?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-librpc: Remove gse_verify_server_auth_flags
[Samba.git] / source3 / librpc / crypto / gse.c
blobfba2c2fba377f8fa7a0ab8e0c341deb041ef1251
1 /*
2 * GSSAPI Security Extensions
3 * RPC Pipe client and server routines
4 * Copyright (C) Simo Sorce 2010.
5 * Copyright (C) Andrew Bartlett 2004-2011.
6 * Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 /* We support only GSSAPI/KRB5 here */
23
24 #include "includes.h"
25 #include "gse.h"
26 #include "libads/kerberos_proto.h"
27 #include "auth/common_auth.h"
28 #include "auth/gensec/gensec.h"
29 #include "auth/credentials/credentials.h"
30 #include "../librpc/gen_ndr/dcerpc.h"
31 #include "lib/util/asn1.h"
32
33 #if defined(HAVE_KRB5) && defined(HAVE_GSS_WRAP_IOV)
34
35 #include "smb_krb5.h"
36 #include "gse_krb5.h"
37
38 #ifndef GSS_C_DCE_STYLE
39 #define GSS_C_DCE_STYLE 0x1000
40 #endif
41
42 #ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
43 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11
44 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05"
45 #endif
46
47 gss_OID_desc gse_sesskey_inq_oid = {
48 GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH,
49 (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
50 };
51
52 #ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID
53 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10
54 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04"
55 #endif
56
57 gss_OID_desc gse_sesskeytype_oid = {
58 GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH,
59 (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID
60 };
61
62 #define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12
63 /* EXTRACTION OID AUTHZ ID */
64 #define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01"
65
66 gss_OID_desc gse_authz_data_oid = {
67 GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH,
68 (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID
69 };
70
71 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
72
73 struct gse_context {
74 gss_ctx_id_t gssapi_context;
75 gss_name_t server_name;
76 gss_name_t client_name;
77 OM_uint32 gss_want_flags, gss_got_flags;
78
79 gss_cred_id_t delegated_cred_handle;
80
81 /* gensec_gse only */
82 krb5_context k5ctx;
83 krb5_ccache ccache;
84 krb5_keytab keytab;
85
86 gss_OID_desc gss_mech;
87 gss_cred_id_t creds;
88
89 gss_OID ret_mech;
90 };
91
92 #ifndef HAVE_GSS_OID_EQUAL
93
94 static bool gss_oid_equal(const gss_OID o1, const gss_OID o2)
95 {
96 if (o1 == o2) {
97 return true;
98 }
99 if ((o1 == NULL && o2 != NULL) || (o1 != NULL && o2 == NULL)) {
100 return false;
101 }
102 if (o1->length != o2->length) {
103 return false;
104 }
105 return memcmp(o1->elements, o2->elements, o1->length) == false;
106 }
107
108 #endif
109
110 /* free non talloc dependent contexts */
111 static int gse_context_destructor(void *ptr)
112 {
113 struct gse_context *gse_ctx;
114 OM_uint32 gss_min, gss_maj;
115
116 gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
117 if (gse_ctx->k5ctx) {
118 if (gse_ctx->ccache) {
119 krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
120 gse_ctx->ccache = NULL;
121 }
122 if (gse_ctx->keytab) {
123 krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
124 gse_ctx->keytab = NULL;
125 }
126 krb5_free_context(gse_ctx->k5ctx);
127 gse_ctx->k5ctx = NULL;
128 }
129 if (gse_ctx->gssapi_context != GSS_C_NO_CONTEXT) {
130 gss_maj = gss_delete_sec_context(&gss_min,
131 &gse_ctx->gssapi_context,
132 GSS_C_NO_BUFFER);
133 }
134 if (gse_ctx->server_name) {
135 gss_maj = gss_release_name(&gss_min,
136 &gse_ctx->server_name);
137 }
138 if (gse_ctx->client_name) {
139 gss_maj = gss_release_name(&gss_min,
140 &gse_ctx->client_name);
141 }
142 if (gse_ctx->creds) {
143 gss_maj = gss_release_cred(&gss_min,
144 &gse_ctx->creds);
145 }
146 if (gse_ctx->delegated_cred_handle) {
147 gss_maj = gss_release_cred(&gss_min,
148 &gse_ctx->delegated_cred_handle);
149 }
150
151 /* MIT and Heimdal differ as to if you can call
152 * gss_release_oid() on this OID, generated by
153 * gss_{accept,init}_sec_context(). However, as long as the
154 * oid is gss_mech_krb5 (which it always is at the moment),
155 * then this is a moot point, as both declare this particular
156 * OID static, and so no memory is lost. This assert is in
157 * place to ensure that the programmer who wishes to extend
158 * this code to EAP or other GSS mechanisms determines an
159 * implementation-dependent way of releasing any dynamically
160 * allocated OID */
161 SMB_ASSERT(gss_oid_equal(&gse_ctx->gss_mech, GSS_C_NO_OID) || gss_oid_equal(&gse_ctx->gss_mech, gss_mech_krb5));
162
163 return 0;
164 }
165
166 static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
167 bool do_sign, bool do_seal,
168 const char *ccache_name,
169 uint32_t add_gss_c_flags,
170 struct gse_context **_gse_ctx)
171 {
172 struct gse_context *gse_ctx;
173 krb5_error_code k5ret;
174 NTSTATUS status;
175
176 gse_ctx = talloc_zero(mem_ctx, struct gse_context);
177 if (!gse_ctx) {
178 return NT_STATUS_NO_MEMORY;
179 }
180 talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
181
182 memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
183
184 gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
185 GSS_C_DELEG_FLAG |
186 GSS_C_DELEG_POLICY_FLAG |
187 GSS_C_REPLAY_FLAG |
188 GSS_C_SEQUENCE_FLAG;
189 if (do_sign) {
190 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
191 }
192 if (do_seal) {
193 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
194 gse_ctx->gss_want_flags |= GSS_C_CONF_FLAG;
195 }
196
197 gse_ctx->gss_want_flags |= add_gss_c_flags;
198
199 /* Initialize Kerberos Context */
200 initialize_krb5_error_table();
201
202 k5ret = krb5_init_context(&gse_ctx->k5ctx);
203 if (k5ret) {
204 DEBUG(0, ("Failed to initialize kerberos context! (%s)\n",
205 error_message(k5ret)));
206 status = NT_STATUS_INTERNAL_ERROR;
207 goto err_out;
208 }
209
210 if (!ccache_name) {
211 ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
212 }
213 k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
214 &gse_ctx->ccache);
215 if (k5ret) {
216 DEBUG(1, ("Failed to resolve credential cache! (%s)\n",
217 error_message(k5ret)));
218 status = NT_STATUS_INTERNAL_ERROR;
219 goto err_out;
220 }
221
222 /* TODO: Should we enforce a enc_types list ?
