source4/ntp_signd/ntp_signd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    NTP packet signing server
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Andrew Tridgell        2005
   8    Copyright (C) Stefan Metzmacher      2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "samba/service_task.h"
  26 #include "samba/service.h"
  27 #include "samba/service_stream.h"
  28 #include "samba/process_model.h"
  29 #include "lib/stream/packet.h"
  30 #include "lib/tsocket/tsocket.h"
  31 #include "libcli/util/tstream.h"
  32 #include "librpc/gen_ndr/ndr_ntp_signd.h"
  33 #include "param/param.h"
  34 #include "dsdb/common/util.h"
  35 #include "dsdb/samdb/samdb.h"
  36 #include "auth/auth.h"
  37 #include "libcli/security/security.h"
  38 #include "libcli/ldap/ldap_ndr.h"
  39 #include <ldb.h>
  40 #include <ldb_errors.h>
  41 #include "system/network.h"
  42 #include "system/passwd.h"
  43
  44 #include "lib/crypto/gnutls_helpers.h"
  45 #include <gnutls/gnutls.h>
  46 #include <gnutls/crypto.h>
  47
  48 NTSTATUS server_service_ntp_signd_init(TALLOC_CTX *);
  49
  50 /*
  51   top level context structure for the ntp_signd server
  52 */
  53 struct ntp_signd_server {
  54         struct task_server *task;
  55         struct ldb_context *samdb;
  56 };
  57
  58 /*
  59   state of an open connection
  60 */
  61 struct ntp_signd_connection {
  62         /* stream connection we belong to */
  63         struct stream_connection *conn;
  64
  65         /* the ntp_signd_server the connection belongs to */
  66         struct ntp_signd_server *ntp_signd;
  67
  68         struct tstream_context *tstream;
  69
  70         struct tevent_queue *send_queue;
  71 };
  72
  73 static void ntp_signd_terminate_connection(struct ntp_signd_connection *ntp_signd_conn, const char *reason)
  74 {
  75         stream_terminate_connection(ntp_signd_conn->conn, reason);
  76 }
  77
  78 static NTSTATUS signing_failure(struct ntp_signd_connection *ntp_signdconn,
  79                                 TALLOC_CTX *mem_ctx,
  80                                 DATA_BLOB *output,
  81                                 uint32_t packet_id)
  82 {
  83         struct signed_reply signed_reply;
  84         enum ndr_err_code ndr_err;
  85
  86         signed_reply.op = SIGNING_FAILURE;
  87         signed_reply.packet_id = packet_id;
  88         signed_reply.signed_packet = data_blob(NULL, 0);
  89
  90         ndr_err = ndr_push_struct_blob(output, mem_ctx, &signed_reply,
  91                                        (ndr_push_flags_fn_t)ndr_push_signed_reply);
  92
  93         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
  94                 DEBUG(1,("failed to push ntp error reply\n"));
  95                 return ndr_map_error2ntstatus(ndr_err);
  96         }
  97
  98         return NT_STATUS_OK;
  99 }
 100
 101 /*
 102   receive a full packet on a NTP_SIGND connection
 103 */
 104 static NTSTATUS ntp_signd_process(struct ntp_signd_connection *ntp_signd_conn,
 105                                   TALLOC_CTX *mem_ctx,
 106                                   DATA_BLOB *input,
 107                                   DATA_BLOB *output)
 108 {
 109         const struct dom_sid *domain_sid;
 110         struct dom_sid *sid;
 111         struct sign_request sign_request;
 112         struct signed_reply signed_reply;
 113         enum ndr_err_code ndr_err;
 114         struct ldb_result *res;
 115         static const char *attrs[] = {
 116                 "unicodePwd",
 117                 "userAccountControl",
 118                 "cn",
 119                 /* Required for Group Managed Service Accounts. */
 120                 "msDS-ManagedPasswordId",
 121                 "msDS-ManagedPasswordInterval",
 122                 "objectClass",
 123                 "objectSid",
 124                 "whenCreated",
 125                 NULL};
 126         gnutls_hash_hd_t hash_hnd = NULL;
 127         struct samr_Password *nt_hash;
 128         uint32_t user_account_control;
 129         struct dom_sid_buf buf;
 130         int ret;
 131
 132         ndr_err = ndr_pull_struct_blob_all(input, mem_ctx,
 133                                            &sign_request,
 134                                            (ndr_pull_flags_fn_t)ndr_pull_sign_request);
 135
