2 Unix SMB/CIFS implementation.
4 dcerpc schannel operations
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 wrappers for the schannel_*() functions
28 static NTSTATUS schan_unseal_packet(struct dcerpc_security *dcerpc_security,
29 uchar *data, size_t length, DATA_BLOB *sig)
31 struct schannel_state *schannel_state = dcerpc_security->private;
32 return schannel_unseal_packet(schannel_state, data, length, sig);
35 static NTSTATUS schan_check_packet(struct dcerpc_security *dcerpc_security,
36 const uchar *data, size_t length,
39 struct schannel_state *schannel_state = dcerpc_security->private;
40 return schannel_check_packet(schannel_state, data, length, sig);
43 static NTSTATUS schan_seal_packet(struct dcerpc_security *dcerpc_security,
44 uchar *data, size_t length,
47 struct schannel_state *schannel_state = dcerpc_security->private;
48 return schannel_seal_packet(schannel_state, data, length, sig);
51 static NTSTATUS schan_sign_packet(struct dcerpc_security *dcerpc_security,
52 const uchar *data, size_t length,
55 struct schannel_state *schannel_state = dcerpc_security->private;
56 return schannel_sign_packet(schannel_state, data, length, sig);
59 static void schan_security_end(struct dcerpc_security *dcerpc_security)
61 struct schannel_state *schannel_state = dcerpc_security->private;
62 return schannel_end(&schannel_state);
67 do a schannel style bind on a dcerpc pipe. The username is usually
68 of the form HOSTNAME$ and the password is the domain trust password
70 NTSTATUS dcerpc_bind_auth_schannel(struct dcerpc_pipe *p,
71 const char *uuid, unsigned version,
77 struct dcerpc_pipe *p2;
78 struct netr_ServerReqChallenge r;
79 struct netr_ServerAuthenticate2 a;
81 uint8 session_key[16];
82 struct netr_CredentialState creds;
83 struct schannel_state *schannel_state;
84 const char *workgroup, *workstation;
85 uint32 negotiate_flags = 0;
87 workstation = username;
91 step 1 - establish a netlogon connection, with no authentication
93 status = dcerpc_secondary_smb(p, &p2,
96 DCERPC_NETLOGON_VERSION);
100 step 2 - request a netlogon challenge
102 r.in.server_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dcerpc_server_name(p));
103 r.in.computer_name = workstation;
104 generate_random_buffer(r.in.credentials.data, sizeof(r.in.credentials.data), False);
106 status = dcerpc_netr_ServerReqChallenge(p2, p->mem_ctx, &r);
107 if (!NT_STATUS_IS_OK(status)) {
112 step 3 - authenticate on the netlogon pipe
114 E_md4hash(password, mach_pwd);
115 creds_client_init(&creds, &r.in.credentials, &r.out.credentials, mach_pwd,
118 a.in.server_name = r.in.server_name;
119 a.in.username = talloc_asprintf(p->mem_ctx, "%s$", workstation);
120 if (lp_server_role() == ROLE_DOMAIN_BDC) {
121 a.in.secure_channel_type = SEC_CHAN_BDC;
123 a.in.secure_channel_type = SEC_CHAN_WKSTA;
125 a.in.computer_name = workstation;
126 a.in.negotiate_flags = &negotiate_flags;
127 a.out.negotiate_flags = &negotiate_flags;
129 status = dcerpc_netr_ServerAuthenticate2(p2, p->mem_ctx, &a);
130 if (!NT_STATUS_IS_OK(status)) {
133 if (!creds_client_check(&creds, &a.out.credentials)) {
134 return NT_STATUS_UNSUCCESSFUL;
138 the schannel session key is now in creds.session_key
143 step 4 - perform a bind with security type schannel
145 p->auth_info = talloc(p->mem_ctx, sizeof(*p->auth_info));
147 status = NT_STATUS_NO_MEMORY;
151 p->auth_info->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
153 if (p->flags & DCERPC_SEAL) {
154 p->auth_info->auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
156 /* note that DCERPC_AUTH_LEVEL_NONE does not make any
157 sense, and would be rejected by the server */
158 p->auth_info->auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
160 p->auth_info->auth_pad_length = 0;
161 p->auth_info->auth_reserved = 0;
162 p->auth_info->auth_context_id = random();
163 p->security_state = NULL;
165 p->auth_info->credentials = data_blob_talloc(p->mem_ctx,
168 strlen(workgroup)+1 +
169 strlen(workstation)+1);
170 if (!p->auth_info->credentials.data) {
171 return NT_STATUS_NO_MEMORY;
174 /* oh, this is ugly! */
175 SIVAL(p->auth_info->credentials.data, 0, 0);
176 SIVAL(p->auth_info->credentials.data, 4, 3);
177 memcpy(p->auth_info->credentials.data+8, workgroup, strlen(workgroup)+1);
178 memcpy(p->auth_info->credentials.data+8+strlen(workgroup)+1,
179 workstation, strlen(workstation)+1);
181 /* send the authenticated bind request */
182 status = dcerpc_bind_byuuid(p, p->mem_ctx, uuid, version);
183 if (!NT_STATUS_IS_OK(status)) {
187 p->security_state = talloc_p(p->mem_ctx, struct dcerpc_security);
188 if (!p->security_state) {
189 status = NT_STATUS_NO_MEMORY;
193 schannel_state = talloc_p(p->mem_ctx, struct schannel_state);
194 if (!schannel_state) {
195 status = NT_STATUS_NO_MEMORY;
199 memcpy(session_key, creds.session_key, 8);
200 memset(session_key+8, 0, 8);
202 status = schannel_start(&schannel_state, session_key, True);
203 if (!NT_STATUS_IS_OK(status)) {
207 dump_data_pw("session key:\n", schannel_state->session_key, 16);
209 p->security_state->private = schannel_state;
210 p->security_state->unseal_packet = schan_unseal_packet;
211 p->security_state->check_packet = schan_check_packet;
212 p->security_state->seal_packet = schan_seal_packet;
213 p->security_state->sign_packet = schan_sign_packet;
214 p->security_state->security_end = schan_security_end;