223 ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
224 */
225
226 *_gse_ctx = gse_ctx;
227 return NT_STATUS_OK;
228
229 err_out:
230 TALLOC_FREE(gse_ctx);
231 return status;
232 }
233
234 static NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
235 bool do_sign, bool do_seal,
236 const char *ccache_name,
237 const char *server,
238 const char *service,
239 const char *username,
240 const char *password,
241 uint32_t add_gss_c_flags,
242 struct gse_context **_gse_ctx)
243 {
244 struct gse_context *gse_ctx;
245 OM_uint32 gss_maj, gss_min;
246 gss_buffer_desc name_buffer = {0, NULL};
247 gss_OID_set_desc mech_set;
248 NTSTATUS status;
249
250 if (!server || !service) {
251 return NT_STATUS_INVALID_PARAMETER;
252 }
253
254 status = gse_context_init(mem_ctx, do_sign, do_seal,
255 ccache_name, add_gss_c_flags,
256 &gse_ctx);
257 if (!NT_STATUS_IS_OK(status)) {
258 return NT_STATUS_NO_MEMORY;
259 }
260
261 /* Guess the realm based on the supplied service, and avoid the GSS libs
262 doing DNS lookups which may fail.
263
264 TODO: Loop with the KDC on some more combinations (local
265 realm in particular), possibly falling back to
266 GSS_C_NT_HOSTBASED_SERVICE
267 */
268 name_buffer.value = kerberos_get_principal_from_service_hostname(gse_ctx,
269 service, server);
270 if (!name_buffer.value) {
271 status = NT_STATUS_NO_MEMORY;
272 goto err_out;
273 }
274 name_buffer.length = strlen((char *)name_buffer.value);
275 gss_maj = gss_import_name(&gss_min, &name_buffer,
276 GSS_C_NT_USER_NAME,
277 &gse_ctx->server_name);
278 if (gss_maj) {
279 DEBUG(0, ("gss_import_name failed for %s, with [%s]\n",
280 (char *)name_buffer.value,
281 gse_errstr(gse_ctx, gss_maj, gss_min)));
282 status = NT_STATUS_INTERNAL_ERROR;
283 goto err_out;
284 }
285
286 /* TODO: get krb5 ticket using username/password, if no valid
287 * one already available in ccache */
288
289 mech_set.count = 1;
290 mech_set.elements = &gse_ctx->gss_mech;
291
292 gss_maj = gss_acquire_cred(&gss_min,
293 GSS_C_NO_NAME,
294 GSS_C_INDEFINITE,
295 &mech_set,
296 GSS_C_INITIATE,
297 &gse_ctx->creds,
298 NULL, NULL);
299 if (gss_maj) {
300 DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n",
301 (char *)name_buffer.value,
302 gse_errstr(gse_ctx, gss_maj, gss_min)));
303 status = NT_STATUS_INTERNAL_ERROR;
304 goto err_out;
305 }
306
307 *_gse_ctx = gse_ctx;
308 TALLOC_FREE(name_buffer.value);
309 return NT_STATUS_OK;
310
311 err_out:
312 TALLOC_FREE(name_buffer.value);
313 TALLOC_FREE(gse_ctx);
314 return status;
315 }
316
317 static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
318 struct gse_context *gse_ctx,
319 const DATA_BLOB *token_in,
320 DATA_BLOB *token_out)
321 {
322 OM_uint32 gss_maj, gss_min;
323 gss_buffer_desc in_data;
324 gss_buffer_desc out_data;
325 DATA_BLOB blob = data_blob_null;
326 NTSTATUS status;
327
328 in_data.value = token_in->data;
329 in_data.length = token_in->length;
330
331 gss_maj = gss_init_sec_context(&gss_min,
332 gse_ctx->creds,
333 &gse_ctx->gssapi_context,
334 gse_ctx->server_name,
335 &gse_ctx->gss_mech,
336 gse_ctx->gss_want_flags,
337 0, GSS_C_NO_CHANNEL_BINDINGS,
338 &in_data, NULL, &out_data,
339 &gse_ctx->gss_got_flags, NULL);
340 switch (gss_maj) {
341 case GSS_S_COMPLETE:
342 /* we are done with it */
343 status = NT_STATUS_OK;
344 break;
345 case GSS_S_CONTINUE_NEEDED:
346 /* we will need a third leg */
347 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
348 break;
349 default:
350 DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
351 gse_errstr(talloc_tos(), gss_maj, gss_min)));
352 status = NT_STATUS_INTERNAL_ERROR;
353 goto done;
354 }
355
356 /* we may be told to return nothing */
357 if (out_data.length) {
358 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
359 if (!blob.data) {
360 status = NT_STATUS_NO_MEMORY;
361 }
362
363 gss_maj = gss_release_buffer(&gss_min, &out_data);
364 }
365
366 done:
367 *token_out = blob;
368 return status;
369 }
370
371 static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
372 bool do_sign, bool do_seal,
373 uint32_t add_gss_c_flags,
374 struct gse_context **_gse_ctx)
375 {
376 struct gse_context *gse_ctx;
377 OM_uint32 gss_maj, gss_min;
378 krb5_error_code ret;
379 NTSTATUS status;
380
381 status = gse_context_init(mem_ctx, do_sign, do_seal,
382 NULL, add_gss_c_flags, &gse_ctx);
383 if (!NT_STATUS_IS_OK(status)) {
384 return NT_STATUS_NO_MEMORY;
385 }
386
387 ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
388 &gse_ctx->keytab);
389 if (ret) {
