2 Unix SMB/CIFS implementation.
4 dcerpc schannel operations
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "lib/util/tevent_ntstatus.h"
26 #include "librpc/gen_ndr/ndr_schannel.h"
27 #include "auth/auth.h"
28 #include "auth/credentials/credentials.h"
29 #include "auth/gensec/gensec.h"
30 #include "auth/gensec/gensec_internal.h"
31 #include "auth/gensec/gensec_proto.h"
32 #include "../libcli/auth/schannel.h"
33 #include "librpc/gen_ndr/dcerpc.h"
34 #include "param/param.h"
35 #include "auth/gensec/gensec_toplevel_proto.h"
36 #include "lib/crypto/crypto.h"
37 #include "libds/common/roles.h"
40 #define DBGC_CLASS DBGC_AUTH
42 struct schannel_state
{
43 struct gensec_security
*gensec
;
46 struct netlogon_creds_CredentialState
*creds
;
47 struct auth_user_info_dc
*user_info_dc
;
50 #define SETUP_SEQNUM(state, buf, initiator) do { \
51 uint8_t *_buf = buf; \
52 uint32_t _seq_num_low = (state)->seq_num & UINT32_MAX; \
53 uint32_t _seq_num_high = (state)->seq_num >> 32; \
55 _seq_num_high |= 0x80000000; \
57 RSIVAL(_buf, 0, _seq_num_low); \
58 RSIVAL(_buf, 4, _seq_num_high); \
61 static struct schannel_state
*netsec_create_state(
62 struct gensec_security
*gensec
,
63 struct netlogon_creds_CredentialState
*creds
,
66 struct schannel_state
*state
;
68 state
= talloc_zero(gensec
, struct schannel_state
);
73 state
->gensec
= gensec
;
74 state
->initiator
= initiator
;
75 state
->creds
= netlogon_creds_copy(state
, creds
);
76 if (state
->creds
== NULL
) {
81 gensec
->private_data
= state
;
86 static void netsec_offset_and_sizes(struct schannel_state
*state
,
88 uint32_t *_min_sig_size
,
89 uint32_t *_used_sig_size
,
90 uint32_t *_checksum_length
,
91 uint32_t *_confounder_ofs
)
93 uint32_t min_sig_size
;
94 uint32_t used_sig_size
;
95 uint32_t checksum_length
;
96 uint32_t confounder_ofs
;
98 if (state
->creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
102 * Note: windows has a bug here and uses the old values...
104 * checksum_length = 32;
105 * confounder_ofs = 48;
121 *_min_sig_size
= min_sig_size
;
124 if (_used_sig_size
) {
125 *_used_sig_size
= used_sig_size
;
128 if (_checksum_length
) {
129 *_checksum_length
= checksum_length
;
132 if (_confounder_ofs
) {
133 *_confounder_ofs
= confounder_ofs
;
137 /*******************************************************************
138 Encode or Decode the sequence number (which is symmetric)
139 ********************************************************************/
140 static void netsec_do_seq_num(struct schannel_state
*state
,
141 const uint8_t *checksum
,
142 uint32_t checksum_length
,
145 if (state
->creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
147 uint8_t iv
[AES_BLOCK_SIZE
];
149 AES_set_encrypt_key(state
->creds
->session_key
, 128, &key
);
151 memcpy(iv
+0, checksum
, 8);
152 memcpy(iv
+8, checksum
, 8);
154 aes_cfb8_encrypt(seq_num
, seq_num
, 8, &key
, iv
, AES_ENCRYPT
);
156 static const uint8_t zeros
[4];
157 uint8_t sequence_key
[16];
160 hmac_md5(state
->creds
->session_key
, zeros
, sizeof(zeros
), digest1
);
161 hmac_md5(digest1
, checksum
, checksum_length
, sequence_key
);
162 arcfour_crypt(seq_num
, sequence_key
, 8);
168 static void netsec_do_seal(struct schannel_state
*state
,
169 const uint8_t seq_num
[8],
170 uint8_t confounder
[8],
171 uint8_t *data
, uint32_t length
,
174 if (state
->creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
176 uint8_t iv
[AES_BLOCK_SIZE
];
177 uint8_t sess_kf0
[16];
180 for (i
= 0; i
< 16; i
++) {
181 sess_kf0
[i
] = state
->creds
->session_key
[i
] ^ 0xf0;
184 AES_set_encrypt_key(sess_kf0
, 128, &key
);
186 memcpy(iv
+0, seq_num
, 8);
187 memcpy(iv
+8, seq_num
, 8);
190 aes_cfb8_encrypt(confounder
, confounder
, 8, &key
, iv
, AES_ENCRYPT
);
191 aes_cfb8_encrypt(data
, data
, length
, &key
, iv
, AES_ENCRYPT
);
193 aes_cfb8_encrypt(confounder
, confounder
, 8, &key
, iv
, AES_DECRYPT
);
194 aes_cfb8_encrypt(data
, data
, length
, &key
, iv
, AES_DECRYPT
);
197 uint8_t sealing_key
[16];
198 static const uint8_t zeros
[4];
200 uint8_t sess_kf0
[16];
203 for (i
= 0; i
< 16; i
++) {
204 sess_kf0
[i
] = state
->creds
->session_key
[i
] ^ 0xf0;
207 hmac_md5(sess_kf0
, zeros
, 4, digest2
);
208 hmac_md5(digest2
, seq_num
, 8, sealing_key
);
210 arcfour_crypt(confounder
, sealing_key
, 8);
211 arcfour_crypt(data
, sealing_key
, length
);
