2 Unix SMB/CIFS implementation.
4 dcerpc schannel operations
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 wrappers for the schannel_*() functions
28 static NTSTATUS schan_unseal_packet(struct dcerpc_security *dcerpc_security,
30 uint8_t *data, size_t length, DATA_BLOB *sig)
32 struct schannel_state *schannel_state = dcerpc_security->private;
33 return schannel_unseal_packet(schannel_state, mem_ctx, data, length, sig);
36 static NTSTATUS schan_check_packet(struct dcerpc_security *dcerpc_security,
38 const uint8_t *data, size_t length,
41 struct schannel_state *schannel_state = dcerpc_security->private;
42 return schannel_check_packet(schannel_state, data, length, sig);
45 static NTSTATUS schan_seal_packet(struct dcerpc_security *dcerpc_security,
47 uint8_t *data, size_t length,
50 struct schannel_state *schannel_state = dcerpc_security->private;
51 return schannel_seal_packet(schannel_state, mem_ctx, data, length, sig);
54 static NTSTATUS schan_sign_packet(struct dcerpc_security *dcerpc_security,
56 const uint8_t *data, size_t length,
59 struct schannel_state *schannel_state = dcerpc_security->private;
60 return schannel_sign_packet(schannel_state, mem_ctx, data, length, sig);
63 static NTSTATUS schan_session_key(struct dcerpc_security *dcerpc_security,
64 DATA_BLOB *session_key)
66 return NT_STATUS_NOT_IMPLEMENTED;
69 static void schan_security_end(struct dcerpc_security *dcerpc_security)
71 struct schannel_state *schannel_state = dcerpc_security->private;
72 schannel_end(&schannel_state);
77 get a schannel key using a netlogon challenge on a secondary pipe
79 NTSTATUS dcerpc_schannel_key(struct dcerpc_pipe *p,
84 uint8_t new_session_key[16])
87 struct dcerpc_pipe *p2;
88 struct netr_ServerReqChallenge r;
89 struct netr_ServerAuthenticate2 a;
90 struct netr_Credential credentials1, credentials2, credentials3;
91 struct samr_Password mach_pwd;
92 struct creds_CredentialState creds;
93 const char *workgroup, *workstation;
94 uint32_t negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
96 workstation = username;
100 step 1 - establish a netlogon connection, with no authentication
102 status = dcerpc_secondary_connection(p, &p2,
103 DCERPC_NETLOGON_NAME,
104 DCERPC_NETLOGON_UUID,
105 DCERPC_NETLOGON_VERSION);
109 step 2 - request a netlogon challenge
111 r.in.server_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dcerpc_server_name(p));
112 r.in.computer_name = workstation;
113 r.in.credentials = &credentials1;
114 r.out.credentials = &credentials2;
116 generate_random_buffer(credentials1.data, sizeof(credentials1.data), False);
118 status = dcerpc_netr_ServerReqChallenge(p2, p->mem_ctx, &r);
119 if (!NT_STATUS_IS_OK(status)) {
124 step 3 - authenticate on the netlogon pipe
126 E_md4hash(password, mach_pwd.hash);
127 creds_client_init(&creds, &credentials1, &credentials2, &mach_pwd, &credentials3,
130 a.in.server_name = r.in.server_name;
131 a.in.account_name = talloc_asprintf(p->mem_ctx, "%s$", workstation);
132 a.in.secure_channel_type = chan_type;
133 a.in.computer_name = workstation;
134 a.in.negotiate_flags = &negotiate_flags;
135 a.out.negotiate_flags = &negotiate_flags;
136 a.in.credentials = &credentials3;
137 a.out.credentials = &credentials3;
139 status = dcerpc_netr_ServerAuthenticate2(p2, p->mem_ctx, &a);
140 if (!NT_STATUS_IS_OK(status)) {
144 if (!creds_client_check(&creds, a.out.credentials)) {
145 return NT_STATUS_UNSUCCESSFUL;