390 status = NT_STATUS_INTERNAL_ERROR;
391 goto done;
392 }
393
394 #ifdef HAVE_GSS_KRB5_IMPORT_CRED
395
396 /* This creates a GSSAPI cred_id_t with the keytab set */
397 gss_maj = gss_krb5_import_cred(&gss_min, NULL, NULL, gse_ctx->keytab,
398 &gse_ctx->creds);
399
400 if (gss_maj != 0
401 && gss_maj != (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME)) {
402 DEBUG(0, ("gss_krb5_import_cred failed with [%s]\n",
403 gse_errstr(gse_ctx, gss_maj, gss_min)));
404 status = NT_STATUS_INTERNAL_ERROR;
405 goto done;
406
407 /* This is the error the MIT krb5 1.9 gives when it
408 * implements the function, but we do not specify the
409 * principal. However, when we specify the principal
410 * as host$@REALM the GSS acceptor fails with 'wrong
411 * principal in request'. Work around the issue by
412 * falling back to the alternate approach below. */
413 } else if (gss_maj == (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME))
414 #endif
415 /* FIXME!!!
416 * This call sets the default keytab for the whole server, not
417 * just for this context. Need to find a way that does not alter
418 * the state of the whole server ... */
419 {
420 const char *ktname;
421 gss_OID_set_desc mech_set;
422
423 ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx,
424 gse_ctx->keytab, &ktname);
425 if (ret) {
426 status = NT_STATUS_INTERNAL_ERROR;
427 goto done;
428 }
429
430 ret = gsskrb5_register_acceptor_identity(ktname);
431 if (ret) {
432 status = NT_STATUS_INTERNAL_ERROR;
433 goto done;
434 }
435
436 mech_set.count = 1;
437 mech_set.elements = &gse_ctx->gss_mech;
438
439 gss_maj = gss_acquire_cred(&gss_min,
440 GSS_C_NO_NAME,
441 GSS_C_INDEFINITE,
442 &mech_set,
443 GSS_C_ACCEPT,
444 &gse_ctx->creds,
445 NULL, NULL);
446
447 if (gss_maj) {
448 DEBUG(0, ("gss_acquire_creds failed with [%s]\n",
449 gse_errstr(gse_ctx, gss_maj, gss_min)));
450 status = NT_STATUS_INTERNAL_ERROR;
451 goto done;
452 }
453 }
454
455 status = NT_STATUS_OK;
456
457 done:
458 if (!NT_STATUS_IS_OK(status)) {
459 TALLOC_FREE(gse_ctx);
460 }
461
462 *_gse_ctx = gse_ctx;
463 return status;
464 }
465
466 static NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
467 struct gse_context *gse_ctx,
468 const DATA_BLOB *token_in,
469 DATA_BLOB *token_out)
470 {
471 OM_uint32 gss_maj, gss_min;
472 gss_buffer_desc in_data;
473 gss_buffer_desc out_data;
474 DATA_BLOB blob = data_blob_null;
475 NTSTATUS status;
476
477 in_data.value = token_in->data;
478 in_data.length = token_in->length;
479
480 gss_maj = gss_accept_sec_context(&gss_min,
481 &gse_ctx->gssapi_context,
482 gse_ctx->creds,
483 &in_data,
484 GSS_C_NO_CHANNEL_BINDINGS,
485 &gse_ctx->client_name,
486 &gse_ctx->ret_mech,
487 &out_data,
488 &gse_ctx->gss_got_flags, NULL,
489 &gse_ctx->delegated_cred_handle);
490 switch (gss_maj) {
491 case GSS_S_COMPLETE:
492 /* we are done with it */
493 status = NT_STATUS_OK;
494 break;
495 case GSS_S_CONTINUE_NEEDED:
496 /* we will need a third leg */
497 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
498 break;
499 default:
500 DEBUG(1, ("gss_init_sec_context failed with [%s]\n",
501 gse_errstr(talloc_tos(), gss_maj, gss_min)));
502
503 if (gse_ctx->gssapi_context) {
504 gss_delete_sec_context(&gss_min,
505 &gse_ctx->gssapi_context,
506 GSS_C_NO_BUFFER);
507 }
508
509 status = NT_STATUS_LOGON_FAILURE;
510 goto done;
511 }
512
513 /* we may be told to return nothing */
514 if (out_data.length) {
515 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
516 if (!blob.data) {
517 status = NT_STATUS_NO_MEMORY;
518 }
519 gss_maj = gss_release_buffer(&gss_min, &out_data);
520 }
521
522
523 done:
524 *token_out = blob;
525 return status;
526 }
527
528 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
529 {
530 OM_uint32 gss_min, gss_maj;
531 gss_buffer_desc msg_min;
532 gss_buffer_desc msg_maj;
533 OM_uint32 msg_ctx = 0;
534
535 char *errstr = NULL;
536
537 ZERO_STRUCT(msg_min);
538 ZERO_STRUCT(msg_maj);
539
540 gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
541 GSS_C_NO_OID, &msg_ctx, &msg_maj);
542 if (gss_maj) {
543 goto done;
544 }
545 errstr = talloc_strndup(mem_ctx,
546 (char *)msg_maj.value,
547 msg_maj.length);
548 if (!errstr) {
549 goto done;
550 }
551 gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
552 (gss_OID)discard_const(gss_mech_krb5),
553 &msg_ctx, &msg_min);
554 if (gss_maj) {
555 goto done;
556 }
557
558 errstr = talloc_strdup_append_buffer(errstr, ": ");
559 if (!errstr) {
560 goto done;
561 }
562 errstr = talloc_strndup_append_buffer(errstr,
