source3/librpc/crypto/gse.c

   1 /*
   2  *  GSSAPI Security Extensions
   3  *  RPC Pipe client and server routines
   4  *  Copyright (C) Simo Sorce 2010.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /* We support only GSSAPI/KRB5 here */
  21
  22 #include "includes.h"
  23 #include "gse.h"
  24
  25 #if defined(HAVE_KRB5) \
  26         && defined(HAVE_GSSAPI_GSSAPI_EXT_H) \
  27         && defined(HAVE_GSS_WRAP_IOV) \
  28         && defined(HAVE_GSS_GET_NAME_ATTRIBUTE)
  29
  30 #include "smb_krb5.h"
  31 #include "gse_krb5.h"
  32
  33 #include <gssapi/gssapi.h>
  34 #include <gssapi/gssapi_krb5.h>
  35 #include <gssapi/gssapi_ext.h>
  36
  37 #ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
  38 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11
  39 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05"
  40 #endif
  41
  42 gss_OID_desc gse_sesskey_inq_oid = {
  43         GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH,
  44         (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
  45 };
  46
  47 #ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID
  48 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10
  49 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID  "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04"
  50 #endif
  51
  52 gss_OID_desc gse_sesskeytype_oid = {
  53         GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH,
  54         (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID
  55 };
  56
  57 #define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12
  58 /*                                          EXTRACTION OID                                 AUTHZ ID */
  59 #define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01"
  60
  61 gss_OID_desc gse_authz_data_oid = {
  62         GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH,
  63         (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID
  64 };
  65
  66 #ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID
  67 #define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11
  68 #define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c"
  69 #endif
  70
  71 gss_OID_desc gse_authtime_oid = {
  72         GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH,
  73         (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID
  74 };
  75
  76 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
  77
  78 struct gse_context {
  79         krb5_context k5ctx;
  80         krb5_ccache ccache;
  81         krb5_keytab keytab;
  82
  83         gss_ctx_id_t gss_ctx;
  84
  85         gss_OID_desc gss_mech;
  86         OM_uint32 gss_c_flags;
  87         gss_cred_id_t creds;
  88         gss_name_t server_name;
  89
  90         gss_OID ret_mech;
  91         OM_uint32 ret_flags;
  92         gss_cred_id_t delegated_creds;
  93         gss_name_t client_name;
  94
  95         bool more_processing;
  96         bool authenticated;
  97 };
  98
  99 /* free non talloc dependent contexts */
 100 static int gse_context_destructor(void *ptr)
 101 {
 102         struct gse_context *gse_ctx;
 103         OM_uint32 gss_min, gss_maj;
 104
 105         gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
 106         if (gse_ctx->k5ctx) {
 107                 if (gse_ctx->ccache) {
 108                         krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
 109                         gse_ctx->ccache = NULL;
 110                 }
 111                 if (gse_ctx->keytab) {
 112                         krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
 113                         gse_ctx->keytab = NULL;
 114                 }
 115                 krb5_free_context(gse_ctx->k5ctx);
 116                 gse_ctx->k5ctx = NULL;
 117         }
 118         if (gse_ctx->gss_ctx != GSS_C_NO_CONTEXT) {
 119                 gss_maj = gss_delete_sec_context(&gss_min,
 120                                                  &gse_ctx->gss_ctx,
 121                                                  GSS_C_NO_BUFFER);
 122         }
 123         if (gse_ctx->server_name) {
 124                 gss_maj = gss_release_name(&gss_min,
 125                                            &gse_ctx->server_name);
 126         }
 127         if (gse_ctx->client_name) {
 128                 gss_maj = gss_release_name(&gss_min,
 129                                            &gse_ctx->client_name);
 130         }
 131         if (gse_ctx->creds) {
 132                 gss_maj = gss_release_cred(&gss_min,
 133                                            &gse_ctx->creds);
 134         }
 135         if (gse_ctx->delegated_creds) {
 136                 gss_maj = gss_release_cred(&gss_min,
 137                                            &gse_ctx->delegated_creds);
 138         }
 139         if (gse_ctx->ret_mech) {
 140                 gss_maj = gss_release_oid(&gss_min,
