?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:gse: remember the expire time
[Samba/gebeck_regimport.git] / source3 / librpc / crypto / gse.c
blob64ae97720fef232b92da7085aae695af849d2bfe
1 /*
2 * GSSAPI Security Extensions
3 * RPC Pipe client and server routines
4 * Copyright (C) Simo Sorce 2010.
5 * Copyright (C) Andrew Bartlett 2004-2011.
6 * Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 /* We support only GSSAPI/KRB5 here */
23
24 #include "includes.h"
25 #include "gse.h"
26 #include "libads/kerberos_proto.h"
27 #include "auth/common_auth.h"
28 #include "auth/gensec/gensec.h"
29 #include "auth/credentials/credentials.h"
30 #include "../librpc/gen_ndr/dcerpc.h"
31
32 #if defined(HAVE_KRB5)
33
34 #include "auth/kerberos/pac_utils.h"
35 #include "gse_krb5.h"
36
37 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
38
39 struct gse_context {
40 gss_ctx_id_t gssapi_context;
41 gss_name_t server_name;
42 gss_name_t client_name;
43 OM_uint32 gss_want_flags, gss_got_flags;
44
45 gss_cred_id_t delegated_cred_handle;
46
47 NTTIME expire_time;
48
49 /* gensec_gse only */
50 krb5_context k5ctx;
51 krb5_ccache ccache;
52 krb5_keytab keytab;
53
54 gss_OID_desc gss_mech;
55 gss_cred_id_t creds;
56
57 gss_OID ret_mech;
58 };
59
60 #ifndef HAVE_GSS_OID_EQUAL
61
62 static bool gss_oid_equal(const gss_OID o1, const gss_OID o2)
63 {
64 if (o1 == o2) {
65 return true;
66 }
67 if ((o1 == NULL && o2 != NULL) || (o1 != NULL && o2 == NULL)) {
68 return false;
69 }
70 if (o1->length != o2->length) {
71 return false;
72 }
73 return memcmp(o1->elements, o2->elements, o1->length) == false;
74 }
75
76 #endif
77
78 /* free non talloc dependent contexts */
79 static int gse_context_destructor(void *ptr)
80 {
81 struct gse_context *gse_ctx;
82 OM_uint32 gss_min;
83
84 gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
85 if (gse_ctx->k5ctx) {
86 if (gse_ctx->ccache) {
87 krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
88 gse_ctx->ccache = NULL;
89 }
90 if (gse_ctx->keytab) {
91 krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
92 gse_ctx->keytab = NULL;
93 }
94 krb5_free_context(gse_ctx->k5ctx);
95 gse_ctx->k5ctx = NULL;
96 }
97 if (gse_ctx->gssapi_context != GSS_C_NO_CONTEXT) {
98 (void)gss_delete_sec_context(&gss_min,
99 &gse_ctx->gssapi_context,
100 GSS_C_NO_BUFFER);
101 }
102 if (gse_ctx->server_name) {
103 (void)gss_release_name(&gss_min,
104 &gse_ctx->server_name);
105 }
106 if (gse_ctx->client_name) {
107 (void)gss_release_name(&gss_min,
108 &gse_ctx->client_name);
109 }
110 if (gse_ctx->creds) {
111 (void)gss_release_cred(&gss_min,
112 &gse_ctx->creds);
113 }
114 if (gse_ctx->delegated_cred_handle) {
115 (void)gss_release_cred(&gss_min,
116 &gse_ctx->delegated_cred_handle);
117 }
118
119 /* MIT and Heimdal differ as to if you can call
120 * gss_release_oid() on this OID, generated by
121 * gss_{accept,init}_sec_context(). However, as long as the
122 * oid is gss_mech_krb5 (which it always is at the moment),
123 * then this is a moot point, as both declare this particular
124 * OID static, and so no memory is lost. This assert is in
125 * place to ensure that the programmer who wishes to extend
126 * this code to EAP or other GSS mechanisms determines an
127 * implementation-dependent way of releasing any dynamically
128 * allocated OID */
129 SMB_ASSERT(gss_oid_equal(&gse_ctx->gss_mech, GSS_C_NO_OID) || gss_oid_equal(&gse_ctx->gss_mech, gss_mech_krb5));
130
131 return 0;
132 }
133
134 static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
135 bool do_sign, bool do_seal,
136 const char *ccache_name,
137 uint32_t add_gss_c_flags,
138 struct gse_context **_gse_ctx)
139 {
140 struct gse_context *gse_ctx;
141 krb5_error_code k5ret;
142 NTSTATUS status;
143
144 gse_ctx = talloc_zero(mem_ctx, struct gse_context);
145 if (!gse_ctx) {
146 return NT_STATUS_NO_MEMORY;
147 }
148 talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
149
150 memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
151
152 gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
153 GSS_C_DELEG_FLAG |
154 GSS_C_DELEG_POLICY_FLAG |
155 GSS_C_REPLAY_FLAG |
156 GSS_C_SEQUENCE_FLAG;
157 if (do_sign) {
158 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
159 }
160 if (do_seal) {
161 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
162 gse_ctx->gss_want_flags |= GSS_C_CONF_FLAG;
163 }
164
165 gse_ctx->gss_want_flags |= add_gss_c_flags;
166
167 /* Initialize Kerberos Context */
168 initialize_krb5_error_table();
169
170 k5ret = krb5_init_context(&gse_ctx->k5ctx);
171 if (k5ret) {
172 DEBUG(0, ("Failed to initialize kerberos context! (%s)\n",
173 error_message(k5ret)));
174 status = NT_STATUS_INTERNAL_ERROR;
175 goto err_out;
176 }
177
178 if (!ccache_name) {
179 ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
180 }
181 k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
182 &gse_ctx->ccache);
183 if (k5ret) {
184 DEBUG(1, ("Failed to resolve credential cache! (%s)\n",
185 error_message(k5ret)));
186 status = NT_STATUS_INTERNAL_ERROR;
187 goto err_out;
188 }
189
190 /* TODO: Should we enforce a enc_types list ?
