diff options
Diffstat (limited to 'source3/librpc/crypto/gse.c')
-rw-r--r-- | source3/librpc/crypto/gse.c | 1034 |
1 files changed, 1034 insertions, 0 deletions
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c new file mode 100644 index 0000000000..c12656b0fa --- /dev/null +++ b/source3/librpc/crypto/gse.c @@ -0,0 +1,1034 @@ +/* + * GSSAPI Security Extensions + * RPC Pipe client and server routines + * Copyright (C) Simo Sorce 2010. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see <http://www.gnu.org/licenses/>. + */ + +/* We support only GSSAPI/KRB5 here */ + +#include "includes.h" +#include "gse.h" + +#if defined(HAVE_KRB5) && defined(HAVE_GSSAPI_GSSAPI_EXT_H) && defined(HAVE_GSS_WRAP_IOV) + +#include "smb_krb5.h" +#include "gse_krb5.h" + +#include <gssapi/gssapi.h> +#include <gssapi/gssapi_krb5.h> +#include <gssapi/gssapi_ext.h> + +#ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID +#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11 +#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05" +#endif + +gss_OID_desc gse_sesskey_inq_oid = { + GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH, + (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID +}; + +#ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID +#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10 +#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04" +#endif + +gss_OID_desc gse_sesskeytype_oid = { + GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH, + (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID +}; + +#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12 +/* EXTRACTION OID AUTHZ ID */ +#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01" + +gss_OID_desc gse_authz_data_oid = { + GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH, + (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID +}; + +#ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID +#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11 +#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c" +#endif + +gss_OID_desc gse_authtime_oid = { + GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH, + (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID +}; + +static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min); + +struct gse_context { + krb5_context k5ctx; + krb5_ccache ccache; + krb5_keytab keytab; + + gss_ctx_id_t gss_ctx; + + gss_OID_desc gss_mech; + OM_uint32 gss_c_flags; + gss_cred_id_t creds; + gss_name_t server_name; + + gss_OID ret_mech; + OM_uint32 ret_flags; + gss_cred_id_t delegated_creds; + gss_name_t client_name; + + bool spnego_wrap; + bool more_processing; + bool authenticated; +}; + +/* free non talloc dependent contexts */ +static int gse_context_destructor(void *ptr) +{ + struct gse_context *gse_ctx; + OM_uint32 gss_min, gss_maj; + + gse_ctx = talloc_get_type_abort(ptr, struct gse_context); + if (gse_ctx->k5ctx) { + if (gse_ctx->ccache) { + krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache); + gse_ctx->ccache = NULL; + } + if (gse_ctx->keytab) { + krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab); + gse_ctx->keytab = NULL; + } + krb5_free_context(gse_ctx->k5ctx); + gse_ctx->k5ctx = NULL; + } + if (gse_ctx->gss_ctx != GSS_C_NO_CONTEXT) { + gss_maj = gss_delete_sec_context(&gss_min, + &gse_ctx->gss_ctx, + GSS_C_NO_BUFFER); + } + if (gse_ctx->server_name) { + gss_maj = gss_release_name(&gss_min, + &gse_ctx->server_name); + } + if (gse_ctx->client_name) { + gss_maj = gss_release_name(&gss_min, + &gse_ctx->client_name); + } + if (gse_ctx->creds) { + gss_maj = gss_release_cred(&gss_min, + &gse_ctx->creds); + } + if (gse_ctx->delegated_creds) { + gss_maj = gss_release_cred(&gss_min, + &gse_ctx->delegated_creds); + } + if (gse_ctx->ret_mech) { + gss_maj = gss_release_oid(&gss_min, + &gse_ctx->ret_mech); + } + return 0; +} + +static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + const char *ccache_name, + uint32_t add_gss_c_flags, + struct gse_context **_gse_ctx) +{ + struct gse_context *gse_ctx; + krb5_error_code k5ret; + NTSTATUS status; + + gse_ctx = talloc_zero(mem_ctx, struct gse_context); + if (!gse_ctx) { + return NT_STATUS_NO_MEMORY; + } + talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor); + + memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc)); + + switch (auth_type) { + case DCERPC_AUTH_TYPE_SPNEGO: + gse_ctx->spnego_wrap = true; + break; + case DCERPC_AUTH_TYPE_KRB5: + gse_ctx->spnego_wrap = false; + break; + default: + status = NT_STATUS_INVALID_PARAMETER; + goto err_out; + } + + gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG | + GSS_C_DELEG_FLAG | + GSS_C_DELEG_POLICY_FLAG | + GSS_C_REPLAY_FLAG | + GSS_C_SEQUENCE_FLAG; + switch (auth_level) { + case DCERPC_AUTH_LEVEL_INTEGRITY: + gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG; + break; + case DCERPC_AUTH_LEVEL_PRIVACY: + gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG; + break; + default: + break; + } + + gse_ctx->gss_c_flags |= add_gss_c_flags; + + /* Initialize Kerberos Context */ + initialize_krb5_error_table(); + + k5ret = krb5_init_context(&gse_ctx->k5ctx); + if (k5ret) { + DEBUG(0, ("Failed to initialize kerberos context! (%s)\n", + error_message(k5ret))); + status = NT_STATUS_INTERNAL_ERROR; + goto err_out; + } + + if (!ccache_name) { + ccache_name = krb5_cc_default_name(gse_ctx->k5ctx); + } + k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name, + &gse_ctx->ccache); + if (k5ret) { + DEBUG(1, ("Failed to resolve credential cache! (%s)\n", + error_message(k5ret))); + status = NT_STATUS_INTERNAL_ERROR; + goto err_out; + } + + /* TODO: Should we enforce a enc_types list ? + ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types); + */ + + *_gse_ctx = gse_ctx; + return NT_STATUS_OK; + +err_out: + TALLOC_FREE(gse_ctx); + return status; +} + +NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + const char *ccache_name, + const char *server, + const char *service, + const char *username, + const char *password, + uint32_t add_gss_c_flags, + struct gse_context **_gse_ctx) +{ + struct gse_context *gse_ctx; + OM_uint32 gss_maj, gss_min; + gss_buffer_desc name_buffer = {0, NULL}; + gss_OID_set_desc mech_set; + NTSTATUS status; + + if (!server || !service) { + return NT_STATUS_INVALID_PARAMETER; + } + + status = gse_context_init(mem_ctx, auth_type, auth_level, + ccache_name, add_gss_c_flags, + &gse_ctx); + if (!NT_STATUS_IS_OK(status)) { + return NT_STATUS_NO_MEMORY; + } + + name_buffer.value = talloc_asprintf(gse_ctx, + "%s@%s", service, server); + if (!name_buffer.value) { + status = NT_STATUS_NO_MEMORY; + goto err_out; + } + name_buffer.length = strlen((char *)name_buffer.value); + gss_maj = gss_import_name(&gss_min, &name_buffer, + GSS_C_NT_HOSTBASED_SERVICE, + &gse_ctx->server_name); + if (gss_maj) { + DEBUG(0, ("gss_import_name failed for %s, with [%s]\n", + (char *)name_buffer.value, + gse_errstr(gse_ctx, gss_maj, gss_min))); + status = NT_STATUS_INTERNAL_ERROR; + goto err_out; + } + + /* TODO: get krb5 ticket using username/password, if no valid + * one already available in ccache */ + + mech_set.count = 1; + mech_set.elements = &gse_ctx->gss_mech; + + gss_maj = gss_acquire_cred(&gss_min, + GSS_C_NO_NAME, + GSS_C_INDEFINITE, + &mech_set, + GSS_C_INITIATE, + &gse_ctx->creds, + NULL, NULL); + if (gss_maj) { + DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n", + (char *)name_buffer.value, + gse_errstr(gse_ctx, gss_maj, gss_min))); + status = NT_STATUS_INTERNAL_ERROR; + goto err_out; + } + + *_gse_ctx = gse_ctx; + TALLOC_FREE(name_buffer.value); + return NT_STATUS_OK; + +err_out: + TALLOC_FREE(name_buffer.value); + TALLOC_FREE(gse_ctx); + return status; +} + +NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + OM_uint32 gss_maj, gss_min; + gss_buffer_desc in_data; + gss_buffer_desc out_data; + DATA_BLOB blob = data_blob_null; + NTSTATUS status; + + in_data.value = token_in->data; + in_data.length = token_in->length; + + gss_maj = gss_init_sec_context(&gss_min, + gse_ctx->creds, + &gse_ctx->gss_ctx, + gse_ctx->server_name, + &gse_ctx->gss_mech, + gse_ctx->gss_c_flags, + 0, GSS_C_NO_CHANNEL_BINDINGS, + &in_data, NULL, &out_data, + NULL, NULL); + switch (gss_maj) { + case GSS_S_COMPLETE: + /* we are done with it */ + gse_ctx->more_processing = false; + status = NT_STATUS_OK; + break; + case GSS_S_CONTINUE_NEEDED: + /* we will need a third leg */ + gse_ctx->more_processing = true; + /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ + status = NT_STATUS_OK; + break; + default: + DEBUG(0, ("gss_init_sec_context failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); + if (!blob.data) { + status = NT_STATUS_NO_MEMORY; + } + + gss_maj = gss_release_buffer(&gss_min, &out_data); + +done: + *token_out = blob; + return status; +} + +NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + uint32_t add_gss_c_flags, + const char *server, + const char *keytab_name, + struct gse_context **_gse_ctx) +{ + struct gse_context *gse_ctx; + OM_uint32 