?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
netlogon_creds_cli: Simplify netlogon_creds_cli_delete
[Samba.git] / auth / gensec / schannel.c
blob8e58e73cacde84984a036751fd9d1c7ceab175c9
1 /*
2 Unix SMB/CIFS implementation.
3
4 dcerpc schannel operations
5
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include <tevent.h>
25 #include "lib/util/tevent_ntstatus.h"
26 #include "librpc/gen_ndr/ndr_schannel.h"
27 #include "auth/auth.h"
28 #include "auth/credentials/credentials.h"
29 #include "auth/gensec/gensec.h"
30 #include "auth/gensec/gensec_internal.h"
31 #include "auth/gensec/gensec_proto.h"
32 #include "../libcli/auth/schannel.h"
33 #include "librpc/gen_ndr/dcerpc.h"
34 #include "param/param.h"
35 #include "auth/gensec/gensec_toplevel_proto.h"
36 #include "lib/crypto/crypto.h"
37 #include "libds/common/roles.h"
38
39 struct schannel_state {
40 struct gensec_security *gensec;
41 uint64_t seq_num;
42 bool initiator;
43 struct netlogon_creds_CredentialState *creds;
44 struct auth_user_info_dc *user_info_dc;
45 };
46
47 #define SETUP_SEQNUM(state, buf, initiator) do { \
48 uint8_t *_buf = buf; \
49 uint32_t _seq_num_low = (state)->seq_num & UINT32_MAX; \
50 uint32_t _seq_num_high = (state)->seq_num >> 32; \
51 if (initiator) { \
52 _seq_num_high |= 0x80000000; \
53 } \
54 RSIVAL(_buf, 0, _seq_num_low); \
55 RSIVAL(_buf, 4, _seq_num_high); \
56 } while(0)
57
58 static struct schannel_state *netsec_create_state(
59 struct gensec_security *gensec,
60 struct netlogon_creds_CredentialState *creds,
61 bool initiator)
62 {
63 struct schannel_state *state;
64
65 state = talloc_zero(gensec, struct schannel_state);
66 if (state == NULL) {
67 return NULL;
68 }
69
70 state->gensec = gensec;
71 state->initiator = initiator;
72 state->creds = netlogon_creds_copy(state, creds);
73 if (state->creds == NULL) {
74 talloc_free(state);
75 return NULL;
76 }
77
78 gensec->private_data = state;
79
80 return state;
81 }
82
83 static void netsec_offset_and_sizes(struct schannel_state *state,
84 bool do_seal,
85 uint32_t *_min_sig_size,
86 uint32_t *_used_sig_size,
87 uint32_t *_checksum_length,
88 uint32_t *_confounder_ofs)
89 {
90 uint32_t min_sig_size;
91 uint32_t used_sig_size;
92 uint32_t checksum_length;
93 uint32_t confounder_ofs;
94
95 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
96 min_sig_size = 48;
97 used_sig_size = 56;
98 /*
99 * Note: windows has a bug here and uses the old values...
100 *
101 * checksum_length = 32;
102 * confounder_ofs = 48;
103 */
104 checksum_length = 8;
105 confounder_ofs = 24;
106 } else {
107 min_sig_size = 24;
108 used_sig_size = 32;
109 checksum_length = 8;
110 confounder_ofs = 24;
111 }
112
113 if (do_seal) {
114 min_sig_size += 8;
115 }
116
117 if (_min_sig_size) {
118 *_min_sig_size = min_sig_size;
119 }
120
121 if (_used_sig_size) {
122 *_used_sig_size = used_sig_size;
123 }
124
125 if (_checksum_length) {
126 *_checksum_length = checksum_length;
127 }
128
129 if (_confounder_ofs) {
130 *_confounder_ofs = confounder_ofs;
131 }
132 }
133
134 /*******************************************************************
135 Encode or Decode the sequence number (which is symmetric)
136 ********************************************************************/
137 static void netsec_do_seq_num(struct schannel_state *state,
138 const uint8_t *checksum,
139 uint32_t checksum_length,
140 uint8_t seq_num[8])
141 {
142 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
143 AES_KEY key;
144 uint8_t iv[AES_BLOCK_SIZE];
145
146 AES_set_encrypt_key(state->creds->session_key, 128, &key);