191 ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
192 */
193
194 *_gse_ctx = gse_ctx;
195 return NT_STATUS_OK;
196
197 err_out:
198 TALLOC_FREE(gse_ctx);
199 return status;
200 }
201
202 static NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
203 bool do_sign, bool do_seal,
204 const char *ccache_name,
205 const char *server,
206 const char *service,
207 const char *username,
208 const char *password,
209 uint32_t add_gss_c_flags,
210 struct gse_context **_gse_ctx)
211 {
212 struct gse_context *gse_ctx;
213 OM_uint32 gss_maj, gss_min;
214 gss_buffer_desc name_buffer = {0, NULL};
215 gss_OID_set_desc mech_set;
216 NTSTATUS status;
217
218 if (!server || !service) {
219 return NT_STATUS_INVALID_PARAMETER;
220 }
221
222 status = gse_context_init(mem_ctx, do_sign, do_seal,
223 ccache_name, add_gss_c_flags,
224 &gse_ctx);
225 if (!NT_STATUS_IS_OK(status)) {
226 return NT_STATUS_NO_MEMORY;
227 }
228
229 /* Guess the realm based on the supplied service, and avoid the GSS libs
230 doing DNS lookups which may fail.
231
232 TODO: Loop with the KDC on some more combinations (local
233 realm in particular), possibly falling back to
234 GSS_C_NT_HOSTBASED_SERVICE
235 */
236 name_buffer.value = kerberos_get_principal_from_service_hostname(
237 gse_ctx, service, server, lp_realm());
238 if (!name_buffer.value) {
239 status = NT_STATUS_NO_MEMORY;
240 goto err_out;
241 }
242 name_buffer.length = strlen((char *)name_buffer.value);
243 gss_maj = gss_import_name(&gss_min, &name_buffer,
244 GSS_C_NT_USER_NAME,
245 &gse_ctx->server_name);
246 if (gss_maj) {
247 DEBUG(0, ("gss_import_name failed for %s, with [%s]\n",
248 (char *)name_buffer.value,
249 gse_errstr(gse_ctx, gss_maj, gss_min)));
250 status = NT_STATUS_INTERNAL_ERROR;
251 goto err_out;
252 }
253
254 /* TODO: get krb5 ticket using username/password, if no valid
255 * one already available in ccache */
256
257 mech_set.count = 1;
258 mech_set.elements = &gse_ctx->gss_mech;
259
260 gss_maj = gss_acquire_cred(&gss_min,
261 GSS_C_NO_NAME,
262 GSS_C_INDEFINITE,
263 &mech_set,
264 GSS_C_INITIATE,
265 &gse_ctx->creds,
266 NULL, NULL);
267 if (gss_maj) {
268 DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n",
269 (char *)name_buffer.value,
270 gse_errstr(gse_ctx, gss_maj, gss_min)));
271 status = NT_STATUS_INTERNAL_ERROR;
272 goto err_out;
273 }
274
275 *_gse_ctx = gse_ctx;
276 TALLOC_FREE(name_buffer.value);
277 return NT_STATUS_OK;
278
279 err_out:
280 TALLOC_FREE(name_buffer.value);
281 TALLOC_FREE(gse_ctx);
282 return status;
283 }
284
285 static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
286 struct gse_context *gse_ctx,
287 const DATA_BLOB *token_in,
288 DATA_BLOB *token_out)
289 {
290 OM_uint32 gss_maj, gss_min;
291 gss_buffer_desc in_data;
292 gss_buffer_desc out_data;
293 DATA_BLOB blob = data_blob_null;
294 NTSTATUS status;
295 OM_uint32 time_rec = 0;
296 struct timeval tv;
297
298 in_data.value = token_in->data;
299 in_data.length = token_in->length;
300
301 gss_maj = gss_init_sec_context(&gss_min,
302 gse_ctx->creds,
303 &gse_ctx->gssapi_context,
304 gse_ctx->server_name,
305 &gse_ctx->gss_mech,
306 gse_ctx->gss_want_flags,
307 0, GSS_C_NO_CHANNEL_BINDINGS,
308 &in_data, NULL, &out_data,
309 &gse_ctx->gss_got_flags, &time_rec);
310 switch (gss_maj) {
311 case GSS_S_COMPLETE:
312 /* we are done with it */
313 tv = timeval_current_ofs(time_rec, 0);
314 gse_ctx->expire_time = timeval_to_nttime(&tv);
315
316 status = NT_STATUS_OK;
317 break;
318 case GSS_S_CONTINUE_NEEDED:
319 /* we will need a third leg */
320 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
321 break;
322 default:
323 DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
324 gse_errstr(talloc_tos(), gss_maj, gss_min)));
325 status = NT_STATUS_INTERNAL_ERROR;
326 goto done;
327 }
328
329 /* we may be told to return nothing */
330 if (out_data.length) {
331 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
332 if (!blob.data) {
333 status = NT_STATUS_NO_MEMORY;
334 }
335
336 gss_maj = gss_release_buffer(&gss_min, &out_data);
337 }
338
339 done:
