summaryrefslogtreecommitdiff
path: root/source4/rpc_server
diff options
context:
space:
mode:
Diffstat (limited to 'source4/rpc_server')
-rw-r--r--source4/rpc_server/config.mk1
-rw-r--r--source4/rpc_server/dcerpc_server.c2
-rw-r--r--source4/rpc_server/dcerpc_server.h2
-rw-r--r--source4/rpc_server/dcesrv_auth.c95
-rw-r--r--source4/rpc_server/dcesrv_crypto.c122
-rw-r--r--source4/rpc_server/epmapper/rpc_epmapper.c4
-rw-r--r--source4/rpc_server/netlogon/dcerpc_netlogon.c9
-rw-r--r--source4/rpc_server/samr/samr_password.c8
8 files changed, 173 insertions, 70 deletions
diff --git a/source4/rpc_server/config.mk b/source4/rpc_server/config.mk
index da6adaa220..4f8b4796fd 100644
--- a/source4/rpc_server/config.mk
+++ b/source4/rpc_server/config.mk
@@ -122,6 +122,7 @@ INIT_OBJ_FILES = \
ADD_OBJ_FILES = \
rpc_server/dcerpc_tcp.o \
rpc_server/dcesrv_auth.o \
+ rpc_server/dcesrv_crypto.o \
rpc_server/handles.o
#
# End SUBSYSTEM DCERPC
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index 683be7225b..fd806c5289 100644
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -268,7 +268,7 @@ NTSTATUS dcesrv_endpoint_connect(struct dcesrv_context *dce_ctx,
(*p)->cli_max_recv_frag = 0;
(*p)->handles = NULL;
(*p)->partial_input = data_blob(NULL, 0);
- (*p)->auth_state.ntlmssp_state = NULL;
+ (*p)->auth_state.crypto_state = NULL;
(*p)->auth_state.auth_info = NULL;
(*p)->session_key = data_blob(NULL, 0);
diff --git a/source4/rpc_server/dcerpc_server.h b/source4/rpc_server/dcerpc_server.h
index 2d833ebd58..bdda8f252f 100644
--- a/source4/rpc_server/dcerpc_server.h
+++ b/source4/rpc_server/dcerpc_server.h
@@ -95,7 +95,7 @@ struct dcesrv_handle {
/* hold the authentication state information */
struct dcesrv_auth {
- struct auth_ntlmssp_state *ntlmssp_state;
+ void *crypto_state;
struct dcerpc_auth *auth_info;
};
diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index 48792180c6..7aa296c245 100644
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -22,7 +22,6 @@
#include "includes.h"
-
/*
parse any auth information from a dcerpc bind request
return False if we can't handle the auth request for some
@@ -52,24 +51,11 @@ BOOL dcesrv_auth_bind(struct dcesrv_call_state *call)
return False;
}
- if (dce_conn->auth_state.auth_info->auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
- /* only do NTLMSSP for now */
- DEBUG(2,("auth_type %d not supported\n", dce_conn->auth_state.auth_info->auth_type));
- return False;
- }
-
- if (dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_INTEGRITY &&
- dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
- DEBUG(2,("auth_level %d not supported\n", dce_conn->auth_state.auth_info->auth_level));
- return False;
- }
-
- status = auth_ntlmssp_start(&dce_conn->auth_state.ntlmssp_state);
+ status = dcesrv_crypto_startup(dce_conn, &dce_conn->auth_state);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(2, ("Failed to start NTLMSSP subsystem!\n"));
return False;
}
-
+
return True;
}
@@ -81,17 +67,17 @@ BOOL dcesrv_auth_bind_ack(struct dcesrv_call_state *call, struct dcerpc_packet *
struct dcesrv_connection *dce_conn = call->conn;
NTSTATUS status;
- if (!call->conn->auth_state.ntlmssp_state) {
+ if (!call->conn->auth_state.crypto_state) {
return True;
}
- status = auth_ntlmssp_update(dce_conn->auth_state.ntlmssp_state,
- call->mem_ctx,
- dce_conn->auth_state.auth_info->credentials,
- &dce_conn->auth_state.auth_info->credentials);
+ status = dcesrv_crypto_update(&dce_conn->auth_state,
+ call->mem_ctx,
+ dce_conn->auth_state.auth_info->credentials,
+ &dce_conn->auth_state.auth_info->credentials);
if (!NT_STATUS_IS_OK(status) &&
!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
