summaryrefslogtreecommitdiff
path: root/source3/librpc/crypto
diff options
context:
space:
mode:
Diffstat (limited to 'source3/librpc/crypto')
-rw-r--r--source3/librpc/crypto/gse.c1034
-rw-r--r--source3/librpc/crypto/gse.h77
-rw-r--r--source3/librpc/crypto/gse_krb5.c388
-rw-r--r--source3/librpc/crypto/gse_krb5.h30
4 files changed, 1529 insertions, 0 deletions
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
new file mode 100644
index 0000000000..c12656b0fa
--- /dev/null
+++ b/source3/librpc/crypto/gse.c
@@ -0,0 +1,1034 @@
+/*
+ * GSSAPI Security Extensions
+ * RPC Pipe client and server routines
+ * Copyright (C) Simo Sorce 2010.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* We support only GSSAPI/KRB5 here */
+
+#include "includes.h"
+#include "gse.h"
+
+#if defined(HAVE_KRB5) && defined(HAVE_GSSAPI_GSSAPI_EXT_H) && defined(HAVE_GSS_WRAP_IOV)
+
+#include "smb_krb5.h"
+#include "gse_krb5.h"
+
+#include <gssapi/gssapi.h>
+#include <gssapi/gssapi_krb5.h>
+#include <gssapi/gssapi_ext.h>
+
+#ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
+#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11
+#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05"
+#endif
+
+gss_OID_desc gse_sesskey_inq_oid = {
+ GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH,
+ (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
+};
+
+#ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID
+#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10
+#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04"
+#endif
+
+gss_OID_desc gse_sesskeytype_oid = {
+ GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH,
+ (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID
+};
+
+#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12
+/* EXTRACTION OID AUTHZ ID */
+#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01"
+
+gss_OID_desc gse_authz_data_oid = {
+ GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH,
+ (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID
+};
+
+#ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID
+#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11
+#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c"
+#endif
+
+gss_OID_desc gse_authtime_oid = {
+ GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH,
+ (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID
+};
+
+static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
+
+struct gse_context {
+ krb5_context k5ctx;
+ krb5_ccache ccache;
+ krb5_keytab keytab;
+
+ gss_ctx_id_t gss_ctx;
+
+ gss_OID_desc gss_mech;
+ OM_uint32 gss_c_flags;
+ gss_cred_id_t creds;
+ gss_name_t server_name;
+
+ gss_OID ret_mech;
+ OM_uint32 ret_flags;
+ gss_cred_id_t delegated_creds;
+ gss_name_t client_name;
+
+ bool spnego_wrap;
+ bool more_processing;
+ bool authenticated;
+};
+
+/* free non talloc dependent contexts */
+static int gse_context_destructor(void *ptr)
+{
+ struct gse_context *gse_ctx;
+ OM_uint32 gss_min, gss_maj;
+
+ gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
+ if (gse_ctx->k5ctx) {
+ if (gse_ctx->ccache) {
+ krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
+ gse_ctx->ccache = NULL;
+ }
+ if (gse_ctx->keytab) {
+ krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
+ gse_ctx->keytab = NULL;
+ }
+ krb5_free_context(gse_ctx->k5ctx);
+ gse_ctx->k5ctx = NULL;
+ }
+ if (gse_ctx->gss_ctx != GSS_C_NO_CONTEXT) {
+ gss_maj = gss_delete_sec_context(&gss_min,
+ &gse_ctx->gss_ctx,
+ GSS_C_NO_BUFFER);
+ }
+ if (gse_ctx->server_name) {
+ gss_maj = gss_release_name(&gss_min,
+ &gse_ctx->server_name);
+ }
+ if (gse_ctx->client_name) {
+ gss_maj = gss_release_name(&gss_min,
+ &gse_ctx->client_name);
+ }
+ if (gse_ctx->creds) {
+ gss_maj = gss_release_cred(&gss_min,
+ &gse_ctx->creds);
+ }
+ if (gse_ctx->delegated_creds) {
+ gss_maj = gss_release_cred(&gss_min,
+ &gse_ctx->delegated_creds);
+ }
+ if (gse_ctx->ret_mech) {
+ gss_maj = gss_release_oid(&gss_min,
+ &gse_ctx->ret_mech);
+ }
+ return 0;
+}
+
+static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level,
+ const char *ccache_name,
+ uint32_t add_gss_c_flags,
+ struct gse_context **_gse_ctx)
+{
+ struct gse_context *gse_ctx;
+ krb5_error_code k5ret;
+ NTSTATUS status;
+
+ gse_ctx = talloc_zero(mem_ctx, struct gse_context);
+ if (!gse_ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
+
+ memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
+
+ switch (auth_type) {
+ case DCERPC_AUTH_TYPE_SPNEGO:
+ gse_ctx->spnego_wrap = true;
+ break;
+ case DCERPC_AUTH_TYPE_KRB5:
+ gse_ctx->spnego_wrap = false;
+ break;
+ default:
+ status = NT_STATUS_INVALID_PARAMETER;
+ goto err_out;
+ }
+
+ gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG |
+ GSS_C_DELEG_FLAG |
+ GSS_C_DELEG_POLICY_FLAG |
+ GSS_C_REPLAY_FLAG |
+ GSS_C_SEQUENCE_FLAG;
+ switch (auth_level) {
+ case DCERPC_AUTH_LEVEL_INTEGRITY:
+ gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG;
+ break;
+ case DCERPC_AUTH_LEVEL_PRIVACY:
+ gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG;
+ break;
+ default:
+ break;
+ }
+
+ gse_ctx->gss_c_flags |= add_gss_c_flags;
+
+ /* Initialize Kerberos Context */
+ initialize_krb5_error_table();
+
+ k5ret = krb5_init_context(&gse_ctx->k5ctx);
+ if (k5ret) {
+ DEBUG(0, ("Failed to initialize kerberos context! (%s)\n",
+ error_message(k5ret)));
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto err_out;
+ }
+
+ if (!ccache_name) {
+ ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
+ }
+ k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
+ &gse_ctx->ccache);
+ if (k5ret) {
+ DEBUG(1, ("Failed to resolve credential cache! (%s)\n",
+ error_message(k5ret)));
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto err_out;
+ }
+
+ /* TODO: Should we enforce a enc_types list ?
+ ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
+ */
+
+ *_gse_ctx = gse_ctx;
+ return NT_STATUS_OK;
+
+err_out:
+ TALLOC_FREE(gse_ctx);
+ return status;
+}
+
+NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level,
+ const char *ccache_name,
+ const char *server,
+ const char *service,
+ const char *username,
+ const char *password,
+ uint32_t add_gss_c_flags,
+ struct gse_context **_gse_ctx)
+{
+ struct gse_context *gse_ctx;
+ OM_uint32 gss_maj, gss_min;
+ gss_buffer_desc name_buffer = {0, NULL};
+ gss_OID_set_desc mech_set;
+ NTSTATUS status;
+
+ if (!server || !service) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ status = gse_context_init(mem_ctx, auth_type, auth_level,
+ ccache_name, add_gss_c_flags,
+ &gse_ctx);
+ if (!NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ name_buffer.value = talloc_asprintf(gse_ctx,
+ "%s@%s", service, server);
+ if (!name_buffer.value) {
+ status = NT_STATUS_NO_MEMORY;
+ goto err_out;
+ }
+ name_buffer.length = strlen((char *)name_buffer.value);
+ gss_maj = gss_import_name(&gss_min, &name_buffer,
+ GSS_C_NT_HOSTBASED_SERVICE,
+ &gse_ctx->server_name);
+ if (gss_maj) {
+ DEBUG(0, ("gss_import_name failed for %s, with [%s]\n",
+ (char *)name_buffer.value,
+ gse_errstr(gse_ctx, gss_maj, gss_min)));
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto err_out;
+ }
+
+ /* TODO: get krb5 ticket using username/password, if no valid
+ * one already available in ccache */
+
+ mech_set.count = 1;
+ mech_set.elements = &gse_ctx->gss_mech;
+
+ gss_maj = gss_acquire_cred(&gss_min,
+ GSS_C_NO_NAME,
+ GSS_C_INDEFINITE,
+ &mech_set,
+ GSS_C_INITIATE,
+ &gse_ctx->creds,
+ NULL, NULL);
+ if (gss_maj) {
+ DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n",
+ (char *)name_buffer.value,
+ gse_errstr(gse_ctx, gss_maj, gss_min)));
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto err_out;
+ }
+
+ *_gse_ctx = gse_ctx;
+ TALLOC_FREE(name_buffer.value);
+ return NT_STATUS_OK;
+
+err_out:
+ TALLOC_FREE(name_buffer.value);
+ TALLOC_FREE(gse_ctx);
+ return status;
+}
+
+NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx,
+ DATA_BLOB *token_in,
+ DATA_BLOB *token_out)
+{
+ OM_uint32 gss_maj, gss_min;
+ gss_buffer_desc in_data;
+ gss_buffer_desc out_data;
+ DATA_BLOB blob = data_blob_null;
+ NTSTATUS status;
+
+ in_data.value = token_in->data;
+ in_data.length = token_in->length;
+
+ gss_maj = gss_init_sec_context(&gss_min,
+ gse_ctx->creds,
+ &gse_ctx->gss_ctx,
+ gse_ctx->server_name,
+ &gse_ctx->gss_mech,
+ gse_ctx->gss_c_flags,
+ 0, GSS_C_NO_CHANNEL_BINDINGS,
+ &in_data, NULL, &out_data,
+ NULL, NULL);
+ switch (gss_maj) {
+ case GSS_S_COMPLETE:
+ /* we are done with it */
+ gse_ctx->more_processing = false;
+ status = NT_STATUS_OK;
+ break;
+ case GSS_S_CONTINUE_NEEDED:
+ /* we will need a third leg */
+ gse_ctx->more_processing = true;
+ /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
+ status = NT_STATUS_OK;
+ break;
+ default:
+ DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+
+ blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
+ if (!blob.data) {
+ status = NT_STATUS_NO_MEMORY;
+ }
+
+ gss_maj = gss_release_buffer(&gss_min, &out_data);
+
+done:
+ *token_out = blob;
+ return status;
+}
+
+NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level,
+ uint32_t add_gss_c_flags,
+ const char *server,
+ const char *keytab_name,
+ struct gse_context **_gse_ctx)
+{
+ struct gse_context *gse_ctx;
+ OM_uint32 gss_maj, gss_min;
+ gss_OID_set_desc mech_set;
+ krb5_error_code ret;
+ const char *ktname;
+ NTSTATUS status;
+
+ status = gse_context_init(mem_ctx, auth_type, auth_level,
+ NULL, add_gss_c_flags, &gse_ctx);
+ if (!NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!keytab_name) {
+ ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
+ &gse_ctx->keytab);
+ if (ret) {
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+ ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx,
+ gse_ctx->keytab, &ktname);
+ if (ret) {
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+ } else {
+ ktname = keytab_name;
+ }
+
+ /* FIXME!!!
