From 0e5eb82a6f29e33ca2cafe0ed7103395837b3fc0 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 1 Sep 2010 11:58:33 -0400 Subject: s3-dcerpc: move crypto stuff in /librpc/crypto MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Günther Deschner --- source3/librpc/rpc/dcerpc_gssapi.c | 1034 ------------------------------------ 1 file changed, 1034 deletions(-) delete mode 100644 source3/librpc/rpc/dcerpc_gssapi.c (limited to 'source3/librpc/rpc/dcerpc_gssapi.c') diff --git a/source3/librpc/rpc/dcerpc_gssapi.c b/source3/librpc/rpc/dcerpc_gssapi.c deleted file mode 100644 index 2918cfdf8f..0000000000 --- a/source3/librpc/rpc/dcerpc_gssapi.c +++ /dev/null @@ -1,1034 +0,0 @@ -/* - * GSSAPI Security Extensions - * RPC Pipe client and server routines - * Copyright (C) Simo Sorce 2010. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -/* We support only GSSAPI/KRB5 here */ - -#include "includes.h" -#include "dcerpc_gssapi.h" - -#if defined(HAVE_KRB5) && defined(HAVE_GSSAPI_GSSAPI_EXT_H) && defined(HAVE_GSS_WRAP_IOV) - -#include "smb_krb5.h" -#include "dcerpc_krb5.h" - -#include -#include -#include - -#ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID -#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11 -#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05" -#endif - -gss_OID_desc gse_sesskey_inq_oid = { - GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH, - (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID -}; - -#ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID -#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10 -#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04" -#endif - -gss_OID_desc gse_sesskeytype_oid = { - GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH, - (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID -}; - -#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12 -/* EXTRACTION OID AUTHZ ID */ -#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01" - -gss_OID_desc gse_authz_data_oid = { - GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH, - (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID -}; - -#ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID -#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11 -#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c" -#endif - -gss_OID_desc gse_authtime_oid = { - GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH, - (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID -}; - -static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min); - -struct gse_context { - krb5_context k5ctx; - krb5_ccache ccache; - krb5_keytab keytab; - - gss_ctx_id_t gss_ctx; - - gss_OID_desc gss_mech; - OM_uint32 gss_c_flags; - gss_cred_id_t creds; - gss_name_t server_name; - - gss_OID ret_mech; - OM_uint32 ret_flags; - gss_cred_id_t delegated_creds; - gss_name_t client_name; - - bool spnego_wrap; - bool more_processing; - bool authenticated; -}; - -/* free non talloc dependent contexts */ -static int gse_context_destructor(void *ptr) -{ - struct gse_context *gse_ctx; - OM_uint32 gss_min, gss_maj; - - gse_ctx = talloc_get_type_abort(ptr, struct gse_context); - if (gse_ctx->k5ctx) { - if (gse_ctx->ccache) { - krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache); - gse_ctx->ccache = NULL; - } - if (gse_ctx->keytab) { - krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab); - gse_ctx->keytab = NULL; - } - krb5_free_context(gse_ctx->k5ctx); - gse_ctx->k5ctx = NULL; - } - if (gse_ctx->gss_ctx != GSS_C_NO_CONTEXT) { - gss_maj = gss_delete_sec_context(&gss_min, - &gse_ctx->gss_ctx, - GSS_C_NO_BUFFER); - } - if (gse_ctx->server_name) { - gss_maj = gss_release_name(&gss_min, - &gse_ctx->server_name); - } - if (gse_ctx->client_name) { - gss_maj = gss_release_name(&gss_min, - &gse_ctx->client_name); - } - if (gse_ctx->creds) { - gss_maj = gss_release_cred(&gss_min, - &gse_ctx->creds); - } - if (gse_ctx->delegated_creds) { - gss_maj = gss_release_cred(&gss_min, - &gse_ctx->delegated_creds); - } - if (gse_ctx->ret_mech) { - gss_maj = gss_release_oid(&gss_min, - &gse_ctx->ret_mech); - } - return 0; -} - -static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx) -{ - struct gse_context *gse_ctx; - krb5_error_code k5ret; - NTSTATUS status; - - gse_ctx = talloc_zero(mem_ctx, struct gse_context); - if (!gse_ctx) { - return NT_STATUS_NO_MEMORY; - } - talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor); - - memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc)); - - switch (auth_type) { - case DCERPC_AUTH_TYPE_SPNEGO: - gse_ctx->spnego_wrap = true; - break; - case DCERPC_AUTH_TYPE_KRB5: - gse_ctx->spnego_wrap = false; - break; - default: - status = NT_STATUS_INVALID_PARAMETER; - goto err_out; - } - - gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG | - GSS_C_DELEG_FLAG | - GSS_C_DELEG_POLICY_FLAG | - GSS_C_REPLAY_FLAG | - GSS_C_SEQUENCE_FLAG; - switch (auth_level) { - case DCERPC_AUTH_LEVEL_INTEGRITY: - gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG; - break; - case DCERPC_AUTH_LEVEL_PRIVACY: - gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG; - break; - default: - break; - } - - gse_ctx->gss_c_flags |= add_gss_c_flags; - - /* Initialize Kerberos Context */ - initialize_krb5_error_table(); - - k5ret = krb5_init_context(&gse_ctx->k5ctx); - if (k5ret) { - DEBUG(0, ("Failed to initialize kerberos context! (%s)\n", - error_message(k5ret))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - if (!ccache_name) { - ccache_name = krb5_cc_default_name(gse_ctx->k5ctx); - } - k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name, - &gse_ctx->ccache); - if (k5ret) { - DEBUG(1, ("Failed to resolve credential cache! (%s)\n", - error_message(k5ret))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - /* TODO: Should we enforce a enc_types list ? - ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types); - */ - - *_gse_ctx = gse_ctx; - return NT_STATUS_OK; - -err_out: - TALLOC_FREE(gse_ctx); - return status; -} - -NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - const char *server, - const char *service, - const char *username, - const char *password, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx) -{ - struct gse_context *gse_ctx; - OM_uint32 gss_maj, gss_min; - gss_buffer_desc name_buffer = {0, NULL}; - gss_OID_set_desc mech_set; - NTSTATUS status; - - if (!server || !service) { - return NT_STATUS_INVALID_PARAMETER; - } - - status = gse_context_init(mem_ctx, auth_type, auth_level, - ccache_name, add_gss_c_flags, - &gse_ctx); - if (!NT_STATUS_IS_OK(status)) { - return NT_STATUS_NO_MEMORY; - } - - name_buffer.value = talloc_asprintf(gse_ctx, - "%s@%s", service, server); - if (!name_buffer.value) { - status = NT_STATUS_NO_MEMORY; - goto err_out; - } - name_buffer.length = strlen((char *)name_buffer.value); - gss_maj = gss_import_name(&gss_min, &name_buffer, - GSS_C_NT_HOSTBASED_SERVICE, - &gse_ctx->server_name); - if (gss_maj) { - DEBUG(0, ("gss_import_name failed for %s, with [%s]\n", - (char *)name_buffer.value, - gse_errstr(gse_ctx, gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - /* TODO: get krb5 ticket using username/password, if no valid - * one already available in ccache */ - - mech_set.count = 1; - mech_set.elements = &gse_ctx->gss_mech; - - gss_maj = gss_acquire_cred(&gss_min, - GSS_C_NO_NAME, - GSS_C_INDEFINITE, - &mech_set, - GSS_C_INITIATE, - &gse_ctx->creds, - NULL, NULL); - if (gss_maj) { - DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n", - (char *)name_buffer.value, - gse_errstr(gse_ctx, gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - *_gse_ctx = gse_ctx; - TALLOC_FREE(name_buffer.value); - return NT_STATUS_OK; - -err_out: - TALLOC_FREE(name_buffer.value); - TALLOC_FREE(gse_ctx); - return status; -} - -NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - OM_uint32 gss_maj, gss_min; - gss_buffer_desc in_data; - gss_buffer_desc out_data; - DATA_BLOB blob = data_blob_null; - NTSTATUS status; - - in_data.value = token_in->data; - in_data.length = token_in->length; - - gss_maj = gss_init_sec_context(&gss_min, - gse_ctx->creds, - &gse_ctx->gss_ctx, - gse_ctx->server_name, - &gse_ctx->gss_mech, - gse_ctx->gss_c_flags, - 0, GSS_C_NO_CHANNEL_BINDINGS, - &in_data, NULL, &out_data, - NULL, NULL); - switch (gss_maj) { - case GSS_S_COMPLETE: - /* we are done with it */ - gse_ctx->more_processing = false; - status = NT_STATUS_OK; - break; - case GSS_S_CONTINUE_NEEDED: - /* we will need a third leg */ - gse_ctx->more_processing = true; - /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ - status = NT_STATUS_OK; - break; - default: - DEBUG(0, ("gss_init_sec_context failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); - if (!blob.data) { - status = NT_STATUS_NO_MEMORY; - } - - gss_maj = gss_release_buffer(&gss_min, &out_data); - -done: - *token_out = blob; - return status; -} - -NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - uint32_t add_gss_c_flags, - const