source3/librpc/rpc/dcerpc_helpers.c

   1 /*
   2  *  DCERPC Helper routines
   3  *  Günther Deschner <gd@samba.org> 2010.
   4  *  Simo Sorce <idra@samba.org> 2010.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20
  21 #include "includes.h"
  22 #include "librpc/rpc/dcerpc.h"
  23 #include "librpc/gen_ndr/ndr_dcerpc.h"
  24 #include "librpc/gen_ndr/ndr_schannel.h"
  25 #include "../libcli/auth/schannel.h"
  26 #include "../libcli/auth/spnego.h"
  27 #include "../auth/ntlmssp/ntlmssp.h"
  28 #include "ntlmssp_wrap.h"
  29 #include "librpc/crypto/gse.h"
  30 #include "librpc/crypto/spnego.h"
  31 #include "auth/gensec/gensec.h"
  32
  33 #undef DBGC_CLASS
  34 #define DBGC_CLASS DBGC_RPC_PARSE
  35
  36 /**
  37 * @brief NDR Encodes a ncacn_packet
  38 *
  39 * @param mem_ctx        The memory context the blob will be allocated on
  40 * @param ptype          The DCERPC packet type
  41 * @param pfc_flags      The DCERPC PFC Falgs
  42 * @param auth_length    The length of the trailing auth blob
  43 * @param call_id        The call ID
  44 * @param u              The payload of the packet
  45 * @param blob [out]     The encoded blob if successful
  46 *
  47 * @return an NTSTATUS error code
  48 */
  49 NTSTATUS dcerpc_push_ncacn_packet(TALLOC_CTX *mem_ctx,
  50                                   enum dcerpc_pkt_type ptype,
  51                                   uint8_t pfc_flags,
  52                                   uint16_t auth_length,
  53                                   uint32_t call_id,
  54                                   union dcerpc_payload *u,
  55                                   DATA_BLOB *blob)
  56 {
  57         struct ncacn_packet r;
  58         enum ndr_err_code ndr_err;
  59
  60         r.rpc_vers              = 5;
  61         r.rpc_vers_minor        = 0;
  62         r.ptype                 = ptype;
  63         r.pfc_flags             = pfc_flags;
  64         r.drep[0]               = DCERPC_DREP_LE;
  65         r.drep[1]               = 0;
  66         r.drep[2]               = 0;
  67         r.drep[3]               = 0;
  68         r.auth_length           = auth_length;
  69         r.call_id               = call_id;
  70         r.u                     = *u;
  71
  72         ndr_err = ndr_push_struct_blob(blob, mem_ctx, &r,
  73                 (ndr_push_flags_fn_t)ndr_push_ncacn_packet);
  74         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
  75                 return ndr_map_error2ntstatus(ndr_err);
  76         }
  77
  78         dcerpc_set_frag_length(blob, blob->length);
  79
  80
  81         if (DEBUGLEVEL >= 10) {
  82                 /* set frag len for print function */
  83                 r.frag_length = blob->length;
  84                 NDR_PRINT_DEBUG(ncacn_packet, &r);
  85         }
  86
  87         return NT_STATUS_OK;
  88 }
  89
  90 /**
  91 * @brief Decodes a ncacn_packet
  92 *
  93 * @param mem_ctx        The memory context on which to allocate the packet
  94 *                       elements
  95 * @param blob           The blob of data to decode
  96 * @param r              An empty ncacn_packet, must not be NULL
  97 * @param bigendian      Whether the packet is bignedian encoded
  98 *
  99 * @return a NTSTATUS error code
 100 */
 101 NTSTATUS dcerpc_pull_ncacn_packet(TALLOC_CTX *mem_ctx,
 102                                   const DATA_BLOB *blob,
 103                                   struct ncacn_packet *r,
 104                                   bool bigendian)
 105 {
 106         enum ndr_err_code ndr_err;
 107         struct ndr_pull *ndr;
 108
 109         ndr = ndr_pull_init_blob(blob, mem_ctx);
 110         if (!ndr) {
 111                 return NT_STATUS_NO_MEMORY;
 112         }
 113         if (bigendian) {
 114                 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
 115         }
 116
 117         ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, r);
 118
 119         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 120                 talloc_free(ndr);
 121                 return ndr_map_error2ntstatus(ndr_err);
 122         }
 123         talloc_free(ndr);
 124
 125         if (DEBUGLEVEL >= 10) {
 126                 NDR_PRINT_DEBUG(ncacn_packet, r);
 127         }
 128
 129         return NT_STATUS_OK;
 130 }
 131
 132 /**
 133 * @brief NDR Encodes a NL_AUTH_MESSAGE
 134 *
 135 * @param mem_ctx        The memory context the blob will be allocated on
 136 * @param r              The NL_AUTH_MESSAGE to encode
 137 * @param blob [out]     The encoded blob if successful
 138 *
 139 * @return a NTSTATUS error code
 140 */
 141 NTSTATUS dcerpc_push_schannel_bind(TALLOC_CTX *mem_ctx,
 142                                    struct NL_AUTH_MESSAGE *r,
 143                                    DATA_BLOB *blob)
 144 {
 145         enum ndr_err_code ndr_err;
 146
 147         ndr_err = ndr_push_struct_blob(blob, mem_ctx, r,
 148                 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 149         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 150                 return ndr_map_error2ntstatus(ndr_err);
 151         }
 152
 153         if (DEBUGLEVEL >= 10) {
 154                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, r);
 155         }
 156
 157         return NT_STATUS_OK;
 158 }
 159
 160 /**
 161 * @brief NDR Encodes a dcerpc_auth structure
 162 *
 163 * @param mem_ctx          The memory context the blob will be allocated on
 164 * @param auth_type        The DCERPC Authentication Type
 165 * @param auth_level       The DCERPC Authentication Level
 166 * @param auth_pad_length  The padding added to the packet this blob will be
 167 *                          appended to.
