source3/librpc/crypto/gse.c

   1 /*
   2  *  GSSAPI Security Extensions
   3  *  RPC Pipe client and server routines
   4  *  Copyright (C) Simo Sorce 2010.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /* We support only GSSAPI/KRB5 here */
  21
  22 #include "includes.h"
  23 #include "gse.h"
  24
  25 #if defined(HAVE_KRB5) && defined(HAVE_GSS_WRAP_IOV)
  26
  27 #include "smb_krb5.h"
  28 #include "gse_krb5.h"
  29
  30 #include <gssapi/gssapi.h>
  31 #include <gssapi/gssapi_krb5.h>
  32 #ifdef HAVE_GSSAPI_GSSAPI_EXT_H
  33 #include <gssapi/gssapi_ext.h>
  34 #endif
  35
  36 #ifndef GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
  37 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11
  38 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05"
  39 #endif
  40
  41 gss_OID_desc gse_sesskey_inq_oid = {
  42         GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH,
  43         (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
  44 };
  45
  46 #ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID
  47 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10
  48 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID  "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04"
  49 #endif
  50
  51 gss_OID_desc gse_sesskeytype_oid = {
  52         GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH,
  53         (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID
  54 };
  55
  56 #define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12
  57 /*                                          EXTRACTION OID                                 AUTHZ ID */
  58 #define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01"
  59
  60 gss_OID_desc gse_authz_data_oid = {
  61         GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH,
  62         (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID
  63 };
  64
  65 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
  66
  67 struct gse_context {
  68         krb5_context k5ctx;
  69         krb5_ccache ccache;
  70         krb5_keytab keytab;
  71
  72         gss_ctx_id_t gss_ctx;
  73
  74         gss_OID_desc gss_mech;
  75         OM_uint32 gss_c_flags;
  76         gss_cred_id_t creds;
  77         gss_name_t server_name;
  78
  79         gss_OID ret_mech;
  80         OM_uint32 ret_flags;
  81         gss_cred_id_t delegated_creds;
  82         gss_name_t client_name;
  83
  84         bool more_processing;
  85         bool authenticated;
  86 };
  87
  88 #ifndef HAVE_GSS_OID_EQUAL
  89
  90 static bool gss_oid_equal(const gss_OID o1, const gss_OID o2)
  91 {
  92         if (o1 == o2) {
  93                 return true;
  94         }
  95         if ((o1 == NULL && o2 != NULL) || (o1 != NULL && o2 == NULL)) {
  96                 return false;
  97         }
  98         if (o1->length != o2->length) {
  99                 return false;
 100         }
 101         return memcmp(o1->elements, o2->elements, o1->length) == false;
 102 }
 103
 104 #endif
 105
 106 /* free non talloc dependent contexts */
 107 static int gse_context_destructor(void *ptr)
 108 {
 109         struct gse_context *gse_ctx;
 110         OM_uint32 gss_min, gss_maj;
 111
 112         gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
 113         if (gse_ctx->k5ctx) {
 114                 if (gse_ctx->ccache) {
 115                         krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
 116                         gse_ctx->ccache = NULL;
 117                 }
 118                 if (gse_ctx->keytab) {
 119                         krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
 120                         gse_ctx->keytab = NULL;
 121                 }
 122                 krb5_free_context(gse_ctx->k5ctx);
 123                 gse_ctx->k5ctx = NULL;
 124         }
 125         if (gse_ctx->gss_ctx != GSS_C_NO_CONTEXT) {
 126                 gss_maj = gss_delete_sec_context(&gss_min,
 127                                                  &gse_ctx->gss_ctx,
 128                                                  GSS_C_NO_BUFFER);
 129         }
 130         if (gse_ctx->server_name) {
 131                 gss_maj = gss_release_name(&gss_min,
 132                                            &gse_ctx->server_name);
 133         }
 134         if (gse_ctx->client_name) {
 135                 gss_maj = gss_release_name(&gss_min,
 136                                            &gse_ctx->client_name);
 137         }
 138         if (gse_ctx->creds) {
 139                 gss_maj = gss_release_cred(&gss_min,
 140                                            &gse_ctx->creds);
 141         }
 142         if (gse_ctx->delegated_creds) {
 143                 gss_maj = gss_release_cred(&gss_min,
 144                                            &gse_ctx->delegated_creds);
 145         }
 146
 147         /* MIT and Heimdal differ as to if you can call
 148          * gss_release_oid() on this OID, generated by
 149          * gss_{accept,init}_sec_context().  However, as long as the
 150          * oid is gss_mech_krb5 (which it always is at the moment),
