diff options
Diffstat (limited to 'source3/librpc')
| -rw-r--r-- | source3/librpc/crypto/cli_spnego.c | 2 | ||||
| -rw-r--r-- | source3/librpc/crypto/gse.c | 135 | ||||
| -rw-r--r-- | source3/librpc/crypto/gse.h | 3 | ||||
| -rw-r--r-- | source3/librpc/crypto/gse_krb5.c | 2 | ||||
| -rw-r--r-- | source3/librpc/idl/messaging.idl | 1 | ||||
| -rw-r--r-- | source3/librpc/idl/notify.idl | 84 | ||||
| -rw-r--r-- | source3/librpc/idl/server_id.idl | 25 | ||||
| -rw-r--r-- | source3/librpc/idl/wscript_build | 4 | ||||
| -rw-r--r-- | source3/librpc/ndr/util.c | 30 | ||||
| -rw-r--r-- | source3/librpc/ndr/util.h | 4 | ||||
| -rw-r--r-- | source3/librpc/rpc/dcerpc.h | 23 | ||||
| -rw-r--r-- | source3/librpc/rpc/dcerpc_ep.c | 7 | ||||
| -rw-r--r-- | source3/librpc/rpc/dcerpc_helpers.c | 1 | ||||
| -rw-r--r-- | source3/librpc/rpc/rpc_common.c | 2 | ||||
| -rw-r--r-- | source3/librpc/wscript_build | 10 |
15 files changed, 94 insertions, 239 deletions
diff --git a/source3/librpc/crypto/cli_spnego.c b/source3/librpc/crypto/cli_spnego.c index bf58e25d9a..e4fdf315aa 100644 --- a/source3/librpc/crypto/cli_spnego.c +++ b/source3/librpc/crypto/cli_spnego.c @@ -99,7 +99,7 @@ NTSTATUS spnego_ntlmssp_init_client(TALLOC_CTX *mem_ctx, sp_ctx->mech = SPNEGO_NTLMSSP; status = auth_ntlmssp_client_start(sp_ctx, - global_myname(), + lp_netbios_name(), lp_workgroup(), lp_client_ntlmv2_auth(), &sp_ctx->mech_ctx.ntlmssp_state); diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c index 0d9eead082..c311c774d4 100644 --- a/source3/librpc/crypto/gse.c +++ b/source3/librpc/crypto/gse.c @@ -27,12 +27,6 @@ #include "smb_krb5.h" #include "gse_krb5.h" -#include <gssapi/gssapi.h> -#include <gssapi/gssapi_krb5.h> -#ifdef HAVE_GSSAPI_GSSAPI_EXT_H -#include <gssapi/gssapi_ext.h> -#endif - #ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05" @@ -62,16 +56,6 @@ gss_OID_desc gse_authz_data_oid = { (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID }; -#ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID -#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11 -#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c" -#endif - -gss_OID_desc gse_authtime_oid = { - GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH, - (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID -}; - static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min); struct gse_context { @@ -95,6 +79,24 @@ struct gse_context { bool authenticated; }; +#ifndef HAVE_GSS_OID_EQUAL + +static bool gss_oid_equal(const gss_OID o1, const gss_OID o2) +{ + if (o1 == o2) { + return true; + } + if ((o1 == NULL && o2 != NULL) || (o1 != NULL && o2 == NULL)) { + return false; + } + if (o1->length != o2->length) { + return false; + } + return memcmp(o1->elements, o2->elements, o1->length) == false; +} + +#endif + /* free non talloc dependent contexts */ static int gse_context_destructor(void *ptr) { @@ -135,10 +137,19 @@ static int gse_context_destructor(void *ptr) gss_maj = gss_release_cred(&gss_min, &gse_ctx->delegated_creds); } - if (gse_ctx->ret_mech) { - gss_maj = gss_release_oid(&gss_min, - &gse_ctx->ret_mech); - } + + /* MIT and Heimdal differ as to if you can call + * gss_release_oid() on this OID, generated by + * gss_{accept,init}_sec_context(). However, as long as the + * oid is gss_mech_krb5 (which it always is at the moment), + * then this is a moot point, as both declare this particular + * OID static, and so no memory is lost. This assert is in + * place to ensure that the programmer who wishes to extend + * this