 141                                           &gse_ctx->ret_mech);
 142         }
 143         return 0;
 144 }
 145
 146 static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
 147                                  bool do_sign, bool do_seal,
 148                                  const char *ccache_name,
 149                                  uint32_t add_gss_c_flags,
 150                                  struct gse_context **_gse_ctx)
 151 {
 152         struct gse_context *gse_ctx;
 153         krb5_error_code k5ret;
 154         NTSTATUS status;
 155
 156         gse_ctx = talloc_zero(mem_ctx, struct gse_context);
 157         if (!gse_ctx) {
 158                 return NT_STATUS_NO_MEMORY;
 159         }
 160         talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
 161
 162         memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
 163
 164         gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG |
 165                                 GSS_C_DELEG_FLAG |
 166                                 GSS_C_DELEG_POLICY_FLAG |
 167                                 GSS_C_REPLAY_FLAG |
 168                                 GSS_C_SEQUENCE_FLAG;
 169         if (do_sign) {
 170                 gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG;
 171         }
 172         if (do_seal) {
 173                 gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG;
 174         }
 175
 176         gse_ctx->gss_c_flags |= add_gss_c_flags;
 177
 178         /* Initialize Kerberos Context */
 179         initialize_krb5_error_table();
 180
 181         k5ret = krb5_init_context(&gse_ctx->k5ctx);
 182         if (k5ret) {
 183                 DEBUG(0, ("Failed to initialize kerberos context! (%s)\n",
 184                           error_message(k5ret)));
 185                 status = NT_STATUS_INTERNAL_ERROR;
 186                 goto err_out;
 187         }
 188
 189         if (!ccache_name) {
 190                 ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
 191         }
 192         k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
 193                                 &gse_ctx->ccache);
 194         if (k5ret) {
 195                 DEBUG(1, ("Failed to resolve credential cache! (%s)\n",
 196                           error_message(k5ret)));
 197                 status = NT_STATUS_INTERNAL_ERROR;
 198                 goto err_out;
 199         }
 200
 201         /* TODO: Should we enforce a enc_types list ?
 202         ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
 203         */
 204
 205         *_gse_ctx = gse_ctx;
 206         return NT_STATUS_OK;
 207
 208 err_out:
 209         TALLOC_FREE(gse_ctx);
 210         return status;
 211 }
 212
 213 NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
 214                           bool do_sign, bool do_seal,
 215                           const char *ccache_name,
 216                           const char *server,
 217                           const char *service,
 218                           const char *username,
 219                           const char *password,
 220                           uint32_t add_gss_c_flags,
 221                           struct gse_context **_gse_ctx)
 222 {
 223         struct gse_context *gse_ctx;
 224         OM_uint32 gss_maj, gss_min;
 225         gss_buffer_desc name_buffer = {0, NULL};
 226         gss_OID_set_desc mech_set;
 227         NTSTATUS status;
 228
 229         if (!server || !service) {
 230                 return NT_STATUS_INVALID_PARAMETER;
 231         }
 232
 233         status = gse_context_init(mem_ctx, do_sign, do_seal,
 234                                   ccache_name, add_gss_c_flags,
 235                                   &gse_ctx);
 236         if (!NT_STATUS_IS_OK(status)) {
 237                 return NT_STATUS_NO_MEMORY;
 238         }
 239
 240         name_buffer.value = talloc_asprintf(gse_ctx,
 241                                             "%s@%s", service, server);
 242         if (!name_buffer.value) {
 243                 status = NT_STATUS_NO_MEMORY;
 244                 goto err_out;
 245         }
 246         name_buffer.length = strlen((char *)name_buffer.value);
 247         gss_maj = gss_import_name(&gss_min, &name_buffer,
 248                                   GSS_C_NT_HOSTBASED_SERVICE,
 249                                   &gse_ctx->server_name);
 250         if (gss_maj) {
 251                 DEBUG(0, ("gss_import_name failed for %s, with [%s]\n",
 252                           (char *)name_buffer.value,
 253                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 254                 status = NT_STATUS_INTERNAL_ERROR;
 255                 goto err_out;
 256         }
 257
 258         /* TODO: get krb5 ticket using username/password, if no valid
 259          * one already available in ccache */
