?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:gse: fix debug message in gse_get_server_auth_token()
[Samba.git] / source3 / librpc / crypto / gse.c
blobe2a84c19b58b4b50b3dff24823fd73de09476ab0
1 /*
2 * GSSAPI Security Extensions
3 * RPC Pipe client and server routines
4 * Copyright (C) Simo Sorce 2010.
5 * Copyright (C) Andrew Bartlett 2004-2011.
6 * Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 /* We support only GSSAPI/KRB5 here */
23
24 #include "includes.h"
25 #include "gse.h"
26 #include "libads/kerberos_proto.h"
27 #include "auth/common_auth.h"
28 #include "auth/gensec/gensec.h"
29 #include "auth/credentials/credentials.h"
30 #include "../librpc/gen_ndr/dcerpc.h"
31 #include "lib/util/asn1.h"
32
33 #if defined(HAVE_KRB5)
34
35 #include "smb_krb5.h"
36 #include "gse_krb5.h"
37
38 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
39
40 struct gse_context {
41 gss_ctx_id_t gssapi_context;
42 gss_name_t server_name;
43 gss_name_t client_name;
44 OM_uint32 gss_want_flags, gss_got_flags;
45
46 gss_cred_id_t delegated_cred_handle;
47
48 /* gensec_gse only */
49 krb5_context k5ctx;
50 krb5_ccache ccache;
51 krb5_keytab keytab;
52
53 gss_OID_desc gss_mech;
54 gss_cred_id_t creds;
55
56 gss_OID ret_mech;
57 };
58
59 #ifndef HAVE_GSS_OID_EQUAL
60
61 static bool gss_oid_equal(const gss_OID o1, const gss_OID o2)
62 {
63 if (o1 == o2) {
64 return true;
65 }
66 if ((o1 == NULL && o2 != NULL) || (o1 != NULL && o2 == NULL)) {
67 return false;
68 }
69 if (o1->length != o2->length) {
70 return false;
71 }
72 return memcmp(o1->elements, o2->elements, o1->length) == false;
73 }
74
75 #endif
76
77 /* free non talloc dependent contexts */
78 static int gse_context_destructor(void *ptr)
79 {
80 struct gse_context *gse_ctx;
81 OM_uint32 gss_min;
82
83 gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
84 if (gse_ctx->k5ctx) {
85 if (gse_ctx->ccache) {
86 krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
87 gse_ctx->ccache = NULL;
88 }
89 if (gse_ctx->keytab) {
90 krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
91 gse_ctx->keytab = NULL;
92 }
93 krb5_free_context(gse_ctx->k5ctx);
94 gse_ctx->k5ctx = NULL;
95 }
96 if (gse_ctx->gssapi_context != GSS_C_NO_CONTEXT) {
97 (void)gss_delete_sec_context(&gss_min,
98 &gse_ctx->gssapi_context,
99 GSS_C_NO_BUFFER);
100 }
101 if (gse_ctx->server_name) {
102 (void)gss_release_name(&gss_min,
103 &gse_ctx->server_name);
104 }
105 if (gse_ctx->client_name) {
106 (void)gss_release_name(&gss_min,
107 &gse_ctx->client_name);
108 }
109 if (gse_ctx->creds) {
110 (void)gss_release_cred(&gss_min,
111 &gse_ctx->creds);
112 }
113 if (gse_ctx->delegated_cred_handle) {
114 (void)gss_release_cred(&gss_min,
115 &gse_ctx->delegated_cred_handle);
116 }
117
118 /* MIT and Heimdal differ as to if you can call
119 * gss_release_oid() on this OID, generated by
120 * gss_{accept,init}_sec_context(). However, as long as the
121 * oid is gss_mech_krb5 (which it always is at the moment),
122 * then this is a moot point, as both declare this particular
123 * OID static, and so no memory is lost. This assert is in
124 * place to ensure that the programmer who wishes to extend
125 * this code to EAP or other GSS mechanisms determines an
126 * implementation-dependent way of releasing any dynamically
127 * allocated OID */
128 SMB_ASSERT(gss_oid_equal(&gse_ctx->gss_mech, GSS_C_NO_OID) || gss_oid_equal(&gse_ctx->gss_mech, gss_mech_krb5));
129
130 return 0;
131 }
132
133 static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
134 bool do_sign, bool do_seal,
135 const char *ccache_name,
136 uint32_t add_gss_c_flags,
137 struct gse_context **_gse_ctx)
138 {
139 struct gse_context *gse_ctx;
140 krb5_error_code k5ret;
141 NTSTATUS status;
142
143 gse_ctx = talloc_zero(mem_ctx, struct gse_context);
144 if (!gse_ctx) {
145 return NT_STATUS_NO_MEMORY;
146 }
147 talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
148
149 memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
150
151 gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
152 GSS_C_DELEG_FLAG |
153 GSS_C_DELEG_POLICY_FLAG |
154 GSS_C_REPLAY_FLAG |
155 GSS_C_SEQUENCE_FLAG;
156 if (do_sign) {
157 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
158 }
159 if (do_seal) {
160 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
161 gse_ctx->gss_want_flags |= GSS_C_CONF_FLAG;
162 }
163
164 gse_ctx->gss_want_flags |= add_gss_c_flags;
165
166 /* Initialize Kerberos Context */
167 initialize_krb5_error_table();
168
169 k5ret = krb5_init_context(&gse_ctx->k5ctx);
170 if (k5ret) {
171 DEBUG(0, ("Failed to initialize kerberos context! (%s)\n",
172 error_message(k5ret)));
173 status = NT_STATUS_INTERNAL_ERROR;
174 goto err_out;
175 }
176
177 if (!ccache_name) {
178 ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
179 }
180 k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
181 &gse_ctx->ccache);
182 if (k5ret) {
183 DEBUG(1, ("Failed to resolve credential cache! (%s)\n",
184 error_message(k5ret)));
185 status = NT_STATUS_INTERNAL_ERROR;
186 goto err_out;
187 }
188
189 /* TODO: Should we enforce a enc_types list ?