+ * This call sets the default keytab for the whole server, not
+ * just for this context. Need to find a way that does not alter
+ * the state of the whole server ... */
+ ret = gsskrb5_register_acceptor_identity(ktname);
+ if (ret) {
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+
+ mech_set.count = 1;
+ mech_set.elements = &gse_ctx->gss_mech;
+
+ gss_maj = gss_acquire_cred(&gss_min,
+ GSS_C_NO_NAME,
+ GSS_C_INDEFINITE,
+ &mech_set,
+ GSS_C_ACCEPT,
+ &gse_ctx->creds,
+ NULL, NULL);
+ if (gss_maj) {
+ DEBUG(0, ("gss_acquire_creds failed with [%s]\n",
+ gse_errstr(gse_ctx, gss_maj, gss_min)));
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+
+ status = NT_STATUS_OK;
+
+done:
+ if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(gse_ctx);
+ }
+
+ *_gse_ctx = gse_ctx;
+ return status;
+}
+
+NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx,
+ DATA_BLOB *token_in,
+ DATA_BLOB *token_out)
+{
+ OM_uint32 gss_maj, gss_min;
+ gss_buffer_desc in_data;
+ gss_buffer_desc out_data;
+ DATA_BLOB blob = data_blob_null;
+ NTSTATUS status;
+
+ in_data.value = token_in->data;
+ in_data.length = token_in->length;
+
+ gss_maj = gss_accept_sec_context(&gss_min,
+ &gse_ctx->gss_ctx,
+ gse_ctx->creds,
+ &in_data,
+ GSS_C_NO_CHANNEL_BINDINGS,
+ &gse_ctx->client_name,
+ &gse_ctx->ret_mech,
+ &out_data,
+ &gse_ctx->ret_flags, NULL,
+ &gse_ctx->delegated_creds);
+ switch (gss_maj) {
+ case GSS_S_COMPLETE:
+ /* we are done with it */
+ gse_ctx->more_processing = false;
+ gse_ctx->authenticated = true;
+ status = NT_STATUS_OK;
+ break;
+ case GSS_S_CONTINUE_NEEDED:
+ /* we will need a third leg */
+ gse_ctx->more_processing = true;
+ /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
+ status = NT_STATUS_OK;
+ break;
+ default:
+ DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+
+ if (gse_ctx->gss_ctx) {
+ gss_delete_sec_context(&gss_min,
+ &gse_ctx->gss_ctx,
+ GSS_C_NO_BUFFER);
+ }
+
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+
+ /* we may be told to return nothing */
+ if (out_data.length) {
+ blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
+ if (!blob.data) {
+ status = NT_STATUS_NO_MEMORY;
+ }
+ gss_maj = gss_release_buffer(&gss_min, &out_data);
+ }
+
+
+done:
+ *token_out = blob;
+ return status;
+}
+
+NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
+{
+ if (!gse_ctx->authenticated) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (memcmp(gse_ctx->ret_mech,
+ gss_mech_krb5, sizeof(gss_OID_desc)) != 0) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ /* GSS_C_MUTUAL_FLAG */
+ if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) {
+ if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ }
+
+ /* GSS_C_DELEG_FLAG */
+ /* GSS_C_DELEG_POLICY_FLAG */
+ /* GSS_C_REPLAY_FLAG */
+ /* GSS_C_SEQUENCE_FLAG */
+
+ /* GSS_C_INTEG_FLAG */
+ if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) {
+ if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ }
+
+ /* GSS_C_CONF_FLAG */
+ if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) {
+ if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
+static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_buffer_desc msg_min;
+ gss_buffer_desc msg_maj;
+ OM_uint32 msg_ctx = 0;
+
+ char *errstr = NULL;
+
+ ZERO_STRUCT(msg_min);
+ ZERO_STRUCT(msg_maj);
+
+ gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
+ GSS_C_NO_OID, &msg_ctx, &msg_maj);
+ if (gss_maj) {
+ goto done;
+ }
+ gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
+ (gss_OID)discard_const(gss_mech_krb5),
+ &msg_ctx, &msg_min);
+ if (gss_maj) {
+ goto done;
+ }
+
+ errstr = talloc_strndup(mem_ctx,
+ (char *)msg_maj.value,
+ msg_maj.length);
+ if (!errstr) {
+ goto done;
+ }
+ errstr = talloc_strdup_append_buffer(errstr, ": ");
+ if (!errstr) {
+ goto done;
+ }
+ errstr = talloc_strndup_append_buffer(errstr,
+ (char *)msg_min.value,
+ msg_min.length);
+ if (!errstr) {
+ goto done;
+ }
+
+done:
+ if (msg_min.value) {
+ gss_maj = gss_release_buffer(&gss_min, &msg_min);
+ }
+ if (msg_maj.value) {
+ gss_maj = gss_release_buffer(&gss_min, &msg_maj);
+ }
+ return errstr;
+}
+
+bool gse_require_more_processing(struct gse_context *gse_ctx)
+{
