From 0e5eb82a6f29e33ca2cafe0ed7103395837b3fc0 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 1 Sep 2010 11:58:33 -0400 Subject: s3-dcerpc: move crypto stuff in /librpc/crypto MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Günther Deschner --- source3/Makefile.in | 4 +- source3/librpc/crypto/gse.c | 1034 +++++++++++++++++++++++++++++++++++ source3/librpc/crypto/gse.h | 77 +++ source3/librpc/crypto/gse_krb5.c | 388 +++++++++++++ source3/librpc/crypto/gse_krb5.h | 30 + source3/librpc/rpc/dcerpc_gssapi.c | 1034 ----------------------------------- source3/librpc/rpc/dcerpc_gssapi.h | 76 --- source3/librpc/rpc/dcerpc_helpers.c | 2 +- source3/librpc/rpc/dcerpc_krb5.c | 388 ------------- source3/librpc/rpc/dcerpc_krb5.h | 30 - source3/librpc/rpc/dcerpc_spnego.c | 2 +- source3/rpc_client/cli_pipe.c | 2 +- source3/rpc_server/srv_pipe.c | 2 +- 13 files changed, 1535 insertions(+), 1534 deletions(-) create mode 100644 source3/librpc/crypto/gse.c create mode 100644 source3/librpc/crypto/gse.h create mode 100644 source3/librpc/crypto/gse_krb5.c create mode 100644 source3/librpc/crypto/gse_krb5.h delete mode 100644 source3/librpc/rpc/dcerpc_gssapi.c delete mode 100644 source3/librpc/rpc/dcerpc_gssapi.h delete mode 100644 source3/librpc/rpc/dcerpc_krb5.c delete mode 100644 source3/librpc/rpc/dcerpc_krb5.h (limited to 'source3') diff --git a/source3/Makefile.in b/source3/Makefile.in index 2f32251fb1..6beced2580 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -593,8 +593,8 @@ LIBSMB_OBJ = libsmb/clientgen.o libsmb/cliconnect.o libsmb/clifile.o \ LIBMSRPC_OBJ = $(SCHANNEL_OBJ) \ rpc_client/cli_pipe.o \ - librpc/rpc/dcerpc_krb5.o \ - librpc/rpc/dcerpc_gssapi.o \ + librpc/crypto/gse_krb5.o \ + librpc/crypto/gse.o \ librpc/rpc/dcerpc_spnego.o \ librpc/rpc/rpc_common.o \ rpc_client/rpc_transport_np.o \ diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c new file mode 100644 index 0000000000..c12656b0fa --- /dev/null +++ b/source3/librpc/crypto/gse.c @@ -0,0 +1,1034 @@ +/* + * GSSAPI Security Extensions + * RPC Pipe client and server routines + * Copyright (C) Simo Sorce 2010. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +/* We support only GSSAPI/KRB5 here */ + +#include "includes.h" +#include "gse.h" + +#if defined(HAVE_KRB5) && defined(HAVE_GSSAPI_GSSAPI_EXT_H) && defined(HAVE_GSS_WRAP_IOV) + +#include "smb_krb5.h" +#include "gse_krb5.h" + +#include +#include +#include + +#ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID +#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11 +#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05" +#endif + +gss_OID_desc gse_sesskey_inq_oid = { + GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH, + (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID +}; + +#ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID +#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10 +#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04" +#endif + +gss_OID_desc gse_sesskeytype_oid = { + GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH, + (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID +}; + +#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12 +/* EXTRACTION OID AUTHZ ID */ +#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01" + +gss_OID_desc gse_authz_data_oid = { + GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH, + (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID +}; + +#ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID +#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11 +#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c" +#endif + +gss_OID_desc gse_authtime_oid = { + GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH, + (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID +}; + +static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min); + +struct gse_context { + krb5_context k5ctx; + krb5_ccache ccache; + krb5_keytab keytab; + + gss_ctx_id_t gss_ctx; + + gss_OID_desc gss_mech; + OM_uint32 gss_c_flags; + gss_cred_id_t creds; + gss_name_t server_name; + + gss_OID ret_mech; + OM_uint32 ret_flags; + gss_cred_id_t delegated_creds; + gss_name_t client_name; + + bool spnego_wrap; + bool more_processing; + bool authenticated; +}; + +/* free non talloc dependent contexts */ +static int gse_context_destructor(void *ptr) +{ + struct gse_context *gse_ctx; + OM_uint32 gss_min, gss_maj; + + gse_ctx = talloc_get_type_abort(ptr, struct gse_context); + if (gse_ctx->k5ctx) { + if (gse_ctx->ccache) { + krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache); + gse_ctx->ccache = NULL; + } + if (gse_ctx->keytab) { + krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab); + gse_ctx->keytab = NULL; + } + krb5_free_context(gse_ctx->k5ctx); + gse_ctx->k5ctx = NULL; + } + if (gse_ctx->gss_ctx != GSS_C_NO_CONTEXT) { + gss_maj = gss_delete_sec_context(&gss_min, + &gse_ctx->gss_ctx, + GSS_C_NO_BUFFER); + } + if (gse_ctx->server_name) { + gss_maj = gss_release_name(&gss_min, + &gse_ctx->server_name); + } + if (gse_ctx->client_name) { + gss_maj = gss_release_name(&gss_min, + &gse_ctx->client_name); + } + if (gse_ctx->creds) { + gss_maj = gss_release_cred(&gss_min, + &gse_ctx->creds); + } + if (gse_ctx->delegated_creds) { + gss_maj = gss_release_cred(&gss_min, + &gse_ctx->delegated_creds); + } + if (gse_ctx->ret_mech) { + gss_maj = gss_release_oid(&gss_min, + &gse_ctx->ret_mech); + } + return 0; +} + +static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + const char *ccache_name, + uint32_t add_gss_c_flags, + struct gse_context **_gse_ctx) +{ + struct gse_context *gse_ctx; + krb5_error_code k5ret; + NTSTATUS status; + + gse_ctx = talloc_zero(mem_ctx, struct gse_context); + if (!gse_ctx) { + return NT_STATUS_NO_MEMORY; + } + talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor); + + memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc)); + + switch (auth_type) { + case DCERPC_AUTH_TYPE_SPNEGO: + gse_ctx->spnego_wrap = true; + break; + case DCERPC_AUTH_TYPE_KRB5: + gse_ctx->spnego_wrap = false; + break; + default: + status = NT_STATUS_INVALID_PARAMETER; + goto err_out; + } + + gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG | + GSS_C_DELEG_FLAG | + GSS_C_DELEG_POLICY_FLAG | + GSS_C_REPLAY_FLAG | + GSS_C_SEQUENCE_FLAG; + switch (auth_level) { + case DCERPC_AUTH_LEVEL_INTEGRITY: + gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG; + break; + case DCERPC_AUTH_LEVEL_PRIVACY: + gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG; + break; + default: + break; + } + + gse_ctx->gss_c_flags |= add_gss_c_flags; + + /* Initialize Kerberos Context */ + initialize_krb5_error_table(); + + k5ret = krb5_init_context(&gse_ctx->k5ctx); + if (k5ret) { + DEBUG(0, ("Failed to initialize kerberos context! (%s)\n", + error_message(k5ret))); + status = NT_STATUS_INTERNAL_ERROR; + goto err_out; + } + + if (!ccache_name) { + ccache_name = krb5_cc_default_name(gse_ctx->k5ctx); + } + k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name, + &gse_ctx->ccache); + if (k5ret) { + DEBUG(1, ("Failed to resolve credential cache! (%s)\n", + error_message(k5ret))); + status = NT_STATUS_INTERNAL_ERROR; + goto err_out; + } + + /* TODO: Should we enforce a enc_types list ? + ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types); + */ + + *_gse_ctx = gse_ctx; + return NT_STATUS_OK; + +err_out: + TALLOC_FREE(gse_ctx); + return status; +} + +NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + const char *ccache_name, + const char *server, + const char *service, + const char *username, + const char *password, + uint32_t add_gss_c_flags, + struct gse_context **_gse_ctx) +{ + struct gse_context *gse_ctx; + OM_uint32 gss_maj, gss_min; + gss_buffer_desc name_buffer = {0, NULL}; + gss_OID_set_desc mech_set; + NTSTATUS status; + + if (!server || !service) { + return NT_STATUS_INVALID_PARAMETER; + } + + status = gse_context_init(mem_ctx, auth_type, auth_level, + ccache_name, add_gss_c_flags, + &gse_ctx); + if (!NT_STATUS_IS_OK(status)) { + return NT_STATUS_NO_MEMORY; + } + + name_buffer.value = talloc_asprintf(gse_ctx, + "%s@%s", service, server); + if (!name_buffer.value) { + status = NT_STATUS_NO_MEMORY; + goto err_out; + } + name_buffer.length = strlen((char *)name_buffer.value); + gss_maj = gss_import_name(&gss_min, &name_buffer, + GSS_C_NT_HOSTBASED_SERVICE, + &gse_ctx->server_name); + if (gss_maj) { + DEBUG(0, ("gss_import_name failed for %s, with [%s]\n", + (char *)name_buffer.value, + gse_errstr(gse_ctx, gss_maj, gss_min))); + status = NT_STATUS_INTERNAL_ERROR; + goto err_out; + } + + /* TODO: get krb5 ticket using username/password, if no valid + * one already available in ccache */ + + mech_set.count = 1; + mech_set.elements = &gse_ctx->gss_mech; + + gss_maj = gss_acquire_cred(&gss_min, + GSS_C_NO_NAME, + GSS_C_INDEFINITE, + &mech_set, + GSS_C_INITIATE, + &gse_ctx->creds, + NULL, NULL); + if (gss_maj) { + DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n", + (char *)name_buffer.value, + gse_errstr(gse_ctx, gss_maj, gss_min))); + status = NT_STATUS_INTERNAL_ERROR; + goto err_out; + } + + *_gse_ctx = gse_ctx; + TALLOC_FREE(name_buffer.value); + return NT_STATUS_OK; + +err_out: + TALLOC_FREE(name_buffer.value); + TALLOC_FREE(gse_ctx); + return status; +} + +NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + OM_uint32 gss_maj, gss_min; + gss_buffer_desc in_data; + gss_buffer_desc out_data; + DATA_BLOB blob = data_blob_null; + NTSTATUS status; + + in_data.value = token_in->data; + in_data.length = token_in->length; + + gss_maj = gss_init_sec_context(&gss_min, + gse_ctx->creds, + &gse_ctx->gss_ctx, + gse_ctx->server_name, + &gse_ctx->gss_mech, + gse_ctx->gss_c_flags, + 0, GSS_C_NO_CHANNEL_BINDINGS, + &in_data, NULL, &out_data, + NULL, NULL); + switch (gss_maj) { + case GSS_S_COMPLETE: + /* we are done with it */ + gse_ctx->more_processing = false; + status = NT_STATUS_OK; + break; + case GSS_S_CONTINUE_NEEDED: + /* we will need a third leg */ + gse_ctx->more_processing = true; + /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ + status = NT_STATUS_OK; + break; + default: + DEBUG(0, ("gss_init_sec_context failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); + if (!blob.data) { + status = NT_STATUS_NO_MEMORY; + } + + gss_maj = gss_release_buffer(&gss_min, &out_data); + +done: + *token_out = blob; + return status; +} + +NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + uint32_t add_gss_c_flags, + const char *server, + const char *keytab_name, + struct gse_context **_gse_ctx) +{ + struct gse_context *gse_ctx; + OM_uint32 gss_maj, gss_min; + gss_OID_set_desc mech_set; + krb5_error_code ret; + const char *ktname; + NTSTATUS status; + + status = gse_context_init(mem_ctx, auth_type, auth_level, + NULL, add_gss_c_flags, &gse_ctx); + if (!NT_STATUS_IS_OK(status)) { + return NT_STATUS_NO_MEMORY; + } + + if (!keytab_name) { + ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx, + &gse_ctx->keytab); + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx, + gse_ctx->keytab, &ktname); + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + } else { + ktname = keytab_name; + } + + /* FIXME!!! + * This call sets the default keytab for the whole server, not + * just for this context. Need to find a way that does not alter + * the state of the whole server ... */ + ret = gsskrb5_register_acceptor_identity(ktname); + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + mech_set.count = 1; + mech_set.elements = &gse_ctx->gss_mech; + + gss_maj = gss_acquire_cred(&gss_min, + GSS_C_NO_NAME, + GSS_C_INDEFINITE, + &mech_set, + GSS_C_ACCEPT, + &gse_ctx->creds, + NULL, NULL); + if (gss_maj) { + DEBUG(0, ("gss_acquire_creds failed with [%s]\n", + gse_errstr(gse_ctx, gss_maj, gss_min))); + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + status = NT_STATUS_OK; + +done: + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(gse_ctx); + } + + *_gse_ctx = gse_ctx; + return status; +} + +NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + OM_uint32 gss_maj, gss_min; + gss_buffer_desc in_data; + gss_buffer_desc out_data; + DATA_BLOB blob = data_blob_null; + NTSTATUS status; + + in_data.value = token_in->data; + in_data.length = token_in->length; + + gss_maj = gss_accept_sec_context(&gss_min, + &gse_ctx->gss_ctx, + gse_ctx->creds, + &in_data, + GSS_C_NO_CHANNEL_BINDINGS, + &gse_ctx->client_name, + &gse_ctx->ret_mech, + &out_data, + &gse_ctx->ret_flags, NULL, + &gse_ctx->delegated_creds); + switch (gss_maj) { + case GSS_S_COMPLETE: + /* we are done with it */ + gse_ctx->more_processing = false; + gse_ctx->authenticated = true; + status = NT_STATUS_OK; + break; + case GSS_S_CONTINUE_NEEDED: + /* we will need a third leg */ + gse_ctx->more_processing = true; + /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ + status = NT_STATUS_OK; + break; + default: + DEBUG(0, ("gss_init_sec_context failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + + if (gse_ctx->gss_ctx) { + gss_delete_sec_context(&gss_min, + &gse_ctx->gss_ctx, + GSS_C_NO_BUFFER); + } + + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + /* we may be told to return nothing */ + if (out_data.length) { + blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); + if (!blob.data) { + status = NT_STATUS_NO_MEMORY; + } + gss_maj = gss_release_buffer(&gss_min, &out_data); + } + + +done: + *token_out = blob; + return status; +} + +NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) +{ + if (!gse_ctx->authenticated) { + return NT_STATUS_INVALID_HANDLE; + } + + if (memcmp(gse_ctx->ret_mech, + gss_mech_krb5, sizeof(gss_OID_desc)) != 0) { + return NT_STATUS_ACCESS_DENIED; + } + + /* GSS_C_MUTUAL_FLAG */ + if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) { + if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) { + return NT_STATUS_ACCESS_DENIED; + } + } + + /* GSS_C_DELEG_FLAG */ + /* GSS_C_DELEG_POLICY_FLAG */ + /* GSS_C_REPLAY_FLAG */ + /* GSS_C_SEQUENCE_FLAG */ + + /* GSS_C_INTEG_FLAG */ + if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) { + if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) { + return NT_STATUS_ACCESS_DENIED; + } + } + + /* GSS_C_CONF_FLAG */ + if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) { + if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) { + return NT_STATUS_ACCESS_DENIED; + } + } + + return NT_STATUS_OK; +} + +static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_desc msg_min; + gss_buffer_desc msg_maj; + OM_uint32 msg_ctx = 0; + + char *errstr = NULL; + + ZERO_STRUCT(msg_min); + ZERO_STRUCT(msg_maj); + + gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE, + GSS_C_NO_OID, &msg_ctx, &msg_maj); + if (gss_maj) { + goto done; + } + gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE, + (gss_OID)discard_const(gss_mech_krb5), + &msg_ctx, &msg_min); + if (gss_maj) { + goto done; + } + + errstr = talloc_strndup(mem_ctx, + (char *)msg_maj.value, + msg_maj.length); + if (!errstr) { + goto done; + } + errstr = talloc_strdup_append_buffer(errstr, ": "); + if (!errstr) { + goto done; + } + errstr = talloc_strndup_append_buffer(errstr, + (char *)msg_min.value, + msg_min.length); + if (!errstr) { + goto done; + } + +done: + if (msg_min.value) { + gss_maj = gss_release_buffer(&gss_min, &msg_min); + } + if (msg_maj.value) { + gss_maj = gss_release_buffer(&gss_min, &msg_maj); + } + return errstr; +} + +bool gse_require_more_processing(struct gse_context *gse_ctx) +{ + return gse_ctx->more_processing; +} + +DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; + DATA_BLOB ret; + + gss_maj = gss_inquire_sec_context_by_oid( + &gss_min, gse_ctx->gss_ctx, + &gse_sesskey_inq_oid, &set); + if (gss_maj) { + DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return data_blob_null; + } + + if ((set == GSS_C_NO_BUFFER_SET) || + (set->count != 2) || + (memcmp(set->elements[1].value, + gse_sesskeytype_oid.elements, + gse_sesskeytype_oid.length) != 0)) { + DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " + "OID for data in results:\n")); + dump_data(1, (uint8_t *)set->elements[1].value, + set->elements[1].length); + return data_blob_null; + } + + ret = data_blob_talloc(mem_ctx, set->elements[0].value, + set->elements[0].length); + + gss_maj = gss_release_buffer_set(&gss_min, &set); + return ret; +} + +NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, char **cli_name) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_desc name_buffer; + + if (!gse_ctx->authenticated) { + return NT_STATUS_ACCESS_DENIED; + } + + if (!gse_ctx->client_name) { + return NT_STATUS_NOT_FOUND; + } + + /* TODO: check OID matches KRB5 Principal Name OID ? */ + + gss_maj = gss_display_name(&gss_min, + gse_ctx->client_name, + &name_buffer, NULL); + if (gss_maj) { + DEBUG(0, ("gss_display_name failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return NT_STATUS_INTERNAL_ERROR; + } + + *cli_name = talloc_strndup(talloc_tos(), + (char *)name_buffer.value, + name_buffer.length); + + gss_maj = gss_release_buffer(&gss_min, &name_buffer); + + if (!*cli_name) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + +NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, DATA_BLOB *pac) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; + + if (!gse_ctx->authenticated) { + return NT_STATUS_ACCESS_DENIED; + } + + gss_maj = gss_inquire_sec_context_by_oid( + &gss_min, gse_ctx->gss_ctx, + &gse_authz_data_oid, &set); + if (gss_maj) { + DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return NT_STATUS_NOT_FOUND; + } + + if (set == GSS_C_NO_BUFFER_SET) { + DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " + "data in results.