 260
 261         mech_set.count = 1;
 262         mech_set.elements = &gse_ctx->gss_mech;
 263
 264         gss_maj = gss_acquire_cred(&gss_min,
 265                                    GSS_C_NO_NAME,
 266                                    GSS_C_INDEFINITE,
 267                                    &mech_set,
 268                                    GSS_C_INITIATE,
 269                                    &gse_ctx->creds,
 270                                    NULL, NULL);
 271         if (gss_maj) {
 272                 DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n",
 273                           (char *)name_buffer.value,
 274                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 275                 status = NT_STATUS_INTERNAL_ERROR;
 276                 goto err_out;
 277         }
 278
 279         *_gse_ctx = gse_ctx;
 280         TALLOC_FREE(name_buffer.value);
 281         return NT_STATUS_OK;
 282
 283 err_out:
 284         TALLOC_FREE(name_buffer.value);
 285         TALLOC_FREE(gse_ctx);
 286         return status;
 287 }
 288
 289 NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
 290                                    struct gse_context *gse_ctx,
 291                                    DATA_BLOB *token_in,
 292                                    DATA_BLOB *token_out)
 293 {
 294         OM_uint32 gss_maj, gss_min;
 295         gss_buffer_desc in_data;
 296         gss_buffer_desc out_data;
 297         DATA_BLOB blob = data_blob_null;
 298         NTSTATUS status;
 299
 300         in_data.value = token_in->data;
 301         in_data.length = token_in->length;
 302
 303         gss_maj = gss_init_sec_context(&gss_min,
 304                                         gse_ctx->creds,
 305                                         &gse_ctx->gss_ctx,
 306                                         gse_ctx->server_name,
 307                                         &gse_ctx->gss_mech,
 308                                         gse_ctx->gss_c_flags,
 309                                         0, GSS_C_NO_CHANNEL_BINDINGS,
 310                                         &in_data, NULL, &out_data,
 311                                         NULL, NULL);
 312         switch (gss_maj) {
 313         case GSS_S_COMPLETE:
 314                 /* we are done with it */
 315                 gse_ctx->more_processing = false;
 316                 status = NT_STATUS_OK;
 317                 break;
 318         case GSS_S_CONTINUE_NEEDED:
 319                 /* we will need a third leg */
 320                 gse_ctx->more_processing = true;
 321                 /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
 322                 status = NT_STATUS_OK;
 323                 break;
 324         default:
 325                 DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
 326                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 327                 status = NT_STATUS_INTERNAL_ERROR;
 328                 goto done;
 329         }
 330
 331         blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
 332         if (!blob.data) {
 333                 status = NT_STATUS_NO_MEMORY;
 334         }
 335
 336         gss_maj = gss_release_buffer(&gss_min, &out_data);
 337
 338 done:
 339         *token_out = blob;
 340         return status;
 341 }
 342
 343 NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
 344                          bool do_sign, bool do_seal,
 345                          uint32_t add_gss_c_flags,
 346                          const char *keytab_name,
 347                          struct gse_context **_gse_ctx)
 348 {
 349         struct gse_context *gse_ctx;
 350         OM_uint32 gss_maj, gss_min;
 351         gss_OID_set_desc mech_set;
 352         krb5_error_code ret;
 353         const char *ktname;
 354         NTSTATUS status;
 355
 356         status = gse_context_init(mem_ctx, do_sign, do_seal,
 357                                   NULL, add_gss_c_flags, &gse_ctx);
 358         if (!NT_STATUS_IS_OK(status)) {
 359                 return NT_STATUS_NO_MEMORY;
 360         }
 361
 362         if (!keytab_name) {
 363                 ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
 364                                                  &gse_ctx->keytab);
 365                 if (ret) {
 366                         status = NT_STATUS_INTERNAL_ERROR;
 367                         goto done;
 368                 }
 369                 ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx,
 370                                            gse_ctx->keytab, &ktname);
 371                 if (ret) {
 372                         status = NT_STATUS_INTERNAL_ERROR;
 373                         goto done;
 374                 }
 375         } else {
 376                 ktname = keytab_name;
 377         }
 378
 379         /* FIXME!!!
