2 Unix SMB/CIFS implementation.
4 server side dcerpc authentication code
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Stefan (metze) Metzmacher 2004
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "rpc_server/dcerpc_server.h"
25 #include "rpc_server/dcerpc_server_proto.h"
26 #include "rpc_server/common/proto.h"
27 #include "librpc/rpc/dcerpc_proto.h"
28 #include "librpc/gen_ndr/ndr_dcerpc.h"
29 #include "auth/credentials/credentials.h"
30 #include "auth/gensec/gensec.h"
31 #include "auth/auth.h"
32 #include "param/param.h"
33 #include "librpc/rpc/rpc_common.h"
36 parse any auth information from a dcerpc bind request
37 return false if we can't handle the auth request for some
38 reason (in which case we send a bind_nak)
40 bool dcesrv_auth_bind(struct dcesrv_call_state
*call
)
42 struct cli_credentials
*server_credentials
= NULL
;
43 struct ncacn_packet
*pkt
= &call
->pkt
;
44 struct dcesrv_connection
*dce_conn
= call
->conn
;
45 struct dcesrv_auth
*auth
= &dce_conn
->auth_state
;
46 bool want_header_signing
= false;
49 if (pkt
->auth_length
== 0) {
50 enum dcerpc_transport_t transport
=
51 dcerpc_binding_get_transport(call
->conn
->endpoint
->ep_description
);
52 const char *auth_type
= derpc_transport_string_by_transport(transport
);
53 const char *transport_protection
= AUTHZ_TRANSPORT_PROTECTION_NONE
;
54 if (transport
== NCACN_NP
) {
55 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SMB
;
57 auth
->auth_type
= DCERPC_AUTH_TYPE_NONE
;
58 auth
->auth_level
= DCERPC_AUTH_LEVEL_NONE
;
59 auth
->auth_context_id
= 0;
62 * Log the authorization to this RPC interface. This
63 * covered ncacn_np pass-through auth, and anonymous
64 * DCE/RPC (eg epmapper, netlogon etc)
66 log_successful_authz_event(call
->conn
->msg_ctx
,
67 call
->conn
->dce_ctx
->lp_ctx
,
68 call
->conn
->remote_address
,
69 call
->conn
->local_address
,
73 call
->conn
->auth_state
.session_info
);
78 status
= dcerpc_pull_auth_trailer(pkt
, call
, &pkt
->u
.bind
.auth_info
,
81 if (!NT_STATUS_IS_OK(status
)) {
83 * Setting DCERPC_AUTH_LEVEL_NONE,
84 * gives the caller the reject_reason
87 * Note: DCERPC_AUTH_LEVEL_NONE == 1
89 auth
->auth_type
= DCERPC_AUTH_TYPE_NONE
;
90 auth
->auth_level
= DCERPC_AUTH_LEVEL_NONE
;
91 auth
->auth_context_id
=
92 DCERPC_BIND_NAK_REASON_PROTOCOL_VERSION_NOT_SUPPORTED
;
96 switch (call
->in_auth_info
.auth_level
) {
97 case DCERPC_AUTH_LEVEL_CONNECT
:
98 case DCERPC_AUTH_LEVEL_CALL
:
99 case DCERPC_AUTH_LEVEL_PACKET
:
100 case DCERPC_AUTH_LEVEL_INTEGRITY
:
101 case DCERPC_AUTH_LEVEL_PRIVACY
:
103 * We evaluate auth_type only if auth_level was valid
108 * Setting DCERPC_AUTH_LEVEL_NONE,
109 * gives the caller the reject_reason
110 * as auth_context_id.
112 * Note: DCERPC_AUTH_LEVEL_NONE == 1
114 auth
->auth_type
= DCERPC_AUTH_TYPE_NONE
;
115 auth
->auth_level
= DCERPC_AUTH_LEVEL_NONE
;
116 auth
->auth_context_id
= DCERPC_BIND_NAK_REASON_NOT_SPECIFIED
;
120 auth
->auth_type
= call
->in_auth_info
.auth_type
;
121 auth
->auth_level
= call
->in_auth_info
.auth_level
;
122 auth
->auth_context_id
= call
->in_auth_info
.auth_context_id
;
125 = cli_credentials_init(call
);
126 if (!server_credentials
) {
127 DEBUG(1, ("Failed to init server credentials\n"));
131 cli_credentials_set_conf(server_credentials
, call
->conn
->dce_ctx
->lp_ctx
);
132 status
= cli_credentials_set_machine_account(server_credentials
, call
->conn
->dce_ctx
->lp_ctx
);
133 if (!NT_STATUS_IS_OK(status
)) {
134 DEBUG(1, ("Failed to obtain server credentials: %s\n",
139 status
= samba_server_gensec_start(dce_conn
, call
->event_ctx
,
141 call
->conn
->dce_ctx
->lp_ctx
,
144 &auth
->gensec_security
);
145 if (!NT_STATUS_IS_OK(status
)) {
146 DEBUG(1, ("Failed to call samba_server_gensec_start %s\n",
152 * We have to call this because we set the target_service for
153 * Kerberos to NULL above, and in any case we wish to log a
154 * more specific service target.
