source3/librpc/crypto/gse.c

   1 /*
   2  *  GSSAPI Security Extensions
   3  *  RPC Pipe client and server routines
   4  *  Copyright (C) Simo Sorce 2010.
   5  *  Copyright (C) Andrew Bartlett 2004-2011.
   6  *  Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 /* We support only GSSAPI/KRB5 here */
  23
  24 #include "includes.h"
  25 #include "gse.h"
  26 #include "libads/kerberos_proto.h"
  27 #include "auth/common_auth.h"
  28 #include "auth/gensec/gensec.h"
  29 #include "auth/gensec/gensec_internal.h"
  30 #include "auth/credentials/credentials.h"
  31 #include "../librpc/gen_ndr/dcerpc.h"
  32
  33 #if defined(HAVE_KRB5)
  34
  35 #include "auth/kerberos/pac_utils.h"
  36 #include "auth/kerberos/gssapi_helper.h"
  37 #include "gse_krb5.h"
  38
  39 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
  40 static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
  41                                   size_t data_size);
  42
  43 struct gse_context {
  44         gss_ctx_id_t gssapi_context;
  45         gss_name_t server_name;
  46         gss_name_t client_name;
  47         OM_uint32 gss_want_flags, gss_got_flags;
  48         size_t max_wrap_buf_size;
  49         size_t sig_size;
  50
  51         gss_cred_id_t delegated_cred_handle;
  52
  53         NTTIME expire_time;
  54
  55         /* gensec_gse only */
  56         krb5_context k5ctx;
  57         krb5_ccache ccache;
  58         krb5_keytab keytab;
  59
  60         gss_OID_desc gss_mech;
  61         gss_cred_id_t creds;
  62
  63         gss_OID ret_mech;
  64 };
  65
  66 /* free non talloc dependent contexts */
  67 static int gse_context_destructor(void *ptr)
  68 {
  69         struct gse_context *gse_ctx;
  70         OM_uint32 gss_min;
  71
  72         gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
  73         if (gse_ctx->k5ctx) {
  74                 if (gse_ctx->ccache) {
  75                         krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
  76                         gse_ctx->ccache = NULL;
  77                 }
  78                 if (gse_ctx->keytab) {
  79                         krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
  80                         gse_ctx->keytab = NULL;
  81                 }
  82                 krb5_free_context(gse_ctx->k5ctx);
  83                 gse_ctx->k5ctx = NULL;
  84         }
  85         if (gse_ctx->gssapi_context != GSS_C_NO_CONTEXT) {
  86                 (void)gss_delete_sec_context(&gss_min,
  87                                                  &gse_ctx->gssapi_context,
  88                                                  GSS_C_NO_BUFFER);
  89         }
  90         if (gse_ctx->server_name) {
  91                 (void)gss_release_name(&gss_min,
  92                                            &gse_ctx->server_name);
  93         }
  94         if (gse_ctx->client_name) {
  95                 (void)gss_release_name(&gss_min,
  96                                            &gse_ctx->client_name);
  97         }
  98         if (gse_ctx->creds) {
  99                 (void)gss_release_cred(&gss_min,
 100                                            &gse_ctx->creds);
 101         }
 102         if (gse_ctx->delegated_cred_handle) {
 103                 (void)gss_release_cred(&gss_min,
 104                                            &gse_ctx->delegated_cred_handle);
 105         }
 106
 107         /* MIT and Heimdal differ as to if you can call
 108          * gss_release_oid() on this OID, generated by
 109          * gss_{accept,init}_sec_context().  However, as long as the
 110          * oid is gss_mech_krb5 (which it always is at the moment),
 111          * then this is a moot point, as both declare this particular
 112          * OID static, and so no memory is lost.  This assert is in
 113          * place to ensure that the programmer who wishes to extend
 114          * this code to EAP or other GSS mechanisms determines an
 115          * implementation-dependent way of releasing any dynamically
 116          * allocated OID */
 117         SMB_ASSERT(smb_gss_oid_equal(&gse_ctx->gss_mech, GSS_C_NO_OID) ||
 118                    smb_gss_oid_equal(&gse_ctx->gss_mech, gss_mech_krb5));
 119
 120         return 0;
 121 }
 122
 123 static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
 124                                  bool do_sign, bool do_seal,
 125                                  const char *ccache_name,
 126                                  uint32_t add_gss_c_flags,
 127                                  struct gse_context **_gse_ctx)
 128 {
 129         struct gse_context *gse_ctx;
 130         krb5_error_code k5ret;
 131         NTSTATUS status;
 132
 133         gse_ctx = talloc_zero(mem_ctx, struct gse_context);
 134         if (!gse_ctx) {
 135                 return NT_STATUS_NO_MEMORY;
 136         }
 137         talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
 138
 139         gse_ctx->expire_time = GENSEC_EXPIRE_TIME_INFINITY;
 140         gse_ctx->max_wrap_buf_size = UINT16_MAX;
 141
 142         memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
 143
 144         gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
 145                                 GSS_C_DELEG_POLICY_FLAG |
 146                                 GSS_C_REPLAY_FLAG |
 147                                 GSS_C_SEQUENCE_FLAG;
 148         if (do_sign) {
 149                 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
 150         }
 151         if (do_seal) {
 152                 gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
 153                 gse_ctx->gss_want_flags |= GSS_C_CONF_FLAG;
 154         }
 155
 156         gse_ctx->gss_want_flags |= add_gss_c_flags;
 157
 158         /* Initialize Kerberos Context */
 159         initialize_krb5_error_table();
 160
 161         k5ret = krb5_init_context(&gse_ctx->k5ctx);
 162         if (k5ret) {
 163                 DEBUG(0, ("Failed to initialize kerberos context! (%s)\n",
 164                           error_message(k5ret)));
 165                 status = NT_STATUS_INTERNAL_ERROR;
 166                 goto err_out;
 167         }
 168
 169         if (!ccache_name) {
 170                 ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
 171         }
 172         k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
 173                                 &gse_ctx->ccache);
 174         if (k5ret) {
 175                 DEBUG(1, ("Failed to resolve credential cache '%s'! (%s)\n",
 176                           ccache_name, error_message(k5ret)));
 177                 status = NT_STATUS_INTERNAL_ERROR;
 178                 goto err_out;
 179         }
 180
 181         /* TODO: Should we enforce a enc_types list ?