 151          * then this is a moot point, as both declare this particular
 152          * OID static, and so no memory is lost.  This assert is in
 153          * place to ensure that the programmer who wishes to extend
 154          * this code to EAP or other GSS mechanisms determines an
 155          * implementation-dependent way of releasing any dynamically
 156          * allocated OID */
 157         SMB_ASSERT(gss_oid_equal(&gse_ctx->gss_mech, GSS_C_NO_OID) || gss_oid_equal(&gse_ctx->gss_mech, gss_mech_krb5));
 158
 159         return 0;
 160 }
 161
 162 static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
 163                                  bool do_sign, bool do_seal,
 164                                  const char *ccache_name,
 165                                  uint32_t add_gss_c_flags,
 166                                  struct gse_context **_gse_ctx)
 167 {
 168         struct gse_context *gse_ctx;
 169         krb5_error_code k5ret;
 170         NTSTATUS status;
 171
 172         gse_ctx = talloc_zero(mem_ctx, struct gse_context);
 173         if (!gse_ctx) {
 174                 return NT_STATUS_NO_MEMORY;
 175         }
 176         talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
 177
 178         memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
 179
 180         gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG |
 181                                 GSS_C_DELEG_FLAG |
 182                                 GSS_C_DELEG_POLICY_FLAG |
 183                                 GSS_C_REPLAY_FLAG |
 184                                 GSS_C_SEQUENCE_FLAG;
 185         if (do_sign) {
 186                 gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG;
 187         }
 188         if (do_seal) {
 189                 gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG;
 190         }
 191
 192         gse_ctx->gss_c_flags |= add_gss_c_flags;
 193
 194         /* Initialize Kerberos Context */
 195         initialize_krb5_error_table();
 196
 197         k5ret = krb5_init_context(&gse_ctx->k5ctx);
 198         if (k5ret) {
 199                 DEBUG(0, ("Failed to initialize kerberos context! (%s)\n",
 200                           error_message(k5ret)));
 201                 status = NT_STATUS_INTERNAL_ERROR;
 202                 goto err_out;
 203         }
 204
 205         if (!ccache_name) {
 206                 ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
 207         }
 208         k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
 209                                 &gse_ctx->ccache);
 210         if (k5ret) {
 211                 DEBUG(1, ("Failed to resolve credential cache! (%s)\n",
 212                           error_message(k5ret)));
 213                 status = NT_STATUS_INTERNAL_ERROR;
 214                 goto err_out;
 215         }
 216
 217         /* TODO: Should we enforce a enc_types list ?
 218         ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
 219         */
 220
 221         *_gse_ctx = gse_ctx;
 222         return NT_STATUS_OK;
 223
 224 err_out:
 225         TALLOC_FREE(gse_ctx);
 226         return status;
 227 }
 228
 229 NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
 230                           bool do_sign, bool do_seal,
 231                           const char *ccache_name,
 232                           const char *server,
 233                           const char *service,
 234                           const char *username,
 235                           const char *password,
 236                           uint32_t add_gss_c_flags,
 237                           struct gse_context **_gse_ctx)
 238 {
 239         struct gse_context *gse_ctx;
 240         OM_uint32 gss_maj, gss_min;
 241         gss_buffer_desc name_buffer = {0, NULL};
 242         gss_OID_set_desc mech_set;
 243         NTSTATUS status;
 244
 245         if (!server || !service) {
 246                 return NT_STATUS_INVALID_PARAMETER;
 247         }
 248
 249         status = gse_context_init(mem_ctx, do_sign, do_seal,
 250                                   ccache_name, add_gss_c_flags,
 251                                   &gse_ctx);
 252         if (!NT_STATUS_IS_OK(status)) {
 253                 return NT_STATUS_NO_MEMORY;
 254         }
 255
 256         name_buffer.value = talloc_asprintf(gse_ctx,
 257                                             "%s@%s", service, server);
 258         if (!name_buffer.value) {
 259                 status = NT_STATUS_NO_MEMORY;
 260                 goto err_out;
 261         }
 262         name_buffer.length = strlen((char *)name_buffer.value);
 263         gss_maj = gss_import_name(&gss_min, &name_buffer,
 264                                   GSS_C_NT_HOSTBASED_SERVICE,
 265                                   &gse_ctx->server_name);
 266         if (gss_maj) {
 267                 DEBUG(0, ("gss_import_name failed for %s, with [%s]\n",
 268                           (char *)name_buffer.value,