code to EAP or other GSS mechanisms determines an + * implementation-dependent way of releasing any dynamically + * allocated OID */ + SMB_ASSERT(gss_oid_equal(&gse_ctx->gss_mech, GSS_C_NO_OID) || gss_oid_equal(&gse_ctx->gss_mech, gss_mech_krb5)); + return 0; } @@ -348,8 +359,6 @@ NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, OM_uint32 gss_maj, gss_min; krb5_error_code ret; NTSTATUS status; - const char *ktname; - gss_OID_set_desc mech_set; status = gse_context_init(mem_ctx, do_sign, do_seal, NULL, add_gss_c_flags, &gse_ctx); @@ -379,24 +388,27 @@ NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, * This call sets the default keytab for the whole server, not * just for this context. Need to find a way that does not alter * the state of the whole server ... */ + { + const char *ktname; + gss_OID_set_desc mech_set; - ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx, + ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx, gse_ctx->keytab, &ktname); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } - ret = gsskrb5_register_acceptor_identity(ktname); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } + ret = gsskrb5_register_acceptor_identity(ktname); + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } - mech_set.count = 1; - mech_set.elements = &gse_ctx->gss_mech; - - gss_maj = gss_acquire_cred(&gss_min, + mech_set.count = 1; + mech_set.elements = &gse_ctx->gss_mech; + + gss_maj = gss_acquire_cred(&gss_min, GSS_C_NO_NAME, GSS_C_INDEFINITE, &mech_set, @@ -404,11 +416,12 @@ NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, &gse_ctx->creds, NULL, NULL); - if (gss_maj) { - DEBUG(0, ("gss_acquire_creds failed with [%s]\n", - gse_errstr(gse_ctx, gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto done; + if (gss_maj) { + DEBUG(0, ("gss_acquire_creds failed with [%s]\n", + gse_errstr(gse_ctx, gss_maj, gss_min))); + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } } #endif status = NT_STATUS_OK; @@ -692,42 +705,15 @@ NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, return NT_STATUS_OK; } -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) +NTSTATUS gse_get_pac_blob(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, DATA_BLOB *pac_blob) { - OM_uint32 gss_min, gss_maj; - gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; - int32_t tkttime; - if (!gse_ctx->authenticated) { return NT_STATUS_ACCESS_DENIED; } - gss_maj = gss_inquire_sec_context_by_oid( - &gss_min, gse_ctx->gss_ctx, - &gse_authtime_oid, &set); - if (gss_maj) { - DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return NT_STATUS_NOT_FOUND; - } - - if ((set == GSS_C_NO_BUFFER_SET) || (set->count != 1) != 0) { - DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " - "data in results.\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - if (set->elements[0].length != sizeof(int32_t)) { - DEBUG(0, ("Invalid authtime size!\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - tkttime = *((int32_t *)set->elements[0].value); - - gss_maj = gss_release_buffer_set(&gss_min, &set); - - *authtime = (time_t)tkttime; - return NT_STATUS_OK; + return gssapi_obtain_pac_blob(mem_ctx, gse_ctx->gss_ctx, + gse_ctx->client_name, pac_blob); } size_t gse_get_signature_length(struct gse_context *gse_ctx, @@ -982,7 +968,8 @@ NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, return NT_STATUS_NOT_IMPLEMENTED; } -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) +NTSTATUS gse_get_pac_blob(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, DATA_BLOB *pac_blob) { return NT_STATUS_NOT_IMPLEMENTED; } @@ -1017,4 +1004,4 @@ NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, return NT_STATUS_NOT_IMPLEMENTED; } -#endif /* HAVE_KRB5 && HAVE_GSSAPI_EXT_H && HAVE_GSS_WRAP_IOV */ +#endif /* HAVE_KRB5 && HAVE_GSS_WRAP_IOV */ diff --git a/source3/librpc/crypto/gse.h b/source3/librpc/crypto/gse.h index fbcf5b6e10..27cc2e9255 100644 --- a/source3/librpc/crypto/gse.h +++ b/source3/librpc/crypto/gse.h @@ -56,7 +56,8 @@ NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, TALLOC_CTX *mem_ctx, char **client_name); NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *pac); -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime); +NTSTATUS gse_get_pac_blob(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, DATA_BLOB *pac_blob); size_t gse_get_signature_length(struct gse_context *gse_ctx, int seal, size_t payload_size); diff --git a/source3/librpc/crypto/gse_krb5.c b/source3/librpc/crypto/gse_krb5.c index 830d517bc7..81a9a07596 100644 --- a/source3/librpc/crypto/gse_krb5.c +++ b/source3/librpc/crypto/gse_krb5.c @@ -90,7 +90,7 @@ static krb5_error_code get_host_principal(krb5_context krbctx, char *host_princ_s = NULL; int err; - err = asprintf(&host_princ_s, "%s$@%s", global_myname(), lp_realm()); + err = asprintf(&host_princ_s, "%s$@%s", lp_netbios_name(), lp_realm()); if (err == -1) { return -1; } diff --git a/source3/librpc/idl/messaging.idl b/source3/librpc/idl/messaging.idl index 8618d53c9a..0c0672c7a6 100644 --- a/source3/librpc/idl/messaging.idl +++ b/source3/librpc/idl/messaging.idl @@ -75,7 +75,6 @@ interface messaging /* cluster reconfigure events */ MSG_SMB_BRL_VALIDATE = 0x0311, - MSG_SMB_RELEASE_IP = 0x0312, /*Close a specific file given a share entry. */ MSG_SMB_CLOSE_FILE = 0x0313, diff --git a/source3/librpc/idl/notify.idl b/source3/librpc/idl/notify.idl deleted file mode 100644 index 0776ed107c..0000000000 --- a/source3/librpc/idl/notify.idl +++ /dev/null @@ -1,84 +0,0 @@ -#include "idl_types.h" - -import "file_id.idl", "server_id.idl"; - -/* - IDL structures for notify change code - - this defines the structures used in the notify database code, and - the change notify buffers -*/ - -[ - pointer_default(unique) -] -interface notify -{ - - /* structure used in the notify database */ - typedef [public] struct { - server_id server; - uint32 filter; /* filter to apply in this directory */ - uint32 subdir_filter; /* filter to apply in child directories */ - uint32 dir_fd; /* fd of open directory */ - file_id dir_id; /* file_id of open directory */ - utf8string path; - uint32 path_len; /* saves some computation on search */ - pointer private_data; - } notify_entry; - - typedef [public] struct { - uint32 num_entries; - notify_entry entries[num_entries]; - } notify_entry_array; - - /* - to allow for efficient search for matching entries, we - divide them by the directory depth, with a separate array - per depth. The entries within each depth are sorted by path, - allowing for a bisection search. - - The max_mask and max_mask_subdir at each depth is the - bitwise or of the filters and subdir filters for all entries - at that depth. This allows a depth to be quickly skipped if - no entries will match the target filter - */ - typedef struct { - uint32 max_mask; - uint32 max_mask_subdir; - uint32 num_entries; - notify_entry entries[num_entries]; - } notify_depth; - - typedef [public] struct { - uint32 num_depths; - notify_depth depth[num_depths]; - } notify_array; - - /* structure sent between servers