2 Unix SMB/CIFS implementation.
4 server side dcerpc authentication code
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Stefan (metze) Metzmacher 2004
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #include "rpc_server/dcerpc_server.h"
26 #include "librpc/gen_ndr/ndr_dcerpc.h"
27 #include "auth/credentials/credentials.h"
28 #include "auth/gensec/gensec.h"
31 parse any auth information from a dcerpc bind request
32 return False if we can't handle the auth request for some
33 reason (in which case we send a bind_nak)
35 BOOL
dcesrv_auth_bind(struct dcesrv_call_state
*call
)
37 struct cli_credentials
*server_credentials
;
38 struct ncacn_packet
*pkt
= &call
->pkt
;
39 struct dcesrv_connection
*dce_conn
= call
->conn
;
40 struct dcesrv_auth
*auth
= &dce_conn
->auth_state
;
43 if (pkt
->u
.bind
.auth_info
.length
== 0) {
44 dce_conn
->auth_state
.auth_info
= NULL
;
48 dce_conn
->auth_state
.auth_info
= talloc(dce_conn
, struct dcerpc_auth
);
49 if (!dce_conn
->auth_state
.auth_info
) {
53 status
= ndr_pull_struct_blob(&pkt
->u
.bind
.auth_info
,
55 dce_conn
->auth_state
.auth_info
,
56 (ndr_pull_flags_fn_t
)ndr_pull_dcerpc_auth
);
57 if (!NT_STATUS_IS_OK(status
)) {
61 status
= gensec_server_start(dce_conn
, call
->event_ctx
, call
->msg_ctx
, &auth
->gensec_security
);
62 if (!NT_STATUS_IS_OK(status
)) {
63 DEBUG(1, ("Failed to start GENSEC for DCERPC server: %s\n", nt_errstr(status
)));
68 = cli_credentials_init(call
);
69 if (!server_credentials
) {
70 DEBUG(1, ("Failed to init server credentials\n"));
74 cli_credentials_set_conf(server_credentials
);
75 status
= cli_credentials_set_machine_account(server_credentials
);
76 if (!NT_STATUS_IS_OK(status
)) {
77 DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(status
)));
78 talloc_free(server_credentials
);
79 server_credentials
= NULL
;
82 gensec_set_credentials(auth
->gensec_security
, server_credentials
);
84 status
= gensec_start_mech_by_authtype(auth
->gensec_security
, auth
->auth_info
->auth_type
,
85 auth
->auth_info
->auth_level
);
87 if (!NT_STATUS_IS_OK(status
)) {
88 DEBUG(1, ("Failed to start GENSEC mechanism for DCERPC server: auth_type=%d, auth_level=%d: %s\n",
89 (int)auth
->auth_info
->auth_type
,
90 (int)auth
->auth_info
->auth_level
,
99 add any auth information needed in a bind ack, and process the authentication
100 information found in the bind.
102 BOOL
dcesrv_auth_bind_ack(struct dcesrv_call_state
*call
, struct ncacn_packet
*pkt
)
104 struct dcesrv_connection
*dce_conn
= call
->conn
;
107 if (!call
->conn
->auth_state
.gensec_security
) {
111 status
= gensec_update(dce_conn
->auth_state
.gensec_security
,
113 dce_conn
->auth_state
.auth_info
->credentials
,
114 &dce_conn
->auth_state
.auth_info
->credentials
);
116 if (NT_STATUS_IS_OK(status
)) {
117 status
= gensec_session_info(dce_conn
->auth_state
.gensec_security
,
118 &dce_conn
->auth_state
.session_info
);
119 if (!NT_STATUS_IS_OK(status
)) {
120 DEBUG(1, ("Failed to establish session_info: %s\n", nt_errstr(status
)));
124 /* Now that we are authenticated, go back to the generic session key... */
125 dce_conn
->auth_state
.session_key
= dcesrv_generic_session_key
;
127 } else if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
128 dce_conn
->auth_state
.auth_info
->auth_pad_length
= 0;
129 dce_conn
->auth_state
.auth_info
->auth_reserved
= 0;
132 DEBUG(2, ("Failed to start dcesrv auth negotiate: %s\n", nt_errstr(status
