The branch, master has been updated via 5954a37 lib/param: Remove parameters for wins and spoolss databases via 9d49945 ldb: Output more error information when a connect fails via 94fbe2e s3:auth_util: add the uid with WBC_ID_TYPE_BOTH also to the group array via 9068a30 s3-auth: use typedefs in auth.h via e7d5f0a gensec: move event context from gensec_*_init() to gensec_update() via 0f2b27e s3-auth fix comment after s3 ntlmssp gensec module via f88b686 gensec: move event-using code to gensec_update() hooks out of gensec_start*() via 3f9ab2e ntlmssp: Refuse to seal if we did not negotiate to sign via 86d684e gensec: Refuse to seal if we did not negotiate to sign via 09c5acd s4-auth: match the new s3 gensec client and always negotiate SIGN with SEAL via 0d5de7e gensec: Assert that we have not been subject to a downgrade attack in DCE/RPC clients via 5ef4e91 s3-smbd Give the nt error string when failing to set up encrypted transport via 5392491 s3-ntlmssp Implement the server-side auth_ntlmssp code as a GENSEC module via c779647 gensec: an event context is no longer mandetory via 02eef4d ntlmssp: Put members from auth_ntlmssp_state into gensec_ntlmssp_state via 968b367 ntlmssp: Prepare gensec_ntlmssp_start() for broader use via 0c6e4ad ntlmssp: Move ntlmssp code to auth/ntlmssp via 5e6543a build: compile gensec_start.c and credentials.c in the autoconf build via 5f11615 s4-s3-upgrade: Give a better clue when we cannot open secrets.tdb via d4d4f4e s3-auth Add my copyright via 734e5c5 credentials: Prioritise command-line specified options above defaults from smb.conf via f8c6219 s4-selftest When testing for a credentials cache, do not specify a domain via 4c20276 Revert "s4: Mark the winsreplication test as knownfail" via fe98fa6 Revert "s4:selftest: skip flakey samba4.nbt.winsreplication for now" from 75953f1 ldb: fixed a race in ldb initialisation
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 5954a37997a786a8808ee2544b594a0c90f1c893 Author: Andrew Bartlett <abart...@samba.org> Date: Tue Oct 18 11:33:33 2011 +1100 lib/param: Remove parameters for wins and spoolss databases This removes the smb.conf parameters per-database, replacing these with hard-coded database names in well known (and configurable) directories. The wins.ldb is now always in the "state dir", rather than being in both state and lock dir (ie, a bug). Less smb.conf parameters means less parameters to try and sync up between the loadparm subsystems. Andrew Bartlett Autobuild-User: Andrew Bartlett <abart...@samba.org> Autobuild-Date: Tue Oct 18 05:39:54 CEST 2011 on sn-devel-104 commit 9d49945ff037e46f5083dc88816acafc2343a77c Author: Andrew Bartlett <abart...@samba.org> Date: Tue Oct 18 11:30:52 2011 +1100 ldb: Output more error information when a connect fails commit 94fbe2e4bdab8bcd021fedfff71114bbf3d72ca1 Author: Stefan Metzmacher <me...@samba.org> Date: Wed Oct 12 20:52:09 2011 +0200 s3:auth_util: add the uid with WBC_ID_TYPE_BOTH also to the group array This will help with having "sidHistory" support in future. metze commit 9068a3080b6d8980f46cc141fdf76b832d38ecf7 Author: Andrew Bartlett <abart...@samba.org> Date: Mon Oct 17 15:56:44 2011 +1100 s3-auth: use typedefs in auth.h Signed-off-by: Stefan Metzmacher <me...@samba.org> commit e7d5f0a357c42593a015b80390dedf920117a7e2 Author: Andrew Bartlett <abart...@samba.org> Date: Mon Oct 17 09:22:33 2011 +0200 gensec: move event context from gensec_*_init() to gensec_update() This avoids keeping the event context around on a the gensec_security context structure long term. In the Samba3 server, the event context we either supply is a NULL pointer as no server-side modules currently use the event context. Andrew Bartlett Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 0f2b27e7d428e75b8e6079ee5f36a0cccd4d1785 Author: Andrew Bartlett <abart...