?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
vfs_ceph: fix strict_allocate_ftruncate()
[Samba.git] / source3 / librpc / crypto / gse.c
blob9a9f4261222f8d954e490d35b7b5a284513efe10
1 /*
2 * GSSAPI Security Extensions
3 * RPC Pipe client and server routines
4 * Copyright (C) Simo Sorce 2010.
5 * Copyright (C) Andrew Bartlett 2004-2011.
6 * Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 /* We support only GSSAPI/KRB5 here */
23
24 #include "includes.h"
25 #include <tevent.h>
26 #include "lib/util/tevent_ntstatus.h"
27 #include "gse.h"
28 #include "libads/kerberos_proto.h"
29 #include "auth/common_auth.h"
30 #include "auth/gensec/gensec.h"
31 #include "auth/gensec/gensec_internal.h"
32 #include "auth/credentials/credentials.h"
33 #include "../librpc/gen_ndr/dcerpc.h"
34
35 #if defined(HAVE_KRB5)
36
37 #include "auth/kerberos/pac_utils.h"
38 #include "auth/kerberos/gssapi_helper.h"
39 #include "gse_krb5.h"
40
41 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
42 static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
43 size_t data_size);
44
45 struct gse_context {
46 gss_ctx_id_t gssapi_context;
47 gss_name_t server_name;
48 gss_name_t client_name;
49 OM_uint32 gss_want_flags, gss_got_flags;
50 size_t max_wrap_buf_size;
51 size_t sig_size;
52
53 gss_cred_id_t delegated_cred_handle;
54
55 NTTIME expire_time;
56
57 /* gensec_gse only */
58 krb5_context k5ctx;
59 krb5_ccache ccache;
60 krb5_keytab keytab;
61
62 gss_OID_desc gss_mech;
63 gss_cred_id_t creds;
64
65 gss_OID ret_mech;
66 };
67
68 /* free non talloc dependent contexts */
69 static int gse_context_destructor(void *ptr)
70 {
71 struct gse_context *gse_ctx;
72 OM_uint32 gss_min;
73
74 gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
75 if (gse_ctx->k5ctx) {
76 if (gse_ctx->ccache) {
77 krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
78 gse_ctx->ccache = NULL;
79 }
80 if (gse_ctx->keytab) {
81 krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
82 gse_ctx->keytab = NULL;
83 }
84 krb5_free_context(gse_ctx->k5ctx);
85 gse_ctx->k5ctx = NULL;
86 }
87 if (gse_ctx->gssapi_context != GSS_C_NO_CONTEXT) {
88 (void)gss_delete_sec_context(&gss_min,
89 &gse_ctx->gssapi_context,
90 GSS_C_NO_BUFFER);
91 }
92 if (gse_ctx->server_name) {
93 (void)gss_release_name(&gss_min,
94 &gse_ctx->server_name);
95 }
96 if (gse_ctx->client_name) {
97 (void)gss_release_name(&gss_min,
98 &gse_ctx->client_name);
99 }
100 if (gse_ctx->creds) {
101 (void)gss_release_cred(&gss_min,
102 &gse_ctx->creds);
103 }
104 if (gse_ctx->delegated_cred_handle) {
105 (void)gss_release_cred(&gss_min,
106 &gse_ctx->delegated_cred_handle);
107 }
108
109 /* MIT and Heimdal differ as to if you can call
110 * gss_release_oid() on this OID, generated by
111 * gss_{accept,init}_sec_context(). However, as long as the
112 * oid is gss_mech_krb5 (which it always is at the moment),
113 * then this is a moot point, as both declare this particular
114 * OID static, and so no memory is lost. This assert is in
115 * place to ensure that the programmer who wishes to extend
116 * this code to EAP or other GSS mechanisms determines an
117 * implementation-dependent way of releasing any dynamically
118 * allocated OID */
119 SMB_ASSERT(smb_gss_oid_equal(&gse_ctx->gss_mech, GSS_C_NO_OID) ||
120 smb_gss_oid_equal(&gse_ctx->gss_mech, gss_mech_krb5));
121
122 return 0;
123 }
124
125 static NTSTATUS gse_setup_server_principal(TALLOC_CTX *mem_ctx,
126 const char *target_principal,
127 const char *service,
128 const char *hostname,
129 const char *realm,
130 char **pserver_principal,
131 gss_name_t *pserver_name)
132 {
133 char *server_principal = NULL;
134 gss_buffer_desc name_token;
135 gss_OID name_type;
136 OM_uint32 maj_stat, min_stat = 0;
137
138 if (target_principal != NULL) {
139 server_principal = talloc_strdup(mem_ctx, target_principal);
140 name_type = GSS_C_NULL_OID;
141 } else {
142 server_principal = talloc_asprintf(mem_ctx,
143 "%s/%s@%s",
144 service,
145 hostname,
146 realm);
147 name_type = GSS_C_NT_USER_NAME;
148 }
149 if (server_principal == NULL) {
150 return NT_STATUS_NO_MEMORY;
151 }
152
153 name_token.value = (uint8_t *)server_principal;
154 name_token.length = strlen(server_principal);
155
156 maj_stat = gss_import_name(&min_stat,
157 &name_token,
158 name_type,
159 pserver_name);
160 if (maj_stat) {
161 DBG_WARNING("GSS Import name of %s failed: %s\n",
162 server_principal,
163 gse_errstr(mem_ctx, maj_stat, min_stat));
164 TALLOC_FREE(server_principal);
165 return NT_STATUS_INVALID_PARAMETER;
166 }
167
168 *pserver_principal = server_principal;
169
170 return NT_STATUS_OK;
171 }
172
173 static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
174 bool do_sign, bool do_seal,
175 const char *ccache_name,
176 uint32_t add_gss_c_flags,
177 struct gse_context **_gse_ctx)
178 {
179 struct gse_context *gse_ctx;
180 krb5_error_code k5ret;
181 NTSTATUS status;
182
183 gse_ctx = talloc_zero(mem_ctx, struct gse_context);
184 if (!gse_ctx) {
185 return NT_STATUS_NO_MEMORY;
186 }
187 talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
188
189 gse_ctx->expire_time = GENSEC_EXPIRE_TIME_INFINITY;
190 gse_ctx->max_wrap_buf_size = UINT16_MAX;
191
192 memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
193
194 gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
195 GSS_C_DELEG_POLICY_FLAG |
196 GSS_C_REPLAY_FLAG |
197 GSS_C_SEQUENCE_FLAG;
198 if (do_sign) {
199 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
200 }
201 if (do_seal) {
202 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
203 gse_ctx->gss_want_flags |= GSS_C_CONF_FLAG;
204 }
205
206 gse_ctx->gss_want_flags |= add_gss_c_flags;
207
208 /* Initialize Kerberos Context */
209 k5ret = smb_krb5_init_context_common(&gse_ctx->k5ctx);
210 if (k5ret) {
211 DBG_ERR("kerberos init context failed (%s)\n",
212 error_message(k5ret));
213 status = NT_STATUS_INTERNAL_ERROR;
214 goto err_out;
215 }
216
217 if (!ccache_name) {
218 ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
219 }
220 k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
221 &gse_ctx->ccache);
222 if (k5ret) {
223 DEBUG(1, ("Failed to resolve credential cache '%s'! (%s)\n",
224 ccache_name, error_message(k5ret)));
225 status = NT_STATUS_INTERNAL_ERROR;
226 goto err_out;
227 }
228
229 /* TODO: Should we enforce a enc_types list ?
