?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
auth:gensec: Use C99 initializer in schannel
[Samba.git] / auth / gensec / schannel.c
blob364a0fcc1860eb563329c5401b8019197f5be827
1 /*
2 Unix SMB/CIFS implementation.
3
4 dcerpc schannel operations
5
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include <tevent.h>
25 #include "lib/util/tevent_ntstatus.h"
26 #include "librpc/gen_ndr/ndr_schannel.h"
27 #include "auth/auth.h"
28 #include "auth/credentials/credentials.h"
29 #include "auth/gensec/gensec.h"
30 #include "auth/gensec/gensec_internal.h"
31 #include "auth/gensec/gensec_proto.h"
32 #include "../libcli/auth/schannel.h"
33 #include "librpc/gen_ndr/dcerpc.h"
34 #include "param/param.h"
35 #include "auth/gensec/gensec_toplevel_proto.h"
36 #include "lib/crypto/crypto.h"
37 #include "libds/common/roles.h"
38
39 #undef DBGC_CLASS
40 #define DBGC_CLASS DBGC_AUTH
41
42 struct schannel_state {
43 struct gensec_security *gensec;
44 uint64_t seq_num;
45 bool initiator;
46 struct netlogon_creds_CredentialState *creds;
47 struct auth_user_info_dc *user_info_dc;
48 };
49
50 #define SETUP_SEQNUM(state, buf, initiator) do { \
51 uint8_t *_buf = buf; \
52 uint32_t _seq_num_low = (state)->seq_num & UINT32_MAX; \
53 uint32_t _seq_num_high = (state)->seq_num >> 32; \
54 if (initiator) { \
55 _seq_num_high |= 0x80000000; \
56 } \
57 RSIVAL(_buf, 0, _seq_num_low); \
58 RSIVAL(_buf, 4, _seq_num_high); \
59 } while(0)
60
61 static struct schannel_state *netsec_create_state(
62 struct gensec_security *gensec,
63 struct netlogon_creds_CredentialState *creds,
64 bool initiator)
65 {
66 struct schannel_state *state;
67
68 state = talloc_zero(gensec, struct schannel_state);
69 if (state == NULL) {
70 return NULL;
71 }
72
73 state->gensec = gensec;
74 state->initiator = initiator;
75 state->creds = netlogon_creds_copy(state, creds);
76 if (state->creds == NULL) {
77 talloc_free(state);
78 return NULL;
79 }
80
81 gensec->private_data = state;
82
83 return state;
84 }
85
86 static void netsec_offset_and_sizes(struct schannel_state *state,
87 bool do_seal,
88 uint32_t *_min_sig_size,
89 uint32_t *_used_sig_size,
90 uint32_t *_checksum_length,
91 uint32_t *_confounder_ofs)
92 {
93 uint32_t min_sig_size;
94 uint32_t used_sig_size;
95 uint32_t checksum_length;
96 uint32_t confounder_ofs;
97
98 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
99 min_sig_size = 48;
100 used_sig_size = 56;
101 /*
102 * Note: windows has a bug here and uses the old values...
