Line data Source code
1 : /*
2 : * GSSAPI Security Extensions
3 : * RPC Pipe client and server routines
4 : * Copyright (C) Simo Sorce 2010.
5 : * Copyright (C) Andrew Bartlett 2004-2011.
6 : * Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
7 : *
8 : * This program is free software; you can redistribute it and/or modify
9 : * it under the terms of the GNU General Public License as published by
10 : * the Free Software Foundation; either version 3 of the License, or
11 : * (at your option) any later version.
12 : *
13 : * This program is distributed in the hope that it will be useful,
14 : * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 : * GNU General Public License for more details.
17 : *
18 : * You should have received a copy of the GNU General Public License
19 : * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 : */
21 :
22 : /* We support only GSSAPI/KRB5 here */
23 :
24 : #include "includes.h"
25 : #include <tevent.h>
26 : #include "lib/util/tevent_ntstatus.h"
27 : #include "gse.h"
28 : #include "libads/kerberos_proto.h"
29 : #include "auth/common_auth.h"
30 : #include "auth/gensec/gensec.h"
31 : #include "auth/gensec/gensec_internal.h"
32 : #include "auth/credentials/credentials.h"
33 : #include "../librpc/gen_ndr/dcerpc.h"
34 : #include "param/param.h"
35 :
36 : #if defined(HAVE_KRB5)
37 :
38 : #include "auth/kerberos/pac_utils.h"
39 : #include "auth/kerberos/gssapi_helper.h"
40 : #include "gse_krb5.h"
41 :
42 : static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
43 : static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
44 : size_t data_size);
45 :
46 : struct gse_context {
47 : gss_ctx_id_t gssapi_context;
48 : gss_name_t server_name;
49 : gss_name_t client_name;
50 : OM_uint32 gss_want_flags, gss_got_flags;
51 : size_t max_wrap_buf_size;
52 : size_t sig_size;
53 :
54 : gss_cred_id_t delegated_cred_handle;
55 :
56 : NTTIME expire_time;
57 :
58 : /* gensec_gse only */
59 : krb5_context k5ctx;
60 : krb5_ccache ccache;
61 : krb5_keytab keytab;
62 :
63 : gss_OID_desc gss_mech;
64 : gss_cred_id_t creds;
65 :
66 : gss_OID ret_mech;
67 : };
68 :
69 : /* free non talloc dependent contexts */
70 18421 : static int gse_context_destructor(void *ptr)
71 : {
72 0 : struct gse_context *gse_ctx;
73 0 : OM_uint32 gss_min;
74 :
75 18421 : gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
76 18421 : if (gse_ctx->k5ctx) {
77 18421 : if (gse_ctx->ccache) {
78 18421 : krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
79 18421 : gse_ctx->ccache = NULL;
80 : }
81 18421 : if (gse_ctx->keytab) {
82 3487 : krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
83 3487 : gse_ctx->keytab = NULL;
84 : }
85 18421 : krb5_free_context(gse_ctx->k5ctx);
86 18421 : gse_ctx->k5ctx = NULL;
87 : }
88 18421 : if (gse_ctx->gssapi_context != GSS_C_NO_CONTEXT) {
89 3517 : (void)gss_delete_sec_context(&gss_min,
90 : &gse_ctx->gssapi_context,
91 : GSS_C_NO_BUFFER);
92 : }
93 18421 : if (gse_ctx->server_name) {
94 2645 : (void)gss_release_name(&gss_min,
95 : &gse_ctx->server_name);
96 : }
97 18421 : if (gse_ctx->client_name) {
98 876 : (void)gss_release_name(&gss_min,
99 : &gse_ctx->client_name);
100 : }
101 18421 : if (gse_ctx->creds) {
102 6132 : (void)gss_release_cred(&gss_min,
103 : &gse_ctx->creds);
104 : }
105 18421 : if (gse_ctx->delegated_cred_handle) {
106 0 : (void)gss_release_cred(&gss_min,
107 : &gse_ctx->delegated_cred_handle);
108 : }
109 :
110 : /* MIT and Heimdal differ as to if you can call
111 : * gss_release_oid() on this OID, generated by
112 : * gss_{accept,init}_sec_context(). However, as long as the
113 : * oid is gss_mech_krb5 (which it always is at the moment),
114 : * then this is a moot point, as both declare this particular
115 : * OID static, and so no memory is lost. This assert is in
116 : * place to ensure that the programmer who wishes to extend
117 : * this code to EAP or other GSS mechanisms determines an
118 : * implementation-dependent way of releasing any dynamically
119 : * allocated OID */
120 18421 : SMB_ASSERT(smb_gss_oid_equal(&gse_ctx->gss_mech, GSS_C_NO_OID) ||
121 : smb_gss_oid_equal(&gse_ctx->gss_mech, gss_mech_krb5));
122 :
123 18421 : return 0;
124 : }
125 :
126 2669 : static NTSTATUS gse_setup_server_principal(TALLOC_CTX *mem_ctx,
127 : const char *target_principal,
128 : const char *service,
129 : const char *hostname,
130 : const char *realm,
131 : char **pserver_principal,
132 : gss_name_t *pserver_name)
133 : {
134 2669 : char *server_principal = NULL;
135 0 : gss_buffer_desc name_token;
136 0 : gss_OID name_type;
137 2669 : OM_uint32 maj_stat, min_stat = 0;
138 :
139 2669 : if (target_principal != NULL) {
140 0 : server_principal = talloc_strdup(mem_ctx, target_principal);
141 0 : name_type = GSS_C_NULL_OID;
142 : } else {
143 2669 : server_principal = talloc_asprintf(mem_ctx,
144 : "%s/%s@%s",
145 : service,
146 : hostname,
147 : realm);
148 2669 : name_type = GSS_C_NT_USER_NAME;
149 : }
150 2669 : if (server_principal == NULL) {
151 0 : return NT_STATUS_NO_MEMORY;
152 : }
153 :
154 2669 : name_token.value = (uint8_t *)server_principal;
155 2669 : name_token.length = strlen(server_principal);
156 :
157 2669 : maj_stat = gss_import_name(&min_stat,
158 : &name_token,
159 : name_type,
160 : pserver_name);
161 2669 : if (maj_stat) {
162 0 : DBG_WARNING("GSS Import name of %s failed: %s\n",
163 : server_principal,
164 : gse_errstr(mem_ctx, maj_stat, min_stat));
165 0 : TALLOC_FREE(server_principal);
166 0 : return NT_STATUS_INVALID_PARAMETER;
167 : }
168 :
169 2669 : *pserver_principal = server_principal;
170 :
171 2669 : return NT_STATUS_OK;
172 : }
173 :
174 18459 : static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
175 : bool do_sign, bool do_seal,
176 : const char *ccache_name,
177 : uint32_t add_gss_c_flags,
178 : struct gse_context **_gse_ctx)
179 : {
180 0 : struct gse_context *gse_ctx;
181 0 : krb5_error_code k5ret;
182 0 : NTSTATUS status;
183 :
184 18459 : gse_ctx = talloc_zero(mem_ctx, struct gse_context);
185 18459 : if (!gse_ctx) {
186 0 : return NT_STATUS_NO_MEMORY;
187 : }
188 18459 : talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
189 :
190 18459 : gse_ctx->expire_time = GENSEC_EXPIRE_TIME_INFINITY;
191 18459 : gse_ctx->max_wrap_buf_size = UINT16_MAX;
192 :
193 18459 : memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
194 :
195 18459 : gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
196 : GSS_C_DELEG_POLICY_FLAG |
197 : GSS_C_REPLAY_FLAG |
198 : GSS_C_SEQUENCE_FLAG;
199 18459 : if (do_sign) {
200 14924 : gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
201 : }
202 18459 : if (do_seal) {
203 820 : gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
204 820 : gse_ctx->gss_want_flags |= GSS_C_CONF_FLAG;
205 : }
206 :
207 18459 : gse_ctx->gss_want_flags |= add_gss_c_flags;
208 :
209 : /* Initialize Kerberos Context */
210 18459 : k5ret = smb_krb5_init_context_common(&gse_ctx->k5ctx);
211 18459 : if (k5ret) {
212 0 : DBG_ERR("kerberos init context failed (%s)\n",
213 : error_message(k5ret));
214 0 : status = NT_STATUS_INTERNAL_ERROR;
215 0 : goto err_out;
216 : }
217 :
218 : #ifdef SAMBA4_USES_HEIMDAL
219 15615 : k5ret = gsskrb5_set_dns_canonicalize(false);
220 15615 : if (k5ret) {
221 0 : DBG_ERR("gsskrb5_set_dns_canonicalize() failed (%s)\n",
222 : error_message(k5ret));
223 0 : status = NT_STATUS_INTERNAL_ERROR;
224 0 : goto err_out;
225 : }
226 : #endif
227 :
228 18459 : if (!ccache_name) {
229 18459 : ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
230 : }
231 18459 : k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
232 : &gse_ctx->ccache);
233 18459 : if (k5ret) {
234 0 : DEBUG(1, ("Failed to resolve credential cache '%s'! (%s)\n",
235 : ccache_name, error_message(k5ret)));
236 0 : status = NT_STATUS_INTERNAL_ERROR;
237 0 : goto err_out;
238 : }
239 :
240 : /* TODO: Should we enforce a enc_types list ?
