From 0e5eb82a6f29e33ca2cafe0ed7103395837b3fc0 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 1 Sep 2010 11:58:33 -0400 Subject: s3-dcerpc: move crypto stuff in /librpc/crypto MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Günther Deschner --- source3/librpc/rpc/dcerpc_gssapi.c | 1034 ----------------------------------- source3/librpc/rpc/dcerpc_gssapi.h | 76 --- source3/librpc/rpc/dcerpc_helpers.c | 2 +- source3/librpc/rpc/dcerpc_krb5.c | 388 ------------- source3/librpc/rpc/dcerpc_krb5.h | 30 - source3/librpc/rpc/dcerpc_spnego.c | 2 +- 6 files changed, 2 insertions(+), 1530 deletions(-) delete mode 100644 source3/librpc/rpc/dcerpc_gssapi.c delete mode 100644 source3/librpc/rpc/dcerpc_gssapi.h delete mode 100644 source3/librpc/rpc/dcerpc_krb5.c delete mode 100644 source3/librpc/rpc/dcerpc_krb5.h (limited to 'source3/librpc/rpc') diff --git a/source3/librpc/rpc/dcerpc_gssapi.c b/source3/librpc/rpc/dcerpc_gssapi.c deleted file mode 100644 index 2918cfdf8f..0000000000 --- a/source3/librpc/rpc/dcerpc_gssapi.c +++ /dev/null @@ -1,1034 +0,0 @@ -/* - * GSSAPI Security Extensions - * RPC Pipe client and server routines - * Copyright (C) Simo Sorce 2010. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -/* We support only GSSAPI/KRB5 here */ - -#include "includes.h" -#include "dcerpc_gssapi.h" - -#if defined(HAVE_KRB5) && defined(HAVE_GSSAPI_GSSAPI_EXT_H) && defined(HAVE_GSS_WRAP_IOV) - -#include "smb_krb5.h" -#include "dcerpc_krb5.h" - -#include -#include -#include - -#ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID -#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11 -#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05" -#endif - -gss_OID_desc gse_sesskey_inq_oid = { - GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH, - (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID -}; - -#ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID -#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10 -#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04" -#endif - -gss_OID_desc gse_sesskeytype_oid = { - GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH, - (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID -}; - -#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12 -/* EXTRACTION OID AUTHZ ID */ -#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01" - -gss_OID_desc gse_authz_data_oid = { - GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH, - (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID -}; - -#ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID -#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11 -#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c" -#endif - -gss_OID_desc gse_authtime_oid = { - GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH, - (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID -}; - -static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min); - -struct gse_context { - krb5_context k5ctx; - krb5_ccache ccache; - krb5_keytab keytab; - - gss_ctx_id_t gss_ctx; - - gss_OID_desc gss_mech; - OM_uint32 gss_c_flags; - gss_cred_id_t creds; - gss_name_t server_name; - - gss_OID ret_mech; - OM_uint32 ret_flags; - gss_cred_id_t delegated_creds; - gss_name_t client_name; - - bool spnego_wrap; - bool more_processing; - bool authenticated; -}; - -/* free non talloc dependent contexts */ -static int gse_context_destructor(void *ptr) -{ - struct gse_context *gse_ctx; - OM_uint32 gss_min, gss_maj; - - gse_ctx = talloc_get_type_abort(ptr, struct gse_context); - if (gse_ctx->k5ctx) { - if (gse_ctx->ccache) { - krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache); - gse_ctx->ccache = NULL; - } - if (gse_ctx->keytab) { - krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab); - gse_ctx->keytab = NULL; - } - krb5_free_context(gse_ctx->k5ctx); - gse_ctx->k5ctx = NULL; - } - if (gse_ctx->gss_ctx != GSS_C_NO_CONTEXT) { - gss_maj = gss_delete_sec_context(&gss_min, - &gse_ctx->gss_ctx, - GSS_C_NO_BUFFER); - } - if (gse_ctx->server_name) { - gss_maj = gss_release_name(&gss_min, - &gse_ctx->server_name); - } - if (gse_ctx->client_name) { - gss_maj = gss_release_name(&gss_min, - &gse_ctx->client_name); - } - if (gse_ctx->creds) { - gss_maj = gss_release_cred(&gss_min, - &gse_ctx->creds); - } - if (gse_ctx->delegated_creds) { - gss_maj = gss_release_cred(&gss_min, - &gse_ctx->delegated_creds); - } - if (gse_ctx->ret_mech) { - gss_maj = gss_release_oid(&gss_min, - &gse_ctx->ret_mech); - } - return 0; -} - -static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx) -{ - struct gse_context *gse_ctx; - krb5_error_code k5ret; - NTSTATUS status; - - gse_ctx = talloc_zero(mem_ctx, struct gse_context); - if (!gse_ctx) { - return NT_STATUS_NO_MEMORY; - } - talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor); - - memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc)); - - switch (auth_type) { - case DCERPC_AUTH_TYPE_SPNEGO: - gse_ctx->spnego_wrap = true; - break; - case DCERPC_AUTH_TYPE_KRB5: - gse_ctx->spnego_wrap = false; - break; - default: - status = NT_STATUS_INVALID_PARAMETER; - goto err_out; - } - - gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG | - GSS_C_DELEG_FLAG | - GSS_C_DELEG_POLICY_FLAG | - GSS_C_REPLAY_FLAG | - GSS_C_SEQUENCE_FLAG; - switch (auth_level) { - case DCERPC_AUTH_LEVEL_INTEGRITY: - gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG; - break; - case DCERPC_AUTH_LEVEL_PRIVACY: - gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG; - break; - default: - break; - } - - gse_ctx->gss_c_flags |= add_gss_c_flags; - - /* Initialize Kerberos Context */ - initialize_krb5_error_table(); - - k5ret = krb5_init_context(&gse_ctx->k5ctx); - if (k5ret) { - DEBUG(0, ("Failed to initialize kerberos context! (%s)\n", - error_message(k5ret))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - if (!ccache_name) { - ccache_name = krb5_cc_default_name(gse_ctx->k5ctx); - } - k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name, - &gse_ctx->ccache); - if (k5ret) { - DEBUG(1, ("Failed to resolve credential cache! (%s)\n", - error_message(k5ret))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - /* TODO: Should we enforce a enc_types list ? - ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types); - */ - - *_gse_ctx = gse_ctx; - return NT_STATUS_OK; - -err_out: - TALLOC_FREE(gse_ctx); - return status; -} - -NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - const char *server, - const char *service, - const char *username, - const char *password, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx) -{ - struct gse_context *gse_ctx; - OM_uint32 gss_maj, gss_min; - gss_buffer_desc name_buffer = {0, NULL}; - gss_OID_set_desc mech_set; - NTSTATUS status; - - if (!server || !service) { - return NT_STATUS_INVALID_PARAMETER; - } - - status = gse_context_init(mem_ctx, auth_type, auth_level, - ccache_name, add_gss_c_flags, - &gse_ctx); - if (!NT_STATUS_IS_OK(status)) { - return NT_STATUS_NO_MEMORY; - } - - name_buffer.value = talloc_asprintf(gse_ctx, - "%s@%s", service, server); - if (!name_buffer.value) { - status = NT_STATUS_NO_MEMORY; - goto err_out; - } - name_buffer.length = strlen((char *)name_buffer.value); - gss_maj = gss_import_name(&gss_min, &name_buffer, - GSS_C_NT_HOSTBASED_SERVICE, - &gse_ctx->server_name); - if (gss_maj) { - DEBUG(0, ("gss_import_name failed for %s, with [%s]\n", - (char *)name_buffer.value, - gse_errstr(gse_ctx, gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - /* TODO: get krb5 ticket using username/password, if no valid - * one already available in ccache */ - - mech_set.count = 1; - mech_set.elements = &gse_ctx->gss_mech; - - gss_maj = gss_acquire_cred(&gss_min, - GSS_C_NO_NAME, - GSS_C_INDEFINITE, - &mech_set, - GSS_C_INITIATE, - &gse_ctx->creds, - NULL, NULL); - if (gss_maj) { - DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n", - (char *)name_buffer.value, - gse_errstr(gse_ctx, gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - *_gse_ctx = gse_ctx; - TALLOC_FREE(name_buffer.value); - return NT_STATUS_OK; - -err_out: - TALLOC_FREE(name_buffer.value); - TALLOC_FREE(gse_ctx); - return status; -} - -NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - OM_uint32 gss_maj, gss_min; - gss_buffer_desc in_data; - gss_buffer_desc out_data; - DATA_BLOB blob = data_blob_null; - NTSTATUS status; - - in_data.value = token_in->data; - in_data.length = token_in->length; - - gss_maj = gss_init_sec_context(&gss_min, - gse_ctx->creds, - &gse_ctx->gss_ctx, - gse_ctx->server_name, - &gse_ctx->gss_mech, - gse_ctx->gss_c_flags, - 0, GSS_C_NO_CHANNEL_BINDINGS, - &in_data, NULL, &out_data, - NULL, NULL); - switch (gss_maj) { - case GSS_S_COMPLETE: - /* we are done with it */ - gse_ctx->more_processing = false; - status = NT_STATUS_OK; - break; - case GSS_S_CONTINUE_NEEDED: - /* we will need a third leg */ - gse_ctx->more_processing = true; - /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ - status = NT_STATUS_OK; - break; - default: - DEBUG(0, ("gss_init_sec_context failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); - if (!blob.data) { - status = NT_STATUS_NO_MEMORY; - } - - gss_maj = gss_release_buffer(&gss_min, &out_data); - -done: - *token_out = blob; - return status; -} - -NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - uint32_t add_gss_c_flags, - const char *server, - const char *keytab_name, - struct gse_context **_gse_ctx) -{ - struct gse_context *gse_ctx; - OM_uint32 gss_maj, gss_min; - gss_OID_set_desc mech_set; - krb5_error_code ret; - const char *ktname; - NTSTATUS status; - - status = gse_context_init(mem_ctx, auth_type, auth_level, - NULL, add_gss_c_flags, &gse_ctx); - if (!NT_STATUS_IS_OK(status)) { - return NT_STATUS_NO_MEMORY; - } - - if (!keytab_name) { - ret = smb_krb5_get_server_keytab(gse_ctx->k5ctx, - &gse_ctx->keytab); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx, - gse_ctx->keytab, &ktname); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - } else { - ktname = keytab_name; - } - - /* FIXME!!! - * This call sets the default keytab for the whole server, not - * just for this context. Need to find a way that does not alter - * the state of the whole server ... */ - ret = gsskrb5_register_acceptor_identity(ktname); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - mech_set.count = 1; - mech_set.elements = &gse_ctx->gss_mech; - - gss_maj = gss_acquire_cred(&gss_min, - GSS_C_NO_NAME, - GSS_C_INDEFINITE, - &mech_set, - GSS_C_ACCEPT, - &gse_ctx->creds, - NULL, NULL); - if (gss_maj) { - DEBUG(0, ("gss_acquire_creds failed with [%s]\n", - gse_errstr(gse_ctx, gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - status = NT_STATUS_OK; - -done: - if (!NT_STATUS_IS_OK(status)) { - TALLOC_FREE(gse_ctx); - } - - *_gse_ctx = gse_ctx; - return status; -} - -NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - OM_uint32 gss_maj, gss_min; - gss_buffer_desc in_data; - gss_buffer_desc out_data; - DATA_BLOB blob = data_blob_null; - NTSTATUS status; - - in_data.value = token_in->data; - in_data.length = token_in->length; - - gss_maj = gss_accept_sec_context(&gss_min, - &gse_ctx->gss_ctx, - gse_ctx->creds, - &in_data, - GSS_C_NO_CHANNEL_BINDINGS, - &gse_ctx->client_name, - &gse_ctx->ret_mech, - &out_data, - &gse_ctx->ret_flags, NULL, - &gse_ctx->delegated_creds); - switch (gss_maj) { - case GSS_S_COMPLETE: - /* we are done with it */ - gse_ctx->more_processing = false; - gse_ctx->authenticated = true; - status = NT_STATUS_OK; - break; - case GSS_S_CONTINUE_NEEDED: - /* we will need a third leg */ - gse_ctx->more_processing = true; - /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ - status = NT_STATUS_OK; - break; - default: - DEBUG(0, ("gss_init_sec_context failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - - if (gse_ctx->gss_ctx) { - gss_delete_sec_context(&gss_min, - &gse_ctx->gss_ctx, - GSS_C_NO_BUFFER); - } - - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - /* we may be told to return nothing */ - if (out_data.length) { - blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); - if (!blob.data) { - status = NT_STATUS_NO_MEMORY; - } - gss_maj = gss_release_buffer(&gss_min, &out_data); - } - - -done: - *token_out = blob; - return status; -} - -NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) -{ - if (!gse_ctx->authenticated) { - return NT_STATUS_INVALID_HANDLE; - } - - if (memcmp(gse_ctx->ret_mech, - gss_mech_krb5, sizeof(gss_OID_desc)) != 0) { - return NT_STATUS_ACCESS_DENIED; - } - - /* GSS_C_MUTUAL_FLAG */ - if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) { - if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) { - return NT_STATUS_ACCESS_DENIED; - } - } - - /* GSS_C_DELEG_FLAG */ - /* GSS_C_DELEG_POLICY_FLAG */ - /* GSS_C_REPLAY_FLAG */ - /* GSS_C_SEQUENCE_FLAG */ - - /* GSS_C_INTEG_FLAG */ - if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) { - if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) { - return NT_STATUS_ACCESS_DENIED; - } - } - - /* GSS_C_CONF_FLAG */ - if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) { - if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) { - return NT_STATUS_ACCESS_DENIED; - } - } - - return