ldap/libkdb_ldap/lockout.c

2N/A/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2N/A/*
2N/A * plugins/kdb/ldap/lockout.c
2N/A *
2N/A * Copyright (C) 2009 by the Massachusetts Institute of Technology.
2N/A * All rights reserved.
2N/A *
2N/A * Export of this software from the United States of America may
2N/A *   require a specific license from the United States Government.
2N/A *   It is the responsibility of any person or organization contemplating
2N/A *   export to obtain such a license before exporting.
2N/A *
2N/A * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
2N/A * distribute this software and its documentation for any purpose and
2N/A * without fee is hereby granted, provided that the above copyright
2N/A * notice appear in all copies and that both that copyright notice and
2N/A * this permission notice appear in supporting documentation, and that
2N/A * the name of M.I.T. not be used in advertising or publicity pertaining
2N/A * to distribution of the software without specific, written prior
2N/A * permission.  Furthermore if you modify this software you must label
2N/A * your software as modified software and not distribute it in such a
2N/A * fashion that it might be confused with the original M.I.T. software.
2N/A * M.I.T. makes no representations about the suitability of
2N/A * this software for any purpose.  It is provided "as is" without express
2N/A * or implied warranty.
2N/A *
2N/A *
2N/A *
2N/A */
2N/A
2N/A#include <stdio.h>
2N/A#include <errno.h>
2N/A
2N/A#include <k5-int.h>
2N/A#include <kadm5/admin.h>
2N/A#include <kdb.h>
2N/A
2N/A#include "kdb_ldap.h"
2N/A#include "princ_xdr.h"
2N/A#include "ldap_principal.h"
2N/A#include "ldap_pwd_policy.h"
2N/A#include "ldap_tkt_policy.h"
2N/A
2N/Astatic krb5_error_code
2N/Alookup_lockout_policy(krb5_context context,
2N/A                      krb5_db_entry *entry,
2N/A                      krb5_kvno *pw_max_fail,
2N/A                      krb5_deltat *pw_failcnt_interval,
2N/A                      krb5_deltat *pw_lockout_duration)
2N/A{
2N/A    krb5_tl_data tl_data;
2N/A    krb5_error_code code;
2N/A    osa_princ_ent_rec adb;
2N/A    XDR xdrs;
2N/A
2N/A    *pw_max_fail = 0;
2N/A    *pw_failcnt_interval = 0;
2N/A    *pw_lockout_duration = 0;
2N/A
2N/A    tl_data.tl_data_type = KRB5_TL_KADM_DATA;
2N/A
2N/A    code = krb5_dbe_lookup_tl_data(context, entry, &tl_data);
2N/A    if (code != 0 || tl_data.tl_data_length == 0)
2N/A        return code;
2N/A
2N/A    memset(&adb, 0, sizeof(adb));
2N/A
2N/A    code = krb5_lookup_tl_kadm_data(&tl_data, &adb);
2N/A    if (code != 0)
2N/A        return code;
2N/A
2N/A    if (adb.policy != NULL) {
2N/A        osa_policy_ent_t policy = NULL;
2N/A        int count = 0;
2N/A
2N/A        code = krb5_ldap_get_password_policy(context, adb.policy,
2N/A                                             &policy, &count);
2N/A        if (code == 0 && count == 1) {
2N/A            *pw_max_fail = policy->pw_max_fail;
2N/A            *pw_failcnt_interval = policy->pw_failcnt_interval;
2N/A            *pw_lockout_duration = policy->pw_lockout_duration;
2N/A        }
2N/A        krb5_ldap_free_password_policy(context, policy);
2N/A    }
2N/A
2N/A    xdrmem_create(&xdrs, NULL, 0, XDR_FREE);
2N/A    ldap_xdr_osa_princ_ent_rec(&xdrs, &adb);
2N/A    xdr_destroy(&xdrs);
2N/A
2N/A    return 0;
2N/A}
2N/A
2N/A/* draft-behera-ldap-password-policy-10.txt 7.1 */
2N/Astatic krb5_boolean
2N/Alocked_check_p(krb5_context context,
2N/A               krb5_timestamp stamp,
2N/A               krb5_kvno max_fail,
2N/A               krb5_timestamp lockout_duration,
