?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
auth: Add a reminder about the strings currently used for auditing
[Samba.git] / auth / gensec / schannel.c
blob1b99bb747aaadc145aa147655a46b27caf7a081a
1 /*
2 Unix SMB/CIFS implementation.
3
4 dcerpc schannel operations
5
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include <tevent.h>
25 #include "lib/util/tevent_ntstatus.h"
26 #include "librpc/gen_ndr/ndr_schannel.h"
27 #include "auth/auth.h"
28 #include "auth/credentials/credentials.h"
29 #include "auth/gensec/gensec.h"
30 #include "auth/gensec/gensec_internal.h"
31 #include "auth/gensec/gensec_proto.h"
32 #include "../libcli/auth/schannel.h"
33 #include "librpc/gen_ndr/dcerpc.h"
34 #include "param/param.h"
35 #include "auth/gensec/gensec_toplevel_proto.h"
36 #include "lib/crypto/crypto.h"
37
38 struct schannel_state {
39 struct gensec_security *gensec;
40 uint64_t seq_num;
41 bool initiator;
42 struct netlogon_creds_CredentialState *creds;
43 struct auth_user_info_dc *user_info_dc;
44 };
45
46 #define SETUP_SEQNUM(state, buf, initiator) do { \
47 uint8_t *_buf = buf; \
48 uint32_t _seq_num_low = (state)->seq_num & UINT32_MAX; \
49 uint32_t _seq_num_high = (state)->seq_num >> 32; \
50 if (initiator) { \
51 _seq_num_high |= 0x80000000; \
52 } \
53 RSIVAL(_buf, 0, _seq_num_low); \
54 RSIVAL(_buf, 4, _seq_num_high); \
55 } while(0)
56
57 static struct schannel_state *netsec_create_state(
58 struct gensec_security *gensec,
59 struct netlogon_creds_CredentialState *creds,
60 bool initiator)
61 {
62 struct schannel_state *state;
63
64 state = talloc_zero(gensec, struct schannel_state);
65 if (state == NULL) {
66 return NULL;
67 }
68
69 state->gensec = gensec;
70 state->initiator = initiator;
71 state->creds = netlogon_creds_copy(state, creds);
72 if (state->creds == NULL) {
73 talloc_free(state);
74 return NULL;
75 }
76
77 gensec->private_data = state;
78
79 return state;
80 }
81
82 static void netsec_offset_and_sizes(struct schannel_state *state,
83 bool do_seal,
84 uint32_t *_min_sig_size,
85 uint32_t *_used_sig_size,
86 uint32_t *_checksum_length,
87 uint32_t *_confounder_ofs)
88 {
89 uint32_t min_sig_size;
90 uint32_t used_sig_size;
91 uint32_t checksum_length;
92 uint32_t confounder_ofs;
93
94 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
95 min_sig_size = 48;
96 used_sig_size = 56;
97 /*
98 * Note: windows has a bug here and uses the old values...
99 *
100 * checksum_length = 32;
101 * confounder_ofs = 48;
102 */
103 checksum_length = 8;
104 confounder_ofs = 24;
105 } else {
106 min_sig_size = 24;
107 used_sig_size = 32;
108 checksum_length = 8;
109 confounder_ofs = 24;
110 }
111
112 if (do_seal) {
113 min_sig_size += 8;
114 }
115
116 if (_min_sig_size) {
117 *_min_sig_size = min_sig_size;
118 }
119
120 if (_used_sig_size) {
121 *_used_sig_size = used_sig_size;
122 }
123
124 if (_checksum_length) {
125 *_checksum_length = checksum_length;
126 }
127
128 if (_confounder_ofs) {
129 *_confounder_ofs = confounder_ofs;
130 }
131 }
132
133 /*******************************************************************
134 Encode or Decode the sequence number (which is symmetric)
135 ********************************************************************/
136 static void netsec_do_seq_num(struct schannel_state *state,
137 const uint8_t *checksum,
138 uint32_t checksum_length,
139 uint8_t seq_num[8])
140 {
141 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
142 AES_KEY key;
143 uint8_t iv[AES_BLOCK_SIZE];
