← Back to branch summary

~zulcss/samba/server-dailies-3.4

« back to all changes in this revision

Viewing changes to source3/smbd/seal.c

  • Committer: Chuck Short
  • Date: 2010-09-28 20:38:39 UTC
  • Revision ID: zulcss@ubuntu.com-20100928203839-pgjulytsi9ue63x1
Initial version

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/smbd/seal.c
 
1
/* 
 
2
   Unix SMB/CIFS implementation.
 
3
   SMB Transport encryption (sealing) code - server code.
 
4
   Copyright (C) Jeremy Allison 2007.
 
5
   
 
6
   This program is free software; you can redistribute it and/or modify
 
7
   it under the terms of the GNU General Public License as published by
 
8
   the Free Software Foundation; either version 3 of the License, or
 
9
   (at your option) any later version.
 
10
   
 
11
   This program is distributed in the hope that it will be useful,
 
12
   but WITHOUT ANY WARRANTY; without even the implied warranty of
 
13
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
14
   GNU General Public License for more details.
 
15
   
 
16
   You should have received a copy of the GNU General Public License
 
17
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
18
*/
 
19
 
 
20
#include "includes.h"
 
21
#include "smbd/globals.h"
 
22
 
 
23
/******************************************************************************
 
24
 Server side encryption.
 
25
******************************************************************************/
 
26
 
 
27
/******************************************************************************
 
28
 Global server state.
 
29
******************************************************************************/
 
30
 
 
31
struct smb_srv_trans_enc_ctx {
 
32
        struct smb_trans_enc_state *es;
 
33
        AUTH_NTLMSSP_STATE *auth_ntlmssp_state; /* Must be kept in sync with pointer in ec->ntlmssp_state. */
 
34
};
 
35
 
 
36
/******************************************************************************
 
37
 Return global enc context - this must change if we ever do multiple contexts.
 
38
******************************************************************************/
 
39
 
 
40
uint16_t srv_enc_ctx(void)
 
41
{
 
42
        return srv_trans_enc_ctx->es->enc_ctx_num;
 
43
}
 
44
 
 
45
/******************************************************************************
 
46
 Is this an incoming encrypted packet ?
 
47
******************************************************************************/
 
48
 
 
49
bool is_encrypted_packet(const uint8_t *inbuf)
 
50
{
 
51
        NTSTATUS status;
 
52
        uint16_t enc_num;
 
53
 
 
54
        /* Ignore non-session messages or non 0xFF'E' messages. */
 
55
        if(CVAL(inbuf,0) || !(inbuf[4] == 0xFF && inbuf[5] == 'E')) {
 
56
                return false;
 
57
        }
 
58
 
 
59
        status = get_enc_ctx_num(inbuf, &enc_num);
 
60
        if (!NT_STATUS_IS_OK(status)) {
 
61
                return false;
 
62
        }
 
63
 
 
64
        /* Encrypted messages are 0xFF'E'<ctx> */
 
65
        if (srv_trans_enc_ctx && enc_num == srv_enc_ctx()) {
 
66
                return true;
 
67
        }
 
68
        return false;
 
69
}
 
70
 
 
71
/******************************************************************************
 
72
 Create an auth_ntlmssp_state and ensure pointer copy is correct.
 
73
******************************************************************************/
 
74
 
 
75
static NTSTATUS make_auth_ntlmssp(struct smb_srv_trans_enc_ctx *ec)
 
76
{
 
77
        NTSTATUS status = auth_ntlmssp_start(&ec->auth_ntlmssp_state);
 
78
        if (!NT_STATUS_IS_OK(status)) {
 
79
                return nt_status_squash(status);
 
80
        }
 
81
 
 
82
        /*
 
83
         * We must remember to update the pointer copy for the common
 
84
         * functions after any auth_ntlmssp_start/auth_ntlmssp_end.
 
85
         */
 
86
        ec->es->s.ntlmssp_state = ec->auth_ntlmssp_state->ntlmssp_state;
 
87
        return status;
 
88
}
 
89
 
 
90
/******************************************************************************
 
91
 Destroy an auth_ntlmssp_state and ensure pointer copy is correct.
 
92
******************************************************************************/
 
93
 
 
94
static void destroy_auth_ntlmssp(struct smb_srv_trans_enc_ctx *ec)
 
95
{
 
96
        /*
 
97
         * We must remember to update the pointer copy for the common
 
98
         * functions after any auth_ntlmssp_start/auth_ntlmssp_end.
 
