[SCM] Samba Shared Repository - branch master updated
Günther Deschner
gd at samba.org
Mon Aug 30 06:34:04 MDT 2010
The branch, master has been updated
via 36fdb21 dcerpc-gssapi: add function to retrieve client name
via d15d76a dcerpc-gssapi: add function to extract authtime
via 6c80e04 dcerpc-gssapi: add function to extract authorization data (PAC) form gssapi context
via fb1aef0 dcerpc-gssapi: add function to check flags
via e6ed1dc dcerpc-gssapi: add initial server side code
via b31f75d s3-dcerpc: add krb5 helpers
from 26e2492 s3-krb: Reformat and add doxygen comment to decode_pac_data()
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 36fdb211a6f2cfa7c939dc40df5094019c6e977f
Author: Simo Sorce <idra at samba.org>
Date: Wed Aug 25 16:21:51 2010 -0400
dcerpc-gssapi: add function to retrieve client name
Signed-off-by: Günther Deschner <gd at samba.org>
commit d15d76af5f169d27eeecab909174b67f7b44d0ee
Author: Simo Sorce <idra at samba.org>
Date: Sat Aug 21 10:59:52 2010 -0400
dcerpc-gssapi: add function to extract authtime
Signed-off-by: Günther Deschner <gd at samba.org>
commit 6c80e04120542624438e4ca015bdaca45e4baee3
Author: Simo Sorce <idra at samba.org>
Date: Fri Aug 20 09:30:49 2010 -0400
dcerpc-gssapi: add function to extract authorization data (PAC) form gssapi context
Signed-off-by: Günther Deschner <gd at samba.org>
commit fb1aef085e0ae52869bb3906e803e10951da5781
Author: Simo Sorce <idra at samba.org>
Date: Fri Aug 20 09:31:07 2010 -0400
dcerpc-gssapi: add function to check flags
Signed-off-by: Günther Deschner <gd at samba.org>
commit e6ed1dc249f6a1a536efcd7519bc9d9bd5c180dd
Author: Simo Sorce <idra at samba.org>
Date: Fri Aug 20 04:45:56 2010 -0400
dcerpc-gssapi: add initial server side code
Signed-off-by: Günther Deschner <gd at samba.org>
commit b31f75d8f6dbfcad4438262eeb3ecda165f72fae
Author: Simo Sorce <idra at samba.org>
Date: Thu Aug 19 11:25:32 2010 -0400
s3-dcerpc: add krb5 helpers
Signed-off-by: Günther Deschner <gd at samba.org>
-----------------------------------------------------------------------
Summary of changes:
source3/Makefile.in | 1 +
source3/librpc/rpc/dcerpc_gssapi.c | 415 +++++++++++++++++++-
source3/librpc/rpc/dcerpc_gssapi.h | 19 +-
source3/librpc/rpc/dcerpc_krb5.c | 381 ++++++++++++++++++
.../rpc/dcerpc_krb5.h} | 20 +-
5 files changed, 812 insertions(+), 24 deletions(-)
create mode 100644 source3/librpc/rpc/dcerpc_krb5.c
copy source3/{printing/nt_printing_migrate.h => librpc/rpc/dcerpc_krb5.h} (69%)
Changeset truncated at 500 lines:
diff --git a/source3/Makefile.in b/source3/Makefile.in
index 81f0ac9..4f0cbe7 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -597,6 +597,7 @@ LIBSMB_OBJ = libsmb/clientgen.o libsmb/cliconnect.o libsmb/clifile.o \
LIBMSRPC_OBJ = $(SCHANNEL_OBJ) \
rpc_client/cli_pipe.o \
+ librpc/rpc/dcerpc_krb5.o \
librpc/rpc/dcerpc_gssapi.o \
librpc/rpc/dcerpc_spnego.o \
librpc/rpc/rpc_common.o \
diff --git a/source3/librpc/rpc/dcerpc_gssapi.c b/source3/librpc/rpc/dcerpc_gssapi.c
index f2c657c..af94b66 100644
--- a/source3/librpc/rpc/dcerpc_gssapi.c
+++ b/source3/librpc/rpc/dcerpc_gssapi.c
@@ -1,6 +1,6 @@
/*
* GSSAPI Security Extensions
- * RPC Pipe client routines
+ * RPC Pipe client and server routines
* Copyright (C) Simo Sorce 2010.