NT_STATUS_OK; -} - -static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc msg_min; - gss_buffer_desc msg_maj; - OM_uint32 msg_ctx = 0; - - char *errstr = NULL; - - ZERO_STRUCT(msg_min); - ZERO_STRUCT(msg_maj); - - gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE, - GSS_C_NO_OID, &msg_ctx, &msg_maj); - if (gss_maj) { - goto done; - } - gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE, - (gss_OID)discard_const(gss_mech_krb5), - &msg_ctx, &msg_min); - if (gss_maj) { - goto done; - } - - errstr = talloc_strndup(mem_ctx, - (char *)msg_maj.value, - msg_maj.length); - if (!errstr) { - goto done; - } - errstr = talloc_strdup_append_buffer(errstr, ": "); - if (!errstr) { - goto done; - } - errstr = talloc_strndup_append_buffer(errstr, - (char *)msg_min.value, - msg_min.length); - if (!errstr) { - goto done; - } - -done: - if (msg_min.value) { - gss_maj = gss_release_buffer(&gss_min, &msg_min); - } - if (msg_maj.value) { - gss_maj = gss_release_buffer(&gss_min, &msg_maj); - } - return errstr; -} - -bool gse_require_more_processing(struct gse_context *gse_ctx) -{ - return gse_ctx->more_processing; -} - -DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; - DATA_BLOB ret; - - gss_maj = gss_inquire_sec_context_by_oid( - &gss_min, gse_ctx->gss_ctx, - &gse_sesskey_inq_oid, &set); - if (gss_maj) { - DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return data_blob_null; - } - - if ((set == GSS_C_NO_BUFFER_SET) || - (set->count != 2) || - (memcmp(set->elements[1].value, - gse_sesskeytype_oid.elements, - gse_sesskeytype_oid.length) != 0)) { - DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " - "OID for data in results:\n")); - dump_data(1, (uint8_t *)set->elements[1].value, - set->elements[1].length); - return data_blob_null; - } - - ret = data_blob_talloc(mem_ctx, set->elements[0].value, - set->elements[0].length); - - gss_maj = gss_release_buffer_set(&gss_min, &set); - return ret; -} - -NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, char **cli_name) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc name_buffer; - - if (!gse_ctx->authenticated) { - return NT_STATUS_ACCESS_DENIED; - } - - if (!gse_ctx->client_name) { - return NT_STATUS_NOT_FOUND; - } - - /* TODO: check OID matches KRB5 Principal Name OID ? */ - - gss_maj = gss_display_name(&gss_min, - gse_ctx->client_name, - &name_buffer, NULL); - if (gss_maj) { - DEBUG(0, ("gss_display_name failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return NT_STATUS_INTERNAL_ERROR; - } - - *cli_name = talloc_strndup(talloc_tos(), - (char *)name_buffer.value, - name_buffer.length); - - gss_maj = gss_release_buffer(&gss_min, &name_buffer); - - if (!*cli_name) { - return NT_STATUS_NO_MEMORY; - } - - return NT_STATUS_OK; -} - -NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, DATA_BLOB *pac) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; - - if (!gse_ctx->authenticated) { - return NT_STATUS_ACCESS_DENIED; - } - - gss_maj = gss_inquire_sec_context_by_oid( - &gss_min, gse_ctx->gss_ctx, - &gse_authz_data_oid, &set); - if (gss_maj) { - DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return NT_STATUS_NOT_FOUND; - } - - if (set == GSS_C_NO_BUFFER_SET) { - DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " - "data in results.\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - /* for now we just hope it is the first value */ - *pac = data_blob_talloc(mem_ctx, - set->elements[0].value, - set->elements[0].length); - - gss_maj = gss_release_buffer_set(&gss_min, &set); - - return NT_STATUS_OK; -} - -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; - int32_t tkttime; - - if (!gse_ctx->authenticated) { - return NT_STATUS_ACCESS_DENIED; - } - - gss_maj = gss_inquire_sec_context_by_oid( - &gss_min, gse_ctx->gss_ctx, - &gse_authtime_oid, &set); - if (gss_maj) { - DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return NT_STATUS_NOT_FOUND; - } - - if ((set == GSS_C_NO_BUFFER_SET) || (set->count != 1) != 0) { - DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " - "data in results.\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - if (set->elements[0].length != sizeof(int32_t)) { - DEBUG(0, ("Invalid authtime size!