241 : ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
242 : */
243 :
244 18459 : *_gse_ctx = gse_ctx;
245 18459 : return NT_STATUS_OK;
246 :
247 0 : err_out:
248 0 : TALLOC_FREE(gse_ctx);
249 0 : return status;
250 : }
251 :
252 14930 : static NTSTATUS gse_init_client(struct gensec_security *gensec_security,
253 : bool do_sign, bool do_seal,
254 : const char *ccache_name,
255 : const char *server,
256 : const char *service,
257 : const char *realm,
258 : const char *username,
259 : const char *password,
260 : uint32_t add_gss_c_flags,
261 : struct gse_context **_gse_ctx)
262 : {
263 0 : struct gse_context *gse_ctx;
264 0 : OM_uint32 gss_maj, gss_min;
265 : #ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
266 14930 : gss_buffer_desc empty_buffer = GSS_C_EMPTY_BUFFER;
267 14930 : gss_OID oid = discard_const(GSS_KRB5_CRED_NO_CI_FLAGS_X);
268 : #endif
269 0 : NTSTATUS status;
270 :
271 14930 : if (!server || !service) {
272 0 : return NT_STATUS_INVALID_PARAMETER;
273 : }
274 :
275 14930 : status = gse_context_init(gensec_security, do_sign, do_seal,
276 : ccache_name, add_gss_c_flags,
277 : &gse_ctx);
278 14930 : if (!NT_STATUS_IS_OK(status)) {
279 0 : return NT_STATUS_NO_MEMORY;
280 : }
281 :
282 : #ifdef SAMBA4_USES_HEIMDAL
283 : {
284 0 : int ret;
285 13809 : bool set_dns_canon = gensec_setting_bool(
286 : gensec_security->settings,
287 : "krb5", "set_dns_canonicalize",
288 : false);
289 13809 : const char *server_realm = lpcfg_realm(
290 13809 : gensec_security->settings->lp_ctx);
291 13809 : if (server_realm != NULL) {
292 13809 : ret = gsskrb5_set_default_realm(server_realm);
293 13809 : if (ret) {
294 0 : DBG_ERR("gsskrb5_set_default_realm failed\n");
295 0 : return NT_STATUS_INTERNAL_ERROR;
296 : }
297 : }
298 :
299 : /*
300 : * don't do DNS lookups of any kind, it might/will
301 : * fail for a netbios name
302 : */
303 13809 : ret = gsskrb5_set_dns_canonicalize(set_dns_canon);
304 13809 : if (ret != GSS_S_COMPLETE) {
305 0 : DBG_ERR("gsskrb5_set_dns_canonicalize failed\n");
306 0 : return NT_STATUS_INTERNAL_ERROR;
307 : }
308 : }
309 : #endif
310 :
311 : /* TODO: get krb5 ticket using username/password, if no valid
312 : * one already available in ccache */
313 :
314 14930 : gss_maj = smb_gss_krb5_import_cred(&gss_min,
315 14930 : gse_ctx->k5ctx,
316 14930 : gse_ctx->ccache,
317 : NULL, /* keytab_principal */
318 : NULL, /* keytab */
319 14930 : &gse_ctx->creds);
320 14930 : if (gss_maj) {
321 12279 : char *ccache = NULL;
322 0 : int kret;
323 :
324 12279 : kret = krb5_cc_get_full_name(gse_ctx->k5ctx,
325 12279 : gse_ctx->ccache,
326 : &ccache);
327 12279 : if (kret != 0) {
328 0 : ccache = NULL;
329 : }
330 :
331 12279 : DEBUG(5, ("smb_gss_krb5_import_cred ccache[%s] failed with [%s] -"
332 : "the caller may retry after a kinit.\n",
333 : ccache, gse_errstr(gse_ctx, gss_maj, gss_min)));
334 12279 : krb5_free_string(gse_ctx->k5ctx, ccache);
335 12279 : status = NT_STATUS_INTERNAL_ERROR;
336 12279 : goto err_out;
337 : }
338 :
339 : #ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
340 : /*
341 : * Don't force GSS_C_CONF_FLAG and GSS_C_INTEG_FLAG.
342 : *
343 : * This allows us to disable SIGN and SEAL for
344 : * AUTH_LEVEL_CONNECT and AUTH_LEVEL_INTEGRITY.