\n")); + return NT_STATUS_INTERNAL_ERROR; + } + + /* for now we just hope it is the first value */ + *pac = data_blob_talloc(mem_ctx, + set->elements[0].value, + set->elements[0].length); + + gss_maj = gss_release_buffer_set(&gss_min, &set); + + return NT_STATUS_OK; +} + +NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; + int32_t tkttime; + + if (!gse_ctx->authenticated) { + return NT_STATUS_ACCESS_DENIED; + } + + gss_maj = gss_inquire_sec_context_by_oid( + &gss_min, gse_ctx->gss_ctx, + &gse_authtime_oid, &set); + if (gss_maj) { + DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return NT_STATUS_NOT_FOUND; + } + + if ((set == GSS_C_NO_BUFFER_SET) || (set->count != 1) != 0) { + DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " + "data in results.\n")); + return NT_STATUS_INTERNAL_ERROR; + } + + if (set->elements[0].length != sizeof(int32_t)) { + DEBUG(0, ("Invalid authtime size!\n")); + return NT_STATUS_INTERNAL_ERROR; + } + + tkttime = *((int32_t *)set->elements[0].value); + + gss_maj = gss_release_buffer_set(&gss_min, &set); + + *authtime = (time_t)tkttime; + return NT_STATUS_OK; +} + +size_t gse_get_signature_length(struct gse_context *gse_ctx, + int seal, size_t payload_size) +{ + OM_uint32 gss_min, gss_maj; + gss_iov_buffer_desc iov[2]; + uint8_t fakebuf[payload_size]; + int sealed; + + iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; + iov[0].buffer.value = NULL; + iov[0].buffer.length = 0; + iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; + iov[1].buffer.value = fakebuf; + iov[1].buffer.length = payload_size; + + gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gss_ctx, + seal, GSS_C_QOP_DEFAULT, + &sealed, iov, 2); + if (gss_maj) { + DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return 0; + } + + return iov[0].buffer.length; +} + +NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + OM_uint32 gss_min, gss_maj; + gss_iov_buffer_desc iov[2]; + int req_seal = 1; /* setting to 1 means we request sign+seal */ + int sealed; + NTSTATUS status; + + /* allocate the memory ourselves so we do not need to talloc_memdup */ + signature->length = gse_get_signature_length(gse_ctx, 1, data->length); + if (!signature->length) { + return NT_STATUS_INTERNAL_ERROR; + } + signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length); + if (!signature->data) { + return NT_STATUS_NO_MEMORY; + } + iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; + iov[0].buffer.value = signature->data; + iov[0].buffer.length = signature->length; + + /* data is encrypted in place, which is ok */ + iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; + iov[1].buffer.value = data->data; + iov[1].buffer.length = data->length; + + gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gss_ctx, + req_seal, GSS_C_QOP_DEFAULT, + &sealed, iov, 2); + if (gss_maj) { + DEBUG(0, ("gss_wrap_iov failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + if (!sealed) { + DEBUG(0, ("gss_wrap_iov says data was not sealed!\n")); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + status = NT_STATUS_OK; + + DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n", + (int)iov[1].buffer.length, (int)iov[0].buffer.length)); + +done: + return status; +} + +NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + OM_uint32 gss_min, gss_maj; + gss_iov_buffer_desc iov[2]; + int sealed; + NTSTATUS status; + + iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; + iov[0].buffer.value = signature->data; + iov[0].buffer.length = signature->length; + + /* data is decrypted in place, which is ok */ + iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; + iov[1].buffer.value = data->data; + iov[1].buffer.length = data->length; + + gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gss_ctx, + &sealed, NULL, iov, 2); + if (gss_maj) { + DEBUG(0, ("gss_unwrap_iov failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + if (!sealed) { + DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n")); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + status = NT_STATUS_OK; + + DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n", + (int)iov[1].buffer.length, (int)iov[0].buffer.length)); + +done: + return status; +} + +NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_desc in_data = { 0, NULL }; + gss_buffer_desc out_data = { 0, NULL}; + NTSTATUS status; + + in_data.value = data->data; + in_data.length = data->length; + + gss_maj = gss_get_mic(&gss_min, gse_ctx->gss_ctx, + GSS_C_QOP_DEFAULT, + &in_data, &out_data); + if (gss_maj) { + DEBUG(0, ("gss_get_mic failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + *signature = data_blob_talloc(mem_ctx, + out_data.value, out_data.length); + if (!signature->data) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + + status = NT_STATUS_OK; + +done: + if (out_data.value) { + gss_maj = gss_release_buffer(&gss_min, &out_data); + } + return status; +} + +NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_desc in_data = { 0, NULL }; + gss_buffer_desc in_token = { 0, NULL}; + NTSTATUS status; + + in_data.value = data->data; + in_data.length = data->length; + in_token.value = signature->data; + in_token.length = signature->length; + + gss_maj = gss_verify_mic(&gss_min, gse_ctx->gss_ctx, + &in_data, &in_token, NULL); + if (gss_maj) { + DEBUG(0, ("gss_verify_mic failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + status = NT_STATUS_OK; + +done: + return status; +} + +#else + +NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + const char *ccache_name, + const char *server, + const char *service, + const char *username, + const char *password, + uint32_t add_gss_c_flags, + struct gse_context **_gse_ctx) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + uint32_t add_gss_c_flags, + const char *server, + const char *keytab, + struct gse_context **_gse_ctx) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +bool gse_require_more_processing(struct gse_context *gse_ctx) +{ + return false; +} + +DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx) +{ + return data_blob_null; +} + +NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, char **cli_name) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, DATA_BLOB *pac) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +size_t gse_get_signature_length(struct gse_context *gse_ctx, + int seal, size_t payload_size) +{ + return 0; +} + +NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +#endif /* HAVE_KRB5 && HAVE_GSSAPI_EXT_H && HAVE_GSS_WRAP_IOV */ diff --git a/source3/librpc/crypto/gse.h b/source3/librpc/crypto/gse.h new file mode 100644 index 0000000000..6f8b6735ad --- /dev/null +++ b/source3/librpc/crypto/gse.h @@ -0,0 +1,77 @@ +/* + * GSSAPI Security Extensions + * RPC Pipe client routines + * Copyright (C) Simo Sorce 2010. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#ifndef _GSE_H_ +#define _GSE_H_ + +struct gse_context; + +#ifndef GSS_C_DCE_STYLE +#define GSS_C_DCE_STYLE 0x1000 +#endif + +NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + const char *ccache_name, + const char *server, + const char *service, + const char *username, + const char *password, + uint32_t add_gss_c_flags, + struct gse_context **_gse_ctx); +NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out); + +NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + uint32_t add_gss_c_flags, + const char *server, + const char *keytab, + struct gse_context **_gse_ctx); +NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out); +NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx); + +bool gse_require_more_processing(struct gse_context *gse_ctx); +DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx); +NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, char **client_name); +NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, DATA_BLOB *pac); +NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime); + +size_t gse_get_signature_length(struct gse_context *gse_ctx, + int seal, size_t payload_size); +NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature); +NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature); +NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature); +NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, + DATA_BLOB *data, DATA_BLOB *signature); + +#endif /* _GSE_H_ */ diff --git a/source3/librpc/crypto/gse_krb5.c b/source3/librpc/crypto/gse_krb5.c new file mode 100644 index 0000000000..735dff059e --- /dev/null +++ b/source3/librpc/crypto/gse_krb5.c @@ -0,0 +1,388 @@ +/* + * GSSAPI Security Extensions + * Krb5 helpers + * Copyright (C) Simo Sorce 2010. