source3/librpc/crypto/gse.c

   1 /*
   2  *  GSSAPI Security Extensions
   3  *  RPC Pipe client and server routines
   4  *  Copyright (C) Simo Sorce 2010.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /* We support only GSSAPI/KRB5 here */
  21
  22 #include "includes.h"
  23 #include "gse.h"
  24
  25 #if defined(HAVE_KRB5) && defined(HAVE_GSS_WRAP_IOV)
  26
  27 #include "smb_krb5.h"
  28 #include "gse_krb5.h"
  29
  30 #include <gssapi/gssapi.h>
  31 #include <gssapi/gssapi_krb5.h>
  32 #ifdef HAVE_GSSAPI_GSSAPI_EXT_H
  33 #include <gssapi/gssapi_ext.h>
  34 #endif
  35
  36 #ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
  37 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11
  38 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05"
  39 #endif
  40
  41 gss_OID_desc gse_sesskey_inq_oid = {
  42         GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH,
  43         (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
  44 };
  45
  46 #ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID
  47 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10
  48 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID  "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04"
  49 #endif
  50
  51 gss_OID_desc gse_sesskeytype_oid = {
  52         GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH,
  53         (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID
  54 };
  55
  56 #define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12
  57 /*                                          EXTRACTION OID                                 AUTHZ ID */
  58 #define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01"
  59
  60 gss_OID_desc gse_authz_data_oid = {
  61         GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH,
  62         (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID
  63 };
  64
  65 #ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID
  66 #define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11
  67 #define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c"
  68 #endif
  69
  70 gss_OID_desc gse_authtime_oid = {
  71         GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH,
  72         (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID
  73 };
  74
  75 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
  76
  77 struct gse_context {
  78         krb5_context k5ctx;
  79         krb5_ccache ccache;
  80         krb5_keytab keytab;
  81
  82         gss_ctx_id_t gss_ctx;
  83
  84         gss_OID_desc gss_mech;
  85         OM_uint32 gss_c_flags;
  86         gss_cred_id_t creds;
  87         gss_name_t server_name;
  88
  89         gss_OID ret_mech;
  90         OM_uint32 ret_flags;
  91         gss_cred_id_t delegated_creds;
  92         gss_name_t client_name;
  93
  94         bool more_processing;
  95         bool authenticated;
  96 };
  97
  98 /* free non talloc dependent contexts */
  99 static int gse_context_destructor(void *ptr)
 100 {
 101         struct gse_context *gse_ctx;
 102         OM_uint32 gss_min, gss_maj;
 103
 104         gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
 105         if (gse_ctx->k5ctx) {
 106                 if (gse_ctx->ccache) {
 107                         krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
 108                         gse_ctx->ccache = NULL;
 109                 }
 110                 if (gse_ctx->keytab) {
 111                         krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
 112                         gse_ctx->keytab = NULL;
 113                 }
 114                 krb5_free_context(gse_ctx->k5ctx);
 115                 gse_ctx->k5ctx = NULL;
 116         }
 117         if (gse_ctx->gss_ctx != GSS_C_NO_CONTEXT) {
 118                 gss_maj = gss_delete_sec_context(&gss_min,
 119                                                  &gse_ctx->gss_ctx,
 120                                                  GSS_C_NO_BUFFER);
 121         }
 122         if (gse_ctx->server_name) {
 123                 gss_maj = gss_release_name(&gss_min,
 124                                            &gse_ctx->server_name);
 125         }
 126         if (gse_ctx->client_name) {
 127                 gss_maj = gss_release_name(&gss_min,
 128                                            &gse_ctx->client_name);
 129         }
 130         if (gse_ctx->creds) {
 131                 gss_maj = gss_release_cred(&gss_min,
 132                                            &gse_ctx->creds);
 133         }
 134         if (gse_ctx->delegated_creds) {
 135                 gss_maj = gss_release_cred(&gss_min,
 136                                            &gse_ctx->delegated_creds);
 137         }
 138         if (gse_ctx->ret_mech) {
 139                 gss_maj = gss_release_oid(&gss_min,
 140                                           &gse_ctx->ret_mech);