563 (char *)msg_min.value,
564 msg_min.length);
565 if (!errstr) {
566 goto done;
567 }
568
569 done:
570 if (msg_min.value) {
571 gss_maj = gss_release_buffer(&gss_min, &msg_min);
572 }
573 if (msg_maj.value) {
574 gss_maj = gss_release_buffer(&gss_min, &msg_maj);
575 }
576 return errstr;
577 }
578
579 static NTSTATUS gse_get_session_key(TALLOC_CTX *mem_ctx,
580 struct gse_context *gse_ctx,
581 DATA_BLOB *session_key,
582 uint32_t *keytype)
583 {
584 OM_uint32 gss_min, gss_maj;
585 gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
586
587 gss_maj = gss_inquire_sec_context_by_oid(
588 &gss_min, gse_ctx->gssapi_context,
589 &gse_sesskey_inq_oid, &set);
590 if (gss_maj) {
591 DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
592 gse_errstr(talloc_tos(), gss_maj, gss_min)));
593 return NT_STATUS_NO_USER_SESSION_KEY;
594 }
595
596 if ((set == GSS_C_NO_BUFFER_SET) ||
597 (set->count != 2) ||
598 (memcmp(set->elements[1].value,
599 gse_sesskeytype_oid.elements,
600 gse_sesskeytype_oid.length) != 0)) {
601 #ifdef HAVE_GSSKRB5_GET_SUBKEY
602 krb5_keyblock *subkey;
603 gss_maj = gsskrb5_get_subkey(&gss_min,
604 gse_ctx->gssapi_context,
605 &subkey);
606 if (gss_maj != 0) {
607 DEBUG(1, ("NO session key for this mech\n"));
608 return NT_STATUS_NO_USER_SESSION_KEY;
609 }
610 if (session_key) {
611 *session_key = data_blob_talloc(mem_ctx,
612 KRB5_KEY_DATA(subkey), KRB5_KEY_LENGTH(subkey));
613 }
614 if (keytype) {
615 *keytype = KRB5_KEY_TYPE(subkey);
616 }
617 krb5_free_keyblock(NULL /* should be krb5_context */, subkey);
618 return NT_STATUS_OK;
619 #else
620 DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
621 "OID for data in results:\n"));
622 dump_data(1, (uint8_t *)set->elements[1].value,
623 set->elements[1].length);
624 return NT_STATUS_NO_USER_SESSION_KEY;
625 #endif
626 }
627
628 if (session_key) {
629 *session_key = data_blob_talloc(mem_ctx, set->elements[0].value,
630 set->elements[0].length);
631 }
632
633 if (keytype) {
634 char *oid;
635 char *p, *q = NULL;
636 if (!ber_read_OID_String(talloc_tos(),
637 data_blob_const(set->elements[0].value,
638 set->elements[0].length), &oid)) {
639 TALLOC_FREE(oid);
640 gss_maj = gss_release_buffer_set(&gss_min, &set);
641 return NT_STATUS_INVALID_PARAMETER;
642 }
643 p = strrchr(oid, '.');
644 if (!p) {
645 TALLOC_FREE(oid);
646 gss_maj = gss_release_buffer_set(&gss_min, &set);
647 return NT_STATUS_INVALID_PARAMETER;
648 } else {
649 p++;
650 *keytype = strtoul(p, &q, 10);
651 if (q == NULL || *q != '\0') {
652 return NT_STATUS_INVALID_PARAMETER;
653 }
654 }
655 TALLOC_FREE(oid);
656 }
657
658 gss_maj = gss_release_buffer_set(&gss_min, &set);
659 return NT_STATUS_OK;
660 }
661
662 static size_t gse_get_signature_length(struct gse_context *gse_ctx,
663 bool seal, size_t payload_size)
664 {
665 OM_uint32 gss_min, gss_maj;
666 gss_iov_buffer_desc iov[2];
667 int sealed;
668
669 /*
670 * gss_wrap_iov_length() only needs the type and length
671 */
672 iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
673 iov[0].buffer.value = NULL;
674 iov[0].buffer.length = 0;
675 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
676 iov[1].buffer.value = NULL;
677 iov[1].buffer.length = payload_size;
678
679 gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gssapi_context,
680 seal, GSS_C_QOP_DEFAULT,
681 &sealed, iov, 2);
682 if (gss_maj) {
683 DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n",
684 gse_errstr(talloc_tos(), gss_maj, gss_min)));
685 return 0;
686 }
687
688 return iov[0].buffer.length;
689 }
690
691 static NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
692 DATA_BLOB *data, DATA_BLOB *signature)
693 {
694 OM_uint32 gss_min, gss_maj;
695 gss_iov_buffer_desc iov[2];
696 int req_seal = 1; /* setting to 1 means we request sign+seal */
697 int sealed = 1;
698 NTSTATUS status;
699
700 /* allocate the memory ourselves so we do not need to talloc_memdup */
701 signature->length = gse_get_signature_length(gse_ctx, true, data->length);
702 if (!signature->length) {
703 return NT_STATUS_INTERNAL_ERROR;
704 }
705 signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length);
706 if (!signature->data) {
707 return NT_STATUS_NO_MEMORY;
708 }
709 iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
710 iov[0].buffer.value = signature->data;
711 iov[0].buffer.length = signature->length;
712
713 /* data is encrypted in place, which is ok */
714 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
715 iov[1].buffer.value = data->data;