 380          * This call sets the default keytab for the whole server, not
 381          * just for this context. Need to find a way that does not alter
 382          * the state of the whole server ... */
 383         ret = gsskrb5_register_acceptor_identity(ktname);
 384         if (ret) {
 385                 status = NT_STATUS_INTERNAL_ERROR;
 386                 goto done;
 387         }
 388
 389         mech_set.count = 1;
 390         mech_set.elements = &gse_ctx->gss_mech;
 391
 392         gss_maj = gss_acquire_cred(&gss_min,
 393                                    GSS_C_NO_NAME,
 394                                    GSS_C_INDEFINITE,
 395                                    &mech_set,
 396                                    GSS_C_ACCEPT,
 397                                    &gse_ctx->creds,
 398                                    NULL, NULL);
 399         if (gss_maj) {
 400                 DEBUG(0, ("gss_acquire_creds failed with [%s]\n",
 401                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 402                 status = NT_STATUS_INTERNAL_ERROR;
 403                 goto done;
 404         }
 405
 406         status = NT_STATUS_OK;
 407
 408 done:
 409         if (!NT_STATUS_IS_OK(status)) {
 410                 TALLOC_FREE(gse_ctx);
 411         }
 412
 413         *_gse_ctx = gse_ctx;
 414         return status;
 415 }
 416
 417 NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
 418                                    struct gse_context *gse_ctx,
 419                                    DATA_BLOB *token_in,
 420                                    DATA_BLOB *token_out)
 421 {
 422         OM_uint32 gss_maj, gss_min;
 423         gss_buffer_desc in_data;
 424         gss_buffer_desc out_data;
 425         DATA_BLOB blob = data_blob_null;
 426         NTSTATUS status;
 427
 428         in_data.value = token_in->data;
 429         in_data.length = token_in->length;
 430
 431         gss_maj = gss_accept_sec_context(&gss_min,
 432                                          &gse_ctx->gss_ctx,
 433                                          gse_ctx->creds,
 434                                          &in_data,
 435                                          GSS_C_NO_CHANNEL_BINDINGS,
 436                                          &gse_ctx->client_name,
 437                                          &gse_ctx->ret_mech,
 438                                          &out_data,
 439                                          &gse_ctx->ret_flags, NULL,
 440                                          &gse_ctx->delegated_creds);
 441         switch (gss_maj) {
 442         case GSS_S_COMPLETE:
 443                 /* we are done with it */
 444                 gse_ctx->more_processing = false;
 445                 gse_ctx->authenticated = true;
 446                 status = NT_STATUS_OK;
 447                 break;
 448         case GSS_S_CONTINUE_NEEDED:
 449                 /* we will need a third leg */
 450                 gse_ctx->more_processing = true;
 451                 /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
 452                 status = NT_STATUS_OK;
 453                 break;
 454         default:
 455                 DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
 456                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 457
 458                 if (gse_ctx->gss_ctx) {
 459                         gss_delete_sec_context(&gss_min,
 460                                                 &gse_ctx->gss_ctx,
 461                                                 GSS_C_NO_BUFFER);
 462                 }
 463
 464                 status = NT_STATUS_INTERNAL_ERROR;
 465                 goto done;
 466         }
 467
 468         /* we may be told to return nothing */
 469         if (out_data.length) {
 470                 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
 471                 if (!blob.data) {
 472                         status = NT_STATUS_NO_MEMORY;
 473                 }
 474                 gss_maj = gss_release_buffer(&gss_min, &out_data);
 475         }
 476
 477
 478 done:
 479         *token_out = blob;
 480         return status;
 481 }
 482
 483 NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
 484 {
 485         if (!gse_ctx->authenticated) {
 486                 return NT_STATUS_INVALID_HANDLE;
 487         }
 488
 489         if (memcmp(gse_ctx->ret_mech,
 490                    gss_mech_krb5, sizeof(gss_OID_desc)) != 0) {
 491                 return NT_STATUS_ACCESS_DENIED;
 492         }
 493
 494         /* GSS_C_MUTUAL_FLAG */
 495         if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) {
 496                 if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) {
 497                         return NT_STATUS_ACCESS_DENIED;
 498                 }
 499         }
 500
 501         /* GSS_C_DELEG_FLAG */
 502         /* GSS_C_DELEG_POLICY_FLAG */
 503         /* GSS_C_REPLAY_FLAG */
 504         /* GSS_C_SEQUENCE_FLAG */
 505
 506         /* GSS_C_INTEG_FLAG */
 507         if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) {