103 *
104 * checksum_length = 32;
105 * confounder_ofs = 48;
106 */
107 checksum_length = 8;
108 confounder_ofs = 24;
109 } else {
110 min_sig_size = 24;
111 used_sig_size = 32;
112 checksum_length = 8;
113 confounder_ofs = 24;
114 }
115
116 if (do_seal) {
117 min_sig_size += 8;
118 }
119
120 if (_min_sig_size) {
121 *_min_sig_size = min_sig_size;
122 }
123
124 if (_used_sig_size) {
125 *_used_sig_size = used_sig_size;
126 }
127
128 if (_checksum_length) {
129 *_checksum_length = checksum_length;
130 }
131
132 if (_confounder_ofs) {
133 *_confounder_ofs = confounder_ofs;
134 }
135 }
136
137 /*******************************************************************
138 Encode or Decode the sequence number (which is symmetric)
139 ********************************************************************/
140 static void netsec_do_seq_num(struct schannel_state *state,
141 const uint8_t *checksum,
142 uint32_t checksum_length,
143 uint8_t seq_num[8])
144 {
145 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
146 AES_KEY key;
147 uint8_t iv[AES_BLOCK_SIZE];
148
149 AES_set_encrypt_key(state->creds->session_key, 128, &key);
150 ZERO_STRUCT(iv);
151 memcpy(iv+0, checksum, 8);
152 memcpy(iv+8, checksum, 8);
153
154 aes_cfb8_encrypt(seq_num, seq_num, 8, &key, iv, AES_ENCRYPT);
155 } else {
156 static const uint8_t zeros[4];
157 uint8_t sequence_key[16];
158 uint8_t digest1[16];
159
160 hmac_md5(state->creds->session_key, zeros, sizeof(zeros), digest1);
161 hmac_md5(digest1, checksum, checksum_length, sequence_key);
162 arcfour_crypt(seq_num, sequence_key, 8);
163 }
164
165 state->seq_num++;
166 }
167
168 static void netsec_do_seal(struct schannel_state *state,
169 const uint8_t seq_num[8],
170 uint8_t confounder[8],
171 uint8_t *data, uint32_t length,
172 bool forward)
173 {
174 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
175 AES_KEY key;
176 uint8_t iv[AES_BLOCK_SIZE];
177 uint8_t sess_kf0[16];
178 int i;
179
180 for (i = 0; i < 16; i++) {
181 sess_kf0[i] = state->creds->session_key[i] ^ 0xf0;
182 }
183
184 AES_set_encrypt_key(sess_kf0, 128, &key);
185 ZERO_STRUCT(iv);
186 memcpy(iv+0, seq_num, 8);
187 memcpy(iv+8, seq_num, 8);
188
189 if (forward) {
190 aes_cfb8_encrypt(confounder, confounder, 8, &key, iv, AES_ENCRYPT);
191 aes_cfb8_encrypt(data, data, length, &key, iv, AES_ENCRYPT);
192 } else {
193 aes_cfb8_encrypt(confounder, confounder, 8, &key, iv, AES_DECRYPT);
194 aes_cfb8_encrypt(data, data, length, &key, iv, AES_DECRYPT);
195 }
196 } else {
197 uint8_t sealing_key[16];
198 static const uint8_t zeros[4];
199 uint8_t digest2[16];
200 uint8_t sess_kf0[16];
201 int i;
202
203 for (i = 0; i < 16; i++) {
204 sess_kf0[i] = state->creds->session_key[i] ^ 0xf0;
205 }
206
207 hmac_md5(sess_kf0, zeros, 4, digest2);
208 hmac_md5(digest2, seq_num, 8, sealing_key);
209
210 arcfour_crypt(confounder, sealing_key, 8);
211 arcfour_crypt(data, sealing_key, length);
212 }
213 }
214
215 /*******************************************************************
216 Create a digest over the entire packet (including the data), and
217 MD5 it with the session key.
218 ********************************************************************/
219 static void netsec_do_sign(struct schannel_state *state,
220 const uint8_t *confounder,
221 const uint8_t *data, size_t length,
222 uint8_t header[8],
223 uint8_t *checksum)
224 {
225 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
226 struct HMACSHA256Context ctx;
227
228 hmac_sha256_init(state->creds->session_key,
229 sizeof(state->creds->session_key),
230 &ctx);
231
232 if (confounder) {
233 SSVAL(header, 0, NL_SIGN_HMAC_SHA256);
234 SSVAL(header, 2, NL_SEAL_AES128);
235 SSVAL(header, 4, 0xFFFF);
236 SSVAL(header, 6, 0x0000);
237