215 /*******************************************************************
216 Create a digest over the entire packet (including the data), and
217 MD5 it with the session key.
218 ********************************************************************/
219 static void netsec_do_sign(struct schannel_state
*state
,
220 const uint8_t *confounder
,
221 const uint8_t *data
, size_t length
,
225 if (state
->creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
226 struct HMACSHA256Context ctx
;
228 hmac_sha256_init(state
->creds
->session_key
,
229 sizeof(state
->creds
->session_key
),
233 SSVAL(header
, 0, NL_SIGN_HMAC_SHA256
);
234 SSVAL(header
, 2, NL_SEAL_AES128
);
235 SSVAL(header
, 4, 0xFFFF);
236 SSVAL(header
, 6, 0x0000);
238 hmac_sha256_update(header
, 8, &ctx
);
239 hmac_sha256_update(confounder
, 8, &ctx
);
241 SSVAL(header
, 0, NL_SIGN_HMAC_SHA256
);
242 SSVAL(header
, 2, NL_SEAL_NONE
);
243 SSVAL(header
, 4, 0xFFFF);
244 SSVAL(header
, 6, 0x0000);
246 hmac_sha256_update(header
, 8, &ctx
);
249 hmac_sha256_update(data
, length
, &ctx
);
251 hmac_sha256_final(checksum
, &ctx
);
253 uint8_t packet_digest
[16];
254 static const uint8_t zeros
[4];
258 MD5Update(&ctx
, zeros
, 4);
260 SSVAL(header
, 0, NL_SIGN_HMAC_MD5
);
261 SSVAL(header
, 2, NL_SEAL_RC4
);
262 SSVAL(header
, 4, 0xFFFF);
263 SSVAL(header
, 6, 0x0000);
265 MD5Update(&ctx
, header
, 8);
266 MD5Update(&ctx
, confounder
, 8);
268 SSVAL(header
, 0, NL_SIGN_HMAC_MD5
);
269 SSVAL(header
, 2, NL_SEAL_NONE
);
270 SSVAL(header
, 4, 0xFFFF);
271 SSVAL(header
, 6, 0x0000);
273 MD5Update(&ctx
, header
, 8);
275 MD5Update(&ctx
, data
, length
);
276 MD5Final(packet_digest
, &ctx
);
278 hmac_md5(state
->creds
->session_key
,
279 packet_digest
, sizeof(packet_digest
),
284 static NTSTATUS
netsec_incoming_packet(struct schannel_state
*state
,
286 uint8_t *data
, size_t length
,
287 const uint8_t *whole_pdu
, size_t pdu_length
,
288 const DATA_BLOB
*sig
)
290 uint32_t min_sig_size
= 0;
292 uint8_t checksum
[32];
293 uint32_t checksum_length
= sizeof(checksum_length
);
294 uint8_t _confounder
[8];
295 uint8_t *confounder
= NULL
;
296 uint32_t confounder_ofs
= 0;
299 const uint8_t *sign_data
= NULL
;
300 size_t sign_length
= 0;
302 netsec_offset_and_sizes(state
,
309 if (sig
->length
< min_sig_size
) {
310 return NT_STATUS_ACCESS_DENIED
;
314 confounder
= _confounder
;
315 memcpy(confounder
, sig
->data
+confounder_ofs
, 8);
320 SETUP_SEQNUM(state
, seq_num
, !state
->initiator
);
323 netsec_do_seal(state
, seq_num
,
329 if (state
->gensec
->want_features
& GENSEC_FEATURE_SIGN_PKT_HEADER
) {
330 sign_data
= whole_pdu
;
331 sign_length
= pdu_length
;
334 sign_length
= length
;
337 netsec_do_sign(state
, confounder
,
338 sign_data
, sign_length
,
341 ret
= memcmp(checksum
, sig
->data
+16, checksum_length
);
343 dump_data_pw("calc digest:", checksum
, checksum_length
);
344 dump_data_pw("wire digest:", sig
->data
+16, checksum_length
);
345 return NT_STATUS_ACCESS_DENIED
;
348 netsec_do_seq_num(state
, checksum
, checksum_length
, seq_num
);
350 ret
= memcmp(seq_num
, sig
->data
+8, 8);
352 dump_data_pw("calc seq num:", seq_num
, 8);
353 dump_data_pw("wire seq num:", sig
->data
+8, 8);
354 return NT_STATUS_ACCESS_DENIED
;
