source4/auth/gensec/gensec_krb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Kerberos backend for GENSEC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
   7    Copyright (C) Andrew Tridgell 2001
   8    Copyright (C) Luke Howard 2002-2003
   9    Copyright (C) Stefan Metzmacher 2004-2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "system/kerberos.h"
  28 #include "auth/kerberos/kerberos.h"
  29 #include "auth/auth.h"
  30 #include "lib/tsocket/tsocket.h"
  31 #include "librpc/gen_ndr/dcerpc.h"
  32 #include "auth/credentials/credentials.h"
  33 #include "auth/credentials/credentials_krb5.h"
  34 #include "auth/kerberos/kerberos_credentials.h"
  35 #include "auth/gensec/gensec.h"
  36 #include "auth/gensec/gensec_internal.h"
  37 #include "auth/gensec/gensec_proto.h"
  38 #include "auth/gensec/gensec_toplevel_proto.h"
  39 #include "param/param.h"
  40 #include "auth/auth_sam_reply.h"
  41 #include "lib/util/util_net.h"
  42 #include "../lib/util/asn1.h"
  43 #include "auth/kerberos/pac_utils.h"
  44 #include "gensec_krb5.h"
  45
  46 _PUBLIC_ NTSTATUS gensec_krb5_init(void);
  47
  48 enum GENSEC_KRB5_STATE {
  49         GENSEC_KRB5_SERVER_START,
  50         GENSEC_KRB5_CLIENT_START,
  51         GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
  52         GENSEC_KRB5_DONE
  53 };
  54
  55 struct gensec_krb5_state {
  56         enum GENSEC_KRB5_STATE state_position;
  57         struct smb_krb5_context *smb_krb5_context;
  58         krb5_auth_context auth_context;
  59         krb5_data enc_ticket;
  60         krb5_keyblock *keyblock;
  61         krb5_ticket *ticket;
  62         bool gssapi;
  63         krb5_flags ap_req_options;
  64 };
  65
  66 static int gensec_krb5_destroy(struct gensec_krb5_state *gensec_krb5_state)
  67 {
  68         if (!gensec_krb5_state->smb_krb5_context) {
  69                 /* We can't clean anything else up unless we started up this far */
  70                 return 0;
  71         }
  72         if (gensec_krb5_state->enc_ticket.length) {
  73                 smb_krb5_free_data_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
  74                                             &gensec_krb5_state->enc_ticket);
  75         }
  76
  77         if (gensec_krb5_state->ticket) {
  78                 krb5_free_ticket(gensec_krb5_state->smb_krb5_context->krb5_context,
  79                                  gensec_krb5_state->ticket);
  80         }
  81
  82         /* ccache freed in a child destructor */
  83
  84         krb5_free_keyblock(gensec_krb5_state->smb_krb5_context->krb5_context,
  85                            gensec_krb5_state->keyblock);
  86
  87         if (gensec_krb5_state->auth_context) {
  88                 krb5_auth_con_free(gensec_krb5_state->smb_krb5_context->krb5_context,
  89                                    gensec_krb5_state->auth_context);
  90         }
  91
  92         return 0;
  93 }
  94
  95 static NTSTATUS gensec_krb5_start(struct gensec_security *gensec_security, bool gssapi)
  96 {
  97         krb5_error_code ret;
  98         struct gensec_krb5_state *gensec_krb5_state;
  99         struct cli_credentials *creds;
 100         const struct tsocket_address *tlocal_addr, *tremote_addr;
 101         krb5_address my_krb5_addr, peer_krb5_addr;
 102
 103         creds = gensec_get_credentials(gensec_security);
 104         if (!creds) {
 105                 return NT_STATUS_INVALID_PARAMETER;
 106         }
 107
 108         gensec_krb5_state = talloc(gensec_security, struct gensec_krb5_state);
 109         if (!gensec_krb5_state) {
 110                 return NT_STATUS_NO_MEMORY;
 111         }
 112
 113         gensec_security->private_data = gensec_krb5_state;
 114         gensec_krb5_state->smb_krb5_context = NULL;
 115         gensec_krb5_state->auth_context = NULL;
 116         gensec_krb5_state->ticket = NULL;
 117         ZERO_STRUCT(gensec_krb5_state->enc_ticket);
 118         gensec_krb5_state->keyblock = NULL;
 119         gensec_krb5_state->gssapi = gssapi;
 120
 121         talloc_set_destructor(gensec_krb5_state, gensec_krb5_destroy);
 122
 123         if (cli_credentials_get_krb5_context(creds,
 124                                              gensec_security->settings->lp_ctx, &gensec_krb5_state->smb_krb5_context)) {
 125                 talloc_free(gensec_krb5_state);
 126                 return NT_STATUS_INTERNAL_ERROR;
 127         }
 128
 129         ret = krb5_auth_con_init(gensec_krb5_state->smb_krb5_context->krb5_context, &gensec_krb5_state->auth_context);
 130         if (ret) {
 131                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_init failed (%s)\n",
 132                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 133                                                     ret, gensec_krb5_state)));
 134                 talloc_free(gensec_krb5_state);
 135                 return NT_STATUS_INTERNAL_ERROR;
 136         }
 137
 138         ret = krb5_auth_con_setflags(gensec_krb5_state->smb_krb5_context->krb5_context,
 139                                      gensec_krb5_state->auth_context,
 140                                      KRB5_AUTH_CONTEXT_DO_SEQUENCE);
 141         if (ret) {
 142                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setflags failed (%s)\n",
 143                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 144                                                     ret, gensec_krb5_state)));
 145                 talloc_free(gensec_krb5_state);
 146                 return NT_STATUS_INTERNAL_ERROR;
 147         }
 148
 149         tlocal_addr = gensec_get_local_address(gensec_security);
 150         if (tlocal_addr) {