gss_maj, gss_min; + gss_OID_set_desc mech_set; + krb5_error_code ret; + const char *ktname; + NTSTATUS status; + + status = gse_context_init(mem_ctx, auth_type, auth_level, + NULL, add_gss_c_flags, &gse_ctx); + if (!NT_STATUS_IS_OK(status)) { + return NT_STATUS_NO_MEMORY; + } + + if (!keytab_name) { + ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx, + &gse_ctx->keytab); + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx, + gse_ctx->keytab, &ktname); + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + } else { + ktname = keytab_name; + } + + /* FIXME!!! + * This call sets the default keytab for the whole server, not + * just for this context. Need to find a way that does not alter + * the state of the whole server ... */ + ret = gsskrb5_register_acceptor_identity(ktname); + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + mech_set.count = 1; + mech_set.elements = &gse_ctx->gss_mech; + + gss_maj = gss_acquire_cred(&gss_min, + GSS_C_NO_NAME, + GSS_C_INDEFINITE, + &mech_set, + GSS_C_ACCEPT, + &gse_ctx->creds, + NULL, NULL); + if (gss_maj) { + DEBUG(0, ("gss_acquire_creds failed with [%s]\n", + gse_errstr(gse_ctx, gss_maj, gss_min))); + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + status = NT_STATUS_OK; + +done: + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(gse_ctx); + } + + *_gse_ctx = gse_ctx; + return status; +} + +NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + OM_uint32 gss_maj, gss_min; + gss_buffer_desc in_data; + gss_buffer_desc out_data; + DATA_BLOB blob = data_blob_null; + NTSTATUS status; + + in_data.value = token_in->data; + in_data.length = token_in->length; + + gss_maj = gss_accept_sec_context(&gss_min, + &gse_ctx->gss_ctx, + gse_ctx->creds, + &in_data, + GSS_C_NO_CHANNEL_BINDINGS, + &gse_ctx->client_name, + &gse_ctx->ret_mech, + &out_data, + &gse_ctx->ret_flags, NULL, + &gse_ctx->delegated_creds); + switch (gss_maj) { + case GSS_S_COMPLETE: + /* we are done with it */ + gse_ctx->more_processing = false; + gse_ctx->authenticated = true; + status = NT_STATUS_OK; + break; + case GSS_S_CONTINUE_NEEDED: + /* we will need a third leg */ + gse_ctx->more_processing = true; + /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ + status = NT_STATUS_OK; + break; + default: + DEBUG(0, ("gss_init_sec_context failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + + if (gse_ctx->gss_ctx) { + gss_delete_sec_context(&gss_min, + &gse_ctx->gss_ctx, + GSS_C_NO_BUFFER); + } + + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + /* we may be told to return nothing */ + if (out_data.length) { + blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); + if (!blob.data) { + status = NT_STATUS_NO_MEMORY; + } + gss_maj = gss_release_buffer(&gss_min, &out_data); + } + + +done: + *token_out = blob; + return status; +} + +NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) +{ + if (!gse_ctx->authenticated) { + return NT_STATUS_INVALID_HANDLE; + } + + if (memcmp(gse_ctx->ret_mech, + gss_mech_krb5, sizeof(gss_OID_desc)) != 0) { + return NT_STATUS_ACCESS_DENIED; + } + + /* GSS_C_MUTUAL_FLAG */ + if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) { + if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) { + return NT_STATUS_ACCESS_DENIED; + } + } + + /* GSS_C_DELEG_FLAG */ + /* GSS_C_DELEG_POLICY_FLAG */ + /* GSS_C_REPLAY_FLAG */ + /* GSS_C_SEQUENCE_FLAG */ + + /* GSS_C_INTEG_FLAG */ + if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) { + if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) { + return NT_STATUS_ACCESS_DENIED; + } + } + + /* GSS_C_CONF_FLAG */ + if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) { + if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) { + return NT_STATUS_ACCESS_DENIED; + } + } + + return NT_STATUS_OK; +} + +static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_desc msg_min; + gss_buffer_desc msg_maj; + OM_uint32 msg_ctx = 0; + + char *errstr = NULL; + + ZERO_STRUCT(msg_min); + ZERO_STRUCT(msg_maj); + + gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE, + GSS_C_NO_OID, &msg_ctx, &msg_maj); + if (gss_maj) { + goto done; + } + gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE, + (gss_OID)discard_const(gss_mech_krb5), + &msg_ctx, &msg_min); + if (gss_maj) { + goto done; + } + + errstr = talloc_strndup(mem_ctx, + (char *)msg_maj.value, + msg_maj.length); + if (!errstr) { + goto done; + } + errstr = talloc_strdup_append_buffer(errstr, ": "); + if (!errstr) { + goto done; + } + errstr = talloc_strndup_append_buffer(errstr, + (char *)msg_min.value, + msg_min.length); + if (!errstr) { + goto done; + } + +done: + if (msg_min.value) { + gss_maj = gss_release_buffer(&gss_min, &msg_min); + } + if (msg_maj.value) { + gss_maj = gss_release_buffer(&gss_min, &msg_maj); + } + return errstr; +} + +bool gse_require_more_processing(struct gse_context *gse_ctx) +{ + return gse_ctx->more_processing; +} + +DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; + DATA_BLOB ret; + + gss_maj = gss_inquire_sec_context_by_oid( + &gss_min, gse_ctx->gss_ctx, + &gse_sesskey_inq_oid, &set); + if (gss_maj) { + DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return data_blob_null; + } + + if ((set == GSS_C_NO_BUFFER_SET) || + (set->count != 2) || + (memcmp(set->elements[1].value, + gse_sesskeytype_oid.elements, + gse_sesskeytype_oid.length) != 0)) { + DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " + "OID for data in results:\n")); + dump_data(1, (uint8_t *)set->elements[1].value, + set->elements[1].length); + return data_blob_null; + } + + ret = data_blob_talloc(mem_ctx, set->elements[0].value, + set->elements[0].length); + + gss_maj = gss_release_buffer_set(&gss_min, &set); + return ret; +} + +NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, char **cli_name) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_desc name_buffer; + + if (!gse_ctx->authenticated) { + return NT_STATUS_ACCESS_DENIED; + } + + if (!gse_ctx->client_name) { + return NT_STATUS_NOT_FOUND; + } + + /* TODO: check OID matches KRB5 Principal Name OID ? */ + + gss_maj = gss_display_name(&gss_min, + gse_ctx->client_name, + &name_buffer, NULL); + if (gss_maj) { + DEBUG(0, ("gss_display_name failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return NT_STATUS_INTERNAL_ERROR; + } + + *cli_name = talloc_strndup(talloc_tos(), + (char *)name_buffer.value, + name_buffer.length); + + gss_maj = gss_release_buffer(&gss_min, &name_buffer); + + if (!*cli_name) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + +NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, DATA_BLOB *pac) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; + + if (!gse_ctx->authenticated) { + return NT_STATUS_ACCESS_DENIED; + } + + gss_maj = gss_inquire_sec_context_by_oid( + &gss_min, gse_ctx->gss_ctx, + &gse_authz_data_oid, &set); + if (gss_maj) { + DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return NT_STATUS_NOT_FOUND; + } + + if (set == GSS_C_NO_BUFFER_SET) { + DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " + "data in results.\n")); + return NT_STATUS_INTERNAL_ERROR; + } + + /* for now we just hope it is the first value */ + *pac = data_blob_talloc(mem_ctx, + set->elements[0].value, + set->elements[0].length); + + gss_maj = gss_release_buffer_set(&gss_min, &set); + + return NT_STATUS_OK; +} + +NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; + int32_t tkttime; + + if (!gse_ctx->authenticated) { + return NT_STATUS_ACCESS_DENIED; + } + + gss_maj = gss_inquire_sec_context_by_oid( + &gss_min, gse_ctx->gss_ctx, + &gse_authtime_oid, &set); + if (gss_maj) { + DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return NT_STATUS_NOT_FOUND; + } + + if ((set == GSS_C_NO_BUFFER_SET) || (set->count != 1) != 0) { + DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " + "data in results.\n")); + return NT_STATUS_INTERNAL_ERROR; + } + + if (set->elements[0].length != sizeof(int32_t)) { + DEBUG(0, ("Invalid authtime size!\n")); + return NT_STATUS_INTERNAL_ERROR; + } + + tkttime = *((int32_t *)set->elements[0].value); + + gss_maj = gss_release_buffer_set(&gss_min, &set); + + *authtime = (time_t)tkttime; + return NT_STATUS_OK; +} + +size_t gse_get_signature_length(struct gse_context *gse_ctx, + int seal, size_t payload_size) +{ + OM_uint32 gss_min, gss_maj; + gss_iov_buffer_desc iov[2]; + uint8_t fakebuf[payload_size]; + int sealed; + + iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; + iov[0].buffer.value = NULL; + iov[0].buffer.length = 0; + iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; + iov[1].buffer.value = fakebuf; + iov[1].buffer.length = payload_size; + + gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gss_ctx, + seal, GSS_C_QOP_DEFAULT, + &sealed, iov, 2); + if (gss_maj) { + DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return 0; + } + + return iov[0].buffer.length; +} + +NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + OM_uint32 gss_min, gss_maj; + gss_iov_buffer_desc iov[2]; + int req_seal = 1; /* setting to 1 means we request sign+seal */ + int sealed; + NTSTATUS status; + + /* allocate the memory ourselves so we do not need to talloc_memdup */ + signature->length = gse_get_signature_length(gse_ctx, 1, data->length); + if (!signature->length) { + return NT_STATUS_INTERNAL_ERROR; + } + signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length); + if (!signature->data) { + return NT_STATUS_NO_MEMORY; + } + iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; + iov[0].buffer.value = signature->data; + iov[0].buffer.length = signature->length; + + /* data is encrypted in place, which is ok */ + iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; + iov[1].buffer.value = data->data; + iov[1].buffer.length = data->length; + + gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gss_ctx, + req_seal, GSS_C_QOP_DEFAULT, + &sealed, iov, 2); + if (gss_maj) { + DEBUG(0, ("gss_wrap_iov failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + if (!sealed) { + DEBUG(0, ("gss_wrap_iov says data was not sealed!\n")); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + status = NT_STATUS_OK; + + DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n", + (int)iov[1].buffer.length, (int)iov[0].buffer.length)); + +done: + return status; +} + +NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + OM_uint32 gss_min, gss_maj; + gss_iov_buffer_desc iov[2]; + int sealed; + NTSTATUS status; + + iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; + iov[0].buffer.value = signature->data; + iov[0].buffer.length = signature->length; + + /* data is decrypted in place, which is ok */ + iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; + iov[1].buffer.value = data->data; + iov[1].buffer.length = data->length; + + gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gss_ctx, + &sealed, NULL, iov, 2); + if (gss_maj) { + DEBUG(0, ("gss_unwrap_iov failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + if (!sealed) { + DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n")); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + status = NT_STATUS_OK; + + DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n", + (int)iov[1].buffer.length, (int)iov[0].buffer.length)); + +done: + return status; +} + +NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_desc in_data = { 0, NULL }; + gss_buffer_desc out_data = { 0, NULL}; + NTSTATUS status; + + in_data.value = data->data; + in_data.length = data->length; + + gss_maj = gss_get_mic(&gss_min, gse_ctx->gss_ctx, + GSS_C_QOP_DEFAULT, + &in_data, &out_data); + if (gss_maj) { + DEBUG(0, ("gss_get_mic failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + *signature = data_blob_talloc(mem_ctx, + out_data.value, out_data.length); + if (!signature->data) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + + status = NT_STATUS_OK; + +done: + if (out_data.value) { + gss_maj = gss_release_buffer(&gss_min, &out_data); + } + return status; +} + +NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_desc in_data = { 0, NULL }; + gss_buffer_desc in_token = { 0, NULL}; + NTSTATUS status; + + in_data.value = data->data; + in_data.length = data->length; + in_token.value = signature->data; + in_token.length = signature->length; + + gss_maj = gss_verify_mic(&gss_min, gse_ctx->gss_ctx, + &in_data, &in_token, NULL); + if (gss_maj) { + DEBUG(0, ("gss_verify_mic failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + status = NT_STATUS_OK; + +done: + return status; +} + +#else + +NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + const char *ccache_name, + const char *server, + const char *service, + const char *username, + const char *password, + uint32_t add_gss_c_flags, + struct gse_context **_gse_ctx) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + uint32_t add_gss_c_flags, + const char *server, + const char *keytab, + struct gse_context **_gse_ctx) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +bool gse_require_more_processing(struct gse_context *gse_ctx) +{ + return false; +} + +DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx) +{ + return data_blob_null; +} + +NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, char **cli_name) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, DATA_BLOB *pac) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +size_t gse_get_signature_length(struct gse_context *gse_ctx, + int seal, size_t payload_size) +{ + return 0; +} + +NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +#endif /* HAVE_KRB5 && HAVE_GSSAPI_EXT_H && HAVE_GSS_WRAP_IOV */ |