 269                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 270                 status = NT_STATUS_INTERNAL_ERROR;
 271                 goto err_out;
 272         }
 273
 274         /* TODO: get krb5 ticket using username/password, if no valid
 275          * one already available in ccache */
 276
 277         mech_set.count = 1;
 278         mech_set.elements = &gse_ctx->gss_mech;
 279
 280         gss_maj = gss_acquire_cred(&gss_min,
 281                                    GSS_C_NO_NAME,
 282                                    GSS_C_INDEFINITE,
 283                                    &mech_set,
 284                                    GSS_C_INITIATE,
 285                                    &gse_ctx->creds,
 286                                    NULL, NULL);
 287         if (gss_maj) {
 288                 DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n",
 289                           (char *)name_buffer.value,
 290                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 291                 status = NT_STATUS_INTERNAL_ERROR;
 292                 goto err_out;
 293         }
 294
 295         *_gse_ctx = gse_ctx;
 296         TALLOC_FREE(name_buffer.value);
 297         return NT_STATUS_OK;
 298
 299 err_out:
 300         TALLOC_FREE(name_buffer.value);
 301         TALLOC_FREE(gse_ctx);
 302         return status;
 303 }
 304
 305 NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
 306                                    struct gse_context *gse_ctx,
 307                                    DATA_BLOB *token_in,
 308                                    DATA_BLOB *token_out)
 309 {
 310         OM_uint32 gss_maj, gss_min;
 311         gss_buffer_desc in_data;
 312         gss_buffer_desc out_data;
 313         DATA_BLOB blob = data_blob_null;
 314         NTSTATUS status;
 315
 316         in_data.value = token_in->data;
 317         in_data.length = token_in->length;
 318
 319         gss_maj = gss_init_sec_context(&gss_min,
 320                                         gse_ctx->creds,
 321                                         &gse_ctx->gss_ctx,
 322                                         gse_ctx->server_name,
 323                                         &gse_ctx->gss_mech,
 324                                         gse_ctx->gss_c_flags,
 325                                         0, GSS_C_NO_CHANNEL_BINDINGS,
 326                                         &in_data, NULL, &out_data,
 327                                         NULL, NULL);
 328         switch (gss_maj) {
 329         case GSS_S_COMPLETE:
 330                 /* we are done with it */
 331                 gse_ctx->more_processing = false;
 332                 status = NT_STATUS_OK;
 333                 break;
 334         case GSS_S_CONTINUE_NEEDED:
 335                 /* we will need a third leg */
 336                 gse_ctx->more_processing = true;
 337                 /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
 338                 status = NT_STATUS_OK;
 339                 break;
 340         default:
 341                 DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
 342                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 343                 status = NT_STATUS_INTERNAL_ERROR;
 344                 goto done;
 345         }
 346
 347         blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
 348         if (!blob.data) {
 349                 status = NT_STATUS_NO_MEMORY;
 350         }
 351
 352         gss_maj = gss_release_buffer(&gss_min, &out_data);
 353
 354 done:
 355         *token_out = blob;
 356         return status;
 357 }
 358
 359 NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
 360                          bool do_sign, bool do_seal,
 361                          uint32_t add_gss_c_flags,
 362                          struct gse_context **_gse_ctx)
 363 {
 364         struct gse_context *gse_ctx;
 365         OM_uint32 gss_maj, gss_min;
 366         krb5_error_code ret;
 367         NTSTATUS status;
 368
 369         status = gse_context_init(mem_ctx, do_sign, do_seal,
 370                                   NULL, add_gss_c_flags, &gse_ctx);
 371         if (!NT_STATUS_IS_OK(status)) {
 372                 return NT_STATUS_NO_MEMORY;
 373         }
 374
 375         ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
 376                                          &gse_ctx->keytab);
 377         if (ret) {
 378                 status = NT_STATUS_INTERNAL_ERROR;
 379                 goto done;
 380         }
 381
 382 #ifdef HAVE_GSS_KRB5_IMPORT_CRED
 383         /* This creates a GSSAPI cred_id_t with the principal and keytab set */
 384         gss_maj = gss_krb5_import_cred(&gss_min, NULL, NULL, gse_ctx->keytab,
 385                                         &gse_ctx->creds);
 386         if (gss_maj) {
 387                 DEBUG(0, ("gss_krb5_import_cred failed with [%s]\n",
 388                           gse_errstr(gse_ctx, gss_maj, gss_min)));
 389                 status = NT_STATUS_INTERNAL_ERROR;
 390                 goto done;
 391         }
 392 #else
 393         /* FIXME!!!