 151                 ssize_t socklen;
 152                 struct sockaddr_storage ss;
 153                 bool ok;
 154
 155                 socklen = tsocket_address_bsd_sockaddr(tlocal_addr,
 156                                 (struct sockaddr *) &ss,
 157                                 sizeof(struct sockaddr_storage));
 158                 if (socklen < 0) {
 159                         talloc_free(gensec_krb5_state);
 160                         return NT_STATUS_INTERNAL_ERROR;
 161                 }
 162                 ok = smb_krb5_sockaddr_to_kaddr(&ss, &my_krb5_addr);
 163                 if (!ok) {
 164                         DBG_WARNING("smb_krb5_sockaddr_to_kaddr (local) failed\n");
 165                         talloc_free(gensec_krb5_state);
 166                         return NT_STATUS_INTERNAL_ERROR;
 167                 }
 168         }
 169
 170         tremote_addr = gensec_get_remote_address(gensec_security);
 171         if (tremote_addr) {
 172                 ssize_t socklen;
 173                 struct sockaddr_storage ss;
 174                 bool ok;
 175
 176                 socklen = tsocket_address_bsd_sockaddr(tremote_addr,
 177                                 (struct sockaddr *) &ss,
 178                                 sizeof(struct sockaddr_storage));
 179                 if (socklen < 0) {
 180                         talloc_free(gensec_krb5_state);
 181                         return NT_STATUS_INTERNAL_ERROR;
 182                 }
 183                 ok = smb_krb5_sockaddr_to_kaddr(&ss, &peer_krb5_addr);
 184                 if (!ok) {
 185                         DBG_WARNING("smb_krb5_sockaddr_to_kaddr (remote) failed\n");
 186                         talloc_free(gensec_krb5_state);
 187                         return NT_STATUS_INTERNAL_ERROR;
 188                 }
 189         }
 190
 191         ret = krb5_auth_con_setaddrs(gensec_krb5_state->smb_krb5_context->krb5_context,
 192                                      gensec_krb5_state->auth_context,
 193                                      tlocal_addr ? &my_krb5_addr : NULL,
 194                                      tremote_addr ? &peer_krb5_addr : NULL);
 195         if (ret) {
 196                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setaddrs failed (%s)\n",
 197                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 198                                                     ret, gensec_krb5_state)));
 199                 talloc_free(gensec_krb5_state);
 200                 return NT_STATUS_INTERNAL_ERROR;
 201         }
 202
 203         return NT_STATUS_OK;
 204 }
 205
 206 static NTSTATUS gensec_krb5_common_server_start(struct gensec_security *gensec_security, bool gssapi)
 207 {
 208         NTSTATUS nt_status;
 209         struct gensec_krb5_state *gensec_krb5_state;
 210
 211         nt_status = gensec_krb5_start(gensec_security, gssapi);
 212         if (!NT_STATUS_IS_OK(nt_status)) {
 213                 return nt_status;
 214         }
 215
 216         gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 217         gensec_krb5_state->state_position = GENSEC_KRB5_SERVER_START;
 218
 219         return NT_STATUS_OK;
 220 }
 221
 222 static NTSTATUS gensec_krb5_server_start(struct gensec_security *gensec_security)
 223 {
 224         return gensec_krb5_common_server_start(gensec_security, false);
 225 }
 226
 227 static NTSTATUS gensec_fake_gssapi_krb5_server_start(struct gensec_security *gensec_security)
 228 {
 229         return gensec_krb5_common_server_start(gensec_security, true);
 230 }
 231
 232 static NTSTATUS gensec_krb5_common_client_start(struct gensec_security *gensec_security, bool gssapi)
 233 {
 234         const char *hostname;
 235         struct gensec_krb5_state *gensec_krb5_state;
 236         NTSTATUS nt_status;
 237         hostname = gensec_get_target_hostname(gensec_security);
 238         if (!hostname) {
 239                 DEBUG(3, ("No hostname for target computer passed in, cannot use kerberos for this connection\n"));
 240                 return NT_STATUS_INVALID_PARAMETER;
 241         }
 242         if (is_ipaddress(hostname)) {
 243                 DEBUG(2, ("Cannot do krb5 to an IP address"));
 244                 return NT_STATUS_INVALID_PARAMETER;
 245         }
 246         if (strcmp(hostname, "localhost") == 0) {
 247                 DEBUG(2, ("krb5 to 'localhost' does not make sense"));
 248                 return NT_STATUS_INVALID_PARAMETER;
 249         }
 250
 251         nt_status = gensec_krb5_start(gensec_security, gssapi);
 252         if (!NT_STATUS_IS_OK(nt_status)) {
 253                 return nt_status;
 254         }
 255
 256         gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 257         gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_START;
 258         gensec_krb5_state->ap_req_options = AP_OPTS_USE_SUBKEY;
 259
 260         if (gensec_krb5_state->gssapi) {
 261                 /* The Fake GSSAPI model emulates Samba3, which does not do mutual authentication */
 262                 if (gensec_setting_bool(gensec_security->settings, "gensec_fake_gssapi_krb5", "mutual", false)) {
 263                         gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
 264                 }
 265         } else {
 266                 /* The wrapping for KPASSWD (a user of the raw KRB5 API) should be mutually authenticated */
 267                 if (gensec_setting_bool(gensec_security->settings, "gensec_krb5", "mutual", true)) {
 268                         gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
 269                 }
 270         }
 271         return NT_STATUS_OK;
 272 }
 273