 182         ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
 183         */
 184
 185         *_gse_ctx = gse_ctx;
 186         return NT_STATUS_OK;
 187
 188 err_out:
 189         TALLOC_FREE(gse_ctx);
 190         return status;
 191 }
 192
 193 static NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
 194                                 bool do_sign, bool do_seal,
 195                                 const char *ccache_name,
 196                                 const char *server,
 197                                 const char *service,
 198                                 const char *realm,
 199                                 const char *username,
 200                                 const char *password,
 201                                 uint32_t add_gss_c_flags,
 202                                 struct gse_context **_gse_ctx)
 203 {
 204         struct gse_context *gse_ctx;
 205         OM_uint32 gss_maj, gss_min;
 206         gss_buffer_desc name_buffer = GSS_C_EMPTY_BUFFER;
 207 #ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
 208         gss_buffer_desc empty_buffer = GSS_C_EMPTY_BUFFER;
 209         gss_OID oid = discard_const(GSS_KRB5_CRED_NO_CI_FLAGS_X);
 210 #endif
 211         NTSTATUS status;
 212
 213         if (!server || !service) {
 214                 return NT_STATUS_INVALID_PARAMETER;
 215         }
 216
 217         status = gse_context_init(mem_ctx, do_sign, do_seal,
 218                                   ccache_name, add_gss_c_flags,
 219                                   &gse_ctx);
 220         if (!NT_STATUS_IS_OK(status)) {
 221                 return NT_STATUS_NO_MEMORY;
 222         }
 223
 224         /* Guess the realm based on the supplied service, and avoid the GSS libs
 225            doing DNS lookups which may fail.
 226
 227            TODO: Loop with the KDC on some more combinations (local
 228            realm in particular), possibly falling back to
 229            GSS_C_NT_HOSTBASED_SERVICE
 230         */
 231         name_buffer.value =
 232                 smb_krb5_get_principal_from_service_hostname(gse_ctx,
 233                                                              service,
 234                                                              server,
 235                                                              realm);
 236         if (!name_buffer.value) {
 237                 status = NT_STATUS_NO_MEMORY;
 238                 goto err_out;
 239         }
 240         name_buffer.length = strlen((char *)name_buffer.value);
 241         gss_maj = gss_import_name(&gss_min, &name_buffer,
 242                                   GSS_C_NT_USER_NAME,
 243                                   &gse_ctx->server_name);
 244         if (gss_maj) {
 245                 DEBUG(5, ("gss_import_name failed for %s, with [%s]\n",
 246                           (char *)name_buffer.value,
 247                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 248                 status = NT_STATUS_INTERNAL_ERROR;
 249                 goto err_out;
 250         }
 251
 252         /* TODO: get krb5 ticket using username/password, if no valid
 253          * one already available in ccache */
 254
 255         gss_maj = smb_gss_krb5_import_cred(&gss_min,
 256                                            gse_ctx->k5ctx,
 257                                            gse_ctx->ccache,
 258                                            NULL, /* keytab_principal */
 259                                            NULL, /* keytab */
 260                                            &gse_ctx->creds);
 261         if (gss_maj) {
 262                 char *ccache = NULL;
 263                 int kret;
 264
 265                 kret = krb5_cc_get_full_name(gse_ctx->k5ctx,
 266                                              gse_ctx->ccache,
 267                                              &ccache);
 268                 if (kret != 0) {
 269                         ccache = NULL;
 270                 }
 271
 272                 DEBUG(5, ("smb_gss_krb5_import_cred ccache[%s] failed with [%s] -"
 273                           "the caller may retry after a kinit.\n",
 274                           ccache, gse_errstr(gse_ctx, gss_maj, gss_min)));
 275                 SAFE_FREE(ccache);
 276                 status = NT_STATUS_INTERNAL_ERROR;
 277                 goto err_out;
 278         }
 279
 280 #ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
 281         /*
 282          * Don't force GSS_C_CONF_FLAG and GSS_C_INTEG_FLAG.
 283          *
 284          * This allows us to disable SIGN and SEAL for
 285          * AUTH_LEVEL_CONNECT and AUTH_LEVEL_INTEGRITY.