 168 * @param auth_context_id  The context id
 169 * @param credentials      The authentication credentials blob (signature)
 170 * @param blob [out]       The encoded blob if successful
 171 *
 172 * @return a NTSTATUS error code
 173 */
 174 NTSTATUS dcerpc_push_dcerpc_auth(TALLOC_CTX *mem_ctx,
 175                                  enum dcerpc_AuthType auth_type,
 176                                  enum dcerpc_AuthLevel auth_level,
 177                                  uint8_t auth_pad_length,
 178                                  uint32_t auth_context_id,
 179                                  const DATA_BLOB *credentials,
 180                                  DATA_BLOB *blob)
 181 {
 182         struct dcerpc_auth r;
 183         enum ndr_err_code ndr_err;
 184
 185         r.auth_type             = auth_type;
 186         r.auth_level            = auth_level;
 187         r.auth_pad_length       = auth_pad_length;
 188         r.auth_reserved         = 0;
 189         r.auth_context_id       = auth_context_id;
 190         r.credentials           = *credentials;
 191
 192         ndr_err = ndr_push_struct_blob(blob, mem_ctx, &r,
 193                 (ndr_push_flags_fn_t)ndr_push_dcerpc_auth);
 194         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 195                 return ndr_map_error2ntstatus(ndr_err);
 196         }
 197
 198         if (DEBUGLEVEL >= 10) {
 199                 NDR_PRINT_DEBUG(dcerpc_auth, &r);
 200         }
 201
 202         return NT_STATUS_OK;
 203 }
 204
 205 /**
 206 * @brief Decodes a dcerpc_auth blob
 207 *
 208 * @param mem_ctx        The memory context on which to allocate the packet
 209 *                       elements
 210 * @param blob           The blob of data to decode
 211 * @param r              An empty dcerpc_auth structure, must not be NULL
 212 *
 213 * @return a NTSTATUS error code
 214 */
 215 NTSTATUS dcerpc_pull_dcerpc_auth(TALLOC_CTX *mem_ctx,
 216                                  const DATA_BLOB *blob,
 217                                  struct dcerpc_auth *r,
 218                                  bool bigendian)
 219 {
 220         enum ndr_err_code ndr_err;
 221         struct ndr_pull *ndr;
 222
 223         ndr = ndr_pull_init_blob(blob, mem_ctx);
 224         if (!ndr) {
 225                 return NT_STATUS_NO_MEMORY;
 226         }
 227         if (bigendian) {
 228                 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
 229         }
 230
 231         ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, r);
 232
 233         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 234                 talloc_free(ndr);
 235                 return ndr_map_error2ntstatus(ndr_err);
 236         }
 237         talloc_free(ndr);
 238
 239         if (DEBUGLEVEL >= 10) {
 240                 NDR_PRINT_DEBUG(dcerpc_auth, r);
 241         }
 242
 243         return NT_STATUS_OK;
 244 }
 245
 246 /**
 247 * @brief Calculate how much data we can in a packet, including calculating
 248 *        auth token and pad lengths.
 249 *
 250 * @param auth           The pipe_auth_data structure for this pipe.
 251 * @param header_len     The length of the packet header
 252 * @param data_left      The data left in the send buffer
 253 * @param max_xmit_frag  The max fragment size.
 254 * @param pad_alignment  The NDR padding size.
 255 * @param data_to_send   [out] The max data we will send in the pdu
 256 * @param frag_len       [out] The total length of the fragment
 257 * @param auth_len       [out] The length of the auth trailer
 258 * @param pad_len        [out] The padding to be applied
 259 *
 260 * @return A NT Error status code.