99
         */
 
100
 
 
101
        if (ec->auth_ntlmssp_state) {
 
102
                auth_ntlmssp_end(&ec->auth_ntlmssp_state);
 
103
                /* The auth_ntlmssp_end killed this already. */
 
104
                ec->es->s.ntlmssp_state = NULL;
 
105
        }
 
106
}
 
107
 
 
108
#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
 
109
 
 
110
/******************************************************************************
 
111
 Import a name.
 
112
******************************************************************************/
 
113
 
 
114
static NTSTATUS get_srv_gss_creds(const char *service,
 
115
                                const char *name,
 
116
                                gss_cred_usage_t cred_type,
 
117
                                gss_cred_id_t *p_srv_cred)
 
118
{
 
119
        OM_uint32 ret;
 
120
        OM_uint32 min;
 
121
        gss_name_t srv_name;
 
122
        gss_buffer_desc input_name;
 
123
        char *host_princ_s = NULL;
 
124
        NTSTATUS status = NT_STATUS_OK;
 
125
 
 
126
        gss_OID_desc nt_hostbased_service =
 
127
        {10, CONST_DISCARD(char *,"\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x04")};
 
128
 
 
129
        if (asprintf(&host_princ_s, "%s@%s", service, name) == -1) {
 
130
                return NT_STATUS_NO_MEMORY;
 
131
        }
 
132
 
 
133
        input_name.value = host_princ_s;
 
134
        input_name.length = strlen(host_princ_s) + 1;
 
135
 
 
136
        ret = gss_import_name(&min,
 
137
                                &input_name,
 
138
                                &nt_hostbased_service,
 
139
                                &srv_name);
 
140
 
 
141
        DEBUG(10,("get_srv_gss_creds: imported name %s\n",
 
142
                host_princ_s ));
 
143
 
 
144
        if (ret != GSS_S_COMPLETE) {
 
145
                SAFE_FREE(host_princ_s);
 
146
                return map_nt_error_from_gss(ret, min);
 
147
        }
 
148
 
 
149
        /*
 
150
         * We're accessing the krb5.keytab file here.
 
151
         * ensure we have permissions to do so.
 
152
         */
 
153
        become_root();
 
154
 
 
155
        ret = gss_acquire_cred(&min,
 
156
                                srv_name,
 
157
                                GSS_C_INDEFINITE,
 
158
                                GSS_C_NULL_OID_SET,
 
159
                                cred_type,
 
160
                                p_srv_cred,
 
161
                                NULL,
 
162
                                NULL);
 
163
        unbecome_root();
 
164
 
 
165
        if (ret != GSS_S_COMPLETE) {
 
166
                ADS_STATUS adss = ADS_ERROR_GSS(ret, min);
 
167
                DEBUG(10,("get_srv_gss_creds: gss_acquire_cred failed with %s\n",
 
168
                        ads_errstr(adss)));
 
169
                status = map_nt_error_from_gss(ret, min);
 
170
        }
 
171
 
 
172
        SAFE_FREE(host_princ_s);
 
173
        gss_release_name(&min, &srv_name);
 
174
        return status;
 
175
}
 
176
 
 
177
/******************************************************************************
 
178
 Create a gss state.
 
179
 Try and get the cifs/server@realm principal first, then fall back to
 
180
 host/server@realm.
 
181
******************************************************************************/
 
182
 
 
183
static NTSTATUS make_auth_gss(struct smb_srv_trans_enc_ctx *ec)
 
184
{
 
185
        NTSTATUS status;
 
186
        gss_cred_id_t srv_cred;
 
187
        fstring fqdn;
 
188
 
 
189
        name_to_fqdn(fqdn, global_myname());
 
190
        strlower_m(fqdn);
 
191
 
 
192
        status = get_srv_gss_creds("cifs", fqdn, GSS_C_ACCEPT, &srv_cred);
 
193
        if (!NT_STATUS_IS_OK(status)) {
 
194
                status = get_srv_gss_creds("host", fqdn, GSS_C_ACCEPT, &srv_cred);
 
