source4/auth/gensec/schannel.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    dcerpc schannel operations
   5
   6    Copyright (C) Andrew Tridgell 2004
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "librpc/gen_ndr/ndr_schannel.h"
  25 #include "auth/auth.h"
  26 #include "auth/credentials/credentials.h"
  27 #include "auth/gensec/gensec.h"
  28 #include "auth/gensec/gensec_proto.h"
  29 #include "../libcli/auth/schannel.h"
  30 #include "librpc/rpc/dcerpc.h"
  31 #include "param/param.h"
  32 #include "auth/gensec/gensec_toplevel_proto.h"
  33
  34 _PUBLIC_ NTSTATUS gensec_schannel_init(void);
  35
  36 static size_t schannel_sig_size(struct gensec_security *gensec_security, size_t data_size)
  37 {
  38         struct schannel_state *state =
  39                 talloc_get_type_abort(gensec_security->private_data,
  40                 struct schannel_state);
  41
  42         return netsec_outgoing_sig_size(state);
  43 }
  44
  45 static NTSTATUS schannel_session_key(struct gensec_security *gensec_security,
  46                                      TALLOC_CTX *mem_ctx,
  47                                      DATA_BLOB *session_key)
  48 {
  49         return NT_STATUS_NOT_IMPLEMENTED;
  50 }
  51
  52 static NTSTATUS schannel_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
  53                                 struct tevent_context *ev,
  54                                 const DATA_BLOB in, DATA_BLOB *out)
  55 {
  56         struct schannel_state *state =
  57                 talloc_get_type(gensec_security->private_data,
  58                 struct schannel_state);
  59         NTSTATUS status;
  60         enum ndr_err_code ndr_err;
  61         struct NL_AUTH_MESSAGE bind_schannel;
  62         struct NL_AUTH_MESSAGE bind_schannel_ack;
  63         struct netlogon_creds_CredentialState *creds;
  64         const char *workstation;
  65         const char *domain;
  66
  67         *out = data_blob(NULL, 0);
  68
  69         switch (gensec_security->gensec_role) {
  70         case GENSEC_CLIENT:
  71                 if (state != NULL) {
  72                         /* we could parse the bind ack, but we don't know what it is yet */
  73                         return NT_STATUS_OK;
  74                 }
  75
  76                 creds = cli_credentials_get_netlogon_creds(gensec_security->credentials);
  77                 if (creds == NULL) {
  78                         return NT_STATUS_INVALID_PARAMETER_MIX;
  79                 }
  80
  81                 state = netsec_create_state(gensec_security,
  82                                             creds, true /* initiator */);
  83                 if (state == NULL) {
  84                         return NT_STATUS_NO_MEMORY;
  85                 }
  86                 gensec_security->private_data = state;
  87
  88                 bind_schannel.MessageType = NL_NEGOTIATE_REQUEST;
  89 #if 0
  90                 /* to support this we'd need to have access to the full domain name */
  91                 /* 0x17, 23 */
  92                 bind_schannel.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
  93                                       NL_FLAG_OEM_NETBIOS_COMPUTER_NAME |
  94                                       NL_FLAG_UTF8_DNS_DOMAIN_NAME |
  95                                       NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME;
  96                 bind_schannel.oem_netbios_domain.a = cli_credentials_get_domain(gensec_security->credentials);
  97                 bind_schannel.oem_netbios_computer.a = creds->computer_name;
  98                 bind_schannel.utf8_dns_domain = cli_credentials_get_realm(gensec_security->credentials);
  99                 /* w2k3 refuses us if we use the full DNS workstation?