 286          *
 287          * https://groups.yahoo.com/neo/groups/cat-ietf/conversations/topics/575
 288          * http://krbdev.mit.edu/rt/Ticket/Display.html?id=6938
 289          */
 290         gss_maj = gss_set_cred_option(&gss_min, &gse_ctx->creds,
 291                                       oid,
 292                                       &empty_buffer);
 293         if (gss_maj) {
 294                 DEBUG(0, ("gss_set_cred_option(GSS_KRB5_CRED_NO_CI_FLAGS_X), "
 295                           "failed with [%s]\n",
 296                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 297                 status = NT_STATUS_INTERNAL_ERROR;
 298                 goto err_out;
 299         }
 300 #endif
 301
 302         *_gse_ctx = gse_ctx;
 303         TALLOC_FREE(name_buffer.value);
 304         return NT_STATUS_OK;
 305
 306 err_out:
 307         TALLOC_FREE(name_buffer.value);
 308         TALLOC_FREE(gse_ctx);
 309         return status;
 310 }
 311
 312 static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
 313                                           struct gse_context *gse_ctx,
 314                                           const DATA_BLOB *token_in,
 315                                           DATA_BLOB *token_out)
 316 {
 317         OM_uint32 gss_maj, gss_min;
 318         gss_buffer_desc in_data;
 319         gss_buffer_desc out_data;
 320         DATA_BLOB blob = data_blob_null;
 321         NTSTATUS status;
 322         OM_uint32 time_rec = 0;
 323         struct timeval tv;
 324
 325         in_data.value = token_in->data;
 326         in_data.length = token_in->length;
 327
 328         gss_maj = gss_init_sec_context(&gss_min,
 329                                         gse_ctx->creds,
 330                                         &gse_ctx->gssapi_context,
 331                                         gse_ctx->server_name,
 332                                         &gse_ctx->gss_mech,
 333                                         gse_ctx->gss_want_flags,
 334                                         0, GSS_C_NO_CHANNEL_BINDINGS,
 335                                         &in_data, NULL, &out_data,
 336                                         &gse_ctx->gss_got_flags, &time_rec);
 337         switch (gss_maj) {
 338         case GSS_S_COMPLETE:
 339                 /* we are done with it */
 340                 tv = timeval_current_ofs(time_rec, 0);
 341                 gse_ctx->expire_time = timeval_to_nttime(&tv);
 342
 343                 status = NT_STATUS_OK;
 344                 break;
 345         case GSS_S_CONTINUE_NEEDED:
 346                 /* we will need a third leg */
 347                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 348                 break;
 349         case GSS_S_CONTEXT_EXPIRED:
 350                 /* Make SPNEGO ignore us, we can't go any further here */
 351                 DBG_NOTICE("Context expired\n");
 352                 status = NT_STATUS_INVALID_PARAMETER;
 353                 goto done;
 354         case GSS_S_FAILURE:
 355                 switch (gss_min) {
 356                 case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
 357                         DBG_NOTICE("Server principal not found\n");
 358                         /* Make SPNEGO ignore us, we can't go any further here */
 359                         status = NT_STATUS_INVALID_PARAMETER;
 360                         goto done;
 361                 case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED:
 362                         DBG_NOTICE("Ticket expired\n");
 363                         /* Make SPNEGO ignore us, we can't go any further here */
 364                         status = NT_STATUS_INVALID_PARAMETER;
 365                         goto done;
 366                 case (OM_uint32)KRB5KRB_AP_ERR_TKT_NYV:
 367                         DBG_NOTICE("Clockskew\n");
 368                         /* Make SPNEGO ignore us, we can't go any further here */
 369                         status = NT_STATUS_TIME_DIFFERENCE_AT_DC;
 370                         goto done;
 371                 case (OM_uint32)KRB5_KDC_UNREACH:
 372                         DBG_NOTICE("KDC unreachable\n");
 373                         /* Make SPNEGO ignore us, we can't go any further here */
 374                         status = NT_STATUS_NO_LOGON_SERVERS;
 375                         goto done;
 376                 case (OM_uint32)KRB5KRB_AP_ERR_MSG_TYPE:
 377                         /* Garbage input, possibly from the auto-mech detection */
 378                         status = NT_STATUS_INVALID_PARAMETER;
 379                         goto done;
 380                 default:
 381                         DBG_ERR("gss_init_sec_context failed with [%s](%u)\n",
 382                                 gse_errstr(talloc_tos(), gss_maj, gss_min),
 383                                 gss_min);
 384                         status = NT_STATUS_LOGON_FAILURE;
 385                         goto done;
 386                 }
 387                 break;
 388         default:
 389                 DBG_ERR("gss_init_sec_context failed with [%s]\n",
 390                         gse_errstr(talloc_tos(), gss_maj, gss_min));
 391                 status = NT_STATUS_INTERNAL_ERROR;
 392                 goto done;
 393         }
 394
 395         /* we may be told to return nothing */
 396         if (out_data.length) {
 397                 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
 398                 if (!blob.data) {
 399                         status = NT_STATUS_NO_MEMORY;
 400                 }
 401
 402                 gss_maj = gss_release_buffer(&gss_min, &out_data);
 403         }
 404
 405 done:
 406         *token_out = blob;
 407         return status;
 408 }
 409
 410 static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
 411                                 bool do_sign, bool do_seal,
 412                                 uint32_t add_gss_c_flags,
 413                                 struct gse_context **_gse_ctx)
 414 {
 415         struct gse_context *gse_ctx;
 416         OM_uint32 gss_maj, gss_min;
 417         krb5_error_code ret;
 418         NTSTATUS status;
 419
 420         status = gse_context_init(mem_ctx, do_sign, do_seal,
 421                                   NULL, add_gss_c_flags, &gse_ctx);