 136         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 137                 DEBUG(1,("failed to parse ntp signing request\n"));
 138                 dump_data(1, input->data, input->length);
 139                 return ndr_map_error2ntstatus(ndr_err);
 140         }
 141
 142         /* We need to implement 'check signature' and 'request server
 143          * to sign' operations at some point */
 144         if (sign_request.op != SIGN_TO_CLIENT) {
 145                 return signing_failure(ntp_signd_conn,
 146                                        mem_ctx,
 147                                        output,
 148                                        sign_request.packet_id);
 149         }
 150
 151         /* We need to implement 'check signature' and 'request server
 152          * to sign' operations at some point */
 153         if (sign_request.version != NTP_SIGND_PROTOCOL_VERSION_0) {
 154                 return signing_failure(ntp_signd_conn,
 155                                        mem_ctx,
 156                                        output,
 157                                        sign_request.packet_id);
 158         }
 159
 160         domain_sid = samdb_domain_sid(ntp_signd_conn->ntp_signd->samdb);
 161         if (domain_sid == NULL) {
 162                 return signing_failure(ntp_signd_conn,
 163                                        mem_ctx,
 164                                        output,
 165                                        sign_request.packet_id);
 166         }
 167
 168         /* The top bit is a 'key selector' */
 169         sid = dom_sid_add_rid(mem_ctx, domain_sid,
 170                               sign_request.key_id & 0x7FFFFFFF);
 171         if (sid == NULL) {
 172                 talloc_free(mem_ctx);
 173                 return signing_failure(ntp_signd_conn,
 174                                        mem_ctx,
 175                                        output,
 176                                        sign_request.packet_id);
 177         }
 178
 179         ret = dsdb_search(ntp_signd_conn->ntp_signd->samdb, mem_ctx,
 180                           &res,
 181                           ldb_get_default_basedn(ntp_signd_conn->ntp_signd->samdb),
 182                           LDB_SCOPE_SUBTREE,
 183                           attrs,
 184                           DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
 185                           "(&(objectSid=%s)(objectClass=user))",
 186                           ldap_encode_ndr_dom_sid(mem_ctx, sid));
 187         if (ret != LDB_SUCCESS) {
 188                 DEBUG(2, ("Failed to search for SID %s in SAM for NTP signing: "
 189                           "%s\n",
 190                           dom_sid_str_buf(sid, &buf),
 191                           ldb_errstring(ntp_signd_conn->ntp_signd->samdb)));
 192                 return signing_failure(ntp_signd_conn,
 193                                        mem_ctx,
 194                                        output,
 195                                        sign_request.packet_id);
 196         }
 197
 198         if (res->count == 0) {
 199                 DEBUG(2, ("Failed to find SID %s in SAM for NTP signing\n",
 200                           dom_sid_str_buf(sid, &buf)));
 201                 return signing_failure(ntp_signd_conn,
 202                                        mem_ctx,
 203                                        output,
 204                                        sign_request.packet_id);
 205         } else if (res->count != 1) {
 206                 DEBUG(1, ("Found SID %s %u times in SAM for NTP signing\n",
 207                           dom_sid_str_buf(sid, &buf),
 208                           res->count));
 209                 return signing_failure(ntp_signd_conn,
 210                                        mem_ctx,
 211                                        output,
 212                                        sign_request.packet_id);
 213         }
 214
 215         user_account_control = ldb_msg_find_attr_as_uint(res->msgs[0],
 216                                                          "userAccountControl",
 217                                                          0);
 218
 219         if (user_account_control & UF_ACCOUNTDISABLE) {
 220                 DEBUG(1, ("Account %s for SID [%s] is disabled\n",
 221                           ldb_dn_get_linearized(res->msgs[0]->dn),