190 ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
191 */
192
193 *_gse_ctx = gse_ctx;
194 return NT_STATUS_OK;
195
196 err_out:
197 TALLOC_FREE(gse_ctx);
198 return status;
199 }
200
201 static NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
202 bool do_sign, bool do_seal,
203 const char *ccache_name,
204 const char *server,
205 const char *service,
206 const char *username,
207 const char *password,
208 uint32_t add_gss_c_flags,
209 struct gse_context **_gse_ctx)
210 {
211 struct gse_context *gse_ctx;
212 OM_uint32 gss_maj, gss_min;
213 gss_buffer_desc name_buffer = {0, NULL};
214 gss_OID_set_desc mech_set;
215 NTSTATUS status;
216
217 if (!server || !service) {
218 return NT_STATUS_INVALID_PARAMETER;
219 }
220
221 status = gse_context_init(mem_ctx, do_sign, do_seal,
222 ccache_name, add_gss_c_flags,
223 &gse_ctx);
224 if (!NT_STATUS_IS_OK(status)) {
225 return NT_STATUS_NO_MEMORY;
226 }
227
228 /* Guess the realm based on the supplied service, and avoid the GSS libs
229 doing DNS lookups which may fail.
230
231 TODO: Loop with the KDC on some more combinations (local
232 realm in particular), possibly falling back to
233 GSS_C_NT_HOSTBASED_SERVICE
234 */
235 name_buffer.value = kerberos_get_principal_from_service_hostname(gse_ctx,
236 service, server);
237 if (!name_buffer.value) {
238 status = NT_STATUS_NO_MEMORY;
239 goto err_out;
240 }
241 name_buffer.length = strlen((char *)name_buffer.value);
242 gss_maj = gss_import_name(&gss_min, &name_buffer,
243 GSS_C_NT_USER_NAME,
244 &gse_ctx->server_name);
245 if (gss_maj) {
246 DEBUG(0, ("gss_import_name failed for %s, with [%s]\n",
247 (char *)name_buffer.value,
248 gse_errstr(gse_ctx, gss_maj, gss_min)));
249 status = NT_STATUS_INTERNAL_ERROR;
250 goto err_out;
251 }
252
253 /* TODO: get krb5 ticket using username/password, if no valid
254 * one already available in ccache */
255
256 mech_set.count = 1;
257 mech_set.elements = &gse_ctx->gss_mech;
258
259 gss_maj = gss_acquire_cred(&gss_min,
260 GSS_C_NO_NAME,
261 GSS_C_INDEFINITE,
262 &mech_set,
263 GSS_C_INITIATE,
264 &gse_ctx->creds,
265 NULL, NULL);
266 if (gss_maj) {
267 DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n",
268 (char *)name_buffer.value,
269 gse_errstr(gse_ctx, gss_maj, gss_min)));
270 status = NT_STATUS_INTERNAL_ERROR;
271 goto err_out;
272 }
273
274 *_gse_ctx = gse_ctx;
275 TALLOC_FREE(name_buffer.value);
276 return NT_STATUS_OK;
277
278 err_out:
279 TALLOC_FREE(name_buffer.value);
280 TALLOC_FREE(gse_ctx);
281 return status;
282 }
283
284 static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
285 struct gse_context *gse_ctx,
286 const DATA_BLOB *token_in,
287 DATA_BLOB *token_out)
288 {
289 OM_uint32 gss_maj, gss_min;
290 gss_buffer_desc in_data;
291 gss_buffer_desc out_data;
292 DATA_BLOB blob = data_blob_null;
293 NTSTATUS status;
294
295 in_data.value = token_in->data;
296 in_data.length = token_in->length;
297
298 gss_maj = gss_init_sec_context(&gss_min,
299 gse_ctx->creds,
300 &gse_ctx->gssapi_context,
301 gse_ctx->server_name,
302 &gse_ctx->gss_mech,
303 gse_ctx->gss_want_flags,
304 0, GSS_C_NO_CHANNEL_BINDINGS,
305 &in_data, NULL, &out_data,
306 &gse_ctx->gss_got_flags, NULL);
307 switch (gss_maj) {
308 case GSS_S_COMPLETE:
309 /* we are done with it */
310 status = NT_STATUS_OK;
311 break;
312 case GSS_S_CONTINUE_NEEDED:
313 /* we will need a third leg */
314 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
315 break;
316 default:
317 DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
318 gse_errstr(talloc_tos(), gss_maj, gss_min)));
319 status = NT_STATUS_INTERNAL_ERROR;
320 goto done;
321 }
322
323 /* we may be told to return nothing */
324 if (out_data.length) {
325 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
326 if (!blob.data) {
327 status = NT_STATUS_NO_MEMORY;
328 }
329
330 gss_maj = gss_release_buffer(&gss_min, &out_data);
331 }
332
333 done:
334 *token_out = blob;
335 return status;
336 }
337
338 static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
339 bool do_sign, bool do_seal,
340 uint32_t add_gss_c_flags,
341 struct gse_context **_gse_ctx)
342 {
343 struct gse_context *gse_ctx;
344 OM_uint32 gss_maj, gss_min;
345 krb5_error_code ret;
346 NTSTATUS status;
347
348 status = gse_context_init(mem_ctx, do_sign, do_seal,
349 NULL, add_gss_c_flags, &gse_ctx);