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#include "includes.h" +#include "smb_krb5.h" +#include "secrets.h" +#include "gse_krb5.h" + +#ifdef HAVE_KRB5 + +static krb5_error_code flush_keytab(krb5_context krbctx, krb5_keytab keytab) +{ + krb5_error_code ret; + krb5_kt_cursor kt_cursor; + krb5_keytab_entry kt_entry; + + ZERO_STRUCT(kt_entry); + + ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor); + if (ret == KRB5_KT_END || ret == ENOENT ) { + /* no entries */ + return 0; + } + + ret = krb5_kt_next_entry(krbctx, keytab, &kt_entry, &kt_cursor); + while (ret == 0) { + + /* we need to close and reopen enumeration because we modify + * the keytab */ + ret = krb5_kt_end_seq_get(krbctx, keytab, &kt_cursor); + if (ret) { + DEBUG(1, (__location__ ": krb5_kt_end_seq_get() " + "failed (%s)\n", error_message(ret))); + goto out; + } + + /* remove the entry */ + ret = krb5_kt_remove_entry(krbctx, keytab, &kt_entry); + if (ret) { + DEBUG(1, (__location__ ": krb5_kt_remove_entry() " + "failed (%s)\n", error_message(ret))); + goto out; + } + ret = smb_krb5_kt_free_entry(krbctx, &kt_entry); + ZERO_STRUCT(kt_entry); + + /* now reopen */ + ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor); + if (ret) { + DEBUG(1, (__location__ ": krb5_kt_start_seq() failed " + "(%s)\n", error_message(ret))); + goto out; + } + + ret = krb5_kt_next_entry(krbctx, keytab, + &kt_entry, &kt_cursor); + } + + if (ret != KRB5_KT_END && ret != ENOENT) { + DEBUG(1, (__location__ ": flushing keytab we got [%s]!\n", + error_message(ret))); + } + + ret = 0; + +out: + return ret; +} + +static krb5_error_code get_host_principal(krb5_context krbctx, + krb5_principal *host_princ) +{ + krb5_error_code ret; + char *host_princ_s = NULL; + int err; + + err = asprintf(&host_princ_s, "%s$@%s", global_myname(), lp_realm()); + if (err == -1) { + return -1; + } + + strlower_m(host_princ_s); + ret = smb_krb5_parse_name(krbctx, host_princ_s, host_princ); + if (ret) { + DEBUG(1, (__location__ ": smb_krb5_parse_name(%s) " + "failed (%s)\n", + host_princ_s, error_message(ret))); + } + + SAFE_FREE(host_princ_s); + return ret; +} + +static krb5_error_code fill_keytab_from_password(krb5_context krbctx, + krb5_keytab keytab, + krb5_principal princ, + krb5_kvno vno, + krb5_data *password) +{ + krb5_error_code ret; + krb5_enctype *enctypes; + krb5_keytab_entry kt_entry; + unsigned int i; + + ret = get_kerberos_allowed_etypes(krbctx, &enctypes); + if (ret) { + DEBUG(1, (__location__ + ": Can't determine permitted enctypes!\n")); + return ret; + } + + for (i = 0; enctypes[i]; i++) { + krb5_keyblock *key = NULL; + + if (!(key = SMB_MALLOC_P(krb5_keyblock))) { + ret = ENOMEM; + goto out; + } + + if (create_kerberos_key_from_string(krbctx, princ, + password, key, + enctypes[i], false)) { + DEBUG(10, ("Failed to create key for enctype %d " + "(error: %s)\n", + enctypes[i], error_message(ret))); + SAFE_FREE(key); + continue; + } + + kt_entry.principal = princ; + kt_entry.vno = vno; + *(KRB5_KT_KEY(&kt_entry)) = *key; + + ret = krb5_kt_add_entry(krbctx, keytab, &kt_entry); + if (ret) { + DEBUG(1, (__location__ ": Failed to add entry to " + "keytab for enctype %d (error: %s)\n", + enctypes[i], error_message(ret))); + krb5_free_keyblock(krbctx, key); + goto out; + } + + krb5_free_keyblock(krbctx, key); + } + + ret = 0; + +out: + SAFE_FREE(enctypes); + return ret; +} + +#define SRV_MEM_KEYTAB_NAME "MEMORY:cifs_srv_keytab" +#define CLEARTEXT_PRIV_ENCTYPE -99 + +static krb5_error_code get_mem_keytab_from_secrets(krb5_context krbctx, + krb5_keytab *keytab) +{ + krb5_error_code ret; + char *pwd = NULL; + size_t pwd_len; + krb5_kt_cursor kt_cursor; + krb5_keytab_entry kt_entry; + krb5_data password; + krb5_principal princ = NULL; + krb5_kvno kvno = 0; /* FIXME: fetch current vno from KDC ? */ + char *pwd_old = NULL; + + if (!secrets_init()) { + DEBUG(1, (__location__ ": secrets_init failed\n")); + return KRB5_CONFIG_CANTOPEN; + } + + pwd = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); + if (!pwd) { + DEBUG(2, (__location__ ": failed to fetch machine password\n")); + return KRB5_LIBOS_CANTREADPWD; + } + pwd_len = strlen(pwd); + + if (*keytab == NULL) { + /* create memory keytab */ + ret = krb5_kt_resolve(krbctx, SRV_MEM_KEYTAB_NAME, keytab); + if (ret) { + DEBUG(1, (__location__ ": Failed to get memory " + "keytab!\n")); + return ret; + } + } + + ZERO_STRUCT(kt_entry); + ZERO_STRUCT(kt_cursor); + + /* check if the keytab already has any entry */ + ret = krb5_kt_start_seq_get(krbctx, *keytab, &kt_cursor); + if (ret != KRB5_KT_END && ret != ENOENT ) { + /* check if we have our special enctype used to hold + * the clear text password. If so, check it out so that + * we can verify if the keytab needs to be upgraded */ + while ((ret = krb5_kt_next_entry(krbctx, *keytab, + &kt_entry, &kt_cursor)) == 0) { + if (smb_get_enctype_from_kt_entry(&kt_entry) == CLEARTEXT_PRIV_ENCTYPE) { + break; + } + smb_krb5_kt_free_entry(krbctx, &kt_entry); + ZERO_STRUCT(kt_entry); + } + + if (ret != 0 && ret != KRB5_KT_END && ret != ENOENT ) { + /* Error parsing keytab */ + DEBUG(1, (__location__ ": Failed to parse memory " + "keytab!\n")); + goto out; + } + + if (ret == 0) { + /* found private entry, + * check if keytab is up to date */ + + if ((pwd_len == KRB5_KEY_LENGTH(KRB5_KT_KEY(&kt_entry))) && + (memcmp(KRB5_KEY_DATA(KRB5_KT_KEY(&kt_entry)), + pwd, pwd_len) == 0)) { + /* keytab is already up to date, return */ + smb_krb5_kt_free_entry(krbctx, &kt_entry); + goto out; + } + + smb_krb5_kt_free_entry(krbctx, &kt_entry); + ZERO_STRUCT(kt_entry); + + + /* flush keytab, we need to regen it */ + ret = flush_keytab(krbctx, *keytab); + if (ret) { + DEBUG(1, (__location__ ": Failed to flush " + "memory keytab!\n")); + goto out; + } + } + } + + { + krb5_kt_cursor zero_csr; + ZERO_STRUCT(zero_csr); + if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && *keytab) { + krb5_kt_end_seq_get(krbctx, *keytab, &kt_cursor); + } + } + + /* keytab is not up to date, fill it up */ + + ret = get_host_principal(krbctx, &princ); + if (ret) { + DEBUG(1, (__location__ ": Failed to get host principal!\n")); + goto out; + } + + password.data = pwd; + password.length = pwd_len; + ret = fill_keytab_from_password(krbctx, *keytab, + princ, kvno, &password); + if (ret) { + DEBUG(1, (__location__ ": Failed to fill memory keytab!\n")); + goto out; + } + + pwd_old = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); + if (!pwd_old) { + DEBUG(10, (__location__ ": no prev machine password\n")); + } else { + password.data = pwd_old; + password.length = strlen(pwd_old); + ret = fill_keytab_from_password(krbctx, *keytab, + princ, kvno -1, &password); + if (ret) { + DEBUG(1, (__location__ + ": Failed to fill memory keytab!\n")); + goto out; + } + } + + /* add our private enctype + cleartext password so that we can + * update the keytab if secrets change later on */ + ZERO_STRUCT(kt_entry); + kt_entry.principal = princ; + kt_entry.vno = 0; + + KRB5_KEY_TYPE(KRB5_KT_KEY(&kt_entry)) = CLEARTEXT_PRIV_ENCTYPE; + KRB5_KEY_LENGTH(KRB5_KT_KEY(&kt_entry)) = pwd_len; + KRB5_KEY_DATA(KRB5_KT_KEY(&kt_entry)) = (uint8_t *)pwd; + + ret = krb5_kt_add_entry(krbctx, *keytab, &kt_entry); + if (ret) { + DEBUG(1, (__location__ ": Failed to add entry to " + "keytab for private enctype (%d) (error: %s)\n", + CLEARTEXT_PRIV_ENCTYPE, error_message(ret))); + goto out; + } + + ret = 0; + +out: + SAFE_FREE(pwd); + SAFE_FREE(pwd_old); + + { + krb5_kt_cursor zero_csr; + ZERO_STRUCT(zero_csr); + if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && *keytab) { + krb5_kt_end_seq_get(krbctx, *keytab, &kt_cursor); + } + } + + if (princ) { + krb5_free_principal(krbctx, princ); + } + + if (ret) { + if (*keytab) { + krb5_kt_close(krbctx, *keytab); + *keytab = NULL; + } + } + + return ret; +} + +static krb5_error_code get_mem_keytab_from_system_keytab(krb5_context krbctx, + krb5_keytab *keytab, + bool verify) +{ + return KRB5_KT_NOTFOUND; +} + +krb5_error_code gse_krb5_get_server_keytab(krb5_context krbctx, + krb5_keytab *keytab) +{ + krb5_error_code ret; + + *keytab = NULL; + + switch (lp_kerberos_method()) { + default: + case KERBEROS_VERIFY_SECRETS: + ret = get_mem_keytab_from_secrets(krbctx, keytab); + break; + case KERBEROS_VERIFY_SYSTEM_KEYTAB: + ret = get_mem_keytab_from_system_keytab(krbctx, keytab, true); + break; + case KERBEROS_VERIFY_DEDICATED_KEYTAB: + /* just use whatever keytab is configured */ + ret = get_mem_keytab_from_system_keytab(krbctx, keytab, false); + break; + case KERBEROS_VERIFY_SECRETS_AND_KEYTAB: + ret = get_mem_keytab_from_secrets(krbctx, keytab); + if (ret) { + DEBUG(3, (__location__ ": Warning! Unable to set mem " + "keytab from secrets!\n")); + } + /* Now append system keytab keys too */ + ret = get_mem_keytab_from_system_keytab(krbctx, keytab, true); + if (ret) { + DEBUG(3, (__location__ ": Warning! Unable to set mem " + "keytab from secrets!\n")); + } + break; + } + + return ret; +} + +#endif /* HAVE_KRB5 */ diff --git a/source3/librpc/crypto/gse_krb5.h b/source3/librpc/crypto/gse_krb5.h new file mode 100644 index 0000000000..ea789c947a --- /dev/null +++ b/source3/librpc/crypto/gse_krb5.h @@ -0,0 +1,30 @@ +/* + * GSSAPI Security Extensions + * Krb5 helpers + * Copyright (C) Simo Sorce 2010. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#ifndef _GSE_KRB5_H_ +#define _GSE_KRB5_H_ + +#ifdef HAVE_KRB5 + +krb5_error_code gse_krb5_get_server_keytab(krb5_context krbctx, + krb5_keytab *keytab); + +#endif /* HAVE_KRB5 */ + +#endif /* _GSE_KRB5_H_ */ diff --git a/source3/librpc/rpc/dcerpc_gssapi.c b/source3/librpc/rpc/dcerpc_gssapi.c deleted file mode 100644 index 2918cfdf8f..0000000000 --- a/source3/librpc/rpc/dcerpc_gssapi.c +++ /dev/null @@ -1,1034 +0,0 @@ -/* - * GSSAPI Security Extensions - * RPC Pipe client and server routines - * Copyright (C) Simo Sorce 2010. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -/* We support only GSSAPI/KRB5 here */ - -#include "includes.h" -#include "dcerpc_gssapi.h" - -#if defined(HAVE_KRB5) && defined(HAVE_GSSAPI_GSSAPI_EXT_H) && defined(HAVE_GSS_WRAP_IOV) - -#include "smb_krb5.h" -#include "dcerpc_krb5.h" - -#include -#include -#include - -#ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID -#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11 -#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05" -#endif - -gss_OID_desc gse_sesskey_inq_oid = { - GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH, - (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID -}; - -#ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID -#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10 -#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04" -#endif - -gss_OID_desc gse_sesskeytype_oid = { - GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH, - (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID -}; - -#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12 -/* EXTRACTION OID AUTHZ ID */ -#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01" - -gss_OID_desc gse_authz_data_oid = { - GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH, - (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID -}; - -#ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID -#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11 -#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c" -#endif - -gss_OID_desc gse_authtime_oid = { - GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH, - (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID -}; - -static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min); - -struct gse_context { - krb5_context k5ctx; - krb5_ccache ccache; - krb5_keytab keytab; - - gss_ctx_id_t gss_ctx; - - gss_OID_desc gss_mech; - OM_uint32 gss_c_flags; - gss_cred_id_t creds; - gss_name_t server_name; - - gss_OID ret_mech; - OM_uint32 ret_flags; - gss_cred_id_t delegated_creds; - gss_name_t client_name; - - bool spnego_wrap; - bool more_processing; - bool authenticated; -}; - -/* free non talloc dependent contexts */ -static int gse_context_destructor(void *ptr) -{ - struct gse_context *gse_ctx; - OM_uint32 gss_min, gss_maj; - - gse_ctx = talloc_get_type_abort(ptr, struct gse_context); - if (gse_ctx->k5ctx) { - if (gse_ctx->ccache) { - krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache); - gse_ctx->ccache = NULL; - } - if (gse_ctx->keytab) { - krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab); - gse_ctx->keytab = NULL; - } - krb5_free_context(gse_ctx->k5ctx); - gse_ctx->k5ctx = NULL; - } - if (gse_ctx->gss_ctx != GSS_C_NO_CONTEXT) { - gss_maj = gss_delete_sec_context(&gss_min, - &gse_ctx->gss_ctx, - GSS_C_NO_BUFFER); - } - if (gse_ctx->server_name) { - gss_maj = gss_release_name(&gss_min, - &gse_ctx->server_name); - } - if (gse_ctx->client_name) { - gss_maj = gss_release_name(&gss_min, - &gse_ctx->client_name); - } - if (gse_ctx->creds) { - gss_maj = gss_release_cred(&gss_min, - &gse_ctx->creds); - } - if (gse_ctx->delegated_creds) { - gss_maj = gss_release_cred(&gss_min, - &gse_ctx->delegated_creds); - } - if (gse_ctx->ret_mech) { - gss_maj = gss_release_oid(&gss_min, - &gse_ctx->ret_mech); - } - return 0; -} - -static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx) -{ - struct gse_context *gse_ctx; - krb5_error_code k5ret; - NTSTATUS status; - - gse_ctx = talloc_zero(mem_ctx, struct gse_context); - if (!gse_ctx) { - return NT_STATUS_NO_MEMORY; - } - talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor); - - memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc)); - - switch (auth_type) { - case DCERPC_AUTH_TYPE_SPNEGO: - gse_ctx->spnego_wrap = true; - break; - case DCERPC_AUTH_TYPE_KRB5: - gse_ctx->spnego_wrap = false; - break; - default: - status = NT_STATUS_INVALID_PARAMETER; - goto err_out; - } - - gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG | - GSS_C_DELEG_FLAG | - GSS_C_DELEG_POLICY_FLAG | - GSS_C_REPLAY_FLAG | - GSS_C_SEQUENCE_FLAG; - switch (auth_level) { - case DCERPC_AUTH_LEVEL_INTEGRITY: - gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG; - break; - case DCERPC_AUTH_LEVEL_PRIVACY: - gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG; - break; - default: - break; - } - - gse_ctx->gss_c_flags |= add_gss_c_flags; - - /* Initialize Kerberos Context */ - initialize_krb5_error_table(); - - k5ret = krb5_init_context(&gse_ctx->k5ctx); - if (k5ret) { - DEBUG(0, ("Failed to initialize kerberos context! (%s)\n", - error_message(k5ret))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - if (!ccache_name) { - ccache_name = krb5_cc_default_name(gse_ctx->k5ctx); - } - k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name, - &gse_ctx->ccache); - if (k5ret) { - DEBUG(1, ("Failed to resolve credential cache! (%s)\n", - error_message(k5ret))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - /* TODO: Should we enforce a enc_types list ? - ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types); - */ - - *_gse_ctx = gse_ctx; - return NT_STATUS_OK; - -err_out: - TALLOC_FREE(gse_ctx); - return status; -} - -NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - const char *server, - const char *service, - const char *username, - const char *password, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx) -{ - struct gse_context *gse_ctx; - OM_uint32 gss_maj, gss_min; - gss_buffer_desc name_buffer = {0, NULL}; - gss_OID_set_desc mech_set; - NTSTATUS status; - - if (!server || !service) { - return NT_STATUS_INVALID_PARAMETER; - } - - status = gse_context_init(mem_ctx, auth_type, auth_level, - ccache_name, add_gss_c_flags, - &gse_ctx); - if (!NT_STATUS_IS_OK(status)) { - return NT_STATUS_NO_MEMORY; - } - - name_buffer.value = talloc_asprintf(gse_ctx, - "%s@%s", service, server); - if (!name_buffer.value) { - status = NT_STATUS_NO_MEMORY; - goto err_out; - } - name_buffer.length = strlen((char *)name_buffer.value); - gss_maj = gss_import_name(&gss_min, &name_buffer, - GSS_C_NT_HOSTBASED_SERVICE, - &gse_ctx->server_name); - if (gss_maj) { - DEBUG(0, ("gss_import_name failed for %s, with [%s]\n", - (char *)name_buffer.value, - gse_errstr(gse_ctx, gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - /* TODO: get krb5 ticket using username/password, if no valid - * one already available in ccache */ - - mech_set.count = 1; - mech_set.elements = &gse_ctx->gss_mech; - - gss_maj = gss_acquire_cred(&gss_min, - GSS_C_NO_NAME, - GSS_C_INDEFINITE, - &mech_set, - GSS_C_INITIATE, - &gse_ctx->creds, - NULL, NULL); - if (gss_maj) { - DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n", - (char *)name_buffer.value, - gse_errstr(gse_ctx, gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto err_out; - } - - *_gse_ctx = gse_ctx; - TALLOC_FREE(name_buffer.value); - return NT_STATUS_OK; - -err_out: - TALLOC_FREE(name_buffer.value); - TALLOC_FREE(gse_ctx); - return status; -} - -NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - OM_uint32 gss_maj, gss_min; - gss_buffer_desc in_data; - gss_buffer_desc out_data; - DATA_BLOB blob = data_blob_null; - NTSTATUS status; - - in_data.value = token_in->data; - in_data.length = token_in->length; - - gss_maj = gss_init_sec_context(&gss_min, - gse_ctx->creds, - &gse_ctx->gss_ctx, - gse_ctx->server_name, - &gse_ctx->gss_mech, - gse_ctx->gss_c_flags, - 0, GSS_C_NO_CHANNEL_BINDINGS, - &in_data, NULL, &out_data, - NULL, NULL); - switch (gss_maj) { - case GSS_S_COMPLETE: - /* we are done with it */ - gse_ctx->more_processing = false; - status = NT_STATUS_OK; - break; - case GSS_S_CONTINUE_NEEDED: - /* we will need a third leg */ - gse_ctx->more_processing = true; - /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ - status = NT_STATUS_OK; - break; - default: - DEBUG(0, ("gss_init_sec_context failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); - if (!blob.data) { - status = NT_STATUS_NO_MEMORY; - } - - gss_maj = gss_release_buffer(&gss_min, &out_data); - -done: - *token_out = blob; - return status; -} - -NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - uint32_t add_gss_c_flags, - const char *server, - const char *keytab_name, - struct gse_context **_gse_ctx) -{ - struct gse_context *gse_ctx; - OM_uint32 gss_maj, gss_min; - gss_OID_set_desc mech_set; - krb5_error_code ret; - const char *ktname; - NTSTATUS status; - - status = gse_context_init(mem_ctx, auth_type, auth_level, - NULL, add_gss_c_flags, &gse_ctx); - if (!NT_STATUS_IS_OK(status)) { - return NT_STATUS_NO_MEMORY; - } - - if (!keytab_name) { - ret = smb_krb5_get_server_keytab(gse_ctx->k5ctx, - &gse_ctx->keytab); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx, - gse_ctx->keytab, &ktname); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - } else { - ktname = keytab_name; - } - - /* FIXME!!! - * This call sets the default keytab for the whole server, not - * just for this context. Need to find a way that does not alter - * the state of the whole server ... */ - ret = gsskrb5_register_acceptor_identity(ktname); - if (ret) { - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - mech_set.count = 1; - mech_set.elements = &gse_ctx->gss_mech; - - gss_maj = gss_acquire_cred(&gss_min, - GSS_C_NO_NAME, - GSS_C_INDEFINITE, - &mech_set, - GSS_C_ACCEPT, - &gse_ctx->creds, - NULL, NULL); - if (gss_maj) { - DEBUG(0, ("gss_acquire_creds failed with [%s]\n", - gse_errstr(gse_ctx, gss_maj, gss_min))); - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - status = NT_STATUS_OK; - -done: - if (!NT_STATUS_IS_OK(status)) { - TALLOC_FREE(gse_ctx); - } - - *_gse_ctx = gse_ctx; - return status; -} - -NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - OM_uint32 gss_maj, gss_min; - gss_buffer_desc in_data; - gss_buffer_desc out_data; - DATA_BLOB blob = data_blob_null; - NTSTATUS status; - - in_data.value = token_in->data; - in_data.length = token_in->length; - - gss_maj = gss_accept_sec_context(&gss_min, - &gse_ctx->gss_ctx, - gse_ctx->creds, - &in_data, - GSS_C_NO_CHANNEL_BINDINGS, - &gse_ctx->client_name, - &gse_ctx->ret_mech, - &out_data, - &gse_ctx->ret_flags, NULL, - &gse_ctx->delegated_creds); - switch (gss_maj) { - case GSS_S_COMPLETE: - /* we are done with it */ - gse_ctx->more_processing = false; - gse_ctx->authenticated = true; - status = NT_STATUS_OK; - break; - case GSS_S_CONTINUE_NEEDED: - /* we will need a third leg */ - gse_ctx->more_processing = true; - /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ - status = NT_STATUS_OK; - break; - default: - DEBUG(0, ("gss_init_sec_context failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - - if (gse_ctx->gss_ctx) { - gss_delete_sec_context(&gss_min, - &gse_ctx->gss_ctx, - GSS_C_NO_BUFFER); - } - - status = NT_STATUS_INTERNAL_ERROR; - goto done; - } - - /* we may be told to return nothing */ - if (out_data.length) { - blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); - if (!blob.data) { - status = NT_STATUS_NO_MEMORY; - } - gss_maj = gss_release_buffer(&gss_min, &out_data); - } - - -done: - *token_out = blob; - return status; -} - -NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) -{ - if (!gse_ctx->authenticated) { - return NT_STATUS_INVALID_HANDLE; - } - - if (memcmp(gse_ctx->ret_mech, - gss_mech_krb5, sizeof(gss_OID_desc)) != 0) { - return NT_STATUS_ACCESS_DENIED; - } - - /* GSS_C_MUTUAL_FLAG */ - if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) { - if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) { - return NT_STATUS_ACCESS_DENIED; - } - } - - /* GSS_C_DELEG_FLAG */ - /* GSS_C_DELEG_POLICY_FLAG */ - /* GSS_C_REPLAY_FLAG */ - /* GSS_C_SEQUENCE_FLAG */ - - /* GSS_C_INTEG_FLAG */ - if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) { - if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) { - return NT_STATUS_ACCESS_DENIED; - } - } - - /* GSS_C_CONF_FLAG */ - if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) { - if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) { - return NT_STATUS_ACCESS_DENIED; - } - } - - return NT_STATUS_OK; -} - -static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc msg_min; - gss_buffer_desc msg_maj; - OM_uint32 msg_ctx = 0; - - char *errstr = NULL; - - ZERO_STRUCT(msg_min); - ZERO_STRUCT(msg_maj); - - gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE, - GSS_C_NO_OID, &msg_ctx, &msg_maj); - if (gss_maj) { - goto done; - } - gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE, - (gss_OID)discard_const(gss_mech_krb5), - &msg_ctx, &msg_min); - if (gss_maj) { - goto done; - } - - errstr = talloc_strndup(mem_ctx, - (char *)msg_maj.value, - msg_maj.length); - if (!errstr) { - goto done; - } - errstr = talloc_strdup_append_buffer(errstr, ": "); - if (!errstr) { - goto done; - } - errstr = talloc_strndup_append_buffer(errstr, - (char *)msg_min.value, - msg_min.length); - if (!errstr) { - goto done; - } - -done: - if (msg_min.value) { - gss_maj = gss_release_buffer(&gss_min, &msg_min); - } - if (msg_maj.value) { - gss_maj = gss_release_buffer(&gss_min, &msg_maj); - } - return errstr; -} - -bool gse_require_more_processing(struct gse_context *gse_ctx) -{ - return gse_ctx->more_processing; -} - -DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; - DATA_BLOB ret; - - gss_maj = gss_inquire_sec_context_by_oid( - &gss_min, gse_ctx->gss_ctx, - &gse_sesskey_inq_oid, &set); - if (gss_maj) { - DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return data_blob_null; - } - - if ((set == GSS_C_NO_BUFFER_SET) || - (set->count != 2) || - (memcmp(set->elements[1].value, - gse_sesskeytype_oid.elements, - gse_sesskeytype_oid.length) != 0)) { - DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " - "OID for data in results:\n")); - dump_data(1, (uint8_t *)set->elements[1].value, - set->elements[1].length); - return data_blob_null; - } - - ret = data_blob_talloc(mem_ctx, set->elements[0].value, - set->elements[0].length); - - gss_maj = gss_release_buffer_set(&gss_min, &set); - return ret; -} - -NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, char **cli_name) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc name_buffer; - - if (!gse_ctx->authenticated) { - return NT_STATUS_ACCESS_DENIED; - } - - if (!gse_ctx->client_name) { - return NT_STATUS_NOT_FOUND; - } - - /* TODO: check OID matches KRB5 Principal Name OID ? */ - - gss_maj = gss_display_name(&gss_min, - gse_ctx->client_name, - &name_buffer, NULL); - if (gss_maj) { - DEBUG(0, ("gss_display_name failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return NT_STATUS_INTERNAL_ERROR; - } - - *cli_name = talloc_strndup(talloc_tos(), - (char *)name_buffer.value, - name_buffer.length); - - gss_maj = gss_release_buffer(&gss_min, &name_buffer); - - if (!*cli_name) { - return NT_STATUS_NO_MEMORY; - } - - return NT_STATUS_OK; -} - -NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, DATA_BLOB *pac) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; - - if (!gse_ctx->authenticated) { - return NT_STATUS_ACCESS_DENIED; - } - - gss_maj = gss_inquire_sec_context_by_oid( - &gss_min, gse_ctx->gss_ctx, - &gse_authz_data_oid, &set); - if (gss_maj) { - DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return NT_STATUS_NOT_FOUND; - } - - if (set == GSS_C_NO_BUFFER_SET) { - DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " - "data in results.\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - /* for now we just hope it is the first value */ - *pac = data_blob_talloc(mem_ctx, - set->elements[0].value, - set->elements[0].length); - - gss_maj = gss_release_buffer_set(&gss_min, &set); - - return NT_STATUS_OK; -} - -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; - int32_t tkttime; - - if (!gse_ctx->authenticated) { - return NT_STATUS_ACCESS_DENIED; - } - - gss_maj = gss_inquire_sec_context_by_oid( - &gss_min, gse_ctx->gss_ctx, - &gse_authtime_oid, &set); - if (gss_maj) { - DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return NT_STATUS_NOT_FOUND; - } - - if ((set == GSS_C_NO_BUFFER_SET) || (set->count != 1) != 0) { - DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " - "data in results.\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - if (set->elements[0].length != sizeof(int32_t)) { - DEBUG(0, ("Invalid authtime size!\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - tkttime = *((int32_t *)set->elements[0].value); - - gss_maj = gss_release_buffer_set(&gss_min, &set); - - *authtime = (time_t)tkttime; - return NT_STATUS_OK; -} - -size_t gse_get_signature_length(struct gse_context *gse_ctx, - int seal, size_t payload_size) -{ - OM_uint32 gss_min, gss_maj; - gss_iov_buffer_desc iov[2]; - uint8_t fakebuf[payload_size]; - int sealed; - - iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; - iov[0].buffer.value = NULL; - iov[0].buffer.length = 0; - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.value = fakebuf; - iov[1].buffer.length = payload_size; - - gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gss_ctx, - seal, GSS_C_QOP_DEFAULT, - &sealed, iov, 2); - if (gss_maj) { - DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - return 0; - } - - return iov[0].buffer.length; -} - -NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_iov_buffer_desc iov[2]; - int req_seal = 1; /* setting to 1 means we request sign+seal */ - int sealed; - NTSTATUS status; - - /* allocate the memory ourselves so we do not need to talloc_memdup */ - signature->length = gse_get_signature_length(gse_ctx, 1, data->length); - if (!signature->length) { - return NT_STATUS_INTERNAL_ERROR; - } - signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length); - if (!signature->data) { - return NT_STATUS_NO_MEMORY; - } - iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; - iov[0].buffer.value = signature->data; - iov[0].buffer.length = signature->length; - - /* data is encrypted in place, which is ok */ - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.value = data->data; - iov[1].buffer.length = data->length; - - gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gss_ctx, - req_seal, GSS_C_QOP_DEFAULT, - &sealed, iov, 2); - if (gss_maj) { - DEBUG(0, ("gss_wrap_iov failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - if (!sealed) { - DEBUG(0, ("gss_wrap_iov says data was not sealed!