?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
smbXsrv_session: Remove a "can't happen" NULL check
[Samba.git] / source3 / librpc / crypto / gse.c
blobddda18e45d93f010a893c417491cee7607f7ceb9
1 /*
2 * GSSAPI Security Extensions
3 * RPC Pipe client and server routines
4 * Copyright (C) Simo Sorce 2010.
5 * Copyright (C) Andrew Bartlett 2004-2011.
6 * Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 /* We support only GSSAPI/KRB5 here */
23
24 #include "includes.h"
25 #include <tevent.h>
26 #include "lib/util/tevent_ntstatus.h"
27 #include "gse.h"
28 #include "libads/kerberos_proto.h"
29 #include "auth/common_auth.h"
30 #include "auth/gensec/gensec.h"
31 #include "auth/gensec/gensec_internal.h"
32 #include "auth/credentials/credentials.h"
33 #include "../librpc/gen_ndr/dcerpc.h"
34 #include "param/param.h"
35
36 #if defined(HAVE_KRB5)
37
38 #include "auth/kerberos/pac_utils.h"
39 #include "auth/kerberos/gssapi_helper.h"
40 #include "gse_krb5.h"
41
42 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
43 static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
44 size_t data_size);
45
46 struct gse_context {
47 gss_ctx_id_t gssapi_context;
48 gss_name_t server_name;
49 gss_name_t client_name;
50 OM_uint32 gss_want_flags, gss_got_flags;
51 size_t max_wrap_buf_size;
52 size_t sig_size;
53
54 gss_cred_id_t delegated_cred_handle;
55
56 NTTIME expire_time;
57
58 /* gensec_gse only */
59 krb5_context k5ctx;
60 krb5_ccache ccache;
61 krb5_keytab keytab;
62
63 gss_OID_desc gss_mech;
64 gss_cred_id_t creds;
65
66 gss_OID ret_mech;
67 };
68
69 /* free non talloc dependent contexts */
70 static int gse_context_destructor(void *ptr)
71 {
72 struct gse_context *gse_ctx;
73 OM_uint32 gss_min;
74
75 gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
76 if (gse_ctx->k5ctx) {
77 if (gse_ctx->ccache) {
78 krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
79 gse_ctx->ccache = NULL;
80 }
81 if (gse_ctx->keytab) {
82 krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
83 gse_ctx->keytab = NULL;
84 }
85 krb5_free_context(gse_ctx->k5ctx);
86 gse_ctx->k5ctx = NULL;
87 }
88 if (gse_ctx->gssapi_context != GSS_C_NO_CONTEXT) {
89 (void)gss_delete_sec_context(&gss_min,
90 &gse_ctx->gssapi_context,
91 GSS_C_NO_BUFFER);
92 }
93 if (gse_ctx->server_name) {
94 (void)gss_release_name(&gss_min,
95 &gse_ctx->server_name);
96 }
97 if (gse_ctx->client_name) {
98 (void)gss_release_name(&gss_min,
99 &gse_ctx->client_name);
100 }
101 if (gse_ctx->creds) {
102 (void)gss_release_cred(&gss_min,
103 &gse_ctx->creds);
104 }
105 if (gse_ctx->delegated_cred_handle) {
106 (void)gss_release_cred(&gss_min,
107 &gse_ctx->delegated_cred_handle);
108 }
109
110 /* MIT and Heimdal differ as to if you can call
111 * gss_release_oid() on this OID, generated by
112 * gss_{accept,init}_sec_context(). However, as long as the
113 * oid is gss_mech_krb5 (which it always is at the moment),
114 * then this is a moot point, as both declare this particular
115 * OID static, and so no memory is lost. This assert is in
116 * place to ensure that the programmer who wishes to extend
117 * this code to EAP or other GSS mechanisms determines an
118 * implementation-dependent way of releasing any dynamically
119 * allocated OID */
120 SMB_ASSERT(smb_gss_oid_equal(&gse_ctx->gss_mech, GSS_C_NO_OID) ||
121 smb_gss_oid_equal(&gse_ctx->gss_mech, gss_mech_krb5));
122
123 return 0;
124 }
125
126 static NTSTATUS gse_setup_server_principal(TALLOC_CTX *mem_ctx,
127 const char *target_principal,
128 const char *service,
129 const char *hostname,
130 const char *realm,
131 char **pserver_principal,
132 gss_name_t *pserver_name)
133 {
134 char *server_principal = NULL;
135 gss_buffer_desc name_token;
136 gss_OID name_type;
137 OM_uint32 maj_stat, min_stat = 0;
138
139 if (target_principal != NULL) {
140 server_principal = talloc_strdup(mem_ctx, target_principal);
141 name_type = GSS_C_NULL_OID;
142 } else {
143 server_principal = talloc_asprintf(mem_ctx,
144 "%s/%s@%s",
145 service,
146 hostname,
147 realm);
148 name_type = GSS_C_NT_USER_NAME;
149 }
150 if (server_principal == NULL) {
151 return NT_STATUS_NO_MEMORY;
152 }
153
154 name_token.value = (uint8_t *)server_principal;
155 name_token.length = strlen(server_principal);
156
157 maj_stat = gss_import_name(&min_stat,
158 &name_token,
159 name_type,
160 pserver_name);
161 if (maj_stat) {
162 DBG_WARNING("GSS Import name of %s failed: %s\n",
163 server_principal,
164 gse_errstr(mem_ctx, maj_stat, min_stat));
165 TALLOC_FREE(server_principal);
166 return NT_STATUS_INVALID_PARAMETER;
167 }
168
169 *pserver_principal = server_principal;
170
171 return NT_STATUS_OK;
172 }
173
174 static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
175 bool do_sign, bool do_seal,
176 const char *ccache_name,
177 uint32_t add_gss_c_flags,
178 struct gse_context **_gse_ctx)
179 {
180 struct gse_context *gse_ctx;
181 krb5_error_code k5ret;
182 NTSTATUS status;
183
184 gse_ctx = talloc_zero(mem_ctx, struct gse_context);
185 if (!gse_ctx) {
186 return NT_STATUS_NO_MEMORY;
187 }
188 talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
189
190 gse_ctx->expire_time = GENSEC_EXPIRE_TIME_INFINITY;
191 gse_ctx->max_wrap_buf_size = UINT16_MAX;
192
193 memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
194
195 gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
196 GSS_C_DELEG_POLICY_FLAG |
197 GSS_C_REPLAY_FLAG |
198 GSS_C_SEQUENCE_FLAG;
199 if (do_sign) {
200 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
201 }
202 if (do_seal) {
203 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
204 gse_ctx->gss_want_flags |= GSS_C_CONF_FLAG;
205 }
206
207 gse_ctx->gss_want_flags |= add_gss_c_flags;
208
209 /* Initialize Kerberos Context */
210 k5ret = smb_krb5_init_context_common(&gse_ctx->k5ctx);
211 if (k5ret) {
212 DBG_ERR("kerberos init context failed (%s)\n",
213 error_message(k5ret));
214 status = NT_STATUS_INTERNAL_ERROR;
215 goto err_out;
216 }
217
218 #ifdef SAMBA4_USES_HEIMDAL
219 k5ret = gsskrb5_set_dns_canonicalize(false);
220 if (k5ret) {
221 DBG_ERR("gsskrb5_set_dns_canonicalize() failed (%s)\n",
222 error_message(k5ret));
223 status = NT_STATUS_INTERNAL_ERROR;
224 goto err_out;
225 }
226 #endif
227
228 if (!ccache_name) {
229 ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
230 }
231 k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
232 &gse_ctx->ccache);
233 if (k5ret) {
234 DEBUG(1, ("Failed to resolve credential cache '%s'! (%s)\n",
235 ccache_name, error_message(k5ret)));
236 status = NT_STATUS_INTERNAL_ERROR;
237 goto err_out;
238 }
239
240 /* TODO: Should we enforce a enc_types list ?