230 ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
231 */
232
233 *_gse_ctx = gse_ctx;
234 return NT_STATUS_OK;
235
236 err_out:
237 if (gse_ctx->k5ctx) {
238 krb5_free_context(gse_ctx->k5ctx);
239 }
240
241 TALLOC_FREE(gse_ctx);
242 return status;
243 }
244
245 static NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
246 bool do_sign, bool do_seal,
247 const char *ccache_name,
248 const char *server,
249 const char *service,
250 const char *realm,
251 const char *username,
252 const char *password,
253 uint32_t add_gss_c_flags,
254 struct gse_context **_gse_ctx)
255 {
256 struct gse_context *gse_ctx;
257 OM_uint32 gss_maj, gss_min;
258 #ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
259 gss_buffer_desc empty_buffer = GSS_C_EMPTY_BUFFER;
260 gss_OID oid = discard_const(GSS_KRB5_CRED_NO_CI_FLAGS_X);
261 #endif
262 NTSTATUS status;
263
264 if (!server || !service) {
265 return NT_STATUS_INVALID_PARAMETER;
266 }
267
268 status = gse_context_init(mem_ctx, do_sign, do_seal,
269 ccache_name, add_gss_c_flags,
270 &gse_ctx);
271 if (!NT_STATUS_IS_OK(status)) {
272 return NT_STATUS_NO_MEMORY;
273 }
274
275 /* TODO: get krb5 ticket using username/password, if no valid
276 * one already available in ccache */
277
278 gss_maj = smb_gss_krb5_import_cred(&gss_min,
279 gse_ctx->k5ctx,
280 gse_ctx->ccache,
281 NULL, /* keytab_principal */
282 NULL, /* keytab */
283 &gse_ctx->creds);
284 if (gss_maj) {
285 char *ccache = NULL;
286 int kret;
287
288 kret = krb5_cc_get_full_name(gse_ctx->k5ctx,
289 gse_ctx->ccache,
290 &ccache);
291 if (kret != 0) {
292 ccache = NULL;
293 }
294
295 DEBUG(5, ("smb_gss_krb5_import_cred ccache[%s] failed with [%s] -"
296 "the caller may retry after a kinit.\n",
297 ccache, gse_errstr(gse_ctx, gss_maj, gss_min)));
298 SAFE_FREE(ccache);
299 status = NT_STATUS_INTERNAL_ERROR;
300 goto err_out;
301 }
302
303 #ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
304 /*
305 * Don't force GSS_C_CONF_FLAG and GSS_C_INTEG_FLAG.
306 *
307 * This allows us to disable SIGN and SEAL for
308 * AUTH_LEVEL_CONNECT and AUTH_LEVEL_INTEGRITY.
309 *
310 * https://groups.yahoo.com/neo/groups/cat-ietf/conversations/topics/575
311 * http://krbdev.mit.edu/rt/Ticket/Display.html?id=6938
312 */
313 gss_maj = gss_set_cred_option(&gss_min, &gse_ctx->creds,
314 oid,
315 &empty_buffer);
316 if (gss_maj) {
317 DEBUG(0, ("gss_set_cred_option(GSS_KRB5_CRED_NO_CI_FLAGS_X), "
318 "failed with [%s]\n",
319 gse_errstr(gse_ctx, gss_maj, gss_min)));
320 status = NT_STATUS_INTERNAL_ERROR;
321 goto err_out;
322 }
323 #endif
324
325 *_gse_ctx = gse_ctx;
326 return NT_STATUS_OK;
327
328 err_out:
329 TALLOC_FREE(gse_ctx);
330 return status;
331 }
332
333 static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
334 struct gensec_security *gensec_security,
335 const DATA_BLOB *token_in,
336 DATA_BLOB *token_out)
337 {
338 struct gse_context *gse_ctx =
339 talloc_get_type_abort(gensec_security->private_data,
340 struct gse_context);
341 OM_uint32 gss_maj = 0;
342 OM_uint32 gss_min;
343 gss_buffer_desc in_data;
344 gss_buffer_desc out_data;
345 DATA_BLOB blob = data_blob_null;
346 NTSTATUS status;
347 OM_uint32 time_rec = 0;
348 struct timeval tv;
349 struct cli_credentials *cli_creds = gensec_get_credentials(gensec_security);
350 const char *target_principal = gensec_get_target_principal(gensec_security);
351 const char *hostname = gensec_get_target_hostname(gensec_security);
352 const char *service = gensec_get_target_service(gensec_security);
353 const char *client_realm = cli_credentials_get_realm(cli_creds);
354 char *server_principal = NULL;
355 char *server_realm = NULL;
356 bool fallback = false;
357 OM_uint32 time_req = 0;
358
359 time_req = gensec_setting_int(gensec_security->settings,
360 "gensec_gssapi",
361 "requested_life_time",
362 time_req);
363
364 in_data.value = token_in->data;
365 in_data.length = token_in->length;
366
367 /*
368 * With credentials for administrator@FOREST1.EXAMPLE.COM this patch
369 * changes the target_principal for the ldap service of host
370 * dc2.forest2.example.com from
371 *
372 * ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM
373 *
374 * to
375 *
376 * ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM
377 *
378 * Typically ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM should be
379 * used in order to allow the KDC of FOREST1.EXAMPLE.COM to generate a
380 * referral ticket for krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM.