147 ZERO_STRUCT(iv);
148 memcpy(iv+0, checksum, 8);
149 memcpy(iv+8, checksum, 8);
150
151 aes_cfb8_encrypt(seq_num, seq_num, 8, &key, iv, AES_ENCRYPT);
152 } else {
153 static const uint8_t zeros[4];
154 uint8_t sequence_key[16];
155 uint8_t digest1[16];
156
157 hmac_md5(state->creds->session_key, zeros, sizeof(zeros), digest1);
158 hmac_md5(digest1, checksum, checksum_length, sequence_key);
159 arcfour_crypt(seq_num, sequence_key, 8);
160 }
161
162 state->seq_num++;
163 }
164
165 static void netsec_do_seal(struct schannel_state *state,
166 const uint8_t seq_num[8],
167 uint8_t confounder[8],
168 uint8_t *data, uint32_t length,
169 bool forward)
170 {
171 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
172 AES_KEY key;
173 uint8_t iv[AES_BLOCK_SIZE];
174 uint8_t sess_kf0[16];
175 int i;
176
177 for (i = 0; i < 16; i++) {
178 sess_kf0[i] = state->creds->session_key[i] ^ 0xf0;
179 }
180
181 AES_set_encrypt_key(sess_kf0, 128, &key);
182 ZERO_STRUCT(iv);
183 memcpy(iv+0, seq_num, 8);
184 memcpy(iv+8, seq_num, 8);
185
186 if (forward) {
187 aes_cfb8_encrypt(confounder, confounder, 8, &key, iv, AES_ENCRYPT);
188 aes_cfb8_encrypt(data, data, length, &key, iv, AES_ENCRYPT);
189 } else {
190 aes_cfb8_encrypt(confounder, confounder, 8, &key, iv, AES_DECRYPT);
191 aes_cfb8_encrypt(data, data, length, &key, iv, AES_DECRYPT);
192 }
193 } else {
194 uint8_t sealing_key[16];
195 static const uint8_t zeros[4];
196 uint8_t digest2[16];
197 uint8_t sess_kf0[16];
198 int i;
199
200 for (i = 0; i < 16; i++) {
201 sess_kf0[i] = state->creds->session_key[i] ^ 0xf0;
202 }
203
204 hmac_md5(sess_kf0, zeros, 4, digest2);
205 hmac_md5(digest2, seq_num, 8, sealing_key);
206
207 arcfour_crypt(confounder, sealing_key, 8);
208 arcfour_crypt(data, sealing_key, length);
209 }
210 }
211
212 /*******************************************************************
213 Create a digest over the entire packet (including the data), and
214 MD5 it with the session key.
215 ********************************************************************/
216 static void netsec_do_sign(struct schannel_state *state,
217 const uint8_t *confounder,
218 const uint8_t *data, size_t length,
219 uint8_t header[8],
220 uint8_t *checksum)
221 {
222 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
223 struct HMACSHA256Context ctx;
224
225 hmac_sha256_init(state->creds->session_key,
226 sizeof(state->creds->session_key),
227 &ctx);
228
229 if (confounder) {
230 SSVAL(header, 0, NL_SIGN_HMAC_SHA256);
231 SSVAL(header, 2, NL_SEAL_AES128);
232 SSVAL(header, 4, 0xFFFF);
233 SSVAL(header, 6, 0x0000);
234
235 hmac_sha256_update(header, 8, &ctx);
236 hmac_sha256_update(confounder, 8, &ctx);
237 } else {
238 SSVAL(header, 0, NL_SIGN_HMAC_SHA256);
239 SSVAL(header, 2, NL_SEAL_NONE);
240 SSVAL(header, 4, 0xFFFF);
241 SSVAL(header, 6, 0x0000);
242
243 hmac_sha256_update(header, 8, &ctx);
244 }
245
246 hmac_sha256_update(data, length, &ctx);
247
248 hmac_sha256_final(checksum, &ctx);
249 } else {
250 uint8_t packet_digest[16];
251 static const uint8_t zeros[4];
252 MD5_CTX ctx;
253
254 MD5Init(&ctx);
255 MD5Update(&ctx, zeros, 4);
256 if (confounder) {
257 SSVAL(header, 0, NL_SIGN_HMAC_MD5);
258 SSVAL(header, 2, NL_SEAL_RC4);
259 SSVAL(header, 4, 0xFFFF);
260 SSVAL(header, 6, 0x0000);
261
262 MD5Update(&ctx, header, 8);
263 MD5Update(&ctx, confounder, 8);
264 } else {
265 SSVAL(header, 0, NL_SIGN_HMAC_MD5);
266 SSVAL(header, 2, NL_SEAL_NONE);
267 SSVAL(header, 4, 0xFFFF);
268 SSVAL(header, 6, 0x0000);
269