716 iov[1].buffer.length = data->length;
717
718 gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gssapi_context,
719 req_seal, GSS_C_QOP_DEFAULT,
720 &sealed, iov, 2);
721 if (gss_maj) {
722 DEBUG(0, ("gss_wrap_iov failed with [%s]\n",
723 gse_errstr(talloc_tos(), gss_maj, gss_min)));
724 status = NT_STATUS_ACCESS_DENIED;
725 goto done;
726 }
727
728 if (!sealed) {
729 DEBUG(0, ("gss_wrap_iov says data was not sealed!\n"));
730 status = NT_STATUS_ACCESS_DENIED;
731 goto done;
732 }
733
734 status = NT_STATUS_OK;
735
736 DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n",
737 (int)iov[1].buffer.length, (int)iov[0].buffer.length));
738
739 done:
740 return status;
741 }
742
743 static NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
744 DATA_BLOB *data, const DATA_BLOB *signature)
745 {
746 OM_uint32 gss_min, gss_maj;
747 gss_iov_buffer_desc iov[2];
748 int sealed;
749 NTSTATUS status;
750
751 iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
752 iov[0].buffer.value = signature->data;
753 iov[0].buffer.length = signature->length;
754
755 /* data is decrypted in place, which is ok */
756 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
757 iov[1].buffer.value = data->data;
758 iov[1].buffer.length = data->length;
759
760 gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gssapi_context,
761 &sealed, NULL, iov, 2);
762 if (gss_maj) {
763 DEBUG(0, ("gss_unwrap_iov failed with [%s]\n",
764 gse_errstr(talloc_tos(), gss_maj, gss_min)));
765 status = NT_STATUS_ACCESS_DENIED;
766 goto done;
767 }
768
769 if (!sealed) {
770 DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n"));
771 status = NT_STATUS_ACCESS_DENIED;
772 goto done;
773 }
774
775 status = NT_STATUS_OK;
776
777 DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n",
778 (int)iov[1].buffer.length, (int)iov[0].buffer.length));
779
780 done:
781 return status;
782 }
783
784 static NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
785 DATA_BLOB *data, DATA_BLOB *signature)
786 {
787 OM_uint32 gss_min, gss_maj;
788 gss_buffer_desc in_data = { 0, NULL };
789 gss_buffer_desc out_data = { 0, NULL};
790 NTSTATUS status;
791
792 in_data.value = data->data;
793 in_data.length = data->length;
794
795 gss_maj = gss_get_mic(&gss_min, gse_ctx->gssapi_context,
796 GSS_C_QOP_DEFAULT,
797 &in_data, &out_data);
798 if (gss_maj) {
799 DEBUG(0, ("gss_get_mic failed with [%s]\n",
800 gse_errstr(talloc_tos(), gss_maj, gss_min)));
801 status = NT_STATUS_ACCESS_DENIED;
802 goto done;
803 }
804
805 *signature = data_blob_talloc(mem_ctx,
806 out_data.value, out_data.length);
807 if (!signature->data) {
808 status = NT_STATUS_NO_MEMORY;
809 goto done;
810 }
811
812 status = NT_STATUS_OK;
813
814 done:
815 if (out_data.value) {
816 gss_maj = gss_release_buffer(&gss_min, &out_data);
817 }
818 return status;
819 }
820
821 static NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
822 const DATA_BLOB *data, const DATA_BLOB *signature)
823 {
824 OM_uint32 gss_min, gss_maj;
825 gss_buffer_desc in_data = { 0, NULL };
826 gss_buffer_desc in_token = { 0, NULL};
827 NTSTATUS status;
828
829 in_data.value = data->data;
830 in_data.length = data->length;
831 in_token.value = signature->data;
832 in_token.length = signature->length;
833
834 gss_maj = gss_verify_mic(&gss_min, gse_ctx->gssapi_context,
835 &in_data, &in_token, NULL);
836 if (gss_maj) {
837 DEBUG(0, ("gss_verify_mic failed with [%s]\n",
838 gse_errstr(talloc_tos(), gss_maj, gss_min)));
839 status = NT_STATUS_ACCESS_DENIED;
840 goto done;
841 }
842
843 status = NT_STATUS_OK;
844
845 done:
846 return status;
847 }
848
849 static NTSTATUS gensec_gse_client_start(struct gensec_security *gensec_security)
850 {
851 struct gse_context *gse_ctx;
852 struct cli_credentials *creds = gensec_get_credentials(gensec_security);
853 NTSTATUS nt_status;
854 OM_uint32 want_flags = 0;
855 bool do_sign = false, do_seal = false;
856 const char *hostname = gensec_get_target_hostname(gensec_security);
857 const char *service = gensec_get_target_service(gensec_security);
858 const char *username = cli_credentials_get_username(creds);
859 const char *password = cli_credentials_get_password(creds);
860
861 if (!hostname) {
862 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
863 return NT_STATUS_INVALID_PARAMETER;
864 }
865 if (is_ipaddress(hostname)) {
866 DEBUG(2, ("Cannot do GSE to an IP address\n"));
867 return NT_STATUS_INVALID_PARAMETER;
868 }
869 if (strcmp(hostname, "localhost") == 0) {