 222                           dom_sid_str_buf(sid, &buf)));
 223                 return NT_STATUS_ACCESS_DENIED;
 224         }
 225
 226         if (!(user_account_control & (UF_INTERDOMAIN_TRUST_ACCOUNT|UF_SERVER_TRUST_ACCOUNT|UF_WORKSTATION_TRUST_ACCOUNT))) {
 227                 DEBUG(1, ("Account %s for SID [%s] is not a trust account\n",
 228                           ldb_dn_get_linearized(res->msgs[0]->dn),
 229                           dom_sid_str_buf(sid, &buf)));
 230                 return NT_STATUS_ACCESS_DENIED;
 231         }
 232
 233         nt_hash = samdb_result_hash(mem_ctx, res->msgs[0], "unicodePwd");
 234         if (!nt_hash) {
 235                 DEBUG(1, ("No unicodePwd found on record of SID %s "
 236                           "for NTP signing\n",
 237                           dom_sid_str_buf(sid, &buf)));
 238                 return signing_failure(ntp_signd_conn,
 239                                        mem_ctx,
 240                                        output,
 241                                        sign_request.packet_id);
 242         }
 243
 244         /* Generate the reply packet */
 245         signed_reply.packet_id = sign_request.packet_id;
 246         signed_reply.op = SIGNING_SUCCESS;
 247         signed_reply.signed_packet = data_blob_talloc(mem_ctx,
 248                                                       NULL,
 249                                                       sign_request.packet_to_sign.length + 20);
 250
 251         if (!signed_reply.signed_packet.data) {
 252                 return signing_failure(ntp_signd_conn,
 253                                        mem_ctx,
 254                                        output,
 255                                        sign_request.packet_id);
 256         }
 257
 258         memcpy(signed_reply.signed_packet.data, sign_request.packet_to_sign.data, sign_request.packet_to_sign.length);
 259         SIVAL(signed_reply.signed_packet.data, sign_request.packet_to_sign.length, sign_request.key_id);
 260
 261         /* Sign the NTP response with the unicodePwd */
 262         ret = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_MD5);
 263         if (ret < 0) {
 264                 return gnutls_error_to_ntstatus(ret, NT_STATUS_HASH_NOT_SUPPORTED);
 265         }
 266
 267         ret = gnutls_hash(hash_hnd,
 268                           nt_hash->hash,
 269                           sizeof(nt_hash->hash));
 270         if (ret < 0) {
 271                 gnutls_hash_deinit(hash_hnd, NULL);
 272                 return gnutls_error_to_ntstatus(ret, NT_STATUS_HASH_NOT_SUPPORTED);
 273         }
 274         ret = gnutls_hash(hash_hnd,
 275                           sign_request.packet_to_sign.data,
 276                           sign_request.packet_to_sign.length);
 277         if (ret < 0) {
 278                 gnutls_hash_deinit(hash_hnd, NULL);
 279                 return gnutls_error_to_ntstatus(ret, NT_STATUS_HASH_NOT_SUPPORTED);
 280         }
 281
 282         gnutls_hash_deinit(hash_hnd,
 283                            signed_reply.signed_packet.data +
 284                            sign_request.packet_to_sign.length + 4);
 285
 286         /* Place it into the packet for the wire */
 287         ndr_err = ndr_push_struct_blob(output, mem_ctx, &signed_reply,
 288                                        (ndr_push_flags_fn_t)ndr_push_signed_reply);
 289
 290         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 291                 DEBUG(1,("failed to push ntp error reply\n"));
 292                 return ndr_map_error2ntstatus(ndr_err);
 293         }
 294
 295         return NT_STATUS_OK;
 296 }
 297
 298 /*
 299   called on a tcp recv
 300 */
 301 static void ntp_signd_recv(struct stream_connection *conn, uint16_t flags)
 302 {
 303         struct ntp_signd_connection *ntp_signd_conn = talloc_get_type(conn->private_data,
 304                                                         struct ntp_signd_connection);
 305         ntp_signd_terminate_connection(ntp_signd_conn,
 306                                        "ntp_signd_recv: called");
 307 }
 308
 309 /*
 310   called when we can write to a connection
 311 */
 312 static void ntp_signd_send(struct stream_connection *conn, uint16_t flags)
 313 {
 314         struct ntp_signd_connection *ntp_signd_conn = talloc_get_type(conn->private_data,