 261 */
 262 NTSTATUS dcerpc_guess_sizes(struct pipe_auth_data *auth,
 263                             size_t header_len, size_t data_left,
 264                             size_t max_xmit_frag, size_t pad_alignment,
 265                             size_t *data_to_send, size_t *frag_len,
 266                             size_t *auth_len, size_t *pad_len)
 267 {
 268         size_t max_len;
 269         size_t mod_len;
 270         struct gensec_security *gensec_security;
 271         struct schannel_state *schannel_auth;
 272         struct spnego_context *spnego_ctx;
 273         struct gse_context *gse_ctx;
 274         enum spnego_mech auth_type;
 275         void *auth_ctx;
 276         bool seal = false;
 277         NTSTATUS status;
 278
 279         /* no auth token cases first */
 280         switch (auth->auth_level) {
 281         case DCERPC_AUTH_LEVEL_NONE:
 282         case DCERPC_AUTH_LEVEL_CONNECT:
 283         case DCERPC_AUTH_LEVEL_PACKET:
 284                 max_len = max_xmit_frag - header_len;
 285                 *data_to_send = MIN(max_len, data_left);
 286                 *pad_len = 0;
 287                 *auth_len = 0;
 288                 *frag_len = header_len + *data_to_send;
 289                 return NT_STATUS_OK;
 290
 291         case DCERPC_AUTH_LEVEL_PRIVACY:
 292                 seal = true;
 293                 break;
 294
 295         case DCERPC_AUTH_LEVEL_INTEGRITY:
 296                 break;
 297
 298         default:
 299                 return NT_STATUS_INVALID_PARAMETER;
 300         }
 301
 302
 303         /* Sign/seal case, calculate auth and pad lengths */
 304
 305         max_len = max_xmit_frag - header_len - DCERPC_AUTH_TRAILER_LENGTH;
 306
 307         /* Treat the same for all authenticated rpc requests. */
 308         switch (auth->auth_type) {
 309         case DCERPC_AUTH_TYPE_SPNEGO:
 310                 spnego_ctx = talloc_get_type_abort(auth->auth_ctx,
 311                                                    struct spnego_context);
 312                 status = spnego_get_negotiated_mech(spnego_ctx,
 313                                                     &auth_type, &auth_ctx);
 314                 if (!NT_STATUS_IS_OK(status)) {
 315                         return status;
 316                 }
 317                 switch (auth_type) {
 318                 case SPNEGO_NTLMSSP:
 319                         gensec_security = talloc_get_type_abort(auth_ctx,
 320                                                                 struct gensec_security);
 321                         *auth_len = gensec_sig_size(gensec_security, max_len);
 322                         break;
 323
 324                 case SPNEGO_KRB5:
 325                         gse_ctx = talloc_get_type_abort(auth_ctx,
 326                                                         struct gse_context);
 327                         if (!gse_ctx) {
 328                                 return NT_STATUS_INVALID_PARAMETER;
 329                         }
 330                         *auth_len = gse_get_signature_length(gse_ctx,
 331                                                              seal, max_len);
 332                         break;
 333
 334                 default:
 335                         return NT_STATUS_INVALID_PARAMETER;
 336                 }
 337                 break;
 338
 339         case DCERPC_AUTH_TYPE_NTLMSSP:
 340                 gensec_security = talloc_get_type_abort(auth->auth_ctx,
 341                                                         struct gensec_security);
 342                 *auth_len = gensec_sig_size(gensec_security, max_len);
 343                 break;
 344
 345         case DCERPC_AUTH_TYPE_SCHANNEL:
 346                 schannel_auth = talloc_get_type_abort(auth->auth_ctx,
 347                                                       struct schannel_state);
 348                 *auth_len = netsec_outgoing_sig_size(schannel_auth);
 349                 break;
 350
 351         case DCERPC_AUTH_TYPE_KRB5:
 352                 gse_ctx = talloc_get_type_abort(auth->auth_ctx,
 353                                                 struct gse_context);
 354                 *auth_len = gse_get_signature_length(gse_ctx,
 355                                                      seal, max_len);
 356                 break;
 357
 358         default:
 359                 return NT_STATUS_INVALID_PARAMETER;
 360         }
 361
 362         max_len -= *auth_len;
 363
 364         *data_to_send = MIN(max_len, data_left);
 365
 366         mod_len = (header_len + *data_to_send) % pad_alignment;
 367         if (mod_len) {
 368                 *pad_len = pad_alignment - mod_len;
 369         } else {
 370                 *pad_len = 0;
 371         }
 372
 373         if (*data_to_send + *pad_len > max_len) {
 374                 *data_to_send -= pad_alignment;
 375         }
 376
 377         *frag_len = header_len + *data_to_send + *pad_len
 378                         + DCERPC_AUTH_TRAILER_LENGTH + *auth_len;
 379
 380         return NT_STATUS_OK;