870 DEBUG(2, ("GSE to 'localhost' does not make sense\n"));
871 return NT_STATUS_INVALID_PARAMETER;
872 }
873
874 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
875 do_sign = true;
876 }
877 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
878 do_seal = true;
879 }
880 if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
881 want_flags |= GSS_C_DCE_STYLE;
882 }
883
884 nt_status = gse_init_client(gensec_security, do_sign, do_seal, NULL,
885 hostname, service,
886 username, password, want_flags,
887 &gse_ctx);
888 if (!NT_STATUS_IS_OK(nt_status)) {
889 return nt_status;
890 }
891 gensec_security->private_data = gse_ctx;
892 return NT_STATUS_OK;
893 }
894
895 static NTSTATUS gensec_gse_server_start(struct gensec_security *gensec_security)
896 {
897 struct gse_context *gse_ctx;
898 NTSTATUS nt_status;
899 OM_uint32 want_flags = 0;
900 bool do_sign = false, do_seal = false;
901
902 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
903 do_sign = true;
904 }
905 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
906 do_seal = true;
907 }
908 if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
909 want_flags |= GSS_C_DCE_STYLE;
910 }
911
912 nt_status = gse_init_server(gensec_security, do_sign, do_seal, want_flags,
913 &gse_ctx);
914 if (!NT_STATUS_IS_OK(nt_status)) {
915 return nt_status;
916 }
917 gensec_security->private_data = gse_ctx;
918 return NT_STATUS_OK;
919 }
920
921 /**
922 * Check if the packet is one for this mechansim
923 *
924 * @param gensec_security GENSEC state
925 * @param in The request, as a DATA_BLOB
926 * @return Error, INVALID_PARAMETER if it's not a packet for us
927 * or NT_STATUS_OK if the packet is ok.
928 */
929
930 static NTSTATUS gensec_gse_magic(struct gensec_security *gensec_security,
931 const DATA_BLOB *in)
932 {
933 if (gensec_gssapi_check_oid(in, GENSEC_OID_KERBEROS5)) {
934 return NT_STATUS_OK;
935 } else {
936 return NT_STATUS_INVALID_PARAMETER;
937 }
938 }
939
940
941 /**
942 * Next state function for the GSE GENSEC mechanism
943 *
944 * @param gensec_gse_state GSE State
945 * @param mem_ctx The TALLOC_CTX for *out to be allocated on
946 * @param in The request, as a DATA_BLOB
947 * @param out The reply, as an talloc()ed DATA_BLOB, on *mem_ctx
948 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
949 * or NT_STATUS_OK if the user is authenticated.
950 */
951
952 static NTSTATUS gensec_gse_update(struct gensec_security *gensec_security,
953 TALLOC_CTX *mem_ctx,
954 struct tevent_context *ev,
955 const DATA_BLOB in, DATA_BLOB *out)
956 {
957 NTSTATUS status;
958 struct gse_context *gse_ctx =
959 talloc_get_type_abort(gensec_security->private_data,
960 struct gse_context);
961
962 switch (gensec_security->gensec_role) {
963 case GENSEC_CLIENT:
964 status = gse_get_client_auth_token(mem_ctx, gse_ctx,
965 &in, out);
966 break;
967 case GENSEC_SERVER:
968 status = gse_get_server_auth_token(mem_ctx, gse_ctx,
969 &in, out);
970 break;
971 }
972 if (!NT_STATUS_IS_OK(status)) {
973 return status;
974 }
975
976 return NT_STATUS_OK;
977 }
978
979 static NTSTATUS gensec_gse_wrap(struct gensec_security *gensec_security,
980 TALLOC_CTX *mem_ctx,
981 const DATA_BLOB *in,
982 DATA_BLOB *out)
983 {
984 struct gse_context *gse_ctx =
985 talloc_get_type_abort(gensec_security->private_data,
986 struct gse_context);
987 OM_uint32 maj_stat, min_stat;
988 gss_buffer_desc input_token, output_token;
989 int conf_state;
990 input_token.length = in->length;
991 input_token.value = in->data;
992
993 maj_stat = gss_wrap(&min_stat,
994 gse_ctx->gssapi_context,
995 gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
996 GSS_C_QOP_DEFAULT,
997 &input_token,
998 &conf_state,
999 &output_token);
1000 if (GSS_ERROR(maj_stat)) {
1001 DEBUG(0, ("gensec_gse_wrap: GSS Wrap failed: %s\n",
1002 gse_errstr(talloc_tos(), maj_stat, min_stat)));
1003 return NT_STATUS_ACCESS_DENIED;
1004 }
1005
1006 *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
1007 gss_release_buffer(&min_stat, &output_token);
1008
1009 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
1010 && !conf_state) {
1011 return NT_STATUS_ACCESS_DENIED;
1012 }
1013 return NT_STATUS_OK;
1014 }
1015
1016 static NTSTATUS gensec_gse_unwrap(struct gensec_security *gensec_security,
1017 TALLOC_CTX *mem_ctx,
1018 const DATA_BLOB *in,
1019 DATA_BLOB *out)
1020 {
1021 struct gse_context *gse_ctx =
1022 talloc_get_type_abort(gensec_security->private_data,
1023 struct gse_context);
1024 OM_uint32 maj_stat, min_stat;
1025 gss_buffer_desc input_token, output_token;
