2 Unix SMB/CIFS implementation.
4 server side dcerpc authentication code
6 Copyright (C) Andrew Tridgell 2003
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 parse any auth information from a dcerpc bind request
27 return False if we can't handle the auth request for some
28 reason (in which case we send a bind_nak)
30 BOOL dcesrv_auth_bind(struct dcesrv_call_state *call)
32 struct dcerpc_packet *pkt = &call->pkt;
33 struct dcesrv_connection *dce_conn = call->conn;
36 if (pkt->u.bind.auth_info.length == 0) {
37 dce_conn->auth_state.auth_info = NULL;
41 dce_conn->auth_state.auth_info = talloc_p(dce_conn->mem_ctx, struct dcerpc_auth);
42 if (!dce_conn->auth_state.auth_info) {
46 status = ndr_pull_struct_blob(&pkt->u.bind.auth_info,
48 dce_conn->auth_state.auth_info,
49 (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
50 if (!NT_STATUS_IS_OK(status)) {
54 status = dcesrv_crypto_select_type(dce_conn, &dce_conn->auth_state);
55 if (!NT_STATUS_IS_OK(status)) {
59 status = dcesrv_crypto_start(&dce_conn->auth_state);
60 if (!NT_STATUS_IS_OK(status)) {
68 add any auth information needed in a bind ack
70 BOOL dcesrv_auth_bind_ack(struct dcesrv_call_state *call, struct dcerpc_packet *pkt)
72 struct dcesrv_connection *dce_conn = call->conn;
75 if (!call->conn->auth_state.crypto_ctx.ops) {
79 status = dcesrv_crypto_update(&dce_conn->auth_state,
81 dce_conn->auth_state.auth_info->credentials,
82 &dce_conn->auth_state.auth_info->credentials);
83 if (!NT_STATUS_IS_OK(status) &&
84 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
85 DEBUG(2, ("Failed to start dcesrv auth negotiate: %s\n", nt_errstr(status)));
89 dce_conn->auth_state.auth_info->auth_pad_length = 0;
90 dce_conn->auth_state.auth_info->auth_reserved = 0;
97 process the final stage of a auth request
99 BOOL dcesrv_auth_auth3(struct dcesrv_call_state *call)
101 struct dcerpc_packet *pkt = &call->pkt;
102 struct dcesrv_connection *dce_conn = call->conn;
105 if (!dce_conn->auth_state.auth_info ||
106 !dce_conn->auth_state.crypto_ctx.ops ||
107 pkt->u.auth.auth_info.length == 0) {
111 status = ndr_pull_struct_blob(&pkt->u.auth.auth_info,
113 dce_conn->auth_state.auth_info,
114 (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
115 if (!NT_STATUS_IS_OK(status)) {
119 status = dcesrv_crypto_update(&dce_conn->auth_state,
121 dce_conn->auth_state.auth_info->credentials,
122 &dce_conn->auth_state.auth_info->credentials);
123 if (!NT_STATUS_IS_OK(status)) {
124 DEBUG(4, ("dcesrv_auth_auth3: failed to authenticate: %s\n",
134 check credentials on a request
136 BOOL dcesrv_auth_request(struct dcesrv_call_state *call)
138 struct dcerpc_packet *pkt = &call->pkt;
139 struct dcesrv_connection *dce_conn = call->conn;
141 struct dcerpc_auth auth;
142 struct ndr_pull *ndr;
145 if (!dce_conn->auth_state.auth_info ||
146 !dce_conn->auth_state.crypto_ctx.ops) {
150 auth_blob.length = 8 + pkt->auth_length;
152 /* check for a valid length */
153 if (pkt->u.request.stub_and_verifier.length < auth_blob.length) {
158 pkt->u.request.stub_and_verifier.data +
159 pkt->u.request.stub_and_verifier.length - auth_blob.length;
160 pkt->u.request.stub_and_verifier.length -= auth_blob.length;