345 : *
346 : * https://groups.yahoo.com/neo/groups/cat-ietf/conversations/topics/575
347 : * http://krbdev.mit.edu/rt/Ticket/Display.html?id=6938
348 : */
349 2651 : gss_maj = gss_set_cred_option(&gss_min, &gse_ctx->creds,
350 : oid,
351 : &empty_buffer);
352 2651 : if (gss_maj) {
353 0 : DEBUG(0, ("gss_set_cred_option(GSS_KRB5_CRED_NO_CI_FLAGS_X), "
354 : "failed with [%s]\n",
355 : gse_errstr(gse_ctx, gss_maj, gss_min)));
356 0 : status = NT_STATUS_INTERNAL_ERROR;
357 0 : goto err_out;
358 : }
359 : #endif
360 :
361 2651 : *_gse_ctx = gse_ctx;
362 2651 : return NT_STATUS_OK;
363 :
364 12279 : err_out:
365 12279 : TALLOC_FREE(gse_ctx);
366 12279 : return status;
367 : }
368 :
369 5281 : static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
370 : struct gensec_security *gensec_security,
371 : const DATA_BLOB *token_in,
372 : DATA_BLOB *token_out)
373 : {
374 0 : struct gse_context *gse_ctx =
375 5281 : talloc_get_type_abort(gensec_security->private_data,
376 : struct gse_context);
377 5281 : OM_uint32 gss_maj = 0;
378 0 : OM_uint32 gss_min;
379 0 : gss_buffer_desc in_data;
380 0 : gss_buffer_desc out_data;
381 5281 : DATA_BLOB blob = data_blob_null;
382 0 : NTSTATUS status;
383 5281 : OM_uint32 time_rec = 0;
384 0 : struct timeval tv;
385 5281 : struct cli_credentials *cli_creds = gensec_get_credentials(gensec_security);
386 5281 : const char *target_principal = gensec_get_target_principal(gensec_security);
387 5281 : const char *hostname = gensec_get_target_hostname(gensec_security);
388 5281 : const char *service = gensec_get_target_service(gensec_security);
389 5281 : const char *client_realm = cli_credentials_get_realm(cli_creds);
390 5281 : char *server_principal = NULL;
391 5281 : char *server_realm = NULL;
392 5281 : bool fallback = false;
393 5281 : OM_uint32 time_req = 0;
394 :
395 5281 : time_req = gensec_setting_int(gensec_security->settings,
396 : "gensec_gssapi",
397 : "requested_life_time",
398 : time_req);
399 :
400 5281 : in_data.value = token_in->data;
401 5281 : in_data.length = token_in->length;
402 :
403 : /*
404 : * With credentials for administrator@FOREST1.EXAMPLE.COM this patch
405 : * changes the target_principal for the ldap service of host
406 : * dc2.forest2.example.com from
407 : *
408 : * ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM
409 : *
410 : * to
411 : *
412 : * ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM
413 : *
414 : * Typically ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM should be
415 : * used in order to allow the KDC of FOREST1.EXAMPLE.COM to generate a
416 : * referral ticket for krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM.
417 : *
418 : * The problem is that KDCs only return such referral tickets if
419 : * there's a forest trust between FOREST1.EXAMPLE.COM and
420 : * FOREST2.EXAMPLE.COM. If there's only an external domain trust
421 : * between FOREST1.EXAMPLE.COM and FOREST2.EXAMPLE.COM the KDC of
422 : * FOREST1.EXAMPLE.COM will respond with S_PRINCIPAL_UNKNOWN when being
423 : * asked for ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM.
424 : *
425 : * In the case of an external trust the client can still ask explicitly
426 : * for krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM and the KDC of
427 : * FOREST1.EXAMPLE.COM will generate it.
428 : *
429 : * From there the client can use the
430 : * krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM ticket and ask a KDC
431 : * of FOREST2.EXAMPLE.COM for a service ticket for
432 : * ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM.
433 : *
434 : * With Heimdal we'll get the fallback on S_PRINCIPAL_UNKNOWN behavior
435 : * when we pass ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM as
436 : * target principal. As _krb5_get_cred_kdc_any() first calls
437 : * get_cred_kdc_referral() (which always starts with the client realm)
438 : * and falls back to get_cred_kdc_capath() (which starts with the given
439 : * realm).
440 : *
441 : * MIT krb5 only tries the given realm of the target principal, if we
442 : * want to autodetect support for transitive forest trusts, would have
443 : * to do the fallback ourself.
444 : */
445 : #ifndef SAMBA4_USES_HEIMDAL
446 1804 : if (gse_ctx->server_name == NULL) {
447 907 : OM_uint32 gss_min2 = 0;
448 :
449 907 : status = gse_setup_server_principal(mem_ctx,
450 : target_principal,
451 : service,
452 : hostname,
453 : client_realm,
454 : &server_principal,
455 : &gse_ctx->server_name);
456 907 : if (!NT_STATUS_IS_OK(status)) {
457 0 : return status;
458 : }
459 :
460 1814 : gss_maj = gss_init_sec_context(&gss_min,
461 : gse_ctx->creds,
462 : &gse_ctx->gssapi_context,
463 : gse_ctx->server_name,
464 907 : &gse_ctx->gss_mech,
465 : gse_ctx->gss_want_flags,
466 : time_req,
467 : GSS_C_NO_CHANNEL_BINDINGS,
468 : &in_data,
469 : NULL,
470 : &out_data,
471 : &gse_ctx->gss_got_flags,
472 : &time_rec);
473 907 : if (gss_maj != GSS_S_FAILURE) {
474 889 : goto init_sec_context_done;
475 : }
476 18 : if (gss_min != (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
477 0 : goto init_sec_context_done;
478 : }
479 18 : if (target_principal != NULL) {
480 0 : goto init_sec_context_done;
481 : }
482 :
483 18 : fallback = true;
484 18 : TALLOC_FREE(server_principal);
485 18 : gss_release_name(&gss_min2, &gse_ctx->server_name);
486 : }
487 : #endif /* !SAMBA4_USES_HEIMDAL */
488 :
489 4392 : if (gse_ctx->server_name == NULL) {
490 1762 : server_realm = smb_krb5_get_realm_from_hostname(mem_ctx,
491 : hostname,
492 : client_realm);
493 1762 : if (server_realm == NULL) {
494 0 : return NT_STATUS_NO_MEMORY;
495 : }
496 :
497 1780 : if (fallback &&
498 18 : strequal(client_realm, server_realm)) {
499 0 : goto init_sec_context_done;
500 : }
501 :
502 1762 : status = gse_setup_server_principal(mem_ctx,
503 : target_principal,
504 : service,
505 : hostname,
506 : server_realm,
507 : &server_principal,