+ return gse_ctx->more_processing;
+}
+
+DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
+ DATA_BLOB ret;
+
+ gss_maj = gss_inquire_sec_context_by_oid(
+ &gss_min, gse_ctx->gss_ctx,
+ &gse_sesskey_inq_oid, &set);
+ if (gss_maj) {
+ DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ return data_blob_null;
+ }
+
+ if ((set == GSS_C_NO_BUFFER_SET) ||
+ (set->count != 2) ||
+ (memcmp(set->elements[1].value,
+ gse_sesskeytype_oid.elements,
+ gse_sesskeytype_oid.length) != 0)) {
+ DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
+ "OID for data in results:\n"));
+ dump_data(1, (uint8_t *)set->elements[1].value,
+ set->elements[1].length);
+ return data_blob_null;
+ }
+
+ ret = data_blob_talloc(mem_ctx, set->elements[0].value,
+ set->elements[0].length);
+
+ gss_maj = gss_release_buffer_set(&gss_min, &set);
+ return ret;
+}
+
+NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
+ TALLOC_CTX *mem_ctx, char **cli_name)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_buffer_desc name_buffer;
+
+ if (!gse_ctx->authenticated) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ if (!gse_ctx->client_name) {
+ return NT_STATUS_NOT_FOUND;
+ }
+
+ /* TODO: check OID matches KRB5 Principal Name OID ? */
+
+ gss_maj = gss_display_name(&gss_min,
+ gse_ctx->client_name,
+ &name_buffer, NULL);
+ if (gss_maj) {
+ DEBUG(0, ("gss_display_name failed [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ *cli_name = talloc_strndup(talloc_tos(),
+ (char *)name_buffer.value,
+ name_buffer.length);
+
+ gss_maj = gss_release_buffer(&gss_min, &name_buffer);
+
+ if (!*cli_name) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ return NT_STATUS_OK;
+}
+
+NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
+ TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
+
+ if (!gse_ctx->authenticated) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ gss_maj = gss_inquire_sec_context_by_oid(
+ &gss_min, gse_ctx->gss_ctx,
+ &gse_authz_data_oid, &set);
+ if (gss_maj) {
+ DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ return NT_STATUS_NOT_FOUND;
+ }
+
+ if (set == GSS_C_NO_BUFFER_SET) {
+ DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
+ "data in results.\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ /* for now we just hope it is the first value */
+ *pac = data_blob_talloc(mem_ctx,
+ set->elements[0].value,
+ set->elements[0].length);
+
+ gss_maj = gss_release_buffer_set(&gss_min, &set);
+
+ return NT_STATUS_OK;
+}
+
+NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
+ int32_t tkttime;
+
+ if (!gse_ctx->authenticated) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ gss_maj = gss_inquire_sec_context_by_oid(
+ &gss_min, gse_ctx->gss_ctx,
+ &gse_authtime_oid, &set);
+ if (gss_maj) {
+ DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ return NT_STATUS_NOT_FOUND;
+ }
+
+ if ((set == GSS_C_NO_BUFFER_SET) || (set->count != 1) != 0) {
+ DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
+ "data in results.\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ if (set->elements[0].length != sizeof(int32_t)) {
+ DEBUG(0, ("Invalid authtime size!\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ tkttime = *((int32_t *)set->elements[0].value);
+
+ gss_maj = gss_release_buffer_set(&gss_min, &set);
+
+ *authtime = (time_t)tkttime;
+ return NT_STATUS_OK;
+}
+
+size_t gse_get_signature_length(struct gse_context *gse_ctx,
+ int seal, size_t payload_size)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_iov_buffer_desc iov[2];
+ uint8_t fakebuf[payload_size];
+ int sealed;
+
+ iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
+ iov[0].buffer.value = NULL;
+ iov[0].buffer.length = 0;
+ iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
+ iov[1].buffer.value = fakebuf;
+ iov[1].buffer.length = payload_size;
+
+ gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gss_ctx,
+ seal, GSS_C_QOP_DEFAULT,
+ &sealed, iov, 2);
+ if (gss_maj) {
+ DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ return 0;
+ }
+
+ return iov[0].buffer.length;
+}
+
+NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_iov_buffer_desc iov[2];
+ int req_seal = 1; /* setting to 1 means we request sign+seal */