 422         if (!NT_STATUS_IS_OK(status)) {
 423                 return NT_STATUS_NO_MEMORY;
 424         }
 425
 426         ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
 427                                          &gse_ctx->keytab);
 428         if (ret) {
 429                 status = NT_STATUS_INTERNAL_ERROR;
 430                 goto done;
 431         }
 432
 433         /* This creates a GSSAPI cred_id_t with the keytab set */
 434         gss_maj = smb_gss_krb5_import_cred(&gss_min, gse_ctx->k5ctx,
 435                                            NULL, NULL, gse_ctx->keytab,
 436                                            &gse_ctx->creds);
 437
 438         if (gss_maj != 0) {
 439                 DEBUG(0, ("smb_gss_krb5_import_cred failed with [%s]\n",
 440                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 441                 status = NT_STATUS_INTERNAL_ERROR;
 442                 goto done;
 443         }
 444
 445         status = NT_STATUS_OK;
 446
 447 done:
 448         if (!NT_STATUS_IS_OK(status)) {
 449                 TALLOC_FREE(gse_ctx);
 450         }
 451
 452         *_gse_ctx = gse_ctx;
 453         return status;
 454 }
 455
 456 static NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
 457                                           struct gse_context *gse_ctx,
 458                                           const DATA_BLOB *token_in,
 459                                           DATA_BLOB *token_out)
 460 {
 461         OM_uint32 gss_maj, gss_min;
 462         gss_buffer_desc in_data;
 463         gss_buffer_desc out_data;
 464         DATA_BLOB blob = data_blob_null;
 465         NTSTATUS status;
 466         OM_uint32 time_rec = 0;
 467         struct timeval tv;
 468
 469         in_data.value = token_in->data;
 470         in_data.length = token_in->length;
 471
 472         gss_maj = gss_accept_sec_context(&gss_min,
 473                                          &gse_ctx->gssapi_context,
 474                                          gse_ctx->creds,
 475                                          &in_data,
 476                                          GSS_C_NO_CHANNEL_BINDINGS,
 477                                          &gse_ctx->client_name,
 478                                          &gse_ctx->ret_mech,
 479                                          &out_data,
 480                                          &gse_ctx->gss_got_flags,
 481                                          &time_rec,
 482                                          &gse_ctx->delegated_cred_handle);
 483         switch (gss_maj) {
 484         case GSS_S_COMPLETE:
 485                 /* we are done with it */
 486                 tv = timeval_current_ofs(time_rec, 0);
 487                 gse_ctx->expire_time = timeval_to_nttime(&tv);
 488
 489                 status = NT_STATUS_OK;
 490                 break;
 491         case GSS_S_CONTINUE_NEEDED:
 492                 /* we will need a third leg */
 493                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 494                 break;
 495         default:
 496                 DEBUG(1, ("gss_accept_sec_context failed with [%s]\n",
 497                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 498
 499                 if (gse_ctx->gssapi_context) {
 500                         gss_delete_sec_context(&gss_min,
 501                                                 &gse_ctx->gssapi_context,
 502                                                 GSS_C_NO_BUFFER);
 503                 }
 504
 505                 /*
 506                  * If we got an output token, make Windows aware of it
 507                  * by telling it that more processing is needed
 508                  */
 509                 if (out_data.length > 0) {
 510                         status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 511                         /* Fall through to handle the out token */
 512                 } else {
 513                         status = NT_STATUS_LOGON_FAILURE;
 514                         goto done;
 515                 }
 516         }
 517
 518         /* we may be told to return nothing */
 519         if (out_data.length) {
 520                 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
 521                 if (!blob.data) {
 522                         status = NT_STATUS_NO_MEMORY;
 523                 }
 524                 gss_maj = gss_release_buffer(&gss_min, &out_data);
 525         }
 526
 527
 528 done:
 529         *token_out = blob;
 530         return status;
 531 }
 532
 533 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
 534 {
 535         OM_uint32 gss_min, gss_maj;
 536         gss_buffer_desc msg_min;
 537         gss_buffer_desc msg_maj;
 538         OM_uint32 msg_ctx = 0;
 539
 540         char *errstr = NULL;
 541
 542         ZERO_STRUCT(msg_min);
 543         ZERO_STRUCT(msg_maj);
 544
 545         gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
 546                                      GSS_C_NO_OID, &msg_ctx, &msg_maj);
 547         if (gss_maj) {
 548                 goto done;
 549         }
 550         errstr = talloc_strndup(mem_ctx,
 551                                 (char *)msg_maj.value,
 552                                         msg_maj.length);
 553         if (!errstr) {
 554                 goto done;
 555         }
 556         gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
 557                                      (gss_OID)discard_const(gss_mech_krb5),
 558                                      &msg_ctx, &msg_min);
 559         if (gss_maj) {
 560                 goto done;
 561         }
 562
 563         errstr = talloc_strdup_append_buffer(errstr, ": ");
 564         if (!errstr) {
 565                 goto done;
 566         }
 567         errstr = talloc_strndup_append_buffer(errstr,
 568                                                 (char *)msg_min.value,
 569                                                         msg_min.length);
 570         if (!errstr) {
 571                 goto done;
 572         }
 573
 574 done:
 575         if (msg_min.value) {
 576                 gss_maj = gss_release_buffer(&gss_min, &msg_min);
 577         }
 578         if (msg_maj.value) {
 579                 gss_maj = gss_release_buffer(&gss_min, &msg_maj);
 580         }
