Introduce system MIT krb5 build with --with-system-mitkrb5 option.
[kai/samba.git] / lib / addns / dnsgss.c
1 /*
2   Public Interface file for Linux DNS client library implementation
3
4   Copyright (C) 2006 Krishna Ganugapati <krishnag@centeris.com>
5   Copyright (C) 2006 Gerald Carter <jerry@samba.org>
6
7      ** NOTE! The following LGPL license applies to the libaddns
8      ** library. This does NOT imply that all of Samba is released
9      ** under the LGPL
10
11   This library is free software; you can redistribute it and/or
12   modify it under the terms of the GNU Lesser General Public
13   License as published by the Free Software Foundation; either
14   version 2.1 of the License, or (at your option) any later version.
15
16   This library is distributed in the hope that it will be useful,
17   but WITHOUT ANY WARRANTY; without even the implied warranty of
18   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
19   Lesser General Public License for more details.
20
21   You should have received a copy of the GNU Lesser General Public
22   License along with this library; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "dns.h"
26 #include <ctype.h>
27
28
29 #ifdef HAVE_GSSAPI
30
31 /*********************************************************************
32 *********************************************************************/
33
34 #ifndef HAVE_STRUPR
35 static int strupr( char *szDomainName )
36 {
37         if ( !szDomainName ) {
38                 return ( 0 );
39         }
40         while ( *szDomainName != '\0' ) {
41                 *szDomainName = toupper( *szDomainName );
42                 szDomainName++;
43         }
44         return ( 0 );
45 }
46 #endif
47
48 #if 0
49 /*********************************************************************
50 *********************************************************************/
51
52 static void display_status_1( const char *m, OM_uint32 code, int type )
53 {
54         OM_uint32 maj_stat, min_stat;
55         gss_buffer_desc msg;
56         OM_uint32 msg_ctx;
57
58         msg_ctx = 0;
59         while ( 1 ) {
60                 maj_stat = gss_display_status( &min_stat, code,
61                                                type, GSS_C_NULL_OID,
62                                                &msg_ctx, &msg );
63                 fprintf( stdout, "GSS-API error %s: %s\n", m,
64                          ( char * ) msg.value );
65                 ( void ) gss_release_buffer( &min_stat, &msg );
66
67                 if ( !msg_ctx )
68                         break;
69         }
70 }
71
72 /*********************************************************************
73 *********************************************************************/
74
75 void display_status( const char *msg, OM_uint32 maj_stat, OM_uint32 min_stat )
76 {
77         display_status_1( msg, maj_stat, GSS_C_GSS_CODE );
78         display_status_1( msg, min_stat, GSS_C_MECH_CODE );
79 }
80 #endif
81
82 static DNS_ERROR dns_negotiate_gss_ctx_int( TALLOC_CTX *mem_ctx,
83                                             struct dns_connection *conn,
84                                             const char *keyname,
85                                             const gss_name_t target_name,
86                                             gss_ctx_id_t *ctx, 
87                                             enum dns_ServerType srv_type )
88 {
89         struct gss_buffer_desc_struct input_desc, *input_ptr, output_desc;
90         OM_uint32 major, minor;
91         OM_uint32 ret_flags;
92         DNS_ERROR err;
93
94         gss_OID_desc krb5_oid_desc =
95                 { 9, (const char *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
96
97         *ctx = GSS_C_NO_CONTEXT;
98         input_ptr = NULL;
99
100         do {
101                 major = gss_init_sec_context(
102                         &minor, NULL, ctx, target_name, &krb5_oid_desc,
103                         GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG |
104                         GSS_C_CONF_FLAG |
105                         GSS_C_INTEG_FLAG,
106                         0, NULL, input_ptr, NULL, &output_desc,
107                         &ret_flags, NULL );
108
109                 if (input_ptr != NULL) {
110                         TALLOC_FREE(input_desc.value);