+ int sealed;
+ NTSTATUS status;
+
+ /* allocate the memory ourselves so we do not need to talloc_memdup */
+ signature->length = gse_get_signature_length(gse_ctx, 1, data->length);
+ if (!signature->length) {
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+ signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length);
+ if (!signature->data) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
+ iov[0].buffer.value = signature->data;
+ iov[0].buffer.length = signature->length;
+
+ /* data is encrypted in place, which is ok */
+ iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
+ iov[1].buffer.value = data->data;
+ iov[1].buffer.length = data->length;
+
+ gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gss_ctx,
+ req_seal, GSS_C_QOP_DEFAULT,
+ &sealed, iov, 2);
+ if (gss_maj) {
+ DEBUG(0, ("gss_wrap_iov failed with [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ status = NT_STATUS_ACCESS_DENIED;
+ goto done;
+ }
+
+ if (!sealed) {
+ DEBUG(0, ("gss_wrap_iov says data was not sealed!\n"));
+ status = NT_STATUS_ACCESS_DENIED;
+ goto done;
+ }
+
+ status = NT_STATUS_OK;
+
+ DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n",
+ (int)iov[1].buffer.length, (int)iov[0].buffer.length));
+
+done:
+ return status;
+}
+
+NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_iov_buffer_desc iov[2];
+ int sealed;
+ NTSTATUS status;
+
+ iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
+ iov[0].buffer.value = signature->data;
+ iov[0].buffer.length = signature->length;
+
+ /* data is decrypted in place, which is ok */
+ iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
+ iov[1].buffer.value = data->data;
+ iov[1].buffer.length = data->length;
+
+ gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gss_ctx,
+ &sealed, NULL, iov, 2);
+ if (gss_maj) {
+ DEBUG(0, ("gss_unwrap_iov failed with [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ status = NT_STATUS_ACCESS_DENIED;
+ goto done;
+ }
+
+ if (!sealed) {
+ DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n"));
+ status = NT_STATUS_ACCESS_DENIED;
+ goto done;
+ }
+
+ status = NT_STATUS_OK;
+
+ DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n",
+ (int)iov[1].buffer.length, (int)iov[0].buffer.length));
+
+done:
+ return status;
+}
+
+NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_buffer_desc in_data = { 0, NULL };
+ gss_buffer_desc out_data = { 0, NULL};
+ NTSTATUS status;
+
+ in_data.value = data->data;
+ in_data.length = data->length;
+
+ gss_maj = gss_get_mic(&gss_min, gse_ctx->gss_ctx,
+ GSS_C_QOP_DEFAULT,
+ &in_data, &out_data);
+ if (gss_maj) {
+ DEBUG(0, ("gss_get_mic failed with [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ status = NT_STATUS_ACCESS_DENIED;
+ goto done;
+ }
+
+ *signature = data_blob_talloc(mem_ctx,
+ out_data.value, out_data.length);
+ if (!signature->data) {
+ status = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ status = NT_STATUS_OK;
+
+done:
+ if (out_data.value) {
+ gss_maj = gss_release_buffer(&gss_min, &out_data);
+ }
+ return status;
+}
+
+NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_buffer_desc in_data = { 0, NULL };
+ gss_buffer_desc in_token = { 0, NULL};
+ NTSTATUS status;
+
+ in_data.value = data->data;
+ in_data.length = data->length;
+ in_token.value = signature->data;
+ in_token.length = signature->length;
+
+ gss_maj = gss_verify_mic(&gss_min, gse_ctx->gss_ctx,
+ &in_data, &in_token, NULL);
+ if (gss_maj) {
+ DEBUG(0, ("gss_verify_mic failed with [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ status = NT_STATUS_ACCESS_DENIED;
+ goto done;
+ }
+
+ status = NT_STATUS_OK;
+
+done:
+ return status;
+}
+
+#else
+
+NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level,
+ const char *ccache_name,
+ const char *server,
+ const char *service,
+ const char *username,
+ const char *password,
+ uint32_t add_gss_c_flags,
+ struct gse_context **_gse_ctx)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx,
+ DATA_BLOB *token_in,
+ DATA_BLOB *token_out)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level,
+ uint32_t add_gss_c_flags,
+ const char *server,
+ const char *keytab,