241 ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
242 */
243
244 *_gse_ctx = gse_ctx;
245 return NT_STATUS_OK;
246
247 err_out:
248 TALLOC_FREE(gse_ctx);
249 return status;
250 }
251
252 static NTSTATUS gse_init_client(struct gensec_security *gensec_security,
253 bool do_sign, bool do_seal,
254 const char *ccache_name,
255 const char *server,
256 const char *service,
257 const char *realm,
258 const char *username,
259 const char *password,
260 uint32_t add_gss_c_flags,
261 struct gse_context **_gse_ctx)
262 {
263 struct gse_context *gse_ctx;
264 OM_uint32 gss_maj, gss_min;
265 #ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
266 gss_buffer_desc empty_buffer = GSS_C_EMPTY_BUFFER;
267 gss_OID oid = discard_const(GSS_KRB5_CRED_NO_CI_FLAGS_X);
268 #endif
269 NTSTATUS status;
270
271 if (!server || !service) {
272 return NT_STATUS_INVALID_PARAMETER;
273 }
274
275 status = gse_context_init(gensec_security, do_sign, do_seal,
276 ccache_name, add_gss_c_flags,
277 &gse_ctx);
278 if (!NT_STATUS_IS_OK(status)) {
279 return NT_STATUS_NO_MEMORY;
280 }
281
282 #ifdef SAMBA4_USES_HEIMDAL
283 {
284 int ret;
285 bool set_dns_canon = gensec_setting_bool(
286 gensec_security->settings,
287 "krb5", "set_dns_canonicalize",
288 false);
289 const char *server_realm = lpcfg_realm(
290 gensec_security->settings->lp_ctx);
291 if (server_realm != NULL) {
292 ret = gsskrb5_set_default_realm(server_realm);
293 if (ret) {
294 DBG_ERR("gsskrb5_set_default_realm failed\n");
295 return NT_STATUS_INTERNAL_ERROR;
296 }
297 }
298
299 /*
300 * don't do DNS lookups of any kind, it might/will
301 * fail for a netbios name
302 */
303 ret = gsskrb5_set_dns_canonicalize(set_dns_canon);
304 if (ret != GSS_S_COMPLETE) {
305 DBG_ERR("gsskrb5_set_dns_canonicalize failed\n");
306 return NT_STATUS_INTERNAL_ERROR;
307 }
308 }
309 #endif
310
311 /* TODO: get krb5 ticket using username/password, if no valid
312 * one already available in ccache */
313
314 gss_maj = smb_gss_krb5_import_cred(&gss_min,
315 gse_ctx->k5ctx,
316 gse_ctx->ccache,
317 NULL, /* keytab_principal */
318 NULL, /* keytab */
319 &gse_ctx->creds);
320 if (gss_maj) {
321 char *ccache = NULL;
322 int kret;
323
324 kret = krb5_cc_get_full_name(gse_ctx->k5ctx,
325 gse_ctx->ccache,
326 &ccache);
327 if (kret != 0) {
328 ccache = NULL;
329 }
330
331 DEBUG(5, ("smb_gss_krb5_import_cred ccache[%s] failed with [%s] -"
332 "the caller may retry after a kinit.\n",
333 ccache, gse_errstr(gse_ctx, gss_maj, gss_min)));
334 krb5_free_string(gse_ctx->k5ctx, ccache);
335 status = NT_STATUS_INTERNAL_ERROR;
336 goto err_out;
337 }
338
339 #ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
340 /*
341 * Don't force GSS_C_CONF_FLAG and GSS_C_INTEG_FLAG.
342 *
343 * This allows us to disable SIGN and SEAL for
344 * AUTH_LEVEL_CONNECT and AUTH_LEVEL_INTEGRITY.