195
                if (!NT_STATUS_IS_OK(status)) {
 
196
                        return nt_status_squash(status);
 
197
                }
 
198
        }
 
199
 
 
200
        ec->es->s.gss_state = SMB_MALLOC_P(struct smb_tran_enc_state_gss);
 
201
        if (!ec->es->s.gss_state) {
 
202
                OM_uint32 min;
 
203
                gss_release_cred(&min, &srv_cred);
 
204
                return NT_STATUS_NO_MEMORY;
 
205
        }
 
206
        ZERO_STRUCTP(ec->es->s.gss_state);
 
207
        ec->es->s.gss_state->creds = srv_cred;
 
208
 
 
209
        /* No context yet. */
 
210
        ec->es->s.gss_state->gss_ctx = GSS_C_NO_CONTEXT;
 
211
 
 
212
        return NT_STATUS_OK;
 
213
}
 
214
#endif
 
215
 
 
216
/******************************************************************************
 
217
 Shutdown a server encryption context.
 
218
******************************************************************************/
 
219
 
 
220
static void srv_free_encryption_context(struct smb_srv_trans_enc_ctx **pp_ec)
 
221
{
 
222
        struct smb_srv_trans_enc_ctx *ec = *pp_ec;
 
223
 
 
224
        if (!ec) {
 
225
                return;
 
226
        }
 
227
 
 
228
        if (ec->es) {
 
229
                switch (ec->es->smb_enc_type) {
 
230
                        case SMB_TRANS_ENC_NTLM:
 
231
                                destroy_auth_ntlmssp(ec);
 
232
                                break;
 
233
#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
 
234
                        case SMB_TRANS_ENC_GSS:
 
235
                                break;
 
236
#endif
 
237
                }
 
238
                common_free_encryption_state(&ec->es);
 
239
        }
 
240
 
 
241
        SAFE_FREE(ec);
 
242
        *pp_ec = NULL;
 
243
}
 
244
 
 
245
/******************************************************************************
 
246
 Create a server encryption context.
 
247
******************************************************************************/
 
248
 
 
249
static NTSTATUS make_srv_encryption_context(enum smb_trans_enc_type smb_enc_type, struct smb_srv_trans_enc_ctx **pp_ec)
 
250
{
 
251
        struct smb_srv_trans_enc_ctx *ec;
 
252
 
 
253
        *pp_ec = NULL;
 
254
 
 
255
        ec = SMB_MALLOC_P(struct smb_srv_trans_enc_ctx);
 
256
        if (!ec) {
 
257
                return NT_STATUS_NO_MEMORY;
 
258
        }
 
259
        ZERO_STRUCTP(partial_srv_trans_enc_ctx);
 
260
        ec->es = SMB_MALLOC_P(struct smb_trans_enc_state);
 
261
        if (!ec->es) {
 
262
                SAFE_FREE(ec);
 
263
                return NT_STATUS_NO_MEMORY;
 
264
        }
 
265
        ZERO_STRUCTP(ec->es);
 
266
        ec->es->smb_enc_type = smb_enc_type;
 
267
        switch (smb_enc_type) {
 
268
                case SMB_TRANS_ENC_NTLM:
 
269
                        {
 
270
                                NTSTATUS status = make_auth_ntlmssp(ec);
 
271
                                if (!NT_STATUS_IS_OK(status)) {
 
272
                                        srv_free_encryption_context(&ec);
 
273
                                        return status;
 
274
                                }
 
275
                        }
 
276
                        break;
 
277
 
 
278
#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
 
279
                case SMB_TRANS_ENC_GSS:
 
280
                        /* Acquire our credentials by calling gss_acquire_cred here. */
 
281
                        {
 
282
                                NTSTATUS status = make_auth_gss(ec);
 
283
                                if (!NT_STATUS_IS_OK(status)) {
 
284
                                        srv_free_encryption_context(&ec);
 
285
                                        return status;
 
286
                                }
 
287
                        }
 
288
                        break;
 
289
#endif
 
290
                default:
 
291
                        srv_free_encryption_context(&ec);
 
292
                        return NT_STATUS_INVALID_PARAMETER;
 
293
        }
 
294
        *pp_ec = ec;
 