 381 }
 382
 383 /*******************************************************************
 384  Create and add the NTLMSSP sign/seal auth data.
 385  ********************************************************************/
 386
 387 static NTSTATUS add_ntlmssp_auth_footer(struct gensec_security *gensec_security,
 388                                         enum dcerpc_AuthLevel auth_level,
 389                                         DATA_BLOB *rpc_out)
 390 {
 391         uint16_t data_and_pad_len = rpc_out->length
 392                                         - DCERPC_RESPONSE_LENGTH
 393                                         - DCERPC_AUTH_TRAILER_LENGTH;
 394         DATA_BLOB auth_blob;
 395         NTSTATUS status;
 396
 397         if (!gensec_security) {
 398                 return NT_STATUS_INVALID_PARAMETER;
 399         }
 400
 401         switch (auth_level) {
 402         case DCERPC_AUTH_LEVEL_PRIVACY:
 403                 /* Data portion is encrypted. */
 404                 status = gensec_seal_packet(gensec_security,
 405                                             rpc_out->data,
 406                                             rpc_out->data
 407                                             + DCERPC_RESPONSE_LENGTH,
 408                                             data_and_pad_len,
 409                                             rpc_out->data,
 410                                             rpc_out->length,
 411                                             &auth_blob);
 412                 if (!NT_STATUS_IS_OK(status)) {
 413                         return status;
 414                 }
 415                 break;
 416
 417         case DCERPC_AUTH_LEVEL_INTEGRITY:
 418                 /* Data is signed. */
 419                 status = gensec_sign_packet(gensec_security,
 420                                             rpc_out->data,
 421                                             rpc_out->data
 422                                             + DCERPC_RESPONSE_LENGTH,
 423                                             data_and_pad_len,
 424                                             rpc_out->data,
 425                                             rpc_out->length,
 426                                             &auth_blob);
 427                 if (!NT_STATUS_IS_OK(status)) {
 428                         return status;
 429                 }
 430                 break;
 431
 432         default:
 433                 /* Can't happen. */
 434                 smb_panic("bad auth level");
 435                 /* Notreached. */
 436                 return NT_STATUS_INVALID_PARAMETER;
 437         }
 438
 439         /* Finally attach the blob. */
 440         if (!data_blob_append(NULL, rpc_out,
 441                                 auth_blob.data, auth_blob.length)) {
 442                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
 443                           (unsigned int)auth_blob.length));
 444                 return NT_STATUS_NO_MEMORY;
 445         }
 446         data_blob_free(&auth_blob);
 447
 448         return NT_STATUS_OK;
 449 }
 450
 451 /*******************************************************************
 452  Check/unseal the NTLMSSP auth data. (Unseal in place).
 453  ********************************************************************/
 454
 455 static NTSTATUS get_ntlmssp_auth_footer(struct gensec_security *gensec_security,
 456                                         enum dcerpc_AuthLevel auth_level,
 457                                         DATA_BLOB *data, DATA_BLOB *full_pkt,
 458                                         DATA_BLOB *auth_token)
 459 {
 460         switch (auth_level) {
 461         case DCERPC_AUTH_LEVEL_PRIVACY:
 462                 /* Data portion is encrypted. */
 463                 return gensec_unseal_packet(gensec_security,
 464                                             data->data,
 465                                             data->length,
 466                                             full_pkt->data,
 467                                             full_pkt->length,
 468                                             auth_token);
 469
 470         case DCERPC_AUTH_LEVEL_INTEGRITY:
 471                 /* Data is signed. */
 472                 return gensec_check_packet(gensec_security,
 473                                            data->data,
 474                                            data->length,
 475                                            full_pkt->data,
 476                                            full_pkt->length,
 477                                            auth_token);
 478
 479         default:
 480                 return NT_STATUS_INVALID_PARAMETER;
 481         }
 482 }
 483
 484 /*******************************************************************
 485  Create and add the schannel sign/seal auth data.
 486  ********************************************************************/
 487
 488 static NTSTATUS add_schannel_auth_footer(struct schannel_state *sas,
 489                                         enum dcerpc_AuthLevel auth_level,
 490                                         DATA_BLOB *rpc_out)
 491 {
 492         uint8_t *data_p = rpc_out->data + DCERPC_RESPONSE_LENGTH;
 493         size_t data_and_pad_len = rpc_out->length
 494                                         - DCERPC_RESPONSE_LENGTH
 495                                         - DCERPC_AUTH_TRAILER_LENGTH;
 496         DATA_BLOB auth_blob;
 497         NTSTATUS status;
 498
 499         if (!sas) {
 500                 return NT_STATUS_INVALID_PARAMETER;
 501         }
 502
 503         DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
 504                         sas->seq_num));
 505
 506         switch (auth_level) {
 507         case DCERPC_AUTH_LEVEL_PRIVACY:
 508                 status = netsec_outgoing_packet(sas,
 509                                                 rpc_out->data,
 510                                                 true,
 511                                                 data_p,
 512                                                 data_and_pad_len,
 513                                                 &auth_blob);
 514                 break;
 515         case DCERPC_AUTH_LEVEL_INTEGRITY:
 516                 status = netsec_outgoing_packet(sas,
 517                                                 rpc_out->data,
 518                                                 false,
 519                                                 data_p,
 520                                                 data_and_pad_len,
 521                                                 &auth_blob);
 522                 break;
 523         default:
 524                 status = NT_STATUS_INTERNAL_ERROR;
 525                 break;
 526         }
 527
 528         if (!NT_STATUS_IS_OK(status)) {
 529                 DEBUG(1,("add_schannel_auth_footer: failed to process packet: %s\n",
 530                         nt_errstr(status)));
 531                 return status;
 532         }
 533
 534         if (DEBUGLEVEL >= 10) {
 535                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &auth_blob);
 536         }
 537
 538         /* Finally attach the blob. */
 539         if (!data_blob_append(NULL, rpc_out,
 540                                 auth_blob.data, auth_blob.length)) {
 541                 return NT_STATUS_NO_MEMORY;
 542         }
 543         data_blob_free(&auth_blob);
 544
 545         return NT_STATUS_OK;