 394          * This call sets the default keytab for the whole server, not
 395          * just for this context. Need to find a way that does not alter
 396          * the state of the whole server ... */
 397         {
 398                 const char *ktname;
 399                 gss_OID_set_desc mech_set;
 400
 401                 ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx,
 402                                    gse_ctx->keytab, &ktname);
 403                 if (ret) {
 404                         status = NT_STATUS_INTERNAL_ERROR;
 405                         goto done;
 406                 }
 407
 408                 ret = gsskrb5_register_acceptor_identity(ktname);
 409                 if (ret) {
 410                         status = NT_STATUS_INTERNAL_ERROR;
 411                         goto done;
 412                 }
 413
 414                 mech_set.count = 1;
 415                 mech_set.elements = &gse_ctx->gss_mech;
 416
 417                 gss_maj = gss_acquire_cred(&gss_min,
 418                                    GSS_C_NO_NAME,
 419                                    GSS_C_INDEFINITE,
 420                                    &mech_set,
 421                                    GSS_C_ACCEPT,
 422                                    &gse_ctx->creds,
 423                                    NULL, NULL);
 424
 425                 if (gss_maj) {
 426                         DEBUG(0, ("gss_acquire_creds failed with [%s]\n",
 427                                   gse_errstr(gse_ctx, gss_maj, gss_min)));
 428                         status = NT_STATUS_INTERNAL_ERROR;
 429                         goto done;
 430                 }
 431         }
 432 #endif
 433         status = NT_STATUS_OK;
 434
 435 done:
 436         if (!NT_STATUS_IS_OK(status)) {
 437                 TALLOC_FREE(gse_ctx);
 438         }
 439
 440         *_gse_ctx = gse_ctx;
 441         return status;
 442 }
 443
 444 NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
 445                                    struct gse_context *gse_ctx,
 446                                    DATA_BLOB *token_in,
 447                                    DATA_BLOB *token_out)
 448 {
 449         OM_uint32 gss_maj, gss_min;
 450         gss_buffer_desc in_data;
 451         gss_buffer_desc out_data;
 452         DATA_BLOB blob = data_blob_null;
 453         NTSTATUS status;
 454
 455         in_data.value = token_in->data;
 456         in_data.length = token_in->length;
 457
 458         gss_maj = gss_accept_sec_context(&gss_min,
 459                                          &gse_ctx->gss_ctx,
 460                                          gse_ctx->creds,
 461                                          &in_data,
 462                                          GSS_C_NO_CHANNEL_BINDINGS,
 463                                          &gse_ctx->client_name,
 464                                          &gse_ctx->ret_mech,
 465                                          &out_data,
 466                                          &gse_ctx->ret_flags, NULL,
 467                                          &gse_ctx->delegated_creds);
 468         switch (gss_maj) {
 469         case GSS_S_COMPLETE:
 470                 /* we are done with it */
 471                 gse_ctx->more_processing = false;
 472                 gse_ctx->authenticated = true;
 473                 status = NT_STATUS_OK;
 474                 break;
 475         case GSS_S_CONTINUE_NEEDED:
 476                 /* we will need a third leg */
 477                 gse_ctx->more_processing = true;
 478                 /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
 479                 status = NT_STATUS_OK;
 480                 break;
 481         default:
 482                 DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
 483                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 484
 485                 if (gse_ctx->gss_ctx) {
 486                         gss_delete_sec_context(&gss_min,
 487                                                 &gse_ctx->gss_ctx,
 488                                                 GSS_C_NO_BUFFER);
 489                 }
 490
 491                 status = NT_STATUS_INTERNAL_ERROR;
 492                 goto done;
 493         }
 494
 495         /* we may be told to return nothing */
 496         if (out_data.length) {
 497                 blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
 498                 if (!blob.data) {
 499                         status = NT_STATUS_NO_MEMORY;
 500                 }
 501                 gss_maj = gss_release_buffer(&gss_min, &out_data);
 502         }
 503
 504
 505 done:
 506         *token_out = blob;
