#include "librpc/gen_ndr/ndr_dcerpc.h"
#include "auth/credentials/credentials.h"
#include "auth/gensec/gensec.h"
+#include "auth/auth.h"
#include "param/param.h"
+/*
+ wrapper around gensec_session_info() that handles the special case
+ of not changing existing inherited credentials from a SMB pipe
+ when schannel is in use
+ */
+static NTSTATUS dcesrv_session_info(struct dcesrv_connection *dce_conn)
+{
+ if (dce_conn->auth_state.gensec_security->ops->auth_type == DCERPC_AUTH_TYPE_SCHANNEL &&
+ talloc_get_type(dce_conn->auth_state.session_info, struct auth_session_info)) {
+ return NT_STATUS_OK;
+ }
+ return gensec_session_info(dce_conn->auth_state.gensec_security,
+ &dce_conn->auth_state.session_info);
+}
+
/*
parse any auth information from a dcerpc bind request
return false if we can't handle the auth request for some
struct dcesrv_connection *dce_conn = call->conn;
struct dcesrv_auth *auth = &dce_conn->auth_state;
NTSTATUS status;
- enum ndr_err_code ndr_err;
+ uint32_t auth_length;
if (pkt->u.bind.auth_info.length == 0) {
dce_conn->auth_state.auth_info = NULL;
return false;
}
- ndr_err = ndr_pull_struct_blob(&pkt->u.bind.auth_info,
- call, NULL,
- dce_conn->auth_state.auth_info,
- (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
- if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
- return false;
- }
-
- status = gensec_server_start(dce_conn, call->event_ctx,
- lp_gensec_settings(dce_conn, call->conn->dce_ctx->lp_ctx),
- call->msg_ctx, &auth->gensec_security);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to start GENSEC for DCERPC server: %s\n", nt_errstr(status)));
- return false;
- }
-
+ status = dcerpc_pull_auth_trailer(pkt, call, &pkt->u.bind.auth_info,
+ dce_conn->auth_state.auth_info,
+ &auth_length, false);
server_credentials
= cli_credentials_init(call);
if (!server_credentials) {
server_credentials = NULL;
}
- gensec_set_credentials(auth->gensec_security, server_credentials);
+ status = samba_server_gensec_start(dce_conn, call->event_ctx,
+ call->msg_ctx,
+ call->conn->dce_ctx->lp_ctx,
+ server_credentials,
+ NULL,
+ &auth->gensec_security);
status = gensec_start_mech_by_authtype(auth->gensec_security, auth->auth_info->auth_type,
auth->auth_info->auth_level);
&dce_conn->auth_state.auth_info->credentials);
if (NT_STATUS_IS_OK(status)) {
- status = gensec_session_info(dce_conn->auth_state.gensec_security,
- &dce_conn->auth_state.session_info);
+ status = dcesrv_session_info(dce_conn);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to establish session_info: %s\n", nt_errstr(status)));
return status;
struct ncacn_packet *pkt = &call->pkt;
struct dcesrv_connection *dce_conn = call->conn;
NTSTATUS status;
- enum ndr_err_code ndr_err;
+ uint32_t auth_length;
/* We can't work without an existing gensec state, and an new blob to feed it */
if (!dce_conn->auth_state.auth_info ||
return false;
}
- ndr_err = ndr_pull_struct_blob(&pkt->u.auth3.auth_info,
- call, NULL,
- dce_conn->auth_state.auth_info,
- (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
- if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ status = dcerpc_pull_auth_trailer(pkt, call, &pkt->u.auth3.auth_info,
+ dce_conn->auth_state.auth_info, &auth_length, true);
+ if (!NT_STATUS_IS_OK(status)) {
return false;
}
dce_conn->auth_state.auth_info->credentials,
&dce_conn->auth_state.auth_info->credentials);
if (NT_STATUS_IS_OK(status)) {
- status = gensec_session_info(dce_conn->auth_state.gensec_security,
- &dce_conn->auth_state.session_info);
+ status = dcesrv_session_info(dce_conn);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to establish session_info: %s\n", nt_errstr(status)));
return false;
{
struct ncacn_packet *pkt = &call->pkt;
struct dcesrv_connection *dce_conn = call->conn;
- enum ndr_err_code ndr_err;
+ NTSTATUS status;
+ uint32_t auth_length;
/* on a pure interface change there is no auth blob */
if (pkt->u.alter.auth_info.length == 0) {
return false;
}
- ndr_err = ndr_pull_struct_blob(&pkt->u.alter.auth_info,
- call, NULL,
- dce_conn->auth_state.auth_info,
- (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
- if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ status = dcerpc_pull_auth_trailer(pkt, call, &pkt->u.alter.auth_info,