381 *
382 * The problem is that KDCs only return such referral tickets if
383 * there's a forest trust between FOREST1.EXAMPLE.COM and
384 * FOREST2.EXAMPLE.COM. If there's only an external domain trust
385 * between FOREST1.EXAMPLE.COM and FOREST2.EXAMPLE.COM the KDC of
386 * FOREST1.EXAMPLE.COM will respond with S_PRINCIPAL_UNKNOWN when being
387 * asked for ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM.
388 *
389 * In the case of an external trust the client can still ask explicitly
390 * for krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM and the KDC of
391 * FOREST1.EXAMPLE.COM will generate it.
392 *
393 * From there the client can use the
394 * krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM ticket and ask a KDC
395 * of FOREST2.EXAMPLE.COM for a service ticket for
396 * ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM.
397 *
398 * With Heimdal we'll get the fallback on S_PRINCIPAL_UNKNOWN behavior
399 * when we pass ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM as
400 * target principal. As _krb5_get_cred_kdc_any() first calls
401 * get_cred_kdc_referral() (which always starts with the client realm)
402 * and falls back to get_cred_kdc_capath() (which starts with the given
403 * realm).
404 *
405 * MIT krb5 only tries the given realm of the target principal, if we
406 * want to autodetect support for transitive forest trusts, would have
407 * to do the fallback ourself.
408 */
409 #ifndef SAMBA4_USES_HEIMDAL
410 if (gse_ctx->server_name == NULL) {
411 OM_uint32 gss_min2 = 0;
412
413 status = gse_setup_server_principal(mem_ctx,
414 target_principal,
415 service,
416 hostname,
417 client_realm,
418 &server_principal,
419 &gse_ctx->server_name);
420 if (!NT_STATUS_IS_OK(status)) {
421 return status;
422 }
423
424 gss_maj = gss_init_sec_context(&gss_min,
425 gse_ctx->creds,
426 &gse_ctx->gssapi_context,
427 gse_ctx->server_name,
428 &gse_ctx->gss_mech,
429 gse_ctx->gss_want_flags,
430 time_req,
431 GSS_C_NO_CHANNEL_BINDINGS,
432 &in_data,
433 NULL,
434 &out_data,
435 &gse_ctx->gss_got_flags,
436 &time_rec);
437 if (gss_maj != GSS_S_FAILURE) {
438 goto init_sec_context_done;
439 }
440 if (gss_min != (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
441 goto init_sec_context_done;
442 }
443 if (target_principal != NULL) {
444 goto init_sec_context_done;
445 }
446
447 fallback = true;
448 TALLOC_FREE(server_principal);
449 gss_release_name(&gss_min2, &gse_ctx->server_name);
450 }
451 #endif /* !SAMBA4_USES_HEIMDAL */
452
453 if (gse_ctx->server_name == NULL) {
454 server_realm = smb_krb5_get_realm_from_hostname(mem_ctx,
455 hostname,
456 client_realm);
457 if (server_realm == NULL) {
458 return NT_STATUS_NO_MEMORY;
459 }
460
461 if (fallback &&
462 strequal(client_realm, server_realm)) {
463 goto init_sec_context_done;
464 }
465
466 status = gse_setup_server_principal(mem_ctx,
467 target_principal,
468 service,
469 hostname,
470 server_realm,
471 &server_principal,
472 &gse_ctx->server_name);
473 TALLOC_FREE(server_realm);
474 if (!NT_STATUS_IS_OK(status)) {
475 return status;
476 }
477
478 TALLOC_FREE(server_principal);
479 }
480
481 gss_maj = gss_init_sec_context(&gss_min,
482 gse_ctx->creds,
483 &gse_ctx->gssapi_context,
484 gse_ctx->server_name,
485 &gse_ctx->gss_mech,
486 gse_ctx->gss_want_flags,
487 time_req, GSS_C_NO_CHANNEL_BINDINGS,
488 &in_data, NULL, &out_data,
489 &gse_ctx->gss_got_flags, &time_rec);
490 goto init_sec_context_done;
491 /* JUMP! */
492 init_sec_context_done:
493
494 switch (gss_maj) {
495 case GSS_S_COMPLETE:
496 /* we are done with it */
497 tv = timeval_current_ofs(time_rec, 0);
498 gse_ctx->expire_time = timeval_to_nttime(&tv);
499
500 status = NT_STATUS_OK;
501 break;
502 case GSS_S_CONTINUE_NEEDED:
503 /* we will need a third leg */
504 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
505 break;
506 case GSS_S_CONTEXT_EXPIRED:
507 /* Make SPNEGO ignore us, we can't go any further here */
508 DBG_NOTICE("Context expired\n");
509 status = NT_STATUS_INVALID_PARAMETER;
510 goto done;
511 case GSS_S_FAILURE:
512 switch (gss_min) {
513 case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
514 DBG_NOTICE("Server principal not found\n");
515 /* Make SPNEGO ignore us, we can't go any further here */
516 status = NT_STATUS_INVALID_PARAMETER;
517 goto done;
518 case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED:
519 DBG_NOTICE("Ticket expired\n");
520 /* Make SPNEGO ignore us, we can't go any further here */
521 status = NT_STATUS_INVALID_PARAMETER;
522 goto done;
523 case (OM_uint32)KRB5KRB_AP_ERR_TKT_NYV:
524 DBG_NOTICE("Clockskew\n");
525 /* Make SPNEGO ignore us, we can't go any further here */