 507         return status;
 508 }
 509
 510 NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
 511 {
 512         if (!gse_ctx->authenticated) {
 513                 return NT_STATUS_INVALID_HANDLE;
 514         }
 515
 516         if (memcmp(gse_ctx->ret_mech,
 517                    gss_mech_krb5, sizeof(gss_OID_desc)) != 0) {
 518                 return NT_STATUS_ACCESS_DENIED;
 519         }
 520
 521         /* GSS_C_MUTUAL_FLAG */
 522         if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) {
 523                 if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) {
 524                         return NT_STATUS_ACCESS_DENIED;
 525                 }
 526         }
 527
 528         /* GSS_C_DELEG_FLAG */
 529         /* GSS_C_DELEG_POLICY_FLAG */
 530         /* GSS_C_REPLAY_FLAG */
 531         /* GSS_C_SEQUENCE_FLAG */
 532
 533         /* GSS_C_INTEG_FLAG */
 534         if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) {
 535                 if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) {
 536                         return NT_STATUS_ACCESS_DENIED;
 537                 }
 538         }
 539
 540         /* GSS_C_CONF_FLAG */
 541         if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) {
 542                 if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) {
 543                         return NT_STATUS_ACCESS_DENIED;
 544                 }
 545         }
 546
 547         return NT_STATUS_OK;
 548 }
 549
 550 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
 551 {
 552         OM_uint32 gss_min, gss_maj;
 553         gss_buffer_desc msg_min;
 554         gss_buffer_desc msg_maj;
 555         OM_uint32 msg_ctx = 0;
 556
 557         char *errstr = NULL;
 558
 559         ZERO_STRUCT(msg_min);
 560         ZERO_STRUCT(msg_maj);
 561
 562         gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
 563                                      GSS_C_NO_OID, &msg_ctx, &msg_maj);
 564         if (gss_maj) {
 565                 goto done;
 566         }
 567         gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
 568                                      (gss_OID)discard_const(gss_mech_krb5),
 569                                      &msg_ctx, &msg_min);
 570         if (gss_maj) {
 571                 goto done;
 572         }
 573
 574         errstr = talloc_strndup(mem_ctx,
 575                                 (char *)msg_maj.value,
 576                                         msg_maj.length);
 577         if (!errstr) {
 578                 goto done;
 579         }
 580         errstr = talloc_strdup_append_buffer(errstr, ": ");
 581         if (!errstr) {
 582                 goto done;
 583         }
 584         errstr = talloc_strndup_append_buffer(errstr,
 585                                                 (char *)msg_min.value,
 586                                                         msg_min.length);
 587         if (!errstr) {
 588                 goto done;
 589         }
 590
 591 done:
 592         if (msg_min.value) {
 593                 gss_maj = gss_release_buffer(&gss_min, &msg_min);
 594         }
 595         if (msg_maj.value) {
 596                 gss_maj = gss_release_buffer(&gss_min, &msg_maj);
 597         }
 598         return errstr;
 599 }
 600
 601 bool gse_require_more_processing(struct gse_context *gse_ctx)
 602 {
 603         return gse_ctx->more_processing;
 604 }
 605
 606 DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
 607                                 struct gse_context *gse_ctx)
 608 {
 609         OM_uint32 gss_min, gss_maj;
 610         gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
 611         DATA_BLOB ret;
 612
 613         gss_maj = gss_inquire_sec_context_by_oid(
 614                                 &gss_min, gse_ctx->gss_ctx,
 615                                 &gse_sesskey_inq_oid, &set);
 616         if (gss_maj) {
 617                 DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
 618                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 619                 return data_blob_null;
 620         }
 621
 622         if ((set == GSS_C_NO_BUFFER_SET) ||
 623             (set->count != 2) ||
 624             (memcmp(set->elements[1].value,
 625                     gse_sesskeytype_oid.elements,
 626                     gse_sesskeytype_oid.length) != 0)) {
 627                 DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
 628                           "OID for data in results:\n"));
 629                 dump_data(1, (uint8_t *)set->elements[1].value,
 630                              set->elements[1].length);
 631                 return data_blob_null;