 508                 if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) {
 509                         return NT_STATUS_ACCESS_DENIED;
 510                 }
 511         }
 512
 513         /* GSS_C_CONF_FLAG */
 514         if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) {
 515                 if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) {
 516                         return NT_STATUS_ACCESS_DENIED;
 517                 }
 518         }
 519
 520         return NT_STATUS_OK;
 521 }
 522
 523 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
 524 {
 525         OM_uint32 gss_min, gss_maj;
 526         gss_buffer_desc msg_min;
 527         gss_buffer_desc msg_maj;
 528         OM_uint32 msg_ctx = 0;
 529
 530         char *errstr = NULL;
 531
 532         ZERO_STRUCT(msg_min);
 533         ZERO_STRUCT(msg_maj);
 534
 535         gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
 536                                      GSS_C_NO_OID, &msg_ctx, &msg_maj);
 537         if (gss_maj) {
 538                 goto done;
 539         }
 540         gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
 541                                      (gss_OID)discard_const(gss_mech_krb5),
 542                                      &msg_ctx, &msg_min);
 543         if (gss_maj) {
 544                 goto done;
 545         }
 546
 547         errstr = talloc_strndup(mem_ctx,
 548                                 (char *)msg_maj.value,
 549                                         msg_maj.length);
 550         if (!errstr) {
 551                 goto done;
 552         }
 553         errstr = talloc_strdup_append_buffer(errstr, ": ");
 554         if (!errstr) {
 555                 goto done;
 556         }
 557         errstr = talloc_strndup_append_buffer(errstr,
 558                                                 (char *)msg_min.value,
 559                                                         msg_min.length);
 560         if (!errstr) {
 561                 goto done;
 562         }
 563
 564 done:
 565         if (msg_min.value) {
 566                 gss_maj = gss_release_buffer(&gss_min, &msg_min);
 567         }
 568         if (msg_maj.value) {
 569                 gss_maj = gss_release_buffer(&gss_min, &msg_maj);
 570         }
 571         return errstr;
 572 }
 573
 574 bool gse_require_more_processing(struct gse_context *gse_ctx)
 575 {
 576         return gse_ctx->more_processing;
 577 }
 578
 579 DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
 580                                 struct gse_context *gse_ctx)
 581 {
 582         OM_uint32 gss_min, gss_maj;
 583         gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
 584         DATA_BLOB ret;
 585
 586         gss_maj = gss_inquire_sec_context_by_oid(
 587                                 &gss_min, gse_ctx->gss_ctx,
 588                                 &gse_sesskey_inq_oid, &set);
 589         if (gss_maj) {
 590                 DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
 591                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 592                 return data_blob_null;
 593         }
 594
 595         if ((set == GSS_C_NO_BUFFER_SET) ||
 596             (set->count != 2) ||
 597             (memcmp(set->elements[1].value,
 598                     gse_sesskeytype_oid.elements,
 599                     gse_sesskeytype_oid.length) != 0)) {
 600                 DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
 601                           "OID for data in results:\n"));
 602                 dump_data(1, (uint8_t *)set->elements[1].value,
 603                              set->elements[1].length);
 604                 return data_blob_null;
 605         }
 606
 607         ret = data_blob_talloc(mem_ctx, set->elements[0].value,
 608                                         set->elements[0].length);
 609
 610         gss_maj = gss_release_buffer_set(&gss_min, &set);
 611         return ret;
 612 }
 613
 614 NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
 615                              TALLOC_CTX *mem_ctx, char **cli_name)
 616 {
 617         OM_uint32 gss_min, gss_maj;
 618         gss_buffer_desc name_buffer;
 619
 620         if (!gse_ctx->authenticated) {
 621                 return NT_STATUS_ACCESS_DENIED;
 622         }
 623
 624         if (!gse_ctx->client_name) {
 625                 return NT_STATUS_NOT_FOUND;
 626         }
 627
 628         /* TODO: check OID matches KRB5 Principal Name OID ? */
 629
 630         gss_maj = gss_display_name(&gss_min,
 631                                    gse_ctx->client_name,
 632                                    &name_buffer, NULL);
 633         if (gss_maj) {
 634                 DEBUG(0, ("gss_display_name failed [%s]\n",
 635                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 636                 return NT_STATUS_INTERNAL_ERROR;
 637         }
 638
 639         *cli_name = talloc_strndup(talloc_tos(),
 640                                         (char *)name_buffer.value,
 641                                         name_buffer.length);
 642