+ struct gse_context **_gse_ctx)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx,
+ DATA_BLOB *token_in,
+ DATA_BLOB *token_out)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+bool gse_require_more_processing(struct gse_context *gse_ctx)
+{
+ return false;
+}
+
+DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx)
+{
+ return data_blob_null;
+}
+
+NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
+ TALLOC_CTX *mem_ctx, char **cli_name)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
+ TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+size_t gse_get_signature_length(struct gse_context *gse_ctx,
+ int seal, size_t payload_size)
+{
+ return 0;
+}
+
+NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+#endif /* HAVE_KRB5 && HAVE_GSSAPI_EXT_H && HAVE_GSS_WRAP_IOV */
diff --git a/source3/librpc/crypto/gse.h b/source3/librpc/crypto/gse.h
new file mode 100644
index 0000000000..6f8b6735ad
--- /dev/null
+++ b/source3/librpc/crypto/gse.h
@@ -0,0 +1,77 @@
+/*
+ * GSSAPI Security Extensions
+ * RPC Pipe client routines
+ * Copyright (C) Simo Sorce 2010.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _GSE_H_
+#define _GSE_H_
+
+struct gse_context;
+
+#ifndef GSS_C_DCE_STYLE
+#define GSS_C_DCE_STYLE 0x1000
+#endif
+
+NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level,
+ const char *ccache_name,
+ const char *server,
+ const char *service,
+ const char *username,
+ const char *password,
+ uint32_t add_gss_c_flags,
+ struct gse_context **_gse_ctx);
+NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx,
+ DATA_BLOB *token_in,
+ DATA_BLOB *token_out);
+
+NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level,
+ uint32_t add_gss_c_flags,
+ const char *server,
+ const char *keytab,
+ struct gse_context **_gse_ctx);
+NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx,
+ DATA_BLOB *token_in,
+ DATA_BLOB *token_out);
+NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx);
+
+bool gse_require_more_processing(struct gse_context *gse_ctx);
+DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx);
+NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
+ TALLOC_CTX *mem_ctx, char **client_name);
+NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
+ TALLOC_CTX *mem_ctx, DATA_BLOB *pac);
+NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime);
+
+size_t gse_get_signature_length(struct gse_context *gse_ctx,
+ int seal, size_t payload_size);
+NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature);
+NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature);
+NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature);
+NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
+ DATA_BLOB *data, DATA_BLOB *signature);
+
+#endif /* _GSE_H_ */
diff --git a/source3/librpc/crypto/gse_krb5.c b/source3/librpc/crypto/gse_krb5.c
new file mode 100644
index 0000000000..735dff059e
--- /dev/null
+++ b/source3/librpc/crypto/gse_krb5.c
@@ -0,0 +1,388 @@
+/*
+ * GSSAPI Security Extensions
+ * Krb5 helpers
+ * Copyright (C) Simo Sorce 2010.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "includes.h"
+#include "smb_krb5.h"
+#include "secrets.h"
+#include "gse_krb5.h"
+
+#ifdef HAVE_KRB5
+
+static krb5_error_code flush_keytab(krb5_context krbctx, krb5_keytab keytab)
+{
+ krb5_error_code ret;
+ krb5_kt_cursor kt_cursor;
+ krb5_keytab_entry kt_entry;
+
+ ZERO_STRUCT(kt_entry);
+
+ ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor);
+ if (ret == KRB5_KT_END || ret == ENOENT ) {
+ /* no entries */
+ return 0;
+ }
+
+ ret = krb5_kt_next_entry(krbctx, keytab, &kt_entry, &kt_cursor);
+ while (ret == 0) {
+
+ /* we need to close and reopen enumeration because we modify
+ * the keytab */
+ ret = krb5_kt_end_seq_get(krbctx, keytab, &kt_cursor);
+ if (ret) {
+ DEBUG(1, (__location__ ": krb5_kt_end_seq_get() "
+ "failed (%s)\n", error_message(ret)));
+ goto out;
+ }
+
+ /* remove the entry */
+ ret = krb5_kt_remove_entry(krbctx, keytab, &kt_entry);
+ if (ret) {
+ DEBUG(1, (__location__ ": krb5_kt_remove_entry() "
+ "failed (%s)\n", error_message(ret)));
+ goto out;
+ }
+ ret = smb_krb5_kt_free_entry(krbctx, &kt_entry);
+ ZERO_STRUCT(kt_entry);
+
+ /* now reopen */
+ ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor);
