r2284: Thanks to some great detective work by tridge, NTLM2 signing now works.

This means that 'require NTLMv2 session security' now works for RPC
pipe signing.  We don't yet have sealing, but it can't be much further.

This is almost all tridge's code, munged into a form that can work
with the GENSEC API.

This commit also includes more lsakey fixes - that key is used for all
DCE-RPC level authenticated connections, even over CIFS/ncacn_np.

No doubt I missed something, but I'm going to get some sleep :-)

Andrew Bartlett
(This used to be commit a1fe175eec884280fb7e9ca8f528134cf4600beb)

1 files changed, 37 insertions, 21 deletions

diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index 1197329753..ea029d4d7d 100644
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -186,11 +186,10 @@ BOOL dcesrv_auth_auth3(struct dcesrv_call_state *call)
 	return True;
 }
 
-
 /*
   check credentials on a request
 */
-BOOL dcesrv_auth_request(struct dcesrv_call_state *call)
+BOOL dcesrv_auth_request(struct dcesrv_call_state *call, DATA_BLOB *full_packet)
 {
 	struct dcerpc_packet *pkt = &call->pkt;
 	struct dcesrv_connection *dce_conn = call->conn;
@@ -238,6 +237,8 @@ BOOL dcesrv_auth_request(struct dcesrv_call_state *call)
 					      call->mem_ctx,
 					      pkt->u.request.stub_and_verifier.data, 
 					      pkt->u.request.stub_and_verifier.length, 
+					      full_packet->data,
+					      full_packet->length-auth.credentials.length,
 					      &auth.credentials);
 		break;
 
@@ -246,6 +247,8 @@ BOOL dcesrv_auth_request(struct dcesrv_call_state *call)
 					     call->mem_ctx,
 					     pkt->u.request.stub_and_verifier.data, 
 					     pkt->u.request.stub_and_verifier.length,
+					     full_packet->data,
+					     full_packet->length-auth.credentials.length,
 					     &auth.credentials);
 		break;
 
@@ -254,7 +257,7 @@ BOOL dcesrv_auth_request(struct dcesrv_call_state *call)
 		break;
 	}
 
-	/* remove the indicated amount of paddiing */
+	/* remove the indicated amount of padding */
 	if (pkt->u.request.stub_and_verifier.length < auth.auth_pad_length) {
 		return False;
 	}
@@ -298,13 +301,35 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call,
 	dce_conn->auth_state.auth_info->auth_pad_length = NDR_ALIGN(ndr, 8);
 	ndr_push_zero(ndr, dce_conn->auth_state.auth_info->auth_pad_length);
 
+	
+	dce_conn->auth_state.auth_info->credentials
+		= data_blob_talloc(call->mem_ctx, NULL, 
+				   gensec_sig_size(dce_conn->auth_state.gensec_security));
+
+	/* add the auth verifier */
+	status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, dce_conn->auth_state.auth_info);
+	if (!NT_STATUS_IS_OK(status)) {
+		return False;
+	}
+
+	/* extract the whole packet as a blob */
+	*blob = ndr_push_blob(ndr);
+
+	/* fill in the fragment length and auth_length, we can't fill
+	   in these earlier as we don't know the signature length (it
+	   could be variable length) */
+	dcerpc_set_frag_length(blob, blob->length);
+	dcerpc_set_auth_length(blob, dce_conn->auth_state.auth_info->credentials.length);
+
 	/* sign or seal the packet */
 	switch (dce_conn->auth_state.auth_info->auth_level) {
 	case DCERPC_AUTH_LEVEL_PRIVACY:
 		status = gensec_seal_packet(dce_conn->auth_state.gensec_security, 
-					      call->mem_ctx,
-					      ndr->data + DCERPC_REQUEST_LENGTH, 
-					      ndr->offset - DCERPC_REQUEST_LENGTH,
+					    call->mem_ctx,
+					    ndr->data + DCERPC_REQUEST_LENGTH, 
+					    ndr->offset - DCERPC_REQUEST_LENGTH,
+					    blob->data,
+					    blob->length - dce_conn->auth_state.auth_info->credentials.length,
 					      &dce_conn->auth_state.auth_info->credentials);
 		break;
 
@@ -313,7 +338,10 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call,
 					    call->mem_ctx,
 					    ndr->data + DCERPC_REQUEST_LENGTH, 
 					    ndr->offset - DCERPC_REQUEST_LENGTH,
+					    blob->data,
+					    blob->length - dce_conn->auth_state.auth_info->credentials.length,
 					    &dce_conn->auth_state.auth_info->credentials);
+
 		break;
 	default:
 		status = NT_STATUS_INVALID_LEVEL;
@@ -324,21 +352,9 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call,
 		return False;
 	}	
 
-	/* add the auth verifier */
-	status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, dce_conn->auth_state.auth_info);
-	if (!NT_STATUS_IS_OK(status)) {
-		return False;
-	}
-
-	/* extract the whole packet as a blob */
-	*blob = ndr_push_blob(ndr);
-
-	/* fill in the fragment length and auth_length, we can't fill
-	   in these earlier as we don't know the signature length (it
-	   could be variable length) */
-	dcerpc_set_frag_length(blob, blob->length);
-	dcerpc_set_auth_length(blob, dce_conn->auth_state.auth_info->credentials.length);
-
+	memcpy(blob->data + blob->length - dce_conn->auth_state.auth_info->credentials.length, 
+	       dce_conn->auth_state.auth_info->credentials.data, dce_conn->auth_state.auth_info->credentials.length);
+	
 	data_blob_free(&dce_conn->auth_state.auth_info->credentials);
 
 	return True;