 643         gss_maj = gss_release_buffer(&gss_min, &name_buffer);
 644
 645         if (!*cli_name) {
 646                 return NT_STATUS_NO_MEMORY;
 647         }
 648
 649         return NT_STATUS_OK;
 650 }
 651
 652 NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
 653                             TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
 654 {
 655         OM_uint32 gss_min, gss_maj;
 656         gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
 657
 658         if (!gse_ctx->authenticated) {
 659                 return NT_STATUS_ACCESS_DENIED;
 660         }
 661
 662         gss_maj = gss_inquire_sec_context_by_oid(
 663                                 &gss_min, gse_ctx->gss_ctx,
 664                                 &gse_authz_data_oid, &set);
 665         if (gss_maj) {
 666                 DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
 667                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 668                 return NT_STATUS_NOT_FOUND;
 669         }
 670
 671         if (set == GSS_C_NO_BUFFER_SET) {
 672                 DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
 673                           "data in results.\n"));
 674                 return NT_STATUS_INTERNAL_ERROR;
 675         }
 676
 677         /* for now we just hope it is the first value */
 678         *pac = data_blob_talloc(mem_ctx,
 679                                 set->elements[0].value,
 680                                 set->elements[0].length);
 681
 682         gss_maj = gss_release_buffer_set(&gss_min, &set);
 683
 684         return NT_STATUS_OK;
 685 }
 686
 687 NTSTATUS gse_get_pac_blob(struct gse_context *gse_ctx,
 688                           TALLOC_CTX *mem_ctx, DATA_BLOB *pac_blob)
 689 {
 690         OM_uint32 gss_min, gss_maj;
 691 /*
 692  * gss_get_name_attribute() in MIT krb5 1.10.0 can return unintialized pac_display_buffer
 693  * and later gss_release_buffer() will crash on attempting to release it.
 694  *
 695  * So always initialize the buffer descriptors.
 696  *
 697  * See following links for more details:
 698  * http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658514
 699  * http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7087
 700  */
 701         gss_buffer_desc pac_buffer = {
 702                 .value = NULL,
 703                 .length = 0
 704         };
 705         gss_buffer_desc pac_display_buffer = {
 706                 .value = NULL,
 707                 .length = 0
 708         };
 709         gss_buffer_desc pac_name = {
 710                 .value = discard_const_p(char, "urn:mspac:"),
 711                 .length = sizeof("urn:mspac:") - 1
 712         };
 713         int more = -1;
 714         int authenticated = false;
 715         int complete = false;
 716         NTSTATUS status;
 717
 718         if (!gse_ctx->authenticated) {
 719                 return NT_STATUS_ACCESS_DENIED;
 720         }
 721
 722         gss_maj = gss_get_name_attribute(&gss_min,
 723                                          gse_ctx->client_name, &pac_name,
 724                                          &authenticated, &complete,
 725                                          &pac_buffer, &pac_display_buffer,
 726                                          &more);
 727
 728         if (gss_maj != 0) {
 729                 DEBUG(0, ("obtaining PAC via GSSAPI gss_get_name_attribute "
 730                           "failed: %s\n",
 731                           gse_errstr(mem_ctx, gss_maj, gss_min)));
 732                 return NT_STATUS_ACCESS_DENIED;
 733         }
 734
 735         if (authenticated && complete) {
 736                 /* The PAC blob is returned directly */
 737                 *pac_blob = data_blob_talloc(mem_ctx,
 738                                              pac_buffer.value,
 739                                              pac_buffer.length);
 740                 if (!pac_blob->data) {
 741                         status = NT_STATUS_NO_MEMORY;
 742                 } else {
 743                         status = NT_STATUS_OK;
 744                 }
 745
 746                 gss_maj = gss_release_buffer(&gss_min, &pac_buffer);
 747                 gss_maj = gss_release_buffer(&gss_min, &pac_display_buffer);
 748
 749                 return status;
 750         }
 751
 752         DEBUG(0, ("obtaining PAC via GSSAPI failed: authenticated: %s, "
 753                   "complete: %s, more: %s\n",
 754                   authenticated ? "true" : "false",
 755                   complete ? "true" : "false",
 756                   more ? "true" : "false"));
 757
 758         return NT_STATUS_ACCESS_DENIED;
 759 }
 760
 761 size_t gse_get_signature_length(struct gse_context *gse_ctx,
 762                                 int seal, size_t payload_size)
 763 {
 764         OM_uint32 gss_min, gss_maj;
 765         gss_iov_buffer_desc iov[2];
 766         uint8_t fakebuf[payload_size];
 767         int sealed;
 768
 769         iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
 770         iov[0].buffer.value = NULL;
 771         iov[0].buffer.length = 0;