 632         }
 633
 634         ret = data_blob_talloc(mem_ctx, set->elements[0].value,
 635                                         set->elements[0].length);
 636
 637         gss_maj = gss_release_buffer_set(&gss_min, &set);
 638         return ret;
 639 }
 640
 641 NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
 642                              TALLOC_CTX *mem_ctx, char **cli_name)
 643 {
 644         OM_uint32 gss_min, gss_maj;
 645         gss_buffer_desc name_buffer;
 646
 647         if (!gse_ctx->authenticated) {
 648                 return NT_STATUS_ACCESS_DENIED;
 649         }
 650
 651         if (!gse_ctx->client_name) {
 652                 return NT_STATUS_NOT_FOUND;
 653         }
 654
 655         /* TODO: check OID matches KRB5 Principal Name OID ? */
 656
 657         gss_maj = gss_display_name(&gss_min,
 658                                    gse_ctx->client_name,
 659                                    &name_buffer, NULL);
 660         if (gss_maj) {
 661                 DEBUG(0, ("gss_display_name failed [%s]\n",
 662                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 663                 return NT_STATUS_INTERNAL_ERROR;
 664         }
 665
 666         *cli_name = talloc_strndup(talloc_tos(),
 667                                         (char *)name_buffer.value,
 668                                         name_buffer.length);
 669
 670         gss_maj = gss_release_buffer(&gss_min, &name_buffer);
 671
 672         if (!*cli_name) {
 673                 return NT_STATUS_NO_MEMORY;
 674         }
 675
 676         return NT_STATUS_OK;
 677 }
 678
 679 NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
 680                             TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
 681 {
 682         OM_uint32 gss_min, gss_maj;
 683         gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
 684
 685         if (!gse_ctx->authenticated) {
 686                 return NT_STATUS_ACCESS_DENIED;
 687         }
 688
 689         gss_maj = gss_inquire_sec_context_by_oid(
 690                                 &gss_min, gse_ctx->gss_ctx,
 691                                 &gse_authz_data_oid, &set);
 692         if (gss_maj) {
 693                 DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
 694                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 695                 return NT_STATUS_NOT_FOUND;
 696         }
 697
 698         if (set == GSS_C_NO_BUFFER_SET) {
 699                 DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
 700                           "data in results.\n"));
 701                 return NT_STATUS_INTERNAL_ERROR;
 702         }
 703
 704         /* for now we just hope it is the first value */
 705         *pac = data_blob_talloc(mem_ctx,
 706                                 set->elements[0].value,
 707                                 set->elements[0].length);
 708
 709         gss_maj = gss_release_buffer_set(&gss_min, &set);
 710
 711         return NT_STATUS_OK;
 712 }
 713
 714 NTSTATUS gse_get_pac_blob(struct gse_context *gse_ctx,
 715                           TALLOC_CTX *mem_ctx, DATA_BLOB *pac_blob)
 716 {
 717         if (!gse_ctx->authenticated) {
 718                 return NT_STATUS_ACCESS_DENIED;
 719         }
 720
 721         return gssapi_obtain_pac_blob(mem_ctx, gse_ctx->gss_ctx,
 722                                         gse_ctx->client_name, pac_blob);
 723 }
 724
 725 size_t gse_get_signature_length(struct gse_context *gse_ctx,
 726                                 int seal, size_t payload_size)
 727 {
 728         OM_uint32 gss_min, gss_maj;
 729         gss_iov_buffer_desc iov[2];
 730         uint8_t fakebuf[payload_size];
 731         int sealed;
 732
 733         iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
 734         iov[0].buffer.value = NULL;
 735         iov[0].buffer.length = 0;
 736         iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
 737         iov[1].buffer.value = fakebuf;
 738         iov[1].buffer.length = payload_size;
 739
 740         gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gss_ctx,
 741                                         seal, GSS_C_QOP_DEFAULT,
 742                                         &sealed, iov, 2);
 743         if (gss_maj) {
 744                 DEBUG(0, ("gss_wrap_iov_length failed with [%s]\n",
 745                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 746                 return 0;
 747         }
 748
 749         return iov[0].buffer.length;
 750 }
 751
 752 NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 753                   DATA_BLOB *data, DATA_BLOB *signature)
 754 {
 755         OM_uint32 gss_min, gss_maj;
