The branch, master has been updated via 36fdb21 dcerpc-gssapi: add function to retrieve client name via d15d76a dcerpc-gssapi: add function to extract authtime via 6c80e04 dcerpc-gssapi: add function to extract authorization data (PAC) form gssapi context via fb1aef0 dcerpc-gssapi: add function to check flags via e6ed1dc dcerpc-gssapi: add initial server side code via b31f75d s3-dcerpc: add krb5 helpers from 26e2492 s3-krb: Reformat and add doxygen comment to decode_pac_data()
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 36fdb211a6f2cfa7c939dc40df5094019c6e977f Author: Simo Sorce <i...@samba.org> Date: Wed Aug 25 16:21:51 2010 -0400 dcerpc-gssapi: add function to retrieve client name Signed-off-by: Günther Deschner <g...@samba.org> commit d15d76af5f169d27eeecab909174b67f7b44d0ee Author: Simo Sorce <i...@samba.org> Date: Sat Aug 21 10:59:52 2010 -0400 dcerpc-gssapi: add function to extract authtime Signed-off-by: Günther Deschner <g...@samba.org> commit 6c80e04120542624438e4ca015bdaca45e4baee3 Author: Simo Sorce <i...@samba.org> Date: Fri Aug 20 09:30:49 2010 -0400 dcerpc-gssapi: add function to extract authorization data (PAC) form gssapi context Signed-off-by: Günther Deschner <g...@samba.org> commit fb1aef085e0ae52869bb3906e803e10951da5781 Author: Simo Sorce <i...@samba.org> Date: Fri Aug 20 09:31:07 2010 -0400 dcerpc-gssapi: add function to check flags Signed-off-by: Günther Deschner <g...@samba.org> commit e6ed1dc249f6a1a536efcd7519bc9d9bd5c180dd Author: Simo Sorce <i...@samba.org> Date: Fri Aug 20 04:45:56 2010 -0400 dcerpc-gssapi: add initial server side code Signed-off-by: Günther Deschner <g...@samba.org> commit b31f75d8f6dbfcad4438262eeb3ecda165f72fae Author: Simo Sorce <i...@samba.org> Date: Thu Aug 19 11:25:32 2010 -0400 s3-dcerpc: add krb5 helpers Signed-off-by: Günther Deschner <g...@samba.org> ----------------------------------------------------------------------- Summary of changes: source3/Makefile.in | 1 + source3/librpc/rpc/dcerpc_gssapi.c | 415 +++++++++++++++++++- source3/librpc/rpc/dcerpc_gssapi.h | 19 +- source3/librpc/rpc/dcerpc_krb5.c | 381 ++++++++++++++++++ .../rpc/dcerpc_krb5.h} | 20 +- 5 files changed, 812 insertions(+), 24 deletions(-) create mode 100644 source3/librpc/rpc/dcerpc_krb5.c copy source3/{printing/nt_printing_migrate.h => librpc/rpc/dcerpc_krb5.h} (69%) Changeset truncated at 500 lines: diff --git a/source3/Makefile.in b/source3/Makefile.in index 81f0ac9..4f0cbe7 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -597,6 +597,7 @@ LIBSMB_OBJ = libsmb/clientgen.o libsmb/cliconnect.o libsmb/clifile.o \ LIBMSRPC_OBJ = $(SCHANNEL_OBJ) \ rpc_client/cli_pipe.o \ + librpc/rpc/dcerpc_krb5.o \ librpc/rpc/dcerpc_gssapi.o \ librpc/rpc/dcerpc_spnego.o \ librpc/rpc/rpc_common.o \ diff --git a/source3/librpc/rpc/dcerpc_gssapi.c b/source3/librpc/rpc/dcerpc_gssapi.c index f2c657c..af94b66 100644 --- a/source3/librpc/rpc/dcerpc_gssapi.c +++ b/source3/librpc/rpc/dcerpc_gssapi.c @@ -1,6 +1,6 @@ /* * GSSAPI Security Extensions - * RPC Pipe client routines + * RPC Pipe client and server routines * Copyright (C) Simo Sorce 2010. * * This program is free software; you can redistribute it and/or modify @@ -22,7 +22,10 @@ #include "includes.h" #include "dcerpc_gssapi.h" -#if defined(HAVE_GSSAPI_GSSAPI_EXT_H) && defined(HAVE_GSS_WRAP_IOV) +#if defined(HAVE_KRB5) && defined(HAVE_GSSAPI_GSSAPI_EXT_H) && defined(HAVE_GSS_WRAP_IOV) + +#include "smb_krb5.h" +#include "dcerpc_krb5.h" #include <gssapi/gssapi.h> #include <gssapi/gssapi_krb5.h> @@ -33,33 +36,62 @@ #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05" #endif +gss_OID_desc