 772         iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
 773         iov[1].buffer.value = fakebuf;
 774         iov[1].buffer.length = payload_size;
 775
 776         gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gss_ctx,
 777                                         seal, GSS_C_QOP_DEFAULT,
 778                                         &sealed, iov, 2);
 779         if (gss_maj) {
 780                 DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n",
 781                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 782                 return 0;
 783         }
 784
 785         return iov[0].buffer.length;
 786 }
 787
 788 NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 789                   DATA_BLOB *data, DATA_BLOB *signature)
 790 {
 791         OM_uint32 gss_min, gss_maj;
 792         gss_iov_buffer_desc iov[2];
 793         int req_seal = 1; /* setting to 1 means we request sign+seal */
 794         int sealed;
 795         NTSTATUS status;
 796
 797         /* allocate the memory ourselves so we do not need to talloc_memdup */
 798         signature->length = gse_get_signature_length(gse_ctx, 1, data->length);
 799         if (!signature->length) {
 800                 return NT_STATUS_INTERNAL_ERROR;
 801         }
 802         signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length);
 803         if (!signature->data) {
 804                 return NT_STATUS_NO_MEMORY;
 805         }
 806         iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
 807         iov[0].buffer.value = signature->data;
 808         iov[0].buffer.length = signature->length;
 809
 810         /* data is encrypted in place, which is ok */
 811         iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
 812         iov[1].buffer.value = data->data;
 813         iov[1].buffer.length = data->length;
 814
 815         gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gss_ctx,
 816                                 req_seal, GSS_C_QOP_DEFAULT,
 817                                 &sealed, iov, 2);
 818         if (gss_maj) {
 819                 DEBUG(0, ("gss_wrap_iov failed with [%s]\n",
 820                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 821                 status = NT_STATUS_ACCESS_DENIED;
 822                 goto done;
 823         }
 824
 825         if (!sealed) {
 826                 DEBUG(0, ("gss_wrap_iov says data was not sealed!\n"));
 827                 status = NT_STATUS_ACCESS_DENIED;
 828                 goto done;
 829         }
 830
 831         status = NT_STATUS_OK;
 832
 833         DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n",
 834                    (int)iov[1].buffer.length, (int)iov[0].buffer.length));
 835
 836 done:
 837         return status;
 838 }
 839
 840 NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 841                     DATA_BLOB *data, DATA_BLOB *signature)
 842 {
 843         OM_uint32 gss_min, gss_maj;
 844         gss_iov_buffer_desc iov[2];
 845         int sealed;
 846         NTSTATUS status;
 847
 848         iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
 849         iov[0].buffer.value = signature->data;
 850         iov[0].buffer.length = signature->length;
 851
 852         /* data is decrypted in place, which is ok */
 853         iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
 854         iov[1].buffer.value = data->data;
 855         iov[1].buffer.length = data->length;
 856
 857         gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gss_ctx,
 858                                  &sealed, NULL, iov, 2);
 859         if (gss_maj) {
 860                 DEBUG(0, ("gss_unwrap_iov failed with [%s]\n",
 861                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 862                 status = NT_STATUS_ACCESS_DENIED;
 863                 goto done;
 864         }
 865
 866         if (!sealed) {
 867                 DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n"));
 868                 status = NT_STATUS_ACCESS_DENIED;
 869                 goto done;
 870         }
 871
 872         status = NT_STATUS_OK;
 873
 874         DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n",
 875                    (int)iov[1].buffer.length, (int)iov[0].buffer.length));
 876
 877 done:
 878         return status;
 879 }
 880
 881 NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 882                   DATA_BLOB *data, DATA_BLOB *signature)
 883 {
 884         OM_uint32 gss_min, gss_maj;
 885         gss_buffer_desc in_data = { 0, NULL };
 886         gss_buffer_desc out_data = { 0, NULL};
 887         NTSTATUS status;
 888
 889         in_data.value = data->data;
 890         in_data.length = data->length;
 891
 892         gss_maj = gss_get_mic(&gss_min, gse_ctx->gss_ctx,
 893                               GSS_C_QOP_DEFAULT,
 894                               &in_data, &out_data);
 895         if (gss_maj) {
 896                 DEBUG(0, ("gss_get_mic failed with [%s]\n",
 897                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 898                 status = NT_STATUS_ACCESS_DENIED;