270 MD5Update(&ctx, header, 8);
271 }
272 MD5Update(&ctx, data, length);
273 MD5Final(packet_digest, &ctx);
274
275 hmac_md5(state->creds->session_key,
276 packet_digest, sizeof(packet_digest),
277 checksum);
278 }
279 }
280
281 static NTSTATUS netsec_incoming_packet(struct schannel_state *state,
282 bool do_unseal,
283 uint8_t *data, size_t length,
284 const uint8_t *whole_pdu, size_t pdu_length,
285 const DATA_BLOB *sig)
286 {
287 uint32_t min_sig_size = 0;
288 uint8_t header[8];
289 uint8_t checksum[32];
290 uint32_t checksum_length = sizeof(checksum_length);
291 uint8_t _confounder[8];
292 uint8_t *confounder = NULL;
293 uint32_t confounder_ofs = 0;
294 uint8_t seq_num[8];
295 int ret;
296 const uint8_t *sign_data = NULL;
297 size_t sign_length = 0;
298
299 netsec_offset_and_sizes(state,
300 do_unseal,
301 &min_sig_size,
302 NULL,
303 &checksum_length,
304 &confounder_ofs);
305
306 if (sig->length < min_sig_size) {
307 return NT_STATUS_ACCESS_DENIED;
308 }
309
310 if (do_unseal) {
311 confounder = _confounder;
312 memcpy(confounder, sig->data+confounder_ofs, 8);
313 } else {
314 confounder = NULL;
315 }
316
317 SETUP_SEQNUM(state, seq_num, !state->initiator);
318
319 if (do_unseal) {
320 netsec_do_seal(state, seq_num,
321 confounder,
322 data, length,
323 false);
324 }
325
326 if (state->gensec->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
327 sign_data = whole_pdu;
328 sign_length = pdu_length;
329 } else {
330 sign_data = data;
331 sign_length = length;
332 }
333
334 netsec_do_sign(state, confounder,
335 sign_data, sign_length,
336 header, checksum);
337
338 ret = memcmp(checksum, sig->data+16, checksum_length);
339 if (ret != 0) {
340 dump_data_pw("calc digest:", checksum, checksum_length);
341 dump_data_pw("wire digest:", sig->data+16, checksum_length);
342 return NT_STATUS_ACCESS_DENIED;
343 }
344
345 netsec_do_seq_num(state, checksum, checksum_length, seq_num);
346
347 ret = memcmp(seq_num, sig->data+8, 8);
348 if (ret != 0) {
349 dump_data_pw("calc seq num:", seq_num, 8);
350 dump_data_pw("wire seq num:", sig->data+8, 8);
351 return NT_STATUS_ACCESS_DENIED;
352 }
353
354 return NT_STATUS_OK;
355 }
356
357 static uint32_t netsec_outgoing_sig_size(struct schannel_state *state)
358 {
359 uint32_t sig_size = 0;
360
361 netsec_offset_and_sizes(state,
362 true,
363 NULL,
364 &sig_size,
365 NULL,
366 NULL);
367
368 return sig_size;
369 }
370
371 static NTSTATUS netsec_outgoing_packet(struct schannel_state *state,
372 TALLOC_CTX *mem_ctx,
373 bool do_seal,
374 uint8_t *data, size_t length,
375 const uint8_t *whole_pdu, size_t pdu_length,
376 DATA_BLOB *sig)
377 {
378 uint32_t min_sig_size = 0;
379 uint32_t used_sig_size = 0;
380 uint8_t header[8];
381 uint8_t checksum[32];
382 uint32_t checksum_length = sizeof(checksum_length);
383 uint8_t _confounder[8];
384 uint8_t *confounder = NULL;
385 uint32_t confounder_ofs = 0;
386 uint8_t seq_num[8];
387 const uint8_t *sign_data = NULL;
388 size_t sign_length = 0;
389
390 netsec_offset_and_sizes(state,
391 do_seal,
392 &min_sig_size,
393 &used_sig_size,
394 &checksum_length,
395 &confounder_ofs);
396
397 SETUP_SEQNUM(state, seq_num, state->initiator);
398
399 if (do_seal) {
400 confounder = _confounder;
401 generate_random_buffer(confounder, 8);
402 } else {
403 confounder = NULL;
404 }
405
406 if (state->gensec->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
407 sign_data = whole_pdu;
408 sign_length = pdu_length;
409 } else {
410 sign_data = data;
411 sign_length = length;
412 }
413
414 netsec_do_sign(state, confounder,
