-/*
+/*
Unix SMB/CIFS implementation.
dcerpc schannel operations
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "librpc/gen_ndr/ndr_schannel.h"
#include "auth/auth.h"
-#include "auth/gensec/schannel.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
+#include "../libcli/auth/schannel.h"
+#include "auth/gensec/schannel_state.h"
+#include "librpc/rpc/dcerpc.h"
+#include "param/param.h"
+#include "auth/session_proto.h"
static size_t schannel_sig_size(struct gensec_security *gensec_security, size_t data_size)
{
return 32;
}
-static NTSTATUS schannel_session_key(struct gensec_security *gensec_security,
+static NTSTATUS schannel_session_key(struct gensec_security *gensec_security,
DATA_BLOB *session_key)
{
return NT_STATUS_NOT_IMPLEMENTED;
}
-static NTSTATUS schannel_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
- const DATA_BLOB in, DATA_BLOB *out)
+static NTSTATUS schannel_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
+ const DATA_BLOB in, DATA_BLOB *out)
{
- struct schannel_state *state = gensec_security->private_data;
+ struct schannel_state *state = (struct schannel_state *)gensec_security->private_data;
NTSTATUS status;
- struct schannel_bind bind_schannel;
- struct schannel_bind_ack bind_schannel_ack;
- struct creds_CredentialState *creds;
-
+ enum ndr_err_code ndr_err;
+ struct NL_AUTH_MESSAGE bind_schannel;
+ struct NL_AUTH_MESSAGE bind_schannel_ack;
+ struct netlogon_creds_CredentialState *creds;
+ struct ldb_context *schannel_ldb;
const char *workstation;
const char *domain;
+ uint32_t required_flags;
+
*out = data_blob(NULL, 0);
switch (gensec_security->gensec_role) {
state->creds = talloc_reference(state, cli_credentials_get_netlogon_creds(gensec_security->credentials));
- bind_schannel.unknown1 = 0;
+ bind_schannel.MessageType = NL_NEGOTIATE_REQUEST;
#if 0
/* to support this we'd need to have access to the full domain name */
- bind_schannel.bind_type = 23;
- bind_schannel.u.info23.domain = cli_credentials_get_domain(gensec_security->credentials);
- bind_schannel.u.info23.workstation = cli_credentials_get_workstation(gensec_security->credentials);
- bind_schannel.u.info23.dnsdomain = cli_credentials_get_realm(gensec_security->credentials);
+ /* 0x17, 23 */
+ bind_schannel.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
+ NL_FLAG_OEM_NETBIOS_COMPUTER_NAME |
+ NL_FLAG_UTF8_DNS_DOMAIN_NAME |
+ NL_FLAG_UTF8_NETBIOS_COMPUTER_NAME;
+ bind_schannel.oem_netbios_domain.a = cli_credentials_get_domain(gensec_security->credentials);
+ bind_schannel.oem_netbios_computer.a = cli_credentials_get_workstation(gensec_security->credentials);
+ bind_schannel.utf8_dns_domain = cli_credentials_get_realm(gensec_security->credentials);
/* w2k3 refuses us if we use the full DNS workstation?
why? perhaps because we don't fill in the dNSHostName
attribute in the machine account? */
- bind_schannel.u.info23.dnsworkstation = cli_credentials_get_workstation(gensec_security->credentials);
+ bind_schannel.utf8_netbios_computer = cli_credentials_get_workstation(gensec_security->credentials);
#else
- bind_schannel.bind_type = 3;
- bind_schannel.u.info3.domain = cli_credentials_get_domain(gensec_security->credentials);
- bind_schannel.u.info3.workstation = cli_credentials_get_workstation(gensec_security->credentials);
+ bind_schannel.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
+ NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
+ bind_schannel.oem_netbios_domain.a = cli_credentials_get_domain(gensec_security->credentials);
+ bind_schannel.oem_netbios_computer.a = cli_credentials_get_workstation(gensec_security->credentials);
#endif
-
- status = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel,
- (ndr_push_flags_fn_t)ndr_push_schannel_bind);
- if (!NT_STATUS_IS_OK(status)) {
+
+ ndr_err = ndr_push_struct_blob(out, out_mem_ctx,
+ gensec_security->settings->iconv_convenience, &bind_schannel,
+ (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ status = ndr_map_error2ntstatus(ndr_err);