@samba.org> Date: Mon Oct 17 14:00:39 2011 +1100 s3-auth fix comment after s3 ntlmssp gensec module Signed-off-by: Stefan Metzmacher <me...@samba.org> commit f88b686167d3cc0c8e2c6d00f12da4b0fccc767d Author: Andrew Bartlett <abart...@samba.org> Date: Mon Oct 17 13:46:57 2011 +1100 gensec: move event-using code to gensec_update() hooks out of gensec_start*() This ensures that only gensec_update() will require an event context argument when the API is refactored. Andrew Bartlett commit 3f9ab2e8e7437ad2775ecd7b87c20804089b58cb Author: Andrew Bartlett <abart...@samba.org> Date: Sat Oct 15 14:56:11 2011 +1100 ntlmssp: Refuse to seal if we did not negotiate to sign Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 86d684e4d663141370b7332a9ab37e46f6ef68db Author: Andrew Bartlett <abart...@samba.org> Date: Sat Oct 15 14:56:01 2011 +1100 gensec: Refuse to seal if we did not negotiate to sign Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 09c5acdec825b9a1580f414ba19be04978aaee85 Author: Andrew Bartlett <abart...@samba.org> Date: Sat Oct 15 13:19:41 2011 +1100 s4-auth: match the new s3 gensec client and always negotiate SIGN with SEAL Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 0d5de7e19c8112821269b4f5a910ee777f35d185 Author: Andrew Bartlett <abart...@samba.org> Date: Sat Oct 15 13:17:33 2011 +1100 gensec: Assert that we have not been subject to a downgrade attack in DCE/RPC clients Because of the calling convention, this is the best place to assert that we have not been subject to a downgrade attack on the negotiated features. (In DCE/RPC, this isn't a negotiation, the client simply specifies the level of protection that is required). Andrew Bartlett (some formatting fixes) Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 5ef4e91cf099290c8798fd12b35927eed34b2fcf Author: Andrew Bartlett <abart...@samba.org> Date: Tue Oct 11 16:13:49 2011 +1100 s3-smbd Give the nt error string when failing to set up encrypted transport Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 5392491f7719c0639ecb15832df212bb3767882e Author: Andrew Bartlett <abart...@samba.org> Date: Tue Jul 26 12:35:09 2011 +1000 s3-ntlmssp Implement the server-side auth_ntlmssp code as a GENSEC module This uses the top level gensec_ntlmssp helper functions which are identical to the parts of ntlmssp_wrap.c that are now not called. (Includes formatting and correctness fixes from Metze) Andrew Bartlett Signed-off-by: Stefan Metzmacher <me...@samba.org> commit c77964724d758fcf718d8159b22cd0505ee0a575 Author: Andrew Bartlett <abart...@samba.org> Date: Sat Oct 15 17:27:30 2011 +1100 gensec: an event context is no longer mandetory If you do not specify one however, you better know that the modules you are using do not need one! Andrew Bartlett Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 02eef4d130fb6e798774d58ac18478c719df847c Author: Andrew Bartlett <abart...@samba.org> Date: Mon Jul 25 17:43:50 2011 +1000 ntlmssp: Put members from auth_ntlmssp_state into gensec_ntlmssp_state Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 968b3674b130002fde961d57077915394eb1616c Author: Andrew Bartlett <abart...@samba.org> Date: Tue Jul 26 12:32:08 2011 +1000 ntlmssp: Prepare gensec_ntlmssp_start() for broader use This moves the allocation of the ntlmssp pointer back to the callers. Andrew Bartlett Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 0c6e4adcb26557ae6e55169c051f0260151dc5d9 Author: Andrew Bartlett <abart...@samba.org> Date: Mon Jul 25 16:04:38 2011 +1000 ntlmssp: Move ntlmssp code to auth/ntlmssp This brings in the code from both libcli/auth and source4/auth/ntlmssp. Andrew Bartlett Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 5e6543ad76490b5d21b99841e1f984bad7f17e33 Author: Andrew Bartlett <abart...