 546 }
 547
 548 /*******************************************************************
 549  Check/unseal the Schannel auth data. (Unseal in place).
 550  ********************************************************************/
 551
 552 static NTSTATUS get_schannel_auth_footer(TALLOC_CTX *mem_ctx,
 553                                          struct schannel_state *auth_state,
 554                                          enum dcerpc_AuthLevel auth_level,
 555                                          DATA_BLOB *data, DATA_BLOB *full_pkt,
 556                                          DATA_BLOB *auth_token)
 557 {
 558         switch (auth_level) {
 559         case DCERPC_AUTH_LEVEL_PRIVACY:
 560                 /* Data portion is encrypted. */
 561                 return netsec_incoming_packet(auth_state,
 562                                                 true,
 563                                                 data->data,
 564                                                 data->length,
 565                                                 auth_token);
 566
 567         case DCERPC_AUTH_LEVEL_INTEGRITY:
 568                 /* Data is signed. */
 569                 return netsec_incoming_packet(auth_state,
 570                                                 false,
 571                                                 data->data,
 572                                                 data->length,
 573                                                 auth_token);
 574
 575         default:
 576                 return NT_STATUS_INVALID_PARAMETER;
 577         }
 578 }
 579
 580 /*******************************************************************
 581  Create and add the gssapi sign/seal auth data.
 582  ********************************************************************/
 583
 584 static NTSTATUS add_gssapi_auth_footer(struct gse_context *gse_ctx,
 585                                         enum dcerpc_AuthLevel auth_level,
 586                                         DATA_BLOB *rpc_out)
 587 {
 588         DATA_BLOB data;
 589         DATA_BLOB auth_blob;
 590         NTSTATUS status;
 591
 592         if (!gse_ctx) {
 593                 return NT_STATUS_INVALID_PARAMETER;
 594         }
 595
 596         data.data = rpc_out->data + DCERPC_RESPONSE_LENGTH;
 597         data.length = rpc_out->length - DCERPC_RESPONSE_LENGTH
 598                                         - DCERPC_AUTH_TRAILER_LENGTH;
 599
 600         switch (auth_level) {
 601         case DCERPC_AUTH_LEVEL_PRIVACY:
 602                 status = gse_seal(talloc_tos(), gse_ctx, &data, &auth_blob);
 603                 break;
 604         case DCERPC_AUTH_LEVEL_INTEGRITY:
 605                 status = gse_sign(talloc_tos(), gse_ctx, &data, &auth_blob);
 606                 break;
 607         default:
 608                 status = NT_STATUS_INTERNAL_ERROR;
 609                 break;
 610         }
 611
 612         if (!NT_STATUS_IS_OK(status)) {
 613                 DEBUG(1, ("Failed to process packet: %s\n",
 614                           nt_errstr(status)));
 615                 return status;
 616         }
 617
 618         /* Finally attach the blob. */
 619         if (!data_blob_append(NULL, rpc_out,
 620                                 auth_blob.data, auth_blob.length)) {
 621                 return NT_STATUS_NO_MEMORY;
 622         }
 623
 624         data_blob_free(&auth_blob);
 625
 626         return NT_STATUS_OK;
 627 }
 628
 629 /*******************************************************************
 630  Check/unseal the gssapi auth data. (Unseal in place).
 631  ********************************************************************/
 632
 633 static NTSTATUS get_gssapi_auth_footer(TALLOC_CTX *mem_ctx,
 634                                         struct gse_context *gse_ctx,
 635                                         enum dcerpc_AuthLevel auth_level,
 636                                         DATA_BLOB *data, DATA_BLOB *full_pkt,
 637                                         DATA_BLOB *auth_token)
 638 {
 639         /* TODO: pass in full_pkt when
 640          * DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN is set */
 641         switch (auth_level) {
 642         case DCERPC_AUTH_LEVEL_PRIVACY:
 643                 /* Data portion is encrypted. */
 644                 return gse_unseal(mem_ctx, gse_ctx,
 645                                   data, auth_token);
 646
 647         case DCERPC_AUTH_LEVEL_INTEGRITY:
 648                 /* Data is signed. */
 649                 return gse_sigcheck(mem_ctx, gse_ctx,
 650                                     data, auth_token);
 651         default:
 652                 return NT_STATUS_INVALID_PARAMETER;
