source3/librpc/rpc/dcerpc_helpers.c

   1 /*
   2  *  DCERPC Helper routines
   3  *  Günther Deschner <gd@samba.org> 2010.
   4  *  Simo Sorce <idra@samba.org> 2010.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20
  21 #include "includes.h"
  22 #include "librpc/rpc/dcerpc.h"
  23 #include "librpc/gen_ndr/ndr_dcerpc.h"
  24 #include "librpc/gen_ndr/ndr_schannel.h"
  25 #include "../libcli/auth/schannel.h"
  26 #include "../libcli/auth/spnego.h"
  27 #include "../libcli/auth/ntlmssp.h"
  28 #include "ntlmssp_wrap.h"
  29 #include "librpc/crypto/gse.h"
  30 #include "librpc/crypto/spnego.h"
  31
  32 #undef DBGC_CLASS
  33 #define DBGC_CLASS DBGC_RPC_PARSE
  34
  35 /**
  36 * @brief NDR Encodes a ncacn_packet
  37 *
  38 * @param mem_ctx        The memory context the blob will be allocated on
  39 * @param ptype          The DCERPC packet type
  40 * @param pfc_flags      The DCERPC PFC Falgs
  41 * @param auth_length    The length of the trailing auth blob
  42 * @param call_id        The call ID
  43 * @param u              The payload of the packet
  44 * @param blob [out]     The encoded blob if successful
  45 *
  46 * @return an NTSTATUS error code
  47 */
  48 NTSTATUS dcerpc_push_ncacn_packet(TALLOC_CTX *mem_ctx,
  49                                   enum dcerpc_pkt_type ptype,
  50                                   uint8_t pfc_flags,
  51                                   uint16_t auth_length,
  52                                   uint32_t call_id,
  53                                   union dcerpc_payload *u,
  54                                   DATA_BLOB *blob)
  55 {
  56         struct ncacn_packet r;
  57         enum ndr_err_code ndr_err;
  58
  59         r.rpc_vers              = 5;
  60         r.rpc_vers_minor        = 0;
  61         r.ptype                 = ptype;
  62         r.pfc_flags             = pfc_flags;
  63         r.drep[0]               = DCERPC_DREP_LE;
  64         r.drep[1]               = 0;
  65         r.drep[2]               = 0;
  66         r.drep[3]               = 0;
  67         r.auth_length           = auth_length;
  68         r.call_id               = call_id;
  69         r.u                     = *u;
  70
  71         ndr_err = ndr_push_struct_blob(blob, mem_ctx, &r,
  72                 (ndr_push_flags_fn_t)ndr_push_ncacn_packet);
  73         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
  74                 return ndr_map_error2ntstatus(ndr_err);
  75         }
  76
  77         dcerpc_set_frag_length(blob, blob->length);
  78
  79
  80         if (DEBUGLEVEL >= 10) {
  81                 /* set frag len for print function */
  82                 r.frag_length = blob->length;
  83                 NDR_PRINT_DEBUG(ncacn_packet, &r);
  84         }
  85
  86         return NT_STATUS_OK;
  87 }
  88
  89 /**
  90 * @brief Decodes a ncacn_packet
  91 *
  92 * @param mem_ctx        The memory context on which to allocate the packet
  93 *                       elements
  94 * @param blob           The blob of data to decode
  95 * @param r              An empty ncacn_packet, must not be NULL
  96 * @param bigendian      Whether the packet is bignedian encoded
  97 *
  98 * @return a NTSTATUS error code
  99 */
 100 NTSTATUS dcerpc_pull_ncacn_packet(TALLOC_CTX *mem_ctx,
 101                                   const DATA_BLOB *blob,
 102                                   struct ncacn_packet *r,
 103                                   bool bigendian)
 104 {
 105         enum ndr_err_code ndr_err;
 106         struct ndr_pull *ndr;
 107
 108         ndr = ndr_pull_init_blob(blob, mem_ctx);
 109         if (!ndr) {
 110                 return NT_STATUS_NO_MEMORY;
 111         }
 112         if (bigendian) {
 113                 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
 114         }
 115
 116         ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, r);
 117
 118         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 119                 talloc_free(ndr);
 120                 return ndr_map_error2ntstatus(ndr_err);
 121         }
 122         talloc_free(ndr);
 123
 124         if (DEBUGLEVEL >= 10) {
 125                 NDR_PRINT_DEBUG(ncacn_packet, r);
 126         }
 127
 128         return NT_STATUS_OK;
 129 }
 130
 131 /**
 132 * @brief NDR Encodes a NL_AUTH_MESSAGE
 133 *
 134 * @param mem_ctx        The memory context the blob will be allocated on
 135 * @param r              The NL_AUTH_MESSAGE to encode
 136 * @param blob [out]     The encoded blob if successful
 137 *
 138 * @return a NTSTATUS error code
 139 */
 140 NTSTATUS dcerpc_push_schannel_bind(TALLOC_CTX *mem_ctx,
 141                                    struct NL_AUTH_MESSAGE *r,
 142                                    DATA_BLOB *blob)
 143 {
 144         enum ndr_err_code ndr_err;
 145
 146         ndr_err = ndr_push_struct_blob(blob, mem_ctx, r,
 147                 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 148         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 149                 return ndr_map_error2ntstatus(ndr_err);
 150         }
 151
 152         if (DEBUGLEVEL >= 10) {
 153                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, r);
 154         }
 155
 156         return NT_STATUS_OK;
 157 }
 158
 159 /**
 160 * @brief NDR Encodes a dcerpc_auth structure
 161 *
 162 * @param mem_ctx          The memory context the blob will be allocated on
 163 * @param auth_type        The DCERPC Authentication Type
 164 * @param auth_level       The DCERPC Authentication Level
 165 * @param auth_pad_length  The padding added to the packet this blob will be
 166 *                          appended to.