 141         }
 142         return 0;
 143 }
 144
 145 static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
 146                                  bool do_sign, bool do_seal,
 147                                  const char *ccache_name,
 148                                  uint32_t add_gss_c_flags,
 149                                  struct gse_context **_gse_ctx)
 150 {
 151         struct gse_context *gse_ctx;
 152         krb5_error_code k5ret;
 153         NTSTATUS status;
 154
 155         gse_ctx = talloc_zero(mem_ctx, struct gse_context);
 156         if (!gse_ctx) {
 157                 return NT_STATUS_NO_MEMORY;
 158         }
 159         talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
 160
 161         memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
 162
 163         gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG |
 164                                 GSS_C_DELEG_FLAG |
 165                                 GSS_C_DELEG_POLICY_FLAG |
 166                                 GSS_C_REPLAY_FLAG |
 167                                 GSS_C_SEQUENCE_FLAG;
 168         if (do_sign) {
 169                 gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG;
 170         }
 171         if (do_seal) {
 172                 gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG;
 173         }
 174
 175         gse_ctx->gss_c_flags |= add_gss_c_flags;
 176
 177         /* Initialize Kerberos Context */
 178         initialize_krb5_error_table();
 179
 180         k5ret = krb5_init_context(&gse_ctx->k5ctx);
 181         if (k5ret) {
 182                 DEBUG(0, ("Failed to initialize kerberos context! (%s)\n",
 183                           error_message(k5ret)));
 184                 status = NT_STATUS_INTERNAL_ERROR;
 185                 goto err_out;
 186         }
 187
 188         if (!ccache_name) {
 189                 ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
 190         }
 191         k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
 192                                 &gse_ctx->ccache);
 193         if (k5ret) {
 194                 DEBUG(1, ("Failed to resolve credential cache! (%s)\n",
 195                           error_message(k5ret)));
 196                 status = NT_STATUS_INTERNAL_ERROR;
 197                 goto err_out;
 198         }
 199
 200         /* TODO: Should we enforce a enc_types list ?
 201         ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
 202         */
 203
 204         *_gse_ctx = gse_ctx;
 205         return NT_STATUS_OK;
 206
 207 err_out:
 208         TALLOC_FREE(gse_ctx);
 209         return status;
 210 }
 211
 212 NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
 213                           bool do_sign, bool do_seal,
 214                           const char *ccache_name,
 215                           const char *server,
 216                           const char *service,
 217                           const char *username,
 218                           const char *password,
 219                           uint32_t add_gss_c_flags,
 220                           struct gse_context **_gse_ctx)
 221 {
 222         struct gse_context *gse_ctx;
 223         OM_uint32 gss_maj, gss_min;
 224         gss_buffer_desc name_buffer = {0, NULL};
 225         gss_OID_set_desc mech_set;
 226         NTSTATUS status;
 227
 228         if (!server || !service) {
 229                 return NT_STATUS_INVALID_PARAMETER;
 230         }
 231
 232         status = gse_context_init(mem_ctx, do_sign, do_seal,
 233                                   ccache_name, add_gss_c_flags,
 234                                   &gse_ctx);
 235         if (!NT_STATUS_IS_OK(status)) {
 236                 return NT_STATUS_NO_MEMORY;
 237         }
 238
 239         name_buffer.value = talloc_asprintf(gse_ctx,
 240                                             "%s@%s", service, server);
 241         if (!name_buffer.value) {
 242                 status = NT_STATUS_NO_MEMORY;
 243                 goto err_out;
 244         }
 245         name_buffer.length = strlen((char *)name_buffer.value);
 246         gss_maj = gss_import_name(&gss_min, &name_buffer,
 247                                   GSS_C_NT_HOSTBASED_SERVICE,
 248                                   &gse_ctx->server_name);
 249         if (gss_maj) {
 250                 DEBUG(0, ("gss_import_name failed for %s, with [%s]\n",
 251                           (char *)name_buffer.value,
 252                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 253                 status = NT_STATUS_INTERNAL_ERROR;
 254                 goto err_out;
 255         }
 256
 257         /* TODO: get krb5 ticket using username/password, if no valid
 258          * one already available in ccache */
 259
 260         mech_set.count = 1;