157 status
= gensec_set_target_service_description(auth
->gensec_security
,
159 if (!NT_STATUS_IS_OK(status
)) {
160 DEBUG(1, ("Failed to call gensec_set_target_service_description %s\n",
165 if (call
->conn
->remote_address
!= NULL
) {
166 status
= gensec_set_remote_address(auth
->gensec_security
,
167 call
->conn
->remote_address
);
168 if (!NT_STATUS_IS_OK(status
)) {
169 DEBUG(1, ("Failed to call gensec_set_remote_address() %s\n",
175 if (call
->conn
->local_address
!= NULL
) {
176 status
= gensec_set_local_address(auth
->gensec_security
,
177 call
->conn
->local_address
);
178 if (!NT_STATUS_IS_OK(status
)) {
179 DEBUG(1, ("Failed to call gensec_set_local_address() %s\n",
185 status
= gensec_start_mech_by_authtype(auth
->gensec_security
, auth
->auth_type
,
187 if (!NT_STATUS_IS_OK(status
)) {
188 const char *backend_name
=
189 gensec_get_name_by_authtype(auth
->gensec_security
,
192 DEBUG(3, ("Failed to start GENSEC mechanism for DCERPC server: "
193 "auth_type=%d (%s), auth_level=%d: %s\n",
194 (int)auth
->auth_type
, backend_name
,
195 (int)auth
->auth_level
,
199 * Setting DCERPC_AUTH_LEVEL_NONE,
200 * gives the caller the reject_reason
201 * as auth_context_id.
203 * Note: DCERPC_AUTH_LEVEL_NONE == 1
205 auth
->auth_type
= DCERPC_AUTH_TYPE_NONE
;
206 auth
->auth_level
= DCERPC_AUTH_LEVEL_NONE
;
207 if (backend_name
!= NULL
) {
208 auth
->auth_context_id
=
209 DCERPC_BIND_NAK_REASON_INVALID_CHECKSUM
;
211 auth
->auth_context_id
=
212 DCERPC_BIND_NAK_REASON_INVALID_AUTH_TYPE
;
217 if (call
->pkt
.pfc_flags
& DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN
) {
218 auth
->client_hdr_signing
= true;
219 want_header_signing
= true;
222 if (want_header_signing
) {
223 want_header_signing
= gensec_have_feature(auth
->gensec_security
,
224 GENSEC_FEATURE_SIGN_PKT_HEADER
);
227 if (want_header_signing
) {
228 want_header_signing
= lpcfg_parm_bool(dce_conn
->dce_ctx
->lp_ctx
,
235 if (want_header_signing
) {
236 gensec_want_feature(auth
->gensec_security
,
237 GENSEC_FEATURE_SIGN_PKT_HEADER
);
238 auth
->hdr_signing
= true;
244 NTSTATUS
dcesrv_auth_complete(struct dcesrv_call_state
*call
, NTSTATUS status
)
246 struct dcesrv_connection
*dce_conn
= call
->conn
;
247 const char *pdu
= "<unknown>";
249 switch (call
->pkt
.ptype
) {
250 case DCERPC_PKT_BIND
:
253 case DCERPC_PKT_ALTER
:
256 case DCERPC_PKT_AUTH3
:
258 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
259 DEBUG(4, ("GENSEC not finished at at %s\n", pdu
));
260 return NT_STATUS_RPC_SEC_PKG_ERROR
;
264 return NT_STATUS_INTERNAL_ERROR
;
267 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
271 if (!NT_STATUS_IS_OK(status
)) {
272 DEBUG(4, ("GENSEC mech rejected the incoming authentication "
273 "at %s: %s\n", pdu
, nt_errstr(status
)));
277 status
= gensec_session_info(dce_conn
->auth_state
.gensec_security
,
279 &dce_conn
->auth_state
.session_info
);
280 if (!NT_STATUS_IS_OK(status
)) {
281 DEBUG(1, ("Failed to establish session_info: %s\n",
285 dce_conn
->auth_state
.auth_finished
= true;
286 dce_conn
->allow_request
= true;
288 if (call
->pkt
.ptype
!= DCERPC_PKT_AUTH3
) {
292 if (call
->out_auth_info
->credentials
.length
!= 0) {
293 DEBUG(4, ("GENSEC produced output token (len=%zu) at %s\n",
294 call
->out_auth_info
->credentials
.length
, pdu
));
295 return NT_STATUS_RPC_SEC_PKG_ERROR
;
302 add any auth information needed in a bind ack, and process the authentication
303 information found in the bind.
