From a4e9e8f368c8a61d539e9da26e4a16a6234c138f Mon Sep 17 00:00:00 2001

From: Alexander Bokovoy <abokovoy@redhat.com>

Date: Fri, 17 Nov 2017 17:19:25 +0200

Subject: [PATCH] trust: detect and error out when non-AD trust with IPA domain

 name exists

Quite often users choose wrong type of trust on Active Directory side

when setting up a trust to freeIPA. The trust type supported by freeIPA

is just a normal forest trust to another Active Directory. However,

some people follow old internet recipes that force using a trust to MIT

Kerberos realm.

This is a wrong type of trust. Unfortunately, when someone used MIT

Kerberos realm trust, there is no way to programmatically remote the

trust from freeIPA side. As result, we have to detect such situation and

report an error.

To do proper reporting, we need reuse some constants and trust type

names we use in IPA CLI/Web UI. These common components were moved to

a separate ipaserver/dcerpc_common.py module that is imported by both

ipaserver/plugins/trust.py and ipaserver/dcerpc.py.

Fixes https://pagure.io/freeipa/issue/7264

Reviewed-By: Christian Heimes <cheimes@redhat.com>

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>

---

 ipaserver/dcerpc.py        | 37 +++++++++++++++--------

 ipaserver/dcerpc_common.py | 73 ++++++++++++++++++++++++++++++++++++++++++++++

 ipaserver/plugins/trust.py | 65 ++++++++++-------------------------------

 3 files changed, 113 insertions(+), 62 deletions(-)

 create mode 100644 ipaserver/dcerpc_common.py

diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py

index aa63cd9db0a1d47b5309cc6bed2ff7584760a39d..ac1b2a34784df491a3851aa21bbadbec2297241c 100644

--- a/ipaserver/dcerpc.py

+++ b/ipaserver/dcerpc.py

@@ -31,6 +31,10 @@ from ipapython import ipautil

 from ipapython.ipa_log_manager import root_logger

 from ipapython.dn import DN

 from ipaserver.install import installutils

+from ipaserver.dcerpc_common import (TRUST_BIDIRECTIONAL,

+                                     TRUST_JOIN_EXTERNAL,

+                                     trust_type_string)

+

 from ipalib.util import normalize_name

 import os

@@ -77,15 +81,6 @@ The code in this module relies heavily on samba4-python package

 and Samba4 python bindings.

 """)

-# Both constants can be used as masks against trust direction

-# because bi-directional has two lower bits set.

-TRUST_ONEWAY = 1

-TRUST_BIDIRECTIONAL = 3

-

-# Trust join behavior

-# External trust -- allow creating trust to a non-root domain in the forest

-TRUST_JOIN_EXTERNAL = 1

-

 def is_sid_valid(sid):

     try:

@@ -151,6 +146,7 @@ pysss_type_key_translation_dict = {

     pysss_nss_idmap.ID_BOTH: 'both',

 }

+

 class TrustTopologyConflictSolved(Exception):

     """

     Internal trust error: raised when previously detected

@@ -1254,9 +1250,26 @@ class TrustDomainInstance(object):

             dname = lsa.String()

             dname.string = another_domain.info['dns_domain']

             res = self._pipe.QueryTrustedDomainInfoByName(

-                                self._policy_handle,

-                                dname,

-                                lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)

+                self._policy_handle,

+                dname,

+                lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO

+            )

+            if res.info_ex.trust_type != lsa.LSA_TRUST_TYPE_UPLEVEL:

+                msg = _('There is already a trust to {ipa_domain} with '

+                        'unsupported type {trust_type}. Please remove '

+                        'it manually on AD DC side.')

+                ttype = trust_type_string(

+                    res.info_ex.trust_type, res.info_ex.trust_attributes

+                )

+                err = unicode(msg).format(

+                    ipa_domain=another_domain.info['dns_domain'],

+                    trust_type=ttype)

+

+                raise errors.ValidationError(

+                    name=_('AD domain controller'),

+                    error=err

+                )

+

             self._pipe.DeleteTrustedDomain(self._policy_handle,

                                            res.info_ex.sid)

         except RuntimeError as e:

diff --git a/ipaserver/dcerpc_common.py b/ipaserver/dcerpc_common.py

new file mode 100644

index 0000000000000000000000000000000000000000..526b025e3282c8a556088eb2ed1ba467b889b86c

--- /dev/null

+++ b/ipaserver/dcerpc_common.py

@@ -0,0 +1,73 @@

+import six

+from ipalib import _

+if six.PY3:

+    unicode = six.text_type

+

+# Both constants can be used as masks against trust direction

+# because bi-directional has two lower bits set.

+TRUST_ONEWAY = 1

+TRUST_BIDIRECTIONAL = 3

+

+# Trust join behavior

+# External trust -- allow creating trust to a non-root domain in the forest

+TRUST_JOIN_EXTERNAL = 1

+

+# We don't want to import any of Samba Python code here just for constants

+# Since these constants set in MS-ADTS, we can rely on their stability

+LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE = 0x00000001

+

+_trust_direction_dict = {

+        1: _('Trusting forest'),

+        2: _('Trusted forest'),

+        3: _('Two-way trust')

+}

+

+_trust_status_dict = {

+        True: _('Established and verified'),

+        False: _('Waiting for confirmation by remote side')

+}

+

+_trust_type_dict_unknown = _('Unknown')

+

+# Trust type is a combination of ipanttrusttype and ipanttrustattributes

+# We shift trust attributes by 3 bits to left so bit 0 becomes bit 3 and

+# 2+(1 << 3) becomes 10.