238 hmac_sha256_update(header, 8, &ctx);
239 hmac_sha256_update(confounder, 8, &ctx);
240 } else {
241 SSVAL(header, 0, NL_SIGN_HMAC_SHA256);
242 SSVAL(header, 2, NL_SEAL_NONE);
243 SSVAL(header, 4, 0xFFFF);
244 SSVAL(header, 6, 0x0000);
245
246 hmac_sha256_update(header, 8, &ctx);
247 }
248
249 hmac_sha256_update(data, length, &ctx);
250
251 hmac_sha256_final(checksum, &ctx);
252 } else {
253 uint8_t packet_digest[16];
254 static const uint8_t zeros[4];
255 MD5_CTX ctx;
256
257 MD5Init(&ctx);
258 MD5Update(&ctx, zeros, 4);
259 if (confounder) {
260 SSVAL(header, 0, NL_SIGN_HMAC_MD5);
261 SSVAL(header, 2, NL_SEAL_RC4);
262 SSVAL(header, 4, 0xFFFF);
263 SSVAL(header, 6, 0x0000);
264
265 MD5Update(&ctx, header, 8);
266 MD5Update(&ctx, confounder, 8);
267 } else {
268 SSVAL(header, 0, NL_SIGN_HMAC_MD5);
269 SSVAL(header, 2, NL_SEAL_NONE);
270 SSVAL(header, 4, 0xFFFF);
271 SSVAL(header, 6, 0x0000);
272
273 MD5Update(&ctx, header, 8);
274 }
275 MD5Update(&ctx, data, length);
276 MD5Final(packet_digest, &ctx);
277
278 hmac_md5(state->creds->session_key,
279 packet_digest, sizeof(packet_digest),
280 checksum);
281 }
282 }
283
284 static NTSTATUS netsec_incoming_packet(struct schannel_state *state,
285 bool do_unseal,
286 uint8_t *data, size_t length,
287 const uint8_t *whole_pdu, size_t pdu_length,
288 const DATA_BLOB *sig)
289 {
290 uint32_t min_sig_size = 0;
291 uint8_t header[8];
292 uint8_t checksum[32];
293 uint32_t checksum_length = sizeof(checksum_length);
294 uint8_t _confounder[8];
295 uint8_t *confounder = NULL;
296 uint32_t confounder_ofs = 0;
297 uint8_t seq_num[8];
298 int ret;
299 const uint8_t *sign_data = NULL;
300 size_t sign_length = 0;
301
302 netsec_offset_and_sizes(state,
303 do_unseal,
304 &min_sig_size,
305 NULL,
306 &checksum_length,
307 &confounder_ofs);
308
309 if (sig->length < min_sig_size) {
310 return NT_STATUS_ACCESS_DENIED;
311 }
312
313 if (do_unseal) {
314 confounder = _confounder;
315 memcpy(confounder, sig->data+confounder_ofs, 8);
316 } else {
317 confounder = NULL;
318 }
319
320 SETUP_SEQNUM(state, seq_num, !state->initiator);
321
322 if (do_unseal) {
323 netsec_do_seal(state, seq_num,
324 confounder,
325 data, length,
326 false);
327 }
328
329 if (state->gensec->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
330 sign_data = whole_pdu;
331 sign_length = pdu_length;
332 } else {
333 sign_data = data;
334 sign_length = length;
335 }
336
337 netsec_do_sign(state, confounder,
338 sign_data, sign_length,
339 header, checksum);
340
341 ret = memcmp(checksum, sig->data+16, checksum_length);
342 if (ret != 0) {
343 dump_data_pw("calc digest:", checksum, checksum_length);
344 dump_data_pw("wire digest:", sig->data+16, checksum_length);
345 return NT_STATUS_ACCESS_DENIED;
346 }
347
348 netsec_do_seq_num(state, checksum, checksum_length, seq_num);
349
350 ret = memcmp(seq_num, sig->data+8, 8);
351 if (ret != 0) {
352 dump_data_pw("calc seq num:", seq_num, 8);
353 dump_data_pw("wire seq num:", sig->data+8, 8);
354 return NT_STATUS_ACCESS_DENIED;
355 }
356
357 return NT_STATUS_OK;
358 }
359
360 static uint32_t netsec_outgoing_sig_size(struct schannel_state *state)
361 {
362 uint32_t sig_size = 0;
363
364 netsec_offset_and_sizes(state,
365 true,
366 NULL,
367 &sig_size,
368 NULL,
369 NULL);
370
371 return sig_size;
372 }
373
374 static NTSTATUS netsec_outgoing_packet(struct schannel_state *state,
375 TALLOC_CTX *mem_ctx,
376 bool do_seal,
377 uint8_t *data, size_t length,
378 const uint8_t *whole_pdu, size_t pdu_length,
379 DATA_BLOB *sig)
380 {
381 uint32_t min_sig_size = 0;
382 uint32_t used_sig_size = 0;
383 uint8_t header[8];
384 uint8_t checksum[32];
385 uint32_t checksum_length = sizeof(checksum_length);
386 uint8_t _confounder[8];