345 *
346 * https://groups.yahoo.com/neo/groups/cat-ietf/conversations/topics/575
347 * http://krbdev.mit.edu/rt/Ticket/Display.html?id=6938
348 */
349 gss_maj = gss_set_cred_option(&gss_min, &gse_ctx->creds,
350 oid,
351 &empty_buffer);
352 if (gss_maj) {
353 DEBUG(0, ("gss_set_cred_option(GSS_KRB5_CRED_NO_CI_FLAGS_X), "
354 "failed with [%s]\n",
355 gse_errstr(gse_ctx, gss_maj, gss_min)));
356 status = NT_STATUS_INTERNAL_ERROR;
357 goto err_out;
358 }
359 #endif
360
361 *_gse_ctx = gse_ctx;
362 return NT_STATUS_OK;
363
364 err_out:
365 TALLOC_FREE(gse_ctx);
366 return status;
367 }
368
369 static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
370 struct gensec_security *gensec_security,
371 const DATA_BLOB *token_in,
372 DATA_BLOB *token_out)
373 {
374 struct gse_context *gse_ctx =
375 talloc_get_type_abort(gensec_security->private_data,
376 struct gse_context);
377 OM_uint32 gss_maj = 0;
378 OM_uint32 gss_min;
379 gss_buffer_desc in_data;
380 gss_buffer_desc out_data;
381 DATA_BLOB blob = data_blob_null;
382 NTSTATUS status;
383 OM_uint32 time_rec = 0;
384 struct timeval tv;
385 struct cli_credentials *cli_creds = gensec_get_credentials(gensec_security);
386 const char *target_principal = gensec_get_target_principal(gensec_security);
387 const char *hostname = gensec_get_target_hostname(gensec_security);
388 const char *service = gensec_get_target_service(gensec_security);
389 const char *client_realm = cli_credentials_get_realm(cli_creds);
390 char *server_principal = NULL;
391 char *server_realm = NULL;
392 bool fallback = false;
393 OM_uint32 time_req = 0;
394
395 time_req = gensec_setting_int(gensec_security->settings,
396 "gensec_gssapi",
397 "requested_life_time",
398 time_req);
399
400 in_data.value = token_in->data;
401 in_data.length = token_in->length;
402
403 /*
404 * With credentials for administrator@FOREST1.EXAMPLE.COM this patch
405 * changes the target_principal for the ldap service of host
406 * dc2.forest2.example.com from
407 *
408 * ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM
409 *
410 * to
411 *
412 * ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM
413 *
414 * Typically ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM should be
415 * used in order to allow the KDC of FOREST1.EXAMPLE.COM to generate a
416 * referral ticket for krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM.
417 *
418 * The problem is that KDCs only return such referral tickets if
419 * there's a forest trust between FOREST1.EXAMPLE.COM and
420 * FOREST2.EXAMPLE.COM. If there's only an external domain trust
421 * between FOREST1.EXAMPLE.COM and FOREST2.EXAMPLE.COM the KDC of
422 * FOREST1.EXAMPLE.COM will respond with S_PRINCIPAL_UNKNOWN when being
423 * asked for ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM.
424 *
425 * In the case of an external trust the client can still ask explicitly
426 * for krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM and the KDC of
427 * FOREST1.EXAMPLE.COM will generate it.
428 *
429 * From there the client can use the
430 * krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM ticket and ask a KDC
431 * of FOREST2.EXAMPLE.COM for a service ticket for
432 * ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM.
433 *
434 * With Heimdal we'll get the fallback on S_PRINCIPAL_UNKNOWN behavior
435 * when we pass ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM as
436 * target principal. As _krb5_get_cred_kdc_any() first calls
437 * get_cred_kdc_referral() (which always starts with the client realm)
438 * and falls back to get_cred_kdc_capath() (which starts with the given
439 * realm).
440 *
441 * MIT krb5 only tries the given realm of the target principal, if we
442 * want to autodetect support for transitive forest trusts, would have
443 * to do the fallback ourself.
444 */
445 #ifndef SAMBA4_USES_HEIMDAL
446 if (gse_ctx->server_name == NULL) {
447 OM_uint32 gss_min2 = 0;
448
449 status = gse_setup_server_principal(mem_ctx,
450 target_principal,
451 service,
452 hostname,
453 client_realm,
454 &server_principal,
455 &gse_ctx->server_name);
456 if (!NT_STATUS_IS_OK(status)) {
457 return status;
458 }
459
460 gss_maj = gss_init_sec_context(&gss_min,
461 gse_ctx->creds,
462 &gse_ctx->gssapi_context,
463 gse_ctx->server_name,
464 &gse_ctx->gss_mech,
465 gse_ctx->gss_want_flags,
466 time_req,
467 GSS_C_NO_CHANNEL_BINDINGS,
468 &in_data,
469 NULL,
470 &out_data,
471 &gse_ctx->gss_got_flags,
472 &time_rec);
473 if (gss_maj != GSS_S_FAILURE) {
474 goto init_sec_context_done;
475 }
476 if (gss_min != (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
477 goto init_sec_context_done;
478 }
479 if (target_principal != NULL) {
480 goto init_sec_context_done;
481 }
482
483 fallback = true;
484 TALLOC_FREE(server_principal);
485 gss_release_name(&gss_min2, &gse_ctx->server_name);
486 }
487 #endif /* !SAMBA4_USES_HEIMDAL */
488
489 if (gse_ctx->server_name == NULL) {
490 server_realm = smb_krb5_get_realm_from_hostname(mem_ctx,
491 hostname,
492 client_realm);
493 if (server_realm == NULL) {
494 return NT_STATUS_NO_MEMORY;
495 }
496
497 if (fallback &&
498 strequal(client_realm, server_realm)) {
499 goto init_sec_context_done;
500 }
501