295
        return NT_STATUS_OK;
 
296
}
 
297
 
 
298
/******************************************************************************
 
299
 Free an encryption-allocated buffer.
 
300
******************************************************************************/
 
301
 
 
302
void srv_free_enc_buffer(char *buf)
 
303
{
 
304
        /* We know this is an smb buffer, and we
 
305
         * didn't malloc, only copy, for a keepalive,
 
306
         * so ignore non-session messages. */
 
307
 
 
308
        if(CVAL(buf,0)) {
 
309
                return;
 
310
        }
 
311
 
 
312
        if (srv_trans_enc_ctx) {
 
313
                common_free_enc_buffer(srv_trans_enc_ctx->es, buf);
 
314
        }
 
315
}
 
316
 
 
317
/******************************************************************************
 
318
 Decrypt an incoming buffer.
 
319
******************************************************************************/
 
320
 
 
321
NTSTATUS srv_decrypt_buffer(char *buf)
 
322
{
 
323
        /* Ignore non-session messages. */
 
324
        if(CVAL(buf,0)) {
 
325
                return NT_STATUS_OK;
 
326
        }
 
327
 
 
328
        if (srv_trans_enc_ctx) {
 
329
                return common_decrypt_buffer(srv_trans_enc_ctx->es, buf);
 
330
        }
 
331
 
 
332
        return NT_STATUS_OK;
 
333
}
 
334
 
 
335
/******************************************************************************
 
336
 Encrypt an outgoing buffer. Return the encrypted pointer in buf_out.
 
337
******************************************************************************/
 
338
 
 
339
NTSTATUS srv_encrypt_buffer(char *buf, char **buf_out)
 
340
{
 
341
        *buf_out = buf;
 
342
 
 
343
        /* Ignore non-session messages. */
 
344
        if(CVAL(buf,0)) {
 
345
                return NT_STATUS_OK;
 
346
        }
 
347
 
 
348
        if (srv_trans_enc_ctx) {
 
349
                return common_encrypt_buffer(srv_trans_enc_ctx->es, buf, buf_out);
 
350
        }
 
351
        /* Not encrypting. */
 
352
        return NT_STATUS_OK;
 
353
}
 
354
 
 
355
/******************************************************************************
 
356
 Do the gss encryption negotiation. Parameters are in/out.
 
357
 Until success we do everything on the partial enc ctx.
 
358
******************************************************************************/
 
359
 
 
360
#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
 
361
static NTSTATUS srv_enc_spnego_gss_negotiate(unsigned char **ppdata, size_t *p_data_size, DATA_BLOB secblob)
 
362
{
 
363
        OM_uint32 ret;
 
364
        OM_uint32 min;
 
365
        OM_uint32 flags = 0;
 
366
        gss_buffer_desc in_buf, out_buf;
 
367
        struct smb_tran_enc_state_gss *gss_state;
 
368
        DATA_BLOB auth_reply = data_blob_null;
 
369
        DATA_BLOB response = data_blob_null;
 
370
        NTSTATUS status;
 
371
 
 
372
        if (!partial_srv_trans_enc_ctx) {
 
373
                status = make_srv_encryption_context(SMB_TRANS_ENC_GSS, &partial_srv_trans_enc_ctx);
 
374
                if (!NT_STATUS_IS_OK(status)) {
 
375
                        return status;
 
376
                }
 
377
        }
 
378
 
 
379
        gss_state = partial_srv_trans_enc_ctx->es->s.gss_state;
 
380
 
 
381
        in_buf.value = secblob.data;
 
382
        in_buf.length = secblob.length;
 
383
 
 
384
        out_buf.value = NULL;
 
385
        out_buf.length = 0;
 
386
 
 
387
        become_root();
 
388
 
 
389
        ret = gss_accept_sec_context(&min,
 
390
                                &gss_state->gss_ctx,
 
391
                                gss_state->creds,
 
392
                                &in_buf,
 
393
                                GSS_C_NO_CHANNEL_BINDINGS,
 
394
                                NULL,
 
395
                                NULL,           /* Ignore oids. */
 
396
                                &out_buf,       /* To return. */
 
397
                                &flags,
 
398
                                NULL,           /* Ingore time. */
 
399
                                NULL);          /* Ignore delegated creds. */
 
400
        unbecome_root();
 
