summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--source4/dns_server/dns_crypto.c54
-rw-r--r--source4/dns_server/dns_query.c86
-rw-r--r--source4/dns_server/dns_server.h2
-rw-r--r--source4/dns_server/wscript_build2
4 files changed, 88 insertions, 56 deletions
diff --git a/source4/dns_server/dns_crypto.c b/source4/dns_server/dns_crypto.c
new file mode 100644
index 0000000000..4be61f6aac
--- /dev/null
+++ b/source4/dns_server/dns_crypto.c
@@ -0,0 +1,54 @@
+/*
+ Unix SMB/CIFS implementation.
+
+ DNS server handler for signed packets
+
+ Copyright (C) 2012 Kai Blin <kai@samba.org>
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "lib/crypto/hmacmd5.h"
+#include "system/network.h"
+#include "librpc/ndr/libndr.h"
+#include "librpc/gen_ndr/ndr_dns.h"
+#include "dns_server/dns_server.h"
+#include "libcli/util/ntstatus.h"
+#include "auth/auth.h"
+#include "auth/gensec/gensec.h"
+
+struct dns_server_tkey *dns_find_tkey(struct dns_server_tkey_store *store,
+ const char *name)
+{
+ struct dns_server_tkey *tkey = NULL;
+ uint16_t i = 0;
+
+ do {
+ struct dns_server_tkey *tmp_key = store->tkeys[i];
+
+ i++;
+ i %= TKEY_BUFFER_SIZE;
+
+ if (tmp_key == NULL) {
+ continue;
+ }
+ if (dns_name_equal(name, tmp_key->name)) {
+ tkey = tmp_key;
+ break;
+ }
+ } while (i != 0);
+
+ return tkey;
+}
diff --git a/source4/dns_server/dns_query.c b/source4/dns_server/dns_query.c
index 530b7b22bd..00feec0a83 100644
--- a/source4/dns_server/dns_query.c
+++ b/source4/dns_server/dns_query.c
@@ -320,60 +320,6 @@ static WERROR handle_question(struct dns_server *dns,
return WERR_OK;
}
-static NTSTATUS accept_gss_ticket(TALLOC_CTX *mem_ctx,
- struct dns_server *dns,
- struct dns_server_tkey *tkey,
- const DATA_BLOB *key,
- DATA_BLOB *reply,
- uint16_t *dns_auth_error)
-{
- NTSTATUS status;
-
- status = gensec_update(tkey->gensec, mem_ctx, dns->task->event_ctx,
- *key, reply);
-
- if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
- *dns_auth_error = DNS_RCODE_OK;
- return status;
- }
-
- if (NT_STATUS_IS_OK(status)) {
-
- status = gensec_session_info(tkey->gensec, tkey, &tkey->session_info);
- if (!NT_STATUS_IS_OK(status)) {
- *dns_auth_error = DNS_RCODE_BADKEY;
- return status;
- }
- *dns_auth_error = DNS_RCODE_OK;
- }
-
- return status;
-}
-
-static struct dns_server_tkey *find_tkey(struct dns_server_tkey_store *store,
- const char *name)
-{
- struct dns_server_tkey *tkey = NULL;
- uint16_t i = 0;
-
- do {
- struct dns_server_tkey *tmp_key = store->tkeys[i];
-
- i++;
- i %= TKEY_BUFFER_SIZE;
-
- if (tmp_key == NULL) {
- continue;
- }
- if (dns_name_equal(name, tmp_key->name)) {
- tkey = tmp_key;
- break;
- }
- } while (i != 0);
-
- return tkey;
-}
-
static NTSTATUS create_tkey(struct dns_server *dns,
const char* name,
struct dns_server_tkey **tkey)
@@ -428,6 +374,36 @@ static NTSTATUS create_tkey(struct dns_server *dns,
return NT_STATUS_OK;
}
+static NTSTATUS accept_gss_ticket(TALLOC_CTX *mem_ctx,
+ struct dns_server *dns,
+ struct dns_server_tkey *tkey,
+ const DATA_BLOB *key,
+ DATA_BLOB *reply,
+ uint16_t *dns_auth_error)
+{
+ NTSTATUS status;
+
+ status = gensec_update(tkey->gensec, mem_ctx, dns->task->event_ctx,
+ *key, reply);
+
+ if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
+ *dns_auth_error = DNS_RCODE_OK;
+ return status;
+ }
+
+ if (NT_STATUS_IS_OK(status)) {
+
+ status = gensec_session_info(tkey->gensec, tkey, &tkey->session_info);
+ if (!NT_STATUS_IS_OK(status)) {
+ *dns_auth_error = DNS_RCODE_BADKEY;
+ return status;
+ }
+ *dns_auth_error = DNS_RCODE_OK;
+ }
+
+ return status;
+}
+
static WERROR handle_tkey(struct dns_server *dns,
TALLOC_CTX *mem_ctx,
const struct dns_name_packet *in,
@@ -487,7 +463,7 @@ static WERROR handle_tkey(struct dns_server *dns,
DATA_BLOB key;
DATA_BLOB reply;
- tkey = find_tkey(dns->tkeys, in->questions[0].name);
+ tkey = dns_find_tkey(dns->tkeys, in->questions[0].name);
if (tkey != NULL && tkey->complete) {
/* TODO: check if the key is still valid */
DEBUG(1, ("Rejecting tkey negotiation for already established key\n"));
diff --git a/source4/dns_server/dns_server.h b/source4/dns_server/dns_server.h
index 42ae0ba660..74a1ded6f2 100644
--- a/source4/dns_server/dns_server.h
+++ b/source4/dns_server/dns_server.h
@@ -101,6 +101,8 @@ WERROR dns_name2dn(struct dns_server *dns,
TALLOC_CTX *mem_ctx,
const char *name,
struct ldb_dn **_dn);
+struct dns_server_tkey *dns_find_tkey(struct dns_server_tkey_store *store,
+ const char *name);
#define DNS_ERR(err_str) WERR_DNS_ERROR_RCODE_##err_str
#endif /* __DNS_SERVER_H__ */
diff --git a/source4/dns_server/wscript_build b/source4/dns_server/wscript_build
index 48718ee3e7..b8e2708ac8 100644
--- a/source4/dns_server/wscript_build
+++ b/source4/dns_server/wscript_build
@@ -1,7 +1,7 @@
#!/usr/bin/env python
bld.SAMBA_MODULE('service_dns',
- source='dns_server.c dns_query.c dns_update.c dns_utils.c',
+ source='dns_server.c dns_query.c dns_update.c dns_utils.c dns_crypto.c',
subsystem='service',
init_function='server_service_dns_init',
deps='samba-hostconfig LIBTSOCKET LIBSAMBA_TSOCKET ldbsamba clidns gensec auth samba_server_gensec',
generated by cgit (git 2.34.1) at 2024-11-22 05:17:44 +0000