526 status = NT_STATUS_TIME_DIFFERENCE_AT_DC;
527 goto done;
528 case (OM_uint32)KRB5_KDC_UNREACH:
529 DBG_NOTICE("KDC unreachable\n");
530 /* Make SPNEGO ignore us, we can't go any further here */
531 status = NT_STATUS_NO_LOGON_SERVERS;
532 goto done;
533 case (OM_uint32)KRB5KRB_AP_ERR_MSG_TYPE:
534 /* Garbage input, possibly from the auto-mech detection */
535 status = NT_STATUS_INVALID_PARAMETER;
536 goto done;
537 case (OM_uint32)KRB5KDC_ERR_ETYPE_NOSUPP:
538 status = NT_STATUS_KDC_UNKNOWN_ETYPE;
539 goto done;
540 default:
541 DBG_ERR("gss_init_sec_context failed with [%s](%u)\n",
542 gse_errstr(talloc_tos(), gss_maj, gss_min),
543 gss_min);
544 status = NT_STATUS_LOGON_FAILURE;
545 goto done;
546 }
547 break;
548 default:
549 DBG_ERR("gss_init_sec_context failed with [%s]\n",
550 gse_errstr(talloc_tos(), gss_maj, gss_min));
551 status = NT_STATUS_INTERNAL_ERROR;
552 goto done;
553 }
554
555 /* we may be told to return nothing */
556 if (out_data.length) {
557 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
558 if (!blob.data) {
559 status = NT_STATUS_NO_MEMORY;
560 }
561
562 gss_maj = gss_release_buffer(&gss_min, &out_data);
563 }
564
565 done:
566 *token_out = blob;
567 return status;
568 }
569
570 static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
571 bool do_sign, bool do_seal,
572 uint32_t add_gss_c_flags,
573 struct gse_context **_gse_ctx)
574 {
575 struct gse_context *gse_ctx;
576 OM_uint32 gss_maj, gss_min;
577 krb5_error_code ret;
578 NTSTATUS status;
579
580 status = gse_context_init(mem_ctx, do_sign, do_seal,
581 NULL, add_gss_c_flags, &gse_ctx);
582 if (!NT_STATUS_IS_OK(status)) {
583 return NT_STATUS_NO_MEMORY;
584 }
585
586 ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
587 &gse_ctx->keytab);
588 if (ret) {
589 status = NT_STATUS_INTERNAL_ERROR;
590 goto done;
591 }
592
593 /* This creates a GSSAPI cred_id_t with the keytab set */
594 gss_maj = smb_gss_krb5_import_cred(&gss_min, gse_ctx->k5ctx,
595 NULL, NULL, gse_ctx->keytab,
596 &gse_ctx->creds);
597
598 if (gss_maj != 0) {
599 DEBUG(0, ("smb_gss_krb5_import_cred failed with [%s]\n",
600 gse_errstr(gse_ctx, gss_maj, gss_min)));
601 status = NT_STATUS_INTERNAL_ERROR;
602 goto done;
603 }
604
605 status = NT_STATUS_OK;
606
607 done:
608 if (!NT_STATUS_IS_OK(status)) {
609 TALLOC_FREE(gse_ctx);
610 }
611
612 *_gse_ctx = gse_ctx;
613 return status;
614 }
615
616 static NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
617 struct gensec_security *gensec_security,
618 const DATA_BLOB *token_in,
619 DATA_BLOB *token_out)
620 {
621 struct gse_context *gse_ctx =
622 talloc_get_type_abort(gensec_security->private_data,
623 struct gse_context);
624 OM_uint32 gss_maj, gss_min;
625 gss_buffer_desc in_data;
626 gss_buffer_desc out_data;
627 DATA_BLOB blob = data_blob_null;
628 NTSTATUS status;
629 OM_uint32 time_rec = 0;
630 struct timeval tv;
631
632 in_data.value = token_in->data;
633 in_data.length = token_in->length;
634
635 gss_maj = gss_accept_sec_context(&gss_min,
636 &gse_ctx->gssapi_context,
637 gse_ctx->creds,
638 &in_data,
639 GSS_C_NO_CHANNEL_BINDINGS,
640 &gse_ctx->client_name,
641 &gse_ctx->ret_mech,
642 &out_data,
643 &gse_ctx->gss_got_flags,
644 &time_rec,
645 &gse_ctx->delegated_cred_handle);
646 switch (gss_maj) {
647 case GSS_S_COMPLETE:
648 /* we are done with it */
649 tv = timeval_current_ofs(time_rec, 0);
650 gse_ctx->expire_time = timeval_to_nttime(&tv);
651
652 status = NT_STATUS_OK;
653 break;
654 case GSS_S_CONTINUE_NEEDED:
655 /* we will need a third leg */
656 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
657 break;
658 default:
659 DEBUG(1, ("gss_accept_sec_context failed with [%s]\n",
660 gse_errstr(talloc_tos(), gss_maj, gss_min)));
661
662 if (gse_ctx->gssapi_context) {
663 gss_delete_sec_context(&gss_min,
664 &gse_ctx->gssapi_context,
665 GSS_C_NO_BUFFER);
666 }
667
668 /*
669 * If we got an output token, make Windows aware of it
670 * by telling it that more processing is needed
671 */
672 if (out_data.length > 0) {
673 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
674 /* Fall through to handle the out token */
675 } else {
676 status = NT_STATUS_LOGON_FAILURE;
677 goto done;
678 }
679 }
680
681 /* we may be told to return nothing */
682 if (out_data.length) {
683 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
684 if (!blob.data) {
685 status = NT_STATUS_NO_MEMORY;
686 }
687 gss_maj = gss_release_buffer(&gss_min, &out_data);
688 }
689
690
691 done:
692 *token_out = blob;
693 return status;
694 }
695
696 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
697 {
698 OM_uint32 gss_min, gss_maj;
699 gss_buffer_desc msg_min;