415 sign_data, sign_length,
416 header, checksum);
417
418 if (do_seal) {
419 netsec_do_seal(state, seq_num,
420 confounder,
421 data, length,
422 true);
423 }
424
425 netsec_do_seq_num(state, checksum, checksum_length, seq_num);
426
427 (*sig) = data_blob_talloc_zero(mem_ctx, used_sig_size);
428
429 memcpy(sig->data, header, 8);
430 memcpy(sig->data+8, seq_num, 8);
431 memcpy(sig->data+16, checksum, checksum_length);
432
433 if (confounder) {
434 memcpy(sig->data+confounder_ofs, confounder, 8);
435 }
436
437 dump_data_pw("signature:", sig->data+ 0, 8);
438 dump_data_pw("seq_num :", sig->data+ 8, 8);
439 dump_data_pw("digest :", sig->data+16, checksum_length);
440 dump_data_pw("confound :", sig->data+confounder_ofs, 8);
441
442 return NT_STATUS_OK;
443 }
444
445 _PUBLIC_ NTSTATUS gensec_schannel_init(TALLOC_CTX *ctx);
446
447 static size_t schannel_sig_size(struct gensec_security *gensec_security, size_t data_size)
448 {
449 struct schannel_state *state =
450 talloc_get_type_abort(gensec_security->private_data,
451 struct schannel_state);
452
453 return netsec_outgoing_sig_size(state);
454 }
455
456 struct schannel_update_state {
457 NTSTATUS status;
458 DATA_BLOB out;
459 };
460
461 static NTSTATUS schannel_update_internal(struct gensec_security *gensec_security,
462 TALLOC_CTX *out_mem_ctx,
463 const DATA_BLOB in, DATA_BLOB *out);
464
465 static struct tevent_req *schannel_update_send(TALLOC_CTX *mem_ctx,
466 struct tevent_context *ev,
467 struct gensec_security *gensec_security,
468 const DATA_BLOB in)
469 {
470 struct tevent_req *req;
471 struct schannel_update_state *state = NULL;
472 NTSTATUS status;
473
474 req = tevent_req_create(mem_ctx, &state,
475 struct schannel_update_state);
476 if (req == NULL) {
477 return NULL;
478 }
479
480 status = schannel_update_internal(gensec_security,
481 state, in,
482 &state->out);
483 state->status = status;
484 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
485 status = NT_STATUS_OK;
486 }
487 if (tevent_req_nterror(req, status)) {
488 return tevent_req_post(req, ev);
489 }
490
491 tevent_req_done(req);
492 return tevent_req_post(req, ev);
493 }
494
495 static NTSTATUS schannel_update_internal(struct gensec_security *gensec_security,
496 TALLOC_CTX *out_mem_ctx,
497 const DATA_BLOB in, DATA_BLOB *out)
498 {
499 struct schannel_state *state =
500 talloc_get_type(gensec_security->private_data,
501 struct schannel_state);
502 NTSTATUS status;
503 enum ndr_err_code ndr_err;
504 struct NL_AUTH_MESSAGE bind_schannel = {};
505 struct NL_AUTH_MESSAGE bind_schannel_ack;
506 struct netlogon_creds_CredentialState *creds;
507 const char *workstation;
508 const char *domain;
509
510 *out = data_blob(NULL, 0);
511
512 if (gensec_security->dcerpc_auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) {
513 switch (gensec_security->gensec_role) {
514 case GENSEC_CLIENT:
515 return NT_STATUS_INVALID_PARAMETER_MIX;
516 case GENSEC_SERVER:
517 return NT_STATUS_INVALID_PARAMETER;
518 }
519 return NT_STATUS_INTERNAL_ERROR;
520 }
521
522 switch (gensec_security->gensec_role) {
523 case GENSEC_CLIENT:
524 if (state != NULL) {
525 /* we could parse the bind ack, but we don't know what it is yet */
526 return NT_STATUS_OK;
527 }
528
529 creds = cli_credentials_get_netlogon_creds(gensec_security->credentials);
530 if (creds == NULL) {
531 return NT_STATUS_INVALID_PARAMETER_MIX;
532 }
533
534 state = netsec_create_state(gensec_security,
535 creds, true /* initiator */);
536 if (state == NULL) {
537 return NT_STATUS_NO_MEMORY;
538 }