 274 static NTSTATUS gensec_krb5_common_client_creds(struct gensec_security *gensec_security,
 275                                                 struct tevent_context *ev,
 276                                                 bool gssapi)
 277 {
 278         struct gensec_krb5_state *gensec_krb5_state;
 279         krb5_error_code ret;
 280         struct ccache_container *ccache_container;
 281         const char *error_string;
 282         const char *principal;
 283         const char *hostname;
 284         krb5_data in_data = { .length = 0 };
 285         krb5_data *in_data_p = NULL;
 286 #ifdef SAMBA4_USES_HEIMDAL
 287         struct tevent_context *previous_ev;
 288 #endif
 289
 290         if (lpcfg_parm_bool(gensec_security->settings->lp_ctx,
 291                             NULL, "gensec_krb5", "send_authenticator_checksum", true)) {
 292                 in_data_p = &in_data;
 293         }
 294
 295         gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 296
 297         principal = gensec_get_target_principal(gensec_security);
 298         hostname = gensec_get_target_hostname(gensec_security);
 299
 300         ret = cli_credentials_get_ccache(gensec_get_credentials(gensec_security),
 301                                          ev,
 302                                          gensec_security->settings->lp_ctx, &ccache_container, &error_string);
 303         switch (ret) {
 304         case 0:
 305                 break;
 306         case KRB5KDC_ERR_PREAUTH_FAILED:
 307         case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
 308                 return NT_STATUS_LOGON_FAILURE;
 309         case KRB5_KDC_UNREACH:
 310                 DEBUG(3, ("Cannot reach a KDC we require to contact %s: %s\n", principal, error_string));
 311                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 312         case KRB5_CC_NOTFOUND:
 313         case KRB5_CC_END:
 314                 DEBUG(3, ("Error preparing credentials we require to contact %s : %s\n", principal, error_string));
 315                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 316         default:
 317                 DEBUG(1, ("gensec_krb5_start: Aquiring initiator credentials failed: %s\n", error_string));
 318                 return NT_STATUS_UNSUCCESSFUL;
 319         }
 320
 321 #ifdef SAMBA4_USES_HEIMDAL
 322         /* Do this every time, in case we have weird recursive issues here */
 323         ret = smb_krb5_context_set_event_ctx(gensec_krb5_state->smb_krb5_context, ev, &previous_ev);
 324         if (ret != 0) {
 325                 DEBUG(1, ("gensec_krb5_start: Setting event context failed\n"));
 326                 return NT_STATUS_NO_MEMORY;
 327         }
 328 #endif
 329         if (principal) {
 330                 krb5_principal target_principal;
 331                 ret = krb5_parse_name(gensec_krb5_state->smb_krb5_context->krb5_context, principal,
 332                                       &target_principal);
 333                 if (ret == 0) {
 334                         krb5_creds this_cred;
 335                         krb5_creds *cred;
 336
 337                         ZERO_STRUCT(this_cred);
 338                         ret = krb5_cc_get_principal(gensec_krb5_state->smb_krb5_context->krb5_context,
 339                                                     ccache_container->ccache,
 340                                                     &this_cred.client);
 341                         if (ret != 0) {
 342                                 krb5_free_principal(gensec_krb5_state->smb_krb5_context->krb5_context,
 343                                                     target_principal);
 344                                 return NT_STATUS_UNSUCCESSFUL;
 345                         }
 346
 347                         ret = krb5_copy_principal(gensec_krb5_state->smb_krb5_context->krb5_context,
 348                                                   target_principal,
 349                                                   &this_cred.server);
 350                         krb5_free_principal(gensec_krb5_state->smb_krb5_context->krb5_context,
 351                                             target_principal);
 352                         if (ret != 0) {
 353                                 krb5_free_cred_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
 354                                                         &this_cred);
 355                                 return NT_STATUS_UNSUCCESSFUL;
 356                         }
 357                         this_cred.times.endtime = 0;
 358
 359                         ret = krb5_get_credentials(gensec_krb5_state->smb_krb5_context->krb5_context,
 360                                                    0,
 361                                                    ccache_container->ccache,
 362                                                    &this_cred,
 363                                                    &cred);
 364                         krb5_free_cred_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
 365                                                 &this_cred);
 366                         if (ret != 0) {
 367                                 return NT_STATUS_UNSUCCESSFUL;
 368                         }
 369
 370                         ret = krb5_mk_req_extended(gensec_krb5_state->smb_krb5_context->krb5_context,
 371                                                    &gensec_krb5_state->auth_context,
 372                                                    gensec_krb5_state->ap_req_options,
 373                                                    in_data_p,
 374                                                    cred,