 315                                                         struct ntp_signd_connection);
 316         /* this should never be triggered! */
 317         ntp_signd_terminate_connection(ntp_signd_conn,
 318                                        "ntp_signd_send: called");
 319 }
 320
 321 struct ntp_signd_call {
 322         struct ntp_signd_connection *ntp_signd_conn;
 323         DATA_BLOB in;
 324         DATA_BLOB out;
 325         uint8_t out_hdr[4];
 326         struct iovec out_iov[2];
 327 };
 328
 329 static void ntp_signd_call_writev_done(struct tevent_req *subreq);
 330
 331 static void ntp_signd_call_loop(struct tevent_req *subreq)
 332 {
 333         struct ntp_signd_connection *ntp_signd_conn = tevent_req_callback_data(subreq,
 334                                       struct ntp_signd_connection);
 335         struct ntp_signd_call *call;
 336         NTSTATUS status;
 337
 338         call = talloc(ntp_signd_conn, struct ntp_signd_call);
 339         if (call == NULL) {
 340                 ntp_signd_terminate_connection(ntp_signd_conn,
 341                                 "ntp_signd_call_loop: "
 342                                 "no memory for ntp_signd_call");
 343                 return;
 344         }
 345         call->ntp_signd_conn = ntp_signd_conn;
 346
 347         status = tstream_read_pdu_blob_recv(subreq,
 348                                             call,
 349                                             &call->in);
 350         TALLOC_FREE(subreq);
 351         if (!NT_STATUS_IS_OK(status)) {
 352                 const char *reason;
 353
 354                 reason = talloc_asprintf(call, "ntp_signd_call_loop: "
 355                                          "tstream_read_pdu_blob_recv() - %s",
 356                                          nt_errstr(status));
 357                 if (reason == NULL) {
 358                         reason = nt_errstr(status);
 359                 }
 360
 361                 ntp_signd_terminate_connection(ntp_signd_conn, reason);
 362                 return;
 363         }
 364
 365         DEBUG(10,("Received NTP TCP packet of length %lu from %s\n",
 366                  (long) call->in.length,
 367                  tsocket_address_string(ntp_signd_conn->conn->remote_address, call)));
 368
 369         /* skip length header */
 370         call->in.data +=4;
 371         call->in.length -= 4;
 372
 373         status = ntp_signd_process(ntp_signd_conn,
 374                                      call,
 375                                      &call->in,
 376                                      &call->out);
 377         if (! NT_STATUS_IS_OK(status)) {
 378                 const char *reason;
 379
 380                 reason = talloc_asprintf(call, "ntp_signd_process failed: %s",
 381                                          nt_errstr(status));
 382                 if (reason == NULL) {
 383                         reason = nt_errstr(status);
 384                 }
 385
 386                 ntp_signd_terminate_connection(ntp_signd_conn, reason);
 387                 return;
 388         }
 389
 390         /* First add the length of the out buffer */
 391         RSIVAL(call->out_hdr, 0, call->out.length);
 392         call->out_iov[0].iov_base = (char *) call->out_hdr;
 393         call->out_iov[0].iov_len = 4;
 394
 395         call->out_iov[1].iov_base = (char *) call->out.data;
 396         call->out_iov[1].iov_len = call->out.length;
 397
 398         subreq = tstream_writev_queue_send(call,
 399                                            ntp_signd_conn->conn->event.ctx,
 400                                            ntp_signd_conn->tstream,
 401                                            ntp_signd_conn->send_queue,
 402                                            call->out_iov, 2);
 403         if (subreq == NULL) {
 404                 ntp_signd_terminate_connection(ntp_signd_conn, "ntp_signd_call_loop: "
 405                                 "no memory for tstream_writev_queue_send");
 406                 return;
 407         }
 408
 409         tevent_req_set_callback(subreq, ntp_signd_call_writev_done, call);
 410
 411         /*
 412          * The NTP tcp pdu's has the length as 4 byte (initial_read_size),
 413          * tstream_full_request_u32 provides the pdu length then.