144
145 AES_set_encrypt_key(state->creds->session_key, 128, &key);
146 ZERO_STRUCT(iv);
147 memcpy(iv+0, checksum, 8);
148 memcpy(iv+8, checksum, 8);
149
150 aes_cfb8_encrypt(seq_num, seq_num, 8, &key, iv, AES_ENCRYPT);
151 } else {
152 static const uint8_t zeros[4];
153 uint8_t sequence_key[16];
154 uint8_t digest1[16];
155
156 hmac_md5(state->creds->session_key, zeros, sizeof(zeros), digest1);
157 hmac_md5(digest1, checksum, checksum_length, sequence_key);
158 arcfour_crypt(seq_num, sequence_key, 8);
159 }
160
161 state->seq_num++;
162 }
163
164 static void netsec_do_seal(struct schannel_state *state,
165 const uint8_t seq_num[8],
166 uint8_t confounder[8],
167 uint8_t *data, uint32_t length,
168 bool forward)
169 {
170 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
171 AES_KEY key;
172 uint8_t iv[AES_BLOCK_SIZE];
173 uint8_t sess_kf0[16];
174 int i;
175
176 for (i = 0; i < 16; i++) {
177 sess_kf0[i] = state->creds->session_key[i] ^ 0xf0;
178 }
179
180 AES_set_encrypt_key(sess_kf0, 128, &key);
181 ZERO_STRUCT(iv);
182 memcpy(iv+0, seq_num, 8);
183 memcpy(iv+8, seq_num, 8);
184
185 if (forward) {
186 aes_cfb8_encrypt(confounder, confounder, 8, &key, iv, AES_ENCRYPT);
187 aes_cfb8_encrypt(data, data, length, &key, iv, AES_ENCRYPT);
188 } else {
189 aes_cfb8_encrypt(confounder, confounder, 8, &key, iv, AES_DECRYPT);
190 aes_cfb8_encrypt(data, data, length, &key, iv, AES_DECRYPT);
191 }
192 } else {
193 uint8_t sealing_key[16];
194 static const uint8_t zeros[4];
195 uint8_t digest2[16];
196 uint8_t sess_kf0[16];
197 int i;
198
199 for (i = 0; i < 16; i++) {
200 sess_kf0[i] = state->creds->session_key[i] ^ 0xf0;
201 }
202
203 hmac_md5(sess_kf0, zeros, 4, digest2);
204 hmac_md5(digest2, seq_num, 8, sealing_key);
205
206 arcfour_crypt(confounder, sealing_key, 8);
207 arcfour_crypt(data, sealing_key, length);
208 }
209 }
210
211 /*******************************************************************
212 Create a digest over the entire packet (including the data), and
213 MD5 it with the session key.
214 ********************************************************************/
215 static void netsec_do_sign(struct schannel_state *state,
216 const uint8_t *confounder,
217 const uint8_t *data, size_t length,
218 uint8_t header[8],
219 uint8_t *checksum)
220 {
221 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
222 struct HMACSHA256Context ctx;
223
224 hmac_sha256_init(state->creds->session_key,
225 sizeof(state->creds->session_key),
226 &ctx);
227
228 if (confounder) {
229 SSVAL(header, 0, NL_SIGN_HMAC_SHA256);
230 SSVAL(header, 2, NL_SEAL_AES128);
231 SSVAL(header, 4, 0xFFFF);
232 SSVAL(header, 6, 0x0000);
233
234 hmac_sha256_update(header, 8, &ctx);
235 hmac_sha256_update(confounder, 8, &ctx);
236 } else {
237 SSVAL(header, 0, NL_SIGN_HMAC_SHA256);
238 SSVAL(header, 2, NL_SEAL_NONE);
239 SSVAL(header, 4, 0xFFFF);
240 SSVAL(header, 6, 0x0000);
241
242 hmac_sha256_update(header, 8, &ctx);
243 }
244
245 hmac_sha256_update(data, length, &ctx);
246
247 hmac_sha256_final(checksum, &ctx);
248 } else {
249 uint8_t packet_digest[16];
250 static const uint8_t zeros[4];
251 MD5_CTX ctx;
252
253 MD5Init(&ctx);
254 MD5Update(&ctx, zeros, 4);
255 if (confounder) {
256 SSVAL(header, 0, NL_SIGN_HMAC_MD5);
257 SSVAL(header, 2, NL_SEAL_RC4);
258 SSVAL(header, 4, 0xFFFF);
259 SSVAL(header, 6, 0x0000);
260
261 MD5Update(&ctx, header, 8);
262 MD5Update(&ctx, confounder, 8);
263 } else {
264 SSVAL(header, 0, NL_SIGN_HMAC_MD5);