gse_sesskey_inq_oid = { + GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH, + (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID +}; + #ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04" #endif -gss_OID_desc gse_sesskey_inq_oid = { GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH, - (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID }; -gss_OID_desc gse_sesskeytype_oid = { GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH, - (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID }; +gss_OID_desc gse_sesskeytype_oid = { + GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH, + (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID +}; + +#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12 +/* EXTRACTION OID AUTHZ ID */ +#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01" + +gss_OID_desc gse_authz_data_oid = { + GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH, + (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID +}; + +#ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID +#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11 +#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c" +#endif + +gss_OID_desc gse_authtime_oid = { + GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH, + (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID +}; static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min); struct gse_context { krb5_context k5ctx; krb5_ccache ccache; - - bool spnego_wrap; + krb5_keytab keytab; gss_ctx_id_t gss_ctx; - OM_uint32 gss_c_flags; gss_OID_desc gss_mech; - + OM_uint32 gss_c_flags; + gss_cred_id_t creds; gss_name_t server_name; - gss_cred_id_t cli_creds; + gss_OID ret_mech; + OM_uint32 ret_flags; + gss_cred_id_t delegated_creds; + gss_name_t client_name; + + bool spnego_wrap; bool more_processing; + bool authenticated; }; /* free non talloc dependent contexts */ @@ -74,6 +106,10 @@ static int gse_context_destructor(void *ptr) krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache); gse_ctx->ccache = NULL; } + if (gse_ctx->keytab) { + krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab); + gse_ctx->keytab = NULL; + } krb5_free_context(gse_ctx->k5ctx); gse_ctx->k5ctx = NULL; } @@ -86,7 +122,22 @@ static int gse_context_destructor(void *ptr) gss_maj = gss_release_name(&gss_min, &gse_ctx->server_name); } - + if (gse_ctx->client_name) { + gss_maj = gss_release_name(&gss_min, + &gse_ctx->client_name); + } + if (gse_ctx->creds) { + gss_maj = gss_release_cred(&gss_min, + &gse_ctx->creds); + } + if (gse_ctx->delegated_creds) { + gss_maj = gss_release_cred(&gss_min, + &gse_ctx->delegated_creds); + } + if (gse_ctx->ret_mech) { + gss_maj = gss_release_oid(&gss_min, + &gse_ctx->ret_mech); + } return 0; } @@ -231,7 +282,7 @@ NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx, GSS_C_INDEFINITE, &mech_set, GSS_C_INITIATE, - &gse_ctx->cli_creds, + &gse_ctx->creds, NULL, NULL); if (gss_maj) { DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n", @@ -266,7 +317,7 @@ NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, in_data.length = token_in->length; gss_maj = gss_init_sec_context(&gss_min, - gse_ctx->cli_creds, + gse_ctx->creds, &gse_ctx->gss_ctx, gse_ctx->server_name, &gse_ctx->gss_mech, @@ -305,6 +356,188 @@ done: return status; } +NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + uint32_t add_gss_c_flags, + const char *server, + const char *keytab_name, + struct gse_context **_gse_ctx) +{ + struct gse_context *gse_ctx; + OM_uint32 gss_maj, gss_min; + gss_OID_set_desc mech_set; + krb5_error_code ret; + const char *ktname; + NTSTATUS status; + + status = gse_context_init(mem_ctx, auth_type, auth_level, + NULL, add_gss_c_flags, &gse_ctx); + if (!NT_STATUS_IS_OK(status)) { + return NT_STATUS_NO_MEMORY; + } + + if (!keytab_name) { + ret = smb_krb5_get_server_keytab(gse_ctx->k5ctx, + &gse_ctx->keytab); + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx, + gse_ctx->keytab, &ktname); + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + } else { + ktname = keytab_name; + } + + /* FIXME!!! + * This call sets the default keytab for the whole server, not + * just for this context. Need to find a way that does not alter + * the state of the whole server ... */ + ret = gsskrb5_register_acceptor_identity(ktname); + if (ret) { + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + mech_set.count = 1; + mech_set.elements = &gse_ctx->gss_mech; + + gss_maj = gss_acquire_cred(&gss_min, + GSS_C_NO_NAME, + GSS_C_INDEFINITE, + &mech_set, + GSS_C_ACCEPT, + &gse_ctx->creds, + NULL, NULL); + if (gss_maj) { + DEBUG(0, ("gss_acquire_creds failed with [%s]\n", + gse_errstr(gse_ctx, gss_maj, gss_min))); + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + status = NT_STATUS_OK; + +done: + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(gse_ctx); + } + + *_gse_ctx = gse_ctx; + return status; +} + +NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + OM_uint32 gss_maj, gss_min; + gss_buffer_desc in_data; + gss_buffer_desc out_data; + DATA_BLOB blob = data_blob_null; + NTSTATUS status; + + in_data.value = token_in->data; + in_data.length = token_in->length; + + gss_maj = gss_accept_sec_context(&gss_min, + &gse_ctx->gss_ctx, + gse_ctx->creds, + &in_data, + GSS_C_NO_CHANNEL_BINDINGS, + &gse_ctx->client_name, + &gse_ctx->ret_mech, + &out_data, + &gse_ctx->ret_flags, NULL, + &gse_ctx->delegated_creds); + switch (gss_maj) { + case GSS_S_COMPLETE: + /* we are done with it */ + gse_ctx->more_processing = false; + gse_ctx->authenticated = true; + status = NT_STATUS_OK; + break; + case GSS_S_CONTINUE_NEEDED: + /* we will need a third leg */ + gse_ctx->more_processing = true; + /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */ + status = NT_STATUS_OK; + break; + default: + DEBUG(0, ("gss_init_sec_context failed with [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + + if (gse_ctx->gss_ctx) { + gss_delete_sec_context(&gss_min, + &gse_ctx->gss_ctx, + GSS_C_NO_BUFFER); + } + + status = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + /* we may be told to return nothing */ + if (out_data.length) { + blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length); + if (!blob.data) { + status = NT_STATUS_NO_MEMORY; + } + gss_maj = gss_release_buffer(&gss_min, &out_data); + } + + +done: + *token_out = blob; + return status; +} + +NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) +{ + if (!gse_ctx->authenticated) { + return NT_STATUS_INVALID_HANDLE; + } + + if (memcmp(gse_ctx->ret_mech, + gss_mech_krb5, sizeof(gss_OID_desc)) != 0) { + return NT_STATUS_ACCESS_DENIED; + } + + /* GSS_C_MUTUAL_FLAG */ + if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) { + if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) { + return NT_STATUS_ACCESS_DENIED; + } + } + + /* GSS_C_DELEG_FLAG */ + /* GSS_C_DELEG_POLICY_FLAG */ + /* GSS_C_REPLAY_FLAG */ + /* GSS_C_SEQUENCE_FLAG */ + + /* GSS_C_INTEG_FLAG */ + if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) { + if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) { + return NT_STATUS_ACCESS_DENIED; + } + } + + /* GSS_C_CONF_FLAG */ + if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) { + if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) { + return