 899                 goto done;
 900         }
 901
 902         *signature = data_blob_talloc(mem_ctx,
 903                                         out_data.value, out_data.length);
 904         if (!signature->data) {
 905                 status = NT_STATUS_NO_MEMORY;
 906                 goto done;
 907         }
 908
 909         status = NT_STATUS_OK;
 910
 911 done:
 912         if (out_data.value) {
 913                 gss_maj = gss_release_buffer(&gss_min, &out_data);
 914         }
 915         return status;
 916 }
 917
 918 NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 919                       DATA_BLOB *data, DATA_BLOB *signature)
 920 {
 921         OM_uint32 gss_min, gss_maj;
 922         gss_buffer_desc in_data = { 0, NULL };
 923         gss_buffer_desc in_token = { 0, NULL};
 924         NTSTATUS status;
 925
 926         in_data.value = data->data;
 927         in_data.length = data->length;
 928         in_token.value = signature->data;
 929         in_token.length = signature->length;
 930
 931         gss_maj = gss_verify_mic(&gss_min, gse_ctx->gss_ctx,
 932                                  &in_data, &in_token, NULL);
 933         if (gss_maj) {
 934                 DEBUG(0, ("gss_verify_mic failed with [%s]\n",
 935                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 936                 status = NT_STATUS_ACCESS_DENIED;
 937                 goto done;
 938         }
 939
 940         status = NT_STATUS_OK;
 941
 942 done:
 943         return status;
 944 }
 945
 946 #else
 947
 948 NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
 949                           bool do_sign, bool do_seal,
 950                           const char *ccache_name,
 951                           const char *server,
 952                           const char *service,
 953                           const char *username,
 954                           const char *password,
 955                           uint32_t add_gss_c_flags,
 956                           struct gse_context **_gse_ctx)
 957 {
 958         return NT_STATUS_NOT_IMPLEMENTED;
 959 }
 960
 961 NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
 962                                    struct gse_context *gse_ctx,
 963                                    DATA_BLOB *token_in,
 964                                    DATA_BLOB *token_out)
 965 {
 966         return NT_STATUS_NOT_IMPLEMENTED;
 967 }
 968
 969 NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
 970                          bool do_sign, bool do_seal,
 971                          uint32_t add_gss_c_flags,
 972                          const char *keytab,
 973                          struct gse_context **_gse_ctx)
 974 {
 975         return NT_STATUS_NOT_IMPLEMENTED;
 976 }
 977
 978 NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
 979                                    struct gse_context *gse_ctx,
 980                                    DATA_BLOB *token_in,
 981                                    DATA_BLOB *token_out)
 982 {
 983         return NT_STATUS_NOT_IMPLEMENTED;
 984 }
 985
 986 NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
 987 {
 988         return NT_STATUS_NOT_IMPLEMENTED;
 989 }
 990
 991 bool gse_require_more_processing(struct gse_context *gse_ctx)
 992 {
 993         return false;
 994 }
 995
 996 DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
 997                               struct gse_context *gse_ctx)
 998 {
 999         return data_blob_null;
1000 }
1001
1002 NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
1003                              TALLOC_CTX *mem_ctx, char **cli_name)
1004 {
1005         return NT_STATUS_NOT_IMPLEMENTED;
1006 }
1007
1008 NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
1009                             TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
1010 {
1011         return NT_STATUS_NOT_IMPLEMENTED;
1012 }
1013
1014 NTSTATUS gse_get_pac_blob(struct gse_context *gse_ctx,
1015                           TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
1016 {
1017         return NT_STATUS_NOT_IMPLEMENTED;
1018 }
1019
1020 size_t gse_get_signature_length(struct gse_context *gse_ctx,
1021                                 int seal, size_t payload_size)
1022 {
1023         return 0;
1024 }
1025
1026 NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
1027                   DATA_BLOB *data, DATA_BLOB *signature)
1028 {
1029         return NT_STATUS_NOT_IMPLEMENTED;
1030 }
1031
1032 NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
1033                     DATA_BLOB *data, DATA_BLOB *signature)
1034 {
1035         return NT_STATUS_NOT_IMPLEMENTED;
1036 }
1037
1038 NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
1039                   DATA_BLOB *data, DATA_BLOB *signature)
1040 {
1041         return NT_STATUS_NOT_IMPLEMENTED;
1042 }
1043
1044 NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
1045                       DATA_BLOB *data, DATA_BLOB *signature)
1046 {
1047         return NT_STATUS_NOT_IMPLEMENTED;
1048 }
1049
1050 #endif /* HAVE_KRB5 && HAVE_GSSAPI_EXT_H && HAVE_GSS_WRAP_IOV */