502 status = gse_setup_server_principal(mem_ctx,
503 target_principal,
504 service,
505 hostname,
506 server_realm,
507 &server_principal,
508 &gse_ctx->server_name);
509 TALLOC_FREE(server_realm);
510 if (!NT_STATUS_IS_OK(status)) {
511 return status;
512 }
513
514 TALLOC_FREE(server_principal);
515 }
516
517 gss_maj = gss_init_sec_context(&gss_min,
518 gse_ctx->creds,
519 &gse_ctx->gssapi_context,
520 gse_ctx->server_name,
521 &gse_ctx->gss_mech,
522 gse_ctx->gss_want_flags,
523 time_req, GSS_C_NO_CHANNEL_BINDINGS,
524 &in_data, NULL, &out_data,
525 &gse_ctx->gss_got_flags, &time_rec);
526 goto init_sec_context_done;
527 /* JUMP! */
528 init_sec_context_done:
529
530 switch (gss_maj) {
531 case GSS_S_COMPLETE:
532 /* we are done with it */
533 tv = timeval_current_ofs(time_rec, 0);
534 gse_ctx->expire_time = timeval_to_nttime(&tv);
535
536 status = NT_STATUS_OK;
537 break;
538 case GSS_S_CONTINUE_NEEDED:
539 /* we will need a third leg */
540 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
541 break;
542 case GSS_S_CONTEXT_EXPIRED:
543 /* Make SPNEGO ignore us, we can't go any further here */
544 DBG_NOTICE("Context expired\n");
545 status = NT_STATUS_INVALID_PARAMETER;
546 goto done;
547 case GSS_S_FAILURE:
548 switch (gss_min) {
549 case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: {
550 gss_buffer_desc name_token = {
551 .length = 0,
552 };
553
554 gss_maj = gss_display_name(&gss_min,
555 gse_ctx->server_name,
556 &name_token,
557 NULL);
558 if (gss_maj == GSS_S_COMPLETE) {
559 DBG_NOTICE("Server principal %.*s not found\n",
560 (int)name_token.length,
561 (char *)name_token.value);
562 gss_release_buffer(&gss_maj, &name_token);
563 } else {
564 DBG_NOTICE("Server principal not found\n");
565 }
566
567 /* Make SPNEGO ignore us, we can't go any further here */
568 status = NT_STATUS_INVALID_PARAMETER;
569 goto done;
570 }
571 case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED:
572 DBG_NOTICE("Ticket expired\n");
573 /* Make SPNEGO ignore us, we can't go any further here */
574 status = NT_STATUS_INVALID_PARAMETER;
575 goto done;
576 case (OM_uint32)KRB5KRB_AP_ERR_TKT_NYV:
577 DBG_NOTICE("Clockskew\n");
578 /* Make SPNEGO ignore us, we can't go any further here */
579 status = NT_STATUS_TIME_DIFFERENCE_AT_DC;
580 goto done;
581 case (OM_uint32)KRB5_KDC_UNREACH:
582 DBG_NOTICE("KDC unreachable\n");
583 /* Make SPNEGO ignore us, we can't go any further here */
584 status = NT_STATUS_NO_LOGON_SERVERS;
585 goto done;
586 case (OM_uint32)KRB5KRB_AP_ERR_MSG_TYPE:
587 /* Garbage input, possibly from the auto-mech detection */
588 status = NT_STATUS_INVALID_PARAMETER;
589 goto done;
590 case (OM_uint32)KRB5KDC_ERR_ETYPE_NOSUPP:
591 status = NT_STATUS_KDC_UNKNOWN_ETYPE;
592 goto done;
593 default:
594 DBG_ERR("gss_init_sec_context failed with [%s](%u)\n",
595 gse_errstr(talloc_tos(), gss_maj, gss_min),
596 gss_min);
597 status = NT_STATUS_LOGON_FAILURE;
598 goto done;
599 }
600 break;
601 default:
602 DBG_ERR("gss_init_sec_context failed with [%s]\n",
603 gse_errstr(talloc_tos(), gss_maj, gss_min));
604 status = NT_STATUS_INTERNAL_ERROR;
605 goto done;
606 }
607
608 /* we may be told to return nothing */
609 if (out_data.length) {
610 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
611 if (!blob.data) {
612 status = NT_STATUS_NO_MEMORY;
613 }
614
615 gss_release_buffer(&gss_min, &out_data);
616 }
617
618 done:
619 *token_out = blob;
620 return status;
621 }
622
623 static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
624 bool do_sign, bool do_seal,
625 uint32_t add_gss_c_flags,
626 struct gse_context **_gse_ctx)
627 {
628 struct gse_context *gse_ctx;
629 OM_uint32 gss_maj, gss_min;
630 krb5_error_code ret;
631 NTSTATUS status;
632
633 status = gse_context_init(mem_ctx, do_sign, do_seal,
634 NULL, add_gss_c_flags, &gse_ctx);
635 if (!NT_STATUS_IS_OK(status)) {
636 return NT_STATUS_NO_MEMORY;
637 }
638
639 ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
640 &gse_ctx->keytab);
641 if (ret) {
642 status = NT_STATUS_INTERNAL_ERROR;
643 goto done;
644 }
645
646 /* This creates a GSSAPI cred_id_t with the keytab set */
647 gss_maj = smb_gss_krb5_import_cred(&gss_min, gse_ctx->k5ctx,
648 NULL, NULL, gse_ctx->keytab,
649 &gse_ctx->creds);
650
651 if (gss_maj != 0) {
652 DEBUG(0, ("smb_gss_krb5_import_cred failed with [%s]\n",
653 gse_errstr(gse_ctx, gss_maj, gss_min)));
654 status = NT_STATUS_INTERNAL_ERROR;
655 goto done;
656 }
657
658 status = NT_STATUS_OK;
659
660 done:
661 if (!NT_STATUS_IS_OK(status)) {
662 TALLOC_FREE(gse_ctx);
663 }
664
665 *_gse_ctx = gse_ctx;
666 return status;
667 }
668
669 static NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
670 struct gensec_security *gensec_security,
671 const DATA_BLOB *token_in,
672 DATA_BLOB *token_out)
673 {
674 struct gse_context *gse_ctx =
675 talloc_get_type_abort(gensec_security->private_data,
676 struct gse_context);
677 OM_uint32 gss_maj, gss_min;
678 gss_buffer_desc in_data;
679 gss_buffer_desc out_data;
680 DATA_BLOB blob = data_blob_null;
681 NTSTATUS status;
682 OM_uint32 time_rec = 0;
683 struct timeval tv;
684
685 in_data.value = token_in->data;
686 in_data.length = token_in->length;
687
688 gss_maj = gss_accept_sec_context(&gss_min,