 167 * @param auth_context_id  The context id
 168 * @param credentials      The authentication credentials blob (signature)
 169 * @param blob [out]       The encoded blob if successful
 170 *
 171 * @return a NTSTATUS error code
 172 */
 173 NTSTATUS dcerpc_push_dcerpc_auth(TALLOC_CTX *mem_ctx,
 174                                  enum dcerpc_AuthType auth_type,
 175                                  enum dcerpc_AuthLevel auth_level,
 176                                  uint8_t auth_pad_length,
 177                                  uint32_t auth_context_id,
 178                                  const DATA_BLOB *credentials,
 179                                  DATA_BLOB *blob)
 180 {
 181         struct dcerpc_auth r;
 182         enum ndr_err_code ndr_err;
 183
 184         r.auth_type             = auth_type;
 185         r.auth_level            = auth_level;
 186         r.auth_pad_length       = auth_pad_length;
 187         r.auth_reserved         = 0;
 188         r.auth_context_id       = auth_context_id;
 189         r.credentials           = *credentials;
 190
 191         ndr_err = ndr_push_struct_blob(blob, mem_ctx, &r,
 192                 (ndr_push_flags_fn_t)ndr_push_dcerpc_auth);
 193         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 194                 return ndr_map_error2ntstatus(ndr_err);
 195         }
 196
 197         if (DEBUGLEVEL >= 10) {
 198                 NDR_PRINT_DEBUG(dcerpc_auth, &r);
 199         }
 200
 201         return NT_STATUS_OK;
 202 }
 203
 204 /**
 205 * @brief Decodes a dcerpc_auth blob
 206 *
 207 * @param mem_ctx        The memory context on which to allocate the packet
 208 *                       elements
 209 * @param blob           The blob of data to decode
 210 * @param r              An empty dcerpc_auth structure, must not be NULL
 211 *
 212 * @return a NTSTATUS error code
 213 */
 214 NTSTATUS dcerpc_pull_dcerpc_auth(TALLOC_CTX *mem_ctx,
 215                                  const DATA_BLOB *blob,
 216                                  struct dcerpc_auth *r,
 217                                  bool bigendian)
 218 {
 219         enum ndr_err_code ndr_err;
 220         struct ndr_pull *ndr;
 221
 222         ndr = ndr_pull_init_blob(blob, mem_ctx);
 223         if (!ndr) {
 224                 return NT_STATUS_NO_MEMORY;
 225         }
 226         if (bigendian) {
 227                 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
 228         }
 229
 230         ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, r);
 231
 232         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 233                 talloc_free(ndr);
 234                 return ndr_map_error2ntstatus(ndr_err);
 235         }
 236         talloc_free(ndr);
 237
 238         if (DEBUGLEVEL >= 10) {
 239                 NDR_PRINT_DEBUG(dcerpc_auth, r);
 240         }
 241
 242         return NT_STATUS_OK;
 243 }
 244
 245 /**
 246 * @brief Calculate how much data we can in a packet, including calculating
 247 *        auth token and pad lengths.
 248 *
 249 * @param auth           The pipe_auth_data structure for this pipe.
 250 * @param header_len     The length of the packet header
 251 * @param data_left      The data left in the send buffer
 252 * @param max_xmit_frag  The max fragment size.
 253 * @param pad_alignment  The NDR padding size.
 254 * @param data_to_send   [out] The max data we will send in the pdu
 255 * @param frag_len       [out] The total length of the fragment
 256 * @param auth_len       [out] The length of the auth trailer
 257 * @param pad_len        [out] The padding to be applied
 258 *
 259 * @return A NT Error status code.