NT_STATUS_ACCESS_DENIED; + } + } + + return NT_STATUS_OK; +} + static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min) { OM_uint32 gss_min, gss_maj; @@ -396,6 +629,117 @@ DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, return ret; } +NTSTATUS gse_get_client_name(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, char **cli_name) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_desc name_buffer; + + if (!gse_ctx->authenticated) { + return NT_STATUS_ACCESS_DENIED; + } + + if (!gse_ctx->client_name) { + return NT_STATUS_NOT_FOUND; + } + + /* TODO: check OID matches KRB5 Principal Name OID ? */ + + gss_maj = gss_display_name(&gss_min, + gse_ctx->client_name, + &name_buffer, NULL); + if (gss_maj) { + DEBUG(0, ("gss_display_name failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return NT_STATUS_INTERNAL_ERROR; + } + + *cli_name = talloc_strndup(talloc_tos(), + (char *)name_buffer.value, + name_buffer.length); + + gss_maj = gss_release_buffer(&gss_min, &name_buffer); + + if (!*cli_name) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + +NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx, + TALLOC_CTX *mem_ctx, DATA_BLOB *pac) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; + + if (!gse_ctx->authenticated) { + return NT_STATUS_ACCESS_DENIED; + } + + gss_maj = gss_inquire_sec_context_by_oid( + &gss_min, gse_ctx->gss_ctx, + &gse_authz_data_oid, &set); + if (gss_maj) { + DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return NT_STATUS_NOT_FOUND; + } + + if (set == GSS_C_NO_BUFFER_SET) { + DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " + "data in results.\n")); + return NT_STATUS_INTERNAL_ERROR; + } + + /* for now we just hope it is the first value */ + *pac = data_blob_talloc(mem_ctx, + set->elements[0].value, + set->elements[0].length); + + gss_maj = gss_release_buffer_set(&gss_min, &set); + + return NT_STATUS_OK; +} + +NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime) +{ + OM_uint32 gss_min, gss_maj; + gss_buffer_set_t set = GSS_C_NO_BUFFER_SET; + int32_t tkttime; + + if (!gse_ctx->authenticated) { + return NT_STATUS_ACCESS_DENIED; + } + + gss_maj = gss_inquire_sec_context_by_oid( + &gss_min, gse_ctx->gss_ctx, + &gse_authtime_oid, &set); + if (gss_maj) { + DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n", + gse_errstr(talloc_tos(), gss_maj, gss_min))); + return NT_STATUS_NOT_FOUND; + } + + if ((set == GSS_C_NO_BUFFER_SET) || (set->count != 1) != 0) { + DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown " + "data in results.\n")); + return NT_STATUS_INTERNAL_ERROR; + } + + if (set->elements[0].length != sizeof(int32_t)) { + DEBUG(0, ("Invalid authtime size!\n")); + return NT_STATUS_INTERNAL_ERROR; + } + + tkttime = *((int32_t *)set->elements[0].value); + + gss_maj = gss_release_buffer_set(&gss_min, &set); + + *authtime = (time_t)tkttime; + return NT_STATUS_OK; +} + size_t gse_get_signature_length(struct gse_context *gse_ctx, int seal, size_t payload_size) { @@ -605,6 +949,30 @@ NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx, return NT_STATUS_NOT_IMPLEMENTED; } +NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx, + enum dcerpc_AuthType auth_type, + enum dcerpc_AuthLevel auth_level, + uint32_t add_gss_c_flags, + const char *server, + const char *keytab, + struct gse_context **_gse_ctx) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx, + struct gse_context *gse_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + bool gse_require_more_processing(struct gse_context *gse_ctx) { return false; @@ -616,6 +984,23 @@ DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx, -- Samba Shared Repository