401
 
 
402
        status = gss_err_to_ntstatus(ret, min);
 
403
        if (ret != GSS_S_COMPLETE && ret != GSS_S_CONTINUE_NEEDED) {
 
404
                return status;
 
405
        }
 
406
 
 
407
        /* Ensure we've got sign+seal available. */
 
408
        if (ret == GSS_S_COMPLETE) {
 
409
                if ((flags & (GSS_C_INTEG_FLAG|GSS_C_CONF_FLAG|GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG)) !=
 
410
                                (GSS_C_INTEG_FLAG|GSS_C_CONF_FLAG|GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG)) {
 
411
                        DEBUG(0,("srv_enc_spnego_gss_negotiate: quality of service not good enough "
 
412
                                "for SMB sealing.\n"));
 
413
                        gss_release_buffer(&min, &out_buf);
 
414
                        return NT_STATUS_ACCESS_DENIED;
 
415
                }
 
416
        }
 
417
 
 
418
        auth_reply = data_blob(out_buf.value, out_buf.length);
 
419
        gss_release_buffer(&min, &out_buf);
 
420
 
 
421
        /* Wrap in SPNEGO. */
 
422
        response = spnego_gen_auth_response(&auth_reply, status, OID_KERBEROS5);
 
423
        data_blob_free(&auth_reply);
 
424
 
 
425
        SAFE_FREE(*ppdata);
 
426
        *ppdata = (unsigned char *)memdup(response.data, response.length);
 
427
        if ((*ppdata) == NULL && response.length > 0) {
 
428
                status = NT_STATUS_NO_MEMORY;
 
429
        }
 
430
        *p_data_size = response.length;
 
431
 
 
432
        data_blob_free(&response);
 
433
 
 
434
        return status;
 
435
}
 
436
#endif
 
437
 
 
438
/******************************************************************************
 
439
 Do the NTLM SPNEGO (or raw) encryption negotiation. Parameters are in/out.
 
440
 Until success we do everything on the partial enc ctx.
 
441
******************************************************************************/
 
442
 
 
443
static NTSTATUS srv_enc_ntlm_negotiate(unsigned char **ppdata, size_t *p_data_size, DATA_BLOB secblob, bool spnego_wrap)
 
444
{
 
445
        NTSTATUS status;
 
446
        DATA_BLOB chal = data_blob_null;
 
447
        DATA_BLOB response = data_blob_null;
 
448
 
 
449
        status = make_srv_encryption_context(SMB_TRANS_ENC_NTLM, &partial_srv_trans_enc_ctx);
 
450
        if (!NT_STATUS_IS_OK(status)) {
 
451
                return status;
 
452
        }
 
453
 
 
454
        status = auth_ntlmssp_update(partial_srv_trans_enc_ctx->auth_ntlmssp_state, secblob, &chal);
 
455
 
 
456
        /* status here should be NT_STATUS_MORE_PROCESSING_REQUIRED
 
457
         * for success ... */
 
458
 
 
459
        if (spnego_wrap) {
 
460
                response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
 
461
                data_blob_free(&chal);
 
462
        } else {
 
463
                /* Return the raw blob. */
 
464
                response = chal;
 
465
        }
 
466
 
 
467
        SAFE_FREE(*ppdata);
 
468
        *ppdata = (unsigned char *)memdup(response.data, response.length);
 
469
        if ((*ppdata) == NULL && response.length > 0) {
 
470
                status = NT_STATUS_NO_MEMORY;
 
471
        }
 
472
        *p_data_size = response.length;
 
473
        data_blob_free(&response);
 
474
 
 
475
        return status;
 
476
}
 
477
 
 
478
/******************************************************************************
 
479
 Do the SPNEGO encryption negotiation. Parameters are in/out.
 
480
 Based off code in smbd/sesssionsetup.c
 
481
 Until success we do everything on the partial enc ctx.
 
482
******************************************************************************/
 
483
 
 
484
static NTSTATUS srv_enc_spnego_negotiate(connection_struct *conn,
 
485
                                        unsigned char **ppdata,
 
486
                                        size_t *p_data_size,
 
487
                                        unsigned char **pparam,
 
488
                                        size_t *p_param_size)
 