700 gss_buffer_desc msg_maj;
701 OM_uint32 msg_ctx = 0;
702
703 char *errstr = NULL;
704
705 ZERO_STRUCT(msg_min);
706 ZERO_STRUCT(msg_maj);
707
708 gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
709 GSS_C_NO_OID, &msg_ctx, &msg_maj);
710 if (gss_maj) {
711 goto done;
712 }
713 errstr = talloc_strndup(mem_ctx,
714 (char *)msg_maj.value,
715 msg_maj.length);
716 if (!errstr) {
717 goto done;
718 }
719 gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
720 (gss_OID)discard_const(gss_mech_krb5),
721 &msg_ctx, &msg_min);
722 if (gss_maj) {
723 goto done;
724 }
725
726 errstr = talloc_strdup_append_buffer(errstr, ": ");
727 if (!errstr) {
728 goto done;
729 }
730 errstr = talloc_strndup_append_buffer(errstr,
731 (char *)msg_min.value,
732 msg_min.length);
733 if (!errstr) {
734 goto done;
735 }
736
737 done:
738 if (msg_min.value) {
739 gss_maj = gss_release_buffer(&gss_min, &msg_min);
740 }
741 if (msg_maj.value) {
742 gss_maj = gss_release_buffer(&gss_min, &msg_maj);
743 }
744 return errstr;
745 }
746
747 static NTSTATUS gensec_gse_client_start(struct gensec_security *gensec_security)
748 {
749 struct gse_context *gse_ctx;
750 struct cli_credentials *creds = gensec_get_credentials(gensec_security);
751 NTSTATUS nt_status;
752 OM_uint32 want_flags = 0;
753 bool do_sign = false, do_seal = false;
754 const char *hostname = gensec_get_target_hostname(gensec_security);
755 const char *service = gensec_get_target_service(gensec_security);
756 const char *username = cli_credentials_get_username(creds);
757 const char *password = cli_credentials_get_password(creds);
758 const char *realm = cli_credentials_get_realm(creds);
759
760 if (!hostname) {
761 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
762 return NT_STATUS_INVALID_PARAMETER;
763 }
764 if (is_ipaddress(hostname)) {
765 DEBUG(2, ("Cannot do GSE to an IP address\n"));
766 return NT_STATUS_INVALID_PARAMETER;
767 }
768 if (strcmp(hostname, "localhost") == 0) {
769 DEBUG(2, ("GSE to 'localhost' does not make sense\n"));
770 return NT_STATUS_INVALID_PARAMETER;
771 }
772
773 if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
774 do_sign = true;
775 }
776 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
777 do_sign = true;
778 }
779 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
780 do_seal = true;
781 }
782 if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
783 want_flags |= GSS_C_DCE_STYLE;
784 }
785
786 nt_status = gse_init_client(gensec_security, do_sign, do_seal, NULL,
787 hostname, service, realm,
788 username, password, want_flags,
789 &gse_ctx);
790 if (!NT_STATUS_IS_OK(nt_status)) {
791 return nt_status;
792 }
793 gensec_security->private_data = gse_ctx;
794 return NT_STATUS_OK;
795 }
796
797 static NTSTATUS gensec_gse_server_start(struct gensec_security *gensec_security)
798 {
799 struct gse_context *gse_ctx;
800 NTSTATUS nt_status;
801 OM_uint32 want_flags = 0;
802 bool do_sign = false, do_seal = false;
803
804 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
805 do_sign = true;
806 }
807 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
808 do_seal = true;
809 }
810 if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
811 want_flags |= GSS_C_DCE_STYLE;
812 }
813
814 nt_status = gse_init_server(gensec_security, do_sign, do_seal, want_flags,
815 &gse_ctx);
816 if (!NT_STATUS_IS_OK(nt_status)) {
817 return nt_status;
818 }
819 gensec_security->private_data = gse_ctx;
820 return NT_STATUS_OK;
821 }
822
823 struct gensec_gse_update_state {
824 NTSTATUS status;
825 DATA_BLOB out;
826 };
827
828 static NTSTATUS gensec_gse_update_internal(struct gensec_security *gensec_security,
829 TALLOC_CTX *mem_ctx,
830 const DATA_BLOB in,
831 DATA_BLOB *out);
832
833 static struct tevent_req *gensec_gse_update_send(TALLOC_CTX *mem_ctx,
834 struct tevent_context *ev,
835 struct gensec_security *gensec_security,
836 const DATA_BLOB in)
837 {
838 struct tevent_req *req = NULL;
839 struct gensec_gse_update_state *state = NULL;
840 NTSTATUS status;
841
842 req = tevent_req_create(mem_ctx, &state,
843 struct gensec_gse_update_state);
844 if (req == NULL) {
845 return NULL;
846 }
847
848 status = gensec_gse_update_internal(gensec_security,
849 state, in,
850 &state->out);
851 state->status = status;
852 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
853 tevent_req_done(req);
854 return tevent_req_post(req, ev);
855 }
856 if (tevent_req_nterror(req, status)) {
857 return tevent_req_post(req, ev);
858 }
859
860 tevent_req_done(req);
861 return tevent_req_post(req, ev);
862 }
863
864 static NTSTATUS gensec_gse_update_internal(struct gensec_security *gensec_security,
865 TALLOC_CTX *mem_ctx,
