2 Unix SMB/CIFS implementation.
4 server side dcerpc authentication code
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Stefan (metze) Metzmacher 2004
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "rpc_server/dcerpc_server.h"
25 #include "rpc_server/dcerpc_server_proto.h"
26 #include "rpc_server/common/proto.h"
27 #include "librpc/rpc/dcerpc_proto.h"
28 #include "librpc/gen_ndr/ndr_dcerpc.h"
29 #include "auth/credentials/credentials.h"
30 #include "auth/gensec/gensec.h"
31 #include "auth/auth.h"
32 #include "param/param.h"
33 #include "librpc/rpc/rpc_common.h"
36 parse any auth information from a dcerpc bind request
37 return false if we can't handle the auth request for some
38 reason (in which case we send a bind_nak)
40 bool dcesrv_auth_bind(struct dcesrv_call_state
*call
)
42 struct cli_credentials
*server_credentials
= NULL
;
43 struct ncacn_packet
*pkt
= &call
->pkt
;
44 struct dcesrv_connection
*dce_conn
= call
->conn
;
45 struct dcesrv_auth
*auth
= &dce_conn
->auth_state
;
46 bool want_header_signing
= false;
49 if (pkt
->auth_length
== 0) {
50 enum dcerpc_transport_t transport
=
51 dcerpc_binding_get_transport(call
->conn
->endpoint
->ep_description
);
52 const char *auth_type
= derpc_transport_string_by_transport(transport
);
53 const char *transport_protection
= AUTHZ_TRANSPORT_PROTECTION_NONE
;
54 if (transport
== NCACN_NP
) {
55 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SMB
;
57 auth
->auth_type
= DCERPC_AUTH_TYPE_NONE
;
58 auth
->auth_level
= DCERPC_AUTH_LEVEL_NONE
;
59 auth
->auth_context_id
= 0;
62 * Log the authorization to this RPC interface. This
63 * covered ncacn_np pass-through auth, and anonymous
64 * DCE/RPC (eg epmapper, netlogon etc)
66 log_successful_authz_event(call
->conn
->msg_ctx
,
67 call
->conn
->dce_ctx
->lp_ctx
,
68 call
->conn
->remote_address
,
69 call
->conn
->local_address
,
73 call
->conn
->auth_state
.session_info
);
78 status
= dcerpc_pull_auth_trailer(pkt
, call
, &pkt
->u
.bind
.auth_info
,
81 if (!NT_STATUS_IS_OK(status
)) {
83 * Setting DCERPC_AUTH_LEVEL_NONE,
84 * gives the caller the reject_reason
87 * Note: DCERPC_AUTH_LEVEL_NONE == 1
89 auth
->auth_type
= DCERPC_AUTH_TYPE_NONE
;
90 auth
->auth_level
= DCERPC_AUTH_LEVEL_NONE
;
91 auth
->auth_context_id
=
92 DCERPC_BIND_NAK_REASON_PROTOCOL_VERSION_NOT_SUPPORTED
;
96 switch (call
->in_auth_info
.auth_level
) {
97 case DCERPC_AUTH_LEVEL_CONNECT
:
98 case DCERPC_AUTH_LEVEL_CALL
:
99 case DCERPC_AUTH_LEVEL_PACKET
:
100 case DCERPC_AUTH_LEVEL_INTEGRITY
:
101 case DCERPC_AUTH_LEVEL_PRIVACY
:
103 * We evaluate auth_type only if auth_level was valid
108 * Setting DCERPC_AUTH_LEVEL_NONE,
109 * gives the caller the reject_reason
110 * as auth_context_id.
112 * Note: DCERPC_AUTH_LEVEL_NONE == 1
114 auth
->auth_type
= DCERPC_AUTH_TYPE_NONE
;
115 auth
->auth_level
= DCERPC_AUTH_LEVEL_NONE
;
116 auth
->auth_context_id
= DCERPC_BIND_NAK_REASON_NOT_SPECIFIED
;
120 auth
->auth_type
= call
->in_auth_info
.auth_type
;
121 auth
->auth_level
= call
->in_auth_info
.auth_level
;
122 auth
->auth_context_id
= call
->in_auth_info
.auth_context_id
;
125 = cli_credentials_init(call
);
126 if (!server_credentials
) {
127 DEBUG(1, ("Failed to init server credentials\n"));
131 cli_credentials_set_conf(server_credentials
, call
->conn
->dce_ctx
->lp_ctx
);
132 status
= cli_credentials_set_machine_account(server_credentials
, call
->conn
->dce_ctx
->lp_ctx
);
133 if (!NT_STATUS_IS_OK(status
)) {
134 DEBUG(1, ("Failed to obtain server credentials: %s\n",
139 status
= samba_server_gensec_start(dce_conn
, call
->event_ctx
,
141 call
->conn
->dce_ctx
->lp_ctx
,
144 &auth
->gensec_security
);
145 if (!NT_STATUS_IS_OK(status
)) {
146 DEBUG(1, ("Failed to call samba_server_gensec_start %s\n",
152 * We have to call this because we set the target_service for
153 * Kerberos to NULL above, and in any case we wish to log a
154 * more specific service target.