489
{
 
490
        NTSTATUS status;
 
491
        DATA_BLOB blob = data_blob_null;
 
492
        DATA_BLOB secblob = data_blob_null;
 
493
        char *kerb_mech = NULL;
 
494
 
 
495
        blob = data_blob_const(*ppdata, *p_data_size);
 
496
 
 
497
        status = parse_spnego_mechanisms(blob, &secblob, &kerb_mech);
 
498
        if (!NT_STATUS_IS_OK(status)) {
 
499
                return nt_status_squash(status);
 
500
        }
 
501
 
 
502
        /* We should have no partial context at this point. */
 
503
 
 
504
        srv_free_encryption_context(&partial_srv_trans_enc_ctx);
 
505
 
 
506
        if (kerb_mech) {
 
507
                SAFE_FREE(kerb_mech);
 
508
 
 
509
#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
 
510
                status = srv_enc_spnego_gss_negotiate(ppdata, p_data_size, secblob);
 
511
#else
 
512
                /* Currently we don't SPNEGO negotiate
 
513
                 * back to NTLMSSP as we do in sessionsetupX. We should... */
 
514
                return NT_STATUS_LOGON_FAILURE;
 
515
#endif
 
516
        } else {
 
517
                status = srv_enc_ntlm_negotiate(ppdata, p_data_size, secblob, true);
 
518
        }
 
519
 
 
520
        data_blob_free(&secblob);
 
521
 
 
522
        if (!NT_STATUS_EQUAL(status,NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
 
523
                srv_free_encryption_context(&partial_srv_trans_enc_ctx);
 
524
                return nt_status_squash(status);
 
525
        }
 
526
 
 
527
        if (NT_STATUS_IS_OK(status)) {
 
528
                /* Return the context we're using for this encryption state. */
 
529
                if (!(*pparam = SMB_MALLOC_ARRAY(unsigned char, 2))) {
 
530
                        return NT_STATUS_NO_MEMORY;
 
531
                }
 
532
                SSVAL(*pparam,0,partial_srv_trans_enc_ctx->es->enc_ctx_num);
 
533
                *p_param_size = 2;
 
534
        }
 
535
 
 
536
        return status;
 
537
}
 
538
 
 
539
/******************************************************************************
 
540
 Complete a SPNEGO encryption negotiation. Parameters are in/out.
 
541
 We only get this for a NTLM auth second stage.
 
542
******************************************************************************/
 
543
 
 
544
static NTSTATUS srv_enc_spnego_ntlm_auth(connection_struct *conn,
 
545
                                        unsigned char **ppdata,
 
546
                                        size_t *p_data_size,
 
547
                                        unsigned char **pparam,
 
548
                                        size_t *p_param_size)
 
549
{
 
550
        NTSTATUS status;
 
551
        DATA_BLOB blob = data_blob_null;
 
552
        DATA_BLOB auth = data_blob_null;
 
553
        DATA_BLOB auth_reply = data_blob_null;
 
554
        DATA_BLOB response = data_blob_null;
 
555
        struct smb_srv_trans_enc_ctx *ec = partial_srv_trans_enc_ctx;
 
556
 
 
557
        /* We must have a partial context here. */
 
558
 
 
559
        if (!ec || !ec->es || ec->auth_ntlmssp_state == NULL || ec->es->smb_enc_type != SMB_TRANS_ENC_NTLM) {
 
560
                srv_free_encryption_context(&partial_srv_trans_enc_ctx);
 
561
                return NT_STATUS_INVALID_PARAMETER;
 
562
        }
 
563
 
 
564
        blob = data_blob_const(*ppdata, *p_data_size);
 
565
        if (!spnego_parse_auth(blob, &auth)) {
 
566
                srv_free_encryption_context(&partial_srv_trans_enc_ctx);
 
567
                return NT_STATUS_INVALID_PARAMETER;
 
568
        }
 
569
 
 
570
        status = auth_ntlmssp_update(ec->auth_ntlmssp_state, auth, &auth_reply);
 
571
        data_blob_free(&auth);
 
572
 
 
573
        /* From RFC4178.
 
574
         *
 
575
         *    supportedMech
 
576
         *
 
577
         *          This field SHALL only be present in the first reply from the
 
578
         *                target.
 