387 uint8_t *confounder = NULL;
388 uint32_t confounder_ofs = 0;
389 uint8_t seq_num[8];
390 const uint8_t *sign_data = NULL;
391 size_t sign_length = 0;
392
393 netsec_offset_and_sizes(state,
394 do_seal,
395 &min_sig_size,
396 &used_sig_size,
397 &checksum_length,
398 &confounder_ofs);
399
400 SETUP_SEQNUM(state, seq_num, state->initiator);
401
402 if (do_seal) {
403 confounder = _confounder;
404 generate_random_buffer(confounder, 8);
405 } else {
406 confounder = NULL;
407 }
408
409 if (state->gensec->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
410 sign_data = whole_pdu;
411 sign_length = pdu_length;
412 } else {
413 sign_data = data;
414 sign_length = length;
415 }
416
417 netsec_do_sign(state, confounder,
418 sign_data, sign_length,
419 header, checksum);
420
421 if (do_seal) {
422 netsec_do_seal(state, seq_num,
423 confounder,
424 data, length,
425 true);
426 }
427
428 netsec_do_seq_num(state, checksum, checksum_length, seq_num);
429
430 (*sig) = data_blob_talloc_zero(mem_ctx, used_sig_size);
431
432 memcpy(sig->data, header, 8);
433 memcpy(sig->data+8, seq_num, 8);
434 memcpy(sig->data+16, checksum, checksum_length);
435
436 if (confounder) {
437 memcpy(sig->data+confounder_ofs, confounder, 8);
438 }
439
440 dump_data_pw("signature:", sig->data+ 0, 8);
441 dump_data_pw("seq_num :", sig->data+ 8, 8);
442 dump_data_pw("digest :", sig->data+16, checksum_length);
443 dump_data_pw("confound :", sig->data+confounder_ofs, 8);
444
445 return NT_STATUS_OK;
446 }
447
448 _PUBLIC_ NTSTATUS gensec_schannel_init(TALLOC_CTX *ctx);
449
450 static size_t schannel_sig_size(struct gensec_security *gensec_security, size_t data_size)
451 {
452 struct schannel_state *state =
453 talloc_get_type_abort(gensec_security->private_data,
454 struct schannel_state);
455
456 return netsec_outgoing_sig_size(state);
457 }
458
459 struct schannel_update_state {
460 NTSTATUS status;
461 DATA_BLOB out;
462 };
463
464 static NTSTATUS schannel_update_internal(struct gensec_security *gensec_security,
465 TALLOC_CTX *out_mem_ctx,
466 const DATA_BLOB in, DATA_BLOB *out);
467
468 static struct tevent_req *schannel_update_send(TALLOC_CTX *mem_ctx,
469 struct tevent_context *ev,
470 struct gensec_security *gensec_security,
471 const DATA_BLOB in)
472 {
473 struct tevent_req *req;
474 struct schannel_update_state *state = NULL;
475 NTSTATUS status;
476
477 req = tevent_req_create(mem_ctx, &state,
478 struct schannel_update_state);
479 if (req == NULL) {
480 return NULL;
481 }
482
483 status = schannel_update_internal(gensec_security,
484 state, in,
485 &state->out);
486 state->status = status;
487 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
488 status = NT_STATUS_OK;
489 }
490 if (tevent_req_nterror(req, status)) {
491 return tevent_req_post(req, ev);
492 }
493
494 tevent_req_done(req);
495 return tevent_req_post(req, ev);
496 }
497
498 static NTSTATUS schannel_update_internal(struct gensec_security *gensec_security,
499 TALLOC_CTX *out_mem_ctx,
500 const DATA_BLOB in, DATA_BLOB *out)
501 {
502 struct schannel_state *state =
503 talloc_get_type(gensec_security->private_data,
504 struct schannel_state);
505 NTSTATUS status;
506 enum ndr_err_code ndr_err;
507 struct NL_AUTH_MESSAGE bind_schannel = {
508 .Flags = 0,
509 };
510 struct NL_AUTH_MESSAGE bind_schannel_ack;
511 struct netlogon_creds_CredentialState *creds;
512 const char *workstation;
513 const char *domain;
514
515 *out = data_blob(NULL, 0);
516
517 if (gensec_security->dcerpc_auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) {
518 switch (gensec_security->gensec_role) {
519 case GENSEC_CLIENT:
520 return NT_STATUS_INVALID_PARAMETER_MIX;
521 case GENSEC_SERVER:
522 return NT_STATUS_INVALID_PARAMETER;