 260 */
 261 NTSTATUS dcerpc_guess_sizes(struct pipe_auth_data *auth,
 262                             size_t header_len, size_t data_left,
 263                             size_t max_xmit_frag, size_t pad_alignment,
 264                             size_t *data_to_send, size_t *frag_len,
 265                             size_t *auth_len, size_t *pad_len)
 266 {
 267         size_t max_len;
 268         size_t mod_len;
 269         struct spnego_context *spnego_ctx;
 270         struct gse_context *gse_ctx;
 271         enum spnego_mech auth_type;
 272         void *auth_ctx;
 273         bool seal = false;
 274         NTSTATUS status;
 275
 276         /* no auth token cases first */
 277         switch (auth->auth_level) {
 278         case DCERPC_AUTH_LEVEL_NONE:
 279         case DCERPC_AUTH_LEVEL_CONNECT:
 280         case DCERPC_AUTH_LEVEL_PACKET:
 281                 max_len = max_xmit_frag - header_len;
 282                 *data_to_send = MIN(max_len, data_left);
 283                 *pad_len = 0;
 284                 *auth_len = 0;
 285                 *frag_len = header_len + *data_to_send;
 286                 return NT_STATUS_OK;
 287
 288         case DCERPC_AUTH_LEVEL_PRIVACY:
 289                 seal = true;
 290                 break;
 291
 292         case DCERPC_AUTH_LEVEL_INTEGRITY:
 293                 break;
 294
 295         default:
 296                 return NT_STATUS_INVALID_PARAMETER;
 297         }
 298
 299
 300         /* Sign/seal case, calculate auth and pad lengths */
 301
 302         max_len = max_xmit_frag - header_len - DCERPC_AUTH_TRAILER_LENGTH;
 303
 304         /* Treat the same for all authenticated rpc requests. */
 305         switch (auth->auth_type) {
 306         case DCERPC_AUTH_TYPE_SPNEGO:
 307                 spnego_ctx = talloc_get_type_abort(auth->auth_ctx,
 308                                                    struct spnego_context);
 309                 status = spnego_get_negotiated_mech(spnego_ctx,
 310                                                     &auth_type, &auth_ctx);
 311                 if (!NT_STATUS_IS_OK(status)) {
 312                         return status;
 313                 }
 314                 switch (auth_type) {
 315                 case SPNEGO_NTLMSSP:
 316                         *auth_len = NTLMSSP_SIG_SIZE;
 317                         break;
 318
 319                 case SPNEGO_KRB5:
 320                         gse_ctx = talloc_get_type_abort(auth_ctx,
 321                                                         struct gse_context);
 322                         if (!gse_ctx) {
 323                                 return NT_STATUS_INVALID_PARAMETER;
 324                         }
 325                         *auth_len = gse_get_signature_length(gse_ctx,
 326                                                              seal, max_len);
 327                         break;
 328
 329                 default:
 330                         return NT_STATUS_INVALID_PARAMETER;
 331                 }
 332                 break;
 333
 334         case DCERPC_AUTH_TYPE_NTLMSSP:
 335                 *auth_len = NTLMSSP_SIG_SIZE;
 336                 break;
 337
 338         case DCERPC_AUTH_TYPE_SCHANNEL:
 339                 *auth_len = NL_AUTH_SIGNATURE_SIZE;
 340                 break;
 341
 342         case DCERPC_AUTH_TYPE_KRB5:
 343                 gse_ctx = talloc_get_type_abort(auth->auth_ctx,
 344                                                 struct gse_context);
 345                 *auth_len = gse_get_signature_length(gse_ctx,
 346                                                      seal, max_len);
 347                 break;
 348
 349         default:
 350                 return NT_STATUS_INVALID_PARAMETER;
 351         }
 352
 353         max_len -= *auth_len;
 354
 355         *data_to_send = MIN(max_len, data_left);
 356
 357         mod_len = (header_len + *data_to_send) % pad_alignment;
 358         if (mod_len) {
 359                 *pad_len = pad_alignment - mod_len;
 360         } else {
 361                 *pad_len = 0;
 362         }
 363
 364         if (*data_to_send + *pad_len > max_len) {
 365                 *data_to_send -= pad_alignment;
 366         }
 367
 368         *frag_len = header_len + *data_to_send + *pad_len
 369                         + DCERPC_AUTH_TRAILER_LENGTH + *auth_len;
 370
 371         return NT_STATUS_OK;