689 &gse_ctx->gssapi_context,
690 gse_ctx->creds,
691 &in_data,
692 GSS_C_NO_CHANNEL_BINDINGS,
693 &gse_ctx->client_name,
694 &gse_ctx->ret_mech,
695 &out_data,
696 &gse_ctx->gss_got_flags,
697 &time_rec,
698 &gse_ctx->delegated_cred_handle);
699 switch (gss_maj) {
700 case GSS_S_COMPLETE:
701 /* we are done with it */
702 tv = timeval_current_ofs(time_rec, 0);
703 gse_ctx->expire_time = timeval_to_nttime(&tv);
704
705 status = NT_STATUS_OK;
706 break;
707 case GSS_S_CONTINUE_NEEDED:
708 /* we will need a third leg */
709 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
710 break;
711 default:
712 DEBUG(1, ("gss_accept_sec_context failed with [%s]\n",
713 gse_errstr(talloc_tos(), gss_maj, gss_min)));
714
715 if (gse_ctx->gssapi_context) {
716 gss_delete_sec_context(&gss_min,
717 &gse_ctx->gssapi_context,
718 GSS_C_NO_BUFFER);
719 }
720
721 /*
722 * If we got an output token, make Windows aware of it
723 * by telling it that more processing is needed
724 */
725 if (out_data.length > 0) {
726 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
727 /* Fall through to handle the out token */
728 } else {
729 status = NT_STATUS_LOGON_FAILURE;
730 goto done;
731 }
732 }
733
734 /* we may be told to return nothing */
735 if (out_data.length) {
736 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
737 if (!blob.data) {
738 status = NT_STATUS_NO_MEMORY;
739 }
740 gss_release_buffer(&gss_min, &out_data);
741 }
742
743
744 done:
745 *token_out = blob;
746 return status;
747 }
748
749 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
750 {
751 OM_uint32 gss_min, gss_maj;
752 gss_buffer_desc msg_min;
753 gss_buffer_desc msg_maj;
754 OM_uint32 msg_ctx = 0;
755
756 char *errstr = NULL;
757
758 ZERO_STRUCT(msg_min);
759 ZERO_STRUCT(msg_maj);
760
761 gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
762 GSS_C_NO_OID, &msg_ctx, &msg_maj);
763 if (gss_maj) {
764 goto done;
765 }
766 errstr = talloc_strndup(mem_ctx,
767 (char *)msg_maj.value,
768 msg_maj.length);
769 if (!errstr) {
770 goto done;
771 }
772 gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
773 (gss_OID)discard_const(gss_mech_krb5),
774 &msg_ctx, &msg_min);
775 if (gss_maj) {
776 goto done;
777 }
778
779 errstr = talloc_strdup_append_buffer(errstr, ": ");
780 if (!errstr) {
781 goto done;
782 }
783 errstr = talloc_strndup_append_buffer(errstr,
784 (char *)msg_min.value,
785 msg_min.length);
786 if (!errstr) {
787 goto done;
788 }
789
790 done:
791 if (msg_min.value) {
792 gss_release_buffer(&gss_min, &msg_min);
793 }
794 if (msg_maj.value) {
795 gss_release_buffer(&gss_min, &msg_maj);
796 }
797 return errstr;
798 }
799
800 static NTSTATUS gensec_gse_client_start(struct gensec_security *gensec_security)
801 {
802 struct gse_context *gse_ctx;
803 struct cli_credentials *creds = gensec_get_credentials(gensec_security);
804 NTSTATUS nt_status;
805 OM_uint32 want_flags = 0;
806 bool do_sign = false, do_seal = false;
807 const char *hostname = gensec_get_target_hostname(gensec_security);
808 const char *service = gensec_get_target_service(gensec_security);
809 const char *username = cli_credentials_get_username(creds);
810 const char *password = cli_credentials_get_password(creds);
811 const char *realm = cli_credentials_get_realm(creds);
812
813 if (!hostname) {
814 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
815 return NT_STATUS_INVALID_PARAMETER;
816 }
817 if (is_ipaddress(hostname)) {
818 DEBUG(2, ("Cannot do GSE to an IP address\n"));
819 return NT_STATUS_INVALID_PARAMETER;
820 }
821 if (strcmp(hostname, "localhost") == 0) {
822 DEBUG(2, ("GSE to 'localhost' does not make sense\n"));
823 return NT_STATUS_INVALID_PARAMETER;
824 }
825
826 if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
827 do_sign = true;
828 }
829 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
830 do_sign = true;
831 }
832 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
833 do_seal = true;
834 }
835 if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
836 want_flags |= GSS_C_DCE_STYLE;
837 }
838
839 nt_status = gse_init_client(gensec_security, do_sign, do_seal, NULL,
840 hostname, service, realm,
841 username, password, want_flags,
842 &gse_ctx);
843 if (!NT_STATUS_IS_OK(nt_status)) {
844 return nt_status;
845 }
846 gensec_security->private_data = gse_ctx;
847 return NT_STATUS_OK;
848 }
849
850 static NTSTATUS gensec_gse_server_start(struct gensec_security *gensec_security)
851 {
852 struct gse_context *gse_ctx;
853 NTSTATUS nt_status;
854 OM_uint32 want_flags = 0;
855 bool do_sign = false, do_seal = false;
856
857 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
858 do_sign = true;
859 }
860 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
861 do_seal = true;
862 }
863 if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
864 want_flags |= GSS_C_DCE_STYLE;
865 }
866
867 nt_status = gse_init_server(gensec_security, do_sign, do_seal, want_flags,
868 &gse_ctx);
869 if (!NT_STATUS_IS_OK(nt_status)) {
870 return nt_status;
871 }
872 gensec_security->private_data = gse_ctx;
873 return NT_STATUS_OK;
874 }
875
876 struct gensec_gse_update_state {
877 NTSTATUS status;
878 DATA_BLOB out;
879 };
880