149 the schannel session key is now in creds.session_key
151 we no longer need the netlogon pipe open
153 dcerpc_pipe_close(p2);
155 memcpy(new_session_key, creds.session_key, 16);
162 do a schannel style bind on a dcerpc pipe with the given schannel
163 key. The username is usually of the form HOSTNAME$ and the password
164 is the domain trust password
166 NTSTATUS dcerpc_bind_auth_schannel_key(struct dcerpc_pipe *p,
167 const char *uuid, uint_t version,
169 const char *username,
170 const uint8_t session_key[16])
173 struct schannel_state *schannel_state;
174 const char *workgroup, *workstation;
175 struct dcerpc_bind_schannel bind_schannel;
177 workstation = username;
181 perform a bind with security type schannel
183 p->auth_info = talloc(p->mem_ctx, sizeof(*p->auth_info));
185 status = NT_STATUS_NO_MEMORY;
189 p->auth_info->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
191 if (p->flags & DCERPC_SEAL) {
192 p->auth_info->auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
194 /* note that DCERPC_AUTH_LEVEL_NONE does not make any
195 sense, and would be rejected by the server */
196 p->auth_info->auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
198 p->auth_info->auth_pad_length = 0;
199 p->auth_info->auth_reserved = 0;
200 p->auth_info->auth_context_id = random();
201 p->security_state = NULL;
203 /* TODO: what are these?? */
204 bind_schannel.unknown1 = 0;
205 bind_schannel.unknown2 = 3;
206 bind_schannel.domain = workgroup;
207 bind_schannel.hostname = workstation;
209 status = ndr_push_struct_blob(&p->auth_info->credentials, p->mem_ctx, &bind_schannel,
210 (ndr_push_flags_fn_t)ndr_push_dcerpc_bind_schannel);
211 if (!NT_STATUS_IS_OK(status)) {
215 /* send the authenticated bind request */
216 status = dcerpc_bind_byuuid(p, p->mem_ctx, uuid, version);
217 if (!NT_STATUS_IS_OK(status)) {
221 p->security_state = talloc_p(p->mem_ctx, struct dcerpc_security);
222 if (!p->security_state) {
223 status = NT_STATUS_NO_MEMORY;
227 schannel_state = talloc_p(p->mem_ctx, struct schannel_state);
228 if (!schannel_state) {
229 status = NT_STATUS_NO_MEMORY;
233 status = schannel_start(&schannel_state, session_key, True);
234 if (!NT_STATUS_IS_OK(status)) {
238 dump_data_pw("session key:\n", schannel_state->session_key, 16);
240 p->security_state->private = schannel_state;
241 p->security_state->unseal_packet = schan_unseal_packet;
242 p->security_state->check_packet = schan_check_packet;
243 p->security_state->seal_packet = schan_seal_packet;
244 p->security_state->sign_packet = schan_sign_packet;
245 p->security_state->session_key = schan_session_key;
246 p->security_state->security_end = schan_security_end;
254 do a schannel style bind on a dcerpc pipe. The username is usually
255 of the form HOSTNAME$ and the password is the domain trust password
257 NTSTATUS dcerpc_bind_auth_schannel(struct dcerpc_pipe *p,
258 const char *uuid, uint_t version,
260 const char *username,
261 const char *password)
264 uint8_t session_key[16];
267 if (p->flags & DCERPC_SCHANNEL_BDC) {
268 chan_type = SEC_CHAN_BDC;
269 } else if (p->flags & DCERPC_SCHANNEL_WORKSTATION) {
270 chan_type = SEC_CHAN_WKSTA;
271 } else if (p->flags & DCERPC_SCHANNEL_DOMAIN) {
272 chan_type = SEC_CHAN_DOMAIN;
275 status = dcerpc_schannel_key(p, domain, username, password,
276 chan_type, session_key);
277 if (!NT_STATUS_IS_OK(status)) {
281 status = dcerpc_bind_auth_schannel_key(p, uuid, version, domain, username, session_key);