 261         mech_set.elements = &gse_ctx->gss_mech;
 262
 263         gss_maj = gss_acquire_cred(&gss_min,
 264                                    GSS_C_NO_NAME,
 265                                    GSS_C_INDEFINITE,
 266                                    &mech_set,
 267                                    GSS_C_INITIATE,
 268                                    &gse_ctx->creds,
 269                                    NULL, NULL);
 270         if (gss_maj) {
 271                 DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n",
 272                           (char *)name_buffer.value,
 273                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 274                 status = NT_STATUS_INTERNAL_ERROR;
 275                 goto err_out;
 276         }
 277
 278         *_gse_ctx = gse_ctx;
 279         TALLOC_FREE(name_buffer.value);
 280         return NT_STATUS_OK;
 281
 282 err_out:
 283         TALLOC_FREE(name_buffer.value);
 284         TALLOC_FREE(gse_ctx);
 285         return status;
 286 }
 287
 288 NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
 289                                    struct gse_context *gse_ctx,
 290                                    DATA_BLOB *token_in,
 291                                    DATA_BLOB *token_out)
 292 {
 293         OM_uint32 gss_maj, gss_min;
 294         gss_buffer_desc in_data;
 295         gss_buffer_desc out_data;
 296         DATA_BLOB blob = data_blob_null;
 297         NTSTATUS status;
 298
 299         in_data.value = token_in->data;
 300         in_data.length = token_in->length;
 301
 302         gss_maj = gss_init_sec_context(&gss_min,
 303                                         gse_ctx->creds,
 304                                         &gse_ctx->gss_ctx,
 305                                         gse_ctx->server_name,
 306                                         &gse_ctx->gss_mech,
 307                                         gse_ctx->gss_c_flags,
 308                                         0, GSS_C_NO_CHANNEL_BINDINGS,
 309                                         &in_data, NULL, &out_data,
 310                                         NULL, NULL);
 311         switch (gss_maj) {
 312         case GSS_S_COMPLETE:
 313                 /* we are done with it */
 314                 gse_ctx->more_processing = false;
 315                 status = NT_STATUS_OK;
 316                 break;
 317         case GSS_S_CONTINUE_NEEDED:
 318                 /* we will need a third leg */
 319                 gse_ctx->more_processing = true;
 320                 /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
 321                 status = NT_STATUS_OK;
 322                 break;
 323         default:
 324                 DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
 325                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 326                 status = NT_STATUS_INTERNAL_ERROR;
 327                 goto done;
 328         }
 329
 330         blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
 331         if (!blob.data) {
 332                 status = NT_STATUS_NO_MEMORY;
 333         }
 334
 335         gss_maj = gss_release_buffer(&gss_min, &out_data);
 336
 337 done:
 338         *token_out = blob;
 339         return status;
 340 }
 341
 342 NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
 343                          bool do_sign, bool do_seal,
 344                          uint32_t add_gss_c_flags,
 345                          struct gse_context **_gse_ctx)
 346 {
 347         struct gse_context *gse_ctx;
 348         OM_uint32 gss_maj, gss_min;
 349         krb5_error_code ret;
 350         NTSTATUS status;
 351         const char *ktname;
 352         gss_OID_set_desc mech_set;
 353
 354         status = gse_context_init(mem_ctx, do_sign, do_seal,
 355                                   NULL, add_gss_c_flags, &gse_ctx);
 356         if (!NT_STATUS_IS_OK(status)) {
 357                 return NT_STATUS_NO_MEMORY;
 358         }
 359
 360         ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
 361                                          &gse_ctx->keytab);
 362         if (ret) {
 363                 status = NT_STATUS_INTERNAL_ERROR;
 364                 goto done;
 365         }
 366
 367 #ifdef HAVE_GSS_KRB5_IMPORT_CRED
 368         /* This creates a GSSAPI cred_id_t with the principal and keytab set */
 369         gss_maj = gss_krb5_import_cred(&gss_min, NULL, NULL, gse_ctx->keytab,
 370                                         &gse_ctx->creds);
 371         if (gss_maj) {
 372                 DEBUG(0, ("gss_krb5_import_cred failed with [%s]\n",
 373                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 374                 status = NT_STATUS_INTERNAL_ERROR;
 375                 goto done;
 376         }
 377 #else
 378         /* FIXME!!!