 756         gss_iov_buffer_desc iov[2];
 757         int req_seal = 1; /* setting to 1 means we request sign+seal */
 758         int sealed;
 759         NTSTATUS status;
 760
 761         /* allocate the memory ourselves so we do not need to talloc_memdup */
 762         signature->length = gse_get_signature_length(gse_ctx, 1, data->length);
 763         if (!signature->length) {
 764                 return NT_STATUS_INTERNAL_ERROR;
 765         }
 766         signature->data = (uint8_t *)talloc_size(mem_ctx, signature->length);
 767         if (!signature->data) {
 768                 return NT_STATUS_NO_MEMORY;
 769         }
 770         iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
 771         iov[0].buffer.value = signature->data;
 772         iov[0].buffer.length = signature->length;
 773
 774         /* data is encrypted in place, which is ok */
 775         iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
 776         iov[1].buffer.value = data->data;
 777         iov[1].buffer.length = data->length;
 778
 779         gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gss_ctx,
 780                                 req_seal, GSS_C_QOP_DEFAULT,
 781                                 &sealed, iov, 2);
 782         if (gss_maj) {
 783                 DEBUG(0, ("gss_wrap_iov failed with [%s]\n",
 784                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 785                 status = NT_STATUS_ACCESS_DENIED;
 786                 goto done;
 787         }
 788
 789         if (!sealed) {
 790                 DEBUG(0, ("gss_wrap_iov says data was not sealed!\n"));
 791                 status = NT_STATUS_ACCESS_DENIED;
 792                 goto done;
 793         }
 794
 795         status = NT_STATUS_OK;
 796
 797         DEBUG(10, ("Sealed %d bytes, and got %d bytes header/signature.\n",
 798                    (int)iov[1].buffer.length, (int)iov[0].buffer.length));
 799
 800 done:
 801         return status;
 802 }
 803
 804 NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 805                     DATA_BLOB *data, DATA_BLOB *signature)
 806 {
 807         OM_uint32 gss_min, gss_maj;
 808         gss_iov_buffer_desc iov[2];
 809         int sealed;
 810         NTSTATUS status;
 811
 812         iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
 813         iov[0].buffer.value = signature->data;
 814         iov[0].buffer.length = signature->length;
 815
 816         /* data is decrypted in place, which is ok */
 817         iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
 818         iov[1].buffer.value = data->data;
 819         iov[1].buffer.length = data->length;
 820
 821         gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gss_ctx,
 822                                  &sealed, NULL, iov, 2);
 823         if (gss_maj) {
 824                 DEBUG(0, ("gss_unwrap_iov failed with [%s]\n",
 825                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 826                 status = NT_STATUS_ACCESS_DENIED;
 827                 goto done;
 828         }
 829
 830         if (!sealed) {
 831                 DEBUG(0, ("gss_unwrap_iov says data is not sealed!\n"));
 832                 status = NT_STATUS_ACCESS_DENIED;
 833                 goto done;
 834         }
 835
 836         status = NT_STATUS_OK;
 837
 838         DEBUG(10, ("Unsealed %d bytes, with %d bytes header/signature.\n",
 839                    (int)iov[1].buffer.length, (int)iov[0].buffer.length));
 840
 841 done:
 842         return status;
 843 }
 844
 845 NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 846                   DATA_BLOB *data, DATA_BLOB *signature)
 847 {
 848         OM_uint32 gss_min, gss_maj;
 849         gss_buffer_desc in_data = { 0, NULL };
 850         gss_buffer_desc out_data = { 0, NULL};
 851         NTSTATUS status;
 852
 853         in_data.value = data->data;
 854         in_data.length = data->length;
 855
 856         gss_maj = gss_get_mic(&gss_min, gse_ctx->gss_ctx,
 857                               GSS_C_QOP_DEFAULT,
 858                               &in_data, &out_data);
 859         if (gss_maj) {
 860                 DEBUG(0, ("gss_get_mic failed with [%s]\n",
 861                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 862                 status = NT_STATUS_ACCESS_DENIED;
 863                 goto done;
 864         }
 865
 866         *signature = data_blob_talloc(mem_ctx,
 867                                         out_data.value, out_data.length);
 868         if (!signature->data) {
 869                 status = NT_STATUS_NO_MEMORY;
 870                 goto done;
 871         }
 872
 873         status = NT_STATUS_OK;