@samba.org> Date: Sun Oct 9 23:28:54 2011 +1100 build: compile gensec_start.c and credentials.c in the autoconf build Signed-off-by: Stefan Metzmacher <me...@samba.org> commit 5f1161581084693d9c03b0d72a77856f99463b70 Author: Andrew Bartlett <abart...@samba.org> Date: Mon Oct 17 12:22:44 2011 +1100 s4-s3-upgrade: Give a better clue when we cannot open secrets.tdb Signed-off-by: Stefan Metzmacher <me...@samba.org> commit d4d4f4e07fc7a38e29ec27a7c75d2bdb8e9afcc5 Author: Andrew Bartlett <abart...@samba.org> Date: Tue Oct 18 08:42:25 2011 +1100 s3-auth Add my copyright I have done plenty of work here, I deserve some of the blame :-) Andrew Bartlett commit 734e5c521cb06a91e708226e0eb6d003175958c2 Author: Andrew Bartlett <abart...@samba.org> Date: Tue Oct 18 08:41:46 2011 +1100 credentials: Prioritise command-line specified options above defaults from smb.conf If a user specified -W or --realm on the command line, then this is of level SPECIFIED, not UNINITIALISED, despite it going via the loadparm system. This helps us to ensure that -W server -Ulocaluser is parsed the same as -Userver\localuser. This matters as otherwise we might instead attempt to use kerberos to the realm from the smb.conf. Andrew Bartlett commit f8c6219188fa4ce39a35a8f192c649a6aa9c7ec1 Author: Andrew Bartlett <abart...@samba.org> Date: Tue Oct 18 10:03:21 2011 +1100 s4-selftest When testing for a credentials cache, do not specify a domain If we specify a domain, then we indicate that we must use that domain which overrides the credentials cache we found in the environment. Andrew Bartlett commit 4c20276c3498bd6018f48554fc5ff0cbac21f451 Author: Andrew Bartlett <abart...@samba.org> Date: Tue Oct 18 12:18:36 2011 +1100 Revert "s4: Mark the winsreplication test as knownfail" This reverts commit f7f6992a20dd29bd7643291e3b3d05bc8f6c9c76 because 75953f18469fa8746d9d8ad20bbbb3bcbd0df9dd solved the root cause, which was a race in ldb startup. Andrew Bartlett commit fe98fa67962f7e5267e89d60f9fa37447dbbe581 Author: Andrew Bartlett <abart...@samba.org> Date: Tue Oct 18 12:17:37 2011 +1100 Revert "s4:selftest: skip flakey samba4.nbt.winsreplication for now" This reverts commit 16fd935fc659555c203354b6c96fc23a55be5a3b because 75953f18469fa8746d9d8ad20bbbb3bcbd0df9dd solved the root cause, which was a race in ldb startup. Andrew Bartlett ----------------------------------------------------------------------- Summary of changes: auth/credentials/credentials.c | 18 +- auth/credentials/credentials_samba3.c | 50 ++ auth/gensec/gensec.c | 54 ++- auth/gensec/gensec.h | 6 +- auth/gensec/gensec_start.c | 21 +- auth/ntlmssp/gensec_ntlmssp.c | 234 ++++++++ auth/ntlmssp/ntlmssp.c | 144 +++++ auth/ntlmssp/ntlmssp.h | 243 ++++++++ auth/ntlmssp/ntlmssp_ndr.c | 133 +++++ {libcli/auth => auth/ntlmssp}/ntlmssp_ndr.h | 0 auth/ntlmssp/ntlmssp_private.h | 57 ++ auth/ntlmssp/ntlmssp_server.c | 582 +++++++++++++++++++ auth/ntlmssp/ntlmssp_sign.c | 699 +++++++++++++++++++++++ auth/ntlmssp/wscript_build | 3 + auth/wscript_build | 1 + lib/ldb/common/ldb_modules.c | 2 +- lib/ldb/ldb_tdb/ldb_tdb.c | 5 + lib/param/loadparm.c | 51 +- lib/param/param.h | 1 + libcli/auth/ntlmssp.c | 144 ----- libcli/auth/ntlmssp.h | 173 ------ libcli/auth/ntlmssp_ndr.c | 133 ----- libcli/auth/ntlmssp_private.h | 57 -- libcli/auth/ntlmssp_server.c | 582 ------------------- libcli/auth/ntlmssp_sign.c | 694 ---------------------- libcli/auth/wscript_build | 11 +- source3/Makefile.in | 12 +- source3/auth/auth_ntlmssp.c | 316 ++++++++--- source3/auth/auth_util.c | 6 +- source3/auth/wscript_build | 2 +- source3/include/auth.h | 22 +- source3/include/ntlmssp_wrap.h | 4 +- source3/libads/sasl.c | 2 +- source3/librpc/crypto/cli_spnego.c | 2 +- source3/librpc/rpc/dcerpc_helpers.c | 2 +- source3/libsmb/cliconnect.c | 2 +- source3/libsmb/clifsinfo.c | 2 +- source3/libsmb/ntlmssp.c | 6 +- source3/libsmb/ntlmssp_wrap.c | 6 +- source3/libsmb/smb2cli_session.c | 2 +- source3/libsmb/smb_seal.c | 2 +- source3/rpc_client/cli_pipe.c | 2 +- source3/rpc_server/dcesrv_ntlmssp.c | 2 +- source3/smbd/seal.c | 2 +- source3/smbd/sesssetup.c | 2 +- source3/smbd/smb2_sesssetup.c | 2 +- source3/smbd/trans2.c | 8 +- source3/utils/ntlm_auth.c | 2 +- source3/winbindd/winbindd_ccache_access.c | 2 +- source4/auth/gensec/gensec_gssapi.c | 92 ++-- source4/auth/gensec/gensec_krb5.c | 39 +- source4/auth/gensec/pygensec.c | 30 +- source4/auth/gensec/schannel.c | 3 +- source4/auth/gensec/spnego.c | 29 +- source4/auth/ntlmssp/ntlmssp.c | 111 +---- source4/auth/ntlmssp/ntlmssp.h | 37 -- source4/auth/ntlmssp/ntlmssp_client.c | 21 +- source4/auth/ntlmssp/ntlmssp_server.c | 22 +- source4/auth/ntlmssp/ntlmssp_sign.c | 138 ----- source4/auth/ntlmssp/wscript_build | 2 +- source4/auth/samba_server_gensec.c | 1 - source4/kdc/kpasswdd.c | 2 +- source4/ldap_server/ldap_bind.c | 2 +- source4/libcli/ldap/ldap_bind.c | 2 +- source4/libcli/smb2/session.c | 3 +- source4/libcli/smb_composite/sesssetup.c | 6 +- source4/librpc/rpc/dcerpc_auth.c | 3 +- source4/nbt_server/wins/winsdb.c | 12 +- source4/ntptr/simple_ldb/ntptr_simple_ldb.c | 2 +- source4/rpc_server/dcesrv_auth.c | 6 +- source4/scripting/python/samba/netcmd/domain.py | 2 +- source4/scripting/python/samba/upgrade.py | 5 +- source4/selftest/knownfail | 2 +- source4/selftest/skip | 1 - source4/smb_server/smb/negprot.c | 2 +- source4/smb_server/smb2/negprot.c | 2 +- source4/torture/auth/ntlmssp.c | 4 +- source4/torture/rpc/remote_pac.c | 24 +- source4/utils/ntlm_auth.c | 6 +- source4/wrepl_server/wrepl_server.c | 2 +- testprogs/blackbox/test_chgdcpass.sh | 2 +- testprogs/blackbox/test_export_keytab.sh | 2 +- testprogs/blackbox/test_kinit.sh | 2 +- testprogs/blackbox/test_passwords.sh | 2 +- testprogs/blackbox/test_pkinit.sh | 2 +- 85 files changed, 2749 insertions(+), 2382 deletions(-) create mode 100644 auth/credentials/credentials_samba3.c create mode 100644 auth/ntlmssp/gensec_ntlmssp.c create mode 100644 auth/ntlmssp/ntlmssp.c create mode 100644 auth/ntlmssp/ntlmssp.h create mode 100644 auth/ntlmssp/ntlmssp_ndr.c rename {libcli/auth => auth/ntlmssp}/ntlmssp_ndr.h (100%) create mode 100644 auth/ntlmssp/ntlmssp_private.h create mode 100644 auth/ntlmssp/ntlmssp_server.c create mode 100644 auth/ntlmssp/ntlmssp_sign.c create mode 100644 auth/ntlmssp/wscript_build delete mode 100644 libcli/auth/ntlmssp.c delete mode 100644 libcli/auth/ntlmssp.h delete mode 100644 libcli/auth/ntlmssp_ndr.c delete mode 100644 libcli/auth/ntlmssp_private.h delete mode 100644 libcli/auth/ntlmssp_server.c delete mode 100644 libcli/auth/ntlmssp_sign.c delete mode 100644 source4/auth/ntlmssp/ntlmssp.h delete mode 100644 source4/auth/ntlmssp/ntlmssp_sign.c Changeset truncated at 500 lines: diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c index ee60220..3eaccde 100644 --- a/auth/credentials/credentials.c +++ b/auth/credentials/credentials.c @@ -681,9 +681,21 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, struct loadparm_context *lp_ctx) { cli_credentials_set_username(cred, "", CRED_UNINITIALISED); - cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_UNINITIALISED); - cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_UNINITIALISED); - cli_credentials_set_realm(cred, lpcfg_realm(lp_ctx), CRED_UNINITIALISED); + if (lpcfg_parm_is_cmdline(lp_ctx, "workgroup")) { + cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SPECIFIED); + } else { + cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_UNINITIALISED); + } + if (lpcfg_parm_is_cmdline(lp_ctx, "netbios name")) { + cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SPECIFIED); + } else { + cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_UNINITIALISED); + } + if (lpcfg_parm_is_cmdline(lp_ctx, "realm")) { + cli_credentials_set_realm(cred, lpcfg_realm(lp_ctx), CRED_SPECIFIED); + } else { + cli_credentials_set_realm(cred, lpcfg_realm(lp_ctx), CRED_UNINITIALISED); + } } /** diff --git a/auth/credentials/credentials_samba3.c b/auth/credentials/credentials_samba3.c new file mode 100644 index 0000000..2310825 --- /dev/null +++ b/auth/credentials/credentials_samba3.c @@ -0,0 +1,50 @@ +/* + Unix SMB/CIFS implementation. + + Handle user credentials (shim to allow samba3 to build) + + Copyright (C) Andrew Bartlett <abart...@samba.org> 2011 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "auth/credentials/credentials.h" + +/* These dummy functions are required only to allow the rest of the + * code to compile when we are in the s3 autoconf build system */ + +_PUBLIC_ void cli_credentials_invalidate_ccache(struct cli_credentials *cred, + enum credentials_obtained obtained) +{ + DEBUG(0, ("cli_credentials_invalidate_ccache is unimplemented in the autoconf build\n")); + return; +} + +_PUBLIC_ int cli_credentials_set_ccache(struct cli_credentials *cred, + struct loadparm_context *lp_ctx, + const char *name, + enum credentials_obtained obtained, + const char **error_string) +{ + DEBUG(0, ("cli_credentials_set_ccache is unimplemented in the autoconf build\n")); + return EINVAL; +} + +_PUBLIC_ NTSTATUS cli_credentials_set_machine_account(struct cli_credentials *cred, + struct loadparm_context *lp_ctx) +{ + DEBUG(0, ("cli_credentials_set_machine_account is unimplemented in the autoconf build\n")); + return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; +} diff --git a/auth/gensec/gensec.c b/auth/gensec/gensec.c index 417b05c..cdc7c67 100644 --- a/auth/gensec/gensec.c +++ b/auth/gensec/gensec.c @@ -26,6 +26,7 @@ #include "lib/tsocket/tsocket.h" #include "lib/util/tevent_ntstatus.h" #include "auth/gensec/gensec.h" +#include "librpc/rpc/dcerpc.h" /* wrappers for the gensec function pointers @@ -75,6 +76,9 @@ _PUBLIC_ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security, if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) { return NT_STATUS_INVALID_PARAMETER; } + if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) { + return NT_STATUS_INVALID_PARAMETER; + } return gensec_security->ops->seal_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig); } @@ -193,9 +197,53 @@ _PUBLIC_ NTSTATUS gensec_session_info(struct gensec_security *gensec_security, */ _PUBLIC_ NTSTATUS gensec_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx, - const DATA_BLOB in, DATA_BLOB *out) + struct tevent_context *ev, + const DATA_BLOB in, DATA_BLOB *out) { - return gensec_security->ops->update(gensec_security, out_mem_ctx, in, out); + NTSTATUS status; + + status = gensec_security->ops->update(gensec_security, out_mem_ctx, + ev, in, out); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + /* + * Because callers using the + * gensec_start_mech_by_auth_type() never call + * gensec_want_feature(), it isn't sensible for them + * to have to call gensec_have_feature() manually, and + * these are not points of negotiation, but are + * asserted by the client + */ + switch (gensec_security->dcerpc_auth_level) { + case DCERPC_AUTH_LEVEL_INTEGRITY: + if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) { + DEBUG(0,("Did not manage to negotiate mandetory feature " + "SIGN for dcerpc auth_level %u\n", + gensec_security->dcerpc_auth_level)); + return