- DEBUG(2, ("Failed to start NTLMSSP process NTLMSSP negotiate: %s\n", nt_errstr(status)));
+ DEBUG(2, ("Failed to start dcesrv auth negotiate: %s\n", nt_errstr(status)));
return False;
}
@@ -103,7 +89,7 @@ BOOL dcesrv_auth_bind_ack(struct dcesrv_call_state *call, struct dcerpc_packet *
/*
- process the final stage of a NTLMSSP auth request
+ process the final stage of a auth request
*/
BOOL dcesrv_auth_auth3(struct dcesrv_call_state *call)
{
@@ -112,7 +98,7 @@ BOOL dcesrv_auth_auth3(struct dcesrv_call_state *call)
NTSTATUS status;
if (!dce_conn->auth_state.auth_info ||
- !dce_conn->auth_state.ntlmssp_state ||
+ !dce_conn->auth_state.crypto_state ||
pkt->u.auth.auth_info.length == 0) {
return False;
}
@@ -125,20 +111,13 @@ BOOL dcesrv_auth_auth3(struct dcesrv_call_state *call)
return False;
}
- if (dce_conn->auth_state.auth_info->auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
- return False;
- }
- if (dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_INTEGRITY &&
- dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
- return False;
- }
-
- status = auth_ntlmssp_update(dce_conn->auth_state.ntlmssp_state,
- call->mem_ctx,
- dce_conn->auth_state.auth_info->credentials,
- &dce_conn->auth_state.auth_info->credentials);
+ status = dcesrv_crypto_update(&dce_conn->auth_state,
+ call->mem_ctx,
+ dce_conn->auth_state.auth_info->credentials,
+ &dce_conn->auth_state.auth_info->credentials);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(4, ("User failed to authenticated with NTLMSSP: %s\n", nt_errstr(status)));
+ DEBUG(4, ("dcesrv_auth_auth3: failed to authenticate: %s\n",
+ nt_errstr(status)));
return False;
}
@@ -159,7 +138,7 @@ BOOL dcesrv_auth_request(struct dcesrv_call_state *call)
NTSTATUS status;
if (!dce_conn->auth_state.auth_info ||
- !dce_conn->auth_state.ntlmssp_state) {
+ !dce_conn->auth_state.crypto_state) {
return True;
}
@@ -193,21 +172,21 @@ BOOL dcesrv_auth_request(struct dcesrv_call_state *call)
/* check signature or unseal the packet */
switch (dce_conn->auth_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
- status = ntlmssp_unseal_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
- call->mem_ctx,
- pkt->u.request.stub_and_verifier.data,
- pkt->u.request.stub_and_verifier.length,
- &auth.credentials);
- break;
-
- case DCERPC_AUTH_LEVEL_INTEGRITY:
- status = ntlmssp_check_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
+ status = dcesrv_crypto_unseal(&dce_conn->auth_state,
call->mem_ctx,
pkt->u.request.stub_and_verifier.data,
pkt->u.request.stub_and_verifier.length,
&auth.credentials);
break;
+ case DCERPC_AUTH_LEVEL_INTEGRITY:
+ status = dcesrv_crypto_check_sig(&dce_conn->auth_state,
+ call->mem_ctx,
+ pkt->u.request.stub_and_verifier.data,
+ pkt->u.request.stub_and_verifier.length,
+ &auth.credentials);
+ break;
+
default:
status = NT_STATUS_INVALID_LEVEL;
break;
@@ -234,7 +213,7 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call,
struct ndr_push *ndr;
/* non-signed packets are simple */
- if (!dce_conn->auth_state.auth_info || !dce_conn->auth_state.ntlmssp_state) {
+ if (!dce_conn->auth_state.auth_info || !dce_conn->auth_state.crypto_state) {
status = dcerpc_push_auth(blob, call->mem_ctx, pkt, NULL);
return NT_STATUS_IS_OK(status);
}
@@ -260,19 +239,19 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call,
/* sign or seal the packet */
switch (dce_conn->auth_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
- status = ntlmssp_seal_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
- call->mem_ctx,
- ndr->data + DCERPC_REQUEST_LENGTH,
- ndr->offset - DCERPC_REQUEST_LENGTH,
- &dce_conn->auth_state.auth_info->credentials);