508 : &gse_ctx->server_name);
509 1762 : TALLOC_FREE(server_realm);
510 1762 : if (!NT_STATUS_IS_OK(status)) {
511 0 : return status;
512 : }
513 :
514 1762 : TALLOC_FREE(server_principal);
515 : }
516 :
517 8784 : gss_maj = gss_init_sec_context(&gss_min,
518 3477 : gse_ctx->creds,
519 : &gse_ctx->gssapi_context,
520 3477 : gse_ctx->server_name,
521 4392 : &gse_ctx->gss_mech,
522 : gse_ctx->gss_want_flags,
523 : time_req, GSS_C_NO_CHANNEL_BINDINGS,
524 : &in_data, NULL, &out_data,
525 : &gse_ctx->gss_got_flags, &time_rec);
526 4392 : goto init_sec_context_done;
527 : /* JUMP! */
528 5281 : init_sec_context_done:
529 :
530 5281 : switch (gss_maj) {
531 2630 : case GSS_S_COMPLETE:
532 : /* we are done with it */
533 2630 : tv = timeval_current_ofs(time_rec, 0);
534 2630 : gse_ctx->expire_time = timeval_to_nttime(&tv);
535 :
536 2630 : status = NT_STATUS_OK;
537 2630 : break;
538 2647 : case GSS_S_CONTINUE_NEEDED:
539 : /* we will need a third leg */
540 2647 : status = NT_STATUS_MORE_PROCESSING_REQUIRED;
541 2647 : break;
542 0 : case GSS_S_CONTEXT_EXPIRED:
543 : /* Make SPNEGO ignore us, we can't go any further here */
544 0 : DBG_NOTICE("Context expired\n");
545 0 : status = NT_STATUS_INVALID_PARAMETER;
546 4 : goto done;
547 4 : case GSS_S_FAILURE:
548 4 : switch (gss_min) {
549 2 : case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: {
550 2 : gss_buffer_desc name_token = {
551 : .length = 0,
552 : };
553 :
554 2 : gss_maj = gss_display_name(&gss_min,
555 0 : gse_ctx->server_name,
556 : &name_token,
557 : NULL);
558 2 : if (gss_maj == GSS_S_COMPLETE) {
559 2 : DBG_NOTICE("Server principal %.*s not found\n",
560 : (int)name_token.length,
561 : (char *)name_token.value);
562 2 : gss_release_buffer(&gss_maj, &name_token);
563 : } else {
564 0 : DBG_NOTICE("Server principal not found\n");
565 : }
566 :
567 : /* Make SPNEGO ignore us, we can't go any further here */
568 2 : status = NT_STATUS_INVALID_PARAMETER;
569 2 : goto done;
570 : }
571 0 : case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED:
572 0 : DBG_NOTICE("Ticket expired\n");
573 : /* Make SPNEGO ignore us, we can't go any further here */
574 0 : status = NT_STATUS_INVALID_PARAMETER;
575 0 : goto done;
576 0 : case (OM_uint32)KRB5KRB_AP_ERR_TKT_NYV:
577 0 : DBG_NOTICE("Clockskew\n");
578 : /* Make SPNEGO ignore us, we can't go any further here */
579 0 : status = NT_STATUS_TIME_DIFFERENCE_AT_DC;
580 0 : goto done;
581 0 : case (OM_uint32)KRB5_KDC_UNREACH:
582 0 : DBG_NOTICE("KDC unreachable\n");
583 : /* Make SPNEGO ignore us, we can't go any further here */
584 0 : status = NT_STATUS_NO_LOGON_SERVERS;
585 0 : goto done;
586 0 : case (OM_uint32)KRB5KRB_AP_ERR_MSG_TYPE:
587 : /* Garbage input, possibly from the auto-mech detection */
588 0 : status = NT_STATUS_INVALID_PARAMETER;
589 0 : goto done;
590 0 : case (OM_uint32)KRB5KDC_ERR_ETYPE_NOSUPP:
591 0 : status = NT_STATUS_KDC_UNKNOWN_ETYPE;
592 0 : goto done;
593 2 : default:
594 2 : DBG_ERR("gss_init_sec_context failed with [%s](%u)\n",
595 : gse_errstr(talloc_tos(), gss_maj, gss_min),
596 : gss_min);
597 2 : status = NT_STATUS_LOGON_FAILURE;
598 2 : goto done;
599 : }
600 0 : break;
601 0 : default:
602 0 : DBG_ERR("gss_init_sec_context failed with [%s]\n",
603 : gse_errstr(talloc_tos(), gss_maj, gss_min));
604 0 : status = NT_STATUS_INTERNAL_ERROR;
605 0 : goto done;
606 : }
607 :
608 : /* we may be told to return nothing */
609 5277 : if (out_data.length) {
610 2674 : blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
611 2674 : if (!blob.data) {
612 0 : status = NT_STATUS_NO_MEMORY;
613 : }
614 :
615 2674 : gss_release_buffer(&gss_min, &out_data);
616 : }
617 :
618 2603 : done:
619 5281 : *token_out = blob;
620 5281 : return status;
621 : }
622 :
623 3529 : static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
624 : bool do_sign, bool do_seal,
625 : uint32_t add_gss_c_flags,
626 : struct gse_context **_gse_ctx)
627 : {
628 0 : struct gse_context *gse_ctx;
629 0 : OM_uint32 gss_maj, gss_min;
630 0 : krb5_error_code ret;
631 0 : NTSTATUS status;
632 :
633 3529 : status = gse_context_init(mem_ctx, do_sign, do_seal,
634 : NULL, add_gss_c_flags, &gse_ctx);
635 3529 : if (!NT_STATUS_IS_OK(status)) {
636 0 : return NT_STATUS_NO_MEMORY;
637 : }
638 :
639 3529 : ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
640 3529 : &gse_ctx->keytab);
641 3529 : if (ret) {
642 10 : status = NT_STATUS_INTERNAL_ERROR;
643 10 : goto done;
644 : }
645 :
646 : /* This creates a GSSAPI cred_id_t with the keytab set */
647 3519 : gss_maj = smb_gss_krb5_import_cred(&gss_min, gse_ctx->k5ctx,
648 3519 : NULL, NULL, gse_ctx->keytab,
649 3519 : &gse_ctx->creds);
650 :
651 3519 : if (gss_maj != 0) {
652 0 : DEBUG(0, ("smb_gss_krb5_import_cred failed with [%s]\n",
653 : gse_errstr(gse_ctx, gss_maj, gss_min)));
654 0 : status = NT_STATUS_INTERNAL_ERROR;
655 0 : goto done;
656 : }
657 :
658 3519 : status = NT_STATUS_OK;
659 :
660 3529 : done:
661 3529 : if (!NT_STATUS_IS_OK(status)) {
662 10 : TALLOC_FREE(gse_ctx);
663 : }
664 :
665 3529 : *_gse_ctx = gse_ctx;
666 3529 : return status;
667 : }
668 :
669 997 : static NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
670 : struct gensec_security *gensec_security,
671 : const DATA_BLOB *token_in,
672 : DATA_BLOB *token_out)
673 : {
674 0 : struct gse_context *gse_ctx =
675 997 : talloc_get_type_abort(gensec_security->private_data,
676 : struct gse_context);
677 0 : OM_uint32 gss_maj, gss_min;
678 0 : gss_buffer_desc in_data;
679 0 : gss_buffer_desc out_data;
680 997 : DATA_BLOB blob = data_blob_null;
681 0 : NTSTATUS status;
682 997 : OM_uint32 time_rec = 0;
683 0 : struct timeval tv;
684 :
685 997 : in_data.value = token_in->data;
686 997 : in_data.length = token_in->length;
687 :
688 997 : gss_maj = gss_accept_sec_context(&gss_min,
689 : &gse_ctx->gssapi_context,
690 528 : gse_ctx->creds,
691 : &in_data,