NT_STATUS_ACCESS_DENIED; + } + break; + case DCERPC_AUTH_LEVEL_PRIVACY: + if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) { + DEBUG(0,("Did not manage to negotiate mandetory feature " + "SIGN for dcerpc auth_level %u\n", + gensec_security->dcerpc_auth_level)); + return NT_STATUS_ACCESS_DENIED; + } + if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) { + DEBUG(0,("Did not manage to negotiate mandetory feature " + "SEAL for dcerpc auth_level %u\n", + gensec_security->dcerpc_auth_level)); + return NT_STATUS_ACCESS_DENIED; + } + break; + default: + break; + } + + return NT_STATUS_OK; } struct gensec_update_state { @@ -258,7 +306,7 @@ static void gensec_update_async_trigger(struct tevent_context *ctx, tevent_req_data(req, struct gensec_update_state); NTSTATUS status; - status = gensec_update(state->gensec_security, state, + status = gensec_update(state->gensec_security, state, ctx, state->in, &state->out); if (tevent_req_nterror(req, status)) { return; diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h index 38f2513..acfc549 100644 --- a/auth/gensec/gensec.h +++ b/auth/gensec/gensec.h @@ -92,6 +92,7 @@ struct gensec_security_ops { NTSTATUS (*magic)(struct gensec_security *gensec_security, const DATA_BLOB *first_packet); NTSTATUS (*update)(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx, + struct tevent_context *ev, const DATA_BLOB in, DATA_BLOB *out); NTSTATUS (*seal_packet)(struct gensec_security *gensec_security, TALLOC_CTX *sig_mem_ctx, uint8_t *data, size_t length, @@ -160,7 +161,7 @@ struct gensec_security { enum gensec_role gensec_role; bool subcontext; uint32_t want_features; - struct tevent_context *event_ctx; + uint8_t dcerpc_auth_level; struct tsocket_address *local_addr, *remote_addr; struct gensec_settings *settings; @@ -211,13 +212,13 @@ NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx, struct gensec_security **gensec_security); NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx, struct gensec_security **gensec_security, - struct tevent_context *ev, struct gensec_settings *settings); NTSTATUS gensec_start_mech_by_ops(struct gensec_security *gensec_security, const struct gensec_security_ops *ops); NTSTATUS gensec_start_mech_by_sasl_list(struct gensec_security *gensec_security, const char **sasl_names); NTSTATUS gensec_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx, + struct tevent_context *ev, const DATA_BLOB in, DATA_BLOB *out); struct tevent_req *gensec_update_send(TALLOC_CTX *mem_ctx, struct tevent_context *ev, @@ -266,7 +267,6 @@ NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security, uint8_t auth_type, uint8_t auth_level); const char *gensec_get_name_by_authtype(struct gensec_security *gensec_security, uint8_t authtype); NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx, - struct tevent_context *ev, struct gensec_settings *settings, struct auth4_context *auth_context, struct gensec_security **gensec_security); diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c index ea54352..d5a5dc8 100644 --- a/auth/gensec/gensec_start.c +++ b/auth/gensec/gensec_start.c @@ -506,20 +506,13 @@ const char **gensec_security_oids(struct gensec_security *gensec_security, @ gensec_security return */ static NTSTATUS gensec_start(TALLOC_CTX *mem_ctx, - struct tevent_context *ev, struct gensec_settings *settings, struct auth4_context *auth_context, struct gensec_security **gensec_security) { - if (ev == NULL) { - DEBUG(0, ("No event context available!