579
         * So set mechOID to NULL here.
 
580
         */
 
581
 
 
582
        response = spnego_gen_auth_response(&auth_reply, status, NULL);
 
583
        data_blob_free(&auth_reply);
 
584
 
 
585
        if (NT_STATUS_IS_OK(status)) {
 
586
                /* Return the context we're using for this encryption state. */
 
587
                if (!(*pparam = SMB_MALLOC_ARRAY(unsigned char, 2))) {
 
588
                        return NT_STATUS_NO_MEMORY;
 
589
                }
 
590
                SSVAL(*pparam,0,ec->es->enc_ctx_num);
 
591
                *p_param_size = 2;
 
592
        }
 
593
 
 
594
        SAFE_FREE(*ppdata);
 
595
        *ppdata = (unsigned char *)memdup(response.data, response.length);
 
596
        if ((*ppdata) == NULL && response.length > 0)
 
597
                return NT_STATUS_NO_MEMORY;
 
598
        *p_data_size = response.length;
 
599
        data_blob_free(&response);
 
600
        return status;
 
601
}
 
602
 
 
603
/******************************************************************************
 
604
 Raw NTLM encryption negotiation. Parameters are in/out.
 
605
 This function does both steps.
 
606
******************************************************************************/
 
607
 
 
608
static NTSTATUS srv_enc_raw_ntlm_auth(connection_struct *conn,
 
609
                                        unsigned char **ppdata,
 
610
                                        size_t *p_data_size,
 
611
                                        unsigned char **pparam,
 
612
                                        size_t *p_param_size)
 
613
{
 
614
        NTSTATUS status;
 
615
        DATA_BLOB blob = data_blob_const(*ppdata, *p_data_size);
 
616
        DATA_BLOB response = data_blob_null;
 
617
        struct smb_srv_trans_enc_ctx *ec;
 
618
 
 
619
        if (!partial_srv_trans_enc_ctx) {
 
620
                /* This is the initial step. */
 
621
                status = srv_enc_ntlm_negotiate(ppdata, p_data_size, blob, false);
 
622
                if (!NT_STATUS_EQUAL(status,NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
 
623
                        srv_free_encryption_context(&partial_srv_trans_enc_ctx);
 
624
                        return nt_status_squash(status);
 
625
                }
 
626
                return status;
 
627
        }
 
628
 
 
629
        ec = partial_srv_trans_enc_ctx;
 
630
        if (!ec || !ec->es || ec->auth_ntlmssp_state == NULL || ec->es->smb_enc_type != SMB_TRANS_ENC_NTLM) {
 
631
                srv_free_encryption_context(&partial_srv_trans_enc_ctx);
 
632
                return NT_STATUS_INVALID_PARAMETER;
 
633
        }
 
634
 
 
635
        /* Second step. */
 
636
        status = auth_ntlmssp_update(partial_srv_trans_enc_ctx->auth_ntlmssp_state, blob, &response);
 
637
 
 
638
        if (NT_STATUS_IS_OK(status)) {
 
639
                /* Return the context we're using for this encryption state. */
 
640
                if (!(*pparam = SMB_MALLOC_ARRAY(unsigned char, 2))) {
 
641
                        return NT_STATUS_NO_MEMORY;
 
642
                }
 
643
                SSVAL(*pparam,0,ec->es->enc_ctx_num);
 
644
                *p_param_size = 2;
 
645
        }
 
646
 
 
647
        /* Return the raw blob. */
 
648
        SAFE_FREE(*ppdata);
 
649
        *ppdata = (unsigned char *)memdup(response.data, response.length);
 
650
        if ((*ppdata) == NULL && response.length > 0)
 
651
                return NT_STATUS_NO_MEMORY;
 
652
        *p_data_size = response.length;
 
653
        data_blob_free(&response);
 
654
        return status;
 
655
}
 
656
 
 
657
/******************************************************************************
 
658
 Do the SPNEGO encryption negotiation. Parameters are in/out.
 
659
******************************************************************************/
 
660
 
 
661
NTSTATUS srv_request_encryption_setup(connection_struct *conn,
 
662
                                        unsigned char **ppdata,
 
663
                                        size_t *p_data_size,
 
664
                                        unsigned char **pparam,
 
665
                                        size_t *p_param_size)
 