881 static NTSTATUS gensec_gse_update_internal(struct gensec_security *gensec_security,
882 TALLOC_CTX *mem_ctx,
883 const DATA_BLOB in,
884 DATA_BLOB *out);
885
886 static struct tevent_req *gensec_gse_update_send(TALLOC_CTX *mem_ctx,
887 struct tevent_context *ev,
888 struct gensec_security *gensec_security,
889 const DATA_BLOB in)
890 {
891 struct tevent_req *req = NULL;
892 struct gensec_gse_update_state *state = NULL;
893 NTSTATUS status;
894
895 req = tevent_req_create(mem_ctx, &state,
896 struct gensec_gse_update_state);
897 if (req == NULL) {
898 return NULL;
899 }
900
901 status = gensec_gse_update_internal(gensec_security,
902 state, in,
903 &state->out);
904 state->status = status;
905 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
906 tevent_req_done(req);
907 return tevent_req_post(req, ev);
908 }
909 if (tevent_req_nterror(req, status)) {
910 return tevent_req_post(req, ev);
911 }
912
913 tevent_req_done(req);
914 return tevent_req_post(req, ev);
915 }
916
917 static NTSTATUS gensec_gse_update_internal(struct gensec_security *gensec_security,
918 TALLOC_CTX *mem_ctx,
919 const DATA_BLOB in,
920 DATA_BLOB *out)
921 {
922 NTSTATUS status;
923
924 switch (gensec_security->gensec_role) {
925 case GENSEC_CLIENT:
926 status = gse_get_client_auth_token(mem_ctx,
927 gensec_security,
928 &in, out);
929 break;
930 case GENSEC_SERVER:
931 status = gse_get_server_auth_token(mem_ctx,
932 gensec_security,
933 &in, out);
934 break;
935 }
936 if (!NT_STATUS_IS_OK(status)) {
937 return status;
938 }
939
940 return NT_STATUS_OK;
941 }
942
943 static NTSTATUS gensec_gse_update_recv(struct tevent_req *req,
944 TALLOC_CTX *out_mem_ctx,
945 DATA_BLOB *out)
946 {
947 struct gensec_gse_update_state *state =
948 tevent_req_data(req,
949 struct gensec_gse_update_state);
950 NTSTATUS status;
951
952 *out = data_blob_null;
953
954 if (tevent_req_is_nterror(req, &status)) {
955 tevent_req_received(req);
956 return status;
957 }
958
959 *out = state->out;
960 talloc_steal(out_mem_ctx, state->out.data);
961 status = state->status;
962 tevent_req_received(req);
963 return status;
964 }
965
966 static NTSTATUS gensec_gse_wrap(struct gensec_security *gensec_security,
967 TALLOC_CTX *mem_ctx,
968 const DATA_BLOB *in,
969 DATA_BLOB *out)
970 {
971 struct gse_context *gse_ctx =
972 talloc_get_type_abort(gensec_security->private_data,
973 struct gse_context);
974 OM_uint32 maj_stat, min_stat;
975 gss_buffer_desc input_token, output_token;
976 int conf_state;
977 input_token.length = in->length;
978 input_token.value = in->data;
979
980 maj_stat = gss_wrap(&min_stat,
981 gse_ctx->gssapi_context,
982 gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
983 GSS_C_QOP_DEFAULT,
984 &input_token,
985 &conf_state,
986 &output_token);
987 if (GSS_ERROR(maj_stat)) {
988 DEBUG(0, ("gensec_gse_wrap: GSS Wrap failed: %s\n",
989 gse_errstr(talloc_tos(), maj_stat, min_stat)));
990 return NT_STATUS_ACCESS_DENIED;
991 }
992
993 *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
994 gss_release_buffer(&min_stat, &output_token);
995
996 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
997 && !conf_state) {
998 return NT_STATUS_ACCESS_DENIED;
999 }
1000 return NT_STATUS_OK;
1001 }
1002
1003 static NTSTATUS gensec_gse_unwrap(struct gensec_security *gensec_security,
1004 TALLOC_CTX *mem_ctx,
1005 const DATA_BLOB *in,
1006 DATA_BLOB *out)
1007 {
1008 struct gse_context *gse_ctx =
1009 talloc_get_type_abort(gensec_security->private_data,
1010 struct gse_context);
1011 OM_uint32 maj_stat, min_stat;
1012 gss_buffer_desc input_token, output_token;
1013 int conf_state;
1014 gss_qop_t qop_state;
1015 input_token.length = in->length;
1016 input_token.value = in->data;
1017
1018 maj_stat = gss_unwrap(&min_stat,
1019 gse_ctx->gssapi_context,
1020 &input_token,
1021 &output_token,
1022 &conf_state,
1023 &qop_state);
1024 if (GSS_ERROR(maj_stat)) {
1025 DEBUG(0, ("gensec_gse_unwrap: GSS UnWrap failed: %s\n",
1026 gse_errstr(talloc_tos(), maj_stat, min_stat)));
1027 return NT_STATUS_ACCESS_DENIED;
1028 }
1029
1030 *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
1031 gss_release_buffer(&min_stat, &output_token);
1032
1033 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
1034 && !conf_state) {
1035 return NT_STATUS_ACCESS_DENIED;
1036 }
1037 return NT_STATUS_OK;
1038 }
1039
1040 static NTSTATUS gensec_gse_seal_packet(struct gensec_security *gensec_security,
1041 TALLOC_CTX *mem_ctx,
1042 uint8_t *data, size_t length,
1043 const uint8_t *whole_pdu, size_t pdu_length,
1044 DATA_BLOB *sig)
1045 {
1046 struct gse_context *gse_ctx =
1047 talloc_get_type_abort(gensec_security->private_data,
1048 struct gse_context);
1049 bool hdr_signing = false;
1050 size_t sig_size = 0;
1051 NTSTATUS status;
1052
1053 if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1054 hdr_signing = true;
1055 }
1056
1057 sig_size = gensec_gse_sig_size(gensec_security, length);
1058
1059 status = gssapi_seal_packet(gse_ctx->gssapi_context,
1060 &gse_ctx->gss_mech,
1061 hdr_signing, sig_size,
1062 data, length,
1063 whole_pdu, pdu_length,
1064 mem_ctx, sig);
1065 if (!NT_STATUS_IS_OK(status)) {
1066 DEBUG(0, ("gssapi_seal_packet(hdr_signing=%u,sig_size=%zu,"
1067 "data=%zu,pdu=%zu) failed: %s\n",