DEBUG(3, ("Could not create schannel bind: %s\n",
nt_errstr(status)));
return status;
}
-
+
state->state = SCHANNEL_STATE_UPDATE_1;
return NT_STATUS_MORE_PROCESSING_REQUIRED;
case GENSEC_SERVER:
-
+
+ required_flags = NL_FLAG_OEM_NETBIOS_COMPUTER_NAME |
+ NL_FLAG_OEM_NETBIOS_DOMAIN_NAME;
+
if (state->state != SCHANNEL_STATE_START) {
/* no third leg on this protocol */
return NT_STATUS_INVALID_PARAMETER;
}
-
+
/* parse the schannel startup blob */
- status = ndr_pull_struct_blob(&in, out_mem_ctx, &bind_schannel,
- (ndr_pull_flags_fn_t)ndr_pull_schannel_bind);
- if (!NT_STATUS_IS_OK(status)) {
+ ndr_err = ndr_pull_struct_blob(&in, out_mem_ctx,
+ gensec_security->settings->iconv_convenience,
+ &bind_schannel,
+ (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ status = ndr_map_error2ntstatus(ndr_err);
+ DEBUG(3, ("Could not parse incoming schannel bind: %s\n",
+ nt_errstr(status)));
return status;
}
-
- if (bind_schannel.bind_type == 23) {
- workstation = bind_schannel.u.info23.workstation;
- domain = bind_schannel.u.info23.domain;
- } else {
- workstation = bind_schannel.u.info3.workstation;
- domain = bind_schannel.u.info3.domain;
+
+ if (!(required_flags == (bind_schannel.Flags & required_flags))) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ workstation = bind_schannel.oem_netbios_computer.a;
+ domain = bind_schannel.oem_netbios_domain.a;
+
+ if (strcasecmp_m(domain, lp_workgroup(gensec_security->settings->lp_ctx)) != 0) {
+ DEBUG(3, ("Request for schannel to incorrect domain: %s != our domain %s\n",
+ domain, lp_workgroup(gensec_security->settings->lp_ctx)));
+
+ return NT_STATUS_LOGON_FAILURE;
+ }
+
+ schannel_ldb = schannel_db_connect(out_mem_ctx, gensec_security->event_ctx,
+ gensec_security->settings->lp_ctx);
+ if (!schannel_ldb) {
+ return NT_STATUS_ACCESS_DENIED;
}
-
/* pull the session key for this client */
- status = schannel_fetch_session_key(out_mem_ctx, workstation,
- domain, &creds);
+ status = schannel_fetch_session_key_ldb(schannel_ldb,
+ out_mem_ctx, workstation, &creds);
+ talloc_free(schannel_ldb);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(3, ("Could not find session key for attempted schannel connection from %s: %s\n",
workstation, nt_errstr(status)));
+ if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
+ return NT_STATUS_LOGON_FAILURE;
+ }
return status;
}
state->creds = talloc_reference(state, creds);
- bind_schannel_ack.unknown1 = 1;
- bind_schannel_ack.unknown2 = 0;
- bind_schannel_ack.unknown3 = 0x6c0000;
-
- status = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel_ack,
- (ndr_push_flags_fn_t)ndr_push_schannel_bind_ack);
- if (!NT_STATUS_IS_OK(status)) {
+ bind_schannel_ack.MessageType = NL_NEGOTIATE_RESPONSE;
+ bind_schannel_ack.Flags = 0;
+ bind_schannel_ack.Buffer.dummy = 0x6c0000; /* actually I think
+ * this does not have
+ * any meaning here
+ * - gd */
+
+ ndr_err = ndr_push_struct_blob(out, out_mem_ctx,
+ gensec_security->settings->iconv_convenience, &bind_schannel_ack,
+ (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ status = ndr_map_error2ntstatus(ndr_err);
DEBUG(3, ("Could not return schannel bind ack for client %s: %s\n",
workstation, nt_errstr(status)));
return status;
}
/**
- * Return the struct creds_CredentialState.
+ * Return the struct netlogon_creds_CredentialState.
*
* Make sure not to call this unless gensec is using schannel...
*/
-NTSTATUS dcerpc_schannel_creds(struct gensec_security *gensec_security,
- TALLOC_CTX *mem_ctx,
- struct creds_CredentialState **creds)
-{
- struct schannel_state *state = gensec_security->private_data;
+/* TODO: make this non-public */
+
+_PUBLIC_ NTSTATUS dcerpc_schannel_creds(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ struct netlogon_creds_CredentialState **creds)
+{
+ struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
*creds = talloc_reference(mem_ctx, state->creds);
if (!*creds) {
}
return NT_STATUS_OK;
}
-
-/**
+
+/**
* Returns anonymous credentials for schannel, matching Win2k3.