157 status
= gensec_set_target_service_description(auth
->gensec_security
,
159 if (!NT_STATUS_IS_OK(status
)) {
160 DEBUG(1, ("Failed to call gensec_set_target_service_description %s\n",
165 if (call
->conn
->remote_address
!= NULL
) {
166 status
= gensec_set_remote_address(auth
->gensec_security
,
167 call
->conn
->remote_address
);
168 if (!NT_STATUS_IS_OK(status
)) {
169 DEBUG(1, ("Failed to call gensec_set_remote_address() %s\n",
175 if (call
->conn
->local_address
!= NULL
) {
176 status
= gensec_set_local_address(auth
->gensec_security
,
177 call
->conn
->local_address
);
178 if (!NT_STATUS_IS_OK(status
)) {
179 DEBUG(1, ("Failed to call gensec_set_local_address() %s\n",
185 status
= gensec_start_mech_by_authtype(auth
->gensec_security
, auth
->auth_type
,
187 if (!NT_STATUS_IS_OK(status
)) {
188 const char *backend_name
=
189 gensec_get_name_by_authtype(auth
->gensec_security
,
192 DEBUG(3, ("Failed to start GENSEC mechanism for DCERPC server: "
193 "auth_type=%d (%s), auth_level=%d: %s\n",
194 (int)auth
->auth_type
, backend_name
,
195 (int)auth
->auth_level
,
199 * Setting DCERPC_AUTH_LEVEL_NONE,
200 * gives the caller the reject_reason
201 * as auth_context_id.
203 * Note: DCERPC_AUTH_LEVEL_NONE == 1
205 auth
->auth_type
= DCERPC_AUTH_TYPE_NONE
;
206 auth
->auth_level
= DCERPC_AUTH_LEVEL_NONE
;
207 if (backend_name
!= NULL
) {
208 auth
->auth_context_id
=
209 DCERPC_BIND_NAK_REASON_INVALID_CHECKSUM
;
211 auth
->auth_context_id
=
212 DCERPC_BIND_NAK_REASON_INVALID_AUTH_TYPE
;
217 if (call
->pkt
.pfc_flags
& DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN
) {
218 auth
->client_hdr_signing
= true;
219 want_header_signing
= true;
222 if (want_header_signing
) {
223 want_header_signing
= gensec_have_feature(auth
->gensec_security
,
224 GENSEC_FEATURE_SIGN_PKT_HEADER
);
227 if (want_header_signing
) {
228 want_header_signing
= lpcfg_parm_bool(dce_conn
->dce_ctx
->lp_ctx
,
235 if (want_header_signing
) {
236 gensec_want_feature(auth
->gensec_security
,
237 GENSEC_FEATURE_SIGN_PKT_HEADER
);
238 auth
->hdr_signing
= true;
244 NTSTATUS
dcesrv_auth_complete(struct dcesrv_call_state
*call
, NTSTATUS status
)
246 struct dcesrv_connection
*dce_conn
= call
->conn
;
247 const char *pdu
= "<unknown>";
249 switch (call
->pkt
.ptype
) {
250 case DCERPC_PKT_BIND
:
253 case DCERPC_PKT_ALTER
:
256 case DCERPC_PKT_AUTH3
:
258 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
259 DEBUG(4, ("GENSEC not finished at at %s\n", pdu
));
260 return NT_STATUS_RPC_SEC_PKG_ERROR
;
264 return NT_STATUS_INTERNAL_ERROR
;
267 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
271 if (!NT_STATUS_IS_OK(status
)) {
272 DEBUG(4, ("GENSEC mech rejected the incoming authentication "
273 "at %s: %s\n", pdu
, nt_errstr(status
)));
277 status
= gensec_session_info(dce_conn
->auth_state
.gensec_security
,
279 &dce_conn
->auth_state
.session_info
);
280 if (!NT_STATUS_IS_OK(status
)) {
281 DEBUG(1, ("Failed to establish session_info: %s\n",
285 dce_conn
->auth_state
.auth_finished
= true;
286 dce_conn
->allow_request
= true;
288 /* Now that we are authenticated, go back to the generic session key... */
289 dce_conn
->auth_state
.session_key
= dcesrv_generic_session_key
;
291 if (call
->pkt
.ptype
!= DCERPC_PKT_AUTH3
) {
295 if (call
->out_auth_info
->credentials
.length
!= 0) {
296 DEBUG(4, ("GENSEC produced output token (len=%zu) at %s\n",
297 call
->out_auth_info
->credentials
.length
, pdu
));
298 return NT_STATUS_RPC_SEC_PKG_ERROR
;
305 add any auth information needed in a bind ack, and process the authentication
306 information found in the bind.