*
* This program is free software; you can redistribute it and/or modify
@@ -22,7 +22,10 @@
#include "includes.h"
#include "dcerpc_gssapi.h"
-#if defined(HAVE_GSSAPI_GSSAPI_EXT_H) && defined(HAVE_GSS_WRAP_IOV)
+#if defined(HAVE_KRB5) && defined(HAVE_GSSAPI_GSSAPI_EXT_H) && defined(HAVE_GSS_WRAP_IOV)
+
+#include "smb_krb5.h"
+#include "dcerpc_krb5.h"
#include <gssapi/gssapi.h>
#include <gssapi/gssapi_krb5.h>
@@ -33,33 +36,62 @@
#define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05"
#endif
+gss_OID_desc gse_sesskey_inq_oid = {
+ GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH,
+ (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID
+};
+
#ifndef GSS_KRB5_SESSION_KEY_ENCTYPE_OID
#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10
#define GSS_KRB5_SESSION_KEY_ENCTYPE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04"
#endif
-gss_OID_desc gse_sesskey_inq_oid = { GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH,
- (void *)GSS_KRB5_INQ_SSPI_SESSION_KEY_OID };
-gss_OID_desc gse_sesskeytype_oid = { GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH,
- (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID };
+gss_OID_desc gse_sesskeytype_oid = {
+ GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH,
+ (void *)GSS_KRB5_SESSION_KEY_ENCTYPE_OID
+};
+
+#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH 12
+/* EXTRACTION OID AUTHZ ID */
+#define GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a" "\x01"
+
+gss_OID_desc gse_authz_data_oid = {
+ GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID_LENGTH,
+ (void *)GSE_EXTRACT_RELEVANT_AUTHZ_DATA_OID
+};
+
+#ifndef GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID
+#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11
+#define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c"
+#endif
+
+gss_OID_desc gse_authtime_oid = {
+ GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH,
+ (void *)GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID
+};
static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
struct gse_context {
krb5_context k5ctx;
krb5_ccache ccache;
-
- bool spnego_wrap;
+ krb5_keytab keytab;
gss_ctx_id_t gss_ctx;
- OM_uint32 gss_c_flags;
gss_OID_desc gss_mech;
-
+ OM_uint32 gss_c_flags;
+ gss_cred_id_t creds;
gss_name_t server_name;
- gss_cred_id_t cli_creds;
+ gss_OID ret_mech;
+ OM_uint32 ret_flags;
+ gss_cred_id_t delegated_creds;
+ gss_name_t client_name;
+
+ bool spnego_wrap;
bool more_processing;
+ bool authenticated;
};
/* free non talloc dependent contexts */
@@ -74,6 +106,10 @@ static int gse_context_destructor(void *ptr)
krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
gse_ctx->ccache = NULL;
}
+ if (gse_ctx->keytab) {
+ krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
+ gse_ctx->keytab = NULL;
+ }
krb5_free_context(gse_ctx->k5ctx);
gse_ctx->k5ctx = NULL;
}
@@ -86,7 +122,22 @@ static int gse_context_destructor(void *ptr)
gss_maj = gss_release_name(&gss_min,
&gse_ctx->server_name);
}
-
+ if (gse_ctx->client_name) {
+ gss_maj = gss_release_name(&gss_min,
+ &gse_ctx->client_name);
+ }
+ if (gse_ctx->creds) {
+ gss_maj = gss_release_cred(&gss_min,
+ &gse_ctx->creds);
+ }
+ if (gse_ctx->delegated_creds) {
+ gss_maj = gss_release_cred(&gss_min,
+ &gse_ctx->delegated_creds);
+ }
+ if (gse_ctx->ret_mech) {
+ gss_maj = gss_release_oid(&gss_min,
+ &gse_ctx->ret_mech);
+ }
return 0;
}
@@ -231,7 +282,7 @@ NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
GSS_C_INDEFINITE,
&mech_set,
GSS_C_INITIATE,
- &gse_ctx->cli_creds,
+ &gse_ctx->creds,
NULL, NULL);
if (gss_maj) {
DEBUG(0, ("gss_acquire_creds failed for %s, with [%s]\n",
@@ -266,7 +317,7 @@ NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
in_data.length = token_in->length;
gss_maj = gss_init_sec_context(&gss_min,
- gse_ctx->cli_creds,