162 /* pull the auth structure */
163 ndr = ndr_pull_init_blob(&auth_blob, call->mem_ctx);
168 if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
169 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
172 status = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth);
173 if (!NT_STATUS_IS_OK(status)) {
177 /* check signature or unseal the packet */
178 switch (dce_conn->auth_state.auth_info->auth_level) {
179 case DCERPC_AUTH_LEVEL_PRIVACY:
180 status = dcesrv_crypto_unseal(&dce_conn->auth_state,
182 pkt->u.request.stub_and_verifier.data,
183 pkt->u.request.stub_and_verifier.length,
187 case DCERPC_AUTH_LEVEL_INTEGRITY:
188 status = dcesrv_crypto_check_sig(&dce_conn->auth_state,
190 pkt->u.request.stub_and_verifier.data,
191 pkt->u.request.stub_and_verifier.length,
196 status = NT_STATUS_INVALID_LEVEL;
200 /* remove the indicated amount of paddiing */
201 if (pkt->u.request.stub_and_verifier.length < auth.auth_pad_length) {
204 pkt->u.request.stub_and_verifier.length -= auth.auth_pad_length;
206 return NT_STATUS_IS_OK(status);
211 push a signed or sealed dcerpc request packet into a blob
213 BOOL dcesrv_auth_response(struct dcesrv_call_state *call,
214 DATA_BLOB *blob, struct dcerpc_packet *pkt)
216 struct dcesrv_connection *dce_conn = call->conn;
218 struct ndr_push *ndr;
220 /* non-signed packets are simple */
221 if (!dce_conn->auth_state.auth_info || !dce_conn->auth_state.crypto_ctx.ops) {
222 status = dcerpc_push_auth(blob, call->mem_ctx, pkt, NULL);
223 return NT_STATUS_IS_OK(status);
226 ndr = ndr_push_init_ctx(call->mem_ctx);
231 if (pkt->drep[0] & DCERPC_DREP_LE) {
232 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
235 status = ndr_push_dcerpc_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
236 if (!NT_STATUS_IS_OK(status)) {
240 /* pad to 8 byte multiple */
241 dce_conn->auth_state.auth_info->auth_pad_length = NDR_ALIGN(ndr, 8);
242 ndr_push_zero(ndr, dce_conn->auth_state.auth_info->auth_pad_length);
244 /* sign or seal the packet */
245 switch (dce_conn->auth_state.auth_info->auth_level) {
246 case DCERPC_AUTH_LEVEL_PRIVACY:
247 status = dcesrv_crypto_seal(&dce_conn->auth_state,
249 ndr->data + DCERPC_REQUEST_LENGTH,
250 ndr->offset - DCERPC_REQUEST_LENGTH,
251 &dce_conn->auth_state.auth_info->credentials);
254 case DCERPC_AUTH_LEVEL_INTEGRITY:
255 status = dcesrv_crypto_sign(&dce_conn->auth_state,
257 ndr->data + DCERPC_REQUEST_LENGTH,
258 ndr->offset - DCERPC_REQUEST_LENGTH,
259 &dce_conn->auth_state.auth_info->credentials);
262 status = NT_STATUS_INVALID_LEVEL;
266 if (!NT_STATUS_IS_OK(status)) {
270 /* add the auth verifier */
271 status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, dce_conn->auth_state.auth_info);
272 if (!NT_STATUS_IS_OK(status)) {
276 /* extract the whole packet as a blob */
277 *blob = ndr_push_blob(ndr);
279 /* fill in the fragment length and auth_length, we can't fill
280 in these earlier as we don't know the signature length (it
281 could be variable length) */
282 dcerpc_set_frag_length(blob, blob->length);
283 dcerpc_set_auth_length(blob, dce_conn->auth_state.auth_info->credentials.length);
285 data_blob_free(&dce_conn->auth_state.auth_info->credentials);