692 : GSS_C_NO_CHANNEL_BINDINGS,
693 : &gse_ctx->client_name,
694 : &gse_ctx->ret_mech,
695 : &out_data,
696 : &gse_ctx->gss_got_flags,
697 : &time_rec,
698 : &gse_ctx->delegated_cred_handle);
699 997 : switch (gss_maj) {
700 882 : case GSS_S_COMPLETE:
701 : /* we are done with it */
702 882 : tv = timeval_current_ofs(time_rec, 0);
703 882 : gse_ctx->expire_time = timeval_to_nttime(&tv);
704 :
705 882 : status = NT_STATUS_OK;
706 997 : break;
707 115 : case GSS_S_CONTINUE_NEEDED:
708 : /* we will need a third leg */
709 115 : status = NT_STATUS_MORE_PROCESSING_REQUIRED;
710 115 : break;
711 0 : default:
712 0 : DEBUG(1, ("gss_accept_sec_context failed with [%s]\n",
713 : gse_errstr(talloc_tos(), gss_maj, gss_min)));
714 :
715 0 : if (gse_ctx->gssapi_context) {
716 0 : gss_delete_sec_context(&gss_min,
717 : &gse_ctx->gssapi_context,
718 : GSS_C_NO_BUFFER);
719 : }
720 :
721 : /*
722 : * If we got an output token, make Windows aware of it
723 : * by telling it that more processing is needed
724 : */
725 0 : if (out_data.length > 0) {
726 0 : status = NT_STATUS_MORE_PROCESSING_REQUIRED;
727 : /* Fall through to handle the out token */
728 : } else {
729 0 : status = NT_STATUS_LOGON_FAILURE;
730 0 : goto done;
731 : }
732 : }
733 :
734 : /* we may be told to return nothing */
735 997 : if (out_data.length) {
736 882 : blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
737 882 : if (!blob.data) {
738 0 : status = NT_STATUS_NO_MEMORY;
739 : }
740 882 : gss_release_buffer(&gss_min, &out_data);
741 : }
742 :
743 :
744 115 : done:
745 997 : *token_out = blob;
746 997 : return status;
747 : }
748 :
749 2 : static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
750 : {
751 0 : OM_uint32 gss_min, gss_maj;
752 0 : gss_buffer_desc msg_min;
753 0 : gss_buffer_desc msg_maj;
754 2 : OM_uint32 msg_ctx = 0;
755 :
756 2 : char *errstr = NULL;
757 :
758 2 : ZERO_STRUCT(msg_min);
759 2 : ZERO_STRUCT(msg_maj);
760 :
761 2 : gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
762 : GSS_C_NO_OID, &msg_ctx, &msg_maj);
763 2 : if (gss_maj) {
764 0 : goto done;
765 : }
766 2 : errstr = talloc_strndup(mem_ctx,
767 2 : (char *)msg_maj.value,
768 : msg_maj.length);
769 2 : if (!errstr) {
770 0 : goto done;
771 : }
772 2 : gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
773 : (gss_OID)discard_const(gss_mech_krb5),
774 : &msg_ctx, &msg_min);
775 2 : if (gss_maj) {
776 0 : goto done;
777 : }
778 :
779 2 : errstr = talloc_strdup_append_buffer(errstr, ": ");
780 2 : if (!errstr) {
781 0 : goto done;
782 : }
783 2 : errstr = talloc_strndup_append_buffer(errstr,
784 2 : (char *)msg_min.value,
785 : msg_min.length);
786 2 : if (!errstr) {
787 0 : goto done;
788 : }
789 :
790 2 : done:
791 2 : if (msg_min.value) {
792 2 : gss_release_buffer(&gss_min, &msg_min);
793 : }
794 2 : if (msg_maj.value) {
795 2 : gss_release_buffer(&gss_min, &msg_maj);
796 : }
797 2 : return errstr;
798 : }
799 :
800 16696 : static NTSTATUS gensec_gse_client_start(struct gensec_security *gensec_security)
801 : {
802 0 : struct gse_context *gse_ctx;
803 16696 : struct cli_credentials *creds = gensec_get_credentials(gensec_security);
804 0 : NTSTATUS nt_status;
805 16696 : OM_uint32 want_flags = 0;
806 16696 : bool do_sign = false, do_seal = false;
807 16696 : const char *hostname = gensec_get_target_hostname(gensec_security);
808 16696 : const char *service = gensec_get_target_service(gensec_security);
809 16696 : const char *username = cli_credentials_get_username(creds);
810 16696 : const char *password = cli_credentials_get_password(creds);
811 16696 : const char *realm = cli_credentials_get_realm(creds);
812 :
813 16696 : if (!hostname) {
814 40 : DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
815 40 : return NT_STATUS_INVALID_PARAMETER;
816 : }
817 16656 : if (is_ipaddress(hostname)) {
818 1726 : DEBUG(2, ("Cannot do GSE to an IP address\n"));
819 1726 : return NT_STATUS_INVALID_PARAMETER;
820 : }
821 14930 : if (strcmp(hostname, "localhost") == 0) {
822 0 : DEBUG(2, ("GSE to 'localhost' does not make sense\n"));
823 0 : return NT_STATUS_INVALID_PARAMETER;
824 : }
825 :
826 14930 : if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
827 14345 : do_sign = true;
828 : }
829 14930 : if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
830 981 : do_sign = true;
831 : }
832 14930 : if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
833 802 : do_seal = true;
834 : }
835 14930 : if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
836 87 : want_flags |= GSS_C_DCE_STYLE;
837 : }
838 :
839 14930 : nt_status = gse_init_client(gensec_security, do_sign, do_seal, NULL,
840 : hostname, service, realm,
841 : username, password, want_flags,
842 : &gse_ctx);
843 14930 : if (!NT_STATUS_IS_OK(nt_status)) {
844 12279 : return nt_status;
845 : }
846 2651 : gensec_security->private_data = gse_ctx;
847 2651 : return NT_STATUS_OK;
848 : }
849 :
850 3529 : static NTSTATUS gensec_gse_server_start(struct gensec_security *gensec_security)
851 : {
852 0 : struct gse_context *gse_ctx;
853 0 : NTSTATUS nt_status;
854 3529 : OM_uint32 want_flags = 0;
855 3529 : bool do_sign = false, do_seal = false;
856 :
857 3529 : if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
858 18 : do_sign = true;
859 : }
860 3529 : if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
861 18 : do_seal = true;
862 : }
863 3529 : if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
864 115 : want_flags |= GSS_C_DCE_STYLE;
865 : }
866 :
867 3529 : nt_status = gse_init_server(gensec_security, do_sign, do_seal, want_flags,
868 : &gse_ctx);
869 3529 : if (!NT_STATUS_IS_OK(nt_status)) {
870 10 : return nt_status;
871 : }
872 3519 : gensec_security->private_data = gse_ctx;
873 3519 : return NT_STATUS_OK;
874 : }
875 :
876 : struct gensec_gse_update_state {
877 : NTSTATUS status;
878 : DATA_BLOB out;
879 : };
880 :
881 : static NTSTATUS gensec_gse_update_internal(struct gensec_security *gensec_security,