111                 }
112
113                 if (output_desc.length != 0) {
114
115                         struct dns_request *req;
116                         struct dns_rrec *rec;
117                         struct dns_buffer *buf;
118
119                         time_t t = time(NULL);
120
121                         err = dns_create_query(mem_ctx, keyname, QTYPE_TKEY,
122                                                DNS_CLASS_IN, &req);
123                         if (!ERR_DNS_IS_OK(err)) goto error;
124
125                         err = dns_create_tkey_record(
126                                 req, keyname, "gss.microsoft.com", t,
127                                 t + 86400, DNS_TKEY_MODE_GSSAPI, 0,
128                                 output_desc.length, (uint8 *)output_desc.value,
129                                 &rec );
130                         if (!ERR_DNS_IS_OK(err)) goto error;
131
132                         /* Windows 2000 DNS is broken and requires the
133                            TKEY payload in the Answer section instead
134                            of the Additional seciton like Windows 2003 */
135
136                         if ( srv_type == DNS_SRV_WIN2000 ) {
137                                 err = dns_add_rrec(req, rec, &req->num_answers,
138                                                    &req->answers);
139                         } else {
140                                 err = dns_add_rrec(req, rec, &req->num_additionals,
141                                                    &req->additionals);
142                         }
143                         
144                         if (!ERR_DNS_IS_OK(err)) goto error;
145
146                         err = dns_marshall_request(req, req, &buf);
147                         if (!ERR_DNS_IS_OK(err)) goto error;
148
149                         err = dns_send(conn, buf);
150                         if (!ERR_DNS_IS_OK(err)) goto error;
151
152                         TALLOC_FREE(req);
153                 }
154
155                 gss_release_buffer(&minor, &output_desc);
156
157                 if ((major != GSS_S_COMPLETE) &&
158                     (major != GSS_S_CONTINUE_NEEDED)) {
159                         return ERROR_DNS_GSS_ERROR;
160                 }
161
162                 if (major == GSS_S_CONTINUE_NEEDED) {
163
164                         struct dns_request *resp;
165                         struct dns_buffer *buf;
166                         struct dns_tkey_record *tkey;
167
168                         err = dns_receive(mem_ctx, conn, &buf);
169                         if (!ERR_DNS_IS_OK(err)) goto error;
170
171                         err = dns_unmarshall_request(buf, buf, &resp);
172                         if (!ERR_DNS_IS_OK(err)) goto error;
173
174                         /*
175                          * TODO: Compare id and keyname
176                          */
177                         
178                         if ((resp->num_additionals != 1) ||
179                             (resp->num_answers == 0) ||
180                             (resp->answers[0]->type != QTYPE_TKEY)) {
181                                 err = ERROR_DNS_INVALID_MESSAGE;
182                                 goto error;
183                         }
184
185                         err = dns_unmarshall_tkey_record(
186                                 mem_ctx, resp->answers[0], &tkey);
187                         if (!ERR_DNS_IS_OK(err)) goto error;
188
189                         input_desc.length = tkey->key_length;
190                         input_desc.value = talloc_move(mem_ctx, &tkey->key);
191
192                         input_ptr = &input_desc;
193
194                         TALLOC_FREE(buf);
195                 }
196
197         } while ( major == GSS_S_CONTINUE_NEEDED );
198
199         /* If we arrive here, we have a valid security context */
200
201         err = ERROR_DNS_SUCCESS;
202
203       error:
204
205         return err;
206 }
207
208 DNS_ERROR dns_negotiate_sec_ctx( const char *target_realm,
209                                  const char *servername,
210                                  const char *keyname,
211                                  gss_ctx_id_t *gss_ctx,