 379          * This call sets the default keytab for the whole server, not
 380          * just for this context. Need to find a way that does not alter
 381          * the state of the whole server ... */
 382
 383         ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx,
 384                                    gse_ctx->keytab, &ktname);
 385         if (ret) {
 386                 status = NT_STATUS_INTERNAL_ERROR;
 387                 goto done;
 388         }
 389
 390         ret = gsskrb5_register_acceptor_identity(ktname);
 391         if (ret) {
 392                 status = NT_STATUS_INTERNAL_ERROR;
 393                 goto done;
 394         }
 395
 396         mech_set.count = 1;
 397         mech_set.elements = &gse_ctx->gss_mech;
 398
 399         gss_maj = gss_acquire_cred(&gss_min,
 400                                    GSS_C_NO_NAME,
 401                                    GSS_C_INDEFINITE,
 402                                    &mech_set,
 403                                    GSS_C_ACCEPT,
 404                                    &gse_ctx->creds,
 405                                    NULL, NULL);
 406
 407         if (gss_maj) {
 408                 DEBUG(0, ("gss_acquire_creds failed with [%s]\n",
 409                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 410                 status = NT_STATUS_INTERNAL_ERROR;
 411                 goto done;
 412         }
 413 #endif
 414         status = NT_STATUS_OK;
 415
 416 done:
 417         if (!NT_STATUS_IS_OK(status)) {
 418                 TALLOC_FREE(gse_ctx);
 419         }
 420
 421         *_gse_ctx = gse_ctx;
 422         return status;
 423 }
 424
 425 NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
 426                                    struct gse_context *gse_ctx,
 427                                    DATA_BLOB *token_in,
 428                                    DATA_BLOB *token_out)
 429 {
 430         OM_uint32 gss_maj, gss_min;
 431         gss_buffer_desc in_data;
 432         gss_buffer_desc out_data;
 433         DATA_BLOB blob = data_blob_null;
 434         NTSTATUS status;
 435
 436         in_data.value = token_in->data;
 437         in_data.length = token_in->length;
 438
 439         gss_maj = gss_accept_sec_context(&gss_min,
 440                                          &gse_ctx->gss_ctx,
 441                                          gse_ctx->creds,
 442                                          &in_data,
 443                                          GSS_C_NO_CHANNEL_BINDINGS,
 444                                          &gse_ctx->client_name,
 445                                          &gse_ctx->ret_mech,
 446                                          &out_data,
 447                                          &gse_ctx->ret_flags, NULL,
 448                                          &gse_ctx->delegated_creds);
 449         switch (gss_maj) {
 450         case GSS_S_COMPLETE:
 451                 /* we are done with it */
 452                 gse_ctx->more_processing = false;
 453                 gse_ctx->authenticated = true;
 454                 status = NT_STATUS_OK;
 455                 break;
 456         case GSS_S_CONTINUE_NEEDED:
 457                 /* we will need a third leg */
 458                 gse_ctx->more_processing = true;
 459                 /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
 460                 status = NT_STATUS_OK;
 461                 break;
 462         default:
 463                 DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
 464                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 465
 466                 if (gse_ctx->gss_ctx) {
 467                         gss_delete_sec_context(&gss_min,
 468                                                 &gse_ctx->gss_ctx,
 469                                                 GSS_C_NO_BUFFER);
 470                 }
 471
 472                 status = NT_STATUS_INTERNAL_ERROR;
 473                 goto done;
 474         }
 475
 476         /* we may be told to return nothing */
 477         if (out_data.length) {
 478                 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
 479                 if (!blob.data) {
 480                         status = NT_STATUS_NO_MEMORY;
 481                 }
 482                 gss_maj = gss_release_buffer(&gss_min, &out_data);
 483         }
 484
 485
 486 done:
 487         *token_out = blob;
 488         return status;
 489 }
 490
 491 NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
 492 {
 493         if (!gse_ctx->authenticated) {
 494                 return NT_STATUS_INVALID_HANDLE;
 495         }
 496
 497         if (memcmp(gse_ctx->ret_mech,
 498                    gss_mech_krb5, sizeof(gss_OID_desc)) != 0) {
 499                 return NT_STATUS_ACCESS_DENIED;
 500         }