882 : TALLOC_CTX *mem_ctx,
883 : const DATA_BLOB in,
884 : DATA_BLOB *out);
885 :
886 6278 : static struct tevent_req *gensec_gse_update_send(TALLOC_CTX *mem_ctx,
887 : struct tevent_context *ev,
888 : struct gensec_security *gensec_security,
889 : const DATA_BLOB in)
890 : {
891 6278 : struct tevent_req *req = NULL;
892 6278 : struct gensec_gse_update_state *state = NULL;
893 0 : NTSTATUS status;
894 :
895 6278 : req = tevent_req_create(mem_ctx, &state,
896 : struct gensec_gse_update_state);
897 6278 : if (req == NULL) {
898 0 : return NULL;
899 : }
900 :
901 6278 : status = gensec_gse_update_internal(gensec_security,
902 : state, in,
903 6278 : &state->out);
904 6278 : state->status = status;
905 6278 : if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
906 2762 : tevent_req_done(req);
907 2762 : return tevent_req_post(req, ev);
908 : }
909 3516 : if (tevent_req_nterror(req, status)) {
910 4 : return tevent_req_post(req, ev);
911 : }
912 :
913 3512 : tevent_req_done(req);
914 3512 : return tevent_req_post(req, ev);
915 : }
916 :
917 6278 : static NTSTATUS gensec_gse_update_internal(struct gensec_security *gensec_security,
918 : TALLOC_CTX *mem_ctx,
919 : const DATA_BLOB in,
920 : DATA_BLOB *out)
921 : {
922 0 : NTSTATUS status;
923 :
924 6278 : switch (gensec_security->gensec_role) {
925 5281 : case GENSEC_CLIENT:
926 5281 : status = gse_get_client_auth_token(mem_ctx,
927 : gensec_security,
928 : &in, out);
929 5281 : break;
930 997 : case GENSEC_SERVER:
931 997 : status = gse_get_server_auth_token(mem_ctx,
932 : gensec_security,
933 : &in, out);
934 997 : break;
935 : }
936 6278 : if (!NT_STATUS_IS_OK(status)) {
937 2766 : return status;
938 : }
939 :
940 3512 : return NT_STATUS_OK;
941 : }
942 :
943 6278 : static NTSTATUS gensec_gse_update_recv(struct tevent_req *req,
944 : TALLOC_CTX *out_mem_ctx,
945 : DATA_BLOB *out)
946 : {
947 0 : struct gensec_gse_update_state *state =
948 6278 : tevent_req_data(req,
949 : struct gensec_gse_update_state);
950 0 : NTSTATUS status;
951 :
952 6278 : *out = data_blob_null;
953 :
954 6278 : if (tevent_req_is_nterror(req, &status)) {
955 4 : tevent_req_received(req);
956 4 : return status;
957 : }
958 :
959 6274 : *out = state->out;
960 6274 : talloc_steal(out_mem_ctx, state->out.data);
961 6274 : status = state->status;
962 6274 : tevent_req_received(req);
963 6274 : return status;
964 : }
965 :
966 1604 : static NTSTATUS gensec_gse_wrap(struct gensec_security *gensec_security,
967 : TALLOC_CTX *mem_ctx,
968 : const DATA_BLOB *in,
969 : DATA_BLOB *out)
970 : {
971 0 : struct gse_context *gse_ctx =
972 1604 : talloc_get_type_abort(gensec_security->private_data,
973 : struct gse_context);
974 0 : OM_uint32 maj_stat, min_stat;
975 0 : gss_buffer_desc input_token, output_token;
976 0 : int conf_state;
977 1604 : input_token.length = in->length;
978 1604 : input_token.value = in->data;
979 :
980 1604 : maj_stat = gss_wrap(&min_stat,
981 830 : gse_ctx->gssapi_context,
982 1604 : gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
983 : GSS_C_QOP_DEFAULT,
984 : &input_token,
985 : &conf_state,
986 : &output_token);
987 1604 : if (GSS_ERROR(maj_stat)) {
988 0 : DEBUG(0, ("gensec_gse_wrap: GSS Wrap failed: %s\n",
989 : gse_errstr(talloc_tos(), maj_stat, min_stat)));
990 0 : return NT_STATUS_ACCESS_DENIED;
991 : }
992 :
993 1604 : *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
994 1604 : gss_release_buffer(&min_stat, &output_token);
995 :
996 1604 : if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
997 1604 : && !conf_state) {
998 0 : return NT_STATUS_ACCESS_DENIED;
999 : }
1000 1604 : return NT_STATUS_OK;
1001 : }
1002 :
1003 1298 : static NTSTATUS gensec_gse_unwrap(struct gensec_security *gensec_security,
1004 : TALLOC_CTX *mem_ctx,
1005 : const DATA_BLOB *in,
1006 : DATA_BLOB *out)
1007 : {
1008 0 : struct gse_context *gse_ctx =
1009 1298 : talloc_get_type_abort(gensec_security->private_data,
1010 : struct gse_context);
1011 0 : OM_uint32 maj_stat, min_stat;
1012 0 : gss_buffer_desc input_token, output_token;
1013 0 : int conf_state;
1014 0 : gss_qop_t qop_state;
1015 1298 : input_token.length = in->length;
1016 1298 : input_token.value = in->data;
1017 :
1018 1298 : maj_stat = gss_unwrap(&min_stat,
1019 673 : gse_ctx->gssapi_context,
1020 : &input_token,
1021 : &output_token,
1022 : &conf_state,
1023 : &qop_state);
1024 1298 : if (GSS_ERROR(maj_stat)) {
1025 0 : DEBUG(0, ("gensec_gse_unwrap: GSS UnWrap failed: %s\n",
1026 : gse_errstr(talloc_tos(), maj_stat, min_stat)));
1027 0 : return NT_STATUS_ACCESS_DENIED;
1028 : }
1029 :
1030 1298 : *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
1031 1298 : gss_release_buffer(&min_stat, &output_token);
1032 :
1033 1298 : if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
1034 1298 : && !conf_state) {
1035 0 : return NT_STATUS_ACCESS_DENIED;
1036 : }
1037 1298 : return NT_STATUS_OK;
1038 : }
1039 :
1040 24 : static NTSTATUS gensec_gse_seal_packet(struct gensec_security *gensec_security,
1041 : TALLOC_CTX *mem_ctx,
1042 : uint8_t *data, size_t length,
1043 : const uint8_t *whole_pdu, size_t pdu_length,
1044 : DATA_BLOB *sig)
1045 : {
1046 0 : struct gse_context *gse_ctx =
1047 24 : talloc_get_type_abort(gensec_security->private_data,
1048 : struct gse_context);
1049 24 : bool hdr_signing = false;
1050 24 : size_t sig_size = 0;
1051 0 : NTSTATUS status;
1052 :
1053 24 : if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1054 24 : hdr_signing = true;
1055 : }
1056 :
1057 24 : sig_size = gensec_gse_sig_size(gensec_security, length);
1058 :
1059 24 : status = gssapi_seal_packet(gse_ctx->gssapi_context,
1060 24 : &gse_ctx->gss_mech,
1061 : hdr_signing, sig_size,
1062 : data, length,
1063 : whole_pdu, pdu_length,
1064 : mem_ctx, sig);
1065 24 : if (!NT_STATUS_IS_OK(status)) {
1066 0 : DEBUG(0, ("gssapi_seal_packet(hdr_signing=%u,sig_size=%zu,"