350 if (!NT_STATUS_IS_OK(status)) {
351 return NT_STATUS_NO_MEMORY;
352 }
353
354 ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
355 &gse_ctx->keytab);
356 if (ret) {
357 status = NT_STATUS_INTERNAL_ERROR;
358 goto done;
359 }
360
361 #ifdef HAVE_GSS_KRB5_IMPORT_CRED
362
363 /* This creates a GSSAPI cred_id_t with the keytab set */
364 gss_maj = gss_krb5_import_cred(&gss_min, NULL, NULL, gse_ctx->keytab,
365 &gse_ctx->creds);
366
367 if (gss_maj != 0
368 && gss_maj != (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME)) {
369 DEBUG(0, ("gss_krb5_import_cred failed with [%s]\n",
370 gse_errstr(gse_ctx, gss_maj, gss_min)));
371 status = NT_STATUS_INTERNAL_ERROR;
372 goto done;
373
374 /* This is the error the MIT krb5 1.9 gives when it
375 * implements the function, but we do not specify the
376 * principal. However, when we specify the principal
377 * as host$@REALM the GSS acceptor fails with 'wrong
378 * principal in request'. Work around the issue by
379 * falling back to the alternate approach below. */
380 } else if (gss_maj == (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME))
381 #endif
382 /* FIXME!!!
383 * This call sets the default keytab for the whole server, not
384 * just for this context. Need to find a way that does not alter
385 * the state of the whole server ... */
386 {
387 const char *ktname;
388 gss_OID_set_desc mech_set;
389
390 ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx,
391 gse_ctx->keytab, &ktname);
392 if (ret) {
393 status = NT_STATUS_INTERNAL_ERROR;
394 goto done;
395 }
396
397 ret = gsskrb5_register_acceptor_identity(ktname);
398 if (ret) {
399 status = NT_STATUS_INTERNAL_ERROR;
400 goto done;
401 }
402
403 mech_set.count = 1;
404 mech_set.elements = &gse_ctx->gss_mech;
405
406 gss_maj = gss_acquire_cred(&gss_min,
407 GSS_C_NO_NAME,
408 GSS_C_INDEFINITE,
409 &mech_set,
410 GSS_C_ACCEPT,
411 &gse_ctx->creds,
412 NULL, NULL);
413
414 if (gss_maj) {
415 DEBUG(0, ("gss_acquire_creds failed with [%s]\n",
416 gse_errstr(gse_ctx, gss_maj, gss_min)));
417 status = NT_STATUS_INTERNAL_ERROR;
418 goto done;
419 }
420 }
421
422 status = NT_STATUS_OK;
423
424 done:
425 if (!NT_STATUS_IS_OK(status)) {
426 TALLOC_FREE(gse_ctx);
427 }
428
429 *_gse_ctx = gse_ctx;
430 return status;
431 }
432
433 static NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
434 struct gse_context *gse_ctx,
435 const DATA_BLOB *token_in,
436 DATA_BLOB *token_out)
437 {
438 OM_uint32 gss_maj, gss_min;
439 gss_buffer_desc in_data;
440 gss_buffer_desc out_data;
441 DATA_BLOB blob = data_blob_null;
442 NTSTATUS status;
443
444 in_data.value = token_in->data;
445 in_data.length = token_in->length;
446
447 gss_maj = gss_accept_sec_context(&gss_min,
448 &gse_ctx->gssapi_context,
449 gse_ctx->creds,
450 &in_data,
451 GSS_C_NO_CHANNEL_BINDINGS,
452 &gse_ctx->client_name,
453 &gse_ctx->ret_mech,
454 &out_data,
455 &gse_ctx->gss_got_flags, NULL,
456 &gse_ctx->delegated_cred_handle);
457 switch (gss_maj) {
458 case GSS_S_COMPLETE:
459 /* we are done with it */
460 status = NT_STATUS_OK;
461 break;
462 case GSS_S_CONTINUE_NEEDED:
463 /* we will need a third leg */
464 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
465 break;
466 default:
467 DEBUG(1, ("gss_accept_sec_context failed with [%s]\n",
468 gse_errstr(talloc_tos(), gss_maj, gss_min)));
469
470 if (gse_ctx->gssapi_context) {
471 gss_delete_sec_context(&gss_min,
472 &gse_ctx->gssapi_context,
473 GSS_C_NO_BUFFER);
474 }
475
476 status = NT_STATUS_LOGON_FAILURE;
477 goto done;
478 }
479
480 /* we may be told to return nothing */
481 if (out_data.length) {
482 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
483 if (!blob.data) {
484 status = NT_STATUS_NO_MEMORY;
485 }
486 gss_maj = gss_release_buffer(&gss_min, &out_data);
487 }
488
489
490 done:
491 *token_out = blob;
492 return status;
493 }
494
495 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
496 {
497 OM_uint32 gss_min, gss_maj;
498 gss_buffer_desc msg_min;
499 gss_buffer_desc msg_maj;
500 OM_uint32 msg_ctx = 0;
501
502 char *errstr = NULL;
503
504 ZERO_STRUCT(msg_min);
505 ZERO_STRUCT(msg_maj);
506
507 gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
508 GSS_C_NO_OID, &msg_ctx, &msg_maj);
509 if (gss_maj) {
510 goto done;
511 }
512 errstr = talloc_strndup(mem_ctx,
513 (char *)msg_maj.value,