 501
 502         /* GSS_C_MUTUAL_FLAG */
 503         if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) {
 504                 if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) {
 505                         return NT_STATUS_ACCESS_DENIED;
 506                 }
 507         }
 508
 509         /* GSS_C_DELEG_FLAG */
 510         /* GSS_C_DELEG_POLICY_FLAG */
 511         /* GSS_C_REPLAY_FLAG */
 512         /* GSS_C_SEQUENCE_FLAG */
 513
 514         /* GSS_C_INTEG_FLAG */
 515         if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) {
 516                 if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) {
 517                         return NT_STATUS_ACCESS_DENIED;
 518                 }
 519         }
 520
 521         /* GSS_C_CONF_FLAG */
 522         if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) {
 523                 if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) {
 524                         return NT_STATUS_ACCESS_DENIED;
 525                 }
 526         }
 527
 528         return NT_STATUS_OK;
 529 }
 530
 531 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
 532 {
 533         OM_uint32 gss_min, gss_maj;
 534         gss_buffer_desc msg_min;
 535         gss_buffer_desc msg_maj;
 536         OM_uint32 msg_ctx = 0;
 537
 538         char *errstr = NULL;
 539
 540         ZERO_STRUCT(msg_min);
 541         ZERO_STRUCT(msg_maj);
 542
 543         gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
 544                                      GSS_C_NO_OID, &msg_ctx, &msg_maj);
 545         if (gss_maj) {
 546                 goto done;
 547         }
 548         gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
 549                                      (gss_OID)discard_const(gss_mech_krb5),
 550                                      &msg_ctx, &msg_min);
 551         if (gss_maj) {
 552                 goto done;
 553         }
 554
 555         errstr = talloc_strndup(mem_ctx,
 556                                 (char *)msg_maj.value,
 557                                         msg_maj.length);
 558         if (!errstr) {
 559                 goto done;
 560         }
 561         errstr = talloc_strdup_append_buffer(errstr, ": ");
 562         if (!errstr) {
 563                 goto done;
 564         }
 565         errstr = talloc_strndup_append_buffer(errstr,
 566                                                 (char *)msg_min.value,
 567                                                         msg_min.length);
 568         if (!errstr) {
 569                 goto done;
 570         }
 571
 572 done:
 573         if (msg_min.value) {
 574                 gss_maj = gss_release_buffer(&gss_min, &msg_min);
 575         }
 576         if (msg_maj.value) {
 577                 gss_maj = gss_release_buffer(&gss_min, &msg_maj);
 578         }
 579         return errstr;
 580 }
 581
 582 bool gse_require_more_processing(struct gse_context *gse_ctx)
 583 {
 584         return gse_ctx->more_processing;
 585 }
 586
 587 DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
 588                                 struct gse_context *gse_ctx)
 589 {
 590         OM_uint32 gss_min, gss_maj;
 591         gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
 592         DATA_BLOB ret;
 593
 594         gss_maj = gss_inquire_sec_context_by_oid(
 595                                 &gss_min, gse_ctx->gss_ctx,
 596                                 &gse_sesskey_inq_oid, &set);
 597         if (gss_maj) {
 598                 DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
 599                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 600                 return data_blob_null;
 601         }
 602
 603         if ((set == GSS_C_NO_BUFFER_SET) ||
 604             (set->count != 2) ||
 605             (memcmp(set->elements[1].value,
 606                     gse_sesskeytype_oid.elements,
 607                     gse_sesskeytype_oid.length) != 0)) {
 608                 DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
 609                           "OID for data in results:\n"));
 610                 dump_data(1, (uint8_t *)set->elements[1].value,
 611                              set->elements[1].length);
 612                 return data_blob_null;
 613         }
 614
 615         ret = data_blob_talloc(mem_ctx, set->elements[0].value,
 616                                         set->elements[0].length);
 617
 618         gss_maj = gss_release_buffer_set(&gss_min, &set);
 619         return ret;
 620 }
 621
 622 NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
 623                              TALLOC_CTX *mem_ctx, char **cli_name)
 624 {
 625         OM_uint32 gss_min, gss_maj;
 626         gss_buffer_desc name_buffer;
 627
 628         if (!gse_ctx->authenticated) {