+ if (ret) {
+ DEBUG(1, (__location__ ": krb5_kt_start_seq() failed "
+ "(%s)\n", error_message(ret)));
+ goto out;
+ }
+
+ ret = krb5_kt_next_entry(krbctx, keytab,
+ &kt_entry, &kt_cursor);
+ }
+
+ if (ret != KRB5_KT_END && ret != ENOENT) {
+ DEBUG(1, (__location__ ": flushing keytab we got [%s]!\n",
+ error_message(ret)));
+ }
+
+ ret = 0;
+
+out:
+ return ret;
+}
+
+static krb5_error_code get_host_principal(krb5_context krbctx,
+ krb5_principal *host_princ)
+{
+ krb5_error_code ret;
+ char *host_princ_s = NULL;
+ int err;
+
+ err = asprintf(&host_princ_s, "%s$@%s", global_myname(), lp_realm());
+ if (err == -1) {
+ return -1;
+ }
+
+ strlower_m(host_princ_s);
+ ret = smb_krb5_parse_name(krbctx, host_princ_s, host_princ);
+ if (ret) {
+ DEBUG(1, (__location__ ": smb_krb5_parse_name(%s) "
+ "failed (%s)\n",
+ host_princ_s, error_message(ret)));
+ }
+
+ SAFE_FREE(host_princ_s);
+ return ret;
+}
+
+static krb5_error_code fill_keytab_from_password(krb5_context krbctx,
+ krb5_keytab keytab,
+ krb5_principal princ,
+ krb5_kvno vno,
+ krb5_data *password)
+{
+ krb5_error_code ret;
+ krb5_enctype *enctypes;
+ krb5_keytab_entry kt_entry;
+ unsigned int i;
+
+ ret = get_kerberos_allowed_etypes(krbctx, &enctypes);
+ if (ret) {
+ DEBUG(1, (__location__
+ ": Can't determine permitted enctypes!\n"));
+ return ret;
+ }
+
+ for (i = 0; enctypes[i]; i++) {
+ krb5_keyblock *key = NULL;
+
+ if (!(key = SMB_MALLOC_P(krb5_keyblock))) {
+ ret = ENOMEM;
+ goto out;
+ }
+
+ if (create_kerberos_key_from_string(krbctx, princ,
+ password, key,
+ enctypes[i], false)) {
+ DEBUG(10, ("Failed to create key for enctype %d "
+ "(error: %s)\n",
+ enctypes[i], error_message(ret)));
+ SAFE_FREE(key);
+ continue;
+ }
+
+ kt_entry.principal = princ;
+ kt_entry.vno = vno;
+ *(KRB5_KT_KEY(&kt_entry)) = *key;
+
+ ret = krb5_kt_add_entry(krbctx, keytab, &kt_entry);
+ if (ret) {
+ DEBUG(1, (__location__ ": Failed to add entry to "
+ "keytab for enctype %d (error: %s)\n",
+ enctypes[i], error_message(ret)));
+ krb5_free_keyblock(krbctx, key);
+ goto out;
+ }
+
+ krb5_free_keyblock(krbctx, key);
+ }
+
+ ret = 0;
+
+out:
+ SAFE_FREE(enctypes);
+ return ret;
+}
+
+#define SRV_MEM_KEYTAB_NAME "MEMORY:cifs_srv_keytab"
+#define CLEARTEXT_PRIV_ENCTYPE -99
+
+static krb5_error_code get_mem_keytab_from_secrets(krb5_context krbctx,
+ krb5_keytab *keytab)
+{
+ krb5_error_code ret;
+ char *pwd = NULL;
+ size_t pwd_len;
+ krb5_kt_cursor kt_cursor;
+ krb5_keytab_entry kt_entry;
+ krb5_data password;
+ krb5_principal princ = NULL;
+ krb5_kvno kvno = 0; /* FIXME: fetch current vno from KDC ? */
+ char *pwd_old = NULL;
+
+ if (!secrets_init()) {
+ DEBUG(1, (__location__ ": secrets_init failed\n"));
+ return KRB5_CONFIG_CANTOPEN;
+ }
+
+ pwd = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
+ if (!pwd) {
+ DEBUG(2, (__location__ ": failed to fetch machine password\n"));
+ return KRB5_LIBOS_CANTREADPWD;
+ }
+ pwd_len = strlen(pwd);
+
+ if (*keytab == NULL) {
+ /* create memory keytab */
+ ret = krb5_kt_resolve(krbctx, SRV_MEM_KEYTAB_NAME, keytab);
+ if (ret) {
+ DEBUG(1, (__location__ ": Failed to get memory "
+ "keytab!\n"));
+ return ret;
+ }
+ }
+
+ ZERO_STRUCT(kt_entry);
+ ZERO_STRUCT(kt_cursor);
+
+ /* check if the keytab already has any entry */
+ ret = krb5_kt_start_seq_get(krbctx, *keytab, &kt_cursor);
+ if (ret != KRB5_KT_END && ret != ENOENT ) {
+ /* check if we have our special enctype used to hold
+ * the clear text password. If so, check it out so that
+ * we can verify if the keytab needs to be upgraded */
+ while ((ret = krb5_kt_next_entry(krbctx, *keytab,
+ &kt_entry, &kt_cursor)) == 0) {
+ if (smb_get_enctype_from_kt_entry(&kt_entry) == CLEARTEXT_PRIV_ENCTYPE) {
+ break;
+ }
+ smb_krb5_kt_free_entry(krbctx, &kt_entry);
+ ZERO_STRUCT(kt_entry);
+ }
+
+ if (ret != 0 && ret != KRB5_KT_END && ret != ENOENT ) {
+ /* Error parsing keytab */
+ DEBUG(1, (__location__ ": Failed to parse memory "
+ "keytab!\n"));
+ goto out;
+ }
+
+ if (ret == 0) {
+ /* found private entry,
+ * check if keytab is up to date */
+
+ if ((pwd_len == KRB5_KEY_LENGTH(KRB5_KT_KEY(&kt_entry))) &&
+ (memcmp(KRB5_KEY_DATA(KRB5_KT_KEY(&kt_entry)),
+ pwd, pwd_len) == 0)) {