\n")); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - status = NT_STATUS_OK; - - DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n", - (int)iov[1].buffer.length, (int)iov[0].buffer.length)); - -done: - return status; -} - -NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_iov_buffer_desc iov[2]; - int sealed; - NTSTATUS status; - - iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; - iov[0].buffer.value = signature->data; - iov[0].buffer.length = signature->length; - - /* data is decrypted in place, which is ok */ - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.value = data->data; - iov[1].buffer.length = data->length; - - gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gss_ctx, - &sealed, NULL, iov, 2); - if (gss_maj) { - DEBUG(0, ("gss_unwrap_iov failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - if (!sealed) { - DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n")); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - status = NT_STATUS_OK; - - DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n", - (int)iov[1].buffer.length, (int)iov[0].buffer.length)); - -done: - return status; -} - -NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc in_data = { 0, NULL }; - gss_buffer_desc out_data = { 0, NULL}; - NTSTATUS status; - - in_data.value = data->data; - in_data.length = data->length; - - gss_maj = gss_get_mic(&gss_min, gse_ctx->gss_ctx, - GSS_C_QOP_DEFAULT, - &in_data, &out_data); - if (gss_maj) { - DEBUG(0, ("gss_get_mic failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - *signature = data_blob_talloc(mem_ctx, - out_data.value, out_data.length); - if (!signature->data) { - status = NT_STATUS_NO_MEMORY; - goto done; - } - - status = NT_STATUS_OK; - -done: - if (out_data.value) { - gss_maj = gss_release_buffer(&gss_min, &out_data); - } - return status; -} - -NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - OM_uint32 gss_min, gss_maj; - gss_buffer_desc in_data = { 0, NULL }; - gss_buffer_desc in_token = { 0, NULL}; - NTSTATUS status; - - in_data.value = data->data; - in_data.length = data->length; - in_token.value = signature->data; - in_token.length = signature->length; - - gss_maj = gss_verify_mic(&gss_min, gse_ctx->gss_ctx, - &in_data, &in_token, NULL); - if (gss_maj) { - DEBUG(0, ("gss_verify_mic failed with [%s]\n", - gse_errstr(talloc_tos(), gss_maj, gss_min))); - status = NT_STATUS_ACCESS_DENIED; - goto done; - } - - status = NT_STATUS_OK; - -done: - return status; -} - -#else - -NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - const char *server, - const char *service, - const char *username, - const char *password, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - uint32_t add_gss_c_flags, - const char *server, - const char *keytab, - struct gse_context **_gse_ctx) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -bool gse_require_more_processing(struct gse_context *gse_ctx) -{ - return false; -} - -DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx) -{ - return data_blob_null; -} - -NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, char **cli_name) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, DATA_BLOB *pac) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -size_t gse_get_signature_length(struct gse_context *gse_ctx, - int seal, size_t payload_size) -{ - return 0; -} - -NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -#endif /* HAVE_KRB5 && HAVE_GSSAPI_EXT_H && HAVE_GSS_WRAP_IOV */ diff --git a/source3/librpc/rpc/dcerpc_gssapi.h b/source3/librpc/rpc/dcerpc_gssapi.h deleted file mode 100644 index 0ffed2c457..0000000000 --- a/source3/librpc/rpc/dcerpc_gssapi.h +++ /dev/null @@ -1,76 +0,0 @@ -/* - * GSSAPI Security Extensions - * RPC Pipe client routines - * Copyright (C) Simo Sorce 2010. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -#ifndef _CLI_PIPE_GSSAPI_H_ -#define _CLI_PIPE_GSSAPI_H_ - -struct gse_context; - -#ifndef GSS_C_DCE_STYLE -#define GSS_C_DCE_STYLE 0x1000 -#endif - -NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - const char *ccache_name, - const char *server, - const char *service, - const char *username, - const char *password, - uint32_t add_gss_c_flags, - struct gse_context **_gse_ctx); -NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out); - -NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, - enum dcerpc_AuthType auth_type, - enum dcerpc_AuthLevel auth_level, - uint32_t add_gss_c_flags, - const char *server, - const char *keytab, - struct gse_context **_gse_ctx); -NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx, - DATA_BLOB *token_in, - DATA_BLOB *token_out); -NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx); - -bool gse_require_more_processing(struct gse_context *gse_ctx); -DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, - struct gse_context *gse_ctx); -NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, char **client_name); -NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, - TALLOC_CTX *mem_ctx, DATA_BLOB *pac); -NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime); - -size_t gse_get_signature_length(struct gse_context *gse_ctx, - int seal, size_t payload_size); -NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature); -NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature); -NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature); -NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx, - DATA_BLOB *data, DATA_BLOB *signature); -#endif /* _CLI_PIPE_GSSAPI_H_ */ diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c index b658579d19..8944b395d8 100644 --- a/source3/librpc/rpc/dcerpc_helpers.c +++ b/source3/librpc/rpc/dcerpc_helpers.c @@ -26,7 +26,7 @@ #include "../libcli/auth/spnego.h" #include "../libcli/auth/ntlmssp.h" #include "ntlmssp_wrap.h" -#include "librpc/rpc/dcerpc_gssapi.h" +#include "librpc/crypto/gse.h" #include "librpc/rpc/dcerpc_spnego.h" #undef DBGC_CLASS diff --git a/source3/librpc/rpc/dcerpc_krb5.c b/source3/librpc/rpc/dcerpc_krb5.c deleted file mode 100644 index 22443b63ff..0000000000 --- a/source3/librpc/rpc/dcerpc_krb5.c +++ /dev/null @@ -1,388 +0,0 @@ -/* - * GSSAPI Security Extensions - * Krb5 helpers - * Copyright (C) Simo Sorce 2010. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -#include "includes.h" -#include "smb_krb5.h" -#include "secrets.h" -#include "librpc/rpc/dcerpc_krb5.h" - -#ifdef HAVE_KRB5 - -static krb5_error_code flush_keytab(krb5_context krbctx, krb5_keytab keytab) -{ - krb5_error_code ret; - krb5_kt_cursor kt_cursor; - krb5_keytab_entry kt_entry; - - ZERO_STRUCT(kt_entry); - - ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor); - if (ret == KRB5_KT_END || ret == ENOENT ) { - /* no entries */ - return 0; - } - - ret = krb5_kt_next_entry(krbctx, keytab, &kt_entry, &kt_cursor); - while (ret == 0) { - - /* we need to close and reopen enumeration because we modify - * the keytab */ - ret = krb5_kt_end_seq_get(krbctx, keytab, &kt_cursor); - if (ret) { - DEBUG(1, (__location__ ": krb5_kt_end_seq_get() " - "failed (%s)\n", error_message(ret))); - goto out; - } - - /* remove the entry */ - ret = krb5_kt_remove_entry(krbctx, keytab, &kt_entry); - if (ret) { - DEBUG(1, (__location__ ": krb5_kt_remove_entry() " - "failed (%s)\n", error_message(ret))); - goto out; - } - ret = smb_krb5_kt_free_entry(krbctx, &kt_entry); - ZERO_STRUCT(kt_entry); - - /* now reopen */ - ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor); - if (ret) { - DEBUG(1, (__location__ ": krb5_kt_start_seq() failed " - "(%s)\n", error_message(ret))); - goto out; - } - - ret = krb5_kt_next_entry(krbctx, keytab, - &kt_entry, &kt_cursor); - } - - if (ret != KRB5_KT_END && ret != ENOENT) { - DEBUG(1, (__location__ ": flushing keytab we got [%s]!