360 static uint32_t netsec_outgoing_sig_size(struct schannel_state
*state
)
362 uint32_t sig_size
= 0;
364 netsec_offset_and_sizes(state
,
374 static NTSTATUS
netsec_outgoing_packet(struct schannel_state
*state
,
377 uint8_t *data
, size_t length
,
378 const uint8_t *whole_pdu
, size_t pdu_length
,
381 uint32_t min_sig_size
= 0;
382 uint32_t used_sig_size
= 0;
384 uint8_t checksum
[32];
385 uint32_t checksum_length
= sizeof(checksum_length
);
386 uint8_t _confounder
[8];
387 uint8_t *confounder
= NULL
;
388 uint32_t confounder_ofs
= 0;
390 const uint8_t *sign_data
= NULL
;
391 size_t sign_length
= 0;
393 netsec_offset_and_sizes(state
,
400 SETUP_SEQNUM(state
, seq_num
, state
->initiator
);
403 confounder
= _confounder
;
404 generate_random_buffer(confounder
, 8);
409 if (state
->gensec
->want_features
& GENSEC_FEATURE_SIGN_PKT_HEADER
) {
410 sign_data
= whole_pdu
;
411 sign_length
= pdu_length
;
414 sign_length
= length
;
417 netsec_do_sign(state
, confounder
,
418 sign_data
, sign_length
,
422 netsec_do_seal(state
, seq_num
,
428 netsec_do_seq_num(state
, checksum
, checksum_length
, seq_num
);
430 (*sig
) = data_blob_talloc_zero(mem_ctx
, used_sig_size
);
432 memcpy(sig
->data
, header
, 8);
433 memcpy(sig
->data
+8, seq_num
, 8);
434 memcpy(sig
->data
+16, checksum
, checksum_length
);
437 memcpy(sig
->data
+confounder_ofs
, confounder
, 8);
440 dump_data_pw("signature:", sig
->data
+ 0, 8);
441 dump_data_pw("seq_num :", sig
->data
+ 8, 8);
442 dump_data_pw("digest :", sig
->data
+16, checksum_length
);
443 dump_data_pw("confound :", sig
->data
+confounder_ofs
, 8);
448 _PUBLIC_ NTSTATUS
gensec_schannel_init(TALLOC_CTX
*ctx
);
450 static size_t schannel_sig_size(struct gensec_security
*gensec_security
, size_t data_size
)
452 struct schannel_state
*state
=
453 talloc_get_type_abort(gensec_security
->private_data
,
454 struct schannel_state
);
456 return netsec_outgoing_sig_size(state
);
459 struct schannel_update_state
{
464 static NTSTATUS
schannel_update_internal(struct gensec_security
*gensec_security
,
465 TALLOC_CTX
*out_mem_ctx
,
466 const DATA_BLOB in
, DATA_BLOB
*out
);
468 static struct tevent_req
*schannel_update_send(TALLOC_CTX
*mem_ctx
,
469 struct tevent_context
*ev
,
470 struct gensec_security
*gensec_security
,
473 struct tevent_req
*req
;
474 struct schannel_update_state
*state
= NULL
;
477 req
= tevent_req_create(mem_ctx
, &state
,
478 struct schannel_update_state
);
483 status
= schannel_update_internal(gensec_security
,
486 state
->status
= status
;
487 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
488 status
= NT_STATUS_OK
;
490 if (tevent_req_nterror(req
, status
)) {
491 return tevent_req_post(req
, ev
);
494 tevent_req_done(req
);
495 return tevent_req_post(req
, ev
);
498 static NTSTATUS
schannel_update_internal(struct gensec_security
*gensec_security
,
499 TALLOC_CTX
*out_mem_ctx
,
500 const DATA_BLOB in
, DATA_BLOB
*out
)
502 struct schannel_state
*state
=
503 talloc_get_type(gensec_security
->private_data
,
504 struct schannel_state
);
506 enum ndr_err_code ndr_err
;
507 struct NL_AUTH_MESSAGE bind_schannel
= {
510 struct NL_AUTH_MESSAGE bind_schannel_ack
;
511 struct netlogon_creds_CredentialState
*creds
;
512 const char *workstation
;
515 *out