 372 }
 373
 374 /*******************************************************************
 375  Create and add the NTLMSSP sign/seal auth data.
 376  ********************************************************************/
 377
 378 static NTSTATUS add_ntlmssp_auth_footer(struct auth_ntlmssp_state *auth_state,
 379                                         enum dcerpc_AuthLevel auth_level,
 380                                         DATA_BLOB *rpc_out)
 381 {
 382         uint16_t data_and_pad_len = rpc_out->length
 383                                         - DCERPC_RESPONSE_LENGTH
 384                                         - DCERPC_AUTH_TRAILER_LENGTH;
 385         DATA_BLOB auth_blob;
 386         NTSTATUS status;
 387
 388         if (!auth_state) {
 389                 return NT_STATUS_INVALID_PARAMETER;
 390         }
 391
 392         switch (auth_level) {
 393         case DCERPC_AUTH_LEVEL_PRIVACY:
 394                 /* Data portion is encrypted. */
 395                 status = auth_ntlmssp_seal_packet(auth_state,
 396                                              rpc_out->data,
 397                                              rpc_out->data
 398                                                 + DCERPC_RESPONSE_LENGTH,
 399                                              data_and_pad_len,
 400                                              rpc_out->data,
 401                                              rpc_out->length,
 402                                              &auth_blob);
 403                 if (!NT_STATUS_IS_OK(status)) {
 404                         return status;
 405                 }
 406                 break;
 407
 408         case DCERPC_AUTH_LEVEL_INTEGRITY:
 409                 /* Data is signed. */
 410                 status = auth_ntlmssp_sign_packet(auth_state,
 411                                              rpc_out->data,
 412                                              rpc_out->data
 413                                                 + DCERPC_RESPONSE_LENGTH,
 414                                              data_and_pad_len,
 415                                              rpc_out->data,
 416                                              rpc_out->length,
 417                                              &auth_blob);
 418                 if (!NT_STATUS_IS_OK(status)) {
 419                         return status;
 420                 }
 421                 break;
 422
 423         default:
 424                 /* Can't happen. */
 425                 smb_panic("bad auth level");
 426                 /* Notreached. */
 427                 return NT_STATUS_INVALID_PARAMETER;
 428         }
 429
 430         /* Finally attach the blob. */
 431         if (!data_blob_append(NULL, rpc_out,
 432                                 auth_blob.data, auth_blob.length)) {
 433                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
 434                           (unsigned int)auth_blob.length));
 435                 return NT_STATUS_NO_MEMORY;
 436         }
 437         data_blob_free(&auth_blob);
 438
 439         return NT_STATUS_OK;
 440 }
 441
 442 /*******************************************************************
 443  Check/unseal the NTLMSSP auth data. (Unseal in place).
 444  ********************************************************************/
 445
 446 static NTSTATUS get_ntlmssp_auth_footer(struct auth_ntlmssp_state *auth_state,
 447                                         enum dcerpc_AuthLevel auth_level,
 448                                         DATA_BLOB *data, DATA_BLOB *full_pkt,
 449                                         DATA_BLOB *auth_token)
 450 {
 451         switch (auth_level) {
 452         case DCERPC_AUTH_LEVEL_PRIVACY:
 453                 /* Data portion is encrypted. */
 454                 return auth_ntlmssp_unseal_packet(auth_state,
 455                                                   data->data,
 456                                                   data->length,
 457                                                   full_pkt->data,
 458                                                   full_pkt->length,
 459                                                   auth_token);
 460
 461         case DCERPC_AUTH_LEVEL_INTEGRITY:
 462                 /* Data is signed. */
 463                 return auth_ntlmssp_check_packet(auth_state,
 464                                                  data->data,
 465                                                  data->length,
 466                                                  full_pkt->data,
 467                                                  full_pkt->length,
 468                                                  auth_token);
 469
 470         default:
 471                 return NT_STATUS_INVALID_PARAMETER;
 472         }
 473 }
 474
 475 /*******************************************************************
 476  Create and add the schannel sign/seal auth data.
 477  ********************************************************************/
 478
 479 static NTSTATUS add_schannel_auth_footer(struct schannel_state *sas,
 480                                         enum dcerpc_AuthLevel auth_level,
 481                                         DATA_BLOB *rpc_out)
 482 {
 483         uint8_t *data_p = rpc_out->data + DCERPC_RESPONSE_LENGTH;
 484         size_t data_and_pad_len = rpc_out->length
 485                                         - DCERPC_RESPONSE_LENGTH
 486                                         - DCERPC_AUTH_TRAILER_LENGTH;
 487         DATA_BLOB auth_blob;
 488         NTSTATUS status;
 489
 490         if (!sas) {
 491                 return NT_STATUS_INVALID_PARAMETER;
 492         }
 493
 494         DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
 495                         sas->seq_num));
 496
 497         switch (auth_level) {
 498         case DCERPC_AUTH_LEVEL_PRIVACY:
 499                 status = netsec_outgoing_packet(sas,
 500                                                 rpc_out->data,
 501                                                 true,
 502                                                 data_p,
 503                                                 data_and_pad_len,
 504                                                 &auth_blob);
 505                 break;
 506         case DCERPC_AUTH_LEVEL_INTEGRITY:
 507                 status = netsec_outgoing_packet(sas,
 508                                                 rpc_out->data,
 509                                                 false,
 510                                                 data_p,
 511                                                 data_and_pad_len,
 512                                                 &auth_blob);
 513                 break;
 514         default:
 515                 status = NT_STATUS_INTERNAL_ERROR;
 516                 break;
 517         }
 518
 519         if (!NT_STATUS_IS_OK(status)) {
 520                 DEBUG(1,("add_schannel_auth_footer: failed to process packet: %s\n",
 521                         nt_errstr(status)));
 522                 return status;
 523         }
 524
 525         if (DEBUGLEVEL >= 10) {
 526                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &auth_blob);
 527         }
 528
 529         /* Finally attach the blob. */
 530         if (!data_blob_append(NULL, rpc_out,
 531                                 auth_blob.data, auth_blob.length)) {
 532                 return NT_STATUS_NO_MEMORY;
 533         }
 534         data_blob_free(&auth_blob);
 535
 536         return NT_STATUS_OK;