\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - tkttime = *((int32_t *)set->elements[0].value); - - gss_maj = gss_release_buffer_set(&gss_min, &set); - - *authtime = (time_t)tkttime; - return NT_STATUS_OK; -} - -size_t gse_get_signature_length(struct gse_context *gse_ctx, - int seal, size_t payload_size) -{ - OM_uint32 gss_min, gss_maj; - gss_iov_buffer_desc iov[2]; - uint8_t fakebuf[payload_size]; - int sealed; - - iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; - iov[0].buffer.value = NULL; - iov[0].buffer.length = 0; - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.value = fakebuf; - iov[1].buffer.length = payload_size; - - gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gss_ctx, - seal, GSS_C_QOP_DEFAULT, - &sealed, iov, 2); - if (gss_maj) { - DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return 0; - } - - return iov[0].buffer.length; -} - -NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_iov_buffer_desc iov[2]; - int req_seal = 1; /* setting to 1 means we request sign+seal */ - int sealed; - NTSTATUS status; - - /* allocate the memory ourselves so we do not need to talloc_memdup */ - signature->length = gse_get_signature_length(gse_ctx, 1, data->length); - if (!signature->length) { - return NT_STATUS_INTERNAL_ERROR; - } - signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length); - if (!signature->data) { - return NT_STATUS_NO_MEMORY; - } - iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; - iov[0].buffer.value = signature->data; - iov[0].buffer.length = signature->length; - - /* data is encrypted in place, which is ok */ - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.value = data->data; - iov[1].buffer.length = data->length; - - gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gss_ctx, - req_seal, GSS_C_QOP_DEFAULT, - &sealed, iov, 2); - if (gss_maj) { - DEBUG(0, ("gss_wrap_iov failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - if (!sealed) { - DEBUG(0, ("gss_wrap_iov says data was not sealed!\n")); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - status = NT_STATUS_OK; - - DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n", - (int)iov[1].buffer.length, (int)iov[0].buffer.length)); - -done: - return status; -} - -NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_iov_buffer_desc iov[2]; - int sealed; - NTSTATUS status; - - iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; - iov[0].buffer.value = signature->data; - iov[0].buffer.length = signature->length; - - /* data is decrypted in place, which is ok */ - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.value = data->data; - iov[1].buffer.length = data->length; - - gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gss_ctx, - &sealed, NULL, iov, 2); - if (gss_maj) { - DEBUG(0, ("gss_unwrap_iov failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - if (!sealed) { - DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n")); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - status = NT_STATUS_OK; - - DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n", - (int)iov[1].buffer.length, (int)iov[0].buffer.length)); - -done: - return status; -} - -NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc in_data = { 0, NULL }; - gss_buffer_desc out_data = { 0, NULL}; - NTSTATUS status; - - in_data.value = data->data; - in_data.length = data->length; - - gss_maj = gss_get_mic(&gss_min, gse_ctx->gss_ctx, - GSS_C_QOP_DEFAULT, - &in_data, &out_data); - if (gss_maj) { - DEBUG(0, ("gss_get_mic failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - *signature = data_blob_talloc(mem_ctx, - out_data.value, out_data.length); - if (!signature->data) { - status = NT_STATUS_NO_MEMORY; - goto done; - } - - status = NT_STATUS_OK; - -done: - if (out_data.value) { - gss_maj = gss_release_buffer(&gss_min, &out_data); - } - return status; -} - -NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc in_data = { 0, NULL }; - gss_buffer_desc in_token = { 0, NULL}; - NTSTATUS status; - - in_data.value = data->data; - in_data.length = data->length; - in_token.value = signature->data; - in_token.length = signature->length; - - gss_maj = gss_verify_mic(&gss_min, gse_ctx->gss_ctx, - &in_data, &in_token, NULL); - if (gss_maj) { - DEBUG(0, ("gss_verify_mic failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - status = NT_STATUS_OK; - -done: - return status; -} - -#else - -NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - const char *server, - const char *service, - const char *username, - const char *password, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - uint32_t add_gss_c_flags, - const char *server, - const char *keytab, - struct gse_context **_gse_ctx) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -bool gse_require_more_processing(struct gse_context *gse_ctx) -{ - return false; -} - -DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx) -{ - return data_blob_null; -} - -NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, char **cli_name) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, DATA_BLOB *pac) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -size_t gse_get_signature_length(struct gse_context *gse_ctx, - int seal, size_t payload_size) -{ - return 0; -} - -NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -#endif /* HAVE_KRB5 && HAVE_GSSAPI_EXT_H && HAVE_GSS_WRAP_IOV */ diff --git a/source3/librpc/rpc/dcerpc_gssapi.h b/source3/librpc/rpc/dcerpc_gssapi.h deleted file mode 100644 index 0ffed2c457..0000000000 --- a/source3/librpc/rpc/dcerpc_gssapi.h +++ /dev/null @@ -1,76 +0,0 @@ -/* - * GSSAPI Security Extensions - * RPC Pipe client routines - * Copyright (C) Simo Sorce 2010. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -#ifndef _CLI_PIPE_GSSAPI_H_ -#define _CLI_PIPE_GSSAPI_H_ - -struct gse_context; - -#ifndef GSS_C_DCE_STYLE -#define GSS_C_DCE_STYLE 0x1000 -#endif - -NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - const char *server, - const char *service, - const char *username, - const char *password, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx); -NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out); - -NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - uint32_t add_gss_c_flags, - const char *server, - const char *keytab, - struct gse_context **_gse_ctx); -NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out); -NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx); - -bool gse_require_more_processing(struct gse_context *gse_ctx); -DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx); -NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, char **client_name); -NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, DATA_BLOB *pac); -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime); - -size_t gse_get_signature_length(struct gse_context *gse_ctx, - int seal, size_t payload_size); -NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature); -NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature); -NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature); -NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature); -#endif /* _CLI_PIPE_GSSAPI_H_ */ diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c index b658579d19..8944b395d8 100644 --- a/source3/librpc/rpc/dcerpc_helpers.c +++ b/source3/librpc/rpc/dcerpc_helpers.c @@ -26,7 +26,7 @@ #include "../libcli/auth/spnego.h" #include "../libcli/auth/ntlmssp.h" #include "ntlmssp_wrap.h" -#include "librpc/rpc/dcerpc_gssapi.h" +#include "librpc/crypto/gse.h" #include "librpc/rpc/dcerpc_spnego.h" #undef DBGC_CLASS diff --git a/source3/librpc/rpc/dcerpc_krb5.c b/source3/librpc/rpc/dcerpc_krb5.c deleted file mode 100644 index 22443b63ff..0000000000 --- a/source3/librpc/rpc/dcerpc_krb5.c +++ /dev/null @@ -1,388 +0,0 @@ -/* - * GSSAPI Security Extensions - * Krb5 helpers - * Copyright (C) Simo Sorce 2010. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -#include "includes.h" -#include "smb_krb5.h" -#include "secrets.h" -#include "librpc/rpc/dcerpc_krb5.h" - -#ifdef HAVE_KRB5 - -static krb5_error_code flush_keytab(krb5_context krbctx, krb5_keytab keytab) -{ - krb5_error_code ret; - krb5_kt_cursor kt_cursor; - krb5_keytab_entry kt_entry; - - ZERO_STRUCT(kt_entry); - - ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor); - if (ret == KRB5_KT_END || ret == ENOENT ) { - /* no entries */ - return 0; - } - - ret = krb5_kt_next_entry(krbctx, keytab, &kt_entry, &kt_cursor); - while (ret == 0) { - - /* we need to close and reopen enumeration because we modify - * the keytab */ - ret = krb5_kt_end_seq_get(krbctx, keytab, &kt_cursor); - if (ret) { - DEBUG(1, (__location__ ": krb5_kt_end_seq_get() " - "failed (%s)\n", error_message(ret))); - goto out; - } - - /* remove the entry */ - ret = krb5_kt_remove_entry(krbctx, keytab, &kt_entry); - if (ret) { - DEBUG(1, (__location__ ": krb5_kt_remove_entry() " - "failed (%s)\n", error_message(ret))); - goto out; - } - ret = smb_krb5_kt_free_entry(krbctx, &kt_entry); - ZERO_STRUCT(kt_entry); - - /* now reopen */ - ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor); - if (ret) { - DEBUG(1, (__location__ ": krb5_kt_start_seq() failed " - "(%s)\n", error_message(ret))); - goto out; - } - - ret = krb5_kt_next_entry(krbctx, keytab, - &kt_entry, &kt_cursor); - } - - if (ret != KRB5_KT_END && ret != ENOENT) { - DEBUG(1, (__location__ ": flushing keytab we got [%s]!