1026 int conf_state;
1027 gss_qop_t qop_state;
1028 input_token.length = in->length;
1029 input_token.value = in->data;
1030
1031 maj_stat = gss_unwrap(&min_stat,
1032 gse_ctx->gssapi_context,
1033 &input_token,
1034 &output_token,
1035 &conf_state,
1036 &qop_state);
1037 if (GSS_ERROR(maj_stat)) {
1038 DEBUG(0, ("gensec_gse_unwrap: GSS UnWrap failed: %s\n",
1039 gse_errstr(talloc_tos(), maj_stat, min_stat)));
1040 return NT_STATUS_ACCESS_DENIED;
1041 }
1042
1043 *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
1044 gss_release_buffer(&min_stat, &output_token);
1045
1046 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
1047 && !conf_state) {
1048 return NT_STATUS_ACCESS_DENIED;
1049 }
1050 return NT_STATUS_OK;
1051 }
1052
1053 static NTSTATUS gensec_gse_seal_packet(struct gensec_security *gensec_security,
1054 TALLOC_CTX *mem_ctx,
1055 uint8_t *data, size_t length,
1056 const uint8_t *whole_pdu, size_t pdu_length,
1057 DATA_BLOB *sig)
1058 {
1059 struct gse_context *gse_ctx =
1060 talloc_get_type_abort(gensec_security->private_data,
1061 struct gse_context);
1062 DATA_BLOB payload = data_blob_const(data, length);
1063 return gse_seal(mem_ctx, gse_ctx, &payload, sig);
1064 }
1065
1066 static NTSTATUS gensec_gse_unseal_packet(struct gensec_security *gensec_security,
1067 uint8_t *data, size_t length,
1068 const uint8_t *whole_pdu, size_t pdu_length,
1069 const DATA_BLOB *sig)
1070 {
1071 struct gse_context *gse_ctx =
1072 talloc_get_type_abort(gensec_security->private_data,
1073 struct gse_context);
1074 DATA_BLOB payload = data_blob_const(data, length);
1075 return gse_unseal(talloc_tos() /* unused */, gse_ctx, &payload, sig);
1076 }
1077
1078 static NTSTATUS gensec_gse_sign_packet(struct gensec_security *gensec_security,
1079 TALLOC_CTX *mem_ctx,
1080 const uint8_t *data, size_t length,
1081 const uint8_t *whole_pdu, size_t pdu_length,
1082 DATA_BLOB *sig)
1083 {
1084 struct gse_context *gse_ctx =
1085 talloc_get_type_abort(gensec_security->private_data,
1086 struct gse_context);
1087 DATA_BLOB payload = data_blob_const(data, length);
1088 return gse_sign(mem_ctx, gse_ctx, &payload, sig);
1089 }
1090
1091 static NTSTATUS gensec_gse_check_packet(struct gensec_security *gensec_security,
1092 const uint8_t *data, size_t length,
1093 const uint8_t *whole_pdu, size_t pdu_length,
1094 const DATA_BLOB *sig)
1095 {
1096 struct gse_context *gse_ctx =
1097 talloc_get_type_abort(gensec_security->private_data,
1098 struct gse_context);
1099 DATA_BLOB payload = data_blob_const(data, length);
1100 return gse_sigcheck(NULL, gse_ctx, &payload, sig);
1101 }
1102
1103 /* Try to figure out what features we actually got on the connection */
1104 static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
1105 uint32_t feature)
1106 {
1107 struct gse_context *gse_ctx =
1108 talloc_get_type_abort(gensec_security->private_data,
1109 struct gse_context);
1110
1111 if (feature & GENSEC_FEATURE_SIGN) {
1112 return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
1113 }
1114 if (feature & GENSEC_FEATURE_SEAL) {
1115 return gse_ctx->gss_got_flags & GSS_C_CONF_FLAG;
1116 }
1117 if (feature & GENSEC_FEATURE_SESSION_KEY) {
1118 /* Only for GSE/Krb5 */
1119 if (gss_oid_equal(gse_ctx->ret_mech, gss_mech_krb5)) {
1120 return true;
1121 }
1122 }
1123 if (feature & GENSEC_FEATURE_DCE_STYLE) {
1124 return gse_ctx->gss_got_flags & GSS_C_DCE_STYLE;
1125 }
1126 if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
1127 NTSTATUS status;
1128 uint32_t keytype;
1129
1130 if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
1131 return false;
1132 }
1133
1134 status = gse_get_session_key(talloc_tos(),
1135 gse_ctx, NULL, &keytype);
1136 /*
1137 * We should do a proper sig on the mechListMic unless
1138 * we know we have to be backwards compatible with
1139 * earlier windows versions.
1140 *
1141 * Negotiating a non-krb5
1142 * mech for example should be regarded as having
1143 * NEW_SPNEGO
1144 */
1145 if (NT_STATUS_IS_OK(status)) {
1146 switch (keytype) {
1147 case ENCTYPE_DES_CBC_CRC:
1148 case ENCTYPE_DES_CBC_MD5:
1149 case ENCTYPE_ARCFOUR_HMAC:
1150 case ENCTYPE_DES3_CBC_SHA1:
1151 return false;
1152 }
1153 }
1154 return true;
1155 }
1156 /* We can always do async (rather than strict request/reply) packets. */
1157 if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
1158 return true;
1159 }
1160 return false;
1161 }
1162
1163 /*
1164 * Extract the 'sesssion key' needed by SMB signing and ncacn_np
1165 * (for encrypting some passwords).