+_trust_type_dict = {

+        1: _('Non-Active Directory domain'),

+        2: _('Active Directory domain'),

+        3: _('RFC4120-compliant Kerberos realm'),

+        10: _('Non-transitive external trust to a domain in '

+              'another Active Directory forest'),

+        11: _('Non-transitive external trust to an RFC4120-'

+              'compliant Kerberos realm')

+}

+

+

+def trust_type_string(level, attrs):

+    """

+    Returns a string representing a type of the trust.

+    The original field is an enum:

+      LSA_TRUST_TYPE_DOWNLEVEL  = 0x00000001,

+      LSA_TRUST_TYPE_UPLEVEL    = 0x00000002,

+      LSA_TRUST_TYPE_MIT        = 0x00000003

+    """

+    transitive = int(attrs) & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE

+    string = _trust_type_dict.get(int(level) | (transitive << 3),

+                                  _trust_type_dict_unknown)

+    return unicode(string)

+

+

+def trust_direction_string(level):

+    """

+    Returns a string representing a direction of the trust.

+    The original field is a bitmask taking two bits in use

+      LSA_TRUST_DIRECTION_INBOUND  = 0x00000001,

+      LSA_TRUST_DIRECTION_OUTBOUND = 0x00000002

+    """

+    string = _trust_direction_dict.get(int(level), _trust_type_dict_unknown)

+    return unicode(string)

+

+

+def trust_status_string(level):

+    string = _trust_status_dict.get(level, _trust_type_dict_unknown)

+    return unicode(string)

diff --git a/ipaserver/plugins/trust.py b/ipaserver/plugins/trust.py

index d0bbfbc47ca65c9c5229685fc9d202c293fe41cd..ecc5fa0b22f94de05cc5282758be093f0cfca13f 100644

--- a/ipaserver/plugins/trust.py

+++ b/ipaserver/plugins/trust.py

@@ -44,6 +44,13 @@ from ipalib import errors

 from ipalib import output

 from ldap import SCOPE_SUBTREE

 from time import sleep

+from ipaserver.dcerpc_common import (TRUST_ONEWAY,

+                                     TRUST_BIDIRECTIONAL,

+                                     TRUST_JOIN_EXTERNAL,

+                                     LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE,

+                                     trust_type_string,

+                                     trust_direction_string,

+                                     trust_status_string)

 if six.PY3:

     unicode = str

@@ -63,9 +70,6 @@ except Exception as e:

 if api.env.in_server and api.env.context in ['lite', 'server']:

     try:

         import ipaserver.dcerpc

-        from ipaserver.dcerpc import (TRUST_ONEWAY,

-                                      TRUST_BIDIRECTIONAL,

-                                      TRUST_JOIN_EXTERNAL)

         import dbus

         import dbus.mainloop.glib

         _bindings_installed = True

@@ -157,28 +161,14 @@ particular type.

 register = Registry()

-# Trust type is a combination of ipanttrusttype and ipanttrustattributes

-# We shift trust attributes by 3 bits to left so bit 0 becomes bit 3 and

-# 2+(1 << 3) becomes 10.

-_trust_type_dict = {1 : _('Non-Active Directory domain'),

-                    2 : _('Active Directory domain'),

-                    3 : _('RFC4120-compliant Kerberos realm'),

-                    10: _('Non-transitive external trust to a domain in another Active Directory forest')}

-

-_trust_direction_dict = {1 : _('Trusting forest'),

-                         2 : _('Trusted forest'),

-                         3 : _('Two-way trust')}

-_trust_status_dict = {True : _('Established and verified'),

-                 False : _('Waiting for confirmation by remote side')}

-_trust_type_dict_unknown = _('Unknown')

-

-_trust_type_option = StrEnum('trust_type',

-                        cli_name='type',

-                        label=_('Trust type (ad for Active Directory, default)'),

-                        values=(u'ad',),

-                        default=u'ad',

-                        autofill=True,

-                    )

+_trust_type_option = StrEnum(

+         'trust_type',

+         cli_name='type',

+         label=_('Trust type (ad for Active Directory, default)'),

+         values=(u'ad',),

+         default=u'ad',

+         autofill=True,

+        )

 DEFAULT_RANGE_SIZE = 200000

@@ -187,31 +177,6 @@ DBUS_IFACE_TRUST = 'com.redhat.idm.trust'

 CRED_STYLE_SAMBA = 1

 CRED_STYLE_KERBEROS = 2

-LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE = 0x00000001

-

-def trust_type_string(level, attrs):

-    """

-    Returns a string representing a type of the trust. The original field is an enum:

-      LSA_TRUST_TYPE_DOWNLEVEL  = 0x00000001,

-      LSA_TRUST_TYPE_UPLEVEL    = 0x00000002,

-      LSA_TRUST_TYPE_MIT        = 0x00000003

-    """

-    transitive = int(attrs) & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE

-    string = _trust_type_dict.get(int(level) | (transitive << 3), _trust_type_dict_unknown)

-    return unicode(string)

-

-def trust_direction_string(level):

-    """

-    Returns a string representing a direction of the trust. The original field is a bitmask taking two bits in use

-      LSA_TRUST_DIRECTION_INBOUND  = 0x00000001,

-      LSA_TRUST_DIRECTION_OUTBOUND = 0x00000002

-    """

-    string = _trust_direction_dict.get(int(level), _trust_type_dict_unknown)

-    return unicode(string)

-

-def trust_status_string(level):

-    string = _trust_status_dict.get(level, _trust_type_dict_unknown)

-    return unicode(string)

 def make_trust_dn(env, trust_type, dn):

     assert isinstance(dn, DN)

-- 

2.13.6