340 *token_out = blob;
341 return status;
342 }
343
344 static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
345 bool do_sign, bool do_seal,
346 uint32_t add_gss_c_flags,
347 struct gse_context **_gse_ctx)
348 {
349 struct gse_context *gse_ctx;
350 OM_uint32 gss_maj, gss_min;
351 krb5_error_code ret;
352 NTSTATUS status;
353
354 status = gse_context_init(mem_ctx, do_sign, do_seal,
355 NULL, add_gss_c_flags, &gse_ctx);
356 if (!NT_STATUS_IS_OK(status)) {
357 return NT_STATUS_NO_MEMORY;
358 }
359
360 ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
361 &gse_ctx->keytab);
362 if (ret) {
363 status = NT_STATUS_INTERNAL_ERROR;
364 goto done;
365 }
366
367 #ifdef HAVE_GSS_KRB5_IMPORT_CRED
368
369 /* This creates a GSSAPI cred_id_t with the keytab set */
370 gss_maj = gss_krb5_import_cred(&gss_min, NULL, NULL, gse_ctx->keytab,
371 &gse_ctx->creds);
372
373 if (gss_maj != 0
374 && gss_maj != (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME)) {
375 DEBUG(0, ("gss_krb5_import_cred failed with [%s]\n",
376 gse_errstr(gse_ctx, gss_maj, gss_min)));
377 status = NT_STATUS_INTERNAL_ERROR;
378 goto done;
379
380 /* This is the error the MIT krb5 1.9 gives when it
381 * implements the function, but we do not specify the
382 * principal. However, when we specify the principal
383 * as host$@REALM the GSS acceptor fails with 'wrong
384 * principal in request'. Work around the issue by
385 * falling back to the alternate approach below. */
386 } else if (gss_maj == (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME))
387 #endif
388 /* FIXME!!!
389 * This call sets the default keytab for the whole server, not
390 * just for this context. Need to find a way that does not alter
391 * the state of the whole server ... */
392 {
393 const char *ktname;
394 gss_OID_set_desc mech_set;
395
396 ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx,
397 gse_ctx->keytab, &ktname);
398 if (ret) {
399 status = NT_STATUS_INTERNAL_ERROR;
400 goto done;
401 }
402
403 ret = gsskrb5_register_acceptor_identity(ktname);
404 if (ret) {
405 status = NT_STATUS_INTERNAL_ERROR;
406 goto done;
407 }
408
409 mech_set.count = 1;
410 mech_set.elements = &gse_ctx->gss_mech;
411
412 gss_maj = gss_acquire_cred(&gss_min,
413 GSS_C_NO_NAME,
414 GSS_C_INDEFINITE,
415 &mech_set,
416 GSS_C_ACCEPT,
417 &gse_ctx->creds,
418 NULL, NULL);
419
420 if (gss_maj) {
421 DEBUG(0, ("gss_acquire_creds failed with [%s]\n",
422 gse_errstr(gse_ctx, gss_maj, gss_min)));
423 status = NT_STATUS_INTERNAL_ERROR;
424 goto done;
425 }
426 }
427
428 status = NT_STATUS_OK;
429
430 done:
431 if (!NT_STATUS_IS_OK(status)) {
432 TALLOC_FREE(gse_ctx);
433 }
434
435 *_gse_ctx = gse_ctx;
436 return status;
437 }
438
439 static NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
440 struct gse_context *gse_ctx,
441 const DATA_BLOB *token_in,
442 DATA_BLOB *token_out)
443 {
444 OM_uint32 gss_maj, gss_min;
445 gss_buffer_desc in_data;
446 gss_buffer_desc out_data;
447 DATA_BLOB blob = data_blob_null;
448 NTSTATUS status;
449 OM_uint32 time_rec = 0;
450 struct timeval tv;
451
452 in_data.value = token_in->data;
453 in_data.length = token_in->length;
454
455 gss_maj = gss_accept_sec_context(&gss_min,
456 &gse_ctx->gssapi_context,
457 gse_ctx->creds,
458 &in_data,
459 GSS_C_NO_CHANNEL_BINDINGS,
460 &gse_ctx->client_name,
461 &gse_ctx->ret_mech,
462 &out_data,
463 &gse_ctx->gss_got_flags,
464 &time_rec,
465 &gse_ctx->delegated_cred_handle);
466 switch (gss_maj) {
467 case GSS_S_COMPLETE:
468 /* we are done with it */
469 tv = timeval_current_ofs(time_rec, 0);
470 gse_ctx->expire_time = timeval_to_nttime(&tv);
471
472 status = NT_STATUS_OK;
473 break;
474 case GSS_S_CONTINUE_NEEDED:
475 /* we will need a third leg */
476 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
477 break;
478 default:
479 DEBUG(1, ("gss_accept_sec_context failed with [%s]\n",
480 gse_errstr(talloc_tos(), gss_maj, gss_min)));
481
482 if (gse_ctx->gssapi_context) {
483 gss_delete_sec_context(&gss_min,
484 &gse_ctx->gssapi_context,
485 GSS_C_NO_BUFFER);
486 }
487