 414          */
 415         subreq = tstream_read_pdu_blob_send(ntp_signd_conn,
 416                                             ntp_signd_conn->conn->event.ctx,
 417                                             ntp_signd_conn->tstream,
 418                                             4, /* initial_read_size */
 419                                             tstream_full_request_u32,
 420                                             ntp_signd_conn);
 421         if (subreq == NULL) {
 422                 ntp_signd_terminate_connection(ntp_signd_conn, "ntp_signd_call_loop: "
 423                                 "no memory for tstream_read_pdu_blob_send");
 424                 return;
 425         }
 426         tevent_req_set_callback(subreq, ntp_signd_call_loop, ntp_signd_conn);
 427 }
 428
 429 static void ntp_signd_call_writev_done(struct tevent_req *subreq)
 430 {
 431         struct ntp_signd_call *call = tevent_req_callback_data(subreq,
 432                         struct ntp_signd_call);
 433         int sys_errno;
 434         int rc;
 435
 436         rc = tstream_writev_queue_recv(subreq, &sys_errno);
 437         TALLOC_FREE(subreq);
 438         if (rc == -1) {
 439                 const char *reason;
 440
 441                 reason = talloc_asprintf(call, "ntp_signd_call_writev_done: "
 442                                          "tstream_writev_queue_recv() - %d:%s",
 443                                          sys_errno, strerror(sys_errno));
 444                 if (!reason) {
 445                         reason = "ntp_signd_call_writev_done: "
 446                                  "tstream_writev_queue_recv() failed";
 447                 }
 448
 449                 ntp_signd_terminate_connection(call->ntp_signd_conn, reason);
 450                 return;
 451         }
 452
 453         /* We don't care about errors */
 454
 455         talloc_free(call);
 456 }
 457
 458 /*
 459   called when we get a new connection
 460 */
 461 static void ntp_signd_accept(struct stream_connection *conn)
 462 {
 463         struct ntp_signd_server *ntp_signd = talloc_get_type(conn->private_data,
 464                                                 struct ntp_signd_server);
 465         struct ntp_signd_connection *ntp_signd_conn;
 466         struct tevent_req *subreq;
 467         int rc;
 468
 469         ntp_signd_conn = talloc_zero(conn, struct ntp_signd_connection);
 470         if (ntp_signd_conn == NULL) {
 471                 stream_terminate_connection(conn,
 472                                 "ntp_signd_accept: out of memory");
 473                 return;
 474         }
 475
 476         ntp_signd_conn->send_queue = tevent_queue_create(conn,
 477                         "ntp_signd_accept");
 478         if (ntp_signd_conn->send_queue == NULL) {
 479                 stream_terminate_connection(conn,
 480                                 "ntp_signd_accept: out of memory");
 481                 return;
 482         }
 483
 484         TALLOC_FREE(conn->event.fde);
 485
 486         rc = tstream_bsd_existing_socket(ntp_signd_conn,
 487                         socket_get_fd(conn->socket),
 488                         &ntp_signd_conn->tstream);
 489         if (rc < 0) {
 490                 stream_terminate_connection(conn,
 491                                 "ntp_signd_accept: out of memory");
 492                 return;
 493         }
 494         /* as server we want to fail early */
 495         tstream_bsd_fail_readv_first_error(ntp_signd_conn->tstream, true);
 496
 497         ntp_signd_conn->conn = conn;
 498         ntp_signd_conn->ntp_signd = ntp_signd;
 499         conn->private_data = ntp_signd_conn;
 500
 501         /*
 502          * The NTP tcp pdu's has the length as 4 byte (initial_read_size),
 503          * tstream_full_request_u32 provides the pdu length then.
