X-Git-Url: http://git.samba.org/samba.git/?a=blobdiff_plain;f=source4%2Frpc_server%2Fdcesrv_auth.c;h=0843a4376151d84433f615940aa509d31208e2d0;hb=37d53832a4623653f706e77985a79d84bd7c6694;hp=c8feec11bd18b89662a32bf236bad9d416f33d20;hpb=115945facab217f0744413c65ae485c07ffb52dc;p=kai%2Fsamba.git diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c index c8feec11bd1..0843a437615 100644 --- a/source4/rpc_server/dcesrv_auth.c +++ b/source4/rpc_server/dcesrv_auth.c @@ -8,7 +8,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or + the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, @@ -17,13 +17,15 @@ GNU General Public License for more details. You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + along with this program. If not, see . */ #include "includes.h" #include "rpc_server/dcerpc_server.h" #include "librpc/gen_ndr/ndr_dcerpc.h" +#include "auth/credentials/credentials.h" +#include "auth/gensec/gensec.h" +#include "param/param.h" /* parse any auth information from a dcerpc bind request @@ -32,6 +34,7 @@ */ BOOL dcesrv_auth_bind(struct dcesrv_call_state *call) { + struct cli_credentials *server_credentials; struct ncacn_packet *pkt = &call->pkt; struct dcesrv_connection *dce_conn = call->conn; struct dcesrv_auth *auth = &dce_conn->auth_state; @@ -55,12 +58,29 @@ BOOL dcesrv_auth_bind(struct dcesrv_call_state *call) return False; } - status = gensec_server_start(dce_conn, &auth->gensec_security, call->event_ctx); + status = gensec_server_start(dce_conn, call->event_ctx, call->msg_ctx, &auth->gensec_security); if (!NT_STATUS_IS_OK(status)) { DEBUG(1, ("Failed to start GENSEC for DCERPC server: %s\n", nt_errstr(status))); return False; } + server_credentials + = cli_credentials_init(call); + if (!server_credentials) { + DEBUG(1, ("Failed to init server credentials\n")); + return False; + } + + cli_credentials_set_conf(server_credentials, global_loadparm); + status = cli_credentials_set_machine_account(server_credentials); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(status))); + talloc_free(server_credentials); + server_credentials = NULL; + } + + gensec_set_credentials(auth->gensec_security, server_credentials); + status = gensec_start_mech_by_authtype(auth->gensec_security, auth->auth_info->auth_type, auth->auth_info->auth_level); @@ -79,13 +99,13 @@ BOOL dcesrv_auth_bind(struct dcesrv_call_state *call) add any auth information needed in a bind ack, and process the authentication information found in the bind. */ -BOOL dcesrv_auth_bind_ack(struct dcesrv_call_state *call, struct ncacn_packet *pkt) +NTSTATUS dcesrv_auth_bind_ack(struct dcesrv_call_state *call, struct ncacn_packet *pkt) { struct dcesrv_connection *dce_conn = call->conn; NTSTATUS status; if (!call->conn->auth_state.gensec_security) { - return True; + return NT_STATUS_OK; } status = gensec_update(dce_conn->auth_state.gensec_security, @@ -98,19 +118,19 @@ BOOL dcesrv_auth_bind_ack(struct dcesrv_call_state *call, struct ncacn_packet *p &dce_conn->auth_state.session_info); if (!NT_STATUS_IS_OK(status)) { DEBUG(1, ("Failed to establish session_info: %s\n", nt_errstr(status))); - return False; + return status; } /* Now that we are authenticated, go back to the generic session key... */ dce_conn->auth_state.session_key = dcesrv_generic_session_key; - return True; + return NT_STATUS_OK; } else if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { dce_conn->auth_state.auth_info->auth_pad_length = 0; dce_conn->auth_state.auth_info->auth_reserved = 0; - return True; + return NT_STATUS_OK; } else { DEBUG(2, ("Failed to start dcesrv auth negotiate: %s\n", nt_errstr(status))); - return False; + return status; } } @@ -204,19 +224,20 @@ BOOL dcesrv_auth_alter(struct dcesrv_call_state *call) add any auth information needed in a alter ack, and process the authentication information found in the alter. */ -BOOL dcesrv_auth_alter_ack(struct dcesrv_call_state *call, struct ncacn_packet *pkt) +NTSTATUS dcesrv_auth_alter_ack(struct dcesrv_call_state *call, struct ncacn_packet *pkt) { struct dcesrv_connection *dce_conn = call->conn; NTSTATUS status; /* on a pure interface change there is no auth_info structure setup */ - if (!call->conn->auth_state.auth_info) { - return True; + if (!call->conn->auth_state.auth_info || + dce_conn->auth_state.auth_info->credentials.length == 0) { + return NT_STATUS_OK; } if (!call->conn->auth_state.gensec_security) { - return False; + return NT_STATUS_INVALID_PARAMETER; } status = gensec_update(dce_conn->auth_state.gensec_security, @@ -229,20 +250,20 @@ BOOL dcesrv_auth_alter_ack(struct dcesrv_call_state *call, struct ncacn_packet * &dce_conn->auth_state.session_info); if (!NT_STATUS_IS_OK(status)) { DEBUG(1, ("Failed to establish session_info: %s\n", nt_errstr(status))); - return False; + return status; } /* Now that we are authenticated, got back to the generic session key... */ dce_conn->auth_state.session_key = dcesrv_generic_session_key; - return True; + return NT_STATUS_OK; } else if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { dce_conn->auth_state.auth_info->auth_pad_length = 0; dce_conn->auth_state.auth_info->auth_reserved = 0; - return True; - } else { - DEBUG(2, ("Failed to finish dcesrv auth alter_ack: %s\n", nt_errstr(status))); - return True; + return NT_STATUS_OK; } + + DEBUG(2, ("Failed to finish dcesrv auth alter_ack: %s\n", nt_errstr(status))); + return status; } /* @@ -373,6 +394,7 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call, NTSTATUS status; struct ndr_push *ndr; uint32_t payload_length; + DATA_BLOB creds2; /* non-signed packets are simple */ if (!dce_conn->auth_state.auth_info || !dce_conn->auth_state.gensec_security) { @@ -394,8 +416,8 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call, return False; } - /* pad to 8 byte multiple */ - dce_conn->auth_state.auth_info->auth_pad_length = NDR_ALIGN(ndr, 8); + /* pad to 16 byte multiple, match win2k3 */ + dce_conn->auth_state.auth_info->auth_pad_length = NDR_ALIGN(ndr, 16); ndr_push_zero(ndr, dce_conn->auth_state.auth_info->auth_pad_length); payload_length = ndr->offset - DCERPC_REQUEST_LENGTH; @@ -407,13 +429,20 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call, return False; } } else { + + /* We hope this length is accruate. If must be if the + * GENSEC mech does AEAD signing of the packet + * headers */ dce_conn->auth_state.auth_info->credentials = data_blob_talloc(call, NULL, - gensec_sig_size(dce_conn->auth_state.gensec_security)); + gensec_sig_size(dce_conn->auth_state.gensec_security, + payload_length)); + data_blob_clear(&dce_conn->auth_state.auth_info->credentials); } /* add the auth verifier */ - status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, dce_conn->auth_state.auth_info); + status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, + dce_conn->auth_state.auth_info); if (!NT_STATUS_IS_OK(status)) { return False; } @@ -425,6 +454,9 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call, in these earlier as we don't know the signature length (it could be variable length) */ dcerpc_set_frag_length(blob, blob->length); + + /* We hope this value is accruate. If must be if the GENSEC + * mech does AEAD signing of the packet headers */ dcerpc_set_auth_length(blob, dce_conn->auth_state.auth_info->credentials.length); /* sign or seal the packet */ @@ -436,7 +468,21 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call, payload_length, blob->data, blob->length - dce_conn->auth_state.auth_info->credentials.length, - &dce_conn->auth_state.auth_info->credentials); + &creds2); + + if (NT_STATUS_IS_OK(status)) { + blob->length -= dce_conn->auth_state.auth_info->credentials.length; + if (!data_blob_append(call, blob, creds2.data, creds2.length)) + status = NT_STATUS_NO_MEMORY; + else + status = NT_STATUS_OK; + } + + /* If we did AEAD signing of the packet headers, then we hope + * this value didn't change... */ + dcerpc_set_auth_length(blob, creds2.length); + dcerpc_set_frag_length(blob, dcerpc_get_frag_length(blob)+creds2.length); + data_blob_free(&creds2); break; case DCERPC_AUTH_LEVEL_INTEGRITY: @@ -446,8 +492,20 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call, payload_length, blob->data, blob->length - dce_conn->auth_state.auth_info->credentials.length, - &dce_conn->auth_state.auth_info->credentials); + &creds2); + if (NT_STATUS_IS_OK(status)) { + blob->length -= dce_conn->auth_state.auth_info->credentials.length; + if (!data_blob_append(call, blob, creds2.data, creds2.length)) + status = NT_STATUS_NO_MEMORY; + else + status = NT_STATUS_OK; + } + /* If we did AEAD signing of the packet headers, then we hope + * this value didn't change... */ + dcerpc_set_auth_length(blob, creds2.length); + dcerpc_set_frag_length(blob, dcerpc_get_frag_length(blob)+creds2.length); + data_blob_free(&creds2); break; case DCERPC_AUTH_LEVEL_CONNECT: @@ -458,14 +516,11 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call, break; } + data_blob_free(&dce_conn->auth_state.auth_info->credentials); + if (!NT_STATUS_IS_OK(status)) { return False; } - memcpy(blob->data + blob->length - dce_conn->auth_state.auth_info->credentials.length, - dce_conn->auth_state.auth_info->credentials.data, dce_conn->auth_state.auth_info->credentials.length); - - data_blob_free(&dce_conn->auth_state.auth_info->credentials); - return True; }