 629                 return NT_STATUS_ACCESS_DENIED;
 630         }
 631
 632         if (!gse_ctx->client_name) {
 633                 return NT_STATUS_NOT_FOUND;
 634         }
 635
 636         /* TODO: check OID matches KRB5 Principal Name OID ? */
 637
 638         gss_maj = gss_display_name(&gss_min,
 639                                    gse_ctx->client_name,
 640                                    &name_buffer, NULL);
 641         if (gss_maj) {
 642                 DEBUG(0, ("gss_display_name failed [%s]\n",
 643                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 644                 return NT_STATUS_INTERNAL_ERROR;
 645         }
 646
 647         *cli_name = talloc_strndup(talloc_tos(),
 648                                         (char *)name_buffer.value,
 649                                         name_buffer.length);
 650
 651         gss_maj = gss_release_buffer(&gss_min, &name_buffer);
 652
 653         if (!*cli_name) {
 654                 return NT_STATUS_NO_MEMORY;
 655         }
 656
 657         return NT_STATUS_OK;
 658 }
 659
 660 NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
 661                             TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
 662 {
 663         OM_uint32 gss_min, gss_maj;
 664         gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
 665
 666         if (!gse_ctx->authenticated) {
 667                 return NT_STATUS_ACCESS_DENIED;
 668         }
 669
 670         gss_maj = gss_inquire_sec_context_by_oid(
 671                                 &gss_min, gse_ctx->gss_ctx,
 672                                 &gse_authz_data_oid, &set);
 673         if (gss_maj) {
 674                 DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
 675                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 676                 return NT_STATUS_NOT_FOUND;
 677         }
 678
 679         if (set == GSS_C_NO_BUFFER_SET) {
 680                 DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
 681                           "data in results.\n"));
 682                 return NT_STATUS_INTERNAL_ERROR;
 683         }
 684
 685         /* for now we just hope it is the first value */
 686         *pac = data_blob_talloc(mem_ctx,
 687                                 set->elements[0].value,
 688                                 set->elements[0].length);
 689
 690         gss_maj = gss_release_buffer_set(&gss_min, &set);
 691
 692         return NT_STATUS_OK;
 693 }
 694
 695 NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime)
 696 {
 697         OM_uint32 gss_min, gss_maj;
 698         gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
 699         int32_t tkttime;
 700
 701         if (!gse_ctx->authenticated) {
 702                 return NT_STATUS_ACCESS_DENIED;
 703         }
 704
 705         gss_maj = gss_inquire_sec_context_by_oid(
 706                                 &gss_min, gse_ctx->gss_ctx,
 707                                 &gse_authtime_oid, &set);
 708         if (gss_maj) {
 709                 DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
 710                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 711                 return NT_STATUS_NOT_FOUND;
 712         }
 713
 714         if ((set == GSS_C_NO_BUFFER_SET) || (set->count != 1) != 0) {
 715                 DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
 716                           "data in results.\n"));
 717                 return NT_STATUS_INTERNAL_ERROR;
 718         }
 719
 720         if (set->elements[0].length != sizeof(int32_t)) {
 721                 DEBUG(0, ("Invalid authtime size!\n"));
 722                 return NT_STATUS_INTERNAL_ERROR;
 723         }
 724
 725         tkttime = *((int32_t *)set->elements[0].value);
 726
 727         gss_maj = gss_release_buffer_set(&gss_min, &set);
 728
 729         *authtime = (time_t)tkttime;
 730         return NT_STATUS_OK;
 731 }
 732
 733 size_t gse_get_signature_length(struct gse_context *gse_ctx,
 734                                 int seal, size_t payload_size)
 735 {
 736         OM_uint32 gss_min, gss_maj;
 737         gss_iov_buffer_desc iov[2];
 738         uint8_t fakebuf[payload_size];
 739         int sealed;
 740
 741         iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
 742         iov[0].buffer.value = NULL;
 743         iov[0].buffer.length = 0;
 744         iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
 745         iov[1].buffer.value = fakebuf;
 746         iov[1].buffer.length = payload_size;
 747
 748         gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gss_ctx,
 749                                         seal, GSS_C_QOP_DEFAULT,
 750                                         &sealed, iov, 2);
 751         if (gss_maj) {
 752                 DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n",