 375                                                    &gensec_krb5_state->enc_ticket);
 376                 }
 377         } else {
 378                 ret = krb5_mk_req(gensec_krb5_state->smb_krb5_context->krb5_context,
 379                                   &gensec_krb5_state->auth_context,
 380                                   gensec_krb5_state->ap_req_options,
 381                                   discard_const_p(char, gensec_get_target_service(gensec_security)),
 382                                   discard_const_p(char, hostname),
 383                                   in_data_p, ccache_container->ccache,
 384                                   &gensec_krb5_state->enc_ticket);
 385         }
 386
 387 #ifdef SAMBA4_USES_HEIMDAL
 388         smb_krb5_context_remove_event_ctx(gensec_krb5_state->smb_krb5_context, previous_ev, ev);
 389 #endif
 390
 391         switch (ret) {
 392         case 0:
 393                 return NT_STATUS_OK;
 394         case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
 395                 DEBUG(3, ("Server [%s] is not registered with our KDC: %s\n",
 396                           hostname, smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 397                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 398         case KRB5_KDC_UNREACH:
 399                 DEBUG(3, ("Cannot reach a KDC we require to contact host [%s]: %s\n",
 400                           hostname, smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 401                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 402         case KRB5KDC_ERR_PREAUTH_FAILED:
 403         case KRB5KRB_AP_ERR_TKT_EXPIRED:
 404         case KRB5_CC_END:
 405                 /* Too much clock skew - we will need to kinit to re-skew the clock */
 406         case KRB5KRB_AP_ERR_SKEW:
 407         case KRB5_KDCREP_SKEW:
 408         {
 409                 DEBUG(3, ("kerberos (mk_req) failed: %s\n",
 410                           smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 411                 /*fall through*/
 412         }
 413
 414         /* just don't print a message for these really ordinary messages */
 415         case KRB5_FCC_NOFILE:
 416         case KRB5_CC_NOTFOUND:
 417         case ENOENT:
 418
 419                 return NT_STATUS_UNSUCCESSFUL;
 420                 break;
 421
 422         default:
 423                 DEBUG(0, ("kerberos: %s\n",
 424                           smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 425                 return NT_STATUS_UNSUCCESSFUL;
 426         }
 427 }
 428
 429 static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security)
 430 {
 431         return gensec_krb5_common_client_start(gensec_security, false);
 432 }
 433
 434 static NTSTATUS gensec_fake_gssapi_krb5_client_start(struct gensec_security *gensec_security)
 435 {
 436         return gensec_krb5_common_client_start(gensec_security, true);
 437 }
 438
 439
 440 /*
 441   generate a krb5 GSS-API wrapper packet given a ticket
 442 */
 443 static DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *ticket, const uint8_t tok_id[2])
 444 {
 445         struct asn1_data *data;
 446         DATA_BLOB ret = data_blob_null;
 447
 448         data = asn1_init(mem_ctx);
 449         if (!data || !ticket->data) {
 450                 return ret;
 451         }
 452
 453         if (!asn1_push_tag(data, ASN1_APPLICATION(0))) goto err;
 454         if (!asn1_write_OID(data, GENSEC_OID_KERBEROS5)) goto err;
 455
 456         if (!asn1_write(data, tok_id, 2)) goto err;
 457         if (!asn1_write(data, ticket->data, ticket->length)) goto err;
 458         if (!asn1_pop_tag(data)) goto err;
 459
 460
 461         if (!asn1_extract_blob(data, mem_ctx, &ret)) {
 462                 goto err;
 463         }
 464         asn1_free(data);
 465
 466         return ret;
 467
 468   err:
 469
 470         DEBUG(1, ("Failed to build krb5 wrapper at offset %d\n",
 471                   (int)asn1_current_ofs(data)));
 472         asn1_free(data);
 473         return ret;
 474 }
 475
 476 /*
 477   parse a krb5 GSS-API wrapper packet giving a ticket
 478 */
 479 static bool gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, DATA_BLOB *ticket, uint8_t tok_id[2])
 480 {
 481         bool ret = false;
 482         struct asn1_data *data = asn1_init(mem_ctx);
 483         int data_remaining;
 484
 485         if (!data) {
 486                 return false;
 487         }
 488
 489         if (!asn1_load(data, *blob)) goto err;
 490         if (!asn1_start_tag(data, ASN1_APPLICATION(0))) goto err;
 491         if (!asn1_check_OID(data, GENSEC_OID_KERBEROS5)) goto err;
 492
 493         data_remaining = asn1_tag_remaining(data);
 494
 495         if (data_remaining < 3) {
 496                 asn1_set_error(data);
 497         } else {
 498                 if (!asn1_read(data, tok_id, 2)) goto err;
 499                 data_remaining -= 2;
 500                 *ticket = data_blob_talloc(mem_ctx, NULL, data_remaining);
 501                 if (!asn1_read(data, ticket->data, ticket->length)) goto err;
 502         }
 503
 504         if (!asn1_end_tag(data)) goto err;
 505
 506         ret = !asn1_has_error(data);
 507
 508   err:
 509
 510         asn1_free(data);
 511
 512         return ret;
 513 }
 514
 515 /**
 516  * Next state function for the Krb5 GENSEC mechanism
 517  *
 518  * @param gensec_krb5_state KRB5 State
 519  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
 520  * @param in The request, as a DATA_BLOB
 521  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 522  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 523  *                or NT_STATUS_OK if the user is authenticated.