488 status = NT_STATUS_LOGON_FAILURE;
489 goto done;
490 }
491
492 /* we may be told to return nothing */
493 if (out_data.length) {
494 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
495 if (!blob.data) {
496 status = NT_STATUS_NO_MEMORY;
497 }
498 gss_maj = gss_release_buffer(&gss_min, &out_data);
499 }
500
501
502 done:
503 *token_out = blob;
504 return status;
505 }
506
507 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
508 {
509 OM_uint32 gss_min, gss_maj;
510 gss_buffer_desc msg_min;
511 gss_buffer_desc msg_maj;
512 OM_uint32 msg_ctx = 0;
513
514 char *errstr = NULL;
515
516 ZERO_STRUCT(msg_min);
517 ZERO_STRUCT(msg_maj);
518
519 gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
520 GSS_C_NO_OID, &msg_ctx, &msg_maj);
521 if (gss_maj) {
522 goto done;
523 }
524 errstr = talloc_strndup(mem_ctx,
525 (char *)msg_maj.value,
526 msg_maj.length);
527 if (!errstr) {
528 goto done;
529 }
530 gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
531 (gss_OID)discard_const(gss_mech_krb5),
532 &msg_ctx, &msg_min);
533 if (gss_maj) {
534 goto done;
535 }
536
537 errstr = talloc_strdup_append_buffer(errstr, ": ");
538 if (!errstr) {
539 goto done;
540 }
541 errstr = talloc_strndup_append_buffer(errstr,
542 (char *)msg_min.value,
543 msg_min.length);
544 if (!errstr) {
545 goto done;
546 }
547
548 done:
549 if (msg_min.value) {
550 gss_maj = gss_release_buffer(&gss_min, &msg_min);
551 }
552 if (msg_maj.value) {
553 gss_maj = gss_release_buffer(&gss_min, &msg_maj);
554 }
555 return errstr;
556 }
557
558 static size_t gse_get_signature_length(struct gse_context *gse_ctx,
559 bool seal, size_t payload_size)
560 {
561 OM_uint32 gss_min, gss_maj;
562 gss_iov_buffer_desc iov[2];
563 int sealed;
564
565 /*
566 * gss_wrap_iov_length() only needs the type and length
567 */
568 iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
569 iov[0].buffer.value = NULL;
570 iov[0].buffer.length = 0;
571 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
572 iov[1].buffer.value = NULL;
573 iov[1].buffer.length = payload_size;
574
575 gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gssapi_context,
576 seal, GSS_C_QOP_DEFAULT,
577 &sealed, iov, 2);
578 if (gss_maj) {
579 DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n",
580 gse_errstr(talloc_tos(), gss_maj, gss_min)));
581 return 0;
582 }
583
584 return iov[0].buffer.length;
585 }
586
587 static NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
588 DATA_BLOB *data, DATA_BLOB *signature)
589 {
590 OM_uint32 gss_min, gss_maj;
591 gss_iov_buffer_desc iov[2];
592 int req_seal = 1; /* setting to 1 means we request sign+seal */
593 int sealed = 1;
594 NTSTATUS status;
595
596 /* allocate the memory ourselves so we do not need to talloc_memdup */
597 signature->length = gse_get_signature_length(gse_ctx, true, data->length);
598 if (!signature->length) {
599 return NT_STATUS_INTERNAL_ERROR;
600 }
601 signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length);
602 if (!signature->data) {
603 return NT_STATUS_NO_MEMORY;
604 }
605 iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
606 iov[0].buffer.value = signature->data;
607 iov[0].buffer.length = signature->length;
608
609 /* data is encrypted in place, which is ok */
610 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
611 iov[1].buffer.value = data->data;
612 iov[1].buffer.length = data->length;
613
614 gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gssapi_context,
615 req_seal, GSS_C_QOP_DEFAULT,
616 &sealed, iov, 2);
617 if (gss_maj) {
618 DEBUG(0, ("gss_wrap_iov failed with [%s]\n",
619 gse_errstr(talloc_tos(), gss_maj, gss_min)));
620 status = NT_STATUS_ACCESS_DENIED;
621 goto done;
622 }
623
624 if (!sealed) {
625 DEBUG(0, ("gss_wrap_iov says data was not sealed!\n"));
626 status = NT_STATUS_ACCESS_DENIED;
627 goto done;
628 }
629
630 status = NT_STATUS_OK;
631
632 DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n",
633 (int)iov[1].buffer.length, (int)iov[0].buffer.length));
634
635 done:
636 return status;
637 }
638
639 static NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