523 }
524 return NT_STATUS_INTERNAL_ERROR;
525 }
526
527 switch (gensec_security->gensec_role) {
528 case GENSEC_CLIENT:
529 if (state != NULL) {
530 /* we could parse the bind ack, but we don't know what it is yet */
531 return NT_STATUS_OK;
532 }
533
534 creds = cli_credentials_get_netlogon_creds(gensec_security->credentials);
535 if (creds == NULL) {
536 return NT_STATUS_INVALID_PARAMETER_MIX;
537 }
538
539 state = netsec_create_state(gensec_security,
540 creds, true /* initiator */);
541 if (state == NULL) {
542 return NT_STATUS_NO_MEMORY;
543 }
544
545 bind_schannel.MessageType = NL_NEGOTIATE_REQUEST;
546
547 bind_schannel.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
548 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
549 bind_schannel.oem_netbios_domain.a = cli_credentials_get_domain(gensec_security->credentials);
550 bind_schannel.oem_netbios_computer.a = creds->computer_name;
551
552 if (creds->secure_channel_type == SEC_CHAN_DNS_DOMAIN) {
553 bind_schannel.Flags |= NL_FLAG_UTF8_DNS_DOMAIN_NAME;
554 bind_schannel.utf8_dns_domain.u = cli_credentials_get_realm(gensec_security->credentials);
555
556 bind_schannel.Flags |= NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME;
557 bind_schannel.utf8_netbios_computer.u = creds->computer_name;
558 }
559
560 ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel,
561 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
562 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
563 status = ndr_map_error2ntstatus(ndr_err);
564 DEBUG(3, ("Could not create schannel bind: %s\n",
565 nt_errstr(status)));
566 return status;
567 }
568
569 return NT_STATUS_MORE_PROCESSING_REQUIRED;
570 case GENSEC_SERVER:
571
572 if (state != NULL) {
573 /* no third leg on this protocol */
574 return NT_STATUS_INVALID_PARAMETER;
575 }
576
577 /* parse the schannel startup blob */
578 ndr_err = ndr_pull_struct_blob(&in, out_mem_ctx, &bind_schannel,
579 (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
580 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
581 status = ndr_map_error2ntstatus(ndr_err);
582 DEBUG(3, ("Could not parse incoming schannel bind: %s\n",
583 nt_errstr(status)));
584 return status;
585 }
586
587 if (bind_schannel.Flags & NL_FLAG_OEM_NETBIOS_DOMAIN_NAME) {
588 domain = bind_schannel.oem_netbios_domain.a;
589 if (strcasecmp_m(domain, lpcfg_workgroup(gensec_security->settings->lp_ctx)) != 0) {
590 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
591 domain, lpcfg_workgroup(gensec_security->settings->lp_ctx)));
592 return NT_STATUS_LOGON_FAILURE;
593 }
594 } else if (bind_schannel.Flags & NL_FLAG_UTF8_DNS_DOMAIN_NAME) {
595 domain = bind_schannel.utf8_dns_domain.u;
596 if (strcasecmp_m(domain, lpcfg_dnsdomain(gensec_security->settings->lp_ctx)) != 0) {
597 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
598 domain, lpcfg_dnsdomain(gensec_security->settings->lp_ctx)));
599 return NT_STATUS_LOGON_FAILURE;
600 }
601 } else {
602 DEBUG(3, ("Request for schannel to without domain\n"));
603 return NT_STATUS_LOGON_FAILURE;
604 }
605
606 if (bind_schannel.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME) {
607 workstation = bind_schannel.oem_netbios_computer.a;
608 } else if (bind_schannel.Flags & NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME) {
609 workstation = bind_schannel.utf8_netbios_computer.u;
610 } else {
611 DEBUG(3, ("Request for schannel to without netbios workstation\n"));
612 return NT_STATUS_LOGON_FAILURE;
613 }
614
615 status = schannel_get_creds_state(out_mem_ctx,
616 gensec_security->settings->lp_ctx,
617 workstation, &creds);
618 if (!NT_STATUS_IS_OK(status)) {
619 DEBUG(3, ("Could not find session key for attempted schannel connection from %s: %s\n",