+ dce_conn->auth_state.auth_info,
+ &auth_length, true);
+ if (!NT_STATUS_IS_OK(status)) {
return false;
}
&dce_conn->auth_state.auth_info->credentials);
if (NT_STATUS_IS_OK(status)) {
- status = gensec_session_info(dce_conn->auth_state.gensec_security,
- &dce_conn->auth_state.session_info);
+ status = dcesrv_session_info(dce_conn);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to establish session_info: %s\n", nt_errstr(status)));
return status;
{
struct ncacn_packet *pkt = &call->pkt;
struct dcesrv_connection *dce_conn = call->conn;
- DATA_BLOB auth_blob;
struct dcerpc_auth auth;
- struct ndr_pull *ndr;
NTSTATUS status;
- enum ndr_err_code ndr_err;
+ uint32_t auth_length;
size_t hdr_size = DCERPC_REQUEST_LENGTH;
if (!dce_conn->auth_state.auth_info ||
return true;
}
+ if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
+ hdr_size += 16;
+ }
+
switch (dce_conn->auth_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
case DCERPC_AUTH_LEVEL_INTEGRITY:
return false;
}
- auth_blob.length = 8 + pkt->auth_length;
-
- /* check for a valid length */
- if (pkt->u.request.stub_and_verifier.length < auth_blob.length) {
- return false;
- }
-
- auth_blob.data =
- pkt->u.request.stub_and_verifier.data +
- pkt->u.request.stub_and_verifier.length - auth_blob.length;
- pkt->u.request.stub_and_verifier.length -= auth_blob.length;
-
- /* pull the auth structure */
- ndr = ndr_pull_init_blob(&auth_blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx));
- if (!ndr) {
+ status = dcerpc_pull_auth_trailer(pkt, call,
+ &pkt->u.request.stub_and_verifier,
+ &auth, &auth_length, false);
+ if (!NT_STATUS_IS_OK(status)) {
return false;
}
- if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
- ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
- }
-
- if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
- ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
- hdr_size += 16;
- }
-
- ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth);
- if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
- talloc_free(ndr);
- return false;
- }
+ pkt->u.request.stub_and_verifier.length -= auth_length;
/* check signature or unseal the packet */
switch (dce_conn->auth_state.auth_info->auth_level) {
/* remove the indicated amount of padding */
if (pkt->u.request.stub_and_verifier.length < auth.auth_pad_length) {
- talloc_free(ndr);
return false;
}
pkt->u.request.stub_and_verifier.length -= auth.auth_pad_length;
- talloc_free(ndr);
return NT_STATUS_IS_OK(status);
}
return false;
}
- /* pad to 16 byte multiple, match win2k3 */
+ /* pad to 16 byte multiple in the payload portion of the
+ packet. This matches what w2k3 does. Note that we can't use
+ ndr_push_align() as that is relative to the start of the
+ whole packet, whereas w2k8 wants it relative to the start
+ of the stub */
dce_conn->auth_state.auth_info->auth_pad_length =
(16 - (pkt->u.response.stub_and_verifier.length & 15)) & 15;
ndr_err = ndr_push_zero(ndr, dce_conn->auth_state.auth_info->auth_pad_length);
break;
}
- if (NT_STATUS_IS_OK(status)) {
- if (creds2.length != sig_size) {
- DEBUG(0,("dcesrv_auth_response: creds2.length[%u] != sig_size[%u] pad[%u] stub[%u]\n",
- creds2.length, (uint32_t)sig_size,
- dce_conn->auth_state.auth_info->auth_pad_length,
- pkt->u.response.stub_and_verifier.length));
- data_blob_free(&creds2);
- status = NT_STATUS_INTERNAL_ERROR;
- }
- }
+ if (!NT_STATUS_IS_OK(status)) {
+ return false;
+ }
- if (NT_STATUS_IS_OK(status)) {
- if (!data_blob_append(call, blob, creds2.data, creds2.length)) {
- status = NT_STATUS_NO_MEMORY;
- }
- data_blob_free(&creds2);
+ if (creds2.length != sig_size) {
+ DEBUG(3,("dcesrv_auth_response: creds2.length[%u] != sig_size[%u] pad[%u] stub[%u]\n",
+ (unsigned)creds2.length, (uint32_t)sig_size,
+ (unsigned)dce_conn->auth_state.auth_info->auth_pad_length,
+ (unsigned)pkt->u.response.stub_and_verifier.length));
+ dcerpc_set_frag_length(blob, blob->length + creds2.length);
+ dcerpc_set_auth_length(blob, creds2.length);
}
- if (!NT_STATUS_IS_OK(status)) {
+ if (!data_blob_append(call, blob, creds2.data, creds2.length)) {
+ status = NT_STATUS_NO_MEMORY;
return false;
- }
+ }
+ data_blob_free(&creds2);
return true;
}