 524  */
 525
 526 static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security,
 527                                    TALLOC_CTX *out_mem_ctx,
 528                                    struct tevent_context *ev,
 529                                    const DATA_BLOB in, DATA_BLOB *out)
 530 {
 531         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 532         krb5_error_code ret = 0;
 533         NTSTATUS nt_status;
 534
 535         switch (gensec_krb5_state->state_position) {
 536         case GENSEC_KRB5_CLIENT_START:
 537         {
 538                 DATA_BLOB unwrapped_out;
 539
 540                 nt_status = gensec_krb5_common_client_creds(gensec_security, ev, gensec_krb5_state->gssapi);
 541                 if (!NT_STATUS_IS_OK(nt_status)) {
 542                         return nt_status;
 543                 }
 544
 545                 if (gensec_krb5_state->gssapi) {
 546                         unwrapped_out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
 547
 548                         /* wrap that up in a nice GSS-API wrapping */
 549                         *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REQ);
 550                 } else {
 551                         *out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
 552                 }
 553                 if (gensec_krb5_state->ap_req_options & AP_OPTS_MUTUAL_REQUIRED) {
 554                         gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_MUTUAL_AUTH;
 555                         nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 556                 } else {
 557                         gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 558                         nt_status = NT_STATUS_OK;
 559                 }
 560                 return nt_status;
 561         }
 562
 563         case GENSEC_KRB5_CLIENT_MUTUAL_AUTH:
 564         {
 565                 DATA_BLOB unwrapped_in;
 566                 krb5_data inbuf;
 567                 krb5_ap_rep_enc_part *repl = NULL;
 568                 uint8_t tok_id[2];
 569
 570                 if (gensec_krb5_state->gssapi) {
 571                         if (!gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
 572                                 DEBUG(1,("gensec_gssapi_parse_krb5_wrap(mutual authentication) failed to parse\n"));
 573                                 dump_data_pw("Mutual authentication message:\n", in.data, in.length);
 574                                 return NT_STATUS_INVALID_PARAMETER;
 575                         }
 576                 } else {
 577                         unwrapped_in = in;
 578                 }
 579                 /* TODO: check the tok_id */
 580
 581                 inbuf.data = (char *)unwrapped_in.data;
 582                 inbuf.length = unwrapped_in.length;
 583                 ret = krb5_rd_rep(gensec_krb5_state->smb_krb5_context->krb5_context,
 584                                   gensec_krb5_state->auth_context,
 585                                   &inbuf, &repl);
 586                 if (ret) {
 587                         DEBUG(1,("krb5_rd_rep (mutual authentication) failed (%s)\n",
 588                                  smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, out_mem_ctx)));
 589                         dump_data_pw("Mutual authentication message:\n", (uint8_t *)inbuf.data, inbuf.length);
 590                         nt_status = NT_STATUS_ACCESS_DENIED;
 591                 } else {
 592                         *out = data_blob(NULL, 0);
 593                         nt_status = NT_STATUS_OK;
 594                         gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 595                 }
 596                 if (repl) {
 597                         krb5_free_ap_rep_enc_part(gensec_krb5_state->smb_krb5_context->krb5_context, repl);
 598                 }
 599                 return nt_status;
 600         }
 601
 602         case GENSEC_KRB5_SERVER_START:
 603         {
 604                 DATA_BLOB unwrapped_in;
 605                 DATA_BLOB unwrapped_out = data_blob(NULL, 0);
 606                 krb5_data inbuf, outbuf;
 607                 uint8_t tok_id[2];
 608                 struct keytab_container *keytab;
 609                 krb5_principal server_in_keytab;
 610                 const char *error_string;
 611                 enum credentials_obtained obtained;
 612
 613                 if (!in.data) {
 614                         return NT_STATUS_INVALID_PARAMETER;
 615                 }
 616
 617                 /* Grab the keytab, however generated */
 618                 ret = cli_credentials_get_keytab(gensec_get_credentials(gensec_security),
 619                                                  gensec_security->settings->lp_ctx, &keytab);
 620                 if (ret) {
 621                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 622                 }
 623
 624                 /* This ensures we lookup the correct entry in that
 625                  * keytab.  A NULL principal is acceptable, and means
 626                  * that the krb5 libs should search the keytab at
 627                  * accept time for any matching key */
 628                 ret = principal_from_credentials(out_mem_ctx, gensec_get_credentials(gensec_security),
 629                                                  gensec_krb5_state->smb_krb5_context,
 630                                                  &server_in_keytab, &obtained, &error_string);
 631
 632                 if (ret) {
 633                         DEBUG(2,("Failed to make credentials from principal: %s\n", error_string));
 634                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 635                 }
 636
 637                 if (keytab->password_based || obtained < CRED_SPECIFIED) {
 638                         /*
 639                          * Use match-by-key in this case (matches
 640                          * cli_credentials_get_server_gss_creds()
 641                          * behaviour).  No need to free the memory,
 642                          * this is handled with a talloc destructor.