666
{
 
667
        unsigned char *pdata = *ppdata;
 
668
 
 
669
        SAFE_FREE(*pparam);
 
670
        *p_param_size = 0;
 
671
 
 
672
        if (*p_data_size < 1) {
 
673
                return NT_STATUS_INVALID_PARAMETER;
 
674
        }
 
675
 
 
676
        if (pdata[0] == ASN1_APPLICATION(0)) {
 
677
                /* its a negTokenTarg packet */
 
678
                return srv_enc_spnego_negotiate(conn, ppdata, p_data_size, pparam, p_param_size);
 
679
        }
 
680
 
 
681
        if (pdata[0] == ASN1_CONTEXT(1)) {
 
682
                /* It's an auth packet */
 
683
                return srv_enc_spnego_ntlm_auth(conn, ppdata, p_data_size, pparam, p_param_size);
 
684
        }
 
685
 
 
686
        /* Maybe it's a raw unwrapped auth ? */
 
687
        if (*p_data_size < 7) {
 
688
                return NT_STATUS_INVALID_PARAMETER;
 
689
        }
 
690
 
 
691
        if (strncmp((char *)pdata, "NTLMSSP", 7) == 0) {
 
692
                return srv_enc_raw_ntlm_auth(conn, ppdata, p_data_size, pparam, p_param_size);
 
693
        }
 
694
 
 
695
        DEBUG(1,("srv_request_encryption_setup: Unknown packet\n"));
 
696
 
 
697
        return NT_STATUS_LOGON_FAILURE;
 
698
}
 
699
 
 
700
/******************************************************************************
 
701
 Negotiation was successful - turn on server-side encryption.
 
702
******************************************************************************/
 
703
 
 
704
static NTSTATUS check_enc_good(struct smb_srv_trans_enc_ctx *ec)
 
705
{
 
706
        if (!ec || !ec->es) {
 
707
                return NT_STATUS_LOGON_FAILURE;
 
708
        }
 
709
 
 
710
        if (ec->es->smb_enc_type == SMB_TRANS_ENC_NTLM) {
 
711
                if ((ec->es->s.ntlmssp_state->neg_flags & (NTLMSSP_NEGOTIATE_SIGN|NTLMSSP_NEGOTIATE_SEAL)) !=
 
712
                                (NTLMSSP_NEGOTIATE_SIGN|NTLMSSP_NEGOTIATE_SEAL)) {
 
713
                        return NT_STATUS_INVALID_PARAMETER;
 
714
                }
 
715
        }
 
716
        /* Todo - check gssapi case. */
 
717
 
 
718
        return NT_STATUS_OK;
 
719
}
 
720
 
 
721
/******************************************************************************
 
722
 Negotiation was successful - turn on server-side encryption.
 
723
******************************************************************************/
 
724
 
 
725
NTSTATUS srv_encryption_start(connection_struct *conn)
 
726
{
 
727
        NTSTATUS status;
 
728
 
 
729
        /* Check that we are really doing sign+seal. */
 
730
        status = check_enc_good(partial_srv_trans_enc_ctx);
 
731
        if (!NT_STATUS_IS_OK(status)) {
 
732
                return status;
 
733
        }
 
734
        /* Throw away the context we're using currently (if any). */
 
735
        srv_free_encryption_context(&srv_trans_enc_ctx);
 
736
 
 
737
        /* Steal the partial pointer. Deliberate shallow copy. */
 
738
        srv_trans_enc_ctx = partial_srv_trans_enc_ctx;
 
739
        srv_trans_enc_ctx->es->enc_on = true;
 
740
 
 
741
        partial_srv_trans_enc_ctx = NULL;
 
742
 
 
743
        DEBUG(1,("srv_encryption_start: context negotiated\n"));
 
744
        return NT_STATUS_OK;
 
745
}
 
746
 
 
747
/******************************************************************************
 
748
 Shutdown all server contexts.
 
749
******************************************************************************/
 
750
 
 
751
void server_encryption_shutdown(void)
 
752
{
 
753
        srv_free_encryption_context(&partial_srv_trans_enc_ctx);
 
754
        srv_free_encryption_context(&srv_trans_enc_ctx);
 
755
}