 753                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 754                 return 0;
 755         }
 756
 757         return iov[0].buffer.length;
 758 }
 759
 760 NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 761                   DATA_BLOB *data, DATA_BLOB *signature)
 762 {
 763         OM_uint32 gss_min, gss_maj;
 764         gss_iov_buffer_desc iov[2];
 765         int req_seal = 1; /* setting to 1 means we request sign+seal */
 766         int sealed;
 767         NTSTATUS status;
 768
 769         /* allocate the memory ourselves so we do not need to talloc_memdup */
 770         signature->length = gse_get_signature_length(gse_ctx, 1, data->length);
 771         if (!signature->length) {
 772                 return NT_STATUS_INTERNAL_ERROR;
 773         }
 774         signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length);
 775         if (!signature->data) {
 776                 return NT_STATUS_NO_MEMORY;
 777         }
 778         iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
 779         iov[0].buffer.value = signature->data;
 780         iov[0].buffer.length = signature->length;
 781
 782         /* data is encrypted in place, which is ok */
 783         iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
 784         iov[1].buffer.value = data->data;
 785         iov[1].buffer.length = data->length;
 786
 787         gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gss_ctx,
 788                                 req_seal, GSS_C_QOP_DEFAULT,
 789                                 &sealed, iov, 2);
 790         if (gss_maj) {
 791                 DEBUG(0, ("gss_wrap_iov failed with [%s]\n",
 792                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 793                 status = NT_STATUS_ACCESS_DENIED;
 794                 goto done;
 795         }
 796
 797         if (!sealed) {
 798                 DEBUG(0, ("gss_wrap_iov says data was not sealed!\n"));
 799                 status = NT_STATUS_ACCESS_DENIED;
 800                 goto done;
 801         }
 802
 803         status = NT_STATUS_OK;
 804
 805         DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n",
 806                    (int)iov[1].buffer.length, (int)iov[0].buffer.length));
 807
 808 done:
 809         return status;
 810 }
 811
 812 NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 813                     DATA_BLOB *data, DATA_BLOB *signature)
 814 {
 815         OM_uint32 gss_min, gss_maj;
 816         gss_iov_buffer_desc iov[2];
 817         int sealed;
 818         NTSTATUS status;
 819
 820         iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
 821         iov[0].buffer.value = signature->data;
 822         iov[0].buffer.length = signature->length;
 823
 824         /* data is decrypted in place, which is ok */
 825         iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
 826         iov[1].buffer.value = data->data;
 827         iov[1].buffer.length = data->length;
 828
 829         gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gss_ctx,
 830                                  &sealed, NULL, iov, 2);
 831         if (gss_maj) {
 832                 DEBUG(0, ("gss_unwrap_iov failed with [%s]\n",
 833                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 834                 status = NT_STATUS_ACCESS_DENIED;
 835                 goto done;
 836         }
 837
 838         if (!sealed) {
 839                 DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n"));
 840                 status = NT_STATUS_ACCESS_DENIED;
 841                 goto done;
 842         }
 843
 844         status = NT_STATUS_OK;
 845
 846         DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n",
 847                    (int)iov[1].buffer.length, (int)iov[0].buffer.length));
 848
 849 done:
 850         return status;
 851 }
 852
 853 NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 854                   DATA_BLOB *data, DATA_BLOB *signature)
 855 {
 856         OM_uint32 gss_min, gss_maj;
 857         gss_buffer_desc in_data = { 0, NULL };
 858         gss_buffer_desc out_data = { 0, NULL};
 859         NTSTATUS status;
 860
 861         in_data.value = data->data;
 862         in_data.length = data->length;
 863
 864         gss_maj = gss_get_mic(&gss_min, gse_ctx->gss_ctx,
 865                               GSS_C_QOP_DEFAULT,
 866                               &in_data, &out_data);
 867         if (gss_maj) {
 868                 DEBUG(0, ("gss_get_mic failed with [%s]\n",
 869                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 870                 status = NT_STATUS_ACCESS_DENIED;
 871                 goto done;
 872         }
 873
 874         *signature = data_blob_talloc(mem_ctx,
 875                                         out_data.value, out_data.length);