539
540 bind_schannel.MessageType = NL_NEGOTIATE_REQUEST;
541
542 bind_schannel.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
543 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
544 bind_schannel.oem_netbios_domain.a = cli_credentials_get_domain(gensec_security->credentials);
545 bind_schannel.oem_netbios_computer.a = creds->computer_name;
546
547 if (creds->secure_channel_type == SEC_CHAN_DNS_DOMAIN) {
548 bind_schannel.Flags |= NL_FLAG_UTF8_DNS_DOMAIN_NAME;
549 bind_schannel.utf8_dns_domain.u = cli_credentials_get_realm(gensec_security->credentials);
550
551 bind_schannel.Flags |= NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME;
552 bind_schannel.utf8_netbios_computer.u = creds->computer_name;
553 }
554
555 ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel,
556 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
557 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
558 status = ndr_map_error2ntstatus(ndr_err);
559 DEBUG(3, ("Could not create schannel bind: %s\n",
560 nt_errstr(status)));
561 return status;
562 }
563
564 return NT_STATUS_MORE_PROCESSING_REQUIRED;
565 case GENSEC_SERVER:
566
567 if (state != NULL) {
568 /* no third leg on this protocol */
569 return NT_STATUS_INVALID_PARAMETER;
570 }
571
572 /* parse the schannel startup blob */
573 ndr_err = ndr_pull_struct_blob(&in, out_mem_ctx, &bind_schannel,
574 (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
575 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
576 status = ndr_map_error2ntstatus(ndr_err);
577 DEBUG(3, ("Could not parse incoming schannel bind: %s\n",
578 nt_errstr(status)));
579 return status;
580 }
581
582 if (bind_schannel.Flags & NL_FLAG_OEM_NETBIOS_DOMAIN_NAME) {
583 domain = bind_schannel.oem_netbios_domain.a;
584 if (strcasecmp_m(domain, lpcfg_workgroup(gensec_security->settings->lp_ctx)) != 0) {
585 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
586 domain, lpcfg_workgroup(gensec_security->settings->lp_ctx)));
587 return NT_STATUS_LOGON_FAILURE;
588 }
589 } else if (bind_schannel.Flags & NL_FLAG_UTF8_DNS_DOMAIN_NAME) {
590 domain = bind_schannel.utf8_dns_domain.u;
591 if (strcasecmp_m(domain, lpcfg_dnsdomain(gensec_security->settings->lp_ctx)) != 0) {
592 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
593 domain, lpcfg_dnsdomain(gensec_security->settings->lp_ctx)));
594 return NT_STATUS_LOGON_FAILURE;
595 }
596 } else {
597 DEBUG(3, ("Request for schannel to without domain\n"));
598 return NT_STATUS_LOGON_FAILURE;
599 }
600
601 if (bind_schannel.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME) {
602 workstation = bind_schannel.oem_netbios_computer.a;
603 } else if (bind_schannel.Flags & NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME) {
604 workstation = bind_schannel.utf8_netbios_computer.u;
605 } else {
606 DEBUG(3, ("Request for schannel to without netbios workstation\n"));
607 return NT_STATUS_LOGON_FAILURE;
608 }
609
610 status = schannel_get_creds_state(out_mem_ctx,
611 gensec_security->settings->lp_ctx,
612 workstation, &creds);
613 if (!NT_STATUS_IS_OK(status)) {
614 DEBUG(3, ("Could not find session key for attempted schannel connection from %s: %s\n",
615 workstation, nt_errstr(status)));
616 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
617 return NT_STATUS_LOGON_FAILURE;
618 }
619 return status;
620 }
621
622 state = netsec_create_state(gensec_security,
623 creds, false /* not initiator */);
624 if (state == NULL) {
625 return NT_STATUS_NO_MEMORY;
626 }
627
628 status = auth_anonymous_user_info_dc(state,