305 NTSTATUS
dcesrv_auth_prepare_bind_ack(struct dcesrv_call_state
*call
, struct ncacn_packet
*pkt
)
307 struct dcesrv_connection
*dce_conn
= call
->conn
;
309 dce_conn
->allow_alter
= true;
310 dce_conn
->allow_auth3
= true;
312 if (call
->pkt
.auth_length
== 0) {
313 dce_conn
->auth_state
.auth_finished
= true;
314 dce_conn
->allow_request
= true;
318 /* We can't work without an existing gensec state */
319 if (!call
->conn
->auth_state
.gensec_security
) {
320 return NT_STATUS_INTERNAL_ERROR
;
323 if (dce_conn
->auth_state
.hdr_signing
) {
324 pkt
->pfc_flags
|= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN
;
327 call
->_out_auth_info
= (struct dcerpc_auth
) {
328 .auth_type
= dce_conn
->auth_state
.auth_type
,
329 .auth_level
= dce_conn
->auth_state
.auth_level
,
330 .auth_context_id
= dce_conn
->auth_state
.auth_context_id
,
332 call
->out_auth_info
= &call
->_out_auth_info
;
338 process the final stage of a auth request
340 bool dcesrv_auth_prepare_auth3(struct dcesrv_call_state
*call
)
342 struct ncacn_packet
*pkt
= &call
->pkt
;
343 struct dcesrv_connection
*dce_conn
= call
->conn
;
346 if (pkt
->auth_length
== 0) {
350 if (dce_conn
->auth_state
.auth_finished
) {
354 /* We can't work without an existing gensec state */
355 if (!dce_conn
->auth_state
.gensec_security
) {
359 status
= dcerpc_pull_auth_trailer(pkt
, call
, &pkt
->u
.auth3
.auth_info
,
360 &call
->in_auth_info
, NULL
, true);
361 if (!NT_STATUS_IS_OK(status
)) {
363 * Windows returns DCERPC_NCA_S_FAULT_REMOTE_NO_MEMORY
364 * instead of DCERPC_NCA_S_PROTO_ERROR.
366 call
->fault_code
= DCERPC_NCA_S_FAULT_REMOTE_NO_MEMORY
;
370 if (call
->in_auth_info
.auth_type
!= dce_conn
->auth_state
.auth_type
) {
374 if (call
->in_auth_info
.auth_level
!= dce_conn
->auth_state
.auth_level
) {
378 if (call
->in_auth_info
.auth_context_id
!= dce_conn
->auth_state
.auth_context_id
) {
382 call
->_out_auth_info
= (struct dcerpc_auth
) {
383 .auth_type
= dce_conn
->auth_state
.auth_type
,
384 .auth_level
= dce_conn
->auth_state
.auth_level
,
385 .auth_context_id
= dce_conn
->auth_state
.auth_context_id
,
387 call
->out_auth_info
= &call
->_out_auth_info
;
393 parse any auth information from a dcerpc alter request
394 return false if we can't handle the auth request for some
395 reason (in which case we send a bind_nak (is this true for here?))
397 bool dcesrv_auth_alter(struct dcesrv_call_state
*call
)
399 struct ncacn_packet
*pkt
= &call
->pkt
;
400 struct dcesrv_connection
*dce_conn
= call
->conn
;
403 /* on a pure interface change there is no auth blob */
404 if (pkt
->auth_length
== 0) {
405 if (!dce_conn
->auth_state
.auth_finished
) {
411 if (dce_conn
->auth_state
.auth_finished
) {
412 call
->fault_code
= DCERPC_FAULT_ACCESS_DENIED
;
416 /* We can't work without an existing gensec state */
417 if (!dce_conn
->auth_state
.gensec_security
) {
421 status
= dcerpc_pull_auth_trailer(pkt
, call
, &pkt
->u
.alter
.auth_info
,
422 &call
->in_auth_info
, NULL
, true);
423 if (!NT_STATUS_IS_OK(status
)) {
424 call
->fault_code
= DCERPC_NCA_S_PROTO_ERROR
;
428 if (call
->in_auth_info
.auth_type
== DCERPC_AUTH_TYPE_NONE
) {
429 call
->fault_code
= DCERPC_FAULT_ACCESS_DENIED
;
433 if (call
->in_auth_info
.auth_type
!= dce_conn
->auth_state
.auth_type
) {
437 if (call
->in_auth_info
.auth_level
!= dce_conn
->auth_state
.auth_level
) {
441 if (call
->in_auth_info
.auth_context_id
!= dce_conn
->auth_state
.auth_context_id
) {
449 add any auth information needed in a alter ack, and process the authentication
450 information found in the alter.