308 NTSTATUS
dcesrv_auth_prepare_bind_ack(struct dcesrv_call_state
*call
, struct ncacn_packet
*pkt
)
310 struct dcesrv_connection
*dce_conn
= call
->conn
;
312 dce_conn
->allow_alter
= true;
313 dce_conn
->allow_auth3
= true;
315 if (call
->pkt
.auth_length
== 0) {
316 dce_conn
->auth_state
.auth_finished
= true;
317 dce_conn
->allow_request
= true;
321 /* We can't work without an existing gensec state */
322 if (!call
->conn
->auth_state
.gensec_security
) {
323 return NT_STATUS_INTERNAL_ERROR
;
326 if (dce_conn
->auth_state
.hdr_signing
) {
327 pkt
->pfc_flags
|= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN
;
330 call
->_out_auth_info
= (struct dcerpc_auth
) {
331 .auth_type
= dce_conn
->auth_state
.auth_type
,
332 .auth_level
= dce_conn
->auth_state
.auth_level
,
333 .auth_context_id
= dce_conn
->auth_state
.auth_context_id
,
335 call
->out_auth_info
= &call
->_out_auth_info
;
341 process the final stage of a auth request
343 bool dcesrv_auth_prepare_auth3(struct dcesrv_call_state
*call
)
345 struct ncacn_packet
*pkt
= &call
->pkt
;
346 struct dcesrv_connection
*dce_conn
= call
->conn
;
349 if (pkt
->auth_length
== 0) {
353 if (dce_conn
->auth_state
.auth_finished
) {
357 /* We can't work without an existing gensec state */
358 if (!dce_conn
->auth_state
.gensec_security
) {
362 status
= dcerpc_pull_auth_trailer(pkt
, call
, &pkt
->u
.auth3
.auth_info
,
363 &call
->in_auth_info
, NULL
, true);
364 if (!NT_STATUS_IS_OK(status
)) {
366 * Windows returns DCERPC_NCA_S_FAULT_REMOTE_NO_MEMORY
367 * instead of DCERPC_NCA_S_PROTO_ERROR.
369 call
->fault_code
= DCERPC_NCA_S_FAULT_REMOTE_NO_MEMORY
;
373 if (call
->in_auth_info
.auth_type
!= dce_conn
->auth_state
.auth_type
) {
377 if (call
->in_auth_info
.auth_level
!= dce_conn
->auth_state
.auth_level
) {
381 if (call
->in_auth_info
.auth_context_id
!= dce_conn
->auth_state
.auth_context_id
) {
385 call
->_out_auth_info
= (struct dcerpc_auth
) {
386 .auth_type
= dce_conn
->auth_state
.auth_type
,
387 .auth_level
= dce_conn
->auth_state
.auth_level
,
388 .auth_context_id
= dce_conn
->auth_state
.auth_context_id
,
390 call
->out_auth_info
= &call
->_out_auth_info
;
396 parse any auth information from a dcerpc alter request
397 return false if we can't handle the auth request for some
398 reason (in which case we send a bind_nak (is this true for here?))
400 bool dcesrv_auth_alter(struct dcesrv_call_state
*call
)
402 struct ncacn_packet
*pkt
= &call
->pkt
;
403 struct dcesrv_connection
*dce_conn
= call
->conn
;
406 /* on a pure interface change there is no auth blob */
407 if (pkt
->auth_length
== 0) {
408 if (!dce_conn
->auth_state
.auth_finished
) {
414 if (dce_conn
->auth_state
.auth_finished
) {
415 call
->fault_code
= DCERPC_FAULT_ACCESS_DENIED
;
419 /* We can't work without an existing gensec state */
420 if (!dce_conn
->auth_state
.gensec_security
) {
424 status
= dcerpc_pull_auth_trailer(pkt
, call
, &pkt
->u
.alter
.auth_info
,
425 &call
->in_auth_info
, NULL
, true);
426 if (!NT_STATUS_IS_OK(status
)) {
427 call
->fault_code
= DCERPC_NCA_S_PROTO_ERROR
;
431 if (call
->in_auth_info
.auth_type
== DCERPC_AUTH_TYPE_NONE
) {
432 call
->fault_code
= DCERPC_FAULT_ACCESS_DENIED
;
436 if (call
->in_auth_info
.auth_type
!= dce_conn
->auth_state
.auth_type
) {
440 if (call
->in_auth_info
.auth_level
!= dce_conn
->auth_state
.auth_level
) {
444 if (call
->in_auth_info
.auth_context_id
!= dce_conn
->auth_state
.auth_context_id
) {
452 add any auth information needed in a alter ack, and process the authentication
453 information found in the alter.