514 msg_maj.length);
515 if (!errstr) {
516 goto done;
517 }
518 gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
519 (gss_OID)discard_const(gss_mech_krb5),
520 &msg_ctx, &msg_min);
521 if (gss_maj) {
522 goto done;
523 }
524
525 errstr = talloc_strdup_append_buffer(errstr, ": ");
526 if (!errstr) {
527 goto done;
528 }
529 errstr = talloc_strndup_append_buffer(errstr,
530 (char *)msg_min.value,
531 msg_min.length);
532 if (!errstr) {
533 goto done;
534 }
535
536 done:
537 if (msg_min.value) {
538 gss_maj = gss_release_buffer(&gss_min, &msg_min);
539 }
540 if (msg_maj.value) {
541 gss_maj = gss_release_buffer(&gss_min, &msg_maj);
542 }
543 return errstr;
544 }
545
546 static size_t gse_get_signature_length(struct gse_context *gse_ctx,
547 bool seal, size_t payload_size)
548 {
549 OM_uint32 gss_min, gss_maj;
550 gss_iov_buffer_desc iov[2];
551 int sealed;
552
553 /*
554 * gss_wrap_iov_length() only needs the type and length
555 */
556 iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
557 iov[0].buffer.value = NULL;
558 iov[0].buffer.length = 0;
559 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
560 iov[1].buffer.value = NULL;
561 iov[1].buffer.length = payload_size;
562
563 gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gssapi_context,
564 seal, GSS_C_QOP_DEFAULT,
565 &sealed, iov, 2);
566 if (gss_maj) {
567 DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n",
568 gse_errstr(talloc_tos(), gss_maj, gss_min)));
569 return 0;
570 }
571
572 return iov[0].buffer.length;
573 }
574
575 static NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
576 DATA_BLOB *data, DATA_BLOB *signature)
577 {
578 OM_uint32 gss_min, gss_maj;
579 gss_iov_buffer_desc iov[2];
580 int req_seal = 1; /* setting to 1 means we request sign+seal */
581 int sealed = 1;
582 NTSTATUS status;
583
584 /* allocate the memory ourselves so we do not need to talloc_memdup */
585 signature->length = gse_get_signature_length(gse_ctx, true, data->length);
586 if (!signature->length) {
587 return NT_STATUS_INTERNAL_ERROR;
588 }
589 signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length);
590 if (!signature->data) {
591 return NT_STATUS_NO_MEMORY;
592 }
593 iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
594 iov[0].buffer.value = signature->data;
595 iov[0].buffer.length = signature->length;
596
597 /* data is encrypted in place, which is ok */
598 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
599 iov[1].buffer.value = data->data;
600 iov[1].buffer.length = data->length;
601
602 gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gssapi_context,
603 req_seal, GSS_C_QOP_DEFAULT,
604 &sealed, iov, 2);
605 if (gss_maj) {
606 DEBUG(0, ("gss_wrap_iov failed with [%s]\n",
607 gse_errstr(talloc_tos(), gss_maj, gss_min)));
608 status = NT_STATUS_ACCESS_DENIED;
609 goto done;
610 }
611
612 if (!sealed) {
613 DEBUG(0, ("gss_wrap_iov says data was not sealed!\n"));
614 status = NT_STATUS_ACCESS_DENIED;
615 goto done;
616 }
617
618 status = NT_STATUS_OK;
619
620 DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n",
621 (int)iov[1].buffer.length, (int)iov[0].buffer.length));
622
623 done:
624 return status;
625 }
626
627 static NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
628 DATA_BLOB *data, const DATA_BLOB *signature)
629 {
630 OM_uint32 gss_min, gss_maj;
631 gss_iov_buffer_desc iov[2];
632 int sealed;
633 NTSTATUS status;
634
635 iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
636 iov[0].buffer.value = signature->data;
637 iov[0].buffer.length = signature->length;
638
639 /* data is decrypted in place, which is ok */
640 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
641 iov[1].buffer.value = data->data;
642 iov[1].buffer.length = data->length;
643
644 gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gssapi_context,
645 &sealed, NULL, iov, 2);
646 if (gss_maj) {
647 DEBUG(0, ("gss_unwrap_iov failed with [%s]\n",
648 gse_errstr(talloc_tos(), gss_maj, gss_min)));
649 status = NT_STATUS_ACCESS_DENIED;
650 goto done;
651 }
652
653 if (!sealed) {
654 DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n"));
655 status = NT_STATUS_ACCESS_DENIED;
656 goto done;
657 }
658
659 status = NT_STATUS_OK;
660
661 DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n",
662 (int)iov[1].buffer.length, (int)iov[0].buffer.length));