265 SSVAL(header, 2, NL_SEAL_NONE);
266 SSVAL(header, 4, 0xFFFF);
267 SSVAL(header, 6, 0x0000);
268
269 MD5Update(&ctx, header, 8);
270 }
271 MD5Update(&ctx, data, length);
272 MD5Final(packet_digest, &ctx);
273
274 hmac_md5(state->creds->session_key,
275 packet_digest, sizeof(packet_digest),
276 checksum);
277 }
278 }
279
280 static NTSTATUS netsec_incoming_packet(struct schannel_state *state,
281 bool do_unseal,
282 uint8_t *data, size_t length,
283 const uint8_t *whole_pdu, size_t pdu_length,
284 const DATA_BLOB *sig)
285 {
286 uint32_t min_sig_size = 0;
287 uint8_t header[8];
288 uint8_t checksum[32];
289 uint32_t checksum_length = sizeof(checksum_length);
290 uint8_t _confounder[8];
291 uint8_t *confounder = NULL;
292 uint32_t confounder_ofs = 0;
293 uint8_t seq_num[8];
294 int ret;
295 const uint8_t *sign_data = NULL;
296 size_t sign_length = 0;
297
298 netsec_offset_and_sizes(state,
299 do_unseal,
300 &min_sig_size,
301 NULL,
302 &checksum_length,
303 &confounder_ofs);
304
305 if (sig->length < min_sig_size) {
306 return NT_STATUS_ACCESS_DENIED;
307 }
308
309 if (do_unseal) {
310 confounder = _confounder;
311 memcpy(confounder, sig->data+confounder_ofs, 8);
312 } else {
313 confounder = NULL;
314 }
315
316 SETUP_SEQNUM(state, seq_num, !state->initiator);
317
318 if (do_unseal) {
319 netsec_do_seal(state, seq_num,
320 confounder,
321 data, length,
322 false);
323 }
324
325 if (state->gensec->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
326 sign_data = whole_pdu;
327 sign_length = pdu_length;
328 } else {
329 sign_data = data;
330 sign_length = length;
331 }
332
333 netsec_do_sign(state, confounder,
334 sign_data, sign_length,
335 header, checksum);
336
337 ret = memcmp(checksum, sig->data+16, checksum_length);
338 if (ret != 0) {
339 dump_data_pw("calc digest:", checksum, checksum_length);
340 dump_data_pw("wire digest:", sig->data+16, checksum_length);
341 return NT_STATUS_ACCESS_DENIED;
342 }
343
344 netsec_do_seq_num(state, checksum, checksum_length, seq_num);
345
346 ret = memcmp(seq_num, sig->data+8, 8);
347 if (ret != 0) {
348 dump_data_pw("calc seq num:", seq_num, 8);
349 dump_data_pw("wire seq num:", sig->data+8, 8);
350 return NT_STATUS_ACCESS_DENIED;
351 }
352
353 return NT_STATUS_OK;
354 }
355
356 static uint32_t netsec_outgoing_sig_size(struct schannel_state *state)
357 {
358 uint32_t sig_size = 0;
359
360 netsec_offset_and_sizes(state,
361 true,
362 NULL,
363 &sig_size,
364 NULL,
365 NULL);
366
367 return sig_size;
368 }
369
370 static NTSTATUS netsec_outgoing_packet(struct schannel_state *state,
371 TALLOC_CTX *mem_ctx,
372 bool do_seal,
373 uint8_t *data, size_t length,
374 const uint8_t *whole_pdu, size_t pdu_length,
375 DATA_BLOB *sig)
376 {
377 uint32_t min_sig_size = 0;
378 uint32_t used_sig_size = 0;
379 uint8_t header[8];
380 uint8_t checksum[32];
381 uint32_t checksum_length = sizeof(checksum_length);
382 uint8_t _confounder[8];
383 uint8_t *confounder = NULL;
384 uint32_t confounder_ofs = 0;
385 uint8_t seq_num[8];
386 const uint8_t *sign_data = NULL;
387 size_t sign_length = 0;
388
389 netsec_offset_and_sizes(state,
390 do_seal,
391 &min_sig_size,
392 &used_sig_size,
393 &checksum_length,
394 &confounder_ofs);
395
396 SETUP_SEQNUM(state, seq_num, state->initiator);
397
398 if (do_seal) {
399 confounder = _confounder;
400 generate_random_buffer(confounder, 8);
401 } else {
402 confounder = NULL;
403 }
404
405 if (state->gensec->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