1166 *
1167 * This breaks all the abstractions, but what do you expect...
1168 */
1169 static NTSTATUS gensec_gse_session_key(struct gensec_security *gensec_security,
1170 TALLOC_CTX *mem_ctx,
1171 DATA_BLOB *session_key)
1172 {
1173 struct gse_context *gse_ctx =
1174 talloc_get_type_abort(gensec_security->private_data,
1175 struct gse_context);
1176
1177 return gse_get_session_key(mem_ctx, gse_ctx, session_key, NULL);
1178 }
1179
1180 /* Get some basic (and authorization) information about the user on
1181 * this session. This uses either the PAC (if present) or a local
1182 * database lookup */
1183 static NTSTATUS gensec_gse_session_info(struct gensec_security *gensec_security,
1184 TALLOC_CTX *mem_ctx,
1185 struct auth_session_info **_session_info)
1186 {
1187 struct gse_context *gse_ctx =
1188 talloc_get_type_abort(gensec_security->private_data,
1189 struct gse_context);
1190 NTSTATUS nt_status;
1191 TALLOC_CTX *tmp_ctx;
1192 struct auth_session_info *session_info = NULL;
1193 OM_uint32 maj_stat, min_stat;
1194 DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
1195
1196 gss_buffer_desc name_token;
1197 char *principal_string;
1198
1199 tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gse_session_info context");
1200 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1201
1202 maj_stat = gss_display_name(&min_stat,
1203 gse_ctx->client_name,
1204 &name_token,
1205 NULL);
1206 if (GSS_ERROR(maj_stat)) {
1207 DEBUG(1, ("GSS display_name failed: %s\n",
1208 gse_errstr(talloc_tos(), maj_stat, min_stat)));
1209 talloc_free(tmp_ctx);
1210 return NT_STATUS_FOOBAR;
1211 }
1212
1213 principal_string = talloc_strndup(tmp_ctx,
1214 (const char *)name_token.value,
1215 name_token.length);
1216
1217 gss_release_buffer(&min_stat, &name_token);
1218
1219 if (!principal_string) {
1220 talloc_free(tmp_ctx);
1221 return NT_STATUS_NO_MEMORY;
1222 }
1223
1224 nt_status = gssapi_obtain_pac_blob(tmp_ctx, gse_ctx->gssapi_context,
1225 gse_ctx->client_name,
1226 &pac_blob);
1227
1228 /* IF we have the PAC - otherwise we need to get this
1229 * data from elsewere
1230 */
1231 if (NT_STATUS_IS_OK(nt_status)) {
1232 pac_blob_ptr = &pac_blob;
1233 }
1234 nt_status = gensec_generate_session_info_pac(tmp_ctx,
1235 gensec_security,
1236 NULL,
1237 pac_blob_ptr, principal_string,
1238 gensec_get_remote_address(gensec_security),
1239 &session_info);
1240 if (!NT_STATUS_IS_OK(nt_status)) {
1241 talloc_free(tmp_ctx);
1242 return nt_status;
1243 }
1244
1245 nt_status = gensec_gse_session_key(gensec_security, session_info,
1246 &session_info->session_key);
1247 if (!NT_STATUS_IS_OK(nt_status)) {
1248 talloc_free(tmp_ctx);
1249 return nt_status;
1250 }
1251
1252 *_session_info = talloc_move(mem_ctx, &session_info);
1253 talloc_free(tmp_ctx);
1254
1255 return NT_STATUS_OK;
1256 }
1257
1258 static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
1259 size_t data_size)
1260 {
1261 struct gse_context *gse_ctx =
1262 talloc_get_type_abort(gensec_security->private_data,
1263 struct gse_context);
1264
1265 return gse_get_signature_length(gse_ctx,
1266 gensec_security->want_features & GENSEC_FEATURE_SEAL,
1267 data_size);
1268 }
1269
1270 static const char *gensec_gse_krb5_oids[] = {
1271 GENSEC_OID_KERBEROS5_OLD,
1272 GENSEC_OID_KERBEROS5,
1273 NULL
1274 };
1275
1276 const struct gensec_security_ops gensec_gse_krb5_security_ops = {
1277 .name = "gse_krb5",
1278 .auth_type = DCERPC_AUTH_TYPE_KRB5,
1279 .oid = gensec_gse_krb5_oids,
1280 .client_start = gensec_gse_client_start,
1281 .server_start = gensec_gse_server_start,
1282 .magic = gensec_gse_magic,
1283 .update = gensec_gse_update,
1284 .session_key = gensec_gse_session_key,
1285 .session_info = gensec_gse_session_info,
1286 .sig_size = gensec_gse_sig_size,
1287 .sign_packet = gensec_gse_sign_packet,
1288 .check_packet = gensec_gse_check_packet,
1289 .seal_packet = gensec_gse_seal_packet,
1290 .unseal_packet = gensec_gse_unseal_packet,
1291 .wrap = gensec_gse_wrap,
1292 .unwrap = gensec_gse_unwrap,
1293 .have_feature = gensec_gse_have_feature,
1294 .enabled = true,
1295 .kerberos = true,
1296 .priority = GENSEC_GSSAPI
1297 };
1298
1299 #endif /* HAVE_KRB5 && HAVE_GSS_WRAP_IOV */
Samba GIT mirror