 581         return errstr;
 582 }
 583
 584 static NTSTATUS gensec_gse_client_start(struct gensec_security *gensec_security)
 585 {
 586         struct gse_context *gse_ctx;
 587         struct cli_credentials *creds = gensec_get_credentials(gensec_security);
 588         NTSTATUS nt_status;
 589         OM_uint32 want_flags = 0;
 590         bool do_sign = false, do_seal = false;
 591         const char *hostname = gensec_get_target_hostname(gensec_security);
 592         const char *service = gensec_get_target_service(gensec_security);
 593         const char *username = cli_credentials_get_username(creds);
 594         const char *password = cli_credentials_get_password(creds);
 595         const char *realm = cli_credentials_get_realm(creds);
 596
 597         if (!hostname) {
 598                 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
 599                 return NT_STATUS_INVALID_PARAMETER;
 600         }
 601         if (is_ipaddress(hostname)) {
 602                 DEBUG(2, ("Cannot do GSE to an IP address\n"));
 603                 return NT_STATUS_INVALID_PARAMETER;
 604         }
 605         if (strcmp(hostname, "localhost") == 0) {
 606                 DEBUG(2, ("GSE to 'localhost' does not make sense\n"));
 607                 return NT_STATUS_INVALID_PARAMETER;
 608         }
 609
 610         if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
 611                 do_sign = true;
 612         }
 613         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
 614                 do_sign = true;
 615         }
 616         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
 617                 do_seal = true;
 618         }
 619         if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
 620                 want_flags |= GSS_C_DCE_STYLE;
 621         }
 622
 623         nt_status = gse_init_client(gensec_security, do_sign, do_seal, NULL,
 624                                     hostname, service, realm,
 625                                     username, password, want_flags,
 626                                     &gse_ctx);
 627         if (!NT_STATUS_IS_OK(nt_status)) {
 628                 return nt_status;
 629         }
 630         gensec_security->private_data = gse_ctx;
 631         return NT_STATUS_OK;
 632 }
 633
 634 static NTSTATUS gensec_gse_server_start(struct gensec_security *gensec_security)
 635 {
 636         struct gse_context *gse_ctx;
 637         NTSTATUS nt_status;
 638         OM_uint32 want_flags = 0;
 639         bool do_sign = false, do_seal = false;
 640
 641         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
 642                 do_sign = true;
 643         }
 644         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
 645                 do_seal = true;
 646         }
 647         if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
 648                 want_flags |= GSS_C_DCE_STYLE;
 649         }
 650
 651         nt_status = gse_init_server(gensec_security, do_sign, do_seal, want_flags,
 652                                     &gse_ctx);
 653         if (!NT_STATUS_IS_OK(nt_status)) {
 654                 return nt_status;
 655         }
 656         gensec_security->private_data = gse_ctx;
 657         return NT_STATUS_OK;
 658 }
 659
 660 /**
 661  * Next state function for the GSE GENSEC mechanism
 662  *
 663  * @param gensec_gse_state GSE State
 664  * @param mem_ctx The TALLOC_CTX for *out to be allocated on
 665  * @param in The request, as a DATA_BLOB
 666  * @param out The reply, as an talloc()ed DATA_BLOB, on *mem_ctx
 667  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 668  *                or NT_STATUS_OK if the user is authenticated.
 669  */
 670
 671 static NTSTATUS gensec_gse_update(struct gensec_security *gensec_security,
 672                                   TALLOC_CTX *mem_ctx,
 673                                   struct tevent_context *ev,
 674                                   const DATA_BLOB in, DATA_BLOB *out)
 675 {
 676         NTSTATUS status;
 677         struct gse_context *gse_ctx =
 678                 talloc_get_type_abort(gensec_security->private_data,
 679                 struct gse_context);
 680
 681         switch (gensec_security->gensec_role) {
 682         case GENSEC_CLIENT:
 683                 status = gse_get_client_auth_token(mem_ctx, gse_ctx,
 684                                                    &in, out);
 685                 break;
 686         case GENSEC_SERVER:
 687                 status = gse_get_server_auth_token(mem_ctx, gse_ctx,
 688                                                    &in, out);
 689                 break;
 690         }
 691         if (!NT_STATUS_IS_OK(status)) {
 692                 return status;
 693         }
 694
 695         return NT_STATUS_OK;
 696 }
 697
 698 static NTSTATUS gensec_gse_wrap(struct gensec_security *gensec_security,
 699                                 TALLOC_CTX *mem_ctx,
 700                                 const DATA_BLOB *in,
 701                                 DATA_BLOB *out)
 702 {
 703         struct gse_context *gse_ctx =
 704                 talloc_get_type_abort(gensec_security->private_data,
 705                 struct gse_context);
 706         OM_uint32 maj_stat, min_stat;
 707         gss_buffer_desc input_token, output_token;
 708         int conf_state;
 709         input_token.length = in->length;
 710         input_token.value = in->data;
 711
 712         maj_stat = gss_wrap(&min_stat,
 713                             gse_ctx->gssapi_context,
 714                             gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
 715                             GSS_C_QOP_DEFAULT,
 716                             &input_token,
 717                             &conf_state,
 718                             &output_token);
 719         if (GSS_ERROR(maj_stat)) {
 720                 DEBUG(0, ("gensec_gse_wrap: GSS Wrap failed: %s\n",
 721                           gse_errstr(talloc_tos(), maj_stat, min_stat)));
 722                 return NT_STATUS_ACCESS_DENIED;
 723         }
 724
 725         *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
 726         gss_release_buffer(&min_stat, &output_token);
 727
 728         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 729             && !conf_state) {