406 sign_data = whole_pdu;
407 sign_length = pdu_length;
408 } else {
409 sign_data = data;
410 sign_length = length;
411 }
412
413 netsec_do_sign(state, confounder,
414 sign_data, sign_length,
415 header, checksum);
416
417 if (do_seal) {
418 netsec_do_seal(state, seq_num,
419 confounder,
420 data, length,
421 true);
422 }
423
424 netsec_do_seq_num(state, checksum, checksum_length, seq_num);
425
426 (*sig) = data_blob_talloc_zero(mem_ctx, used_sig_size);
427
428 memcpy(sig->data, header, 8);
429 memcpy(sig->data+8, seq_num, 8);
430 memcpy(sig->data+16, checksum, checksum_length);
431
432 if (confounder) {
433 memcpy(sig->data+confounder_ofs, confounder, 8);
434 }
435
436 dump_data_pw("signature:", sig->data+ 0, 8);
437 dump_data_pw("seq_num :", sig->data+ 8, 8);
438 dump_data_pw("digest :", sig->data+16, checksum_length);
439 dump_data_pw("confound :", sig->data+confounder_ofs, 8);
440
441 return NT_STATUS_OK;
442 }
443
444 _PUBLIC_ NTSTATUS gensec_schannel_init(void);
445
446 static size_t schannel_sig_size(struct gensec_security *gensec_security, size_t data_size)
447 {
448 struct schannel_state *state =
449 talloc_get_type_abort(gensec_security->private_data,
450 struct schannel_state);
451
452 return netsec_outgoing_sig_size(state);
453 }
454
455 struct schannel_update_state {
456 NTSTATUS status;
457 DATA_BLOB out;
458 };
459
460 static NTSTATUS schannel_update_internal(struct gensec_security *gensec_security,
461 TALLOC_CTX *out_mem_ctx,
462 const DATA_BLOB in, DATA_BLOB *out);
463
464 static struct tevent_req *schannel_update_send(TALLOC_CTX *mem_ctx,
465 struct tevent_context *ev,
466 struct gensec_security *gensec_security,
467 const DATA_BLOB in)
468 {
469 struct tevent_req *req;
470 struct schannel_update_state *state = NULL;
471 NTSTATUS status;
472
473 req = tevent_req_create(mem_ctx, &state,
474 struct schannel_update_state);
475 if (req == NULL) {
476 return NULL;
477 }
478
479 status = schannel_update_internal(gensec_security,
480 state, in,
481 &state->out);
482 state->status = status;
483 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
484 status = NT_STATUS_OK;
485 }
486 if (tevent_req_nterror(req, status)) {
487 return tevent_req_post(req, ev);
488 }
489
490 tevent_req_done(req);
491 return tevent_req_post(req, ev);
492 }
493
494 static NTSTATUS schannel_update_internal(struct gensec_security *gensec_security,
495 TALLOC_CTX *out_mem_ctx,
496 const DATA_BLOB in, DATA_BLOB *out)
497 {
498 struct schannel_state *state =
499 talloc_get_type(gensec_security->private_data,
500 struct schannel_state);
501 NTSTATUS status;
502 enum ndr_err_code ndr_err;
503 struct NL_AUTH_MESSAGE bind_schannel = {};
504 struct NL_AUTH_MESSAGE bind_schannel_ack;
505 struct netlogon_creds_CredentialState *creds;
506 const char *workstation;
507 const char *domain;
508
509 *out = data_blob(NULL, 0);
510
511 if (gensec_security->dcerpc_auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) {
512 switch (gensec_security->gensec_role) {
513 case GENSEC_CLIENT:
514 return NT_STATUS_INVALID_PARAMETER_MIX;
515 case GENSEC_SERVER:
516 return NT_STATUS_INVALID_PARAMETER;
517 }
518 return NT_STATUS_INTERNAL_ERROR;
519 }
520
521 switch (gensec_security->gensec_role) {
522 case GENSEC_CLIENT:
523 if (state != NULL) {
524 /* we could parse the bind ack, but we don't know what it is yet */
525 return NT_STATUS_OK;
526 }
527
528 creds = cli_credentials_get_netlogon_creds(gensec_security->credentials);
529 if (creds == NULL) {