866 const DATA_BLOB in,
867 DATA_BLOB *out)
868 {
869 NTSTATUS status;
870
871 switch (gensec_security->gensec_role) {
872 case GENSEC_CLIENT:
873 status = gse_get_client_auth_token(mem_ctx,
874 gensec_security,
875 &in, out);
876 break;
877 case GENSEC_SERVER:
878 status = gse_get_server_auth_token(mem_ctx,
879 gensec_security,
880 &in, out);
881 break;
882 }
883 if (!NT_STATUS_IS_OK(status)) {
884 return status;
885 }
886
887 return NT_STATUS_OK;
888 }
889
890 static NTSTATUS gensec_gse_update_recv(struct tevent_req *req,
891 TALLOC_CTX *out_mem_ctx,
892 DATA_BLOB *out)
893 {
894 struct gensec_gse_update_state *state =
895 tevent_req_data(req,
896 struct gensec_gse_update_state);
897 NTSTATUS status;
898
899 *out = data_blob_null;
900
901 if (tevent_req_is_nterror(req, &status)) {
902 tevent_req_received(req);
903 return status;
904 }
905
906 *out = state->out;
907 talloc_steal(out_mem_ctx, state->out.data);
908 status = state->status;
909 tevent_req_received(req);
910 return status;
911 }
912
913 static NTSTATUS gensec_gse_wrap(struct gensec_security *gensec_security,
914 TALLOC_CTX *mem_ctx,
915 const DATA_BLOB *in,
916 DATA_BLOB *out)
917 {
918 struct gse_context *gse_ctx =
919 talloc_get_type_abort(gensec_security->private_data,
920 struct gse_context);
921 OM_uint32 maj_stat, min_stat;
922 gss_buffer_desc input_token, output_token;
923 int conf_state;
924 input_token.length = in->length;
925 input_token.value = in->data;
926
927 maj_stat = gss_wrap(&min_stat,
928 gse_ctx->gssapi_context,
929 gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
930 GSS_C_QOP_DEFAULT,
931 &input_token,
932 &conf_state,
933 &output_token);
934 if (GSS_ERROR(maj_stat)) {
935 DEBUG(0, ("gensec_gse_wrap: GSS Wrap failed: %s\n",
936 gse_errstr(talloc_tos(), maj_stat, min_stat)));
937 return NT_STATUS_ACCESS_DENIED;
938 }
939
940 *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
941 gss_release_buffer(&min_stat, &output_token);
942
943 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
944 && !conf_state) {
945 return NT_STATUS_ACCESS_DENIED;
946 }
947 return NT_STATUS_OK;
948 }
949
950 static NTSTATUS gensec_gse_unwrap(struct gensec_security *gensec_security,
951 TALLOC_CTX *mem_ctx,
952 const DATA_BLOB *in,
953 DATA_BLOB *out)
954 {
955 struct gse_context *gse_ctx =
956 talloc_get_type_abort(gensec_security->private_data,
957 struct gse_context);
958 OM_uint32 maj_stat, min_stat;
959 gss_buffer_desc input_token, output_token;
960 int conf_state;
961 gss_qop_t qop_state;
962 input_token.length = in->length;
963 input_token.value = in->data;
964
965 maj_stat = gss_unwrap(&min_stat,
966 gse_ctx->gssapi_context,
967 &input_token,
968 &output_token,
969 &conf_state,
970 &qop_state);
971 if (GSS_ERROR(maj_stat)) {
972 DEBUG(0, ("gensec_gse_unwrap: GSS UnWrap failed: %s\n",
973 gse_errstr(talloc_tos(), maj_stat, min_stat)));
974 return NT_STATUS_ACCESS_DENIED;
975 }
976
977 *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
978 gss_release_buffer(&min_stat, &output_token);
979
980 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
981 && !conf_state) {
982 return NT_STATUS_ACCESS_DENIED;
983 }
984 return NT_STATUS_OK;
985 }
986
987 static NTSTATUS gensec_gse_seal_packet(struct gensec_security *gensec_security,
988 TALLOC_CTX *mem_ctx,
989 uint8_t *data, size_t length,
990 const uint8_t *whole_pdu, size_t pdu_length,
991 DATA_BLOB *sig)
992 {
993 struct gse_context *gse_ctx =
994 talloc_get_type_abort(gensec_security->private_data,
995 struct gse_context);
996 bool hdr_signing = false;
997 size_t sig_size = 0;
998 NTSTATUS status;
999
1000 if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1001 hdr_signing = true;
1002 }
1003
1004 sig_size = gensec_gse_sig_size(gensec_security, length);
1005
1006 status = gssapi_seal_packet(gse_ctx->gssapi_context,
1007 &gse_ctx->gss_mech,
1008 hdr_signing, sig_size,
1009 data, length,
1010 whole_pdu, pdu_length,
1011 mem_ctx, sig);
1012 if (!NT_STATUS_IS_OK(status)) {
1013 DEBUG(0, ("gssapi_seal_packet(hdr_signing=%u,sig_size=%zu,"
1014 "data=%zu,pdu=%zu) failed: %s\n",
1015 hdr_signing, sig_size, length, pdu_length,
1016 nt_errstr(status)));
1017 return status;
1018 }
1019
1020 return NT_STATUS_OK;
1021 }
1022
1023 static NTSTATUS gensec_gse_unseal_packet(struct gensec_security *gensec_security,
1024 uint8_t *data, size_t length,
1025 const uint8_t *whole_pdu, size_t pdu_length,
1026 const DATA_BLOB *sig)
1027 {
1028 struct gse_context *gse_ctx =
1029 talloc_get_type_abort(gensec_security->private_data,
1030 struct gse_context);
1031 bool hdr_signing = false;
1032 NTSTATUS status;
1033
1034 if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1035 hdr_signing = true;