*
*/
static NTSTATUS schannel_session_info(struct gensec_security *gensec_security,
- struct auth_session_info **_session_info)
+ struct auth_session_info **_session_info)
{
- NTSTATUS nt_status;
- struct schannel_state *state = gensec_security->private_data;
- struct auth_serversupplied_info *server_info = NULL;
- struct auth_session_info *session_info = NULL;
- TALLOC_CTX *mem_ctx = talloc_new(state);
-
- nt_status = auth_anonymous_server_info(mem_ctx,
- &server_info);
- if (!NT_STATUS_IS_OK(nt_status)) {
- talloc_free(mem_ctx);
- return nt_status;
- }
-
- /* references the server_info into the session_info */
- nt_status = auth_generate_session_info(state, server_info, &session_info);
- talloc_free(mem_ctx);
-
- NT_STATUS_NOT_OK_RETURN(nt_status);
-
- *_session_info = session_info;
-
- return NT_STATUS_OK;
+ struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
+ return auth_anonymous_session_info(state, gensec_security->event_ctx, gensec_security->settings->lp_ctx, _session_info);
}
static NTSTATUS schannel_start(struct gensec_security *gensec_security)
return NT_STATUS_OK;
}
-static NTSTATUS schannel_server_start(struct gensec_security *gensec_security)
+static NTSTATUS schannel_server_start(struct gensec_security *gensec_security)
{
NTSTATUS status;
struct schannel_state *state;
return status;
}
- state = gensec_security->private_data;
- state->initiator = False;
-
+ state = (struct schannel_state *)gensec_security->private_data;
+ state->initiator = false;
+
return NT_STATUS_OK;
}
-static NTSTATUS schannel_client_start(struct gensec_security *gensec_security)
+static NTSTATUS schannel_client_start(struct gensec_security *gensec_security)
{
NTSTATUS status;
struct schannel_state *state;
return status;
}
- state = gensec_security->private_data;
- state->initiator = True;
-
+ state = (struct schannel_state *)gensec_security->private_data;
+ state->initiator = true;
+
return NT_STATUS_OK;
}
-static BOOL schannel_have_feature(struct gensec_security *gensec_security,
+static bool schannel_have_feature(struct gensec_security *gensec_security,
uint32_t feature)
{
- if (feature & (GENSEC_FEATURE_SIGN |
+ if (feature & (GENSEC_FEATURE_SIGN |
GENSEC_FEATURE_SEAL)) {
- return True;
+ return true;
}
if (feature & GENSEC_FEATURE_DCE_STYLE) {
- return True;
+ return true;
}
if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
- return True;
+ return true;
}
- return False;
+ return false;
+}
+
+static NTSTATUS schannel_seal_packet_wrap(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ uint8_t *data, size_t length,
+ const uint8_t *whole_pdu, size_t pdu_length,
+ DATA_BLOB *sig)
+{
+ struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
+
+ return schannel_seal_packet(state, mem_ctx, data, length, sig);
+}
+
+static NTSTATUS schannel_sign_packet_wrap(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ const uint8_t *data, size_t length,
+ const uint8_t *whole_pdu, size_t pdu_length,
+ DATA_BLOB *sig)
+{
+ struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
+
+ return schannel_sign_packet(state, mem_ctx, data, length, sig);
+}
+
+static NTSTATUS schannel_check_packet_wrap(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ const uint8_t *data, size_t length,
+ const uint8_t *whole_pdu, size_t pdu_length,
+ const DATA_BLOB *sig)
+{
+ struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
+
+ return schannel_check_packet(state, mem_ctx, data, length, sig);
}
+static NTSTATUS schannel_unseal_packet_wrap(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ uint8_t *data, size_t length,
+ const uint8_t *whole_pdu, size_t pdu_length,
+ const DATA_BLOB *sig)
+{
+ struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
+
+ return schannel_unseal_packet(state, mem_ctx, data, length, sig);
+}
static const struct gensec_security_ops gensec_schannel_security_ops = {
.name = "schannel",
.client_start = schannel_client_start,
.server_start = schannel_server_start,
.update = schannel_update,
- .seal_packet = schannel_seal_packet,
- .sign_packet = schannel_sign_packet,
- .check_packet = schannel_check_packet,
- .unseal_packet = schannel_unseal_packet,
+ .seal_packet = schannel_seal_packet_wrap,
+ .sign_packet = schannel_sign_packet_wrap,
+ .check_packet = schannel_check_packet_wrap,
+ .unseal_packet = schannel_unseal_packet_wrap,
.session_key = schannel_session_key,
.session_info = schannel_session_info,
.sig_size = schannel_sig_size,
.have_feature = schannel_have_feature,
- .enabled = True
+ .enabled = true,
+ .priority = GENSEC_SCHANNEL
};
-NTSTATUS gensec_schannel_init(void)
+_PUBLIC_ NTSTATUS gensec_schannel_init(void)
{
NTSTATUS ret;
ret = gensec_register(&gensec_schannel_security_ops);
git.samba.org / ira / wip.git / blobdiff