in notify messages */ - typedef [public] struct { - uint32 action; - utf8string path; - pointer private_data; - } notify_event; - - typedef [v1_enum] enum { - FILE_ACTION_ADDED = 0x00000001, - FILE_ACTION_REMOVED = 0x00000002, - FILE_ACTION_MODIFIED = 0x00000003, - FILE_ACTION_RENAMED_OLD_NAME = 0x00000004, - FILE_ACTION_RENAMED_NEW_NAME = 0x00000005, - FILE_ACTION_ADDED_STREAM = 0x00000006, - FILE_ACTION_REMOVED_STREAM = 0x00000007, - FILE_ACTION_MODIFIED_STREAM = 0x00000008 - } FILE_NOTIFY_ACTION; - - /* structure sent at the CIFS layer */ - /* Align on 4-byte boundary according to MS-CIFS 2.2.7.4.2 */ - typedef [public,gensize,flag(NDR_ALIGN4)] struct { - uint32 NextEntryOffset; - FILE_NOTIFY_ACTION Action; - [value(strlen_m(FileName1)*2)] uint32 FileNameLength; - [charset(UTF16),flag(STR_NOTERM)] uint16 FileName1[FileNameLength]; - } FILE_NOTIFY_INFORMATION; -} diff --git a/source3/librpc/idl/server_id.idl b/source3/librpc/idl/server_id.idl deleted file mode 100644 index ed727881c7..0000000000 --- a/source3/librpc/idl/server_id.idl +++ /dev/null @@ -1,25 +0,0 @@ -[ - pointer_default(unique) -] -interface server_id -{ - - /* used to look like the following, note that unique_id was not - * marshalled at all... - - struct server_id { - pid_t pid; - #ifdef CLUSTER_SUPPORT - uint32 vnn; - #endif - uint64_t unique_id; - }; - - */ - - typedef [public] struct { - uint32 pid; - uint32 vnn; - udlong unique_id; - } server_id; -} diff --git a/source3/librpc/idl/wscript_build b/source3/librpc/idl/wscript_build index 5a8dc31980..3e07542320 100644 --- a/source3/librpc/idl/wscript_build +++ b/source3/librpc/idl/wscript_build @@ -5,8 +5,8 @@ import os topinclude=os.path.join(bld.srcnode.abspath(), 'librpc/idl') bld.SAMBA_PIDL_LIST('PIDL', - '''messaging.idl libnetapi.idl notify.idl - perfcount.idl secrets.idl libnet_join.idl server_id.idl''', + '''messaging.idl libnetapi.idl + perfcount.idl secrets.idl libnet_join.idl''', options='--includedir=%s --header --ndr-parser' % topinclude, output_dir='../gen_ndr') diff --git a/source3/librpc/ndr/util.c b/source3/librpc/ndr/util.c deleted file mode 100644 index 6bbe054959..0000000000 --- a/source3/librpc/ndr/util.c +++ /dev/null @@ -1,30 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - libndr interface - - Copyright (C) Andrew Tridgell 2003 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see <http://www.gnu.org/licenses/>. -*/ - -#include "includes.h" -#include "../librpc/ndr/libndr.h" -#include "librpc/ndr/util.h" - -_PUBLIC_ void ndr_print_sockaddr_storage(struct ndr_print *ndr, const char *name, const struct sockaddr_storage *ss) -{ - char addr[INET6_ADDRSTRLEN]; - ndr->print(ndr, "%-25s: %s", name, print_sockaddr(addr, sizeof(addr), ss)); -} diff --git a/source3/librpc/ndr/util.h b/source3/librpc/ndr/util.h deleted file mode 100644 index 3bf9c0eb43..0000000000 --- a/source3/librpc/ndr/util.h +++ /dev/null @@ -1,4 +0,0 @@ - -/* The following definitions come from librpc/ndr/util.c */ - -_PUBLIC_ void ndr_print_sockaddr_storage(struct ndr_print *ndr, const char *name, const struct sockaddr_storage *ss); diff --git a/source3/librpc/rpc/dcerpc.h b/source3/librpc/rpc/dcerpc.h index 0a6ddaca17..d7e8e0c193 100644 --- a/source3/librpc/rpc/dcerpc.h +++ b/source3/librpc/rpc/dcerpc.h @@ -33,7 +33,20 @@ #define SMB_RPC_INTERFACE_VERSION 1 struct NL_AUTH_MESSAGE; -struct pipe_auth_data; + +/* auth state for all bind types. */ + +struct pipe_auth_data { + enum dcerpc_AuthType auth_type; + enum dcerpc_AuthLevel auth_level; + + void *auth_ctx; + + /* Only the client code uses these 3 for now */ + char *domain; + char *user_name; + DATA_BLOB user_session_key; +}; /* The following definitions come from librpc/rpc/dcerpc_helpers.c */ NTSTATUS dcerpc_push_ncacn_packet(TALLOC_CTX *mem_ctx, @@ -75,4 +88,12 @@ NTSTATUS dcerpc_check_auth(struct pipe_auth_data *auth, DATA_BLOB *raw_pkt, size_t *pad_len); +/* The following definitions come from librpc/rpc/rpc_common.c */ + +bool smb_register_ndr_interface(const struct ndr_interface_table *interface); +const struct ndr_interface_table *get_iface_from_syntax( + const struct ndr_syntax_id *syntax); +const char *get_pipe_name_from_syntax(TALLOC_CTX *mem_ctx, + const struct ndr_syntax_id *syntax); + #endif /* __S3_DCERPC_H__ */ diff --git a/source3/librpc/rpc/dcerpc_ep.c b/source3/librpc/rpc/dcerpc_ep.c index 76f7e91fb0..3d1acbbee2 100644 --- a/source3/librpc/rpc/dcerpc_ep.c +++ b/source3/librpc/rpc/dcerpc_ep.c @@ -23,6 +23,7 @@ #include "../librpc/gen_ndr/ndr_epmapper_c.h" #include "rpc_client/cli_pipe.h" #include "auth.h" +#include "rpc_server/rpc_ncacn_np.h" #define EPM_MAX_ANNOTATION_SIZE 64 @@ -77,7 +78,7 @@ NTSTATUS dcerpc_binding_vector_create(TALLOC_CTX *mem_ctx, switch (b->transport) { case NCACN_NP: - b->host = talloc_asprintf(b, "\\\\%s", global_myname()); + b->host = talloc_asprintf(b, "\\\\%s", lp_netbios_name()); if (b->host == NULL) { status = NT_STATUS_NO_MEMORY; goto done; @@ -168,7 +169,7 @@ static NTSTATUS ep_register(TALLOC_CTX *mem_ctx, "rpc_server", "epmapper", "none"); - if (StrCaseCmp(rpcsrv_type, "embedded") == 0) { + if (strcasecmp_m(rpcsrv_type, "embedded") == 0) { static struct client_address client_id; strlcpy(client_id.addr, "localhost", sizeof(client_id.addr)); @@ -185,7 +186,7 @@ static NTSTATUS ep_register(TALLOC_CTX *mem_ctx, "epmapper (%s)", nt_errstr(status))); goto done; } - } else if (StrCaseCmp(rpcsrv_type, "daemon") == 0) { + } else if (strcasecmp_m(rpcsrv_type, "daemon") == 0) { /* Connect to the endpoint mapper locally */ ncalrpc_sock = talloc_asprintf(tmp_ctx, "%s/%s", diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c index 7e6990c0ad..7520d767ba 100644 --- a/source3/librpc/rpc/dcerpc_helpers.c +++ b/source3/librpc/rpc/dcerpc_helpers.c @@ -28,7 +28,6 @@ #include "ntlmssp_wrap.h" #include "librpc/crypto/gse.h" #include "librpc/crypto/spnego.h" -#include "ntdomain.h" #undef DBGC_CLASS #define DBGC_CLASS DBGC_RPC_PARSE diff --git a/source3/librpc/rpc/rpc_common.c b/source3/librpc/rpc/rpc_common.c index ed0320adf0..65e3205f62 100644 --- a/source3/librpc/rpc/rpc_common.c +++ b/source3/librpc/rpc/rpc_common.c @@ -18,7 +18,7 @@ */ #include "includes.h" -#include "../librpc/gen_ndr/ndr_schannel.h" +#include "librpc/rpc/dcerpc.h" #include "../librpc/gen_ndr/ndr_lsa.h" #include "../librpc/gen_ndr/ndr_dssetup.h" #include "../librpc/gen_ndr/ndr_samr.h" diff --git a/source3/librpc/wscript_build b/source3/librpc/wscript_build index d99936cc16..a4af551e7f 100644 --- a/source3/librpc/wscript_build +++ b/source3/librpc/wscript_build @@ -10,21 +10,11 @@ bld.SAMBA3_SUBSYSTEM('NDR_LIBNET_JOIN', public_deps='ndr' ) -bld.SAMBA3_SUBSYSTEM('NDR_SERVER_ID', - source='gen_ndr/ndr_server_id.c', - public_deps='ndr' - ) - bld.SAMBA3_SUBSYSTEM('NDR_MESSAGING', source='gen_ndr/ndr_messaging.c', public_deps='ndr NDR_SERVER_ID' ) -bld.SAMBA3_SUBSYSTEM('NDR_NOTIFY3', - source='gen_ndr/ndr_notify.c', - public_deps='ndr NDR_FILE_ID NDR_SERVER_ID' - ) - bld.SAMBA3_SUBSYSTEM('NDR_SECRETS', source='gen_ndr/ndr_secrets.c', public_deps='ndr' |