1067 : "data=%zu,pdu=%zu) failed: %s\n",
1068 : hdr_signing, sig_size, length, pdu_length,
1069 : nt_errstr(status)));
1070 0 : return status;
1071 : }
1072 :
1073 24 : return NT_STATUS_OK;
1074 : }
1075 :
1076 24 : static NTSTATUS gensec_gse_unseal_packet(struct gensec_security *gensec_security,
1077 : uint8_t *data, size_t length,
1078 : const uint8_t *whole_pdu, size_t pdu_length,
1079 : const DATA_BLOB *sig)
1080 : {
1081 0 : struct gse_context *gse_ctx =
1082 24 : talloc_get_type_abort(gensec_security->private_data,
1083 : struct gse_context);
1084 24 : bool hdr_signing = false;
1085 0 : NTSTATUS status;
1086 :
1087 24 : if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1088 24 : hdr_signing = true;
1089 : }
1090 :
1091 24 : status = gssapi_unseal_packet(gse_ctx->gssapi_context,
1092 24 : &gse_ctx->gss_mech,
1093 : hdr_signing,
1094 : data, length,
1095 : whole_pdu, pdu_length,
1096 : sig);
1097 24 : if (!NT_STATUS_IS_OK(status)) {
1098 0 : DEBUG(0, ("gssapi_unseal_packet(hdr_signing=%u,sig_size=%zu,"
1099 : "data=%zu,pdu=%zu) failed: %s\n",
1100 : hdr_signing, sig->length, length, pdu_length,
1101 : nt_errstr(status)));
1102 0 : return status;
1103 : }
1104 :
1105 24 : return NT_STATUS_OK;
1106 : }
1107 :
1108 222 : static NTSTATUS gensec_gse_sign_packet(struct gensec_security *gensec_security,
1109 : TALLOC_CTX *mem_ctx,
1110 : const uint8_t *data, size_t length,
1111 : const uint8_t *whole_pdu, size_t pdu_length,
1112 : DATA_BLOB *sig)
1113 : {
1114 0 : struct gse_context *gse_ctx =
1115 222 : talloc_get_type_abort(gensec_security->private_data,
1116 : struct gse_context);
1117 222 : bool hdr_signing = false;
1118 0 : NTSTATUS status;
1119 :
1120 222 : if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1121 122 : hdr_signing = true;
1122 : }
1123 :
1124 222 : status = gssapi_sign_packet(gse_ctx->gssapi_context,
1125 222 : &gse_ctx->gss_mech,
1126 : hdr_signing,
1127 : data, length,
1128 : whole_pdu, pdu_length,
1129 : mem_ctx, sig);
1130 222 : if (!NT_STATUS_IS_OK(status)) {
1131 0 : DEBUG(0, ("gssapi_sign_packet(hdr_signing=%u,"
1132 : "data=%zu,pdu=%zu) failed: %s\n",
1133 : hdr_signing, length, pdu_length,
1134 : nt_errstr(status)));
1135 0 : return status;
1136 : }
1137 :
1138 222 : return NT_STATUS_OK;
1139 : }
1140 :
1141 254 : static NTSTATUS gensec_gse_check_packet(struct gensec_security *gensec_security,
1142 : const uint8_t *data, size_t length,
1143 : const uint8_t *whole_pdu, size_t pdu_length,
1144 : const DATA_BLOB *sig)
1145 : {
1146 0 : struct gse_context *gse_ctx =
1147 254 : talloc_get_type_abort(gensec_security->private_data,
1148 : struct gse_context);
1149 254 : bool hdr_signing = false;
1150 0 : NTSTATUS status;
1151 :
1152 254 : if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1153 136 : hdr_signing = true;
1154 : }
1155 :
1156 254 : status = gssapi_check_packet(gse_ctx->gssapi_context,
1157 254 : &gse_ctx->gss_mech,
1158 : hdr_signing,
1159 : data, length,
1160 : whole_pdu, pdu_length,
1161 : sig);
1162 254 : if (!NT_STATUS_IS_OK(status)) {
1163 8 : DEBUG(0, ("gssapi_check_packet(hdr_signing=%u,sig_size=%zu"
1164 : "data=%zu,pdu=%zu) failed: %s\n",
1165 : hdr_signing, sig->length, length, pdu_length,
1166 : nt_errstr(status)));
1167 8 : return status;
1168 : }
1169 :
1170 246 : return NT_STATUS_OK;
1171 : }
1172 :
1173 : /* Try to figure out what features we actually got on the connection */
1174 19714 : static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
1175 : uint32_t feature)
1176 : {
1177 0 : struct gse_context *gse_ctx =
1178 19714 : talloc_get_type_abort(gensec_security->private_data,
1179 : struct gse_context);
1180 :
1181 19714 : if (feature & GENSEC_FEATURE_SESSION_KEY) {
1182 4582 : return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
1183 : }
1184 15132 : if (feature & GENSEC_FEATURE_SIGN) {
1185 5630 : return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
1186 : }
1187 9502 : if (feature & GENSEC_FEATURE_SEAL) {
1188 6377 : return gse_ctx->gss_got_flags & GSS_C_CONF_FLAG;
1189 : }
1190 3125 : if (feature & GENSEC_FEATURE_DCE_STYLE) {
1191 126 : return gse_ctx->gss_got_flags & GSS_C_DCE_STYLE;
1192 : }
1193 2999 : if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
1194 0 : NTSTATUS status;
1195 0 : uint32_t keytype;
1196 :
1197 2699 : if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
1198 18 : return false;
1199 : }
1200 :
1201 2681 : status = gssapi_get_session_key(talloc_tos(),
1202 : gse_ctx->gssapi_context, NULL, &keytype);
1203 : /*
1204 : * We should do a proper sig on the mechListMic unless
1205 : * we know we have to be backwards compatible with
1206 : * earlier windows versions.
1207 : *
1208 : * Negotiating a non-krb5
1209 : * mech for example should be regarded as having
1210 : * NEW_SPNEGO
1211 : */
1212 2681 : if (NT_STATUS_IS_OK(status)) {
1213 2681 : switch (keytype) {
1214 61 : case ENCTYPE_DES_CBC_CRC:
1215 : case ENCTYPE_DES_CBC_MD5:
1216 : case ENCTYPE_ARCFOUR_HMAC:
1217 : case ENCTYPE_DES3_CBC_SHA1:
1218 61 : return false;
1219 : }
1220 : }
1221 2620 : return true;
1222 : }
1223 : /* We can always do async (rather than strict request/reply) packets. */
1224 300 : if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
1225 171 : return true;
1226 : }
1227 129 : if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1228 129 : return true;
1229 : }
1230 0 : return false;
1231 : }
1232 :
1233 1033 : static NTTIME gensec_gse_expire_time(struct gensec_security *gensec_security)
1234 : {
1235 0 : struct gse_context *gse_ctx =
1236 1033 : talloc_get_type_abort(gensec_security->private_data,
1237 : struct gse_context);
1238 :
1239 1033 : return gse_ctx->expire_time;
1240 : }
1241 :
1242 : /*
1243 : * Extract the 'session key' needed by SMB signing and ncacn_np
1244 : * (for encrypting some passwords).
1245 : *
1246 : * This breaks all the abstractions, but what do you expect...