530 return NT_STATUS_INVALID_PARAMETER_MIX;
531 }
532
533 state = netsec_create_state(gensec_security,
534 creds, true /* initiator */);
535 if (state == NULL) {
536 return NT_STATUS_NO_MEMORY;
537 }
538
539 bind_schannel.MessageType = NL_NEGOTIATE_REQUEST;
540
541 bind_schannel.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
542 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
543 bind_schannel.oem_netbios_domain.a = cli_credentials_get_domain(gensec_security->credentials);
544 bind_schannel.oem_netbios_computer.a = creds->computer_name;
545
546 if (creds->secure_channel_type == SEC_CHAN_DNS_DOMAIN) {
547 bind_schannel.Flags |= NL_FLAG_UTF8_DNS_DOMAIN_NAME;
548 bind_schannel.utf8_dns_domain.u = cli_credentials_get_realm(gensec_security->credentials);
549
550 bind_schannel.Flags |= NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME;
551 bind_schannel.utf8_netbios_computer.u = creds->computer_name;
552 }
553
554 ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel,
555 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
556 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
557 status = ndr_map_error2ntstatus(ndr_err);
558 DEBUG(3, ("Could not create schannel bind: %s\n",
559 nt_errstr(status)));
560 return status;
561 }
562
563 return NT_STATUS_MORE_PROCESSING_REQUIRED;
564 case GENSEC_SERVER:
565
566 if (state != NULL) {
567 /* no third leg on this protocol */
568 return NT_STATUS_INVALID_PARAMETER;
569 }
570
571 /* parse the schannel startup blob */
572 ndr_err = ndr_pull_struct_blob(&in, out_mem_ctx, &bind_schannel,
573 (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
574 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
575 status = ndr_map_error2ntstatus(ndr_err);
576 DEBUG(3, ("Could not parse incoming schannel bind: %s\n",
577 nt_errstr(status)));
578 return status;
579 }
580
581 if (bind_schannel.Flags & NL_FLAG_OEM_NETBIOS_DOMAIN_NAME) {
582 domain = bind_schannel.oem_netbios_domain.a;
583 if (strcasecmp_m(domain, lpcfg_workgroup(gensec_security->settings->lp_ctx)) != 0) {
584 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
585 domain, lpcfg_workgroup(gensec_security->settings->lp_ctx)));
586 return NT_STATUS_LOGON_FAILURE;
587 }
588 } else if (bind_schannel.Flags & NL_FLAG_UTF8_DNS_DOMAIN_NAME) {
589 domain = bind_schannel.utf8_dns_domain.u;
590 if (strcasecmp_m(domain, lpcfg_dnsdomain(gensec_security->settings->lp_ctx)) != 0) {
591 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
592 domain, lpcfg_dnsdomain(gensec_security->settings->lp_ctx)));
593 return NT_STATUS_LOGON_FAILURE;
594 }
595 } else {
596 DEBUG(3, ("Request for schannel to without domain\n"));
597 return NT_STATUS_LOGON_FAILURE;
598 }
599
600 if (bind_schannel.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME) {
601 workstation = bind_schannel.oem_netbios_computer.a;
602 } else if (bind_schannel.Flags & NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME) {
603 workstation = bind_schannel.utf8_netbios_computer.u;
604 } else {
605 DEBUG(3, ("Request for schannel to without netbios workstation\n"));
606 return NT_STATUS_LOGON_FAILURE;
607 }
608
609 status = schannel_get_creds_state(out_mem_ctx,
610 gensec_security->settings->lp_ctx,
611 workstation, &creds);
612 if (!NT_STATUS_IS_OK(status)) {
613 DEBUG(3, ("Could not find session key for attempted schannel connection from %s: %s\n",
614 workstation, nt_errstr(status)));
615 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