 653         }
 654 }
 655
 656 /*******************************************************************
 657  Create and add the spnego-negotiated sign/seal auth data.
 658  ********************************************************************/
 659
 660 static NTSTATUS add_spnego_auth_footer(struct spnego_context *spnego_ctx,
 661                                         enum dcerpc_AuthLevel auth_level,
 662                                         DATA_BLOB *rpc_out)
 663 {
 664         DATA_BLOB auth_blob;
 665         DATA_BLOB rpc_data;
 666         NTSTATUS status;
 667
 668         if (!spnego_ctx) {
 669                 return NT_STATUS_INVALID_PARAMETER;
 670         }
 671
 672         rpc_data = data_blob_const(rpc_out->data
 673                                         + DCERPC_RESPONSE_LENGTH,
 674                                    rpc_out->length
 675                                         - DCERPC_RESPONSE_LENGTH
 676                                         - DCERPC_AUTH_TRAILER_LENGTH);
 677
 678         switch (auth_level) {
 679         case DCERPC_AUTH_LEVEL_PRIVACY:
 680                 /* Data portion is encrypted. */
 681                 status = spnego_seal(rpc_out->data, spnego_ctx,
 682                                      &rpc_data, rpc_out, &auth_blob);
 683                 break;
 684
 685                 if (!NT_STATUS_IS_OK(status)) {
 686                         return status;
 687                 }
 688                 break;
 689
 690         case DCERPC_AUTH_LEVEL_INTEGRITY:
 691                 /* Data is signed. */
 692                 status = spnego_sign(rpc_out->data, spnego_ctx,
 693                                      &rpc_data, rpc_out, &auth_blob);
 694                 break;
 695
 696                 if (!NT_STATUS_IS_OK(status)) {
 697                         return status;
 698                 }
 699                 break;
 700
 701         default:
 702                 /* Can't happen. */
 703                 smb_panic("bad auth level");
 704                 /* Notreached. */
 705                 return NT_STATUS_INVALID_PARAMETER;
 706         }
 707
 708         /* Finally attach the blob. */
 709         if (!data_blob_append(NULL, rpc_out,
 710                                 auth_blob.data, auth_blob.length)) {
 711                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
 712                           (unsigned int)auth_blob.length));
 713                 return NT_STATUS_NO_MEMORY;
 714         }
 715         data_blob_free(&auth_blob);
 716
 717         return NT_STATUS_OK;
 718 }
 719
 720 static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx,
 721                                         struct spnego_context *sp_ctx,
 722                                         enum dcerpc_AuthLevel auth_level,
 723                                         DATA_BLOB *data, DATA_BLOB *full_pkt,
 724                                         DATA_BLOB *auth_token)
 725 {
 726         switch (auth_level) {
 727         case DCERPC_AUTH_LEVEL_PRIVACY:
 728                 /* Data portion is encrypted. */
 729                 return spnego_unseal(mem_ctx, sp_ctx,
 730                                      data, full_pkt, auth_token);
 731
 732         case DCERPC_AUTH_LEVEL_INTEGRITY:
 733                 /* Data is signed. */
 734                 return spnego_sigcheck(mem_ctx, sp_ctx,
 735                                        data, full_pkt, auth_token);
 736
 737         default:
 738                 return NT_STATUS_INVALID_PARAMETER;
 739         }
 740 }
 741
 742 /**
 743 * @brief   Append an auth footer according to what is the current mechanism
 744 *
 745 * @param auth           The pipe_auth_data associated with the connection
 746 * @param pad_len        The padding used in the packet
 747 * @param rpc_out        Packet blob up to and including the auth header
 748 *
 749 * @return A NTSTATUS error code.
 750 */
 751 NTSTATUS dcerpc_add_auth_footer(struct pipe_auth_data *auth,
 752                                 size_t pad_len, DATA_BLOB *rpc_out)
 753 {
 754         struct schannel_state *schannel_auth;
 755         struct gensec_security *gensec_security;
 756         struct spnego_context *spnego_ctx;
 757         struct gse_context *gse_ctx;
 758         char pad[CLIENT_NDR_PADDING_SIZE] = { 0, };
 759         DATA_BLOB auth_info;
 760         DATA_BLOB auth_blob;
 761         NTSTATUS status;
 762
 763         if (auth->auth_type == DCERPC_AUTH_TYPE_NONE ||
 764             auth->auth_type == DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM) {
 765                 return NT_STATUS_OK;
 766         }
 767
 768         if (pad_len) {
 769                 /* Copy the sign/seal padding data. */
 770                 if (!data_blob_append(NULL, rpc_out, pad, pad_len)) {
 771                         return NT_STATUS_NO_MEMORY;
 772                 }
 773         }
 774
 775         /* marshall the dcerpc_auth with an actually empty auth_blob.