1247 : */
1248 3155 : static NTSTATUS gensec_gse_session_key(struct gensec_security *gensec_security,
1249 : TALLOC_CTX *mem_ctx,
1250 : DATA_BLOB *session_key)
1251 : {
1252 0 : struct gse_context *gse_ctx =
1253 3155 : talloc_get_type_abort(gensec_security->private_data,
1254 : struct gse_context);
1255 :
1256 3155 : return gssapi_get_session_key(mem_ctx, gse_ctx->gssapi_context, session_key, NULL);
1257 : }
1258 :
1259 : /* Get some basic (and authorization) information about the user on
1260 : * this session. This uses either the PAC (if present) or a local
1261 : * database lookup */
1262 878 : static NTSTATUS gensec_gse_session_info(struct gensec_security *gensec_security,
1263 : TALLOC_CTX *mem_ctx,
1264 : struct auth_session_info **_session_info)
1265 : {
1266 0 : struct gse_context *gse_ctx =
1267 878 : talloc_get_type_abort(gensec_security->private_data,
1268 : struct gse_context);
1269 0 : NTSTATUS nt_status;
1270 0 : TALLOC_CTX *tmp_ctx;
1271 878 : struct auth_session_info *session_info = NULL;
1272 0 : OM_uint32 maj_stat, min_stat;
1273 878 : DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
1274 :
1275 0 : gss_buffer_desc name_token;
1276 0 : char *principal_string;
1277 :
1278 878 : tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gse_session_info context");
1279 878 : NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1280 :
1281 878 : maj_stat = gss_display_name(&min_stat,
1282 461 : gse_ctx->client_name,
1283 : &name_token,
1284 : NULL);
1285 878 : if (GSS_ERROR(maj_stat)) {
1286 0 : DEBUG(1, ("GSS display_name failed: %s\n",
1287 : gse_errstr(talloc_tos(), maj_stat, min_stat)));
1288 0 : talloc_free(tmp_ctx);
1289 0 : return NT_STATUS_FOOBAR;
1290 : }
1291 :
1292 878 : principal_string = talloc_strndup(tmp_ctx,
1293 878 : (const char *)name_token.value,
1294 : name_token.length);
1295 :
1296 878 : gss_release_buffer(&min_stat, &name_token);
1297 :
1298 878 : if (!principal_string) {
1299 0 : talloc_free(tmp_ctx);
1300 0 : return NT_STATUS_NO_MEMORY;
1301 : }
1302 :
1303 878 : nt_status = gssapi_obtain_pac_blob(tmp_ctx, gse_ctx->gssapi_context,
1304 : gse_ctx->client_name,
1305 : &pac_blob);
1306 :
1307 : /* IF we have the PAC - otherwise we need to get this
1308 : * data from elsewhere
1309 : */
1310 878 : if (NT_STATUS_IS_OK(nt_status)) {
1311 870 : pac_blob_ptr = &pac_blob;
1312 : }
1313 878 : nt_status = gensec_generate_session_info_pac(tmp_ctx,
1314 : gensec_security,
1315 : NULL,
1316 : pac_blob_ptr, principal_string,
1317 : gensec_get_remote_address(gensec_security),
1318 : &session_info);
1319 878 : if (!NT_STATUS_IS_OK(nt_status)) {
1320 14 : talloc_free(tmp_ctx);
1321 14 : return nt_status;
1322 : }
1323 :
1324 864 : nt_status = gensec_gse_session_key(gensec_security, session_info,
1325 864 : &session_info->session_key);
1326 864 : if (!NT_STATUS_IS_OK(nt_status)) {
1327 0 : talloc_free(tmp_ctx);
1328 0 : return nt_status;
1329 : }
1330 :
1331 864 : *_session_info = talloc_move(mem_ctx, &session_info);
1332 864 : talloc_free(tmp_ctx);
1333 :
1334 864 : return NT_STATUS_OK;
1335 : }
1336 :
1337 306 : static size_t gensec_gse_max_input_size(struct gensec_security *gensec_security)
1338 : {
1339 0 : struct gse_context *gse_ctx =
1340 306 : talloc_get_type_abort(gensec_security->private_data,
1341 : struct gse_context);
1342 0 : OM_uint32 maj_stat, min_stat;
1343 0 : OM_uint32 max_input_size;
1344 :
1345 463 : maj_stat = gss_wrap_size_limit(&min_stat,
1346 157 : gse_ctx->gssapi_context,
1347 306 : gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
1348 : GSS_C_QOP_DEFAULT,
1349 306 : gse_ctx->max_wrap_buf_size,
1350 : &max_input_size);
1351 306 : if (GSS_ERROR(maj_stat)) {
1352 0 : TALLOC_CTX *mem_ctx = talloc_new(NULL);
1353 0 : DEBUG(1, ("gensec_gssapi_max_input_size: determining signature size with gss_wrap_size_limit failed: %s\n",
1354 : gse_errstr(mem_ctx, maj_stat, min_stat)));
1355 0 : talloc_free(mem_ctx);
1356 0 : return 0;
1357 : }
1358 :
1359 306 : return max_input_size;
1360 : }
1361 :
1362 : /* Find out the maximum output size negotiated on this connection */
1363 306 : static size_t gensec_gse_max_wrapped_size(struct gensec_security *gensec_security)
1364 : {
1365 0 : struct gse_context *gse_ctx =
1366 306 : talloc_get_type_abort(gensec_security->private_data,
1367 : struct gse_context);
1368 306 : return gse_ctx->max_wrap_buf_size;
1369 : }
1370 :
1371 186 : static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
1372 : size_t data_size)
1373 : {
1374 0 : struct gse_context *gse_ctx =
1375 186 : talloc_get_type_abort(gensec_security->private_data,
1376 : struct gse_context);
1377 :
1378 186 : if (gse_ctx->sig_size > 0) {
1379 82 : return gse_ctx->sig_size;
1380 : }
1381 :
1382 208 : gse_ctx->sig_size = gssapi_get_sig_size(gse_ctx->gssapi_context,
1383 104 : &gse_ctx->gss_mech,
1384 : gse_ctx->gss_got_flags,
1385 : data_size);
1386 104 : return gse_ctx->sig_size;
1387 : }
1388 :
1389 858 : static const char *gensec_gse_final_auth_type(struct gensec_security *gensec_security)
1390 : {
1391 0 : struct gse_context *gse_ctx =
1392 858 : talloc_get_type_abort(gensec_security->private_data,
1393 : struct gse_context);
1394 :
1395 : /* Only return the string for GSSAPI/Krb5 */
1396 858 : if (smb_gss_oid_equal(&gse_ctx->gss_mech,
1397 : gss_mech_krb5)) {
1398 858 : return GENSEC_FINAL_AUTH_TYPE_KRB5;
1399 : } else {
1400 0 : return "gensec_gse: UNKNOWN MECH";
1401 : }
1402 : }
1403 :
1404 : static const char *gensec_gse_krb5_oids[] = {
1405 : GENSEC_OID_KERBEROS5_OLD,
1406 : GENSEC_OID_KERBEROS5,
1407 : NULL
1408 : };
1409 :
1410 : const struct gensec_security_ops gensec_gse_krb5_security_ops = {
1411 : .name = "gse_krb5",
1412 : .auth_type = DCERPC_AUTH_TYPE_KRB5,
1413 : .oid = gensec_gse_krb5_oids,
1414 : .client_start = gensec_gse_client_start,
1415 : .server_start = gensec_gse_server_start,
1416 : .magic = gensec_magic_check_krb5_oid,
1417 : .update_send = gensec_gse_update_send,
1418 : .update_recv = gensec_gse_update_recv,
1419 : .session_key = gensec_gse_session_key,
1420 : .session_info = gensec_gse_session_info,
1421 : .sig_size = gensec_gse_sig_size,
1422 : .sign_packet = gensec_gse_sign_packet,
1423 : .check_packet = gensec_gse_check_packet,
1424 : .seal_packet = gensec_gse_seal_packet,
1425 : .unseal_packet = gensec_gse_unseal_packet,
1426 : .max_input_size = gensec_gse_max_input_size,
1427 : .max_wrapped_size = gensec_gse_max_wrapped_size,
1428 : .wrap = gensec_gse_wrap,
1429 : .unwrap = gensec_gse_unwrap,
1430 : .have_feature = gensec_gse_have_feature,
1431 : .expire_time = gensec_gse_expire_time,
1432 : .final_auth_type = gensec_gse_final_auth_type,
1433 : .enabled = true,
1434 : .kerberos = true,
1435 : .priority = GENSEC_GSSAPI
1436 : };
1437 :
1438 : #endif /* HAVE_KRB5 */
|