 730                 return NT_STATUS_ACCESS_DENIED;
 731         }
 732         return NT_STATUS_OK;
 733 }
 734
 735 static NTSTATUS gensec_gse_unwrap(struct gensec_security *gensec_security,
 736                                      TALLOC_CTX *mem_ctx,
 737                                      const DATA_BLOB *in,
 738                                      DATA_BLOB *out)
 739 {
 740         struct gse_context *gse_ctx =
 741                 talloc_get_type_abort(gensec_security->private_data,
 742                 struct gse_context);
 743         OM_uint32 maj_stat, min_stat;
 744         gss_buffer_desc input_token, output_token;
 745         int conf_state;
 746         gss_qop_t qop_state;
 747         input_token.length = in->length;
 748         input_token.value = in->data;
 749
 750         maj_stat = gss_unwrap(&min_stat,
 751                               gse_ctx->gssapi_context,
 752                               &input_token,
 753                               &output_token,
 754                               &conf_state,
 755                               &qop_state);
 756         if (GSS_ERROR(maj_stat)) {
 757                 DEBUG(0, ("gensec_gse_unwrap: GSS UnWrap failed: %s\n",
 758                           gse_errstr(talloc_tos(), maj_stat, min_stat)));
 759                 return NT_STATUS_ACCESS_DENIED;
 760         }
 761
 762         *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
 763         gss_release_buffer(&min_stat, &output_token);
 764
 765         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 766             && !conf_state) {
 767                 return NT_STATUS_ACCESS_DENIED;
 768         }
 769         return NT_STATUS_OK;
 770 }
 771
 772 static NTSTATUS gensec_gse_seal_packet(struct gensec_security *gensec_security,
 773                                        TALLOC_CTX *mem_ctx,
 774                                        uint8_t *data, size_t length,
 775                                        const uint8_t *whole_pdu, size_t pdu_length,
 776                                        DATA_BLOB *sig)
 777 {
 778         struct gse_context *gse_ctx =
 779                 talloc_get_type_abort(gensec_security->private_data,
 780                 struct gse_context);
 781         bool hdr_signing = false;
 782         size_t sig_size = 0;
 783         NTSTATUS status;
 784
 785         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
 786                 hdr_signing = true;
 787         }
 788
 789         sig_size = gensec_gse_sig_size(gensec_security, length);
 790
 791         status = gssapi_seal_packet(gse_ctx->gssapi_context,
 792                                     &gse_ctx->gss_mech,
 793                                     hdr_signing, sig_size,
 794                                     data, length,
 795                                     whole_pdu, pdu_length,
 796                                     mem_ctx, sig);
 797         if (!NT_STATUS_IS_OK(status)) {
 798                 DEBUG(0, ("gssapi_seal_packet(hdr_signing=%u,sig_size=%zu,"
 799                           "data=%zu,pdu=%zu) failed: %s\n",
 800                           hdr_signing, sig_size, length, pdu_length,
 801                           nt_errstr(status)));
 802                 return status;
 803         }
 804
 805         return NT_STATUS_OK;
 806 }
 807
 808 static NTSTATUS gensec_gse_unseal_packet(struct gensec_security *gensec_security,
 809                                          uint8_t *data, size_t length,
 810                                          const uint8_t *whole_pdu, size_t pdu_length,
 811                                          const DATA_BLOB *sig)
 812 {
 813         struct gse_context *gse_ctx =
 814                 talloc_get_type_abort(gensec_security->private_data,
 815                 struct gse_context);
 816         bool hdr_signing = false;
 817         NTSTATUS status;
 818
 819         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
 820                 hdr_signing = true;
 821         }
 822
 823         status = gssapi_unseal_packet(gse_ctx->gssapi_context,
 824                                       &gse_ctx->gss_mech,
 825                                       hdr_signing,
 826                                       data, length,
 827                                       whole_pdu, pdu_length,
 828                                       sig);
 829         if (!NT_STATUS_IS_OK(status)) {
 830                 DEBUG(0, ("gssapi_unseal_packet(hdr_signing=%u,sig_size=%zu,"
 831                           "data=%zu,pdu=%zu) failed: %s\n",
 832                           hdr_signing, sig->length, length, pdu_length,
 833                           nt_errstr(status)));
 834                 return status;
 835         }
 836
 837         return NT_STATUS_OK;
 838 }
 839
 840 static NTSTATUS gensec_gse_sign_packet(struct gensec_security *gensec_security,
 841                                        TALLOC_CTX *mem_ctx,
 842                                        const uint8_t *data, size_t length,
 843                                        const uint8_t *whole_pdu, size_t pdu_length,
 844                                        DATA_BLOB *sig)
 845 {
 846         struct gse_context *gse_ctx =
 847                 talloc_get_type_abort(gensec_security->private_data,
 848                 struct gse_context);
 849         bool hdr_signing = false;
 850         NTSTATUS status;
 851
 852         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
 853                 hdr_signing = true;
 854         }
 855
 856         status = gssapi_sign_packet(gse_ctx->gssapi_context,
 857                                     &gse_ctx->gss_mech,
 858                                     hdr_signing,
 859                                     data, length,
 860                                     whole_pdu, pdu_length,
 861                                     mem_ctx, sig);
 862         if (!NT_STATUS_IS_OK(status)) {
 863                 DEBUG(0, ("gssapi_sign_packet(hdr_signing=%u,"
 864                           "data=%zu,pdu=%zu) failed: %s\n",
 865                           hdr_signing, length, pdu_length,
 866                           nt_errstr(status)));
 867                 return status;
 868         }
 869
 870         return NT_STATUS_OK;
 871 }
 872
 873 static NTSTATUS gensec_gse_check_packet(struct gensec_security *gensec_security,