\n", - error_message(ret))); - } - - ret = 0; - -out: - return ret; -} - -static krb5_error_code get_host_principal(krb5_context krbctx, - krb5_principal *host_princ) -{ - krb5_error_code ret; - char *host_princ_s = NULL; - int err; - - err = asprintf(&host_princ_s, "%s$@%s", global_myname(), lp_realm()); - if (err == -1) { - return -1; - } - - strlower_m(host_princ_s); - ret = smb_krb5_parse_name(krbctx, host_princ_s, host_princ); - if (ret) { - DEBUG(1, (__location__ ": smb_krb5_parse_name(%s) " - "failed (%s)\n", - host_princ_s, error_message(ret))); - } - - SAFE_FREE(host_princ_s); - return ret; -} - -static krb5_error_code fill_keytab_from_password(krb5_context krbctx, - krb5_keytab keytab, - krb5_principal princ, - krb5_kvno vno, - krb5_data *password) -{ - krb5_error_code ret; - krb5_enctype *enctypes; - krb5_keytab_entry kt_entry; - unsigned int i; - - ret = get_kerberos_allowed_etypes(krbctx, &enctypes); - if (ret) { - DEBUG(1, (__location__ - ": Can't determine permitted enctypes!\n")); - return ret; - } - - for (i = 0; enctypes[i]; i++) { - krb5_keyblock *key = NULL; - - if (!(key = SMB_MALLOC_P(krb5_keyblock))) { - ret = ENOMEM; - goto out; - } - - if (create_kerberos_key_from_string(krbctx, princ, - password, key, - enctypes[i], false)) { - DEBUG(10, ("Failed to create key for enctype %d " - "(error: %s)\n", - enctypes[i], error_message(ret))); - SAFE_FREE(key); - continue; - } - - kt_entry.principal = princ; - kt_entry.vno = vno; - *(KRB5_KT_KEY(&kt_entry)) = *key; - - ret = krb5_kt_add_entry(krbctx, keytab, &kt_entry); - if (ret) { - DEBUG(1, (__location__ ": Failed to add entry to " - "keytab for enctype %d (error: %s)\n", - enctypes[i], error_message(ret))); - krb5_free_keyblock(krbctx, key); - goto out; - } - - krb5_free_keyblock(krbctx, key); - } - - ret = 0; - -out: - SAFE_FREE(enctypes); - return ret; -} - -#define SRV_MEM_KEYTAB_NAME "MEMORY:cifs_srv_keytab" -#define CLEARTEXT_PRIV_ENCTYPE -99 - -static krb5_error_code get_mem_keytab_from_secrets(krb5_context krbctx, - krb5_keytab *keytab) -{ - krb5_error_code ret; - char *pwd = NULL; - size_t pwd_len; - krb5_kt_cursor kt_cursor; - krb5_keytab_entry kt_entry; - krb5_data password; - krb5_principal princ = NULL; - krb5_kvno kvno = 0; /* FIXME: fetch current vno from KDC ? */ - char *pwd_old = NULL; - - if (!secrets_init()) { - DEBUG(1, (__location__ ": secrets_init failed\n")); - return KRB5_CONFIG_CANTOPEN; - } - - pwd = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); - if (!pwd) { - DEBUG(2, (__location__ ": failed to fetch machine password\n")); - return KRB5_LIBOS_CANTREADPWD; - } - pwd_len = strlen(pwd); - - if (*keytab == NULL) { - /* create memory keytab */ - ret = krb5_kt_resolve(krbctx, SRV_MEM_KEYTAB_NAME, keytab); - if (ret) { - DEBUG(1, (__location__ ": Failed to get memory " - "keytab!\n")); - return ret; - } - } - - ZERO_STRUCT(kt_entry); - ZERO_STRUCT(kt_cursor); - - /* check if the keytab already has any entry */ - ret = krb5_kt_start_seq_get(krbctx, *keytab, &kt_cursor); - if (ret != KRB5_KT_END && ret != ENOENT ) { - /* check if we have our special enctype used to hold - * the clear text password. If so, check it out so that - * we can verify if the keytab needs to be upgraded */ - while ((ret = krb5_kt_next_entry(krbctx, *keytab, - &kt_entry, &kt_cursor)) == 0) { - if (smb_get_enctype_from_kt_entry(&kt_entry) == CLEARTEXT_PRIV_ENCTYPE) { - break; - } - smb_krb5_kt_free_entry(krbctx, &kt_entry); - ZERO_STRUCT(kt_entry); - } - - if (ret != 0 && ret != KRB5_KT_END && ret != ENOENT ) { - /* Error parsing keytab */ - DEBUG(1, (__location__ ": Failed to parse memory " - "keytab!\n")); - goto out; - } - - if (ret == 0) { - /* found private entry, - * check if keytab is up to date */ - - if ((pwd_len == KRB5_KEY_LENGTH(KRB5_KT_KEY(&kt_entry))) && - (memcmp(KRB5_KEY_DATA(KRB5_KT_KEY(&kt_entry)), - pwd, pwd_len) == 0)) { - /* keytab is already up to date, return */ - smb_krb5_kt_free_entry(krbctx, &kt_entry); - goto out; - } - - smb_krb5_kt_free_entry(krbctx, &kt_entry); - ZERO_STRUCT(kt_entry); - - - /* flush keytab, we need to regen it */ - ret = flush_keytab(krbctx, *keytab); - if (ret) { - DEBUG(1, (__location__ ": Failed to flush " - "memory keytab!\n")); - goto out; - } - } - } - - { - krb5_kt_cursor zero_csr; - ZERO_STRUCT(zero_csr); - if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && *keytab) { - krb5_kt_end_seq_get(krbctx, *keytab, &kt_cursor); - } - } - - /* keytab is not up to date, fill it up */ - - ret = get_host_principal(krbctx, &princ); - if (ret) { - DEBUG(1, (__location__ ": Failed to get host principal!\n")); - goto out; - } - - password.data = pwd; - password.length = pwd_len; - ret = fill_keytab_from_password(krbctx, *keytab, - princ, kvno, &password); - if (ret) { - DEBUG(1, (__location__ ": Failed to fill memory keytab!\n")); - goto out; - } - - pwd_old = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); - if (!pwd_old) { - DEBUG(10, (__location__ ": no prev machine password\n")); - } else { - password.data = pwd_old; - password.length = strlen(pwd_old); - ret = fill_keytab_from_password(krbctx, *keytab, - princ, kvno -1, &password); - if (ret) { - DEBUG(1, (__location__ - ": Failed to fill memory keytab!\n")); - goto out; - } - } - - /* add our private enctype + cleartext password so that we can - * update the keytab if secrets change later on */ - ZERO_STRUCT(kt_entry); - kt_entry.principal = princ; - kt_entry.vno = 0; - - KRB5_KEY_TYPE(KRB5_KT_KEY(&kt_entry)) = CLEARTEXT_PRIV_ENCTYPE; - KRB5_KEY_LENGTH(KRB5_KT_KEY(&kt_entry)) = pwd_len; - KRB5_KEY_DATA(KRB5_KT_KEY(&kt_entry)) = (uint8_t *)pwd; - - ret = krb5_kt_add_entry(krbctx, *keytab, &kt_entry); - if (ret) { - DEBUG(1, (__location__ ": Failed to add entry to " - "keytab for private enctype (%d) (error: %s)\n", - CLEARTEXT_PRIV_ENCTYPE, error_message(ret))); - goto out; - } - - ret = 0; - -out: - SAFE_FREE(pwd); - SAFE_FREE(pwd_old); - - { - krb5_kt_cursor zero_csr; - ZERO_STRUCT(zero_csr); - if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && *keytab) { - krb5_kt_end_seq_get(krbctx, *keytab, &kt_cursor); - } - } - - if (princ) { - krb5_free_principal(krbctx, princ); - } - - if (ret) { - if (*keytab) { - krb5_kt_close(krbctx, *keytab); - *keytab = NULL; - } - } - - return ret; -} - -static krb5_error_code get_mem_keytab_from_system_keytab(krb5_context krbctx, - krb5_keytab *keytab, - bool verify) -{ - return KRB5_KT_NOTFOUND; -} - -krb5_error_code smb_krb5_get_server_keytab(krb5_context krbctx, - krb5_keytab *keytab) -{ - krb5_error_code ret; - - *keytab = NULL; - - switch (lp_kerberos_method()) { - default: - case KERBEROS_VERIFY_SECRETS: - ret = get_mem_keytab_from_secrets(krbctx, keytab); - break; - case KERBEROS_VERIFY_SYSTEM_KEYTAB: - ret = get_mem_keytab_from_system_keytab(krbctx, keytab, true); - break; - case KERBEROS_VERIFY_DEDICATED_KEYTAB: - /* just use whatever keytab is configured */ - ret = get_mem_keytab_from_system_keytab(krbctx, keytab, false); - break; - case KERBEROS_VERIFY_SECRETS_AND_KEYTAB: - ret = get_mem_keytab_from_secrets(krbctx, keytab); - if (ret) { - DEBUG(3, (__location__ ": Warning! Unable to set mem " - "keytab from secrets!\n")); - } - /* Now append system keytab keys too */ - ret = get_mem_keytab_from_system_keytab(krbctx, keytab, true); - if (ret) { - DEBUG(3, (__location__ ": Warning! Unable to set mem " - "keytab from secrets!\n")); - } - break; - } - - return ret; -} - -#endif /* HAVE_KRB5 */ diff --git a/source3/librpc/rpc/dcerpc_krb5.h b/source3/librpc/rpc/dcerpc_krb5.h deleted file mode 100644 index c5d7dd6a09..0000000000 --- a/source3/librpc/rpc/dcerpc_krb5.h +++ /dev/null @@ -1,30 +0,0 @@ -/* - * GSSAPI Security Extensions - * Krb5 helpers - * Copyright (C) Simo Sorce 2010. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -#ifndef _DCERPC_KRB5_H_ -#define _DCERPC_KRB5_H_ - -#ifdef HAVE_KRB5 - -krb5_error_code smb_krb5_get_server_keytab(krb5_context krbctx, - krb5_keytab *keytab); - -#endif /* HAVE_KRB5 */ - -#endif /* _DCERPC_KRB5_H_ */ diff --git a/source3/librpc/rpc/dcerpc_spnego.c b/source3/librpc/rpc/dcerpc_spnego.c index ec81a2c701..9ea2a561da 100644 --- a/source3/librpc/rpc/dcerpc_spnego.c +++ b/source3/librpc/rpc/dcerpc_spnego.c @@ -22,7 +22,7 @@ #include "include/ntlmssp_wrap.h" #include "librpc/gen_ndr/ntlmssp.h" #include "dcerpc_spnego.h" -#include "dcerpc_gssapi.h" +#include "librpc/crypto/gse.h" struct spnego_context { enum dcerpc_AuthType auth_type; diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c index d8bed84e2d..21f7c4bf31 100644 --- a/source3/rpc_client/cli_pipe.c +++ b/source3/rpc_client/cli_pipe.c @@ -29,7 +29,7 @@ #include "ntlmssp_wrap.h" #include "librpc/gen_ndr/ndr_dcerpc.h" #include "librpc/rpc/dcerpc.h" -#include "librpc/rpc/dcerpc_gssapi.h" +#include "librpc/crypto/gse.h" #include "librpc/rpc/dcerpc_spnego.h" #include "rpc_dce.h" diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c index 767f851b2c..4a159ce997 100644 --- a/source3/rpc_server/srv_pipe.c +++ b/source3/rpc_server/srv_pipe.c @@ -37,7 +37,7 @@ #include "ntlmssp_wrap.h" #include "rpc_server.h" #include "rpc_dce.h" -#include "librpc/rpc/dcerpc_gssapi.h" +#include "librpc/crypto/gse.h" #undef DBGC_CLASS #define DBGC_CLASS DBGC_RPC_SRV -- cgit