640 DATA_BLOB *data, const DATA_BLOB *signature)
641 {
642 OM_uint32 gss_min, gss_maj;
643 gss_iov_buffer_desc iov[2];
644 int sealed;
645 NTSTATUS status;
646
647 iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
648 iov[0].buffer.value = signature->data;
649 iov[0].buffer.length = signature->length;
650
651 /* data is decrypted in place, which is ok */
652 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
653 iov[1].buffer.value = data->data;
654 iov[1].buffer.length = data->length;
655
656 gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gssapi_context,
657 &sealed, NULL, iov, 2);
658 if (gss_maj) {
659 DEBUG(0, ("gss_unwrap_iov failed with [%s]\n",
660 gse_errstr(talloc_tos(), gss_maj, gss_min)));
661 status = NT_STATUS_ACCESS_DENIED;
662 goto done;
663 }
664
665 if (!sealed) {
666 DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n"));
667 status = NT_STATUS_ACCESS_DENIED;
668 goto done;
669 }
670
671 status = NT_STATUS_OK;
672
673 DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n",
674 (int)iov[1].buffer.length, (int)iov[0].buffer.length));
675
676 done:
677 return status;
678 }
679
680 static NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
681 DATA_BLOB *data, DATA_BLOB *signature)
682 {
683 OM_uint32 gss_min, gss_maj;
684 gss_buffer_desc in_data = { 0, NULL };
685 gss_buffer_desc out_data = { 0, NULL};
686 NTSTATUS status;
687
688 in_data.value = data->data;
689 in_data.length = data->length;
690
691 gss_maj = gss_get_mic(&gss_min, gse_ctx->gssapi_context,
692 GSS_C_QOP_DEFAULT,
693 &in_data, &out_data);
694 if (gss_maj) {
695 DEBUG(0, ("gss_get_mic failed with [%s]\n",
696 gse_errstr(talloc_tos(), gss_maj, gss_min)));
697 status = NT_STATUS_ACCESS_DENIED;
698 goto done;
699 }
700
701 *signature = data_blob_talloc(mem_ctx,
702 out_data.value, out_data.length);
703 if (!signature->data) {
704 status = NT_STATUS_NO_MEMORY;
705 goto done;
706 }
707
708 status = NT_STATUS_OK;
709
710 done:
711 if (out_data.value) {
712 gss_maj = gss_release_buffer(&gss_min, &out_data);
713 }
714 return status;
715 }
716
717 static NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
718 const DATA_BLOB *data, const DATA_BLOB *signature)
719 {
720 OM_uint32 gss_min, gss_maj;
721 gss_buffer_desc in_data = { 0, NULL };
722 gss_buffer_desc in_token = { 0, NULL};
723 NTSTATUS status;
724
725 in_data.value = data->data;
726 in_data.length = data->length;
727 in_token.value = signature->data;
728 in_token.length = signature->length;
729
730 gss_maj = gss_verify_mic(&gss_min, gse_ctx->gssapi_context,
731 &in_data, &in_token, NULL);
732 if (gss_maj) {
733 DEBUG(0, ("gss_verify_mic failed with [%s]\n",
734 gse_errstr(talloc_tos(), gss_maj, gss_min)));
735 status = NT_STATUS_ACCESS_DENIED;
736 goto done;
737 }
738
739 status = NT_STATUS_OK;
740
741 done:
742 return status;
743 }
744
745 static NTSTATUS gensec_gse_client_start(struct gensec_security *gensec_security)
746 {
747 struct gse_context *gse_ctx;
748 struct cli_credentials *creds = gensec_get_credentials(gensec_security);
749 NTSTATUS nt_status;
750 OM_uint32 want_flags = 0;
751 bool do_sign = false, do_seal = false;
752 const char *hostname = gensec_get_target_hostname(gensec_security);
753 const char *service = gensec_get_target_service(gensec_security);
754 const char *username = cli_credentials_get_username(creds);
755 const char *password = cli_credentials_get_password(creds);
756
757 if (!hostname) {
758 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
759 return NT_STATUS_INVALID_PARAMETER;
760 }
761 if (is_ipaddress(hostname)) {
762 DEBUG(2, ("Cannot do GSE to an IP address\n"));
763 return NT_STATUS_INVALID_PARAMETER;
764 }
765 if (strcmp(hostname, "localhost") == 0) {
766 DEBUG(2, ("GSE to 'localhost' does not make sense\n"));
767 return NT_STATUS_INVALID_PARAMETER;
768 }
769
770 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
771 do_sign = true;
772 }
773 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
774 do_seal = true;
775 }
776 if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