char *server, - const char *keytab_name, - struct gse_context **_gse_ctx) -{ - struct gse_context *gse_ctx; - OM_uint32 gss_maj, gss_min; - gss_OID_set_desc mech_set; - krb5_error_code ret; - const char *ktname; - NTSTATUS status; - - status = gse_context_init(mem_ctx, auth_type, auth_level, - NULL, add_gss_c_flags, &gse_ctx); - if (!NT_STATUS_IS_OK(status)) { - return NT_STATUS_NO_MEMORY; - } - - if (!keytab_name) { - ret = smb_krb5_get_server_keytab(gse_ctx->k5ctx, - &gse_ctx->keytab); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx, - gse_ctx->keytab, &ktname); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - } else { - ktname = keytab_name; - } - - /* FIXME!!! - * This call sets the default keytab for the whole server, not - * just for this context. Need to find a way that does not alter - * the state of the whole server ... */ - ret = gsskrb5_register_acceptor_identity(ktname); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - mech_set.count = 1; - mech_set.elements = &gse_ctx->gss_mech; - - gss_maj = gss_acquire_cred(&gss_min, - GSS_C_NO_NAME, - GSS_C_INDEFINITE, - &mech_set, - GSS_C_ACCEPT, - &gse_ctx->creds, - NULL, NULL); - if (gss_maj) { - DEBUG(0, ("gss_acquire_creds failed with [%s]\n", - gse_errstr(gse_ctx, gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - status = NT_STATUS_OK; - -done: - if (!NT_STATUS_IS_OK(status)) { - TALLOC_FREE(gse_ctx); - } - - *_gse_ctx = gse_ctx; - return status; -} - -NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - OM_uint32 gss_maj, gss_min; - gss_buffer_desc in_data; - gss_buffer_desc out_data; - DATA_BLOB blob = data_blob_null; - NTSTATUS status; - - in_data.value = token_in->data; - in_data.length = token_in->length; - - gss_maj = gss_accept_sec_context(&gss_min, - &gse_ctx->gss_ctx, - gse_ctx->creds, - &in_data, - GSS_C_NO_CHANNEL_BINDINGS, - &gse_ctx->client_name, - &gse_ctx->ret_mech, - &out_data, - &gse_ctx->ret_flags, NULL, - &gse_ctx->delegated_creds); - switch (gss_maj) { - case GSS_S_COMPLETE: - /* we are done with it */ - gse_ctx->more_processing = false; - gse_ctx->authenticated = true; - status = NT_STATUS_OK; - break; - case GSS_S_CONTINUE_NEEDED: - /* we will need a third leg */ - gse_ctx->more_processing = true; - /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ - status = NT_STATUS_OK; - break; - default: - DEBUG(0, ("gss_init_sec_context failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - - if (gse_ctx->gss_ctx) { - gss_delete_sec_context(&gss_min, - &gse_ctx->gss_ctx, - GSS_C_NO_BUFFER); - } - - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - /* we may be told to return nothing */ - if (out_data.length) { - blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); - if (!blob.data) { - status = NT_STATUS_NO_MEMORY; - } - gss_maj = gss_release_buffer(&gss_min, &out_data); - } - - -done: - *token_out = blob; - return status; -} - -NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) -{ - if (!gse_ctx->authenticated) { - return NT_STATUS_INVALID_HANDLE; - } - - if (memcmp(gse_ctx->ret_mech, - gss_mech_krb5, sizeof(gss_OID_desc)) != 0) { - return NT_STATUS_ACCESS_DENIED; - } - - /* GSS_C_MUTUAL_FLAG */ - if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) { - if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) { - return NT_STATUS_ACCESS_DENIED; - } - } - - /* GSS_C_DELEG_FLAG */ - /* GSS_C_DELEG_POLICY_FLAG */ - /* GSS_C_REPLAY_FLAG */ - /* GSS_C_SEQUENCE_FLAG */ - - /* GSS_C_INTEG_FLAG */ - if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) { - if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) { - return NT_STATUS_ACCESS_DENIED; - } - } - - /* GSS_C_CONF_FLAG */ - if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) { - if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) { - return NT_STATUS_ACCESS_DENIED; - } - } - - return NT_STATUS_OK; -} - -static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc msg_min; - gss_buffer_desc msg_maj; - OM_uint32 msg_ctx = 0; - - char *errstr = NULL; - - ZERO_STRUCT(msg_min); - ZERO_STRUCT(msg_maj); - - gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE, - GSS_C_NO_OID, &msg_ctx, &msg_maj); - if (gss_maj) { - goto done; - } - gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE, - (gss_OID)discard_const(gss_mech_krb5), - &msg_ctx, &msg_min); - if (gss_maj) { - goto done; - } - - errstr = talloc_strndup(mem_ctx, - (char *)msg_maj.value, - msg_maj.length); - if (!errstr) { - goto done; - } - errstr = talloc_strdup_append_buffer(errstr, ": "); - if (!errstr) { - goto done; - } - errstr = talloc_strndup_append_buffer(errstr, - (char *)msg_min.value, - msg_min.length); - if (!errstr) { - goto done; - } - -done: - if (msg_min.value) { - gss_maj = gss_release_buffer(&gss_min, &msg_min); - } - if (msg_maj.value) { - gss_maj = gss_release_buffer(&gss_min, &msg_maj); - } - return errstr; -} - -bool gse_require_more_processing(struct gse_context *gse_ctx) -{ - return gse_ctx->more_processing; -} - -DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; - DATA_BLOB ret; - - gss_maj = gss_inquire_sec_context_by_oid( - &gss_min, gse_ctx->gss_ctx, - &gse_sesskey_inq_oid, &set); - if (gss_maj) { - DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return data_blob_null; - } - - if ((set == GSS_C_NO_BUFFER_SET) || - (set->count != 2) || - (memcmp(set->elements[1].value, - gse_sesskeytype_oid.elements, - gse_sesskeytype_oid.length) != 0)) { - DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " - "OID for data in results:\n")); - dump_data(1, (uint8_t *)set->elements[1].value, - set->elements[1].length); - return data_blob_null; - } - - ret = data_blob_talloc(mem_ctx, set->elements[0].value, - set->elements[0].length); - - gss_maj = gss_release_buffer_set(&gss_min, &set); - return ret; -} - -NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, char **cli_name) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc name_buffer; - - if (!gse_ctx->authenticated) { - return NT_STATUS_ACCESS_DENIED; - } - - if (!gse_ctx->client_name) { - return NT_STATUS_NOT_FOUND; - } - - /* TODO: check OID matches KRB5 Principal Name OID ? */ - - gss_maj = gss_display_name(&gss_min, - gse_ctx->client_name, - &name_buffer, NULL); - if (gss_maj) { - DEBUG(0, ("gss_display_name failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return NT_STATUS_INTERNAL_ERROR; - } - - *cli_name = talloc_strndup(talloc_tos(), - (char *)name_buffer.value, - name_buffer.length); - - gss_maj = gss_release_buffer(&gss_min, &name_buffer); - - if (!*cli_name) { - return NT_STATUS_NO_MEMORY; - } - - return NT_STATUS_OK; -} - -NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, DATA_BLOB *pac) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; - - if (!gse_ctx->authenticated) { - return NT_STATUS_ACCESS_DENIED; - } - - gss_maj = gss_inquire_sec_context_by_oid( - &gss_min, gse_ctx->gss_ctx, - &gse_authz_data_oid, &set); - if (gss_maj) { - DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return NT_STATUS_NOT_FOUND; - } - - if (set == GSS_C_NO_BUFFER_SET) { - DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " - "data in results.\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - /* for now we just hope it is the first value */ - *pac = data_blob_talloc(mem_ctx, - set->elements[0].value, - set->elements[0].length); - - gss_maj = gss_release_buffer_set(&gss_min, &set); - - return NT_STATUS_OK; -} - -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; - int32_t tkttime; - - if (!gse_ctx->authenticated) { - return NT_STATUS_ACCESS_DENIED; - } - - gss_maj = gss_inquire_sec_context_by_oid( - &gss_min, gse_ctx->gss_ctx, - &gse_authtime_oid, &set); - if (gss_maj) { - DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return NT_STATUS_NOT_FOUND; - } - - if ((set == GSS_C_NO_BUFFER_SET) || (set->count != 1) != 0) { - DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " - "data in results.\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - if (set->elements[0].length != sizeof(int32_t)) { - DEBUG(0, ("Invalid authtime size!\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - tkttime = *((int32_t *)set->elements[0].value); - - gss_maj = gss_release_buffer_set(&gss_min, &set); - - *authtime = (time_t)tkttime; - return NT_STATUS_OK; -} - -size_t gse_get_signature_length(struct gse_context *gse_ctx, - int seal, size_t payload_size) -{ - OM_uint32 gss_min, gss_maj; - gss_iov_buffer_desc iov[2]; - uint8_t fakebuf[payload_size]; - int sealed; - - iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; - iov[0].buffer.value = NULL; - iov[0].buffer.length = 0; - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.value = fakebuf; - iov[1].buffer.length = payload_size; - - gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gss_ctx, - seal, GSS_C_QOP_DEFAULT, - &sealed, iov, 2); - if (gss_maj) { - DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return 0; - } - - return