 504          */
 505         subreq = tstream_read_pdu_blob_send(ntp_signd_conn,
 506                                             ntp_signd_conn->conn->event.ctx,
 507                                             ntp_signd_conn->tstream,
 508                                             4, /* initial_read_size */
 509                                             tstream_full_request_u32,
 510                                             ntp_signd_conn);
 511         if (subreq == NULL) {
 512                 ntp_signd_terminate_connection(ntp_signd_conn,
 513                                 "ntp_signd_accept: "
 514                                 "no memory for tstream_read_pdu_blob_send");
 515                 return;
 516         }
 517         tevent_req_set_callback(subreq, ntp_signd_call_loop, ntp_signd_conn);
 518 }
 519
 520 static const struct stream_server_ops ntp_signd_stream_ops = {
 521         .name                   = "ntp_signd",
 522         .accept_connection      = ntp_signd_accept,
 523         .recv_handler           = ntp_signd_recv,
 524         .send_handler           = ntp_signd_send
 525 };
 526
 527 /*
 528   startup the ntp_signd task
 529 */
 530 static NTSTATUS ntp_signd_task_init(struct task_server *task)
 531 {
 532         struct ntp_signd_server *ntp_signd;
 533         NTSTATUS status;
 534
 535         const char *address;
 536
 537         if (!directory_create_or_exist_strict(lpcfg_ntp_signd_socket_directory(task->lp_ctx), geteuid(), 0750)) {
 538                 char *error = talloc_asprintf(task, "Cannot create NTP signd pipe directory: %s",
 539                                               lpcfg_ntp_signd_socket_directory(task->lp_ctx));
 540                 task_server_terminate(task,
 541                                       error, true);
 542                 return NT_STATUS_UNSUCCESSFUL;
 543         }
 544
 545         task_server_set_title(task, "task[ntp_signd]");
 546
 547         ntp_signd = talloc(task, struct ntp_signd_server);
 548         if (ntp_signd == NULL) {
 549                 task_server_terminate(task, "ntp_signd: out of memory", true);
 550                 return NT_STATUS_NO_MEMORY;
 551         }
 552
 553         ntp_signd->task = task;
 554
 555         /* Must be system to get at the password hashes */
 556         ntp_signd->samdb = samdb_connect(ntp_signd,
 557                                          task->event_ctx,
 558                                          task->lp_ctx,
 559                                          system_session(task->lp_ctx),
 560                                          NULL,
 561                                          0);
 562         if (ntp_signd->samdb == NULL) {
 563                 task_server_terminate(task, "ntp_signd failed to open samdb", true);
 564                 return NT_STATUS_UNSUCCESSFUL;
 565         }
 566
 567         address = talloc_asprintf(ntp_signd, "%s/socket", lpcfg_ntp_signd_socket_directory(task->lp_ctx));
 568         if (address == NULL) {
 569                 task_server_terminate(
 570                     task, "ntp_signd out of memory in talloc_asprintf()", true);
 571                 return NT_STATUS_NO_MEMORY;
 572         }
 573
 574         status = stream_setup_socket(ntp_signd->task,
 575                                      ntp_signd->task->event_ctx,
 576                                      ntp_signd->task->lp_ctx,
 577                                      task->model_ops,
 578                                      &ntp_signd_stream_ops,
 579                                      "unix", address, NULL,
 580                                      lpcfg_socket_options(ntp_signd->task->lp_ctx),
 581                                      ntp_signd,
 582                                      ntp_signd->task->process_context);
 583         if (!NT_STATUS_IS_OK(status)) {
 584                 DEBUG(0,("Failed to bind to %s - %s\n",
 585                          address, nt_errstr(status)));
 586                 return status;
 587         }
 588
 589         return NT_STATUS_OK;
 590
 591 }
 592
 593
 594 /* called at smbd startup - register ourselves as a server service */
 595 NTSTATUS server_service_ntp_signd_init(TALLOC_CTX *ctx)
 596 {
 597         static const struct service_details details = {
 598                 .inhibit_fork_on_accept = true,
 599                 .inhibit_pre_fork = true,
 600                 .task_init = ntp_signd_task_init,
 601                 .post_fork = NULL
 602         };
 603         return register_server_service(ctx, "ntp_signd", &details);
 604 }