212                                  enum dns_ServerType srv_type )
213 {
214         OM_uint32 major, minor;
215
216         char *upcaserealm, *targetname;
217         DNS_ERROR err;
218
219         gss_buffer_desc input_name;
220         struct dns_connection *conn;
221
222         gss_name_t targ_name;
223
224         gss_OID_desc nt_host_oid_desc =
225                 {10, (const char *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x01"};
226
227         TALLOC_CTX *mem_ctx;
228
229         if (!(mem_ctx = talloc_init("dns_negotiate_sec_ctx"))) {
230                 return ERROR_DNS_NO_MEMORY;
231         }
232
233         err = dns_open_connection( servername, DNS_TCP, mem_ctx, &conn );
234         if (!ERR_DNS_IS_OK(err)) goto error;
235
236         if (!(upcaserealm = talloc_strdup(mem_ctx, target_realm))) {
237                 err = ERROR_DNS_NO_MEMORY;
238                 goto error;
239         }
240
241         strupr(upcaserealm);
242
243         if (!(targetname = talloc_asprintf(mem_ctx, "dns/%s@%s",
244                                            servername, upcaserealm))) {
245                 err = ERROR_DNS_NO_MEMORY;
246                 goto error;
247         }
248
249         input_name.value = targetname;
250         input_name.length = strlen(targetname);
251
252         major = gss_import_name( &minor, &input_name,
253                                  &nt_host_oid_desc, &targ_name );
254
255         if (major) {
256                 err = ERROR_DNS_GSS_ERROR;
257                 goto error;
258         }
259
260         err = dns_negotiate_gss_ctx_int(mem_ctx, conn, keyname, 
261                                         targ_name, gss_ctx, srv_type );
262         
263         gss_release_name( &minor, &targ_name );
264
265  error:
266         TALLOC_FREE(mem_ctx);
267
268         return err;
269 }
270
271 DNS_ERROR dns_sign_update(struct dns_update_request *req,
272                           gss_ctx_id_t gss_ctx,
273                           const char *keyname,
274                           const char *algorithmname,
275                           time_t time_signed, uint16 fudge)
276 {
277         struct dns_buffer *buf;
278         DNS_ERROR err;
279         struct dns_domain_name *key, *algorithm;
280         struct gss_buffer_desc_struct msg, mic;
281         OM_uint32 major, minor;
282         struct dns_rrec *rec;
283
284         err = dns_marshall_update_request(req, req, &buf);
285         if (!ERR_DNS_IS_OK(err)) return err;
286
287         err = dns_domain_name_from_string(buf, keyname, &key);
288         if (!ERR_DNS_IS_OK(err)) goto error;
289
290         err = dns_domain_name_from_string(buf, algorithmname, &algorithm);
291         if (!ERR_DNS_IS_OK(err)) goto error;
292
293         dns_marshall_domain_name(buf, key);
294         dns_marshall_uint16(buf, DNS_CLASS_ANY);
295         dns_marshall_uint32(buf, 0); /* TTL */
296         dns_marshall_domain_name(buf, algorithm);
297         dns_marshall_uint16(buf, 0); /* Time prefix for 48-bit time_t */
298         dns_marshall_uint32(buf, time_signed);
299         dns_marshall_uint16(buf, fudge);
300         dns_marshall_uint16(buf, 0); /* error */
301         dns_marshall_uint16(buf, 0); /* other len */
302
303         err = buf->error;
304         if (!ERR_DNS_IS_OK(buf->error)) goto error;
305
306         msg.value = (void *)buf->data;
307         msg.length = buf->offset;
308
309         major = gss_get_mic(&minor, gss_ctx, 0, &msg, &mic);
310         if (major != 0) {
311                 err = ERROR_DNS_GSS_ERROR;
312                 goto error;
313         }
314
315         if (mic.length > 0xffff) {
316                 gss_release_buffer(&minor, &mic);
317                 err = ERROR_DNS_GSS_ERROR;
318                 goto error;
319         }
320
321         err = dns_create_tsig_record(buf, keyname, algorithmname, time_signed,
322                                      fudge, mic.length, (uint8 *)mic.value,
323                                      req->id, 0, &rec);
324         gss_release_buffer(&minor, &mic);
325         if (!ERR_DNS_IS_OK(err)) goto error;
326
327         err = dns_add_rrec(req, rec, &req->num_additionals, &req->additionals);
328
329  error:
330         TALLOC_FREE(buf);
331         return err;
332 }
333
334 #endif  /* HAVE_GSSAPI */