)));
139 process the final stage of a auth request
141 BOOL
dcesrv_auth_auth3(struct dcesrv_call_state
*call
)
143 struct ncacn_packet
*pkt
= &call
->pkt
;
144 struct dcesrv_connection
*dce_conn
= call
->conn
;
147 /* We can't work without an existing gensec state, and an new blob to feed it */
148 if (!dce_conn
->auth_state
.auth_info
||
149 !dce_conn
->auth_state
.gensec_security
||
150 pkt
->u
.auth3
.auth_info
.length
== 0) {
154 status
= ndr_pull_struct_blob(&pkt
->u
.auth3
.auth_info
,
156 dce_conn
->auth_state
.auth_info
,
157 (ndr_pull_flags_fn_t
)ndr_pull_dcerpc_auth
);
158 if (!NT_STATUS_IS_OK(status
)) {
162 /* Pass the extra data we got from the client down to gensec for processing */
163 status
= gensec_update(dce_conn
->auth_state
.gensec_security
,
165 dce_conn
->auth_state
.auth_info
->credentials
,
166 &dce_conn
->auth_state
.auth_info
->credentials
);
167 if (NT_STATUS_IS_OK(status
)) {
168 status
= gensec_session_info(dce_conn
->auth_state
.gensec_security
,
169 &dce_conn
->auth_state
.session_info
);
170 if (!NT_STATUS_IS_OK(status
)) {
171 DEBUG(1, ("Failed to establish session_info: %s\n", nt_errstr(status
)));
174 /* Now that we are authenticated, go back to the generic session key... */
175 dce_conn
->auth_state
.session_key
= dcesrv_generic_session_key
;
178 DEBUG(4, ("dcesrv_auth_auth3: failed to authenticate: %s\n",
187 parse any auth information from a dcerpc alter request
188 return False if we can't handle the auth request for some
189 reason (in which case we send a bind_nak (is this true for here?))
191 BOOL
dcesrv_auth_alter(struct dcesrv_call_state
*call
)
193 struct ncacn_packet
*pkt
= &call
->pkt
;
194 struct dcesrv_connection
*dce_conn
= call
->conn
;
197 /* on a pure interface change there is no auth blob */
198 if (pkt
->u
.alter
.auth_info
.length
== 0) {
202 /* We can't work without an existing gensec state */
203 if (!dce_conn
->auth_state
.gensec_security
) {
207 dce_conn
->auth_state
.auth_info
= talloc(dce_conn
, struct dcerpc_auth
);
208 if (!dce_conn
->auth_state
.auth_info
) {
212 status
= ndr_pull_struct_blob(&pkt
->u
.alter
.auth_info
,
214 dce_conn
->auth_state
.auth_info
,
215 (ndr_pull_flags_fn_t
)ndr_pull_dcerpc_auth
);
216 if (!NT_STATUS_IS_OK(status
)) {
224 add any auth information needed in a alter ack, and process the authentication
225 information found in the alter.
227 BOOL
dcesrv_auth_alter_ack(struct dcesrv_call_state
*call
, struct ncacn_packet
*pkt
)
229 struct dcesrv_connection
*dce_conn
= call
->conn
;
232 /* on a pure interface change there is no auth_info structure
234 if (!call
->conn
->auth_state
.auth_info
||
235 dce_conn
->auth_state
.auth_info
->credentials
.length
== 0) {
239 if (!call
->conn
->auth_state
.gensec_security
) {
243 status
= gensec_update(dce_conn
->auth_state
.gensec_security
,
245 dce_conn
->auth_state
.auth_info
->credentials
,
246 &dce_conn
->auth_state
.auth_info
->credentials
);
248 if (NT_STATUS_IS_OK(status
)) {
249 status
= gensec_session_info(dce_conn
->auth_state
.gensec_security
,
250 &dce_conn
->auth_state
.session_info
);
251 if (!NT_STATUS_IS_OK(status
)) {
252 DEBUG(1, ("Failed to establish session_info: %s\n", nt_errstr(status
)));
256 /* Now that we are authenticated, got back to the generic session key... */
257 dce_conn
->auth_state
.session_key
= dcesrv_generic_session_key
;
259 } else if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