663
664 done:
665 return status;
666 }
667
668 static NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
669 DATA_BLOB *data, DATA_BLOB *signature)
670 {
671 OM_uint32 gss_min, gss_maj;
672 gss_buffer_desc in_data = { 0, NULL };
673 gss_buffer_desc out_data = { 0, NULL};
674 NTSTATUS status;
675
676 in_data.value = data->data;
677 in_data.length = data->length;
678
679 gss_maj = gss_get_mic(&gss_min, gse_ctx->gssapi_context,
680 GSS_C_QOP_DEFAULT,
681 &in_data, &out_data);
682 if (gss_maj) {
683 DEBUG(0, ("gss_get_mic failed with [%s]\n",
684 gse_errstr(talloc_tos(), gss_maj, gss_min)));
685 status = NT_STATUS_ACCESS_DENIED;
686 goto done;
687 }
688
689 *signature = data_blob_talloc(mem_ctx,
690 out_data.value, out_data.length);
691 if (!signature->data) {
692 status = NT_STATUS_NO_MEMORY;
693 goto done;
694 }
695
696 status = NT_STATUS_OK;
697
698 done:
699 if (out_data.value) {
700 gss_maj = gss_release_buffer(&gss_min, &out_data);
701 }
702 return status;
703 }
704
705 static NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
706 const DATA_BLOB *data, const DATA_BLOB *signature)
707 {
708 OM_uint32 gss_min, gss_maj;
709 gss_buffer_desc in_data = { 0, NULL };
710 gss_buffer_desc in_token = { 0, NULL};
711 NTSTATUS status;
712
713 in_data.value = data->data;
714 in_data.length = data->length;
715 in_token.value = signature->data;
716 in_token.length = signature->length;
717
718 gss_maj = gss_verify_mic(&gss_min, gse_ctx->gssapi_context,
719 &in_data, &in_token, NULL);
720 if (gss_maj) {
721 DEBUG(0, ("gss_verify_mic failed with [%s]\n",
722 gse_errstr(talloc_tos(), gss_maj, gss_min)));
723 status = NT_STATUS_ACCESS_DENIED;
724 goto done;
725 }
726
727 status = NT_STATUS_OK;
728
729 done:
730 return status;
731 }
732
733 static NTSTATUS gensec_gse_client_start(struct gensec_security *gensec_security)
734 {
735 struct gse_context *gse_ctx;
736 struct cli_credentials *creds = gensec_get_credentials(gensec_security);
737 NTSTATUS nt_status;
738 OM_uint32 want_flags = 0;
739 bool do_sign = false, do_seal = false;
740 const char *hostname = gensec_get_target_hostname(gensec_security);
741 const char *service = gensec_get_target_service(gensec_security);
742 const char *username = cli_credentials_get_username(creds);
743 const char *password = cli_credentials_get_password(creds);
744
745 if (!hostname) {
746 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
747 return NT_STATUS_INVALID_PARAMETER;
748 }
749 if (is_ipaddress(hostname)) {
750 DEBUG(2, ("Cannot do GSE to an IP address\n"));
751 return NT_STATUS_INVALID_PARAMETER;
752 }
753 if (strcmp(hostname, "localhost") == 0) {
754 DEBUG(2, ("GSE to 'localhost' does not make sense\n"));
755 return NT_STATUS_INVALID_PARAMETER;
756 }
757
758 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
759 do_sign = true;
760 }
761 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
762 do_seal = true;
763 }
764 if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
765 want_flags |= GSS_C_DCE_STYLE;
766 }
767
768 nt_status = gse_init_client(gensec_security, do_sign, do_seal, NULL,
769 hostname, service,
770 username, password, want_flags,
771 &gse_ctx);
772 if (!NT_STATUS_IS_OK(nt_status)) {
773 return nt_status;
774 }
775 gensec_security->private_data = gse_ctx;
776 return NT_STATUS_OK;
777 }
778
779 static NTSTATUS gensec_gse_server_start(struct gensec_security *gensec_security)
780 {
781 struct gse_context *gse_ctx;
782 NTSTATUS nt_status;
783 OM_uint32 want_flags = 0;
784 bool do_sign = false, do_seal = false;
785
786 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
787 do_sign = true;
788 }
789 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
790 do_seal = true;
791 }
792 if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
793 want_flags |= GSS_C_DCE_STYLE;
794 }
795
796 nt_status = gse_init_server(gensec_security, do_sign, do_seal, want_flags,
797 &gse_ctx);
798 if (!NT_STATUS_IS_OK(nt_status)) {
799 return nt_status;
800 }
801 gensec_security->private_data = gse_ctx;
802 return NT_STATUS_OK;
803 }
804
805 /**
806 * Check if the packet is one for this mechansim
807 *
808 * @param gensec_security GENSEC state
809 * @param in The request, as a DATA_BLOB
810 * @return Error, INVALID_PARAMETER if it's not a packet for us
811 * or NT_STATUS_OK if the packet is ok.