1068 hdr_signing, sig_size, length, pdu_length,
1069 nt_errstr(status)));
1070 return status;
1071 }
1072
1073 return NT_STATUS_OK;
1074 }
1075
1076 static NTSTATUS gensec_gse_unseal_packet(struct gensec_security *gensec_security,
1077 uint8_t *data, size_t length,
1078 const uint8_t *whole_pdu, size_t pdu_length,
1079 const DATA_BLOB *sig)
1080 {
1081 struct gse_context *gse_ctx =
1082 talloc_get_type_abort(gensec_security->private_data,
1083 struct gse_context);
1084 bool hdr_signing = false;
1085 NTSTATUS status;
1086
1087 if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1088 hdr_signing = true;
1089 }
1090
1091 status = gssapi_unseal_packet(gse_ctx->gssapi_context,
1092 &gse_ctx->gss_mech,
1093 hdr_signing,
1094 data, length,
1095 whole_pdu, pdu_length,
1096 sig);
1097 if (!NT_STATUS_IS_OK(status)) {
1098 DEBUG(0, ("gssapi_unseal_packet(hdr_signing=%u,sig_size=%zu,"
1099 "data=%zu,pdu=%zu) failed: %s\n",
1100 hdr_signing, sig->length, length, pdu_length,
1101 nt_errstr(status)));
1102 return status;
1103 }
1104
1105 return NT_STATUS_OK;
1106 }
1107
1108 static NTSTATUS gensec_gse_sign_packet(struct gensec_security *gensec_security,
1109 TALLOC_CTX *mem_ctx,
1110 const uint8_t *data, size_t length,
1111 const uint8_t *whole_pdu, size_t pdu_length,
1112 DATA_BLOB *sig)
1113 {
1114 struct gse_context *gse_ctx =
1115 talloc_get_type_abort(gensec_security->private_data,
1116 struct gse_context);
1117 bool hdr_signing = false;
1118 NTSTATUS status;
1119
1120 if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1121 hdr_signing = true;
1122 }
1123
1124 status = gssapi_sign_packet(gse_ctx->gssapi_context,
1125 &gse_ctx->gss_mech,
1126 hdr_signing,
1127 data, length,
1128 whole_pdu, pdu_length,
1129 mem_ctx, sig);
1130 if (!NT_STATUS_IS_OK(status)) {
1131 DEBUG(0, ("gssapi_sign_packet(hdr_signing=%u,"
1132 "data=%zu,pdu=%zu) failed: %s\n",
1133 hdr_signing, length, pdu_length,
1134 nt_errstr(status)));
1135 return status;
1136 }
1137
1138 return NT_STATUS_OK;
1139 }
1140
1141 static NTSTATUS gensec_gse_check_packet(struct gensec_security *gensec_security,
1142 const uint8_t *data, size_t length,
1143 const uint8_t *whole_pdu, size_t pdu_length,
1144 const DATA_BLOB *sig)
1145 {
1146 struct gse_context *gse_ctx =
1147 talloc_get_type_abort(gensec_security->private_data,
1148 struct gse_context);
1149 bool hdr_signing = false;
1150 NTSTATUS status;
1151
1152 if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1153 hdr_signing = true;
1154 }
1155
1156 status = gssapi_check_packet(gse_ctx->gssapi_context,
1157 &gse_ctx->gss_mech,
1158 hdr_signing,
1159 data, length,
1160 whole_pdu, pdu_length,
1161 sig);
1162 if (!NT_STATUS_IS_OK(status)) {
1163 DEBUG(0, ("gssapi_check_packet(hdr_signing=%u,sig_size=%zu"
1164 "data=%zu,pdu=%zu) failed: %s\n",
1165 hdr_signing, sig->length, length, pdu_length,
1166 nt_errstr(status)));
1167 return status;
1168 }
1169
1170 return NT_STATUS_OK;
1171 }
1172
1173 /* Try to figure out what features we actually got on the connection */
1174 static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
1175 uint32_t feature)
1176 {
1177 struct gse_context *gse_ctx =
1178 talloc_get_type_abort(gensec_security->private_data,
1179 struct gse_context);
1180
1181 if (feature & GENSEC_FEATURE_SESSION_KEY) {
1182 return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
1183 }
1184 if (feature & GENSEC_FEATURE_SIGN) {
1185 return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
1186 }
1187 if (feature & GENSEC_FEATURE_SEAL) {
1188 return gse_ctx->gss_got_flags & GSS_C_CONF_FLAG;
1189 }
1190 if (feature & GENSEC_FEATURE_DCE_STYLE) {
1191 return gse_ctx->gss_got_flags & GSS_C_DCE_STYLE;
1192 }
1193 if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
1194 NTSTATUS status;
1195 uint32_t keytype;
1196
1197 if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
1198 return false;
1199 }
1200
1201 status = gssapi_get_session_key(talloc_tos(),
1202 gse_ctx->gssapi_context, NULL, &keytype);
1203 /*
1204 * We should do a proper sig on the mechListMic unless
1205 * we know we have to be backwards compatible with
1206 * earlier windows versions.
1207 *
1208 * Negotiating a non-krb5
1209 * mech for example should be regarded as having
1210 * NEW_SPNEGO
1211 */
1212 if (NT_STATUS_IS_OK(status)) {
1213 switch (keytype) {
1214 case ENCTYPE_DES_CBC_CRC:
1215 case ENCTYPE_DES_CBC_MD5:
1216 case ENCTYPE_ARCFOUR_HMAC:
1217 case ENCTYPE_DES3_CBC_SHA1:
1218 return false;
1219 }
1220 }
1221 return true;
1222 }
1223 /* We can always do async (rather than strict request/reply) packets. */
1224 if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
1225 return true;
1226 }
1227 if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1228 return true;
1229 }
1230 return false;
1231 }
1232
1233 static NTTIME gensec_gse_expire_time(struct gensec_security *gensec_security)
1234 {
1235 struct gse_context *gse_ctx =
1236 talloc_get_type_abort(gensec_security->private_data,
1237 struct gse_context);
1238
1239 return gse_ctx->expire_time;
1240 }
1241
1242 /*
1243 * Extract the 'session key' needed by SMB signing and ncacn_np
1244 * (for encrypting some passwords).
1245 *
1246 * This breaks all the abstractions, but what do you expect...