616 return NT_STATUS_LOGON_FAILURE;
617 }
618 return status;
619 }
620
621 state = netsec_create_state(gensec_security,
622 creds, false /* not initiator */);
623 if (state == NULL) {
624 return NT_STATUS_NO_MEMORY;
625 }
626
627 status = auth_anonymous_user_info_dc(state,
628 lpcfg_netbios_name(gensec_security->settings->lp_ctx),
629 &state->user_info_dc);
630 if (!NT_STATUS_IS_OK(status)) {
631 return status;
632 }
633
634 bind_schannel_ack.MessageType = NL_NEGOTIATE_RESPONSE;
635 bind_schannel_ack.Flags = 0;
636 bind_schannel_ack.Buffer.dummy = 0x6c0000; /* actually I think
637 * this does not have
638 * any meaning here
639 * - gd */
640
641 ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel_ack,
642 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
643 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
644 status = ndr_map_error2ntstatus(ndr_err);
645 DEBUG(3, ("Could not return schannel bind ack for client %s: %s\n",
646 workstation, nt_errstr(status)));
647 return status;
648 }
649
650 return NT_STATUS_OK;
651 }
652 return NT_STATUS_INVALID_PARAMETER;
653 }
654
655 static NTSTATUS schannel_update_recv(struct tevent_req *req,
656 TALLOC_CTX *out_mem_ctx,
657 DATA_BLOB *out)
658 {
659 struct schannel_update_state *state =
660 tevent_req_data(req,
661 struct schannel_update_state);
662 NTSTATUS status;
663
664 *out = data_blob_null;
665
666 if (tevent_req_is_nterror(req, &status)) {
667 tevent_req_received(req);
668 return status;
669 }
670
671 status = state->status;
672 talloc_steal(out_mem_ctx, state->out.data);
673 *out = state->out;
674 tevent_req_received(req);
675 return status;
676 }
677
678 /**
679 * Returns anonymous credentials for schannel, matching Win2k3.
680 *
681 */
682
683 static NTSTATUS schannel_session_info(struct gensec_security *gensec_security,
684 TALLOC_CTX *mem_ctx,
685 struct auth_session_info **_session_info)
686 {
687 struct schannel_state *state =
688 talloc_get_type(gensec_security->private_data,
689 struct schannel_state);
690 struct auth4_context *auth_ctx = gensec_security->auth_context;
691 struct auth_session_info *session_info = NULL;
692 uint32_t session_info_flags = 0;
693 NTSTATUS status;
694
695 if (auth_ctx == NULL) {
696 DEBUG(0, ("Cannot generate a session_info without the auth_context\n"));
697 return NT_STATUS_INTERNAL_ERROR;
698 }
699
700 if (auth_ctx->generate_session_info == NULL) {
701 DEBUG(0, ("Cannot generate a session_info without the generate_session_info hook\n"));
702 return NT_STATUS_INTERNAL_ERROR;
703 }
704
705 if (gensec_security->want_features & GENSEC_FEATURE_UNIX_TOKEN) {
706 session_info_flags |= AUTH_SESSION_INFO_UNIX_TOKEN;
707 }
708
709 session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
710
711 status = auth_ctx->generate_session_info(
712 auth_ctx,
713 mem_ctx,
714 state->user_info_dc,
715 state->user_info_dc->info->account_name,
716 session_info_flags,
717 &session_info);
718 if (!NT_STATUS_IS_OK(status)) {
719 return status;
720 }
721
722 *_session_info = session_info;
723 return NT_STATUS_OK;
724 }
725
726 static NTSTATUS schannel_server_start(struct gensec_security *gensec_security)
727 {
728 return NT_STATUS_OK;
729 }
730
731 static NTSTATUS schannel_client_start(struct gensec_security *gensec_security)
732 {
733 return NT_STATUS_OK;
734 }
735
736 static bool schannel_have_feature(struct gensec_security *gensec_security,
737 uint32_t feature)
738 {
739 if (gensec_security->dcerpc_auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY) {