777 want_flags |= GSS_C_DCE_STYLE;
778 }
779
780 nt_status = gse_init_client(gensec_security, do_sign, do_seal, NULL,
781 hostname, service,
782 username, password, want_flags,
783 &gse_ctx);
784 if (!NT_STATUS_IS_OK(nt_status)) {
785 return nt_status;
786 }
787 gensec_security->private_data = gse_ctx;
788 return NT_STATUS_OK;
789 }
790
791 static NTSTATUS gensec_gse_server_start(struct gensec_security *gensec_security)
792 {
793 struct gse_context *gse_ctx;
794 NTSTATUS nt_status;
795 OM_uint32 want_flags = 0;
796 bool do_sign = false, do_seal = false;
797
798 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
799 do_sign = true;
800 }
801 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
802 do_seal = true;
803 }
804 if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
805 want_flags |= GSS_C_DCE_STYLE;
806 }
807
808 nt_status = gse_init_server(gensec_security, do_sign, do_seal, want_flags,
809 &gse_ctx);
810 if (!NT_STATUS_IS_OK(nt_status)) {
811 return nt_status;
812 }
813 gensec_security->private_data = gse_ctx;
814 return NT_STATUS_OK;
815 }
816
817 /**
818 * Next state function for the GSE GENSEC mechanism
819 *
820 * @param gensec_gse_state GSE State
821 * @param mem_ctx The TALLOC_CTX for *out to be allocated on
822 * @param in The request, as a DATA_BLOB
823 * @param out The reply, as an talloc()ed DATA_BLOB, on *mem_ctx
824 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
825 * or NT_STATUS_OK if the user is authenticated.
826 */
827
828 static NTSTATUS gensec_gse_update(struct gensec_security *gensec_security,
829 TALLOC_CTX *mem_ctx,
830 struct tevent_context *ev,
831 const DATA_BLOB in, DATA_BLOB *out)
832 {
833 NTSTATUS status;
834 struct gse_context *gse_ctx =
835 talloc_get_type_abort(gensec_security->private_data,
836 struct gse_context);
837
838 switch (gensec_security->gensec_role) {
839 case GENSEC_CLIENT:
840 status = gse_get_client_auth_token(mem_ctx, gse_ctx,
841 &in, out);
842 break;
843 case GENSEC_SERVER:
844 status = gse_get_server_auth_token(mem_ctx, gse_ctx,
845 &in, out);
846 break;
847 }
848 if (!NT_STATUS_IS_OK(status)) {
849 return status;
850 }
851
852 return NT_STATUS_OK;
853 }
854
855 static NTSTATUS gensec_gse_wrap(struct gensec_security *gensec_security,
856 TALLOC_CTX *mem_ctx,
857 const DATA_BLOB *in,
858 DATA_BLOB *out)
859 {
860 struct gse_context *gse_ctx =
861 talloc_get_type_abort(gensec_security->private_data,
862 struct gse_context);
863 OM_uint32 maj_stat, min_stat;
864 gss_buffer_desc input_token, output_token;
865 int conf_state;
866 input_token.length = in->length;
867 input_token.value = in->data;
868
869 maj_stat = gss_wrap(&min_stat,
870 gse_ctx->gssapi_context,
871 gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
872 GSS_C_QOP_DEFAULT,
873 &input_token,
874 &conf_state,
875 &output_token);
876 if (GSS_ERROR(maj_stat)) {
877 DEBUG(0, ("gensec_gse_wrap: GSS Wrap failed: %s\n",
878 gse_errstr(talloc_tos(), maj_stat, min_stat)));
879 return NT_STATUS_ACCESS_DENIED;
880 }
881
882 *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
883 gss_release_buffer(&min_stat, &output_token);
884
885 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
886 && !conf_state) {
887 return NT_STATUS_ACCESS_DENIED;
888 }
889 return NT_STATUS_OK;
890 }
891
892 static NTSTATUS gensec_gse_unwrap(struct gensec_security *gensec_security,
893 TALLOC_CTX *mem_ctx,
894 const DATA_BLOB *in,
895 DATA_BLOB *out)
896 {
897 struct gse_context *gse_ctx =
898 talloc_get_type_abort(gensec_security->private_data,
899 struct gse_context);
900 OM_uint32 maj_stat, min_stat;
901 gss_buffer_desc input_token, output_token;
902 int conf_state;
903 gss_qop_t qop_state;
904 input_token.length = in->length;
905 input_token.value = in->data;
906
907 maj_stat = gss_unwrap(&min_stat,
908 gse_ctx->gssapi_context,
909 &input_token,
910 &output_token,
911 &conf_state,
912 &qop_state);
913 if (GSS_ERROR(maj_stat)) {
914 DEBUG(0, ("gensec_gse_unwrap: GSS UnWrap failed: %s\n",
915 gse_errstr(talloc_tos(), maj_stat, min_stat)));
916 return NT_STATUS_ACCESS_DENIED;