 100                  why? perhaps because we don't fill in the dNSHostName
 101                  attribute in the machine account? */
 102                 bind_schannel.utf8_netbios_computer = creds->computer_name;
 103 #else
 104                 bind_schannel.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
 105                                       NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
 106                 bind_schannel.oem_netbios_domain.a = cli_credentials_get_domain(gensec_security->credentials);
 107                 bind_schannel.oem_netbios_computer.a = creds->computer_name;
 108 #endif
 109
 110                 ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel,
 111                                                (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 112                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 113                         status = ndr_map_error2ntstatus(ndr_err);
 114                         DEBUG(3, ("Could not create schannel bind: %s\n",
 115                                   nt_errstr(status)));
 116                         return status;
 117                 }
 118
 119                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
 120         case GENSEC_SERVER:
 121
 122                 if (state != NULL) {
 123                         /* no third leg on this protocol */
 124                         return NT_STATUS_INVALID_PARAMETER;
 125                 }
 126
 127                 /* parse the schannel startup blob */
 128                 ndr_err = ndr_pull_struct_blob(&in, out_mem_ctx, &bind_schannel,
 129                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 130                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 131                         status = ndr_map_error2ntstatus(ndr_err);
 132                         DEBUG(3, ("Could not parse incoming schannel bind: %s\n",
 133                                   nt_errstr(status)));
 134                         return status;
 135                 }
 136
 137                 if (bind_schannel.Flags & NL_FLAG_OEM_NETBIOS_DOMAIN_NAME) {
 138                         domain = bind_schannel.oem_netbios_domain.a;
 139                         if (strcasecmp_m(domain, lpcfg_workgroup(gensec_security->settings->lp_ctx)) != 0) {
 140                                 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
 141                                           domain, lpcfg_workgroup(gensec_security->settings->lp_ctx)));
 142                                 return NT_STATUS_LOGON_FAILURE;
 143                         }
 144                 } else if (bind_schannel.Flags & NL_FLAG_UTF8_DNS_DOMAIN_NAME) {
 145                         domain = bind_schannel.utf8_dns_domain.u;
 146                         if (strcasecmp_m(domain, lpcfg_dnsdomain(gensec_security->settings->lp_ctx)) != 0) {
 147                                 DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
 148                                           domain, lpcfg_dnsdomain(gensec_security->settings->lp_ctx)));
 149                                 return NT_STATUS_LOGON_FAILURE;
 150                         }
 151                 } else {
 152                         DEBUG(3, ("Request for schannel to without domain\n"));
 153                         return NT_STATUS_LOGON_FAILURE;
 154                 }
 155
 156                 if (bind_schannel.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME) {
 157                         workstation = bind_schannel.oem_netbios_computer.a;
 158                 } else if (bind_schannel.Flags & NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME) {
 159                         workstation = bind_schannel.utf8_netbios_computer.u;
 160                 } else {
 161                         DEBUG(3, ("Request for schannel to without netbios workstation\n"));
 162                         return NT_STATUS_LOGON_FAILURE;
 163                 }
 164
 165                 status = schannel_get_creds_state(out_mem_ctx,
 166                                                   gensec_security->settings->lp_ctx,
 167                                                   workstation, &creds);
 168                 if (!NT_STATUS_IS_OK(status)) {
 169                         DEBUG(3, ("Could not find session key for attempted schannel connection from %s: %s\n",
 170                                   workstation, nt_errstr(status)));
 171                         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
 172                                 return NT_STATUS_LOGON_FAILURE;
 173                         }
 174                         return status;
 175                 }
 176
 177                 state = netsec_create_state(gensec_security,
 178                                             creds, false /* not initiator */);
 179                 if (state == NULL) {
 180                         return NT_STATUS_NO_MEMORY;
 181                 }
 182                 gensec_security->private_data = state;
 183
 184                 bind_schannel_ack.MessageType = NL_NEGOTIATE_RESPONSE;
 185                 bind_schannel_ack.Flags = 0;
 186                 bind_schannel_ack.Buffer.dummy = 0x6c0000; /* actually I think
 187                                                             * this does not have
 188                                                             * any meaning here
 189                                                             * - gd */
 190
 191                 ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel_ack,
 192                                                (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 193                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 194                         status = ndr_map_error2ntstatus(ndr_err);
 195                         DEBUG(3, ("Could not return schannel bind ack for client %s: %s\n",
 196                                   workstation, nt_errstr(status)));
 197                         return status;
 198                 }
 199
 200                 return NT_STATUS_OK;
 201         }
 202         return NT_STATUS_INVALID_PARAMETER;
 203 }
 204
 205 /**
 206  * Returns anonymous credentials for schannel, matching Win2k3.