620 workstation, nt_errstr(status)));
621 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
622 return NT_STATUS_LOGON_FAILURE;
623 }
624 return status;
625 }
626
627 state = netsec_create_state(gensec_security,
628 creds, false /* not initiator */);
629 if (state == NULL) {
630 return NT_STATUS_NO_MEMORY;
631 }
632
633 status = auth_anonymous_user_info_dc(state,
634 lpcfg_netbios_name(gensec_security->settings->lp_ctx),
635 &state->user_info_dc);
636 if (!NT_STATUS_IS_OK(status)) {
637 return status;
638 }
639
640 bind_schannel_ack.MessageType = NL_NEGOTIATE_RESPONSE;
641 bind_schannel_ack.Flags = 0;
642 bind_schannel_ack.Buffer.dummy = 0x6c0000; /* actually I think
643 * this does not have
644 * any meaning here
645 * - gd */
646
647 ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel_ack,
648 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
649 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
650 status = ndr_map_error2ntstatus(ndr_err);
651 DEBUG(3, ("Could not return schannel bind ack for client %s: %s\n",
652 workstation, nt_errstr(status)));
653 return status;
654 }
655
656 return NT_STATUS_OK;
657 }
658 return NT_STATUS_INVALID_PARAMETER;
659 }
660
661 static NTSTATUS schannel_update_recv(struct tevent_req *req,
662 TALLOC_CTX *out_mem_ctx,
663 DATA_BLOB *out)
664 {
665 struct schannel_update_state *state =
666 tevent_req_data(req,
667 struct schannel_update_state);
668 NTSTATUS status;
669
670 *out = data_blob_null;
671
672 if (tevent_req_is_nterror(req, &status)) {
673 tevent_req_received(req);
674 return status;
675 }
676
677 status = state->status;
678 talloc_steal(out_mem_ctx, state->out.data);
679 *out = state->out;
680 tevent_req_received(req);
681 return status;
682 }
683
684 /**
685 * Returns anonymous credentials for schannel, matching Win2k3.
686 *
687 */
688
689 static NTSTATUS schannel_session_info(struct gensec_security *gensec_security,
690 TALLOC_CTX *mem_ctx,
691 struct auth_session_info **_session_info)
692 {
693 struct schannel_state *state =
694 talloc_get_type(gensec_security->private_data,
695 struct schannel_state);
696 struct auth4_context *auth_ctx = gensec_security->auth_context;
697 struct auth_session_info *session_info = NULL;
698 uint32_t session_info_flags = 0;
699 NTSTATUS status;
700
701 if (auth_ctx == NULL) {
702 DEBUG(0, ("Cannot generate a session_info without the auth_context\n"));
703 return NT_STATUS_INTERNAL_ERROR;
704 }
705
706 if (auth_ctx->generate_session_info == NULL) {
707 DEBUG(0, ("Cannot generate a session_info without the generate_session_info hook\n"));
708 return NT_STATUS_INTERNAL_ERROR;
709 }
710
711 if (gensec_security->want_features & GENSEC_FEATURE_UNIX_TOKEN) {
712 session_info_flags |= AUTH_SESSION_INFO_UNIX_TOKEN;
713 }
714
715 session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
716
717 status = auth_ctx->generate_session_info(
718 auth_ctx,
719 mem_ctx,
720 state->user_info_dc,
721 state->user_info_dc->info->account_name,
722 session_info_flags,
723 &session_info);
724 if (!NT_STATUS_IS_OK(status)) {
725 return status;
726 }
727
728 *_session_info = session_info;
729 return NT_STATUS_OK;
730 }
731
732 /*
733 * Reduce the attack surface by ensuring schannel is not availble when
734 * we are not a DC
735 */
736 static NTSTATUS schannel_server_start(struct gensec_security *gensec_security)
737 {
738 enum server_role server_role
739 = lpcfg_server_role(gensec_security->settings->lp_ctx);
740
741 switch (server_role) {
742 case ROLE_DOMAIN_BDC:
743 case ROLE_DOMAIN_PDC:
744 case ROLE_ACTIVE_DIRECTORY_DC:
745 return NT_STATUS_OK;
746 default:
747 return NT_STATUS_NOT_IMPLEMENTED;
748 }
749 }
750
751 static NTSTATUS schannel_client_start(struct gensec_security *gensec_security)