iov[0].buffer.length; -} - -NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_iov_buffer_desc iov[2]; - int req_seal = 1; /* setting to 1 means we request sign+seal */ - int sealed; - NTSTATUS status; - - /* allocate the memory ourselves so we do not need to talloc_memdup */ - signature->length = gse_get_signature_length(gse_ctx, 1, data->length); - if (!signature->length) { - return NT_STATUS_INTERNAL_ERROR; - } - signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length); - if (!signature->data) { - return NT_STATUS_NO_MEMORY; - } - iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; - iov[0].buffer.value = signature->data; - iov[0].buffer.length = signature->length; - - /* data is encrypted in place, which is ok */ - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.value = data->data; - iov[1].buffer.length = data->length; - - gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gss_ctx, - req_seal, GSS_C_QOP_DEFAULT, - &sealed, iov, 2); - if (gss_maj) { - DEBUG(0, ("gss_wrap_iov failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - if (!sealed) { - DEBUG(0, ("gss_wrap_iov says data was not sealed!\n")); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - status = NT_STATUS_OK; - - DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n", - (int)iov[1].buffer.length, (int)iov[0].buffer.length)); - -done: - return status; -} - -NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_iov_buffer_desc iov[2]; - int sealed; - NTSTATUS status; - - iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; - iov[0].buffer.value = signature->data; - iov[0].buffer.length = signature->length; - - /* data is decrypted in place, which is ok */ - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.value = data->data; - iov[1].buffer.length = data->length; - - gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gss_ctx, - &sealed, NULL, iov, 2); - if (gss_maj) { - DEBUG(0, ("gss_unwrap_iov failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - if (!sealed) { - DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n")); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - status = NT_STATUS_OK; - - DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n", - (int)iov[1].buffer.length, (int)iov[0].buffer.length)); - -done: - return status; -} - -NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc in_data = { 0, NULL }; - gss_buffer_desc out_data = { 0, NULL}; - NTSTATUS status; - - in_data.value = data->data; - in_data.length = data->length; - - gss_maj = gss_get_mic(&gss_min, gse_ctx->gss_ctx, - GSS_C_QOP_DEFAULT, - &in_data, &out_data); - if (gss_maj) { - DEBUG(0, ("gss_get_mic failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - *signature = data_blob_talloc(mem_ctx, - out_data.value, out_data.length); - if (!signature->data) { - status = NT_STATUS_NO_MEMORY; - goto done; - } - - status = NT_STATUS_OK; - -done: - if (out_data.value) { - gss_maj = gss_release_buffer(&gss_min, &out_data); - } - return status; -} - -NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc in_data = { 0, NULL }; - gss_buffer_desc in_token = { 0, NULL}; - NTSTATUS status; - - in_data.value = data->data; - in_data.length = data->length; - in_token.value = signature->data; - in_token.length = signature->length; - - gss_maj = gss_verify_mic(&gss_min, gse_ctx->gss_ctx, - &in_data, &in_token, NULL); - if (gss_maj) { - DEBUG(0, ("gss_verify_mic failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - status = NT_STATUS_OK; - -done: - return status; -} - -#else - -NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - const char *server, - const char *service, - const char *username, - const char *password, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - uint32_t add_gss_c_flags, - const char *server, - const char *keytab, - struct gse_context **_gse_ctx) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -bool gse_require_more_processing(struct gse_context *gse_ctx) -{ - return false; -} - -DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx) -{ - return data_blob_null; -} - -NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, char **cli_name) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, DATA_BLOB *pac) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -size_t gse_get_signature_length(struct gse_context *gse_ctx, - int seal, size_t payload_size) -{ - return 0; -} - -NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -#endif /* HAVE_KRB5 && HAVE_GSSAPI_EXT_H && HAVE_GSS_WRAP_IOV */ -- cgit