\n", - error_message(ret))); - } - - ret = 0; - -out: - return ret; -} - -static krb5_error_code get_host_principal(krb5_context krbctx, - krb5_principal *host_princ) -{ - krb5_error_code ret; - char *host_princ_s = NULL; - int err; - - err = asprintf(&host_princ_s, "%s$@%s", global_myname(), lp_realm()); - if (err == -1) { - return -1; - } - - strlower_m(host_princ_s); - ret = smb_krb5_parse_name(krbctx, host_princ_s, host_princ); - if (ret) { - DEBUG(1, (__location__ ": smb_krb5_parse_name(%s) " - "failed (%s)\n", - host_princ_s, error_message(ret))); - } - - SAFE_FREE(host_princ_s); - return ret; -} - -static krb5_error_code fill_keytab_from_password(krb5_context krbctx, - krb5_keytab keytab, - krb5_principal princ, - krb5_kvno vno, - krb5_data *password) -{ - krb5_error_code ret; - krb5_enctype *enctypes; - krb5_keytab_entry kt_entry; - unsigned int i; - - ret = get_kerberos_allowed_etypes(krbctx, &enctypes); - if (ret) { - DEBUG(1, (__location__ - ": Can't determine permitted enctypes!\n")); - return ret; - } - - for (i = 0; enctypes[i]; i++) { - krb5_keyblock *key = NULL; - - if (!(key = SMB_MALLOC_P(krb5_keyblock))) { - ret = ENOMEM; - goto out; - } - - if (create_kerberos_key_from_string(krbctx, princ, - password, key, - enctypes[i], false)) { - DEBUG(10, ("Failed to create key for enctype %d " - "(error: %s)\n", - enctypes[i], error_message(ret))); - SAFE_FREE(key); - continue; - } - - kt_entry.principal = princ; - kt_entry.vno = vno; - *(KRB5_KT_KEY(&kt_entry)) = *key; - - ret = krb5_kt_add_entry(krbctx, keytab, &kt_entry); - if (ret) { - DEBUG(1, (__location__ ": Failed to add entry to " - "keytab for enctype %d (error: %s)\n", - enctypes[i], error_message(ret))); - krb5_free_keyblock(krbctx, key); - goto out; - } - - krb5_free_keyblock(krbctx, key); - } - - ret = 0; - -out: - SAFE_FREE(enctypes); - return ret; -} - -#define SRV_MEM_KEYTAB_NAME "MEMORY:cifs_srv_keytab" -#define CLEARTEXT_PRIV_ENCTYPE -99 - -static krb5_error_code get_mem_keytab_from_secrets(krb5_context krbctx, - krb5_keytab *keytab) -{ - krb5_error_code ret; - char *pwd = NULL; - size_t pwd_len; - krb5_kt_cursor kt_cursor; - krb5_keytab_entry kt_entry; - krb5_data password; - krb5_principal princ = NULL; - krb5_kvno kvno = 0; /* FIXME: fetch current vno from KDC ? */ - char *pwd_old = NULL; - - if (!secrets_init()) { - DEBUG(1, (__location__ ": secrets_init failed\n")); - return KRB5_CONFIG_CANTOPEN; - } - - pwd = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); - if (!pwd) { - DEBUG(2, (__location__ ": failed to fetch machine password\n")); - return KRB5_LIBOS_CANTREADPWD; - } - pwd_len = strlen(pwd); - - if (*keytab == NULL) { - /* create memory keytab */ - ret = krb5_kt_resolve(krbctx, SRV_MEM_KEYTAB_NAME, keytab); - if (ret) { - DEBUG(1, (__location__ ": Failed to get memory " - "keytab!\n")); - return ret; - } - } - - ZERO_STRUCT(kt_entry); - ZERO_STRUCT(kt_cursor); - - /* check if the keytab already has any entry */ - ret = krb5_kt_start_seq_get(krbctx, *keytab, &kt_cursor); - if (ret != KRB5_KT_END && ret != ENOENT ) { - /* check if we have our special enctype used to hold - * the clear text password. If so, check it out so that - * we can verify if the keytab needs to be upgraded */ - while ((ret = krb5_kt_next_entry(krbctx, *keytab, - &kt_entry, &kt_cursor)) == 0) { - if (smb_get_enctype_from_kt_entry(&kt_entry) == CLEARTEXT_PRIV_ENCTYPE) { - break; - } - smb_krb5_kt_free_entry(krbctx, &kt_entry); - ZERO_STRUCT(kt_entry); - } - - if (ret != 0 && ret != KRB5_KT_END && ret != ENOENT ) { - /* Error parsing keytab */ - DEBUG(1, (__location__ ": Failed to parse memory " - "keytab!\n")); - goto out; - } - - if (ret == 0) { - /* found private entry, - * check if keytab is up to date */ - - if ((pwd_len == KRB5_KEY_LENGTH(KRB5_KT_KEY(&kt_entry))) && - (memcmp(KRB5_KEY_DATA(KRB5_KT_KEY(&kt_entry)), - pwd, pwd_len) == 0)) { - /* keytab is already up to date, return */ - smb_krb5_kt_free_entry(krbctx, &kt_entry); - goto out; - } - - smb_krb5_kt_free_entry(krbctx, &kt_entry); - ZERO_STRUCT(kt_entry); - - - /* flush keytab, we need to regen it */ - ret = flush_keytab(krbctx, *keytab); - if (ret) { - DEBUG(1, (__location__ ": Failed to flush " - "memory keytab!