260 dce_conn
->auth_state
.auth_info
->auth_pad_length
= 0;
261 dce_conn
->auth_state
.auth_info
->auth_reserved
= 0;
265 DEBUG(2, ("Failed to finish dcesrv auth alter_ack: %s\n", nt_errstr(status
)));
270 generate a CONNECT level verifier
272 static NTSTATUS
dcesrv_connect_verifier(TALLOC_CTX
*mem_ctx
, DATA_BLOB
*blob
)
274 *blob
= data_blob_talloc(mem_ctx
, NULL
, 16);
275 if (blob
->data
== NULL
) {
276 return NT_STATUS_NO_MEMORY
;
278 SIVAL(blob
->data
, 0, 1);
279 memset(blob
->data
+4, 0, 12);
284 generate a CONNECT level verifier
286 static NTSTATUS
dcesrv_check_connect_verifier(DATA_BLOB
*blob
)
288 if (blob
->length
!= 16 ||
289 IVAL(blob
->data
, 0) != 1) {
290 return NT_STATUS_ACCESS_DENIED
;
297 check credentials on a request
299 BOOL
dcesrv_auth_request(struct dcesrv_call_state
*call
, DATA_BLOB
*full_packet
)
301 struct ncacn_packet
*pkt
= &call
->pkt
;
302 struct dcesrv_connection
*dce_conn
= call
->conn
;
304 struct dcerpc_auth auth
;
305 struct ndr_pull
*ndr
;
308 if (!dce_conn
->auth_state
.auth_info
||
309 !dce_conn
->auth_state
.gensec_security
) {
313 auth_blob
.length
= 8 + pkt
->auth_length
;
315 /* check for a valid length */
316 if (pkt
->u
.request
.stub_and_verifier
.length
< auth_blob
.length
) {
321 pkt
->u
.request
.stub_and_verifier
.data
+
322 pkt
->u
.request
.stub_and_verifier
.length
- auth_blob
.length
;
323 pkt
->u
.request
.stub_and_verifier
.length
-= auth_blob
.length
;
325 /* pull the auth structure */
326 ndr
= ndr_pull_init_blob(&auth_blob
, call
);
331 if (!(pkt
->drep
[0] & DCERPC_DREP_LE
)) {
332 ndr
->flags
|= LIBNDR_FLAG_BIGENDIAN
;
335 status
= ndr_pull_dcerpc_auth(ndr
, NDR_SCALARS
|NDR_BUFFERS
, &auth
);
336 if (!NT_STATUS_IS_OK(status
)) {
341 /* check signature or unseal the packet */
342 switch (dce_conn
->auth_state
.auth_info
->auth_level
) {
343 case DCERPC_AUTH_LEVEL_PRIVACY
:
344 status
= gensec_unseal_packet(dce_conn
->auth_state
.gensec_security
,
346 full_packet
->data
+ DCERPC_REQUEST_LENGTH
,
347 pkt
->u
.request
.stub_and_verifier
.length
,
349 full_packet
->length
-auth
.credentials
.length
,
351 memcpy(pkt
->u
.request
.stub_and_verifier
.data
,
352 full_packet
->data
+ DCERPC_REQUEST_LENGTH
,
353 pkt
->u
.request
.stub_and_verifier
.length
);
356 case DCERPC_AUTH_LEVEL_INTEGRITY
:
357 status
= gensec_check_packet(dce_conn
->auth_state
.gensec_security
,
359 pkt
->u
.request
.stub_and_verifier
.data
,
360 pkt
->u
.request
.stub_and_verifier
.length
,
362 full_packet
->length
-auth
.credentials
.length
,
366 case DCERPC_AUTH_LEVEL_CONNECT
:
367 status
= dcesrv_check_connect_verifier(&auth
.credentials
);
371 status
= NT_STATUS_INVALID_LEVEL
;
375 /* remove the indicated amount of padding */
376 if (pkt
->u
.request
.stub_and_verifier
.length
< auth
.auth_pad_length
) {
380 pkt
->u
.request
.stub_and_verifier
.length
-= auth
.auth_pad_length
;
383 return NT_STATUS_IS_OK(status
);
388 push a signed or sealed dcerpc request packet into a blob
390 BOOL
dcesrv_auth_response(struct dcesrv_call_state
*call
,
391 DATA_BLOB
*blob
, struct ncacn_packet
*pkt
)
393 struct dcesrv_connection
*dce_conn
= call
->conn
;
395 struct ndr_push
*ndr
;
396 uint32_t payload_length
;
399 /* non-signed packets are simple */
400 if (!dce_conn
->auth_state
.auth_info
|| !dce_conn
->auth_state
.gensec_security
) {
401 status
= ncacn_push_auth(blob
, call
, pkt
, NULL
);
