2 Unix SMB/CIFS implementation.
4 dcerpc schannel operations
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "librpc/gen_ndr/ndr_schannel.h"
25 #include "auth/auth.h"
26 #include "auth/credentials/credentials.h"
27 #include "auth/gensec/gensec.h"
28 #include "auth/gensec/gensec_proto.h"
29 #include "../libcli/auth/schannel.h"
30 #include "librpc/rpc/dcerpc.h"
31 #include "param/param.h"
32 #include "auth/gensec/gensec_toplevel_proto.h"
34 _PUBLIC_ NTSTATUS
gensec_schannel_init(void);
36 static size_t schannel_sig_size(struct gensec_security
*gensec_security
, size_t data_size
)
38 struct schannel_state
*state
=
39 talloc_get_type_abort(gensec_security
->private_data
,
40 struct schannel_state
);
42 return netsec_outgoing_sig_size(state
);
45 static NTSTATUS
schannel_session_key(struct gensec_security
*gensec_security
,
47 DATA_BLOB
*session_key
)
49 return NT_STATUS_NOT_IMPLEMENTED
;
52 static NTSTATUS
schannel_update(struct gensec_security
*gensec_security
, TALLOC_CTX
*out_mem_ctx
,
53 struct tevent_context
*ev
,
54 const DATA_BLOB in
, DATA_BLOB
*out
)
56 struct schannel_state
*state
=
57 talloc_get_type(gensec_security
->private_data
,
58 struct schannel_state
);
60 enum ndr_err_code ndr_err
;
61 struct NL_AUTH_MESSAGE bind_schannel
;
62 struct NL_AUTH_MESSAGE bind_schannel_ack
;
63 struct netlogon_creds_CredentialState
*creds
;
64 const char *workstation
;
67 *out
= data_blob(NULL
, 0);
69 switch (gensec_security
->gensec_role
) {
72 /* we could parse the bind ack, but we don't know what it is yet */
76 creds
= cli_credentials_get_netlogon_creds(gensec_security
->credentials
);
78 return NT_STATUS_INVALID_PARAMETER_MIX
;
81 state
= netsec_create_state(gensec_security
,
82 creds
, true /* initiator */);
84 return NT_STATUS_NO_MEMORY
;
86 gensec_security
->private_data
= state
;
88 bind_schannel
.MessageType
= NL_NEGOTIATE_REQUEST
;
90 /* to support this we'd need to have access to the full domain name */
92 bind_schannel
.Flags
= NL_FLAG_OEM_NETBIOS_DOMAIN_NAME
|
93 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME
|
94 NL_FLAG_UTF8_DNS_DOMAIN_NAME
|
95 NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME
;
96 bind_schannel
.oem_netbios_domain
.a
= cli_credentials_get_domain(gensec_security
->credentials
);
97 bind_schannel
.oem_netbios_computer
.a
= creds
->computer_name
;
98 bind_schannel
.utf8_dns_domain
= cli_credentials_get_realm(gensec_security
->credentials
);
99 /* w2k3 refuses us if we use the full DNS workstation?
100 why? perhaps because we don't fill in the dNSHostName
101 attribute in the machine account? */
102 bind_schannel
.utf8_netbios_computer
= creds
->computer_name
;
104 bind_schannel
.Flags
= NL_FLAG_OEM_NETBIOS_DOMAIN_NAME
|
105 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME
;
106 bind_schannel
.oem_netbios_domain
.a
= cli_credentials_get_domain(gensec_security
->credentials
);
107 bind_schannel
.oem_netbios_computer
.a
= creds
->computer_name
;
110 ndr_err
= ndr_push_struct_blob(out
, out_mem_ctx
, &bind_schannel
,
111 (ndr_push_flags_fn_t
)ndr_push_NL_AUTH_MESSAGE
);
112 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
113 status
= ndr_map_error2ntstatus(ndr_err
);
114 DEBUG(3, ("Could not create schannel bind: %s\n",
119 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
123 /* no third leg on this protocol */
124 return NT_STATUS_INVALID_PARAMETER
;
127 /* parse the schannel startup blob */
128 ndr_err
= ndr_pull_struct_blob(&in
, out_mem_ctx
, &bind_schannel
,
129 (ndr_pull_flags_fn_t
)ndr_pull_NL_AUTH_MESSAGE
);
130 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
131 status
= ndr_map_error2ntstatus(ndr_err
);
132 DEBUG(3, ("Could not parse incoming schannel bind: %s\n",
137 if (bind_schannel
.Flags
& NL_FLAG_OEM_NETBIOS_DOMAIN_NAME
) {
138 domain
= bind_schannel
.oem_netbios_domain
.a
;
139 if (strcasecmp_m(domain
, lpcfg_workgroup(gensec_security
->settings
->lp_ctx
)) != 0) {
140 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
141 domain
, lpcfg_workgroup(gensec_security
->settings
->lp_ctx
)));
142 return NT_STATUS_LOGON_FAILURE
;
144 } else if (bind_schannel
.Flags
& NL_FLAG_UTF8_DNS_DOMAIN_NAME
) {
145 domain
= bind_schannel
.utf8_dns_domain
.u
;
146 if (strcasecmp_m(domain
, lpcfg_dnsdomain(gensec_security
->settings
->lp_ctx
)) != 0) {
147 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
148 domain
, lpcfg_dnsdomain(gensec_security
->settings
->lp_ctx
)));
149 return NT_STATUS_LOGON_FAILURE
;
152 DEBUG(3, ("Request for schannel to without domain\n"));
153 return NT_STATUS_LOGON_FAILURE
;
156 if (bind_schannel
.Flags
& NL_FLAG_OEM_NETBIOS_COMPUTER_NAME