752 {
753 return NT_STATUS_OK;
754 }
755
756 static bool schannel_have_feature(struct gensec_security *gensec_security,
757 uint32_t feature)
758 {
759 if (gensec_security->dcerpc_auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY) {
760 if (feature & GENSEC_FEATURE_SIGN) {
761 return true;
762 }
763 }
764 if (gensec_security->dcerpc_auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
765 if (feature & GENSEC_FEATURE_SEAL) {
766 return true;
767 }
768 }
769 if (feature & GENSEC_FEATURE_DCE_STYLE) {
770 return true;
771 }
772 if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
773 return true;
774 }
775 return false;
776 }
777
778 /*
779 unseal a packet
780 */
781 static NTSTATUS schannel_unseal_packet(struct gensec_security *gensec_security,
782 uint8_t *data, size_t length,
783 const uint8_t *whole_pdu, size_t pdu_length,
784 const DATA_BLOB *sig)
785 {
786 struct schannel_state *state =
787 talloc_get_type_abort(gensec_security->private_data,
788 struct schannel_state);
789
790 return netsec_incoming_packet(state, true,
791 discard_const_p(uint8_t, data),
792 length,
793 whole_pdu, pdu_length,
794 sig);
795 }
796
797 /*
798 check the signature on a packet
799 */
800 static NTSTATUS schannel_check_packet(struct gensec_security *gensec_security,
801 const uint8_t *data, size_t length,
802 const uint8_t *whole_pdu, size_t pdu_length,
803 const DATA_BLOB *sig)
804 {
805 struct schannel_state *state =
806 talloc_get_type_abort(gensec_security->private_data,
807 struct schannel_state);
808
809 return netsec_incoming_packet(state, false,
810 discard_const_p(uint8_t, data),
811 length,
812 whole_pdu, pdu_length,
813 sig);
814 }
815 /*
816 seal a packet
817 */
818 static NTSTATUS schannel_seal_packet(struct gensec_security *gensec_security,
819 TALLOC_CTX *mem_ctx,
820 uint8_t *data, size_t length,
821 const uint8_t *whole_pdu, size_t pdu_length,
822 DATA_BLOB *sig)
823 {
824 struct schannel_state *state =
825 talloc_get_type_abort(gensec_security->private_data,
826 struct schannel_state);
827
828 return netsec_outgoing_packet(state, mem_ctx, true,
829 data, length,
830 whole_pdu, pdu_length,
831 sig);
832 }
833
834 /*
835 sign a packet
836 */
837 static NTSTATUS schannel_sign_packet(struct gensec_security *gensec_security,
838 TALLOC_CTX *mem_ctx,
839 const uint8_t *data, size_t length,
840 const uint8_t *whole_pdu, size_t pdu_length,
841 DATA_BLOB *sig)
842 {
843 struct schannel_state *state =
844 talloc_get_type_abort(gensec_security->private_data,
845 struct schannel_state);
846
847 return netsec_outgoing_packet(state, mem_ctx, false,
848 discard_const_p(uint8_t, data),
849 length,
850 whole_pdu, pdu_length,
851 sig);
852 }
853
854 static const struct gensec_security_ops gensec_schannel_security_ops = {
855 .name = "schannel",
856 .auth_type = DCERPC_AUTH_TYPE_SCHANNEL,
857 .client_start = schannel_client_start,
858 .server_start = schannel_server_start,
859 .update_send = schannel_update_send,
860 .update_recv = schannel_update_recv,
861 .seal_packet = schannel_seal_packet,
862 .sign_packet = schannel_sign_packet,
863 .check_packet = schannel_check_packet,
864 .unseal_packet = schannel_unseal_packet,
865 .session_info = schannel_session_info,
866 .sig_size = schannel_sig_size,
867 .have_feature = schannel_have_feature,
868 .enabled = true,
869 .priority = GENSEC_SCHANNEL
870 };
871
872 _PUBLIC_ NTSTATUS gensec_schannel_init(TALLOC_CTX *ctx)
873 {
874 NTSTATUS ret;
875 ret = gensec_register(ctx, &gensec_schannel_security_ops);
876 if (!NT_STATUS_IS_OK(ret)) {
877 DEBUG(0,("Failed to register '%s' gensec backend!\n",
878 gensec_schannel_security_ops.name));
879 return ret;
880 }
881
882 return ret;
883 }
Samba GIT mirror