812 */
813
814 static NTSTATUS gensec_gse_magic(struct gensec_security *gensec_security,
815 const DATA_BLOB *in)
816 {
817 if (gensec_gssapi_check_oid(in, GENSEC_OID_KERBEROS5)) {
818 return NT_STATUS_OK;
819 } else {
820 return NT_STATUS_INVALID_PARAMETER;
821 }
822 }
823
824
825 /**
826 * Next state function for the GSE GENSEC mechanism
827 *
828 * @param gensec_gse_state GSE State
829 * @param mem_ctx The TALLOC_CTX for *out to be allocated on
830 * @param in The request, as a DATA_BLOB
831 * @param out The reply, as an talloc()ed DATA_BLOB, on *mem_ctx
832 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
833 * or NT_STATUS_OK if the user is authenticated.
834 */
835
836 static NTSTATUS gensec_gse_update(struct gensec_security *gensec_security,
837 TALLOC_CTX *mem_ctx,
838 struct tevent_context *ev,
839 const DATA_BLOB in, DATA_BLOB *out)
840 {
841 NTSTATUS status;
842 struct gse_context *gse_ctx =
843 talloc_get_type_abort(gensec_security->private_data,
844 struct gse_context);
845
846 switch (gensec_security->gensec_role) {
847 case GENSEC_CLIENT:
848 status = gse_get_client_auth_token(mem_ctx, gse_ctx,
849 &in, out);
850 break;
851 case GENSEC_SERVER:
852 status = gse_get_server_auth_token(mem_ctx, gse_ctx,
853 &in, out);
854 break;
855 }
856 if (!NT_STATUS_IS_OK(status)) {
857 return status;
858 }
859
860 return NT_STATUS_OK;
861 }
862
863 static NTSTATUS gensec_gse_wrap(struct gensec_security *gensec_security,
864 TALLOC_CTX *mem_ctx,
865 const DATA_BLOB *in,
866 DATA_BLOB *out)
867 {
868 struct gse_context *gse_ctx =
869 talloc_get_type_abort(gensec_security->private_data,
870 struct gse_context);
871 OM_uint32 maj_stat, min_stat;
872 gss_buffer_desc input_token, output_token;
873 int conf_state;
874 input_token.length = in->length;
875 input_token.value = in->data;
876
877 maj_stat = gss_wrap(&min_stat,
878 gse_ctx->gssapi_context,
879 gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
880 GSS_C_QOP_DEFAULT,
881 &input_token,
882 &conf_state,
883 &output_token);
884 if (GSS_ERROR(maj_stat)) {
885 DEBUG(0, ("gensec_gse_wrap: GSS Wrap failed: %s\n",
886 gse_errstr(talloc_tos(), maj_stat, min_stat)));
887 return NT_STATUS_ACCESS_DENIED;
888 }
889
890 *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
891 gss_release_buffer(&min_stat, &output_token);
892
893 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
894 && !conf_state) {
895 return NT_STATUS_ACCESS_DENIED;
896 }
897 return NT_STATUS_OK;
898 }
899
900 static NTSTATUS gensec_gse_unwrap(struct gensec_security *gensec_security,
901 TALLOC_CTX *mem_ctx,
902 const DATA_BLOB *in,
903 DATA_BLOB *out)
904 {
905 struct gse_context *gse_ctx =
906 talloc_get_type_abort(gensec_security->private_data,
907 struct gse_context);
908 OM_uint32 maj_stat, min_stat;
909 gss_buffer_desc input_token, output_token;
910 int conf_state;
911 gss_qop_t qop_state;
912 input_token.length = in->length;
913 input_token.value = in->data;
914
915 maj_stat = gss_unwrap(&min_stat,
916 gse_ctx->gssapi_context,
917 &input_token,
918 &output_token,
919 &conf_state,
920 &qop_state);
921 if (GSS_ERROR(maj_stat)) {
922 DEBUG(0, ("gensec_gse_unwrap: GSS UnWrap failed: %s\n",
923 gse_errstr(talloc_tos(), maj_stat, min_stat)));
924 return NT_STATUS_ACCESS_DENIED;
925 }
926
927 *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
928 gss_release_buffer(&min_stat, &output_token);
929
930 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
931 && !conf_state) {
932 return NT_STATUS_ACCESS_DENIED;
933 }
934 return NT_STATUS_OK;
935 }
936
937 static NTSTATUS gensec_gse_seal_packet(struct gensec_security *gensec_security,
938 TALLOC_CTX *mem_ctx,
