source3/libaddns/dnsgss.c

   1 /*
   2   Public Interface file for Linux DNS client library implementation
   3
   4   Copyright (C) 2006 Krishna Ganugapati <krishnag@centeris.com>
   5   Copyright (C) 2006 Gerald Carter <jerry@samba.org>
   6
   7      ** NOTE! The following LGPL license applies to the libaddns
   8      ** library. This does NOT imply that all of Samba is released
   9      ** under the LGPL
  10
  11   This library is free software; you can redistribute it and/or
  12   modify it under the terms of the GNU Lesser General Public
  13   License as published by the Free Software Foundation; either
  14   version 2.1 of the License, or (at your option) any later version.
  15
  16   This library is distributed in the hope that it will be useful,
  17   but WITHOUT ANY WARRANTY; without even the implied warranty of
  18   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19   Lesser General Public License for more details.
  20
  21   You should have received a copy of the GNU Lesser General Public
  22   License along with this library; if not, write to the Free Software
  23   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  24   02110-1301  USA
  25 */
  26
  27 #include "dns.h"
  28 #include <ctype.h>
  29
  30
  31 #ifdef HAVE_GSSAPI_SUPPORT
  32
  33 /*********************************************************************
  34 *********************************************************************/
  35
  36 static int strupr( char *szDomainName )
  37 {
  38         if ( !szDomainName ) {
  39                 return ( 0 );
  40         }
  41         while ( *szDomainName != '\0' ) {
  42                 *szDomainName = toupper( *szDomainName );
  43                 szDomainName++;
  44         }
  45         return ( 0 );
  46 }
  47
  48 #if 0
  49 /*********************************************************************
  50 *********************************************************************/
  51
  52 static void display_status_1( const char *m, OM_uint32 code, int type )
  53 {
  54         OM_uint32 maj_stat, min_stat;
  55         gss_buffer_desc msg;
  56         OM_uint32 msg_ctx;
  57
  58         msg_ctx = 0;
  59         while ( 1 ) {
  60                 maj_stat = gss_display_status( &min_stat, code,
  61                                                type, GSS_C_NULL_OID,
  62                                                &msg_ctx, &msg );
  63                 fprintf( stdout, "GSS-API error %s: %s\n", m,
  64                          ( char * ) msg.value );
  65                 ( void ) gss_release_buffer( &min_stat, &msg );
  66
  67                 if ( !msg_ctx )
  68                         break;
  69         }
  70 }
  71
  72 /*********************************************************************
  73 *********************************************************************/
  74
  75 void display_status( const char *msg, OM_uint32 maj_stat, OM_uint32 min_stat )
  76 {
  77         display_status_1( msg, maj_stat, GSS_C_GSS_CODE );
  78         display_status_1( msg, min_stat, GSS_C_MECH_CODE );
  79 }
  80 #endif
  81
  82 static DNS_ERROR dns_negotiate_gss_ctx_int( TALLOC_CTX *mem_ctx,
  83                                             struct dns_connection *conn,
  84                                             const char *keyname,
  85                                             const gss_name_t target_name,
  86                                             gss_ctx_id_t *ctx,
  87                                             enum dns_ServerType srv_type )
  88 {
  89         struct gss_buffer_desc_struct input_desc, *input_ptr, output_desc;
  90         OM_uint32 major, minor;
  91         OM_uint32 ret_flags;
  92         DNS_ERROR err;
  93
  94         gss_OID_desc krb5_oid_desc =
  95                 { 9, (char *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
  96
  97         *ctx = GSS_C_NO_CONTEXT;
  98         input_ptr = NULL;
  99
 100         do {
 101                 major = gss_init_sec_context(
 102                         &minor, NULL, ctx, target_name, &krb5_oid_desc,
 103                         GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG |
 104                         GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG |
 105                         GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG,
 106                         0, NULL, input_ptr, NULL, &output_desc,
 107                         &ret_flags, NULL );
 108
 109                 if (input_ptr != NULL) {
 110                         TALLOC_FREE(input_desc.value);