+ status = dcesrv_crypto_seal(&dce_conn->auth_state,
+ call->mem_ctx,
+ ndr->data + DCERPC_REQUEST_LENGTH,
+ ndr->offset - DCERPC_REQUEST_LENGTH,
+ &dce_conn->auth_state.auth_info->credentials);
break;
case DCERPC_AUTH_LEVEL_INTEGRITY:
- status = ntlmssp_sign_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
- call->mem_ctx,
- ndr->data + DCERPC_REQUEST_LENGTH,
- ndr->offset - DCERPC_REQUEST_LENGTH,
- &dce_conn->auth_state.auth_info->credentials);
+ status = dcesrv_crypto_sign(&dce_conn->auth_state,
+ call->mem_ctx,
+ ndr->data + DCERPC_REQUEST_LENGTH,
+ ndr->offset - DCERPC_REQUEST_LENGTH,
+ &dce_conn->auth_state.auth_info->credentials);
break;
default:
status = NT_STATUS_INVALID_LEVEL;
diff --git a/source4/rpc_server/dcesrv_crypto.c b/source4/rpc_server/dcesrv_crypto.c
new file mode 100644
index 0000000000..64ff4ee30b
--- /dev/null
+++ b/source4/rpc_server/dcesrv_crypto.c
@@ -0,0 +1,122 @@
+/*
+ Unix SMB/CIFS implementation.
+
+ server side dcerpc authentication code - crypto support
+
+ Copyright (C) Andrew Tridgell 2004
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+/*
+ this provides a crypto interface to the various backends (such as
+ NTLMSSP and SCHANNEL) for the rpc server code
+*/
+
+#include "includes.h"
+
+/*
+ startup the cryptographic side of an authenticated dcerpc server
+*/
+NTSTATUS dcesrv_crypto_startup(struct dcesrv_connection *dce_conn,
+ struct dcesrv_auth *auth)
+{
+ struct auth_ntlmssp_state *ntlmssp = NULL;
+ NTSTATUS status;
+
+ if (auth->auth_info->auth_level != DCERPC_AUTH_LEVEL_INTEGRITY &&
+ auth->auth_info->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
+ DEBUG(2,("auth_level %d not supported in dcesrv auth\n",
+ auth->auth_info->auth_level));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ switch (auth->auth_info->auth_type) {
+/*
+ case DCERPC_AUTH_TYPE_SCHANNEL:
+ return auth_schannel_start();
+*/
+
+ case DCERPC_AUTH_TYPE_NTLMSSP:
+ status = auth_ntlmssp_start(&ntlmssp);
+ auth->crypto_state = ntlmssp;
+ break;
+
+ default:
+ DEBUG(2,("dcesrv auth_type %d not supported\n", auth->auth_info->auth_type));
+ status = NT_STATUS_INVALID_PARAMETER;
+ }
+
+ DEBUG(4,("dcesrv_crypto_startup: %s\n", nt_errstr(status)));
+
+ return status;
+}
+
+/*
+ update crypto state
+*/
+NTSTATUS dcesrv_crypto_update(struct dcesrv_auth *auth,
+ TALLOC_CTX *out_mem_ctx,
+ const DATA_BLOB in, DATA_BLOB *out)
+{
+ AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+ return ntlmssp_update(ntlmssp->ntlmssp_state, out_mem_ctx, in, out);
+}
+
+
+/*
+ seal a packet
+*/
+NTSTATUS dcesrv_crypto_seal(struct dcesrv_auth *auth,
+ TALLOC_CTX *sig_mem_ctx, uint8_t *data, size_t length, DATA_BLOB *sig)
+{
+ AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+ return ntlmssp_seal_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
+
+/*
+ sign a packet
+*/
+NTSTATUS dcesrv_crypto_sign(struct dcesrv_auth *auth,
+ TALLOC_CTX *sig_mem_ctx, const uint8_t *data, size_t length, DATA_BLOB *sig)
+{
+ AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+ return ntlmssp_sign_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
+
+/*
+ check a packet signature
+*/
+NTSTATUS dcesrv_crypto_check_sig(struct dcesrv_auth *auth,
+ TALLOC_CTX *sig_mem_ctx, const uint8_t *data, size_t length, const DATA_BLOB *sig)
+{
+ AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+ return ntlmssp_check_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
+
+/*
+ unseal a packet
+*/
+NTSTATUS dcesrv_crypto_unseal(struct dcesrv_auth *auth,
+ TALLOC_CTX *sig_mem_ctx, uint8_t *data, size_t length, DATA_BLOB *sig)
+{
+ AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+ return ntlmssp_unseal_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