 643                          */
 644                         server_in_keytab = NULL;
 645                 }
 646
 647                 /* Parse the GSSAPI wrapping, if it's there... (win2k3 allows it to be omited) */
 648                 if (gensec_krb5_state->gssapi
 649                     && gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
 650                         inbuf.data = (char *)unwrapped_in.data;
 651                         inbuf.length = unwrapped_in.length;
 652                 } else {
 653                         inbuf.data = (char *)in.data;
 654                         inbuf.length = in.length;
 655                 }
 656
 657                 ret = smb_krb5_rd_req_decoded(gensec_krb5_state->smb_krb5_context->krb5_context,
 658                                               &gensec_krb5_state->auth_context,
 659                                               &inbuf,
 660                                               keytab->keytab,
 661                                               server_in_keytab,
 662                                               &outbuf,
 663                                               &gensec_krb5_state->ticket,
 664                                               &gensec_krb5_state->keyblock);
 665
 666                 if (ret) {
 667                         DBG_WARNING("smb_krb5_rd_req_decoded failed\n");
 668                         return NT_STATUS_LOGON_FAILURE;
 669                 }
 670                 unwrapped_out.data = (uint8_t *)outbuf.data;
 671                 unwrapped_out.length = outbuf.length;
 672                 gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 673                 /* wrap that up in a nice GSS-API wrapping */
 674                 if (gensec_krb5_state->gssapi) {
 675                         *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REP);
 676                 } else {
 677                         *out = data_blob_talloc(out_mem_ctx, outbuf.data, outbuf.length);
 678                 }
 679                 smb_krb5_free_data_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
 680                                             &outbuf);
 681                 return NT_STATUS_OK;
 682         }
 683
 684         case GENSEC_KRB5_DONE:
 685         default:
 686                 /* Asking too many times... */
 687                 return NT_STATUS_INVALID_PARAMETER;
 688         }
 689 }
 690
 691 static NTSTATUS gensec_krb5_session_key(struct gensec_security *gensec_security,
 692                                         TALLOC_CTX *mem_ctx,
 693                                         DATA_BLOB *session_key)
 694 {
 695         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 696         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 697         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 698         krb5_error_code err = -1;
 699         bool remote = false;
 700         bool ok;
 701
 702         if (gensec_krb5_state->state_position != GENSEC_KRB5_DONE) {
 703                 return NT_STATUS_NO_USER_SESSION_KEY;
 704         }
 705
 706         switch (gensec_security->gensec_role) {
 707         case GENSEC_CLIENT:
 708                 remote = false;
 709                 break;
 710         case GENSEC_SERVER:
 711                 remote = true;
 712                 break;
 713         }
 714
 715         ok = smb_krb5_get_smb_session_key(mem_ctx,
 716                                           context,
 717                                           auth_context,
 718                                           session_key,
 719                                           remote);
 720         if (!ok) {
 721                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 722                 return NT_STATUS_NO_USER_SESSION_KEY;
 723         }
 724
 725         return NT_STATUS_OK;
 726 }
 727
 728 #ifdef SAMBA4_USES_HEIMDAL
 729 static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security,
 730                                          TALLOC_CTX *mem_ctx,
 731                                          struct auth_session_info **_session_info)
 732 {
 733         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 734         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 735         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 736         struct auth_session_info *session_info = NULL;
 737
 738         krb5_principal client_principal;
 739         char *principal_string = NULL;
 740
 741         DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
 742         krb5_data pac_data;
 743
 744         krb5_error_code ret;
 745
 746         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 747         if (!tmp_ctx) {
 748                 return NT_STATUS_NO_MEMORY;
 749         }
 750
 751         ret = krb5_ticket_get_client(context, gensec_krb5_state->ticket, &client_principal);
 752         if (ret) {
 753                 DEBUG(5, ("krb5_ticket_get_client failed to get client principal: %s\n",
 754                           smb_get_krb5_error_message(context,
 755                                                      ret, tmp_ctx)));
 756                 talloc_free(tmp_ctx);
 757                 return NT_STATUS_NO_MEMORY;
 758         }
 759
 760         ret = krb5_unparse_name(gensec_krb5_state->smb_krb5_context->krb5_context,
 761                                 client_principal, &principal_string);
 762         if (ret) {
 763                 DEBUG(1, ("Unable to parse client principal: %s\n",
 764                           smb_get_krb5_error_message(context,
 765                                                      ret, tmp_ctx)));
 766                 krb5_free_principal(context, client_principal);
 767                 talloc_free(tmp_ctx);
 768                 return NT_STATUS_NO_MEMORY;
 769         }
 770
 771         ret = krb5_ticket_get_authorization_data_type(context, gensec_krb5_state->ticket,
 772                                                       KRB5_AUTHDATA_WIN2K_PAC,
 773                                                       &pac_data);
 774
 775         if (ret) {
 776                 /* NO pac */
 777                 DEBUG(5, ("krb5_ticket_get_authorization_data_type failed to find PAC: %s\n",
 778                           smb_get_krb5_error_message(context,
 779                                                      ret, tmp_ctx)));
 780         } else {
 781                 /* Found pac */
 782                 pac_blob = data_blob_talloc(tmp_ctx, pac_data.data, pac_data.length);
 783                 smb_krb5_free_data_contents(context, &pac_data);
 784                 if (!pac_blob.data) {
 785                         free(principal_string);
 786                         krb5_free_principal(context, client_principal);
 787                         talloc_free(tmp_ctx);
 788                         return NT_STATUS_NO_MEMORY;