629 lpcfg_netbios_name(gensec_security->settings->lp_ctx),
630 &state->user_info_dc);
631 if (!NT_STATUS_IS_OK(status)) {
632 return status;
633 }
634
635 bind_schannel_ack.MessageType = NL_NEGOTIATE_RESPONSE;
636 bind_schannel_ack.Flags = 0;
637 bind_schannel_ack.Buffer.dummy = 0x6c0000; /* actually I think
638 * this does not have
639 * any meaning here
640 * - gd */
641
642 ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel_ack,
643 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
644 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
645 status = ndr_map_error2ntstatus(ndr_err);
646 DEBUG(3, ("Could not return schannel bind ack for client %s: %s\n",
647 workstation, nt_errstr(status)));
648 return status;
649 }
650
651 return NT_STATUS_OK;
652 }
653 return NT_STATUS_INVALID_PARAMETER;
654 }
655
656 static NTSTATUS schannel_update_recv(struct tevent_req *req,
657 TALLOC_CTX *out_mem_ctx,
658 DATA_BLOB *out)
659 {
660 struct schannel_update_state *state =
661 tevent_req_data(req,
662 struct schannel_update_state);
663 NTSTATUS status;
664
665 *out = data_blob_null;
666
667 if (tevent_req_is_nterror(req, &status)) {
668 tevent_req_received(req);
669 return status;
670 }
671
672 status = state->status;
673 talloc_steal(out_mem_ctx, state->out.data);
674 *out = state->out;
675 tevent_req_received(req);
676 return status;
677 }
678
679 /**
680 * Returns anonymous credentials for schannel, matching Win2k3.
681 *
682 */
683
684 static NTSTATUS schannel_session_info(struct gensec_security *gensec_security,
685 TALLOC_CTX *mem_ctx,
686 struct auth_session_info **_session_info)
687 {
688 struct schannel_state *state =
689 talloc_get_type(gensec_security->private_data,
690 struct schannel_state);
691 struct auth4_context *auth_ctx = gensec_security->auth_context;
692 struct auth_session_info *session_info = NULL;
693 uint32_t session_info_flags = 0;
694 NTSTATUS status;
695
696 if (auth_ctx == NULL) {
697 DEBUG(0, ("Cannot generate a session_info without the auth_context\n"));
698 return NT_STATUS_INTERNAL_ERROR;
699 }
700
701 if (auth_ctx->generate_session_info == NULL) {
702 DEBUG(0, ("Cannot generate a session_info without the generate_session_info hook\n"));
703 return NT_STATUS_INTERNAL_ERROR;
704 }
705
706 if (gensec_security->want_features & GENSEC_FEATURE_UNIX_TOKEN) {
707 session_info_flags |= AUTH_SESSION_INFO_UNIX_TOKEN;
708 }
709
710 session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
711
712 status = auth_ctx->generate_session_info(
713 auth_ctx,
714 mem_ctx,
715 state->user_info_dc,
716 state->user_info_dc->info->account_name,
717 session_info_flags,
718 &session_info);
719 if (!NT_STATUS_IS_OK(status)) {
720 return status;
721 }
722
723 *_session_info = session_info;
724 return NT_STATUS_OK;
725 }
726
727 /*
728 * Reduce the attack surface by ensuring schannel is not availble when
729 * we are not a DC
730 */
731 static NTSTATUS schannel_server_start(struct gensec_security *gensec_security)
732 {
733 enum server_role server_role
734 = lpcfg_server_role(gensec_security->settings->lp_ctx);
735
736 switch (server_role) {
737 case ROLE_DOMAIN_BDC:
738 case ROLE_DOMAIN_PDC:
739 case ROLE_ACTIVE_DIRECTORY_DC:
740 return NT_STATUS_OK;
741 default:
742 return NT_STATUS_NOT_IMPLEMENTED;
743 }
744 }
745
746 static NTSTATUS schannel_client_start(struct gensec_security *gensec_security)
747 {
748 return NT_STATUS_OK;
749 }
750
751 static bool schannel_have_feature(struct gensec_security *gensec_security,
752 uint32_t feature)
753 {