2N/A               krb5_db_entry *entry)
2N/A{
2N/A    if (max_fail == 0 || entry->fail_auth_count < max_fail)
2N/A        return FALSE;
2N/A
2N/A    if (lockout_duration == 0)
2N/A        return TRUE; /* principal permanently locked */
2N/A
2N/A    return (stamp < entry->last_failed + lockout_duration);
2N/A}
2N/A
2N/Akrb5_error_code
2N/Akrb5_ldap_lockout_check_policy(krb5_context context,
2N/A                               krb5_db_entry *entry,
2N/A                               krb5_timestamp stamp)
2N/A{
2N/A    krb5_error_code code;
2N/A    krb5_kvno max_fail = 0;
2N/A    krb5_deltat failcnt_interval = 0;
2N/A    krb5_deltat lockout_duration = 0;
2N/A
2N/A    code = lookup_lockout_policy(context, entry, &max_fail,
2N/A                                 &failcnt_interval,
2N/A                                 &lockout_duration);
2N/A    if (code != 0 || failcnt_interval == 0)
2N/A        return code;
2N/A
2N/A    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
2N/A        return KRB5KDC_ERR_CLIENT_REVOKED;
2N/A
2N/A    return 0;
2N/A}
2N/A
2N/Akrb5_error_code
2N/Akrb5_ldap_lockout_audit(krb5_context context,
2N/A                        krb5_db_entry *entry,
2N/A                        krb5_timestamp stamp,
2N/A                        krb5_error_code status)
2N/A{
2N/A    krb5_error_code code;
2N/A    krb5_kvno max_fail = 0;
2N/A    krb5_deltat failcnt_interval = 0;
2N/A    krb5_deltat lockout_duration = 0;
2N/A    int nentries = 1;
2N/A
2N/A    switch (status) {
2N/A    case 0:
2N/A    case KRB5KDC_ERR_PREAUTH_FAILED:
2N/A    case KRB5KRB_AP_ERR_BAD_INTEGRITY:
2N/A        break;
2N/A    default:
2N/A        return 0;
2N/A    }
2N/A
2N/A    if (entry == NULL)
2N/A        return 0;
2N/A
2N/A    code = lookup_lockout_policy(context, entry, &max_fail,
2N/A                                 &failcnt_interval,
2N/A                                 &lockout_duration);
2N/A    if (code != 0)
2N/A        return code;
2N/A
2N/A    /*
2N/A     * Don't continue to modify the DB for an already locked account.
2N/A     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
2N/A     * this check is unneeded, but in rare cases, we can fail with an
2N/A     * integrity error or preauth failure before a policy check.)
2N/A     */
2N/A    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
2N/A        return 0;
2N/A
2N/A    entry->mask = 0;
2N/A
2N/A    if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
2N/A        /*
2N/A         * Only mark the authentication as successful if the entry
2N/A         * required preauthentication, otherwise we have no idea.
2N/A         */
2N/A        entry->fail_auth_count = 0;
2N/A        entry->last_success = stamp;
2N/A        entry->mask |= KADM5_FAIL_AUTH_COUNT | KADM5_LAST_SUCCESS;
2N/A    } else if (status == KRB5KDC_ERR_PREAUTH_FAILED ||
2N/A               status == KRB5KRB_AP_ERR_BAD_INTEGRITY) {
2N/A        if (failcnt_interval != 0 &&
2N/A            stamp > entry->last_failed + failcnt_interval) {
2N/A            /* Reset fail_auth_count after failcnt_interval */
2N/A            entry->fail_auth_count = 0;
2N/A            entry->mask |= KADM5_FAIL_AUTH_COUNT;
2N/A        }
2N/A
2N/A        entry->last_failed = stamp;
2N/A        entry->mask |= KADM5_LAST_FAILED | KADM5_FAIL_AUTH_COUNT_INCREMENT;
2N/A    }
2N/A
2N/A    if (entry->mask) {
2N/A        code = krb5_ldap_put_principal(context, entry,
2N/A                                       &nentries, NULL);
2N/A        if (code != 0)
2N/A            return code;
2N/A    }
2N/A
2N/A    return 0;
2N/A}