 537 }
 538
 539 /*******************************************************************
 540  Check/unseal the Schannel auth data. (Unseal in place).
 541  ********************************************************************/
 542
 543 static NTSTATUS get_schannel_auth_footer(TALLOC_CTX *mem_ctx,
 544                                          struct schannel_state *auth_state,
 545                                          enum dcerpc_AuthLevel auth_level,
 546                                          DATA_BLOB *data, DATA_BLOB *full_pkt,
 547                                          DATA_BLOB *auth_token)
 548 {
 549         switch (auth_level) {
 550         case DCERPC_AUTH_LEVEL_PRIVACY:
 551                 /* Data portion is encrypted. */
 552                 return netsec_incoming_packet(auth_state,
 553                                                 mem_ctx, true,
 554                                                 data->data,
 555                                                 data->length,
 556                                                 auth_token);
 557
 558         case DCERPC_AUTH_LEVEL_INTEGRITY:
 559                 /* Data is signed. */
 560                 return netsec_incoming_packet(auth_state,
 561                                                 mem_ctx, false,
 562                                                 data->data,
 563                                                 data->length,
 564                                                 auth_token);
 565
 566         default:
 567                 return NT_STATUS_INVALID_PARAMETER;
 568         }
 569 }
 570
 571 /*******************************************************************
 572  Create and add the gssapi sign/seal auth data.
 573  ********************************************************************/
 574
 575 static NTSTATUS add_gssapi_auth_footer(struct gse_context *gse_ctx,
 576                                         enum dcerpc_AuthLevel auth_level,
 577                                         DATA_BLOB *rpc_out)
 578 {
 579         DATA_BLOB data;
 580         DATA_BLOB auth_blob;
 581         NTSTATUS status;
 582
 583         if (!gse_ctx) {
 584                 return NT_STATUS_INVALID_PARAMETER;
 585         }
 586
 587         data.data = rpc_out->data + DCERPC_RESPONSE_LENGTH;
 588         data.length = rpc_out->length - DCERPC_RESPONSE_LENGTH
 589                                         - DCERPC_AUTH_TRAILER_LENGTH;
 590
 591         switch (auth_level) {
 592         case DCERPC_AUTH_LEVEL_PRIVACY:
 593                 status = gse_seal(talloc_tos(), gse_ctx, &data, &auth_blob);
 594                 break;
 595         case DCERPC_AUTH_LEVEL_INTEGRITY:
 596                 status = gse_sign(talloc_tos(), gse_ctx, &data, &auth_blob);
 597                 break;
 598         default:
 599                 status = NT_STATUS_INTERNAL_ERROR;
 600                 break;
 601         }
 602
 603         if (!NT_STATUS_IS_OK(status)) {
 604                 DEBUG(1, ("Failed to process packet: %s\n",
 605                           nt_errstr(status)));
 606                 return status;
 607         }
 608
 609         /* Finally attach the blob. */
 610         if (!data_blob_append(NULL, rpc_out,
 611                                 auth_blob.data, auth_blob.length)) {
 612                 return NT_STATUS_NO_MEMORY;
 613         }
 614
 615         data_blob_free(&auth_blob);
 616
 617         return NT_STATUS_OK;
 618 }
 619
 620 /*******************************************************************
 621  Check/unseal the gssapi auth data. (Unseal in place).
 622  ********************************************************************/
 623
 624 static NTSTATUS get_gssapi_auth_footer(TALLOC_CTX *mem_ctx,
 625                                         struct gse_context *gse_ctx,
 626                                         enum dcerpc_AuthLevel auth_level,
 627                                         DATA_BLOB *data, DATA_BLOB *full_pkt,
 628                                         DATA_BLOB *auth_token)
 629 {
 630         /* TODO: pass in full_pkt when
 631          * DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN is set */
 632         switch (auth_level) {
 633         case DCERPC_AUTH_LEVEL_PRIVACY:
 634                 /* Data portion is encrypted. */
 635                 return gse_unseal(mem_ctx, gse_ctx,
 636                                   data, auth_token);
 637
 638         case DCERPC_AUTH_LEVEL_INTEGRITY:
 639                 /* Data is signed. */
 640                 return gse_sigcheck(mem_ctx, gse_ctx,
 641                                     data, auth_token);
 642         default:
 643                 return NT_STATUS_INVALID_PARAMETER;