939 uint8_t *data, size_t length,
940 const uint8_t *whole_pdu, size_t pdu_length,
941 DATA_BLOB *sig)
942 {
943 struct gse_context *gse_ctx =
944 talloc_get_type_abort(gensec_security->private_data,
945 struct gse_context);
946 DATA_BLOB payload = data_blob_const(data, length);
947 return gse_seal(mem_ctx, gse_ctx, &payload, sig);
948 }
949
950 static NTSTATUS gensec_gse_unseal_packet(struct gensec_security *gensec_security,
951 uint8_t *data, size_t length,
952 const uint8_t *whole_pdu, size_t pdu_length,
953 const DATA_BLOB *sig)
954 {
955 struct gse_context *gse_ctx =
956 talloc_get_type_abort(gensec_security->private_data,
957 struct gse_context);
958 DATA_BLOB payload = data_blob_const(data, length);
959 return gse_unseal(talloc_tos() /* unused */, gse_ctx, &payload, sig);
960 }
961
962 static NTSTATUS gensec_gse_sign_packet(struct gensec_security *gensec_security,
963 TALLOC_CTX *mem_ctx,
964 const uint8_t *data, size_t length,
965 const uint8_t *whole_pdu, size_t pdu_length,
966 DATA_BLOB *sig)
967 {
968 struct gse_context *gse_ctx =
969 talloc_get_type_abort(gensec_security->private_data,
970 struct gse_context);
971 DATA_BLOB payload = data_blob_const(data, length);
972 return gse_sign(mem_ctx, gse_ctx, &payload, sig);
973 }
974
975 static NTSTATUS gensec_gse_check_packet(struct gensec_security *gensec_security,
976 const uint8_t *data, size_t length,
977 const uint8_t *whole_pdu, size_t pdu_length,
978 const DATA_BLOB *sig)
979 {
980 struct gse_context *gse_ctx =
981 talloc_get_type_abort(gensec_security->private_data,
982 struct gse_context);
983 DATA_BLOB payload = data_blob_const(data, length);
984 return gse_sigcheck(NULL, gse_ctx, &payload, sig);
985 }
986
987 /* Try to figure out what features we actually got on the connection */
988 static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
989 uint32_t feature)
990 {
991 struct gse_context *gse_ctx =
992 talloc_get_type_abort(gensec_security->private_data,
993 struct gse_context);
994
995 if (feature & GENSEC_FEATURE_SIGN) {
996 return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
997 }
998 if (feature & GENSEC_FEATURE_SEAL) {
999 return gse_ctx->gss_got_flags & GSS_C_CONF_FLAG;
1000 }
1001 if (feature & GENSEC_FEATURE_SESSION_KEY) {
1002 /* Only for GSE/Krb5 */
1003 if (gss_oid_equal(gse_ctx->ret_mech, gss_mech_krb5)) {
1004 return true;
1005 }
1006 }
1007 if (feature & GENSEC_FEATURE_DCE_STYLE) {
1008 return gse_ctx->gss_got_flags & GSS_C_DCE_STYLE;
1009 }
1010 if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
1011 NTSTATUS status;
1012 uint32_t keytype;
1013
1014 if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
1015 return false;
1016 }
1017
1018 status = gssapi_get_session_key(talloc_tos(),
1019 gse_ctx->gssapi_context, NULL, &keytype);
1020 /*
1021 * We should do a proper sig on the mechListMic unless
1022 * we know we have to be backwards compatible with
1023 * earlier windows versions.
1024 *
1025 * Negotiating a non-krb5
1026 * mech for example should be regarded as having
1027 * NEW_SPNEGO
1028 */
1029 if (NT_STATUS_IS_OK(status)) {
1030 switch (keytype) {
1031 case ENCTYPE_DES_CBC_CRC:
1032 case ENCTYPE_DES_CBC_MD5:
1033 case ENCTYPE_ARCFOUR_HMAC:
1034 case ENCTYPE_DES3_CBC_SHA1:
1035 return false;
1036 }
1037 }
1038 return true;
1039 }
1040 /* We can always do async (rather than strict request/reply) packets. */
1041 if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
1042 return true;
1043 }
1044 return false;
1045 }
1046
1047 /*
1048 * Extract the 'sesssion key' needed by SMB signing and ncacn_np
1049 * (for encrypting some passwords).
1050 *
1051 * This breaks all the abstractions, but what do you expect...