 874
 875 done:
 876         if (out_data.value) {
 877                 gss_maj = gss_release_buffer(&gss_min, &out_data);
 878         }
 879         return status;
 880 }
 881
 882 NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 883                       DATA_BLOB *data, DATA_BLOB *signature)
 884 {
 885         OM_uint32 gss_min, gss_maj;
 886         gss_buffer_desc in_data = { 0, NULL };
 887         gss_buffer_desc in_token = { 0, NULL};
 888         NTSTATUS status;
 889
 890         in_data.value = data->data;
 891         in_data.length = data->length;
 892         in_token.value = signature->data;
 893         in_token.length = signature->length;
 894
 895         gss_maj = gss_verify_mic(&gss_min, gse_ctx->gss_ctx,
 896                                  &in_data, &in_token, NULL);
 897         if (gss_maj) {
 898                 DEBUG(0, ("gss_verify_mic failed with [%s]\n",
 899                           gse_errstr(talloc_tos(), gss_maj, gss_min)));
 900                 status = NT_STATUS_ACCESS_DENIED;
 901                 goto done;
 902         }
 903
 904         status = NT_STATUS_OK;
 905
 906 done:
 907         return status;
 908 }
 909
 910 #else
 911
 912 NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
 913                           bool do_sign, bool do_seal,
 914                           const char *ccache_name,
 915                           const char *server,
 916                           const char *service,
 917                           const char *username,
 918                           const char *password,
 919                           uint32_t add_gss_c_flags,
 920                           struct gse_context **_gse_ctx)
 921 {
 922         return NT_STATUS_NOT_IMPLEMENTED;
 923 }
 924
 925 NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
 926                                    struct gse_context *gse_ctx,
 927                                    DATA_BLOB *token_in,
 928                                    DATA_BLOB *token_out)
 929 {
 930         return NT_STATUS_NOT_IMPLEMENTED;
 931 }
 932
 933 NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
 934                          bool do_sign, bool do_seal,
 935                          uint32_t add_gss_c_flags,
 936                          struct gse_context **_gse_ctx)
 937 {
 938         return NT_STATUS_NOT_IMPLEMENTED;
 939 }
 940
 941 NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
 942                                    struct gse_context *gse_ctx,
 943                                    DATA_BLOB *token_in,
 944                                    DATA_BLOB *token_out)
 945 {
 946         return NT_STATUS_NOT_IMPLEMENTED;
 947 }
 948
 949 NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
 950 {
 951         return NT_STATUS_NOT_IMPLEMENTED;
 952 }
 953
 954 bool gse_require_more_processing(struct gse_context *gse_ctx)
 955 {
 956         return false;
 957 }
 958
 959 DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
 960                               struct gse_context *gse_ctx)
 961 {
 962         return data_blob_null;
 963 }
 964
 965 NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
 966                              TALLOC_CTX *mem_ctx, char **cli_name)
 967 {
 968         return NT_STATUS_NOT_IMPLEMENTED;
 969 }
 970
 971 NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
 972                             TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
 973 {
 974         return NT_STATUS_NOT_IMPLEMENTED;
 975 }
 976
 977 NTSTATUS gse_get_pac_blob(struct gse_context *gse_ctx,
 978                           TALLOC_CTX *mem_ctx, DATA_BLOB *pac_blob)
 979 {
 980         return NT_STATUS_NOT_IMPLEMENTED;
 981 }
 982
 983 size_t gse_get_signature_length(struct gse_context *gse_ctx,
 984                                 int seal, size_t payload_size)
 985 {
 986         return 0;
 987 }
 988
 989 NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 990                   DATA_BLOB *data, DATA_BLOB *signature)
 991 {
 992         return NT_STATUS_NOT_IMPLEMENTED;
 993 }
 994
 995 NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
 996                     DATA_BLOB *data, DATA_BLOB *signature)
 997 {
 998         return NT_STATUS_NOT_IMPLEMENTED;
 999 }
1000
1001 NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
1002                   DATA_BLOB *data, DATA_BLOB *signature)
1003 {
1004         return NT_STATUS_NOT_IMPLEMENTED;
1005 }
1006
1007 NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
1008                       DATA_BLOB *data, DATA_BLOB *signature)
1009 {
1010         return NT_STATUS_NOT_IMPLEMENTED;
1011 }
1012
1013 #endif /* HAVE_KRB5 && HAVE_GSS_WRAP_IOV */