 644         }
 645 }
 646
 647 /*******************************************************************
 648  Create and add the spnego-negotiated sign/seal auth data.
 649  ********************************************************************/
 650
 651 static NTSTATUS add_spnego_auth_footer(struct spnego_context *spnego_ctx,
 652                                         enum dcerpc_AuthLevel auth_level,
 653                                         DATA_BLOB *rpc_out)
 654 {
 655         DATA_BLOB auth_blob;
 656         DATA_BLOB rpc_data;
 657         NTSTATUS status;
 658
 659         if (!spnego_ctx) {
 660                 return NT_STATUS_INVALID_PARAMETER;
 661         }
 662
 663         rpc_data = data_blob_const(rpc_out->data
 664                                         + DCERPC_RESPONSE_LENGTH,
 665                                    rpc_out->length
 666                                         - DCERPC_RESPONSE_LENGTH
 667                                         - DCERPC_AUTH_TRAILER_LENGTH);
 668
 669         switch (auth_level) {
 670         case DCERPC_AUTH_LEVEL_PRIVACY:
 671                 /* Data portion is encrypted. */
 672                 status = spnego_seal(rpc_out->data, spnego_ctx,
 673                                      &rpc_data, rpc_out, &auth_blob);
 674                 break;
 675
 676                 if (!NT_STATUS_IS_OK(status)) {
 677                         return status;
 678                 }
 679                 break;
 680
 681         case DCERPC_AUTH_LEVEL_INTEGRITY:
 682                 /* Data is signed. */
 683                 status = spnego_sign(rpc_out->data, spnego_ctx,
 684                                      &rpc_data, rpc_out, &auth_blob);
 685                 break;
 686
 687                 if (!NT_STATUS_IS_OK(status)) {
 688                         return status;
 689                 }
 690                 break;
 691
 692         default:
 693                 /* Can't happen. */
 694                 smb_panic("bad auth level");
 695                 /* Notreached. */
 696                 return NT_STATUS_INVALID_PARAMETER;
 697         }
 698
 699         /* Finally attach the blob. */
 700         if (!data_blob_append(NULL, rpc_out,
 701                                 auth_blob.data, auth_blob.length)) {
 702                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
 703                           (unsigned int)auth_blob.length));
 704                 return NT_STATUS_NO_MEMORY;
 705         }
 706         data_blob_free(&auth_blob);
 707
 708         return NT_STATUS_OK;
 709 }
 710
 711 static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx,
 712                                         struct spnego_context *sp_ctx,
 713                                         enum dcerpc_AuthLevel auth_level,
 714                                         DATA_BLOB *data, DATA_BLOB *full_pkt,
 715                                         DATA_BLOB *auth_token)
 716 {
 717         switch (auth_level) {
 718         case DCERPC_AUTH_LEVEL_PRIVACY:
 719                 /* Data portion is encrypted. */
 720                 return spnego_unseal(mem_ctx, sp_ctx,
 721                                      data, full_pkt, auth_token);
 722
 723         case DCERPC_AUTH_LEVEL_INTEGRITY:
 724                 /* Data is signed. */
 725                 return spnego_sigcheck(mem_ctx, sp_ctx,
 726                                        data, full_pkt, auth_token);
 727
 728         default:
 729                 return NT_STATUS_INVALID_PARAMETER;
 730         }
 731 }
 732
 733 /**
 734 * @brief   Append an auth footer according to what is the current mechanism
 735 *
 736 * @param auth           The pipe_auth_data associated with the connection
 737 * @param pad_len        The padding used in the packet
 738 * @param rpc_out        Packet blob up to and including the auth header
 739 *
 740 * @return A NTSTATUS error code.
 741 */
 742 NTSTATUS dcerpc_add_auth_footer(struct pipe_auth_data *auth,
 743                                 size_t pad_len, DATA_BLOB *rpc_out)
 744 {
 745         struct schannel_state *schannel_auth;
 746         struct auth_ntlmssp_state *ntlmssp_ctx;
 747         struct spnego_context *spnego_ctx;
 748         struct gse_context *gse_ctx;
 749         char pad[CLIENT_NDR_PADDING_SIZE] = { 0, };
 750         DATA_BLOB auth_info;
 751         DATA_BLOB auth_blob;
 752         NTSTATUS status;
 753
 754         if (auth->auth_type == DCERPC_AUTH_TYPE_NONE) {
 755                 return NT_STATUS_OK;
 756         }
 757
 758         if (pad_len) {
 759                 /* Copy the sign/seal padding data. */
 760                 if (!data_blob_append(NULL, rpc_out, pad, pad_len)) {
 761                         return NT_STATUS_NO_MEMORY;
 762                 }
 763         }
 764
 765         /* marshall the dcerpc_auth with an actually empty auth_blob.