\n")); - goto out; - } - } - } - - { - krb5_kt_cursor zero_csr; - ZERO_STRUCT(zero_csr); - if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && *keytab) { - krb5_kt_end_seq_get(krbctx, *keytab, &kt_cursor); - } - } - - /* keytab is not up to date, fill it up */ - - ret = get_host_principal(krbctx, &princ); - if (ret) { - DEBUG(1, (__location__ ": Failed to get host principal!\n")); - goto out; - } - - password.data = pwd; - password.length = pwd_len; - ret = fill_keytab_from_password(krbctx, *keytab, - princ, kvno, &password); - if (ret) { - DEBUG(1, (__location__ ": Failed to fill memory keytab!\n")); - goto out; - } - - pwd_old = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); - if (!pwd_old) { - DEBUG(10, (__location__ ": no prev machine password\n")); - } else { - password.data = pwd_old; - password.length = strlen(pwd_old); - ret = fill_keytab_from_password(krbctx, *keytab, - princ, kvno -1, &password); - if (ret) { - DEBUG(1, (__location__ - ": Failed to fill memory keytab!\n")); - goto out; - } - } - - /* add our private enctype + cleartext password so that we can - * update the keytab if secrets change later on */ - ZERO_STRUCT(kt_entry); - kt_entry.principal = princ; - kt_entry.vno = 0; - - KRB5_KEY_TYPE(KRB5_KT_KEY(&kt_entry)) = CLEARTEXT_PRIV_ENCTYPE; - KRB5_KEY_LENGTH(KRB5_KT_KEY(&kt_entry)) = pwd_len; - KRB5_KEY_DATA(KRB5_KT_KEY(&kt_entry)) = (uint8_t *)pwd; - - ret = krb5_kt_add_entry(krbctx, *keytab, &kt_entry); - if (ret) { - DEBUG(1, (__location__ ": Failed to add entry to " - "keytab for private enctype (%d) (error: %s)\n", - CLEARTEXT_PRIV_ENCTYPE, error_message(ret))); - goto out; - } - - ret = 0; - -out: - SAFE_FREE(pwd); - SAFE_FREE(pwd_old); - - { - krb5_kt_cursor zero_csr; - ZERO_STRUCT(zero_csr); - if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && *keytab) { - krb5_kt_end_seq_get(krbctx, *keytab, &kt_cursor); - } - } - - if (princ) { - krb5_free_principal(krbctx, princ); - } - - if (ret) { - if (*keytab) { - krb5_kt_close(krbctx, *keytab); - *keytab = NULL; - } - } - - return ret; -} - -static krb5_error_code get_mem_keytab_from_system_keytab(krb5_context krbctx, - krb5_keytab *keytab, - bool verify) -{ - return KRB5_KT_NOTFOUND; -} - -krb5_error_code smb_krb5_get_server_keytab(krb5_context krbctx, - krb5_keytab *keytab) -{ - krb5_error_code ret; - - *keytab = NULL; - - switch (lp_kerberos_method()) { - default: - case KERBEROS_VERIFY_SECRETS: - ret = get_mem_keytab_from_secrets(krbctx, keytab); - break; - case KERBEROS_VERIFY_SYSTEM_KEYTAB: - ret = get_mem_keytab_from_system_keytab(krbctx, keytab, true); - break; - case KERBEROS_VERIFY_DEDICATED_KEYTAB: - /* just use whatever keytab is configured */ - ret = get_mem_keytab_from_system_keytab(krbctx, keytab, false); - break; - case KERBEROS_VERIFY_SECRETS_AND_KEYTAB: - ret = get_mem_keytab_from_secrets(krbctx, keytab); - if (ret) { - DEBUG(3, (__location__ ": Warning! Unable to set mem " - "keytab from secrets!\n")); - } - /* Now append system keytab keys too */ - ret = get_mem_keytab_from_system_keytab(krbctx, keytab, true); - if (ret) { - DEBUG(3, (__location__ ": Warning! Unable to set mem " - "keytab from secrets!\n")); - } - break; - } - - return ret; -} - -#endif /* HAVE_KRB5 */ diff --git a/source3/librpc/rpc/dcerpc_krb5.h b/source3/librpc/rpc/dcerpc_krb5.h deleted file mode 100644 index c5d7dd6a09..0000000000 --- a/source3/librpc/rpc/dcerpc_krb5.h +++ /dev/null @@ -1,30 +0,0 @@ -/* - * GSSAPI Security Extensions - * Krb5 helpers - * Copyright (C) Simo Sorce 2010. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -#ifndef _DCERPC_KRB5_H_ -#define _DCERPC_KRB5_H_ - -#ifdef HAVE_KRB5 - -krb5_error_code smb_krb5_get_server_keytab(krb5_context krbctx, - krb5_keytab *keytab); - -#endif /* HAVE_KRB5 */ - -#endif /* _DCERPC_KRB5_H_ */ diff --git a/source3/librpc/rpc/dcerpc_spnego.c b/source3/librpc/rpc/dcerpc_spnego.c index ec81a2c701..9ea2a561da 100644 --- a/source3/librpc/rpc/dcerpc_spnego.c +++ b/source3/librpc/rpc/dcerpc_spnego.c @@ -22,7 +22,7 @@ #include "include/ntlmssp_wrap.h" #include "librpc/gen_ndr/ntlmssp.h" #include "dcerpc_spnego.h" -#include "dcerpc_gssapi.h" +#include "librpc/crypto/gse.h" struct spnego_context { enum dcerpc_AuthType auth_type; -- cgit