+ /* keytab is already up to date, return */
+ smb_krb5_kt_free_entry(krbctx, &kt_entry);
+ goto out;
+ }
+
+ smb_krb5_kt_free_entry(krbctx, &kt_entry);
+ ZERO_STRUCT(kt_entry);
+
+
+ /* flush keytab, we need to regen it */
+ ret = flush_keytab(krbctx, *keytab);
+ if (ret) {
+ DEBUG(1, (__location__ ": Failed to flush "
+ "memory keytab!\n"));
+ goto out;
+ }
+ }
+ }
+
+ {
+ krb5_kt_cursor zero_csr;
+ ZERO_STRUCT(zero_csr);
+ if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && *keytab) {
+ krb5_kt_end_seq_get(krbctx, *keytab, &kt_cursor);
+ }
+ }
+
+ /* keytab is not up to date, fill it up */
+
+ ret = get_host_principal(krbctx, &princ);
+ if (ret) {
+ DEBUG(1, (__location__ ": Failed to get host principal!\n"));
+ goto out;
+ }
+
+ password.data = pwd;
+ password.length = pwd_len;
+ ret = fill_keytab_from_password(krbctx, *keytab,
+ princ, kvno, &password);
+ if (ret) {
+ DEBUG(1, (__location__ ": Failed to fill memory keytab!\n"));
+ goto out;
+ }
+
+ pwd_old = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
+ if (!pwd_old) {
+ DEBUG(10, (__location__ ": no prev machine password\n"));
+ } else {
+ password.data = pwd_old;
+ password.length = strlen(pwd_old);
+ ret = fill_keytab_from_password(krbctx, *keytab,
+ princ, kvno -1, &password);
+ if (ret) {
+ DEBUG(1, (__location__
+ ": Failed to fill memory keytab!\n"));
+ goto out;
+ }
+ }
+
+ /* add our private enctype + cleartext password so that we can
+ * update the keytab if secrets change later on */
+ ZERO_STRUCT(kt_entry);
+ kt_entry.principal = princ;
+ kt_entry.vno = 0;
+
+ KRB5_KEY_TYPE(KRB5_KT_KEY(&kt_entry)) = CLEARTEXT_PRIV_ENCTYPE;
+ KRB5_KEY_LENGTH(KRB5_KT_KEY(&kt_entry)) = pwd_len;
+ KRB5_KEY_DATA(KRB5_KT_KEY(&kt_entry)) = (uint8_t *)pwd;
+
+ ret = krb5_kt_add_entry(krbctx, *keytab, &kt_entry);
+ if (ret) {
+ DEBUG(1, (__location__ ": Failed to add entry to "
+ "keytab for private enctype (%d) (error: %s)\n",
+ CLEARTEXT_PRIV_ENCTYPE, error_message(ret)));
+ goto out;
+ }
+
+ ret = 0;
+
+out:
+ SAFE_FREE(pwd);
+ SAFE_FREE(pwd_old);
+
+ {
+ krb5_kt_cursor zero_csr;
+ ZERO_STRUCT(zero_csr);
+ if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && *keytab) {
+ krb5_kt_end_seq_get(krbctx, *keytab, &kt_cursor);
+ }
+ }
+
+ if (princ) {
+ krb5_free_principal(krbctx, princ);
+ }
+
+ if (ret) {
+ if (*keytab) {
+ krb5_kt_close(krbctx, *keytab);
+ *keytab = NULL;
+ }
+ }
+
+ return ret;
+}
+
+static krb5_error_code get_mem_keytab_from_system_keytab(krb5_context krbctx,
+ krb5_keytab *keytab,
+ bool verify)
+{
+ return KRB5_KT_NOTFOUND;
+}
+
+krb5_error_code gse_krb5_get_server_keytab(krb5_context krbctx,
+ krb5_keytab *keytab)
+{
+ krb5_error_code ret;
+
+ *keytab = NULL;
+
+ switch (lp_kerberos_method()) {
+ default:
+ case KERBEROS_VERIFY_SECRETS:
+ ret = get_mem_keytab_from_secrets(krbctx, keytab);
+ break;
+ case KERBEROS_VERIFY_SYSTEM_KEYTAB:
+ ret = get_mem_keytab_from_system_keytab(krbctx, keytab, true);
+ break;
+ case KERBEROS_VERIFY_DEDICATED_KEYTAB:
+ /* just use whatever keytab is configured */
+ ret = get_mem_keytab_from_system_keytab(krbctx, keytab, false);
+ break;
+ case KERBEROS_VERIFY_SECRETS_AND_KEYTAB:
+ ret = get_mem_keytab_from_secrets(krbctx, keytab);
+ if (ret) {
+ DEBUG(3, (__location__ ": Warning! Unable to set mem "
+ "keytab from secrets!\n"));
+ }
+ /* Now append system keytab keys too */
+ ret = get_mem_keytab_from_system_keytab(krbctx, keytab, true);
+ if (ret) {
+ DEBUG(3, (__location__ ": Warning! Unable to set mem "
+ "keytab from secrets!\n"));
+ }
+ break;
+ }
+
+ return ret;
+}
+
+#endif /* HAVE_KRB5 */
diff --git a/source3/librpc/crypto/gse_krb5.h b/source3/librpc/crypto/gse_krb5.h
new file mode 100644
index 0000000000..ea789c947a
--- /dev/null
+++ b/source3/librpc/crypto/gse_krb5.h
@@ -0,0 +1,30 @@
+/*
+ * GSSAPI Security Extensions
+ * Krb5 helpers
+ * Copyright (C) Simo Sorce 2010.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _GSE_KRB5_H_
+#define _GSE_KRB5_H_
+
+#ifdef HAVE_KRB5
+
+krb5_error_code gse_krb5_get_server_keytab(krb5_context krbctx,
+ krb5_keytab *keytab);
+
+#endif /* HAVE_KRB5 */
+
+#endif /* _GSE_KRB5_H_ */
generated by cgit (git 2.34.1) at 2024-11-27 19:07:31 +0000