) {
157 workstation
= bind_schannel
.oem_netbios_computer
.a
;
158 } else if (bind_schannel
.Flags
& NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME
) {
159 workstation
= bind_schannel
.utf8_netbios_computer
.u
;
161 DEBUG(3, ("Request for schannel to without netbios workstation\n"));
162 return NT_STATUS_LOGON_FAILURE
;
165 status
= schannel_get_creds_state(out_mem_ctx
,
166 gensec_security
->settings
->lp_ctx
,
167 workstation
, &creds
);
168 if (!NT_STATUS_IS_OK(status
)) {
169 DEBUG(3, ("Could not find session key for attempted schannel connection from %s: %s\n",
170 workstation
, nt_errstr(status
)));
171 if (NT_STATUS_EQUAL(status
, NT_STATUS_INVALID_HANDLE
)) {
172 return NT_STATUS_LOGON_FAILURE
;
177 state
= netsec_create_state(gensec_security
,
178 creds
, false /* not initiator */);
180 return NT_STATUS_NO_MEMORY
;
182 gensec_security
->private_data
= state
;
184 bind_schannel_ack
.MessageType
= NL_NEGOTIATE_RESPONSE
;
185 bind_schannel_ack
.Flags
= 0;
186 bind_schannel_ack
.Buffer
.dummy
= 0x6c0000; /* actually I think
191 ndr_err
= ndr_push_struct_blob(out
, out_mem_ctx
, &bind_schannel_ack
,
192 (ndr_push_flags_fn_t
)ndr_push_NL_AUTH_MESSAGE
);
193 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
194 status
= ndr_map_error2ntstatus(ndr_err
);
195 DEBUG(3, ("Could not return schannel bind ack for client %s: %s\n",
196 workstation
, nt_errstr(status
)));
202 return NT_STATUS_INVALID_PARAMETER
;
206 * Returns anonymous credentials for schannel, matching Win2k3.
210 static NTSTATUS
schannel_session_info(struct gensec_security
*gensec_security
,
212 struct auth_session_info
**_session_info
)
214 return auth_anonymous_session_info(mem_ctx
, gensec_security
->settings
->lp_ctx
, _session_info
);
217 static NTSTATUS
schannel_server_start(struct gensec_security
*gensec_security
)
222 static NTSTATUS
schannel_client_start(struct gensec_security
*gensec_security
)
227 static bool schannel_have_feature(struct gensec_security
*gensec_security
,
230 if (feature
& (GENSEC_FEATURE_SIGN
|
231 GENSEC_FEATURE_SEAL
)) {
234 if (feature
& GENSEC_FEATURE_DCE_STYLE
) {
237 if (feature
& GENSEC_FEATURE_ASYNC_REPLIES
) {
246 static NTSTATUS
schannel_unseal_packet(struct gensec_security
*gensec_security
,
247 uint8_t *data
, size_t length
,
248 const uint8_t *whole_pdu
, size_t pdu_length
,
249 const DATA_BLOB
*sig
)
251 struct schannel_state
*state
=
252 talloc_get_type_abort(gensec_security
->private_data
,
253 struct schannel_state
);
255 return netsec_incoming_packet(state
, true,
256 discard_const_p(uint8_t, data
),
261 check the signature on a packet
263 static NTSTATUS
schannel_check_packet(struct gensec_security
*gensec_security
,
264 const uint8_t *data
, size_t length
,
265 const uint8_t *whole_pdu
, size_t pdu_length
,
266 const DATA_BLOB
*sig
)
268 struct schannel_state
*state
=
269 talloc_get_type_abort(gensec_security
->private_data
,
270 struct schannel_state
);
272 return netsec_incoming_packet(state
, false,
273 discard_const_p(uint8_t, data
),
279 static NTSTATUS
schannel_seal_packet(struct gensec_security
*gensec_security
,
281 uint8_t *data
, size_t length
,
282 const uint8_t *whole_pdu
, size_t pdu_length
,
285 struct schannel_state
*state
=
286 talloc_get_type_abort(gensec_security
->private_data
,
287 struct schannel_state
);
289 return netsec_outgoing_packet(state
, mem_ctx
, true,
296 static NTSTATUS
schannel_sign_packet(struct gensec_security
*gensec_security
,
298 const uint8_t *data
, size_t length
,
299 const uint8_t *whole_pdu
, size_t pdu_length
,
302 struct schannel_state
*state
=
303 talloc_get_type_abort(gensec_security
->private_data
,
304 struct schannel_state
);
306 return netsec_outgoing_packet(state
, mem_ctx
, false,
307 discard_const_p(uint8_t, data
),
311 static const struct gensec_security_ops gensec_schannel_security_ops
= {
313 .auth_type
= DCERPC_AUTH_TYPE_SCHANNEL
,
314 .client_start
= schannel_client_start
,
315 .server_start
= schannel_server_start
,
316 .update
= schannel_update
,
317 .seal_packet
= schannel_seal_packet
,
318 .sign_packet
= schannel_sign_packet
,
319 .check_packet
= schannel_check_packet
,
320 .unseal_packet
= schannel_unseal_packet
,
321 .session_key
= schannel_session_key
,
322 .session_info
= schannel_session_info
,
323 .sig_size
= schannel_sig_size
,
324 .have_feature
= schannel_have_feature
,
326 .priority
= GENSEC_SCHANNEL
329 _PUBLIC_ NTSTATUS
gensec_schannel_init(void)
332 ret
= gensec_register(&gensec_schannel_security_ops
);
333 if (!NT_STATUS_IS_OK(ret
)) {
334 DEBUG(0,("Failed to register '%s' gensec backend!\n",
335 gensec_schannel_security_ops
.name
));