 766          * This is needed because the ntmlssp signature includes the
 767          * auth header. We will append the actual blob later. */
 768         auth_blob = data_blob_null;
 769         status = dcerpc_push_dcerpc_auth(rpc_out->data,
 770                                          auth->auth_type,
 771                                          auth->auth_level,
 772                                          pad_len,
 773                                          1 /* context id. */,
 774                                          &auth_blob,
 775                                          &auth_info);
 776         if (!NT_STATUS_IS_OK(status)) {
 777                 return status;
 778         }
 779
 780         /* append the header */
 781         if (!data_blob_append(NULL, rpc_out,
 782                                 auth_info.data, auth_info.length)) {
 783                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
 784                           (unsigned int)auth_info.length));
 785                 return NT_STATUS_NO_MEMORY;
 786         }
 787         data_blob_free(&auth_info);
 788
 789         /* Generate any auth sign/seal and add the auth footer. */
 790         switch (auth->auth_type) {
 791         case DCERPC_AUTH_TYPE_NONE:
 792                 status = NT_STATUS_OK;
 793                 break;
 794         case DCERPC_AUTH_TYPE_SPNEGO:
 795                 spnego_ctx = talloc_get_type_abort(auth->auth_ctx,
 796                                                    struct spnego_context);
 797                 status = add_spnego_auth_footer(spnego_ctx,
 798                                                 auth->auth_level, rpc_out);
 799                 break;
 800         case DCERPC_AUTH_TYPE_NTLMSSP:
 801                 ntlmssp_ctx = talloc_get_type_abort(auth->auth_ctx,
 802                                                 struct auth_ntlmssp_state);
 803                 status = add_ntlmssp_auth_footer(ntlmssp_ctx,
 804                                                  auth->auth_level,
 805                                                  rpc_out);
 806                 break;
 807         case DCERPC_AUTH_TYPE_SCHANNEL:
 808                 schannel_auth = talloc_get_type_abort(auth->auth_ctx,
 809                                                       struct schannel_state);
 810                 status = add_schannel_auth_footer(schannel_auth,
 811                                                   auth->auth_level,
 812                                                   rpc_out);
 813                 break;
 814         case DCERPC_AUTH_TYPE_KRB5:
 815                 gse_ctx = talloc_get_type_abort(auth->auth_ctx,
 816                                                 struct gse_context);
 817                 status = add_gssapi_auth_footer(gse_ctx,
 818                                                 auth->auth_level,
 819                                                 rpc_out);
 820                 break;
 821         default:
 822                 status = NT_STATUS_INVALID_PARAMETER;
 823                 break;
 824         }
 825
 826         return status;
 827 }
 828
 829 /**
 830 * @brief Check authentication for request/response packets
 831 *
 832 * @param auth           The auth data for the connection
 833 * @param pkt            The actual ncacn_packet
 834 * @param pkt_trailer    The stub_and_verifier part of the packet
 835 * @param header_size    The header size
 836 * @param raw_pkt        The whole raw packet data blob
 837 * @param pad_len        [out] The padding length used in the packet
 838 *
 839 * @return A NTSTATUS error code
 840 */
 841 NTSTATUS dcerpc_check_auth(struct pipe_auth_data *auth,
 842                            struct ncacn_packet *pkt,
 843                            DATA_BLOB *pkt_trailer,
 844                            size_t header_size,
 845                            DATA_BLOB *raw_pkt,
 846                            size_t *pad_len)
 847 {
 848         struct schannel_state *schannel_auth;
 849         struct auth_ntlmssp_state *ntlmssp_ctx;
 850         struct spnego_context *spnego_ctx;
 851         struct gse_context *gse_ctx;
 852         NTSTATUS status;
 853         struct dcerpc_auth auth_info;
 854         uint32_t auth_length;
 855         DATA_BLOB full_pkt;
 856         DATA_BLOB data;
 857
 858         switch (auth->auth_level) {
 859         case DCERPC_AUTH_LEVEL_PRIVACY:
 860                 DEBUG(10, ("Requested Privacy.\n"));
 861                 break;
 862
 863         case DCERPC_AUTH_LEVEL_INTEGRITY:
 864                 DEBUG(10, ("Requested Integrity.\n"));
 865                 break;
 866
 867         case DCERPC_AUTH_LEVEL_CONNECT:
 868                 if (pkt->auth_length != 0) {
 869                         break;
 870                 }
 871                 *pad_len = 0;
 872                 return NT_STATUS_OK;
 873
 874         case DCERPC_AUTH_LEVEL_NONE:
 875                 if (pkt->auth_length != 0) {
 876                         DEBUG(3, ("Got non-zero auth len on non "
 877                                   "authenticated connection!\n"));