= data_blob(NULL
, 0);
517 if (gensec_security
->dcerpc_auth_level
< DCERPC_AUTH_LEVEL_INTEGRITY
) {
518 switch (gensec_security
->gensec_role
) {
520 return NT_STATUS_INVALID_PARAMETER_MIX
;
522 return NT_STATUS_INVALID_PARAMETER
;
524 return NT_STATUS_INTERNAL_ERROR
;
527 switch (gensec_security
->gensec_role
) {
530 /* we could parse the bind ack, but we don't know what it is yet */
534 creds
= cli_credentials_get_netlogon_creds(gensec_security
->credentials
);
536 return NT_STATUS_INVALID_PARAMETER_MIX
;
539 state
= netsec_create_state(gensec_security
,
540 creds
, true /* initiator */);
542 return NT_STATUS_NO_MEMORY
;
545 bind_schannel
.MessageType
= NL_NEGOTIATE_REQUEST
;
547 bind_schannel
.Flags
= NL_FLAG_OEM_NETBIOS_DOMAIN_NAME
|
548 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME
;
549 bind_schannel
.oem_netbios_domain
.a
= cli_credentials_get_domain(gensec_security
->credentials
);
550 bind_schannel
.oem_netbios_computer
.a
= creds
->computer_name
;
552 if (creds
->secure_channel_type
== SEC_CHAN_DNS_DOMAIN
) {
553 bind_schannel
.Flags
|= NL_FLAG_UTF8_DNS_DOMAIN_NAME
;
554 bind_schannel
.utf8_dns_domain
.u
= cli_credentials_get_realm(gensec_security
->credentials
);
556 bind_schannel
.Flags
|= NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME
;
557 bind_schannel
.utf8_netbios_computer
.u
= creds
->computer_name
;
560 ndr_err
= ndr_push_struct_blob(out
, out_mem_ctx
, &bind_schannel
,
561 (ndr_push_flags_fn_t
)ndr_push_NL_AUTH_MESSAGE
);
562 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
563 status
= ndr_map_error2ntstatus(ndr_err
);
564 DEBUG(3, ("Could not create schannel bind: %s\n",
569 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
573 /* no third leg on this protocol */
574 return NT_STATUS_INVALID_PARAMETER
;
577 /* parse the schannel startup blob */
578 ndr_err
= ndr_pull_struct_blob(&in
, out_mem_ctx
, &bind_schannel
,
579 (ndr_pull_flags_fn_t
)ndr_pull_NL_AUTH_MESSAGE
);
580 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
581 status
= ndr_map_error2ntstatus(ndr_err
);
582 DEBUG(3, ("Could not parse incoming schannel bind: %s\n",
587 if (bind_schannel
.Flags
& NL_FLAG_OEM_NETBIOS_DOMAIN_NAME
) {
588 domain
= bind_schannel
.oem_netbios_domain
.a
;
589 if (strcasecmp_m(domain
, lpcfg_workgroup(gensec_security
->settings
->lp_ctx
)) != 0) {
590 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
591 domain
, lpcfg_workgroup(gensec_security
->settings
->lp_ctx
)));
592 return NT_STATUS_LOGON_FAILURE
;
594 } else if (bind_schannel
.Flags
& NL_FLAG_UTF8_DNS_DOMAIN_NAME
) {
595 domain
= bind_schannel
.utf8_dns_domain
.u
;
596 if (strcasecmp_m(domain
, lpcfg_dnsdomain(gensec_security
->settings
->lp_ctx
)) != 0) {
597 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
598 domain
, lpcfg_dnsdomain(gensec_security
->settings
->lp_ctx
)));
599 return NT_STATUS_LOGON_FAILURE
;
602 DEBUG(3, ("Request for schannel to without domain\n"));
603 return NT_STATUS_LOGON_FAILURE
;
606 if (bind_schannel
.Flags
& NL_FLAG_OEM_NETBIOS_COMPUTER_NAME
) {
607 workstation
= bind_schannel
.oem_netbios_computer
.a
;
608 } else if (bind_schannel
.Flags
& NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME
) {
609 workstation
= bind_schannel