 776          * This is needed because the ntmlssp signature includes the
 777          * auth header. We will append the actual blob later. */
 778         auth_blob = data_blob_null;
 779         status = dcerpc_push_dcerpc_auth(rpc_out->data,
 780                                          auth->auth_type,
 781                                          auth->auth_level,
 782                                          pad_len,
 783                                          1 /* context id. */,
 784                                          &auth_blob,
 785                                          &auth_info);
 786         if (!NT_STATUS_IS_OK(status)) {
 787                 return status;
 788         }
 789
 790         /* append the header */
 791         if (!data_blob_append(NULL, rpc_out,
 792                                 auth_info.data, auth_info.length)) {
 793                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
 794                           (unsigned int)auth_info.length));
 795                 return NT_STATUS_NO_MEMORY;
 796         }
 797         data_blob_free(&auth_info);
 798
 799         /* Generate any auth sign/seal and add the auth footer. */
 800         switch (auth->auth_type) {
 801         case DCERPC_AUTH_TYPE_NONE:
 802         case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
 803                 status = NT_STATUS_OK;
 804                 break;
 805         case DCERPC_AUTH_TYPE_SPNEGO:
 806                 spnego_ctx = talloc_get_type_abort(auth->auth_ctx,
 807                                                    struct spnego_context);
 808                 status = add_spnego_auth_footer(spnego_ctx,
 809                                                 auth->auth_level, rpc_out);
 810                 break;
 811         case DCERPC_AUTH_TYPE_NTLMSSP:
 812                 gensec_security = talloc_get_type_abort(auth->auth_ctx,
 813                                                 struct gensec_security);
 814                 status = add_ntlmssp_auth_footer(gensec_security,
 815                                                  auth->auth_level,
 816                                                  rpc_out);
 817                 break;
 818         case DCERPC_AUTH_TYPE_SCHANNEL:
 819                 schannel_auth = talloc_get_type_abort(auth->auth_ctx,
 820                                                       struct schannel_state);
 821                 status = add_schannel_auth_footer(schannel_auth,
 822                                                   auth->auth_level,
 823                                                   rpc_out);
 824                 break;
 825         case DCERPC_AUTH_TYPE_KRB5:
 826                 gse_ctx = talloc_get_type_abort(auth->auth_ctx,
 827                                                 struct gse_context);
 828                 status = add_gssapi_auth_footer(gse_ctx,
 829                                                 auth->auth_level,
 830                                                 rpc_out);
 831                 break;
 832         default:
 833                 status = NT_STATUS_INVALID_PARAMETER;
 834                 break;
 835         }
 836
 837         return status;
 838 }
 839
 840 /**
 841 * @brief Check authentication for request/response packets
 842 *
 843 * @param auth           The auth data for the connection
 844 * @param pkt            The actual ncacn_packet
 845 * @param pkt_trailer    The stub_and_verifier part of the packet
 846 * @param header_size    The header size
 847 * @param raw_pkt        The whole raw packet data blob
 848 * @param pad_len        [out] The padding length used in the packet
 849 *
 850 * @return A NTSTATUS error code
 851 */
 852 NTSTATUS dcerpc_check_auth(struct pipe_auth_data *auth,
 853                            struct ncacn_packet *pkt,
 854                            DATA_BLOB *pkt_trailer,
 855                            size_t header_size,
 856                            DATA_BLOB *raw_pkt,
 857                            size_t *pad_len)
 858 {
 859         struct schannel_state *schannel_auth;
 860         struct gensec_security *gensec_security;
 861         struct spnego_context *spnego_ctx;
 862         struct gse_context *gse_ctx;
 863         NTSTATUS status;
 864         struct dcerpc_auth auth_info;
 865         uint32_t auth_length;
 866         DATA_BLOB full_pkt;
 867         DATA_BLOB data;
 868
 869         switch (auth->auth_level) {
 870         case DCERPC_AUTH_LEVEL_PRIVACY:
 871                 DEBUG(10, ("Requested Privacy.\n"));
 872                 break;
 873
 874         case DCERPC_AUTH_LEVEL_INTEGRITY:
 875                 DEBUG(10, ("Requested Integrity.\n"));
 876                 break;
 877
 878         case DCERPC_AUTH_LEVEL_CONNECT:
 879                 if (pkt->auth_length != 0) {
 880                         break;
 881                 }
 882                 *pad_len = 0;
 883                 return NT_STATUS_OK;
 884
 885         case DCERPC_AUTH_LEVEL_NONE:
 886                 if (pkt->auth_length != 0) {
 887                         DEBUG(3, ("Got non-zero auth len on non "
 888                                   "authenticated connection!\n"));