917 }
918
919 *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
920 gss_release_buffer(&min_stat, &output_token);
921
922 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
923 && !conf_state) {
924 return NT_STATUS_ACCESS_DENIED;
925 }
926 return NT_STATUS_OK;
927 }
928
929 static NTSTATUS gensec_gse_seal_packet(struct gensec_security *gensec_security,
930 TALLOC_CTX *mem_ctx,
931 uint8_t *data, size_t length,
932 const uint8_t *whole_pdu, size_t pdu_length,
933 DATA_BLOB *sig)
934 {
935 struct gse_context *gse_ctx =
936 talloc_get_type_abort(gensec_security->private_data,
937 struct gse_context);
938 DATA_BLOB payload = data_blob_const(data, length);
939 return gse_seal(mem_ctx, gse_ctx, &payload, sig);
940 }
941
942 static NTSTATUS gensec_gse_unseal_packet(struct gensec_security *gensec_security,
943 uint8_t *data, size_t length,
944 const uint8_t *whole_pdu, size_t pdu_length,
945 const DATA_BLOB *sig)
946 {
947 struct gse_context *gse_ctx =
948 talloc_get_type_abort(gensec_security->private_data,
949 struct gse_context);
950 DATA_BLOB payload = data_blob_const(data, length);
951 return gse_unseal(talloc_tos() /* unused */, gse_ctx, &payload, sig);
952 }
953
954 static NTSTATUS gensec_gse_sign_packet(struct gensec_security *gensec_security,
955 TALLOC_CTX *mem_ctx,
956 const uint8_t *data, size_t length,
957 const uint8_t *whole_pdu, size_t pdu_length,
958 DATA_BLOB *sig)
959 {
960 struct gse_context *gse_ctx =
961 talloc_get_type_abort(gensec_security->private_data,
962 struct gse_context);
963 DATA_BLOB payload = data_blob_const(data, length);
964 return gse_sign(mem_ctx, gse_ctx, &payload, sig);
965 }
966
967 static NTSTATUS gensec_gse_check_packet(struct gensec_security *gensec_security,
968 const uint8_t *data, size_t length,
969 const uint8_t *whole_pdu, size_t pdu_length,
970 const DATA_BLOB *sig)
971 {
972 struct gse_context *gse_ctx =
973 talloc_get_type_abort(gensec_security->private_data,
974 struct gse_context);
975 DATA_BLOB payload = data_blob_const(data, length);
976 return gse_sigcheck(NULL, gse_ctx, &payload, sig);
977 }
978
979 /* Try to figure out what features we actually got on the connection */
980 static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
981 uint32_t feature)
982 {
983 struct gse_context *gse_ctx =
984 talloc_get_type_abort(gensec_security->private_data,
985 struct gse_context);
986
987 if (feature & GENSEC_FEATURE_SIGN) {
988 return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
989 }
990 if (feature & GENSEC_FEATURE_SEAL) {
991 return gse_ctx->gss_got_flags & GSS_C_CONF_FLAG;
992 }
993 if (feature & GENSEC_FEATURE_SESSION_KEY) {
994 /* Only for GSE/Krb5 */
995 if (gss_oid_equal(gse_ctx->ret_mech, gss_mech_krb5)) {
996 return true;
997 }
998 }
999 if (feature & GENSEC_FEATURE_DCE_STYLE) {
1000 return gse_ctx->gss_got_flags & GSS_C_DCE_STYLE;
1001 }
1002 if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
1003 NTSTATUS status;
1004 uint32_t keytype;
1005
1006 if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
1007 return false;
1008 }
1009
1010 status = gssapi_get_session_key(talloc_tos(),
1011 gse_ctx->gssapi_context, NULL, &keytype);
1012 /*
1013 * We should do a proper sig on the mechListMic unless
1014 * we know we have to be backwards compatible with
1015 * earlier windows versions.
1016 *
1017 * Negotiating a non-krb5
1018 * mech for example should be regarded as having
1019 * NEW_SPNEGO
1020 */
1021 if (NT_STATUS_IS_OK(status)) {
1022 switch (keytype) {
1023 case ENCTYPE_DES_CBC_CRC:
1024 case ENCTYPE_DES_CBC_MD5:
1025 case ENCTYPE_ARCFOUR_HMAC:
1026 case ENCTYPE_DES3_CBC_SHA1:
1027 return false;
1028 }
1029 }
1030 return true;
1031 }
1032 /* We can always do async (rather than strict request/reply) packets. */
1033 if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
1034 return true;
1035 }
1036 return false;
1037 }
1038
1039 /*
1040 * Extract the 'sesssion key' needed by SMB signing and ncacn_np
1041 * (for encrypting some passwords).
1042 *
1043 * This breaks all the abstractions, but what do you expect...