.utf8_netbios_computer
.u
;
611 DEBUG(3, ("Request for schannel to without netbios workstation\n"));
612 return NT_STATUS_LOGON_FAILURE
;
615 status
= schannel_get_creds_state(out_mem_ctx
,
616 gensec_security
->settings
->lp_ctx
,
617 workstation
, &creds
);
618 if (!NT_STATUS_IS_OK(status
)) {
619 DEBUG(3, ("Could not find session key for attempted schannel connection from %s: %s\n",
620 workstation
, nt_errstr(status
)));
621 if (NT_STATUS_EQUAL(status
, NT_STATUS_INVALID_HANDLE
)) {
622 return NT_STATUS_LOGON_FAILURE
;
627 state
= netsec_create_state(gensec_security
,
628 creds
, false /* not initiator */);
630 return NT_STATUS_NO_MEMORY
;
633 status
= auth_anonymous_user_info_dc(state
,
634 lpcfg_netbios_name(gensec_security
->settings
->lp_ctx
),
635 &state
->user_info_dc
);
636 if (!NT_STATUS_IS_OK(status
)) {
640 bind_schannel_ack
.MessageType
= NL_NEGOTIATE_RESPONSE
;
641 bind_schannel_ack
.Flags
= 0;
642 bind_schannel_ack
.Buffer
.dummy
= 0x6c0000; /* actually I think
647 ndr_err
= ndr_push_struct_blob(out
, out_mem_ctx
, &bind_schannel_ack
,
648 (ndr_push_flags_fn_t
)ndr_push_NL_AUTH_MESSAGE
);
649 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
650 status
= ndr_map_error2ntstatus(ndr_err
);
651 DEBUG(3, ("Could not return schannel bind ack for client %s: %s\n",
652 workstation
, nt_errstr(status
)));
658 return NT_STATUS_INVALID_PARAMETER
;
661 static NTSTATUS
schannel_update_recv(struct tevent_req
*req
,
662 TALLOC_CTX
*out_mem_ctx
,
665 struct schannel_update_state
*state
=
667 struct schannel_update_state
);
670 *out
= data_blob_null
;
672 if (tevent_req_is_nterror(req
, &status
)) {
673 tevent_req_received(req
);
677 status
= state
->status
;
678 talloc_steal(out_mem_ctx
, state
->out
.data
);
680 tevent_req_received(req
);
685 * Returns anonymous credentials for schannel, matching Win2k3.
689 static NTSTATUS
schannel_session_info(struct gensec_security
*gensec_security
,
691 struct auth_session_info
**_session_info
)
693 struct schannel_state
*state
=
694 talloc_get_type(gensec_security
->private_data
,
695 struct schannel_state
);
696 struct auth4_context
*auth_ctx
= gensec_security
->auth_context
;
697 struct auth_session_info
*session_info
= NULL
;
698 uint32_t session_info_flags
= 0;
701 if (auth_ctx
== NULL
) {
702 DEBUG(0, ("Cannot generate a session_info without the auth_context\n"));
703 return NT_STATUS_INTERNAL_ERROR
;
706 if (auth_ctx
->generate_session_info
== NULL
) {
707 DEBUG(0, ("Cannot generate a session_info without the generate_session_info hook\n"));
708 return NT_STATUS_INTERNAL_ERROR
;
711 if (gensec_security
->want_features
& GENSEC_FEATURE_UNIX_TOKEN
) {
712 session_info_flags
|= AUTH_SESSION_INFO_UNIX_TOKEN
;
715 session_info_flags
|= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES
;
717 status
= auth_ctx
->generate_session_info(
721 state
->user_info_dc
->info
->account_name
,
724 if (!NT_STATUS_IS_OK(status
)) {
728 *_session_info
= session_info
;
733 * Reduce the attack surface by ensuring schannel is not availble when
736 static NTSTATUS
schannel_server_start(struct gensec_security
*gensec_security
)
738 enum server_role server_role
739 = lpcfg_server_role(gensec_security
->settings
->lp_ctx
);
741 switch (server_role
) {