 874                                         const uint8_t *data, size_t length,
 875                                         const uint8_t *whole_pdu, size_t pdu_length,
 876                                         const DATA_BLOB *sig)
 877 {
 878         struct gse_context *gse_ctx =
 879                 talloc_get_type_abort(gensec_security->private_data,
 880                 struct gse_context);
 881         bool hdr_signing = false;
 882         NTSTATUS status;
 883
 884         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
 885                 hdr_signing = true;
 886         }
 887
 888         status = gssapi_check_packet(gse_ctx->gssapi_context,
 889                                      &gse_ctx->gss_mech,
 890                                      hdr_signing,
 891                                      data, length,
 892                                      whole_pdu, pdu_length,
 893                                      sig);
 894         if (!NT_STATUS_IS_OK(status)) {
 895                 DEBUG(0, ("gssapi_check_packet(hdr_signing=%u,sig_size=%zu"
 896                           "data=%zu,pdu=%zu) failed: %s\n",
 897                           hdr_signing, sig->length, length, pdu_length,
 898                           nt_errstr(status)));
 899                 return status;
 900         }
 901
 902         return NT_STATUS_OK;
 903 }
 904
 905 /* Try to figure out what features we actually got on the connection */
 906 static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
 907                                     uint32_t feature)
 908 {
 909         struct gse_context *gse_ctx =
 910                 talloc_get_type_abort(gensec_security->private_data,
 911                 struct gse_context);
 912
 913         if (feature & GENSEC_FEATURE_SESSION_KEY) {
 914                 return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
 915         }
 916         if (feature & GENSEC_FEATURE_SIGN) {
 917                 return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
 918         }
 919         if (feature & GENSEC_FEATURE_SEAL) {
 920                 return gse_ctx->gss_got_flags & GSS_C_CONF_FLAG;
 921         }
 922         if (feature & GENSEC_FEATURE_DCE_STYLE) {
 923                 return gse_ctx->gss_got_flags & GSS_C_DCE_STYLE;
 924         }
 925         if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
 926                 NTSTATUS status;
 927                 uint32_t keytype;
 928
 929                 if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
 930                         return false;
 931                 }
 932
 933                 status = gssapi_get_session_key(talloc_tos(),
 934                                                 gse_ctx->gssapi_context, NULL, &keytype);
 935                 /*
 936                  * We should do a proper sig on the mechListMic unless
 937                  * we know we have to be backwards compatible with
 938                  * earlier windows versions.
 939                  *
 940                  * Negotiating a non-krb5
 941                  * mech for example should be regarded as having
 942                  * NEW_SPNEGO
 943                  */
 944                 if (NT_STATUS_IS_OK(status)) {
 945                         switch (keytype) {
 946                         case ENCTYPE_DES_CBC_CRC:
 947                         case ENCTYPE_DES_CBC_MD5:
 948                         case ENCTYPE_ARCFOUR_HMAC:
 949                         case ENCTYPE_DES3_CBC_SHA1:
 950                                 return false;
 951                         }
 952                 }
 953                 return true;
 954         }
 955         /* We can always do async (rather than strict request/reply) packets.  */
 956         if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
 957                 return true;
 958         }
 959         if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
 960                 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
 961                         return true;
 962                 }
 963
 964                 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
 965                         return true;
 966                 }
 967
 968                 return false;
 969         }
 970         return false;
 971 }
 972
 973 static NTTIME gensec_gse_expire_time(struct gensec_security *gensec_security)
 974 {
 975         struct gse_context *gse_ctx =
 976                 talloc_get_type_abort(gensec_security->private_data,
 977                 struct gse_context);
 978
 979         return gse_ctx->expire_time;
 980 }
 981
 982 /*
 983  * Extract the 'sesssion key' needed by SMB signing and ncacn_np
 984  * (for encrypting some passwords).
 985  *
 986  * This breaks all the abstractions, but what do you expect...
 987  */
 988 static NTSTATUS gensec_gse_session_key(struct gensec_security *gensec_security,
 989                                        TALLOC_CTX *mem_ctx,
 990                                        DATA_BLOB *session_key)
 991 {
 992         struct gse_context *gse_ctx =
 993                 talloc_get_type_abort(gensec_security->private_data,
 994                 struct gse_context);
 995
 996         return gssapi_get_session_key(mem_ctx, gse_ctx->gssapi_context, session_key, NULL);
 997 }
 998
 999 /* Get some basic (and authorization) information about the user on
1000  * this session.  This uses either the PAC (if present) or a local
1001  * database lookup */
1002 static NTSTATUS gensec_gse_session_info(struct gensec_security *gensec_security,
1003                                         TALLOC_CTX *mem_ctx,
1004                                         struct auth_session_info **_session_info)
1005 {
1006         struct gse_context *gse_ctx =
1007                 talloc_get_type_abort(gensec_security->private_data,
1008                 struct gse_context);
1009         NTSTATUS nt_status;
1010         TALLOC_CTX *tmp_ctx;
1011         struct auth_session_info *session_info = NULL;
1012         OM_uint32 maj_stat, min_stat;
1013         DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
1014
1015         gss_buffer_desc name_token;
1016         char *principal_string;
1017
1018         tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gse_session_info context");