1044 */
1045 static NTSTATUS gensec_gse_session_key(struct gensec_security *gensec_security,
1046 TALLOC_CTX *mem_ctx,
1047 DATA_BLOB *session_key)
1048 {
1049 struct gse_context *gse_ctx =
1050 talloc_get_type_abort(gensec_security->private_data,
1051 struct gse_context);
1052
1053 return gssapi_get_session_key(mem_ctx, gse_ctx->gssapi_context, session_key, NULL);
1054 }
1055
1056 /* Get some basic (and authorization) information about the user on
1057 * this session. This uses either the PAC (if present) or a local
1058 * database lookup */
1059 static NTSTATUS gensec_gse_session_info(struct gensec_security *gensec_security,
1060 TALLOC_CTX *mem_ctx,
1061 struct auth_session_info **_session_info)
1062 {
1063 struct gse_context *gse_ctx =
1064 talloc_get_type_abort(gensec_security->private_data,
1065 struct gse_context);
1066 NTSTATUS nt_status;
1067 TALLOC_CTX *tmp_ctx;
1068 struct auth_session_info *session_info = NULL;
1069 OM_uint32 maj_stat, min_stat;
1070 DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
1071
1072 gss_buffer_desc name_token;
1073 char *principal_string;
1074
1075 tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gse_session_info context");
1076 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1077
1078 maj_stat = gss_display_name(&min_stat,
1079 gse_ctx->client_name,
1080 &name_token,
1081 NULL);
1082 if (GSS_ERROR(maj_stat)) {
1083 DEBUG(1, ("GSS display_name failed: %s\n",
1084 gse_errstr(talloc_tos(), maj_stat, min_stat)));
1085 talloc_free(tmp_ctx);
1086 return NT_STATUS_FOOBAR;
1087 }
1088
1089 principal_string = talloc_strndup(tmp_ctx,
1090 (const char *)name_token.value,
1091 name_token.length);
1092
1093 gss_release_buffer(&min_stat, &name_token);
1094
1095 if (!principal_string) {
1096 talloc_free(tmp_ctx);
1097 return NT_STATUS_NO_MEMORY;
1098 }
1099
1100 nt_status = gssapi_obtain_pac_blob(tmp_ctx, gse_ctx->gssapi_context,
1101 gse_ctx->client_name,
1102 &pac_blob);
1103
1104 /* IF we have the PAC - otherwise we need to get this
1105 * data from elsewere
1106 */
1107 if (NT_STATUS_IS_OK(nt_status)) {
1108 pac_blob_ptr = &pac_blob;
1109 }
1110 nt_status = gensec_generate_session_info_pac(tmp_ctx,
1111 gensec_security,
1112 NULL,
1113 pac_blob_ptr, principal_string,
1114 gensec_get_remote_address(gensec_security),
1115 &session_info);
1116 if (!NT_STATUS_IS_OK(nt_status)) {
1117 talloc_free(tmp_ctx);
1118 return nt_status;
1119 }
1120
1121 nt_status = gensec_gse_session_key(gensec_security, session_info,
1122 &session_info->session_key);
1123 if (!NT_STATUS_IS_OK(nt_status)) {
1124 talloc_free(tmp_ctx);
1125 return nt_status;
1126 }
1127
1128 *_session_info = talloc_move(mem_ctx, &session_info);
1129 talloc_free(tmp_ctx);
1130
1131 return NT_STATUS_OK;
1132 }
1133
1134 static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
1135 size_t data_size)
1136 {
1137 struct gse_context *gse_ctx =
1138 talloc_get_type_abort(gensec_security->private_data,
1139 struct gse_context);
1140
1141 return gse_get_signature_length(gse_ctx,
1142 gensec_security->want_features & GENSEC_FEATURE_SEAL,
1143 data_size);
1144 }
1145
1146 static const char *gensec_gse_krb5_oids[] = {
1147 GENSEC_OID_KERBEROS5_OLD,
1148 GENSEC_OID_KERBEROS5,
1149 NULL
1150 };
1151
1152 const struct gensec_security_ops gensec_gse_krb5_security_ops = {
1153 .name = "gse_krb5",
1154 .auth_type = DCERPC_AUTH_TYPE_KRB5,
1155 .oid = gensec_gse_krb5_oids,
1156 .client_start = gensec_gse_client_start,
1157 .server_start = gensec_gse_server_start,
1158 .magic = gensec_magic_check_krb5_oid,
1159 .update = gensec_gse_update,
1160 .session_key = gensec_gse_session_key,
1161 .session_info = gensec_gse_session_info,
1162 .sig_size = gensec_gse_sig_size,
1163 .sign_packet = gensec_gse_sign_packet,
1164 .check_packet = gensec_gse_check_packet,
1165 .seal_packet = gensec_gse_seal_packet,
1166 .unseal_packet = gensec_gse_unseal_packet,
1167 .wrap = gensec_gse_wrap,
1168 .unwrap = gensec_gse_unwrap,
1169 .have_feature = gensec_gse_have_feature,
1170 .enabled = true,
1171 .kerberos = true,
1172 .priority = GENSEC_GSSAPI
1173 };
1174
1175 #endif /* HAVE_KRB5 */
reg import