 207  *
 208  */
 209
 210 static NTSTATUS schannel_session_info(struct gensec_security *gensec_security,
 211                                       TALLOC_CTX *mem_ctx,
 212                                       struct auth_session_info **_session_info)
 213 {
 214         return auth_anonymous_session_info(mem_ctx, gensec_security->settings->lp_ctx, _session_info);
 215 }
 216
 217 static NTSTATUS schannel_server_start(struct gensec_security *gensec_security)
 218 {
 219         return NT_STATUS_OK;
 220 }
 221
 222 static NTSTATUS schannel_client_start(struct gensec_security *gensec_security)
 223 {
 224         return NT_STATUS_OK;
 225 }
 226
 227 static bool schannel_have_feature(struct gensec_security *gensec_security,
 228                                          uint32_t feature)
 229 {
 230         if (feature & (GENSEC_FEATURE_SIGN |
 231                        GENSEC_FEATURE_SEAL)) {
 232                 return true;
 233         }
 234         if (feature & GENSEC_FEATURE_DCE_STYLE) {
 235                 return true;
 236         }
 237         if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
 238                 return true;
 239         }
 240         return false;
 241 }
 242
 243 /*
 244   unseal a packet
 245 */
 246 static NTSTATUS schannel_unseal_packet(struct gensec_security *gensec_security,
 247                                        uint8_t *data, size_t length,
 248                                        const uint8_t *whole_pdu, size_t pdu_length,
 249                                        const DATA_BLOB *sig)
 250 {
 251         struct schannel_state *state =
 252                 talloc_get_type_abort(gensec_security->private_data,
 253                 struct schannel_state);
 254
 255         return netsec_incoming_packet(state, true,
 256                                       discard_const_p(uint8_t, data),
 257                                       length, sig);
 258 }
 259
 260 /*
 261   check the signature on a packet
 262 */
 263 static NTSTATUS schannel_check_packet(struct gensec_security *gensec_security,
 264                                       const uint8_t *data, size_t length,
 265                                       const uint8_t *whole_pdu, size_t pdu_length,
 266                                       const DATA_BLOB *sig)
 267 {
 268         struct schannel_state *state =
 269                 talloc_get_type_abort(gensec_security->private_data,
 270                 struct schannel_state);
 271
 272         return netsec_incoming_packet(state, false,
 273                                       discard_const_p(uint8_t, data),
 274                                       length, sig);
 275 }
 276 /*
 277   seal a packet
 278 */
 279 static NTSTATUS schannel_seal_packet(struct gensec_security *gensec_security,
 280                                      TALLOC_CTX *mem_ctx,
 281                                      uint8_t *data, size_t length,
 282                                      const uint8_t *whole_pdu, size_t pdu_length,
 283                                      DATA_BLOB *sig)
 284 {
 285         struct schannel_state *state =
 286                 talloc_get_type_abort(gensec_security->private_data,
 287                 struct schannel_state);
 288
 289         return netsec_outgoing_packet(state, mem_ctx, true,
 290                                       data, length, sig);
 291 }
 292
 293 /*
 294   sign a packet
 295 */
 296 static NTSTATUS schannel_sign_packet(struct gensec_security *gensec_security,
 297                                      TALLOC_CTX *mem_ctx,
 298                                      const uint8_t *data, size_t length,
 299                                      const uint8_t *whole_pdu, size_t pdu_length,
 300                                      DATA_BLOB *sig)
 301 {
 302         struct schannel_state *state =
 303                 talloc_get_type_abort(gensec_security->private_data,
 304                 struct schannel_state);
 305
 306         return netsec_outgoing_packet(state, mem_ctx, false,
 307                                       discard_const_p(uint8_t, data),
 308                                       length, sig);
 309 }
 310
 311 static const struct gensec_security_ops gensec_schannel_security_ops = {
 312         .name           = "schannel",
 313         .auth_type      = DCERPC_AUTH_TYPE_SCHANNEL,
 314         .client_start   = schannel_client_start,
 315         .server_start   = schannel_server_start,
 316         .update         = schannel_update,
 317         .seal_packet    = schannel_seal_packet,
 318         .sign_packet    = schannel_sign_packet,
 319         .check_packet   = schannel_check_packet,
 320         .unseal_packet  = schannel_unseal_packet,
 321         .session_key    = schannel_session_key,
 322         .session_info   = schannel_session_info,
 323         .sig_size       = schannel_sig_size,
 324         .have_feature   = schannel_have_feature,
 325         .enabled        = true,
 326         .priority       = GENSEC_SCHANNEL
 327 };
 328
 329 _PUBLIC_ NTSTATUS gensec_schannel_init(void)
 330 {
 331         NTSTATUS ret;
 332         ret = gensec_register(&gensec_schannel_security_ops);
 333         if (!NT_STATUS_IS_OK(ret)) {
 334                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
 335                         gensec_schannel_security_ops.name));
 336                 return ret;
 337         }
 338
 339         return ret;
 340 }