 889                         return NT_STATUS_INVALID_PARAMETER;
 890                 }
 891                 *pad_len = 0;
 892                 return NT_STATUS_OK;
 893
 894         default:
 895                 DEBUG(3, ("Unimplemented Auth Level %d",
 896                           auth->auth_level));
 897                 return NT_STATUS_INVALID_PARAMETER;
 898         }
 899
 900         /* Paranioa checks for auth_length. */
 901         if (pkt->auth_length > pkt->frag_length) {
 902                 return NT_STATUS_INFO_LENGTH_MISMATCH;
 903         }
 904         if (((unsigned int)pkt->auth_length
 905              + DCERPC_AUTH_TRAILER_LENGTH < (unsigned int)pkt->auth_length) ||
 906             ((unsigned int)pkt->auth_length
 907              + DCERPC_AUTH_TRAILER_LENGTH < DCERPC_AUTH_TRAILER_LENGTH)) {
 908                 /* Integer wrap attempt. */
 909                 return NT_STATUS_INFO_LENGTH_MISMATCH;
 910         }
 911
 912         status = dcerpc_pull_auth_trailer(pkt, pkt, pkt_trailer,
 913                                           &auth_info, &auth_length, false);
 914         if (!NT_STATUS_IS_OK(status)) {
 915                 return status;
 916         }
 917
 918         data = data_blob_const(raw_pkt->data + header_size,
 919                                 pkt_trailer->length - auth_length);
 920         full_pkt = data_blob_const(raw_pkt->data,
 921                                 raw_pkt->length - auth_info.credentials.length);
 922
 923         switch (auth->auth_type) {
 924         case DCERPC_AUTH_TYPE_NONE:
 925         case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
 926                 return NT_STATUS_OK;
 927
 928         case DCERPC_AUTH_TYPE_SPNEGO:
 929                 spnego_ctx = talloc_get_type_abort(auth->auth_ctx,
 930                                                    struct spnego_context);
 931                 status = get_spnego_auth_footer(pkt, spnego_ctx,
 932                                                 auth->auth_level,
 933                                                 &data, &full_pkt,
 934                                                 &auth_info.credentials);
 935                 if (!NT_STATUS_IS_OK(status)) {
 936                         return status;
 937                 }
 938                 break;
 939
 940         case DCERPC_AUTH_TYPE_NTLMSSP:
 941
 942                 DEBUG(10, ("NTLMSSP auth\n"));
 943
 944                 gensec_security = talloc_get_type_abort(auth->auth_ctx,
 945                                                 struct gensec_security);
 946                 status = get_ntlmssp_auth_footer(gensec_security,
 947                                                  auth->auth_level,
 948                                                  &data, &full_pkt,
 949                                                  &auth_info.credentials);
 950                 if (!NT_STATUS_IS_OK(status)) {
 951                         return status;
 952                 }
 953                 break;
 954
 955         case DCERPC_AUTH_TYPE_SCHANNEL:
 956
 957                 DEBUG(10, ("SCHANNEL auth\n"));
 958
 959                 schannel_auth = talloc_get_type_abort(auth->auth_ctx,
 960                                                       struct schannel_state);
 961                 status = get_schannel_auth_footer(pkt, schannel_auth,
 962                                                   auth->auth_level,
 963                                                   &data, &full_pkt,
 964                                                   &auth_info.credentials);
 965                 if (!NT_STATUS_IS_OK(status)) {
 966                         return status;
 967                 }
 968                 break;
 969
 970         case DCERPC_AUTH_TYPE_KRB5:
 971
 972                 DEBUG(10, ("KRB5 auth\n"));
 973
 974                 gse_ctx = talloc_get_type_abort(auth->auth_ctx,
 975                                                 struct gse_context);
 976                 status = get_gssapi_auth_footer(pkt, gse_ctx,
 977                                                 auth->auth_level,
 978                                                 &data, &full_pkt,
 979                                                 &auth_info.credentials);
 980                 if (!NT_STATUS_IS_OK(status)) {
 981                         return status;
 982                 }
 983                 break;
 984
 985         default:
 986                 DEBUG(0, ("process_request_pdu: "
 987                           "unknown auth type %u set.\n",
 988                           (unsigned int)auth->auth_type));
 989                 return NT_STATUS_INVALID_PARAMETER;
 990         }
 991
 992         /* TODO: remove later
 993          * this is still needed because in the server code the
 994          * pkt_trailer actually has a copy of the raw data, and they
 995          * are still both used in later calls */
 996         if (auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 997                 memcpy(pkt_trailer->data, data.data, data.length);
 998         }
 999
1000         *pad_len = auth_info.auth_pad_length;
1001         data_blob_free(&auth_info.credentials);
1002         return NT_STATUS_OK;
1003 }
1004