 111                 }
 112
 113                 if (output_desc.length != 0) {
 114
 115                         struct dns_request *req;
 116                         struct dns_rrec *rec;
 117                         struct dns_buffer *buf;
 118
 119                         time_t t = time(NULL);
 120
 121                         err = dns_create_query(mem_ctx, keyname, QTYPE_TKEY,
 122                                                DNS_CLASS_IN, &req);
 123                         if (!ERR_DNS_IS_OK(err)) goto error;
 124
 125                         err = dns_create_tkey_record(
 126                                 req, keyname, "gss.microsoft.com", t,
 127                                 t + 86400, DNS_TKEY_MODE_GSSAPI, 0,
 128                                 output_desc.length, (uint8 *)output_desc.value,
 129                                 &rec );
 130                         if (!ERR_DNS_IS_OK(err)) goto error;
 131
 132                         /* Windows 2000 DNS is broken and requires the
 133                            TKEY payload in the Answer section instead
 134                            of the Additional seciton like Windows 2003 */
 135
 136                         if ( srv_type == DNS_SRV_WIN2000 ) {
 137                                 err = dns_add_rrec(req, rec, &req->num_answers,
 138                                                    &req->answers);
 139                         } else {
 140                                 err = dns_add_rrec(req, rec, &req->num_additionals,
 141                                                    &req->additionals);
 142                         }
 143
 144                         if (!ERR_DNS_IS_OK(err)) goto error;
 145
 146                         err = dns_marshall_request(req, req, &buf);
 147                         if (!ERR_DNS_IS_OK(err)) goto error;
 148
 149                         err = dns_send(conn, buf);
 150                         if (!ERR_DNS_IS_OK(err)) goto error;
 151
 152                         TALLOC_FREE(req);
 153                 }
 154
 155                 gss_release_buffer(&minor, &output_desc);
 156
 157                 if ((major != GSS_S_COMPLETE) &&
 158                     (major != GSS_S_CONTINUE_NEEDED)) {
 159                         return ERROR_DNS_GSS_ERROR;
 160                 }
 161
 162                 if (major == GSS_S_CONTINUE_NEEDED) {
 163
 164                         struct dns_request *resp;
 165                         struct dns_buffer *buf;
 166                         struct dns_tkey_record *tkey;
 167
 168                         err = dns_receive(mem_ctx, conn, &buf);
 169                         if (!ERR_DNS_IS_OK(err)) goto error;
 170
 171                         err = dns_unmarshall_request(buf, buf, &resp);
 172                         if (!ERR_DNS_IS_OK(err)) goto error;
 173
 174                         /*
 175                          * TODO: Compare id and keyname
 176                          */
 177
 178                         if ((resp->num_additionals != 1) ||
 179                             (resp->num_answers == 0) ||
 180                             (resp->answers[0]->type != QTYPE_TKEY)) {
 181                                 err = ERROR_DNS_INVALID_MESSAGE;
 182                                 goto error;
 183                         }
 184
 185                         err = dns_unmarshall_tkey_record(
 186                                 mem_ctx, resp->answers[0], &tkey);
 187                         if (!ERR_DNS_IS_OK(err)) goto error;
 188
 189                         input_desc.length = tkey->key_length;
 190                         input_desc.value = talloc_move(mem_ctx, &tkey->key);
 191
 192                         input_ptr = &input_desc;
 193
 194                         TALLOC_FREE(buf);
 195                 }
 196
 197         } while ( major == GSS_S_CONTINUE_NEEDED );
 198
 199         /* If we arrive here, we have a valid security context */
 200
 201         err = ERROR_DNS_SUCCESS;
 202
 203       error:
 204
 205         return err;
 206 }
 207
 208 DNS_ERROR dns_negotiate_sec_ctx( const char *target_realm,
 209                                  const char *servername,
 210                                  const char *keyname,
 211                                  gss_ctx_id_t *gss_ctx,
 212                                  enum dns_ServerType srv_type )
 213 {
 214         OM_uint32 major, minor;
 215
 216         char *upcaserealm, *targetname;
 217         DNS_ERROR err;
 218
 219         gss_buffer_desc input_name;
 220         struct dns_connection *conn;