 789                 }
 790
 791                 /* decode and verify the pac */
 792                 nt_status = kerberos_decode_pac(gensec_krb5_state,
 793                                                 pac_blob,
 794                                                 gensec_krb5_state->smb_krb5_context->krb5_context,
 795                                                 NULL, gensec_krb5_state->keyblock,
 796                                                 client_principal,
 797                                                 gensec_krb5_state->ticket->ticket.authtime, NULL);
 798
 799                 if (!NT_STATUS_IS_OK(nt_status)) {
 800                         free(principal_string);
 801                         krb5_free_principal(context, client_principal);
 802                         talloc_free(tmp_ctx);
 803                         return nt_status;
 804                 }
 805
 806                 pac_blob_ptr = &pac_blob;
 807         }
 808
 809         nt_status = gensec_generate_session_info_pac(tmp_ctx,
 810                                                      gensec_security,
 811                                                      gensec_krb5_state->smb_krb5_context,
 812                                                      pac_blob_ptr, principal_string,
 813                                                      gensec_get_remote_address(gensec_security),
 814                                                      &session_info);
 815
 816         free(principal_string);
 817         krb5_free_principal(context, client_principal);
 818
 819         if (!NT_STATUS_IS_OK(nt_status)) {
 820                 talloc_free(tmp_ctx);
 821                 return nt_status;
 822         }
 823
 824         nt_status = gensec_krb5_session_key(gensec_security, session_info, &session_info->session_key);
 825
 826         if (!NT_STATUS_IS_OK(nt_status)) {
 827                 talloc_free(tmp_ctx);
 828                 return nt_status;
 829         }
 830
 831         *_session_info = talloc_steal(mem_ctx, session_info);
 832
 833         talloc_free(tmp_ctx);
 834         return NT_STATUS_OK;
 835 }
 836 #else /* MIT KERBEROS */
 837 static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security,
 838                                          TALLOC_CTX *mem_ctx,
 839                                          struct auth_session_info **psession_info)
 840 {
 841         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 842         struct gensec_krb5_state *gensec_krb5_state =
 843                 (struct gensec_krb5_state *)gensec_security->private_data;
 844         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 845         struct auth_session_info *session_info = NULL;
 846
 847         krb5_principal client_principal;
 848         char *principal_string = NULL;
 849
 850         krb5_authdata **auth_pac_data = NULL;
 851         DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
 852
 853         krb5_error_code code;
 854
 855         TALLOC_CTX *tmp_ctx;
 856
 857         tmp_ctx = talloc_new(mem_ctx);
 858         if (tmp_ctx == NULL) {
 859                 return NT_STATUS_NO_MEMORY;
 860         }
 861
 862         code = krb5_copy_principal(context,
 863                                    gensec_krb5_state->ticket->enc_part2->client,
 864                                    &client_principal);
 865         if (code != 0) {
 866                 DBG_INFO("krb5_copy_principal failed to copy client "
 867                          "principal: %s\n",
 868                          smb_get_krb5_error_message(context, code, tmp_ctx));
 869                 talloc_free(tmp_ctx);
 870                 return NT_STATUS_NO_MEMORY;
 871         }
 872
 873         code = krb5_unparse_name(context, client_principal, &principal_string);
 874         if (code != 0) {
 875                 DBG_WARNING("Unable to parse client principal: %s\n",
 876                             smb_get_krb5_error_message(context, code, tmp_ctx));
 877                 krb5_free_principal(context, client_principal);
 878                 talloc_free(tmp_ctx);
 879                 return NT_STATUS_NO_MEMORY;
 880         }
 881
 882         code = krb5_find_authdata(context,
 883                                   gensec_krb5_state->ticket->enc_part2->authorization_data,
 884                                   NULL,
 885                                   KRB5_AUTHDATA_WIN2K_PAC,
 886                                   &auth_pac_data);
 887         if (code != 0) {
 888                 /* NO pac */
 889                 DBG_INFO("krb5_find_authdata failed to find PAC: %s\n",
 890                          smb_get_krb5_error_message(context, code, tmp_ctx));
 891         } else {
 892                 krb5_timestamp ticket_authtime =
 893                         gensec_krb5_state->ticket->enc_part2->times.authtime;
 894
 895                 /* Found pac */
 896                 pac_blob = data_blob_talloc(tmp_ctx,
 897                                             auth_pac_data[0]->contents,
 898                                             auth_pac_data[0]->length);
 899                 krb5_free_authdata(context, auth_pac_data);
 900                 if (pac_blob.data == NULL) {
 901                         free(principal_string);
 902                         krb5_free_principal(context, client_principal);
 903                         talloc_free(tmp_ctx);
 904                         return NT_STATUS_NO_MEMORY;
 905                 }
 906
 907                 /* decode and verify the pac */
 908                 status = kerberos_decode_pac(gensec_krb5_state,
 909                                              pac_blob,
 910                                              context,
 911                                              NULL,
 912                                              gensec_krb5_state->keyblock,
 913                                              client_principal,
 914                                              ticket_authtime,
 915                                              NULL);
 916
 917                 if (!NT_STATUS_IS_OK(status)) {
 918                         free(principal_string);
 919                         krb5_free_principal(context, client_principal);
 920                         talloc_free(tmp_ctx);
 921                         return status;
 922                 }
 923
 924                 pac_blob_ptr = &pac_blob;
 925         }
 926         krb5_free_principal(context, client_principal);
 927
 928         status = gensec_generate_session_info_pac(tmp_ctx,
 929                                                   gensec_security,
 930                                                   gensec_krb5_state->smb_krb5_context,
 931                                                   pac_blob_ptr,
 932                                                   principal_string,