1247 */
1248 static NTSTATUS gensec_gse_session_key(struct gensec_security *gensec_security,
1249 TALLOC_CTX *mem_ctx,
1250 DATA_BLOB *session_key)
1251 {
1252 struct gse_context *gse_ctx =
1253 talloc_get_type_abort(gensec_security->private_data,
1254 struct gse_context);
1255
1256 return gssapi_get_session_key(mem_ctx, gse_ctx->gssapi_context, session_key, NULL);
1257 }
1258
1259 /* Get some basic (and authorization) information about the user on
1260 * this session. This uses either the PAC (if present) or a local
1261 * database lookup */
1262 static NTSTATUS gensec_gse_session_info(struct gensec_security *gensec_security,
1263 TALLOC_CTX *mem_ctx,
1264 struct auth_session_info **_session_info)
1265 {
1266 struct gse_context *gse_ctx =
1267 talloc_get_type_abort(gensec_security->private_data,
1268 struct gse_context);
1269 NTSTATUS nt_status;
1270 TALLOC_CTX *tmp_ctx;
1271 struct auth_session_info *session_info = NULL;
1272 OM_uint32 maj_stat, min_stat;
1273 DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
1274
1275 gss_buffer_desc name_token;
1276 char *principal_string;
1277
1278 tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gse_session_info context");
1279 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1280
1281 maj_stat = gss_display_name(&min_stat,
1282 gse_ctx->client_name,
1283 &name_token,
1284 NULL);
1285 if (GSS_ERROR(maj_stat)) {
1286 DEBUG(1, ("GSS display_name failed: %s\n",
1287 gse_errstr(talloc_tos(), maj_stat, min_stat)));
1288 talloc_free(tmp_ctx);
1289 return NT_STATUS_FOOBAR;
1290 }
1291
1292 principal_string = talloc_strndup(tmp_ctx,
1293 (const char *)name_token.value,
1294 name_token.length);
1295
1296 gss_release_buffer(&min_stat, &name_token);
1297
1298 if (!principal_string) {
1299 talloc_free(tmp_ctx);
1300 return NT_STATUS_NO_MEMORY;
1301 }
1302
1303 nt_status = gssapi_obtain_pac_blob(tmp_ctx, gse_ctx->gssapi_context,
1304 gse_ctx->client_name,
1305 &pac_blob);
1306
1307 /* IF we have the PAC - otherwise we need to get this
1308 * data from elsewhere
1309 */
1310 if (NT_STATUS_IS_OK(nt_status)) {
1311 pac_blob_ptr = &pac_blob;
1312 }
1313 nt_status = gensec_generate_session_info_pac(tmp_ctx,
1314 gensec_security,
1315 NULL,
1316 pac_blob_ptr, principal_string,
1317 gensec_get_remote_address(gensec_security),
1318 &session_info);
1319 if (!NT_STATUS_IS_OK(nt_status)) {
1320 talloc_free(tmp_ctx);
1321 return nt_status;
1322 }
1323
1324 nt_status = gensec_gse_session_key(gensec_security, session_info,
1325 &session_info->session_key);
1326 if (!NT_STATUS_IS_OK(nt_status)) {
1327 talloc_free(tmp_ctx);
1328 return nt_status;
1329 }
1330
1331 *_session_info = talloc_move(mem_ctx, &session_info);
1332 talloc_free(tmp_ctx);
1333
1334 return NT_STATUS_OK;
1335 }
1336
1337 static size_t gensec_gse_max_input_size(struct gensec_security *gensec_security)
1338 {
1339 struct gse_context *gse_ctx =
1340 talloc_get_type_abort(gensec_security->private_data,
1341 struct gse_context);
1342 OM_uint32 maj_stat, min_stat;
1343 OM_uint32 max_input_size;
1344
1345 maj_stat = gss_wrap_size_limit(&min_stat,
1346 gse_ctx->gssapi_context,
1347 gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
1348 GSS_C_QOP_DEFAULT,
1349 gse_ctx->max_wrap_buf_size,
1350 &max_input_size);
1351 if (GSS_ERROR(maj_stat)) {
1352 TALLOC_CTX *mem_ctx = talloc_new(NULL);
1353 DEBUG(1, ("gensec_gssapi_max_input_size: determining signature size with gss_wrap_size_limit failed: %s\n",
1354 gse_errstr(mem_ctx, maj_stat, min_stat)));
1355 talloc_free(mem_ctx);
1356 return 0;
1357 }
1358
1359 return max_input_size;
1360 }
1361
1362 /* Find out the maximum output size negotiated on this connection */
1363 static size_t gensec_gse_max_wrapped_size(struct gensec_security *gensec_security)
1364 {
1365 struct gse_context *gse_ctx =
1366 talloc_get_type_abort(gensec_security->private_data,
1367 struct gse_context);
1368 return gse_ctx->max_wrap_buf_size;
1369 }
1370
1371 static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
1372 size_t data_size)
1373 {
1374 struct gse_context *gse_ctx =
1375 talloc_get_type_abort(gensec_security->private_data,
1376 struct gse_context);
1377
1378 if (gse_ctx->sig_size > 0) {
1379 return gse_ctx->sig_size;
1380 }
1381
1382 gse_ctx->sig_size = gssapi_get_sig_size(gse_ctx->gssapi_context,
1383 &gse_ctx->gss_mech,
1384 gse_ctx->gss_got_flags,
1385 data_size);
1386 return gse_ctx->sig_size;
1387 }
1388
1389 static const char *gensec_gse_final_auth_type(struct gensec_security *gensec_security)
1390 {
1391 struct gse_context *gse_ctx =
1392 talloc_get_type_abort(gensec_security->private_data,
1393 struct gse_context);
1394
1395 /* Only return the string for GSSAPI/Krb5 */
1396 if (smb_gss_oid_equal(&gse_ctx->gss_mech,
1397 gss_mech_krb5)) {
1398 return GENSEC_FINAL_AUTH_TYPE_KRB5;
1399 } else {
1400 return "gensec_gse: UNKNOWN MECH";
1401 }
1402 }
1403
1404 static const char *gensec_gse_krb5_oids[] = {
1405 GENSEC_OID_KERBEROS5_OLD,
1406 GENSEC_OID_KERBEROS5,
1407 NULL
1408 };
1409
1410 const struct gensec_security_ops gensec_gse_krb5_security_ops = {
1411 .name = "gse_krb5",
1412 .auth_type = DCERPC_AUTH_TYPE_KRB5,
1413 .oid = gensec_gse_krb5_oids,
1414 .client_start = gensec_gse_client_start,
1415 .server_start = gensec_gse_server_start,
1416 .magic = gensec_magic_check_krb5_oid,
1417 .update_send = gensec_gse_update_send,
1418 .update_recv = gensec_gse_update_recv,
1419 .session_key = gensec_gse_session_key,
1420 .session_info = gensec_gse_session_info,
1421 .sig_size = gensec_gse_sig_size,
1422 .sign_packet = gensec_gse_sign_packet,
1423 .check_packet = gensec_gse_check_packet,
1424 .seal_packet = gensec_gse_seal_packet,
1425 .unseal_packet = gensec_gse_unseal_packet,
1426 .max_input_size = gensec_gse_max_input_size,
1427 .max_wrapped_size = gensec_gse_max_wrapped_size,
1428 .wrap = gensec_gse_wrap,
1429 .unwrap = gensec_gse_unwrap,
1430 .have_feature = gensec_gse_have_feature,
1431 .expire_time = gensec_gse_expire_time,
1432 .final_auth_type = gensec_gse_final_auth_type,
1433 .enabled = true,
1434 .kerberos = true,
1435 .priority = GENSEC_GSSAPI
1436 };
1437
1438 #endif /* HAVE_KRB5 */
Samba GIT mirror