+ gse_ctx->creds,
&gse_ctx->gss_ctx,
gse_ctx->server_name,
&gse_ctx->gss_mech,
@@ -305,6 +356,188 @@ done:
return status;
}
+NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level,
+ uint32_t add_gss_c_flags,
+ const char *server,
+ const char *keytab_name,
+ struct gse_context **_gse_ctx)
+{
+ struct gse_context *gse_ctx;
+ OM_uint32 gss_maj, gss_min;
+ gss_OID_set_desc mech_set;
+ krb5_error_code ret;
+ const char *ktname;
+ NTSTATUS status;
+
+ status = gse_context_init(mem_ctx, auth_type, auth_level,
+ NULL, add_gss_c_flags, &gse_ctx);
+ if (!NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!keytab_name) {
+ ret = smb_krb5_get_server_keytab(gse_ctx->k5ctx,
+ &gse_ctx->keytab);
+ if (ret) {
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+ ret = smb_krb5_keytab_name(gse_ctx, gse_ctx->k5ctx,
+ gse_ctx->keytab, &ktname);
+ if (ret) {
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+ } else {
+ ktname = keytab_name;
+ }
+
+ /* FIXME!!!
+ * This call sets the default keytab for the whole server, not
+ * just for this context. Need to find a way that does not alter
+ * the state of the whole server ... */
+ ret = gsskrb5_register_acceptor_identity(ktname);
+ if (ret) {
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+
+ mech_set.count = 1;
+ mech_set.elements = &gse_ctx->gss_mech;
+
+ gss_maj = gss_acquire_cred(&gss_min,
+ GSS_C_NO_NAME,
+ GSS_C_INDEFINITE,
+ &mech_set,
+ GSS_C_ACCEPT,
+ &gse_ctx->creds,
+ NULL, NULL);
+ if (gss_maj) {
+ DEBUG(0, ("gss_acquire_creds failed with [%s]\n",
+ gse_errstr(gse_ctx, gss_maj, gss_min)));
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+
+ status = NT_STATUS_OK;
+
+done:
+ if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(gse_ctx);
+ }
+
+ *_gse_ctx = gse_ctx;
+ return status;
+}
+
+NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx,
+ DATA_BLOB *token_in,
+ DATA_BLOB *token_out)
+{
+ OM_uint32 gss_maj, gss_min;
+ gss_buffer_desc in_data;
+ gss_buffer_desc out_data;
+ DATA_BLOB blob = data_blob_null;
+ NTSTATUS status;
+
+ in_data.value = token_in->data;
+ in_data.length = token_in->length;
+
+ gss_maj = gss_accept_sec_context(&gss_min,
+ &gse_ctx->gss_ctx,
+ gse_ctx->creds,
+ &in_data,
+ GSS_C_NO_CHANNEL_BINDINGS,
+ &gse_ctx->client_name,
+ &gse_ctx->ret_mech,
+ &out_data,
+ &gse_ctx->ret_flags, NULL,
+ &gse_ctx->delegated_creds);
+ switch (gss_maj) {
+ case GSS_S_COMPLETE:
+ /* we are done with it */
+ gse_ctx->more_processing = false;
+ gse_ctx->authenticated = true;
+ status = NT_STATUS_OK;
+ break;
+ case GSS_S_CONTINUE_NEEDED:
+ /* we will need a third leg */
+ gse_ctx->more_processing = true;
+ /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
+ status = NT_STATUS_OK;
+ break;
+ default:
+ DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+
+ if (gse_ctx->gss_ctx) {
+ gss_delete_sec_context(&gss_min,
+ &gse_ctx->gss_ctx,
+ GSS_C_NO_BUFFER);
+ }
+
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto done;
+ }
+
+ /* we may be told to return nothing */
+ if (out_data.length) {
+ blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
+ if (!blob.data) {
+ status = NT_STATUS_NO_MEMORY;
+ }
+ gss_maj = gss_release_buffer(&gss_min, &out_data);
+ }
+
+
+done:
+ *token_out = blob;
+ return status;
+}
+
+NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
+{
+ if (!gse_ctx->authenticated) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (memcmp(gse_ctx->ret_mech,
+ gss_mech_krb5, sizeof(gss_OID_desc)) != 0) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ /* GSS_C_MUTUAL_FLAG */
+ if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) {
+ if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ }
+
+ /* GSS_C_DELEG_FLAG */
+ /* GSS_C_DELEG_POLICY_FLAG */
+ /* GSS_C_REPLAY_FLAG */
+ /* GSS_C_SEQUENCE_FLAG */
+
+ /* GSS_C_INTEG_FLAG */