diff --git a/source4/rpc_server/epmapper/rpc_epmapper.c b/source4/rpc_server/epmapper/rpc_epmapper.c
index b5113a881b..891876c2d8 100644
--- a/source4/rpc_server/epmapper/rpc_epmapper.c
+++ b/source4/rpc_server/epmapper/rpc_epmapper.c
@@ -102,6 +102,8 @@ static BOOL fill_protocol_tower(TALLOC_CTX *mem_ctx, struct epm_towers *twr,
twr->floors[4].lhs.protocol = EPM_PROTOCOL_IP;
twr->floors[4].lhs.info.lhs_data = data_blob(NULL, 0);
twr->floors[4].rhs.rhs_data = data_blob_talloc_zero(mem_ctx, 4);
+ /* TODO: we should fill in our IP address here as a hint to the
+ client */
break;
}
@@ -247,7 +249,7 @@ static NTSTATUS epm_Map(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
count = build_ep_list(mem_ctx, dce_call->conn->dce_ctx->endpoint_list, &eps);
- ZERO_STRUCTP(r->out.entry_handle);
+ ZERO_STRUCT(*r->out.entry_handle);
r->out.num_towers = 1;
r->out.status = 0;
r->out.towers = talloc_p(mem_ctx, struct epm_twr_p_t);
diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 81d37d0984..5f4717a5c6 100644
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -148,7 +148,7 @@ static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TAL
ZERO_STRUCTP(r->out.credentials);
*r->out.rid = 0;
- *r->out.negotiate_flags = *r->in.negotiate_flags & NETLOGON_NEG_AUTH2_FLAGS;
+ *r->out.negotiate_flags = *r->in.negotiate_flags;
if (!pipe_state) {
DEBUG(1, ("No challange requested by client, cannot authenticate\n"));
@@ -228,8 +228,9 @@ static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TAL
creds_server_init(pipe_state->creds, &pipe_state->client_challenge,
&pipe_state->server_challenge, mach_pwd,
- r->out.credentials);
-
+ r->out.credentials,
+ *r->in.negotiate_flags);
+
if (!creds_server_check(pipe_state->creds, r->in.credentials)) {
return NT_STATUS_ACCESS_DENIED;
}
@@ -249,8 +250,6 @@ static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TAL
}
pipe_state->computer_name = talloc_strdup(pipe_state->mem_ctx, r->in.computer_name);
-
- *r->out.negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
return NT_STATUS_OK;
}
diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
index 89deaa2f09..228b8b53c0 100644
--- a/source4/rpc_server/samr/samr_password.c
+++ b/source4/rpc_server/samr/samr_password.c
@@ -169,7 +169,7 @@ NTSTATUS samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, TALLOC_
}
/* decrypt the password we have been given */
- SamOEMhash(pwbuf->data, lm_pwd, 516);
+ arcfour_crypt(pwbuf->data, lm_pwd, 516);
if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
&new_pass_len, STR_ASCII)) {
@@ -284,7 +284,7 @@ NTSTATUS samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
}
/* decrypt the password we have been given */
- SamOEMhash(r->in.nt_password->data, nt_pwd, 516);
+ arcfour_crypt(r->in.nt_password->data, nt_pwd, 516);
if (!decode_pw_buffer(r->in.nt_password->data, new_pass, sizeof(new_pass),
&new_pass_len, STR_UNICODE)) {
@@ -684,7 +684,7 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call,
uint32_t new_pass_len;
DATA_BLOB session_key = dce_call->conn->session_key;
- SamOEMhashBlob(pwbuf->data, 516, &session_key);
+ arcfour_crypt_blob(pwbuf->data, 516, &session_key);
if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
&new_pass_len, STR_UNICODE)) {
@@ -731,7 +731,7 @@ NTSTATUS samr_set_password_ex(struct dcesrv_call_state *dce_call,
MD5Update(&ctx, session_key.data, session_key.length);
MD5Final(co_session_key.data, &ctx);
- SamOEMhashBlob(pwbuf->data, 516, &co_session_key);
+ arcfour_crypt_blob(pwbuf->data, 516, &co_session_key);
if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
&new_pass_len, STR_UNICODE)) {