1036 }
1037
1038 status = gssapi_unseal_packet(gse_ctx->gssapi_context,
1039 &gse_ctx->gss_mech,
1040 hdr_signing,
1041 data, length,
1042 whole_pdu, pdu_length,
1043 sig);
1044 if (!NT_STATUS_IS_OK(status)) {
1045 DEBUG(0, ("gssapi_unseal_packet(hdr_signing=%u,sig_size=%zu,"
1046 "data=%zu,pdu=%zu) failed: %s\n",
1047 hdr_signing, sig->length, length, pdu_length,
1048 nt_errstr(status)));
1049 return status;
1050 }
1051
1052 return NT_STATUS_OK;
1053 }
1054
1055 static NTSTATUS gensec_gse_sign_packet(struct gensec_security *gensec_security,
1056 TALLOC_CTX *mem_ctx,
1057 const uint8_t *data, size_t length,
1058 const uint8_t *whole_pdu, size_t pdu_length,
1059 DATA_BLOB *sig)
1060 {
1061 struct gse_context *gse_ctx =
1062 talloc_get_type_abort(gensec_security->private_data,
1063 struct gse_context);
1064 bool hdr_signing = false;
1065 NTSTATUS status;
1066
1067 if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1068 hdr_signing = true;
1069 }
1070
1071 status = gssapi_sign_packet(gse_ctx->gssapi_context,
1072 &gse_ctx->gss_mech,
1073 hdr_signing,
1074 data, length,
1075 whole_pdu, pdu_length,
1076 mem_ctx, sig);
1077 if (!NT_STATUS_IS_OK(status)) {
1078 DEBUG(0, ("gssapi_sign_packet(hdr_signing=%u,"
1079 "data=%zu,pdu=%zu) failed: %s\n",
1080 hdr_signing, length, pdu_length,
1081 nt_errstr(status)));
1082 return status;
1083 }
1084
1085 return NT_STATUS_OK;
1086 }
1087
1088 static NTSTATUS gensec_gse_check_packet(struct gensec_security *gensec_security,
1089 const uint8_t *data, size_t length,
1090 const uint8_t *whole_pdu, size_t pdu_length,
1091 const DATA_BLOB *sig)
1092 {
1093 struct gse_context *gse_ctx =
1094 talloc_get_type_abort(gensec_security->private_data,
1095 struct gse_context);
1096 bool hdr_signing = false;
1097 NTSTATUS status;
1098
1099 if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1100 hdr_signing = true;
1101 }
1102
1103 status = gssapi_check_packet(gse_ctx->gssapi_context,
1104 &gse_ctx->gss_mech,
1105 hdr_signing,
1106 data, length,
1107 whole_pdu, pdu_length,
1108 sig);
1109 if (!NT_STATUS_IS_OK(status)) {
1110 DEBUG(0, ("gssapi_check_packet(hdr_signing=%u,sig_size=%zu"
1111 "data=%zu,pdu=%zu) failed: %s\n",
1112 hdr_signing, sig->length, length, pdu_length,
1113 nt_errstr(status)));
1114 return status;
1115 }
1116
1117 return NT_STATUS_OK;
1118 }
1119
1120 /* Try to figure out what features we actually got on the connection */
1121 static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
1122 uint32_t feature)
1123 {
1124 struct gse_context *gse_ctx =
1125 talloc_get_type_abort(gensec_security->private_data,
1126 struct gse_context);
1127
1128 if (feature & GENSEC_FEATURE_SESSION_KEY) {
1129 return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
1130 }
1131 if (feature & GENSEC_FEATURE_SIGN) {
1132 return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
1133 }
1134 if (feature & GENSEC_FEATURE_SEAL) {
1135 return gse_ctx->gss_got_flags & GSS_C_CONF_FLAG;
1136 }
1137 if (feature & GENSEC_FEATURE_DCE_STYLE) {
1138 return gse_ctx->gss_got_flags & GSS_C_DCE_STYLE;
1139 }
1140 if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
1141 NTSTATUS status;
1142 uint32_t keytype;
1143
1144 if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
1145 return false;
1146 }
1147
1148 status = gssapi_get_session_key(talloc_tos(),
1149 gse_ctx->gssapi_context, NULL, &keytype);
1150 /*
1151 * We should do a proper sig on the mechListMic unless
1152 * we know we have to be backwards compatible with
1153 * earlier windows versions.
1154 *
1155 * Negotiating a non-krb5
1156 * mech for example should be regarded as having
1157 * NEW_SPNEGO
1158 */
1159 if (NT_STATUS_IS_OK(status)) {
1160 switch (keytype) {
1161 case ENCTYPE_DES_CBC_CRC:
1162 case ENCTYPE_DES_CBC_MD5:
1163 case ENCTYPE_ARCFOUR_HMAC:
1164 case ENCTYPE_DES3_CBC_SHA1:
1165 return false;
1166 }
1167 }
1168 return true;
1169 }
1170 /* We can always do async (rather than strict request/reply) packets. */
1171 if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
1172 return true;
1173 }
1174 if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1175 return true;
1176 }
1177 return false;
1178 }
1179
1180 static NTTIME gensec_gse_expire_time(struct gensec_security *gensec_security)
1181 {
1182 struct gse_context *gse_ctx =
1183 talloc_get_type_abort(gensec_security->private_data,
1184 struct gse_context);
1185
1186 return gse_ctx->expire_time;
1187 }
1188
1189 /*
1190 * Extract the 'sesssion key' needed by SMB signing and ncacn_np
1191 * (for encrypting some passwords).
1192 *
1193 * This breaks all the abstractions, but what do you expect...