+ if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) {
+ if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ }
+
+ /* GSS_C_CONF_FLAG */
+ if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) {
+ if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
{
OM_uint32 gss_min, gss_maj;
@@ -396,6 +629,117 @@ DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
return ret;
}
+NTSTATUS gse_get_client_name(struct gse_context *gse_ctx,
+ TALLOC_CTX *mem_ctx, char **cli_name)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_buffer_desc name_buffer;
+
+ if (!gse_ctx->authenticated) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ if (!gse_ctx->client_name) {
+ return NT_STATUS_NOT_FOUND;
+ }
+
+ /* TODO: check OID matches KRB5 Principal Name OID ? */
+
+ gss_maj = gss_display_name(&gss_min,
+ gse_ctx->client_name,
+ &name_buffer, NULL);
+ if (gss_maj) {
+ DEBUG(0, ("gss_display_name failed [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ *cli_name = talloc_strndup(talloc_tos(),
+ (char *)name_buffer.value,
+ name_buffer.length);
+
+ gss_maj = gss_release_buffer(&gss_min, &name_buffer);
+
+ if (!*cli_name) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ return NT_STATUS_OK;
+}
+
+NTSTATUS gse_get_authz_data(struct gse_context *gse_ctx,
+ TALLOC_CTX *mem_ctx, DATA_BLOB *pac)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
+
+ if (!gse_ctx->authenticated) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ gss_maj = gss_inquire_sec_context_by_oid(
+ &gss_min, gse_ctx->gss_ctx,
+ &gse_authz_data_oid, &set);
+ if (gss_maj) {
+ DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ return NT_STATUS_NOT_FOUND;
+ }
+
+ if (set == GSS_C_NO_BUFFER_SET) {
+ DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
+ "data in results.\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ /* for now we just hope it is the first value */
+ *pac = data_blob_talloc(mem_ctx,
+ set->elements[0].value,
+ set->elements[0].length);
+
+ gss_maj = gss_release_buffer_set(&gss_min, &set);
+
+ return NT_STATUS_OK;
+}
+
+NTSTATUS gse_get_authtime(struct gse_context *gse_ctx, time_t *authtime)
+{
+ OM_uint32 gss_min, gss_maj;
+ gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
+ int32_t tkttime;
+
+ if (!gse_ctx->authenticated) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ gss_maj = gss_inquire_sec_context_by_oid(
+ &gss_min, gse_ctx->gss_ctx,
+ &gse_authtime_oid, &set);
+ if (gss_maj) {
+ DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min)));
+ return NT_STATUS_NOT_FOUND;
+ }
+
+ if ((set == GSS_C_NO_BUFFER_SET) || (set->count != 1) != 0) {
+ DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
+ "data in results.\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ if (set->elements[0].length != sizeof(int32_t)) {
+ DEBUG(0, ("Invalid authtime size!\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ tkttime = *((int32_t *)set->elements[0].value);
+
+ gss_maj = gss_release_buffer_set(&gss_min, &set);
+
+ *authtime = (time_t)tkttime;
+ return NT_STATUS_OK;
+}
+
size_t gse_get_signature_length(struct gse_context *gse_ctx,
int seal, size_t payload_size)
{
@@ -605,6 +949,30 @@ NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
return NT_STATUS_NOT_IMPLEMENTED;
}
+NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level,
+ uint32_t add_gss_c_flags,
+ const char *server,
+ const char *keytab,
+ struct gse_context **_gse_ctx)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx,
+ DATA_BLOB *token_in,
+ DATA_BLOB *token_out)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
bool gse_require_more_processing(struct gse_context *gse_ctx)
{
return false;
@@ -616,6 +984,23 @@ DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
--
Samba Shared Repository
More information about the samba-cvs
mailing list