 876         if (!signature->data) {
 877                 status = NT_STATUS_NO_MEMORY;
 878                 goto done;
 879         }
 880
 881         status = NT_STATUS_OK;
 882
 883 done:
 884         if (out_data.value) {
 885                 gss_maj = gss_release_buffer(&gss_min, &out_data);
 886         }
 887         return status;
 888 }
 889
 890 NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 891                       DATA_BLOB *data, DATA_BLOB *signature)
 892 {
 893         OM_uint32 gss_min, gss_maj;
 894         gss_buffer_desc in_data = { 0, NULL };
 895         gss_buffer_desc in_token = { 0, NULL};
 896         NTSTATUS status;
 897
 898         in_data.value = data->data;
 899         in_data.length = data->length;
 900         in_token.value = signature->data;
 901         in_token.length = signature->length;
 902
 903         gss_maj = gss_verify_mic(&gss_min, gse_ctx->gss_ctx,
 904                                  &in_data, &in_token, NULL);
 905         if (gss_maj) {
 906                 DEBUG(0, ("gss_verify_mic failed with [%s]\n",
 907                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 908                 status = NT_STATUS_ACCESS_DENIED;
 909                 goto done;
 910         }
 911
 912         status = NT_STATUS_OK;
 913
 914 done:
 915         return status;
 916 }
 917
 918 #else
 919
 920 NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
 921                           bool do_sign, bool do_seal,
 922                           const char *ccache_name,
 923                           const char *server,
 924                           const char *service,
 925                           const char *username,
 926                           const char *password,
 927                           uint32_t add_gss_c_flags,
 928                           struct gse_context **_gse_ctx)
 929 {
 930         return NT_STATUS_NOT_IMPLEMENTED;
 931 }
 932
 933 NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
 934                                    struct gse_context *gse_ctx,
 935                                    DATA_BLOB *token_in,
 936                                    DATA_BLOB *token_out)
 937 {
 938         return NT_STATUS_NOT_IMPLEMENTED;
 939 }
 940
 941 NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
 942                          bool do_sign, bool do_seal,
 943                          uint32_t add_gss_c_flags,
 944                          struct gse_context **_gse_ctx)
 945 {
 946         return NT_STATUS_NOT_IMPLEMENTED;
 947 }
 948
 949 NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
 950                                    struct gse_context *gse_ctx,
 951                                    DATA_BLOB *token_in,
 952                                    DATA_BLOB *token_out)
 953 {
 954         return NT_STATUS_NOT_IMPLEMENTED;
 955 }
 956
 957 NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
 958 {
 959         return NT_STATUS_NOT_IMPLEMENTED;
 960 }
 961
 962 bool gse_require_more_processing(struct gse_context *gse_ctx)
 963 {
 964         return false;
 965 }
 966
 967 DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
 968                               struct gse_context *gse_ctx)
 969 {
 970         return data_blob_null;
 971 }
 972
 973 NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
 974                              TALLOC_CTX *mem_ctx, char **cli_name)
 975 {
 976         return NT_STATUS_NOT_IMPLEMENTED;
 977 }
 978
 979 NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
 980                             TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
 981 {
 982         return NT_STATUS_NOT_IMPLEMENTED;
 983 }
 984
 985 NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime)
 986 {
 987         return NT_STATUS_NOT_IMPLEMENTED;
 988 }
 989
 990 size_t gse_get_signature_length(struct gse_context *gse_ctx,
 991                                 int seal, size_t payload_size)
 992 {
 993         return 0;
 994 }
 995
 996 NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 997                   DATA_BLOB *data, DATA_BLOB *signature)
 998 {
 999         return NT_STATUS_NOT_IMPLEMENTED;
1000 }
1001
1002 NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
1003                     DATA_BLOB *data, DATA_BLOB *signature)
1004 {
1005         return NT_STATUS_NOT_IMPLEMENTED;
1006 }
1007
1008 NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
1009                   DATA_BLOB *data, DATA_BLOB *signature)
1010 {
1011         return NT_STATUS_NOT_IMPLEMENTED;
1012 }
1013
1014 NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
1015                       DATA_BLOB *data, DATA_BLOB *signature)
1016 {
1017         return NT_STATUS_NOT_IMPLEMENTED;
1018 }
1019
1020 #endif /* HAVE_KRB5 && HAVE_GSSAPI_EXT_H && HAVE_GSS_WRAP_IOV */