 221
 222         gss_name_t targ_name;
 223
 224         krb5_principal host_principal;
 225         krb5_context krb_ctx = NULL;
 226
 227         gss_OID_desc nt_host_oid_desc =
 228                 { 10, (char *)"\052\206\110\206\367\022\001\002\002\002" };
 229
 230         TALLOC_CTX *mem_ctx;
 231
 232         if (!(mem_ctx = talloc_init("dns_negotiate_sec_ctx"))) {
 233                 return ERROR_DNS_NO_MEMORY;
 234         }
 235
 236         err = dns_open_connection( servername, DNS_TCP, mem_ctx, &conn );
 237         if (!ERR_DNS_IS_OK(err)) goto error;
 238
 239         if (!(upcaserealm = talloc_strdup(mem_ctx, target_realm))) {
 240                 err = ERROR_DNS_NO_MEMORY;
 241                 goto error;
 242         }
 243
 244         strupr(upcaserealm);
 245
 246         if (!(targetname = talloc_asprintf(mem_ctx, "dns/%s@%s",
 247                                            servername, upcaserealm))) {
 248                 err = ERROR_DNS_NO_MEMORY;
 249                 goto error;
 250         }
 251
 252         krb5_init_context( &krb_ctx );
 253         krb5_parse_name( krb_ctx, targetname, &host_principal );
 254
 255         input_name.value = &host_principal;
 256         input_name.length = sizeof( host_principal );
 257
 258         major = gss_import_name( &minor, &input_name,
 259                                  &nt_host_oid_desc, &targ_name );
 260
 261         if (major) {
 262                 krb5_free_principal( krb_ctx, host_principal );
 263                 krb5_free_context( krb_ctx );
 264                 err = ERROR_DNS_GSS_ERROR;
 265                 goto error;
 266         }
 267
 268         err = dns_negotiate_gss_ctx_int(mem_ctx, conn, keyname,
 269                                         targ_name, gss_ctx, srv_type );
 270
 271         gss_release_name( &minor, &targ_name );
 272         krb5_free_principal( krb_ctx, host_principal );
 273         krb5_free_context( krb_ctx );
 274
 275  error:
 276         TALLOC_FREE(mem_ctx);
 277
 278         return err;
 279 }
 280
 281 DNS_ERROR dns_sign_update(struct dns_update_request *req,
 282                           gss_ctx_id_t gss_ctx,
 283                           const char *keyname,
 284                           const char *algorithmname,
 285                           time_t time_signed, uint16 fudge)
 286 {
 287         struct dns_buffer *buf;
 288         DNS_ERROR err;
 289         struct dns_domain_name *key, *algorithm;
 290         struct gss_buffer_desc_struct msg, mic;
 291         OM_uint32 major, minor;
 292         struct dns_rrec *rec;
 293
 294         err = dns_marshall_update_request(req, req, &buf);
 295         if (!ERR_DNS_IS_OK(err)) return err;
 296
 297         err = dns_domain_name_from_string(buf, keyname, &key);
 298         if (!ERR_DNS_IS_OK(err)) goto error;
 299
 300         err = dns_domain_name_from_string(buf, algorithmname, &algorithm);
 301         if (!ERR_DNS_IS_OK(err)) goto error;
 302
 303         dns_marshall_domain_name(buf, key);
 304         dns_marshall_uint16(buf, DNS_CLASS_ANY);
 305         dns_marshall_uint32(buf, 0); /* TTL */
 306         dns_marshall_domain_name(buf, algorithm);
 307         dns_marshall_uint16(buf, 0); /* Time prefix for 48-bit time_t */
 308         dns_marshall_uint32(buf, time_signed);
 309         dns_marshall_uint16(buf, fudge);
 310         dns_marshall_uint16(buf, 0); /* error */
 311         dns_marshall_uint16(buf, 0); /* other len */
 312
 313         err = buf->error;
 314         if (!ERR_DNS_IS_OK(buf->error)) goto error;
 315
 316         msg.value = (void *)buf->data;
 317         msg.length = buf->offset;
 318
 319         major = gss_get_mic(&minor, gss_ctx, 0, &msg, &mic);
 320         if (major != 0) {
 321                 err = ERROR_DNS_GSS_ERROR;
 322                 goto error;
 323         }
 324
 325         if (mic.length > 0xffff) {
 326                 gss_release_buffer(&minor, &mic);
 327                 err = ERROR_DNS_GSS_ERROR;
 328                 goto error;
 329         }
 330
 331         err = dns_create_tsig_record(buf, keyname, algorithmname, time_signed,
 332                                      fudge, mic.length, (uint8 *)mic.value,
 333                                      req->id, 0, &rec);
 334         gss_release_buffer(&minor, &mic);
 335         if (!ERR_DNS_IS_OK(err)) goto error;
 336
 337         err = dns_add_rrec(req, rec, &req->num_additionals, &req->additionals);
 338
 339  error:
 340         TALLOC_FREE(buf);
 341         return err;
 342 }
 343
 344 #endif  /* HAVE_GSSAPI_SUPPORT */