r4627: - simplified the dcerpc auth code using a common function
[samba.git] / source4 / librpc / rpc / dcerpc_auth.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    Generic Authentication Interface
5
6    Copyright (C) Andrew Tridgell 2003
7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
8
9    
10    This program is free software; you can redistribute it and/or modify
11    it under the terms of the GNU General Public License as published by
12    the Free Software Foundation; either version 2 of the License, or
13    (at your option) any later version.
14    
15    This program is distributed in the hope that it will be useful,
16    but WITHOUT ANY WARRANTY; without even the implied warranty of
17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18    GNU General Public License for more details.
19    
20    You should have received a copy of the GNU General Public License
21    along with this program; if not, write to the Free Software
22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 */
24
25 #include "includes.h"
26
27 /*
28   do a non-athenticated dcerpc bind
29 */
30 NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p,
31                                const char *uuid, uint_t version)
32 {
33         TALLOC_CTX *tmp_ctx = talloc_new(p);
34         NTSTATUS status;
35
36         status = dcerpc_bind_byuuid(p, tmp_ctx, uuid, version);
37         talloc_free(tmp_ctx);
38
39         return status;
40 }
41
42 /*
43   perform a multi-part authenticated bind
44 */
45 NTSTATUS dcerpc_bind_auth(struct dcerpc_pipe *p, uint8_t auth_type, uint8_t auth_level,
46                            const char *uuid, uint_t version)
47 {
48         NTSTATUS status;
49         TALLOC_CTX *tmp_ctx = talloc_new(p);
50         DATA_BLOB credentials;
51         DATA_BLOB null_data_blob = data_blob(NULL, 0);
52
53         if (!p->conn->security_state.generic_state) {
54                 status = gensec_client_start(p, &p->conn->security_state.generic_state);
55                 if (!NT_STATUS_IS_OK(status)) goto done;
56
57                 status = gensec_start_mech_by_authtype(p->conn->security_state.generic_state, 
58                                                        auth_type, auth_level);
59                 if (!NT_STATUS_IS_OK(status)) goto done;
60         }
61
62         p->conn->security_state.auth_info = talloc(p, struct dcerpc_auth);
63         if (!p->conn->security_state.auth_info) {
64                 status = NT_STATUS_NO_MEMORY;
65                 goto done;
66         }
67
68         p->conn->security_state.auth_info->auth_type = auth_type;
69         p->conn->security_state.auth_info->auth_level = auth_level;
70         p->conn->security_state.auth_info->auth_pad_length = 0;
71         p->conn->security_state.auth_info->auth_reserved = 0;
72         p->conn->security_state.auth_info->auth_context_id = random();
73         p->conn->security_state.auth_info->credentials = null_data_blob;
74
75         status = gensec_update(p->conn->security_state.generic_state, tmp_ctx,
76                                null_data_blob,
77                                &credentials);
78         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
79                 goto done;
80         }
81
82         p->conn->security_state.auth_info->credentials = credentials;
83
84         status = dcerpc_bind_byuuid(p, tmp_ctx, uuid, version);
85         if (!NT_STATUS_IS_OK(status)) {
86                 goto done;
87         }
88
89         status = gensec_update(p->conn->security_state.generic_state, tmp_ctx,
90                                p->conn->security_state.auth_info->credentials,
91                                &credentials);
92         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
93                 goto done;
94         }
95
96         do {
97                 p->conn->security_state.auth_info->credentials = credentials;
98
99                 if (auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
100                         status = dcerpc_alter_context(p, tmp_ctx, &p->syntax, &p->transfer_syntax);
101                         if (NT_STATUS_IS_OK(status)) {
102                                 status = gensec_update(p->conn->security_state.generic_state, tmp_ctx,
103                                                        p->conn->security_state.auth_info->credentials,
104                                                        &credentials);
105                         }
106                 } else {
107                         status = dcerpc_auth3(p->conn, tmp_ctx);
108                 }
109         } while (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED));
110
111 done:
112         talloc_free(tmp_ctx);
113
114         if (!NT_STATUS_IS_OK(status)) {
115                 talloc_free(p->conn->security_state.generic_state);
116                 ZERO_STRUCT(p->conn->security_state);
117         } else {
118                 /* Authenticated connections use the generic session key */
119                 p->conn->security_state.session_key = dcerpc_generic_session_key;
120         }
121
122         return status;
123 }
124