740 if (feature & GENSEC_FEATURE_SIGN) {
741 return true;
742 }
743 }
744 if (gensec_security->dcerpc_auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
745 if (feature & GENSEC_FEATURE_SEAL) {
746 return true;
747 }
748 }
749 if (feature & GENSEC_FEATURE_DCE_STYLE) {
750 return true;
751 }
752 if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
753 return true;
754 }
755 return false;
756 }
757
758 /*
759 unseal a packet
760 */
761 static NTSTATUS schannel_unseal_packet(struct gensec_security *gensec_security,
762 uint8_t *data, size_t length,
763 const uint8_t *whole_pdu, size_t pdu_length,
764 const DATA_BLOB *sig)
765 {
766 struct schannel_state *state =
767 talloc_get_type_abort(gensec_security->private_data,
768 struct schannel_state);
769
770 return netsec_incoming_packet(state, true,
771 discard_const_p(uint8_t, data),
772 length,
773 whole_pdu, pdu_length,
774 sig);
775 }
776
777 /*
778 check the signature on a packet
779 */
780 static NTSTATUS schannel_check_packet(struct gensec_security *gensec_security,
781 const uint8_t *data, size_t length,
782 const uint8_t *whole_pdu, size_t pdu_length,
783 const DATA_BLOB *sig)
784 {
785 struct schannel_state *state =
786 talloc_get_type_abort(gensec_security->private_data,
787 struct schannel_state);
788
789 return netsec_incoming_packet(state, false,
790 discard_const_p(uint8_t, data),
791 length,
792 whole_pdu, pdu_length,
793 sig);
794 }
795 /*
796 seal a packet
797 */
798 static NTSTATUS schannel_seal_packet(struct gensec_security *gensec_security,
799 TALLOC_CTX *mem_ctx,
800 uint8_t *data, size_t length,
801 const uint8_t *whole_pdu, size_t pdu_length,
802 DATA_BLOB *sig)
803 {
804 struct schannel_state *state =
805 talloc_get_type_abort(gensec_security->private_data,
806 struct schannel_state);
807
808 return netsec_outgoing_packet(state, mem_ctx, true,
809 data, length,
810 whole_pdu, pdu_length,
811 sig);
812 }
813
814 /*
815 sign a packet
816 */
817 static NTSTATUS schannel_sign_packet(struct gensec_security *gensec_security,
818 TALLOC_CTX *mem_ctx,
819 const uint8_t *data, size_t length,
820 const uint8_t *whole_pdu, size_t pdu_length,
821 DATA_BLOB *sig)
822 {
823 struct schannel_state *state =
824 talloc_get_type_abort(gensec_security->private_data,
825 struct schannel_state);
826
827 return netsec_outgoing_packet(state, mem_ctx, false,
828 discard_const_p(uint8_t, data),
829 length,
830 whole_pdu, pdu_length,
831 sig);
832 }
833
834 static const struct gensec_security_ops gensec_schannel_security_ops = {
835 .name = "schannel",
836 .auth_type = DCERPC_AUTH_TYPE_SCHANNEL,
837 .client_start = schannel_client_start,
838 .server_start = schannel_server_start,
839 .update_send = schannel_update_send,
840 .update_recv = schannel_update_recv,
841 .seal_packet = schannel_seal_packet,
842 .sign_packet = schannel_sign_packet,
843 .check_packet = schannel_check_packet,
844 .unseal_packet = schannel_unseal_packet,
845 .session_info = schannel_session_info,
846 .sig_size = schannel_sig_size,
847 .have_feature = schannel_have_feature,
848 .enabled = true,
849 .priority = GENSEC_SCHANNEL
850 };
851
852 _PUBLIC_ NTSTATUS gensec_schannel_init(void)
853 {
854 NTSTATUS ret;
855 ret = gensec_register(&gensec_schannel_security_ops);
856 if (!NT_STATUS_IS_OK(ret)) {
857 DEBUG(0,("Failed to register '%s' gensec backend!\n",
858 gensec_schannel_security_ops.name));
859 return ret;
860 }
861
862 return ret;
863 }
Samba GIT mirror