455 NTSTATUS
dcesrv_auth_prepare_alter_ack(struct dcesrv_call_state
*call
, struct ncacn_packet
*pkt
)
457 struct dcesrv_connection
*dce_conn
= call
->conn
;
459 /* on a pure interface change there is no auth_info structure
461 if (call
->pkt
.auth_length
== 0) {
465 if (!call
->conn
->auth_state
.gensec_security
) {
466 return NT_STATUS_INTERNAL_ERROR
;
469 call
->_out_auth_info
= (struct dcerpc_auth
) {
470 .auth_type
= dce_conn
->auth_state
.auth_type
,
471 .auth_level
= dce_conn
->auth_state
.auth_level
,
472 .auth_context_id
= dce_conn
->auth_state
.auth_context_id
,
474 call
->out_auth_info
= &call
->_out_auth_info
;
480 check credentials on a packet
482 bool dcesrv_auth_pkt_pull(struct dcesrv_call_state
*call
,
483 DATA_BLOB
*full_packet
,
484 uint8_t required_flags
,
485 uint8_t optional_flags
,
486 uint8_t payload_offset
,
487 DATA_BLOB
*payload_and_verifier
)
489 struct ncacn_packet
*pkt
= &call
->pkt
;
490 struct dcesrv_connection
*dce_conn
= call
->conn
;
491 const struct dcerpc_auth tmp_auth
= {
492 .auth_type
= dce_conn
->auth_state
.auth_type
,
493 .auth_level
= dce_conn
->auth_state
.auth_level
,
494 .auth_context_id
= dce_conn
->auth_state
.auth_context_id
,
498 if (!dce_conn
->allow_request
) {
499 call
->fault_code
= DCERPC_NCA_S_PROTO_ERROR
;
503 if (dce_conn
->auth_state
.auth_invalid
) {
507 status
= dcerpc_ncacn_pull_pkt_auth(&tmp_auth
,
508 dce_conn
->auth_state
.gensec_security
,
514 payload_and_verifier
,
517 if (NT_STATUS_EQUAL(status
, NT_STATUS_RPC_PROTOCOL_ERROR
)) {
518 call
->fault_code
= DCERPC_NCA_S_PROTO_ERROR
;
521 if (NT_STATUS_EQUAL(status
, NT_STATUS_RPC_UNSUPPORTED_AUTHN_LEVEL
)) {
522 call
->fault_code
= DCERPC_NCA_S_UNSUPPORTED_AUTHN_LEVEL
;
525 if (NT_STATUS_EQUAL(status
, NT_STATUS_RPC_SEC_PKG_ERROR
)) {
526 call
->fault_code
= DCERPC_FAULT_SEC_PKG_ERROR
;
529 if (NT_STATUS_EQUAL(status
, NT_STATUS_ACCESS_DENIED
)) {
530 call
->fault_code
= DCERPC_FAULT_ACCESS_DENIED
;
533 if (!NT_STATUS_IS_OK(status
)) {
541 push a signed or sealed dcerpc request packet into a blob
543 bool dcesrv_auth_pkt_push(struct dcesrv_call_state
*call
,
544 DATA_BLOB
*blob
, size_t sig_size
,
545 uint8_t payload_offset
,
546 const DATA_BLOB
*payload
,
547 const struct ncacn_packet
*pkt
)
549 struct dcesrv_connection
*dce_conn
= call
->conn
;
550 const struct dcerpc_auth tmp_auth
= {
551 .auth_type
= dce_conn
->auth_state
.auth_type
,
552 .auth_level
= dce_conn
->auth_state
.auth_level
,
553 .auth_context_id
= dce_conn
->auth_state
.auth_context_id
,
557 status
= dcerpc_ncacn_push_pkt_auth(&tmp_auth
,
558 dce_conn
->auth_state
.gensec_security
,
559 call
, blob
, sig_size
,
563 return NT_STATUS_IS_OK(status
);