 933                                                   gensec_get_remote_address(gensec_security),
 934                                                   &session_info);
 935         SAFE_FREE(principal_string);
 936         if (!NT_STATUS_IS_OK(status)) {
 937                 talloc_free(tmp_ctx);
 938                 return status;
 939         }
 940
 941         status = gensec_krb5_session_key(gensec_security,
 942                                          session_info,
 943                                          &session_info->session_key);
 944         if (!NT_STATUS_IS_OK(status)) {
 945                 talloc_free(tmp_ctx);
 946                 return status;
 947         }
 948
 949         *psession_info = talloc_steal(mem_ctx, session_info);
 950         talloc_free(tmp_ctx);
 951
 952         return NT_STATUS_OK;
 953 }
 954 #endif /* SAMBA4_USES_HEIMDAL */
 955
 956 static NTSTATUS gensec_krb5_wrap(struct gensec_security *gensec_security,
 957                                    TALLOC_CTX *mem_ctx,
 958                                    const DATA_BLOB *in,
 959                                    DATA_BLOB *out)
 960 {
 961         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 962         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 963         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 964         krb5_error_code ret;
 965         krb5_data input, output;
 966         input.length = in->length;
 967         input.data = (char *)in->data;
 968
 969         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 970                 ret = krb5_mk_priv(context, auth_context, &input, &output, NULL);
 971                 if (ret) {
 972                         DEBUG(1, ("krb5_mk_priv failed: %s\n",
 973                                   smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 974                                                              ret, mem_ctx)));
 975                         return NT_STATUS_ACCESS_DENIED;
 976                 }
 977                 *out = data_blob_talloc(mem_ctx, output.data, output.length);
 978
 979                 smb_krb5_free_data_contents(context, &output);
 980         } else {
 981                 return NT_STATUS_ACCESS_DENIED;
 982         }
 983         return NT_STATUS_OK;
 984 }
 985
 986 static NTSTATUS gensec_krb5_unwrap(struct gensec_security *gensec_security,
 987                                      TALLOC_CTX *mem_ctx,
 988                                      const DATA_BLOB *in,
 989                                      DATA_BLOB *out)
 990 {
 991         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 992         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 993         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 994         krb5_error_code ret;
 995         krb5_data input, output;
 996         krb5_replay_data replay;
 997         input.length = in->length;
 998         input.data = (char *)in->data;
 999
1000         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
1001                 ret = krb5_rd_priv(context, auth_context, &input, &output, &replay);
1002                 if (ret) {
1003                         DEBUG(1, ("krb5_rd_priv failed: %s\n",
1004                                   smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
1005                                                              ret, mem_ctx)));
1006                         return NT_STATUS_ACCESS_DENIED;
1007                 }
1008                 *out = data_blob_talloc(mem_ctx, output.data, output.length);
1009
1010                 smb_krb5_free_data_contents(context, &output);
1011         } else {
1012                 return NT_STATUS_ACCESS_DENIED;
1013         }
1014         return NT_STATUS_OK;
1015 }
1016
1017 static bool gensec_krb5_have_feature(struct gensec_security *gensec_security,
1018                                      uint32_t feature)
1019 {
1020         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
1021         if (feature & GENSEC_FEATURE_SESSION_KEY) {
1022                 return true;
1023         }
1024         if (gensec_krb5_state->gssapi) {
1025                 return false;
1026         }
1027
1028         /*
1029          * krb5_mk_priv provides SIGN and SEAL
1030          */
1031         if (feature & GENSEC_FEATURE_SIGN) {
1032                 return true;
1033         }
1034         if (feature & GENSEC_FEATURE_SEAL) {
1035                 return true;
1036         }
1037
1038         return false;
1039 }
1040
1041 static const char *gensec_krb5_oids[] = {
1042         GENSEC_OID_KERBEROS5,
1043         GENSEC_OID_KERBEROS5_OLD,
1044         NULL
1045 };
1046
1047 static const struct gensec_security_ops gensec_fake_gssapi_krb5_security_ops = {
1048         .name           = "fake_gssapi_krb5",
1049         .auth_type      = DCERPC_AUTH_TYPE_KRB5,
1050         .oid            = gensec_krb5_oids,
1051         .client_start   = gensec_fake_gssapi_krb5_client_start,
1052         .server_start   = gensec_fake_gssapi_krb5_server_start,
1053         .update         = gensec_krb5_update,
1054         .magic          = gensec_magic_check_krb5_oid,
1055         .session_key    = gensec_krb5_session_key,
1056         .session_info   = gensec_krb5_session_info,
1057         .have_feature   = gensec_krb5_have_feature,
1058         .enabled        = false,
1059         .kerberos       = true,
1060         .priority       = GENSEC_KRB5
1061 };
1062
1063 static const struct gensec_security_ops gensec_krb5_security_ops = {
1064         .name           = "krb5",
1065         .client_start   = gensec_krb5_client_start,
1066         .server_start   = gensec_krb5_server_start,
1067         .update         = gensec_krb5_update,
1068         .session_key    = gensec_krb5_session_key,
1069         .session_info   = gensec_krb5_session_info,
1070         .have_feature   = gensec_krb5_have_feature,
1071         .wrap           = gensec_krb5_wrap,
1072         .unwrap         = gensec_krb5_unwrap,
1073         .enabled        = true,
1074         .kerberos       = true,
1075         .priority       = GENSEC_KRB5
1076 };
1077
1078 _PUBLIC_ NTSTATUS gensec_krb5_init(void)
1079 {
1080         NTSTATUS ret;
1081
1082         ret = gensec_register(&gensec_krb5_security_ops);
1083         if (!NT_STATUS_IS_OK(ret)) {
1084                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1085                         gensec_krb5_security_ops.name));
1086                 return ret;
1087         }
1088
1089         ret = gensec_register(&gensec_fake_gssapi_krb5_security_ops);
1090         if (!NT_STATUS_IS_OK(ret)) {
1091                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1092                         gensec_fake_gssapi_krb5_security_ops.name));
1093                 return ret;
1094         }
1095
1096         return ret;
1097 }