\n")); - return NT_STATUS_INTERNAL_ERROR; - } - (*gensec_security) = talloc_zero(mem_ctx, struct gensec_security); NT_STATUS_HAVE_NO_MEMORY(*gensec_security); - (*gensec_security)->event_ctx = ev; SMB_ASSERT(settings->lp_ctx != NULL); (*gensec_security)->settings = talloc_reference(*gensec_security, settings); @@ -552,7 +545,7 @@ _PUBLIC_ NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx, (*gensec_security)->subcontext = true; (*gensec_security)->want_features = parent->want_features; - (*gensec_security)->event_ctx = parent->event_ctx; + (*gensec_security)->dcerpc_auth_level = parent->dcerpc_auth_level; (*gensec_security)->auth_context = talloc_reference(*gensec_security, parent->auth_context); (*gensec_security)->settings = talloc_reference(*gensec_security, parent->settings); (*gensec_security)->auth_context = talloc_reference(*gensec_security, parent->auth_context); @@ -568,7 +561,6 @@ _PUBLIC_ NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx, */ _PUBLIC_ NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx, struct gensec_security **gensec_security, - struct tevent_context *ev, struct gensec_settings *settings) { NTSTATUS status; @@ -578,7 +570,7 @@ _PUBLIC_ NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx, return NT_STATUS_INTERNAL_ERROR; } - status = gensec_start(mem_ctx, ev, settings, NULL, gensec_security); + status = gensec_start(mem_ctx, settings, NULL, gensec_security); if (!NT_STATUS_IS_OK(status)) { return status; } @@ -596,24 +588,18 @@ _PUBLIC_ NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx, @note The mem_ctx is only a parent and may be NULL. */ _PUBLIC_ NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx, - struct tevent_context *ev, struct gensec_settings *settings, struct auth4_context *auth_context, struct gensec_security **gensec_security) { NTSTATUS status; - if (!ev) { - DEBUG(0,("gensec_server_start: no event context given!\n")); - return NT_STATUS_INTERNAL_ERROR; - } - if (!settings) { DEBUG(0,("gensec_server_start: no settings given!\n")); return NT_STATUS_INTERNAL_ERROR; } - status = gensec_start(mem_ctx, ev, settings, auth_context, gensec_security); + status = gensec_start(mem_ctx, settings, auth_context, gensec_security); if (!NT_STATUS_IS_OK(status)) { return status; } @@ -681,6 +667,7 @@ _PUBLIC_ NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_s DEBUG(3, ("Could not find GENSEC backend for auth_type=%d\n", (int)auth_type)); return NT_STATUS_INVALID_PARAMETER; } + gensec_security->dcerpc_auth_level = auth_level; gensec_want_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE); gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES); if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) { diff --git a/auth/ntlmssp/gensec_ntlmssp.c b/auth/ntlmssp/gensec_ntlmssp.c new file mode 100644 index 0000000..9cbd6e1 --- /dev/null +++ b/auth/ntlmssp/gensec_ntlmssp.c @@ -0,0 +1,234 @@ +/* + * Unix SMB/CIFS implementation. + * Version 3.0 + * NTLMSSP Signing routines + * Copyright (C) Luke Kenneth Casson Leighton 1996-2001 + * Copyright (C) Andrew Bartlett <abart...@samba.org> 2003-2005 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see <http://www.gnu.org/licenses/>. + */ + +#include "includes.h" +#include "auth/ntlmssp/ntlmssp.h" +#include "auth/gensec/gensec.h" +#include "auth/ntlmssp/ntlmssp_private.h" + +NTSTATUS gensec_ntlmssp_magic(struct gensec_security *gensec_security, + const DATA_BLOB *first_packet) +{ + if (ntlmssp_blob_matches_magic(first_packet)) { + return NT_STATUS_OK; + } else { + return NT_STATUS_INVALID_PARAMETER; + } +} + +/** + * Return the NTLMSSP master session key + * + * @param ntlmssp_state NTLMSSP State + */ + +NTSTATUS gensec_ntlmssp_session_key(struct gensec_security *gensec_security, + TALLOC_CTX *mem_ctx, + DATA_BLOB *session_key) +{ + struct gensec_ntlmssp_context *gensec_ntlmssp = + talloc_get_type_abort(gensec_security->private_data, + struct gensec_ntlmssp_context); + struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state; + + if (ntlmssp_state->expected_state != NTLMSSP_DONE) { + return NT_STATUS_NO_USER_SESSION_KEY; + } + + if (!ntlmssp_state->session_key.data) { + return NT_STATUS_NO_USER_SESSION_KEY; + } + *session_key = data_blob_talloc(mem_ctx, ntlmssp_state->session_key.data, ntlmssp_state->session_key.length); + if (!session_key->data) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + +bool gensec_ntlmssp_have_feature(struct gensec_security *gensec_security, + uint32_t feature) +{ + struct gensec_ntlmssp_context *gensec_ntlmssp = + talloc_get_type_abort(gensec_security->private_data, + struct gensec_ntlmssp_context); + struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state; + + if (feature & GENSEC_FEATURE_SIGN) { + if (!ntlmssp_state->session_key.length) { + return false; + } + if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) { + return true; + } + } + if (feature & GENSEC_FEATURE_SEAL) { + if (!ntlmssp_state->session_key.length) { + return false; + } + if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) { + return true; + } + } + if (feature & GENSEC_FEATURE_SESSION_KEY) { + if (ntlmssp_state->session_key.length) { + return true; + } + } + if (feature & GENSEC_FEATURE_DCE_STYLE) { + return true; + } + if (feature & GENSEC_FEATURE_ASYNC_REPLIES) { + if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) { + return true; + } + } + return false; +} + +NTSTATUS gensec_ntlmssp_start(struct gensec_security *gensec_security) +{ + struct gensec_ntlmssp_context *gensec_ntlmssp; + + gensec_ntlmssp = talloc_zero(gensec_security, + struct gensec_ntlmssp_context); + if (!gensec_ntlmssp) { + return NT_STATUS_NO_MEMORY; + } + + gensec_ntlmssp->gensec_security = gensec_security; + + gensec_security->private_data = gensec_ntlmssp; + return NT_STATUS_OK; +} + +NTSTATUS gensec_ntlmssp_sign_packet(struct gensec_security *gensec_security, + TALLOC_CTX *sig_mem_ctx, + const uint8_t *data, size_t length, + const uint8_t *whole_pdu, size_t pdu_length, + DATA_BLOB *sig) +{ + struct gensec_ntlmssp_context *gensec_ntlmssp = + talloc_get_type_abort(gensec_security->private_data, + struct gensec_ntlmssp_context); + NTSTATUS nt_status; + + nt_status = ntlmssp_sign_packet(gensec_ntlmssp->ntlmssp_state, + sig_mem_ctx, + data, length, + whole_pdu, pdu_length, + sig); + + return nt_status; +} + +NTSTATUS gensec_ntlmssp_check_packet(struct gensec_security *gensec_security, + const uint8_t *data, size_t length, + const uint8_t *whole_pdu, size_t pdu_length, + const DATA_BLOB *sig) +{ + struct gensec_ntlmssp_context *gensec_ntlmssp = + talloc_get_type_abort(gensec_security->private_data, + struct gensec_ntlmssp_context); + NTSTATUS nt_status; + + nt_status = ntlmssp_check_packet(gensec_ntlmssp->ntlmssp_state, + data, length, + whole_pdu, pdu_length, + sig); + + return nt_status; +} + +NTSTATUS gensec_ntlmssp_seal_packet(struct gensec_security *gensec_security, + TALLOC_CTX *sig_mem_ctx, + uint8_t *data, size_t length, + const uint8_t *whole_pdu, size_t pdu_length, + DATA_BLOB *sig) +{ + struct gensec_ntlmssp_context *gensec_ntlmssp = + talloc_get_type_abort(gensec_security->private_data, + struct gensec_ntlmssp_context); + NTSTATUS nt_status; + + nt_status = ntlmssp_seal_packet(gensec_ntlmssp->ntlmssp_state, + sig_mem_ctx, + data, length, + whole_pdu, pdu_length, + sig); + + return nt_status; +} + +/* + wrappers for the ntlmssp_*() functions +*/ +NTSTATUS gensec_ntlmssp_unseal_packet(struct gensec_security *gensec_security, + uint8_t *data, size_t length, + const uint8_t *whole_pdu, size_t pdu_length, + const DATA_BLOB *sig) +{ + struct gensec_ntlmssp_context *gensec_ntlmssp = + talloc_get_type_abort(gensec_security->private_data, + struct gensec_ntlmssp_context); + NTSTATUS nt_status; + -- Samba Shared Repository