402 return NT_STATUS_IS_OK(status
);
405 ndr
= ndr_push_init_ctx(call
);
410 if (!(pkt
->drep
[0] & DCERPC_DREP_LE
)) {
411 ndr
->flags
|= LIBNDR_FLAG_BIGENDIAN
;
414 status
= ndr_push_ncacn_packet(ndr
, NDR_SCALARS
|NDR_BUFFERS
, pkt
);
415 if (!NT_STATUS_IS_OK(status
)) {
419 /* pad to 16 byte multiple, match win2k3 */
420 dce_conn
->auth_state
.auth_info
->auth_pad_length
= NDR_ALIGN(ndr
, 16);
421 ndr_push_zero(ndr
, dce_conn
->auth_state
.auth_info
->auth_pad_length
);
423 payload_length
= ndr
->offset
- DCERPC_REQUEST_LENGTH
;
425 if (dce_conn
->auth_state
.auth_info
->auth_level
== DCERPC_AUTH_LEVEL_CONNECT
) {
426 status
= dcesrv_connect_verifier(call
,
427 &dce_conn
->auth_state
.auth_info
->credentials
);
428 if (!NT_STATUS_IS_OK(status
)) {
433 /* We hope this length is accruate. If must be if the
434 * GENSEC mech does AEAD signing of the packet
436 dce_conn
->auth_state
.auth_info
->credentials
437 = data_blob_talloc(call
, NULL
,
438 gensec_sig_size(dce_conn
->auth_state
.gensec_security
,
440 data_blob_clear(&dce_conn
->auth_state
.auth_info
->credentials
);
443 /* add the auth verifier */
444 status
= ndr_push_dcerpc_auth(ndr
, NDR_SCALARS
|NDR_BUFFERS
,
445 dce_conn
->auth_state
.auth_info
);
446 if (!NT_STATUS_IS_OK(status
)) {
450 /* extract the whole packet as a blob */
451 *blob
= ndr_push_blob(ndr
);
453 /* fill in the fragment length and auth_length, we can't fill
454 in these earlier as we don't know the signature length (it
455 could be variable length) */
456 dcerpc_set_frag_length(blob
, blob
->length
);
458 /* We hope this value is accruate. If must be if the GENSEC
459 * mech does AEAD signing of the packet headers */
460 dcerpc_set_auth_length(blob
, dce_conn
->auth_state
.auth_info
->credentials
.length
);
462 /* sign or seal the packet */
463 switch (dce_conn
->auth_state
.auth_info
->auth_level
) {
464 case DCERPC_AUTH_LEVEL_PRIVACY
:
465 status
= gensec_seal_packet(dce_conn
->auth_state
.gensec_security
,
467 ndr
->data
+ DCERPC_REQUEST_LENGTH
,
470 blob
->length
- dce_conn
->auth_state
.auth_info
->credentials
.length
,
473 if (NT_STATUS_IS_OK(status
)) {
474 blob
->length
-= dce_conn
->auth_state
.auth_info
->credentials
.length
;
475 status
= data_blob_append(call
, blob
, creds2
.data
, creds2
.length
);
478 /* If we did AEAD signing of the packet headers, then we hope
479 * this value didn't change... */
480 dcerpc_set_auth_length(blob
, creds2
.length
);
481 dcerpc_set_frag_length(blob
, dcerpc_get_frag_length(blob
)+creds2
.length
);
482 data_blob_free(&creds2
);
485 case DCERPC_AUTH_LEVEL_INTEGRITY
:
486 status
= gensec_sign_packet(dce_conn
->auth_state
.gensec_security
,
488 ndr
->data
+ DCERPC_REQUEST_LENGTH
,
491 blob
->length
- dce_conn
->auth_state
.auth_info
->credentials
.length
,
493 if (NT_STATUS_IS_OK(status
)) {
494 blob
->length
-= dce_conn
->auth_state
.auth_info
->credentials
.length
;
495 status
= data_blob_append(call
, blob
, creds2
.data
, creds2
.length
);
498 /* If we did AEAD signing of the packet headers, then we hope
499 * this value didn't change... */
500 dcerpc_set_auth_length(blob
, creds2
.length
);
501 dcerpc_set_frag_length(blob
, dcerpc_get_frag_length(blob
)+creds2
.length
);
502 data_blob_free(&creds2
);
505 case DCERPC_AUTH_LEVEL_CONNECT
:
509 status
= NT_STATUS_INVALID_LEVEL
;
513 data_blob_free(&dce_conn
->auth_state
.auth_info
->credentials
);
515 if (!NT_STATUS_IS_OK(status
)) {