1194 */
1195 static NTSTATUS gensec_gse_session_key(struct gensec_security *gensec_security,
1196 TALLOC_CTX *mem_ctx,
1197 DATA_BLOB *session_key)
1198 {
1199 struct gse_context *gse_ctx =
1200 talloc_get_type_abort(gensec_security->private_data,
1201 struct gse_context);
1202
1203 return gssapi_get_session_key(mem_ctx, gse_ctx->gssapi_context, session_key, NULL);
1204 }
1205
1206 /* Get some basic (and authorization) information about the user on
1207 * this session. This uses either the PAC (if present) or a local
1208 * database lookup */
1209 static NTSTATUS gensec_gse_session_info(struct gensec_security *gensec_security,
1210 TALLOC_CTX *mem_ctx,
1211 struct auth_session_info **_session_info)
1212 {
1213 struct gse_context *gse_ctx =
1214 talloc_get_type_abort(gensec_security->private_data,
1215 struct gse_context);
1216 NTSTATUS nt_status;
1217 TALLOC_CTX *tmp_ctx;
1218 struct auth_session_info *session_info = NULL;
1219 OM_uint32 maj_stat, min_stat;
1220 DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
1221
1222 gss_buffer_desc name_token;
1223 char *principal_string;
1224
1225 tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gse_session_info context");
1226 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1227
1228 maj_stat = gss_display_name(&min_stat,
1229 gse_ctx->client_name,
1230 &name_token,
1231 NULL);
1232 if (GSS_ERROR(maj_stat)) {
1233 DEBUG(1, ("GSS display_name failed: %s\n",
1234 gse_errstr(talloc_tos(), maj_stat, min_stat)));
1235 talloc_free(tmp_ctx);
1236 return NT_STATUS_FOOBAR;
1237 }
1238
1239 principal_string = talloc_strndup(tmp_ctx,
1240 (const char *)name_token.value,
1241 name_token.length);
1242
1243 gss_release_buffer(&min_stat, &name_token);
1244
1245 if (!principal_string) {
1246 talloc_free(tmp_ctx);
1247 return NT_STATUS_NO_MEMORY;
1248 }
1249
1250 nt_status = gssapi_obtain_pac_blob(tmp_ctx, gse_ctx->gssapi_context,
1251 gse_ctx->client_name,
1252 &pac_blob);
1253
1254 /* IF we have the PAC - otherwise we need to get this
1255 * data from elsewere
1256 */
1257 if (NT_STATUS_IS_OK(nt_status)) {
1258 pac_blob_ptr = &pac_blob;
1259 }
1260 nt_status = gensec_generate_session_info_pac(tmp_ctx,
1261 gensec_security,
1262 NULL,
1263 pac_blob_ptr, principal_string,
1264 gensec_get_remote_address(gensec_security),
1265 &session_info);
1266 if (!NT_STATUS_IS_OK(nt_status)) {
1267 talloc_free(tmp_ctx);
1268 return nt_status;
1269 }
1270
1271 nt_status = gensec_gse_session_key(gensec_security, session_info,
1272 &session_info->session_key);
1273 if (!NT_STATUS_IS_OK(nt_status)) {
1274 talloc_free(tmp_ctx);
1275 return nt_status;
1276 }
1277
1278 *_session_info = talloc_move(mem_ctx, &session_info);
1279 talloc_free(tmp_ctx);
1280
1281 return NT_STATUS_OK;
1282 }
1283
1284 static size_t gensec_gse_max_input_size(struct gensec_security *gensec_security)
1285 {
1286 struct gse_context *gse_ctx =
1287 talloc_get_type_abort(gensec_security->private_data,
1288 struct gse_context);
1289 OM_uint32 maj_stat, min_stat;
1290 OM_uint32 max_input_size;
1291
1292 maj_stat = gss_wrap_size_limit(&min_stat,
1293 gse_ctx->gssapi_context,
1294 gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
1295 GSS_C_QOP_DEFAULT,
1296 gse_ctx->max_wrap_buf_size,
1297 &max_input_size);
1298 if (GSS_ERROR(maj_stat)) {
1299 TALLOC_CTX *mem_ctx = talloc_new(NULL);
1300 DEBUG(1, ("gensec_gssapi_max_input_size: determining signature size with gss_wrap_size_limit failed: %s\n",
1301 gse_errstr(mem_ctx, maj_stat, min_stat)));
1302 talloc_free(mem_ctx);
1303 return 0;
1304 }
1305
1306 return max_input_size;
1307 }
1308
1309 /* Find out the maximum output size negotiated on this connection */
1310 static size_t gensec_gse_max_wrapped_size(struct gensec_security *gensec_security)
1311 {
1312 struct gse_context *gse_ctx =
1313 talloc_get_type_abort(gensec_security->private_data,
1314 struct gse_context);
1315 return gse_ctx->max_wrap_buf_size;
1316 }
1317
1318 static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
1319 size_t data_size)
1320 {
1321 struct gse_context *gse_ctx =
1322 talloc_get_type_abort(gensec_security->private_data,
1323 struct gse_context);
1324
1325 if (gse_ctx->sig_size > 0) {
1326 return gse_ctx->sig_size;
1327 }
1328
1329 gse_ctx->sig_size = gssapi_get_sig_size(gse_ctx->gssapi_context,
1330 &gse_ctx->gss_mech,
1331 gse_ctx->gss_got_flags,
1332 data_size);
1333 return gse_ctx->sig_size;
1334 }
1335
1336 static const char *gensec_gse_final_auth_type(struct gensec_security *gensec_security)
1337 {
1338 struct gse_context *gse_ctx =
1339 talloc_get_type_abort(gensec_security->private_data,
1340 struct gse_context);
1341
1342 /* Only return the string for GSSAPI/Krb5 */
1343 if (smb_gss_oid_equal(&gse_ctx->gss_mech,
1344 gss_mech_krb5)) {
1345 return GENSEC_FINAL_AUTH_TYPE_KRB5;
1346 } else {
1347 return "gensec_gse: UNKNOWN MECH";
1348 }
1349 }
1350
1351 static const char *gensec_gse_krb5_oids[] = {
1352 GENSEC_OID_KERBEROS5_OLD,
1353 GENSEC_OID_KERBEROS5,
1354 NULL
1355 };
1356
1357 const struct gensec_security_ops gensec_gse_krb5_security_ops = {
1358 .name = "gse_krb5",
1359 .auth_type = DCERPC_AUTH_TYPE_KRB5,
1360 .oid = gensec_gse_krb5_oids,
1361 .client_start = gensec_gse_client_start,
1362 .server_start = gensec_gse_server_start,
1363 .magic = gensec_magic_check_krb5_oid,
1364 .update_send = gensec_gse_update_send,
1365 .update_recv = gensec_gse_update_recv,
1366 .session_key = gensec_gse_session_key,
1367 .session_info = gensec_gse_session_info,
1368 .sig_size = gensec_gse_sig_size,
1369 .sign_packet = gensec_gse_sign_packet,
1370 .check_packet = gensec_gse_check_packet,
1371 .seal_packet = gensec_gse_seal_packet,
1372 .unseal_packet = gensec_gse_unseal_packet,
1373 .max_input_size = gensec_gse_max_input_size,
1374 .max_wrapped_size = gensec_gse_max_wrapped_size,
1375 .wrap = gensec_gse_wrap,
1376 .unwrap = gensec_gse_unwrap,
1377 .have_feature = gensec_gse_have_feature,
1378 .expire_time = gensec_gse_expire_time,
1379 .final_auth_type = gensec_gse_final_auth_type,
1380 .enabled = true,
1381 .kerberos = true,
1382 .priority = GENSEC_GSSAPI
1383 };
1384
1385 #endif /* HAVE_KRB5 */
Samba GIT mirror