 878                         return NT_STATUS_INVALID_PARAMETER;
 879                 }
 880                 *pad_len = 0;
 881                 return NT_STATUS_OK;
 882
 883         default:
 884                 DEBUG(3, ("Unimplemented Auth Level %d",
 885                           auth->auth_level));
 886                 return NT_STATUS_INVALID_PARAMETER;
 887         }
 888
 889         /* Paranioa checks for auth_length. */
 890         if (pkt->auth_length > pkt->frag_length) {
 891                 return NT_STATUS_INFO_LENGTH_MISMATCH;
 892         }
 893         if (((unsigned int)pkt->auth_length
 894              + DCERPC_AUTH_TRAILER_LENGTH < (unsigned int)pkt->auth_length) ||
 895             ((unsigned int)pkt->auth_length
 896              + DCERPC_AUTH_TRAILER_LENGTH < DCERPC_AUTH_TRAILER_LENGTH)) {
 897                 /* Integer wrap attempt. */
 898                 return NT_STATUS_INFO_LENGTH_MISMATCH;
 899         }
 900
 901         status = dcerpc_pull_auth_trailer(pkt, pkt, pkt_trailer,
 902                                           &auth_info, &auth_length, false);
 903         if (!NT_STATUS_IS_OK(status)) {
 904                 return status;
 905         }
 906
 907         data = data_blob_const(raw_pkt->data + header_size,
 908                                 pkt_trailer->length - auth_length);
 909         full_pkt = data_blob_const(raw_pkt->data,
 910                                 raw_pkt->length - auth_info.credentials.length);
 911
 912         switch (auth->auth_type) {
 913         case DCERPC_AUTH_TYPE_NONE:
 914                 return NT_STATUS_OK;
 915
 916         case DCERPC_AUTH_TYPE_SPNEGO:
 917                 spnego_ctx = talloc_get_type_abort(auth->auth_ctx,
 918                                                    struct spnego_context);
 919                 status = get_spnego_auth_footer(pkt, spnego_ctx,
 920                                                 auth->auth_level,
 921                                                 &data, &full_pkt,
 922                                                 &auth_info.credentials);
 923                 if (!NT_STATUS_IS_OK(status)) {
 924                         return status;
 925                 }
 926                 break;
 927
 928         case DCERPC_AUTH_TYPE_NTLMSSP:
 929
 930                 DEBUG(10, ("NTLMSSP auth\n"));
 931
 932                 ntlmssp_ctx = talloc_get_type_abort(auth->auth_ctx,
 933                                                 struct auth_ntlmssp_state);
 934                 status = get_ntlmssp_auth_footer(ntlmssp_ctx,
 935                                                  auth->auth_level,
 936                                                  &data, &full_pkt,
 937                                                  &auth_info.credentials);
 938                 if (!NT_STATUS_IS_OK(status)) {
 939                         return status;
 940                 }
 941                 break;
 942
 943         case DCERPC_AUTH_TYPE_SCHANNEL:
 944
 945                 DEBUG(10, ("SCHANNEL auth\n"));
 946
 947                 schannel_auth = talloc_get_type_abort(auth->auth_ctx,
 948                                                       struct schannel_state);
 949                 status = get_schannel_auth_footer(pkt, schannel_auth,
 950                                                   auth->auth_level,
 951                                                   &data, &full_pkt,
 952                                                   &auth_info.credentials);
 953                 if (!NT_STATUS_IS_OK(status)) {
 954                         return status;
 955                 }
 956                 break;
 957
 958         case DCERPC_AUTH_TYPE_KRB5:
 959
 960                 DEBUG(10, ("KRB5 auth\n"));
 961
 962                 gse_ctx = talloc_get_type_abort(auth->auth_ctx,
 963                                                 struct gse_context);
 964                 status = get_gssapi_auth_footer(pkt, gse_ctx,
 965                                                 auth->auth_level,
 966                                                 &data, &full_pkt,
 967                                                 &auth_info.credentials);
 968                 if (!NT_STATUS_IS_OK(status)) {
 969                         return status;
 970                 }
 971                 break;
 972
 973         default:
 974                 DEBUG(0, ("process_request_pdu: "
 975                           "unknown auth type %u set.\n",
 976                           (unsigned int)auth->auth_type));
 977                 return NT_STATUS_INVALID_PARAMETER;
 978         }
 979
 980         /* TODO: remove later
 981          * this is still needed because in the server code the
 982          * pkt_trailer actually has a copy of the raw data, and they
 983          * are still both used in later calls */
 984         if (auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 985                 memcpy(pkt_trailer->data, data.data, data.length);
 986         }
 987
 988         *pad_len = auth_info.auth_pad_length;
 989         data_blob_free(&auth_info.credentials);
 990         return NT_STATUS_OK;
 991 }
 992