754 if (gensec_security->dcerpc_auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY) {
755 if (feature & GENSEC_FEATURE_SIGN) {
756 return true;
757 }
758 }
759 if (gensec_security->dcerpc_auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
760 if (feature & GENSEC_FEATURE_SEAL) {
761 return true;
762 }
763 }
764 if (feature & GENSEC_FEATURE_DCE_STYLE) {
765 return true;
766 }
767 if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
768 return true;
769 }
770 return false;
771 }
772
773 /*
774 unseal a packet
775 */
776 static NTSTATUS schannel_unseal_packet(struct gensec_security *gensec_security,
777 uint8_t *data, size_t length,
778 const uint8_t *whole_pdu, size_t pdu_length,
779 const DATA_BLOB *sig)
780 {
781 struct schannel_state *state =
782 talloc_get_type_abort(gensec_security->private_data,
783 struct schannel_state);
784
785 return netsec_incoming_packet(state, true,
786 discard_const_p(uint8_t, data),
787 length,
788 whole_pdu, pdu_length,
789 sig);
790 }
791
792 /*
793 check the signature on a packet
794 */
795 static NTSTATUS schannel_check_packet(struct gensec_security *gensec_security,
796 const uint8_t *data, size_t length,
797 const uint8_t *whole_pdu, size_t pdu_length,
798 const DATA_BLOB *sig)
799 {
800 struct schannel_state *state =
801 talloc_get_type_abort(gensec_security->private_data,
802 struct schannel_state);
803
804 return netsec_incoming_packet(state, false,
805 discard_const_p(uint8_t, data),
806 length,
807 whole_pdu, pdu_length,
808 sig);
809 }
810 /*
811 seal a packet
812 */
813 static NTSTATUS schannel_seal_packet(struct gensec_security *gensec_security,
814 TALLOC_CTX *mem_ctx,
815 uint8_t *data, size_t length,
816 const uint8_t *whole_pdu, size_t pdu_length,
817 DATA_BLOB *sig)
818 {
819 struct schannel_state *state =
820 talloc_get_type_abort(gensec_security->private_data,
821 struct schannel_state);
822
823 return netsec_outgoing_packet(state, mem_ctx, true,
824 data, length,
825 whole_pdu, pdu_length,
826 sig);
827 }
828
829 /*
830 sign a packet
831 */
832 static NTSTATUS schannel_sign_packet(struct gensec_security *gensec_security,
833 TALLOC_CTX *mem_ctx,
834 const uint8_t *data, size_t length,
835 const uint8_t *whole_pdu, size_t pdu_length,
836 DATA_BLOB *sig)
837 {
838 struct schannel_state *state =
839 talloc_get_type_abort(gensec_security->private_data,
840 struct schannel_state);
841
842 return netsec_outgoing_packet(state, mem_ctx, false,
843 discard_const_p(uint8_t, data),
844 length,
845 whole_pdu, pdu_length,
846 sig);
847 }
848
849 static const struct gensec_security_ops gensec_schannel_security_ops = {
850 .name = "schannel",
851 .auth_type = DCERPC_AUTH_TYPE_SCHANNEL,
852 .client_start = schannel_client_start,
853 .server_start = schannel_server_start,
854 .update_send = schannel_update_send,
855 .update_recv = schannel_update_recv,
856 .seal_packet = schannel_seal_packet,
857 .sign_packet = schannel_sign_packet,
858 .check_packet = schannel_check_packet,
859 .unseal_packet = schannel_unseal_packet,
860 .session_info = schannel_session_info,
861 .sig_size = schannel_sig_size,
862 .have_feature = schannel_have_feature,
863 .enabled = true,
864 .priority = GENSEC_SCHANNEL
865 };
866
867 _PUBLIC_ NTSTATUS gensec_schannel_init(TALLOC_CTX *ctx)
868 {
869 NTSTATUS ret;
870 ret = gensec_register(ctx, &gensec_schannel_security_ops);
871 if (!NT_STATUS_IS_OK(ret)) {
872 DEBUG(0,("Failed to register '%s' gensec backend!\n",
873 gensec_schannel_security_ops.name));
874 return ret;
875 }
876
877 return ret;
878 }
Samba GIT mirror