1052 */
1053 static NTSTATUS gensec_gse_session_key(struct gensec_security *gensec_security,
1054 TALLOC_CTX *mem_ctx,
1055 DATA_BLOB *session_key)
1056 {
1057 struct gse_context *gse_ctx =
1058 talloc_get_type_abort(gensec_security->private_data,
1059 struct gse_context);
1060
1061 return gssapi_get_session_key(mem_ctx, gse_ctx->gssapi_context, session_key, NULL);
1062 }
1063
1064 /* Get some basic (and authorization) information about the user on
1065 * this session. This uses either the PAC (if present) or a local
1066 * database lookup */
1067 static NTSTATUS gensec_gse_session_info(struct gensec_security *gensec_security,
1068 TALLOC_CTX *mem_ctx,
1069 struct auth_session_info **_session_info)
1070 {
1071 struct gse_context *gse_ctx =
1072 talloc_get_type_abort(gensec_security->private_data,
1073 struct gse_context);
1074 NTSTATUS nt_status;
1075 TALLOC_CTX *tmp_ctx;
1076 struct auth_session_info *session_info = NULL;
1077 OM_uint32 maj_stat, min_stat;
1078 DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
1079
1080 gss_buffer_desc name_token;
1081 char *principal_string;
1082
1083 tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gse_session_info context");
1084 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1085
1086 maj_stat = gss_display_name(&min_stat,
1087 gse_ctx->client_name,
1088 &name_token,
1089 NULL);
1090 if (GSS_ERROR(maj_stat)) {
1091 DEBUG(1, ("GSS display_name failed: %s\n",
1092 gse_errstr(talloc_tos(), maj_stat, min_stat)));
1093 talloc_free(tmp_ctx);
1094 return NT_STATUS_FOOBAR;
1095 }
1096
1097 principal_string = talloc_strndup(tmp_ctx,
1098 (const char *)name_token.value,
1099 name_token.length);
1100
1101 gss_release_buffer(&min_stat, &name_token);
1102
1103 if (!principal_string) {
1104 talloc_free(tmp_ctx);
1105 return NT_STATUS_NO_MEMORY;
1106 }
1107
1108 nt_status = gssapi_obtain_pac_blob(tmp_ctx, gse_ctx->gssapi_context,
1109 gse_ctx->client_name,
1110 &pac_blob);
1111
1112 /* IF we have the PAC - otherwise we need to get this
1113 * data from elsewere
1114 */
1115 if (NT_STATUS_IS_OK(nt_status)) {
1116 pac_blob_ptr = &pac_blob;
1117 }
1118 nt_status = gensec_generate_session_info_pac(tmp_ctx,
1119 gensec_security,
1120 NULL,
1121 pac_blob_ptr, principal_string,
1122 gensec_get_remote_address(gensec_security),
1123 &session_info);
1124 if (!NT_STATUS_IS_OK(nt_status)) {
1125 talloc_free(tmp_ctx);
1126 return nt_status;
1127 }
1128
1129 nt_status = gensec_gse_session_key(gensec_security, session_info,
1130 &session_info->session_key);
1131 if (!NT_STATUS_IS_OK(nt_status)) {
1132 talloc_free(tmp_ctx);
1133 return nt_status;
1134 }
1135
1136 *_session_info = talloc_move(mem_ctx, &session_info);
1137 talloc_free(tmp_ctx);
1138
1139 return NT_STATUS_OK;
1140 }
1141
1142 static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
1143 size_t data_size)
1144 {
1145 struct gse_context *gse_ctx =
1146 talloc_get_type_abort(gensec_security->private_data,
1147 struct gse_context);
1148
1149 return gse_get_signature_length(gse_ctx,
1150 gensec_security->want_features & GENSEC_FEATURE_SEAL,
1151 data_size);
1152 }
1153
1154 static const char *gensec_gse_krb5_oids[] = {
1155 GENSEC_OID_KERBEROS5_OLD,
1156 GENSEC_OID_KERBEROS5,
1157 NULL
1158 };
1159
1160 const struct gensec_security_ops gensec_gse_krb5_security_ops = {
1161 .name = "gse_krb5",
1162 .auth_type = DCERPC_AUTH_TYPE_KRB5,
1163 .oid = gensec_gse_krb5_oids,
1164 .client_start = gensec_gse_client_start,
1165 .server_start = gensec_gse_server_start,
1166 .magic = gensec_gse_magic,
1167 .update = gensec_gse_update,
1168 .session_key = gensec_gse_session_key,
1169 .session_info = gensec_gse_session_info,
1170 .sig_size = gensec_gse_sig_size,
1171 .sign_packet = gensec_gse_sign_packet,
1172 .check_packet = gensec_gse_check_packet,
1173 .seal_packet = gensec_gse_seal_packet,
1174 .unseal_packet = gensec_gse_unseal_packet,
1175 .wrap = gensec_gse_wrap,
1176 .unwrap = gensec_gse_unwrap,
1177 .have_feature = gensec_gse_have_feature,
1178 .enabled = true,
1179 .kerberos = true,
1180 .priority = GENSEC_GSSAPI
1181 };
1182
1183 #endif /* HAVE_KRB5 */
Samba GIT mirror