742 case ROLE_DOMAIN_BDC
:
743 case ROLE_DOMAIN_PDC
:
744 case ROLE_ACTIVE_DIRECTORY_DC
:
747 return NT_STATUS_NOT_IMPLEMENTED
;
751 static NTSTATUS
schannel_client_start(struct gensec_security
*gensec_security
)
756 static bool schannel_have_feature(struct gensec_security
*gensec_security
,
759 if (gensec_security
->dcerpc_auth_level
>= DCERPC_AUTH_LEVEL_INTEGRITY
) {
760 if (feature
& GENSEC_FEATURE_SIGN
) {
764 if (gensec_security
->dcerpc_auth_level
== DCERPC_AUTH_LEVEL_PRIVACY
) {
765 if (feature
& GENSEC_FEATURE_SEAL
) {
769 if (feature
& GENSEC_FEATURE_DCE_STYLE
) {
772 if (feature
& GENSEC_FEATURE_SIGN_PKT_HEADER
) {
781 static NTSTATUS
schannel_unseal_packet(struct gensec_security
*gensec_security
,
782 uint8_t *data
, size_t length
,
783 const uint8_t *whole_pdu
, size_t pdu_length
,
784 const DATA_BLOB
*sig
)
786 struct schannel_state
*state
=
787 talloc_get_type_abort(gensec_security
->private_data
,
788 struct schannel_state
);
790 return netsec_incoming_packet(state
, true,
791 discard_const_p(uint8_t, data
),
793 whole_pdu
, pdu_length
,
798 check the signature on a packet
800 static NTSTATUS
schannel_check_packet(struct gensec_security
*gensec_security
,
801 const uint8_t *data
, size_t length
,
802 const uint8_t *whole_pdu
, size_t pdu_length
,
803 const DATA_BLOB
*sig
)
805 struct schannel_state
*state
=
806 talloc_get_type_abort(gensec_security
->private_data
,
807 struct schannel_state
);
809 return netsec_incoming_packet(state
, false,
810 discard_const_p(uint8_t, data
),
812 whole_pdu
, pdu_length
,
818 static NTSTATUS
schannel_seal_packet(struct gensec_security
*gensec_security
,
820 uint8_t *data
, size_t length
,
821 const uint8_t *whole_pdu
, size_t pdu_length
,
824 struct schannel_state
*state
=
825 talloc_get_type_abort(gensec_security
->private_data
,
826 struct schannel_state
);
828 return netsec_outgoing_packet(state
, mem_ctx
, true,
830 whole_pdu
, pdu_length
,
837 static NTSTATUS
schannel_sign_packet(struct gensec_security
*gensec_security
,
839 const uint8_t *data
, size_t length
,
840 const uint8_t *whole_pdu
, size_t pdu_length
,
843 struct schannel_state
*state
=
844 talloc_get_type_abort(gensec_security
->private_data
,
845 struct schannel_state
);
847 return netsec_outgoing_packet(state
, mem_ctx
, false,
848 discard_const_p(uint8_t, data
),
850 whole_pdu
, pdu_length
,
854 static const struct gensec_security_ops gensec_schannel_security_ops
= {
856 .auth_type
= DCERPC_AUTH_TYPE_SCHANNEL
,
857 .client_start
= schannel_client_start
,
858 .server_start
= schannel_server_start
,
859 .update_send
= schannel_update_send
,
860 .update_recv
= schannel_update_recv
,
861 .seal_packet
= schannel_seal_packet
,
862 .sign_packet
= schannel_sign_packet
,
863 .check_packet
= schannel_check_packet
,
864 .unseal_packet
= schannel_unseal_packet
,
865 .session_info
= schannel_session_info
,
866 .sig_size
= schannel_sig_size
,
867 .have_feature
= schannel_have_feature
,
869 .priority
= GENSEC_SCHANNEL
872 _PUBLIC_ NTSTATUS
gensec_schannel_init(TALLOC_CTX
*ctx
)
875 ret
= gensec_register(ctx
, &gensec_schannel_security_ops
);
876 if (!NT_STATUS_IS_OK(ret
)) {
877 DEBUG(0,("Failed to register '%s' gensec backend!\n",
878 gensec_schannel_security_ops
.name
));