452 NTSTATUS
dcesrv_auth_prepare_alter_ack(struct dcesrv_call_state
*call
, struct ncacn_packet
*pkt
)
454 struct dcesrv_connection
*dce_conn
= call
->conn
;
456 /* on a pure interface change there is no auth_info structure
458 if (call
->pkt
.auth_length
== 0) {
462 if (!call
->conn
->auth_state
.gensec_security
) {
463 return NT_STATUS_INTERNAL_ERROR
;
466 call
->_out_auth_info
= (struct dcerpc_auth
) {
467 .auth_type
= dce_conn
->auth_state
.auth_type
,
468 .auth_level
= dce_conn
->auth_state
.auth_level
,
469 .auth_context_id
= dce_conn
->auth_state
.auth_context_id
,
471 call
->out_auth_info
= &call
->_out_auth_info
;
477 check credentials on a packet
479 bool dcesrv_auth_pkt_pull(struct dcesrv_call_state
*call
,
480 DATA_BLOB
*full_packet
,
481 uint8_t required_flags
,
482 uint8_t optional_flags
,
483 uint8_t payload_offset
,
484 DATA_BLOB
*payload_and_verifier
)
486 struct ncacn_packet
*pkt
= &call
->pkt
;
487 struct dcesrv_connection
*dce_conn
= call
->conn
;
488 const struct dcerpc_auth tmp_auth
= {
489 .auth_type
= dce_conn
->auth_state
.auth_type
,
490 .auth_level
= dce_conn
->auth_state
.auth_level
,
491 .auth_context_id
= dce_conn
->auth_state
.auth_context_id
,
495 if (!dce_conn
->allow_request
) {
496 call
->fault_code
= DCERPC_NCA_S_PROTO_ERROR
;
500 if (dce_conn
->auth_state
.auth_invalid
) {
504 status
= dcerpc_ncacn_pull_pkt_auth(&tmp_auth
,
505 dce_conn
->auth_state
.gensec_security
,
511 payload_and_verifier
,
514 if (NT_STATUS_EQUAL(status
, NT_STATUS_RPC_PROTOCOL_ERROR
)) {
515 call
->fault_code
= DCERPC_NCA_S_PROTO_ERROR
;
518 if (NT_STATUS_EQUAL(status
, NT_STATUS_RPC_UNSUPPORTED_AUTHN_LEVEL
)) {
519 call
->fault_code
= DCERPC_NCA_S_UNSUPPORTED_AUTHN_LEVEL
;
522 if (NT_STATUS_EQUAL(status
, NT_STATUS_RPC_SEC_PKG_ERROR
)) {
523 call
->fault_code
= DCERPC_FAULT_SEC_PKG_ERROR
;
526 if (NT_STATUS_EQUAL(status
, NT_STATUS_ACCESS_DENIED
)) {
527 call
->fault_code
= DCERPC_FAULT_ACCESS_DENIED
;
530 if (!NT_STATUS_IS_OK(status
)) {
538 push a signed or sealed dcerpc request packet into a blob
540 bool dcesrv_auth_pkt_push(struct dcesrv_call_state
*call
,
541 DATA_BLOB
*blob
, size_t sig_size
,
542 uint8_t payload_offset
,
543 const DATA_BLOB
*payload
,
544 const struct ncacn_packet
*pkt
)
546 struct dcesrv_connection
*dce_conn
= call
->conn
;
547 const struct dcerpc_auth tmp_auth
= {
548 .auth_type
= dce_conn
->auth_state
.auth_type
,
549 .auth_level
= dce_conn
->auth_state
.auth_level
,
550 .auth_context_id
= dce_conn
->auth_state
.auth_context_id
,
554 status
= dcerpc_ncacn_push_pkt_auth(&tmp_auth
,
555 dce_conn
->auth_state
.gensec_security
,
556 call
, blob
, sig_size
,
560 return NT_STATUS_IS_OK(status
);