1019         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1020
1021         maj_stat = gss_display_name(&min_stat,
1022                                     gse_ctx->client_name,
1023                                     &name_token,
1024                                     NULL);
1025         if (GSS_ERROR(maj_stat)) {
1026                 DEBUG(1, ("GSS display_name failed: %s\n",
1027                           gse_errstr(talloc_tos(), maj_stat, min_stat)));
1028                 talloc_free(tmp_ctx);
1029                 return NT_STATUS_FOOBAR;
1030         }
1031
1032         principal_string = talloc_strndup(tmp_ctx,
1033                                           (const char *)name_token.value,
1034                                           name_token.length);
1035
1036         gss_release_buffer(&min_stat, &name_token);
1037
1038         if (!principal_string) {
1039                 talloc_free(tmp_ctx);
1040                 return NT_STATUS_NO_MEMORY;
1041         }
1042
1043         nt_status = gssapi_obtain_pac_blob(tmp_ctx,  gse_ctx->gssapi_context,
1044                                            gse_ctx->client_name,
1045                                            &pac_blob);
1046
1047         /* IF we have the PAC - otherwise we need to get this
1048          * data from elsewere
1049          */
1050         if (NT_STATUS_IS_OK(nt_status)) {
1051                 pac_blob_ptr = &pac_blob;
1052         }
1053         nt_status = gensec_generate_session_info_pac(tmp_ctx,
1054                                                      gensec_security,
1055                                                      NULL,
1056                                                      pac_blob_ptr, principal_string,
1057                                                      gensec_get_remote_address(gensec_security),
1058                                                      &session_info);
1059         if (!NT_STATUS_IS_OK(nt_status)) {
1060                 talloc_free(tmp_ctx);
1061                 return nt_status;
1062         }
1063
1064         nt_status = gensec_gse_session_key(gensec_security, session_info,
1065                                            &session_info->session_key);
1066         if (!NT_STATUS_IS_OK(nt_status)) {
1067                 talloc_free(tmp_ctx);
1068                 return nt_status;
1069         }
1070
1071         *_session_info = talloc_move(mem_ctx, &session_info);
1072         talloc_free(tmp_ctx);
1073
1074         return NT_STATUS_OK;
1075 }
1076
1077 static size_t gensec_gse_max_input_size(struct gensec_security *gensec_security)
1078 {
1079         struct gse_context *gse_ctx =
1080                 talloc_get_type_abort(gensec_security->private_data,
1081                 struct gse_context);
1082         OM_uint32 maj_stat, min_stat;
1083         OM_uint32 max_input_size;
1084
1085         maj_stat = gss_wrap_size_limit(&min_stat,
1086                                        gse_ctx->gssapi_context,
1087                                        gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
1088                                        GSS_C_QOP_DEFAULT,
1089                                        gse_ctx->max_wrap_buf_size,
1090                                        &max_input_size);
1091         if (GSS_ERROR(maj_stat)) {
1092                 TALLOC_CTX *mem_ctx = talloc_new(NULL);
1093                 DEBUG(1, ("gensec_gssapi_max_input_size: determining signature size with gss_wrap_size_limit failed: %s\n",
1094                           gse_errstr(mem_ctx, maj_stat, min_stat)));
1095                 talloc_free(mem_ctx);
1096                 return 0;
1097         }
1098
1099         return max_input_size;
1100 }
1101
1102 /* Find out the maximum output size negotiated on this connection */
1103 static size_t gensec_gse_max_wrapped_size(struct gensec_security *gensec_security)
1104 {
1105         struct gse_context *gse_ctx =
1106                 talloc_get_type_abort(gensec_security->private_data,
1107                 struct gse_context);
1108         return gse_ctx->max_wrap_buf_size;
1109 }
1110
1111 static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
1112                                   size_t data_size)
1113 {
1114         struct gse_context *gse_ctx =
1115                 talloc_get_type_abort(gensec_security->private_data,
1116                 struct gse_context);
1117
1118         if (gse_ctx->sig_size > 0) {
1119                 return gse_ctx->sig_size;
1120         }
1121
1122         gse_ctx->sig_size = gssapi_get_sig_size(gse_ctx->gssapi_context,
1123                                                 &gse_ctx->gss_mech,
1124                                                 gse_ctx->gss_got_flags,
1125                                                 data_size);
1126         return gse_ctx->sig_size;
1127 }
1128
1129 static const char *gensec_gse_krb5_oids[] = {
1130         GENSEC_OID_KERBEROS5_OLD,
1131         GENSEC_OID_KERBEROS5,
1132         NULL
1133 };
1134
1135 const struct gensec_security_ops gensec_gse_krb5_security_ops = {
1136         .name           = "gse_krb5",
1137         .auth_type      = DCERPC_AUTH_TYPE_KRB5,
1138         .oid            = gensec_gse_krb5_oids,
1139         .client_start   = gensec_gse_client_start,
1140         .server_start   = gensec_gse_server_start,
1141         .magic          = gensec_magic_check_krb5_oid,
1142         .update         = gensec_gse_update,
1143         .session_key    = gensec_gse_session_key,
1144         .session_info   = gensec_gse_session_info,
1145         .sig_size       = gensec_gse_sig_size,
1146         .sign_packet    = gensec_gse_sign_packet,
1147         .check_packet   = gensec_gse_check_packet,
1148         .seal_packet    = gensec_gse_seal_packet,
1149         .unseal_packet  = gensec_gse_unseal_packet,
1150         .max_input_size   = gensec_gse_max_input_size,
1151         .max_wrapped_size = gensec_gse_max_wrapped_size,
1152         .wrap           = gensec_gse_wrap,
1153         .unwrap         = gensec_gse_unwrap,
1154         .have_feature   = gensec_gse_have_feature,
1155         .expire_time    = gensec_gse_expire_time,
1156         .enabled        = true,
1157         .kerberos       = true,
1158         .priority       = GENSEC_GSSAPI
1159 };
1160
1161 #endif /* HAVE_KRB5 */