source: vendor/current/auth/gensec/ncalrpc.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 7.6 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 dcerpc ncalrpc as system operations
5
6 Copyright (C) 2014 Andreas Schneider <asn@samba.org>
7 Copyright (C) 2014 Stefan Metzmacher <metze@samba.org>
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "auth/auth.h"
25#include "auth/gensec/gensec.h"
26#include "auth/gensec/gensec_internal.h"
27#include "librpc/gen_ndr/dcerpc.h"
28#include "lib/param/param.h"
29#include "tsocket.h"
30
31_PUBLIC_ NTSTATUS gensec_ncalrpc_as_system_init(void);
32
33struct gensec_ncalrpc_state {
34 enum {
35 GENSEC_NCALRPC_START,
36 GENSEC_NCALRPC_MORE,
37 GENSEC_NCALRPC_DONE,
38 GENSEC_NCALRPC_ERROR,
39 } step;
40
41 struct auth_user_info_dc *user_info_dc;
42};
43
44static NTSTATUS gensec_ncalrpc_client_start(struct gensec_security *gensec_security)
45{
46 struct gensec_ncalrpc_state *state;
47
48 state = talloc_zero(gensec_security,
49 struct gensec_ncalrpc_state);
50 if (state == NULL) {
51 return NT_STATUS_NO_MEMORY;
52 }
53 gensec_security->private_data = state;
54
55 state->step = GENSEC_NCALRPC_START;
56 return NT_STATUS_OK;
57}
58
59static NTSTATUS gensec_ncalrpc_server_start(struct gensec_security *gensec_security)
60{
61 struct gensec_ncalrpc_state *state;
62
63 state = talloc_zero(gensec_security,
64 struct gensec_ncalrpc_state);
65 if (state == NULL) {
66 return NT_STATUS_NO_MEMORY;
67 }
68 gensec_security->private_data = state;
69
70 state->step = GENSEC_NCALRPC_START;
71 return NT_STATUS_OK;
72}
73
74static NTSTATUS gensec_ncalrpc_update(struct gensec_security *gensec_security,
75 TALLOC_CTX *mem_ctx,
76 struct tevent_context *ev,
77 const DATA_BLOB in,
78 DATA_BLOB *out)
79{
80 struct gensec_ncalrpc_state *state =
81 talloc_get_type_abort(gensec_security->private_data,
82 struct gensec_ncalrpc_state);
83 DATA_BLOB magic_req = data_blob_string_const("NCALRPC_AUTH_TOKEN");
84 DATA_BLOB magic_ok = data_blob_string_const("NCALRPC_AUTH_OK");
85 DATA_BLOB magic_fail = data_blob_string_const("NCALRPC_AUTH_FAIL");
86 char *unix_path = NULL;
87 int cmp;
88 NTSTATUS status;
89
90 *out = data_blob_null;
91
92 if (state->step >= GENSEC_NCALRPC_DONE) {
93 return NT_STATUS_INVALID_PARAMETER;
94 }
95
96 switch (gensec_security->gensec_role) {
97 case GENSEC_CLIENT:
98 switch (state->step) {
99 case GENSEC_NCALRPC_START:
100 *out = data_blob_dup_talloc(mem_ctx, magic_req);
101 if (out->data == NULL) {
102 state->step = GENSEC_NCALRPC_ERROR;
103 return NT_STATUS_NO_MEMORY;
104 }
105
106 state->step = GENSEC_NCALRPC_MORE;
107 return NT_STATUS_MORE_PROCESSING_REQUIRED;
108
109 case GENSEC_NCALRPC_MORE:
110 cmp = data_blob_cmp(&in, &magic_ok);
111 if (cmp != 0) {
112 state->step = GENSEC_NCALRPC_ERROR;
113 return NT_STATUS_LOGON_FAILURE;
114 }
115
116 state->step = GENSEC_NCALRPC_DONE;
117 return NT_STATUS_OK;
118
119 case GENSEC_NCALRPC_DONE:
120 case GENSEC_NCALRPC_ERROR:
121 break;
122 }
123
124 state->step = GENSEC_NCALRPC_ERROR;
125 return NT_STATUS_INTERNAL_ERROR;
126
127 case GENSEC_SERVER:
128 if (state->step != GENSEC_NCALRPC_START) {
129 state->step = GENSEC_NCALRPC_ERROR;
130 return NT_STATUS_INTERNAL_ERROR;
131 }
132
133 cmp = data_blob_cmp(&in, &magic_req);
134 if (cmp != 0) {
135 state->step = GENSEC_NCALRPC_ERROR;
136 *out = data_blob_dup_talloc(mem_ctx, magic_fail);
137 if (out->data == NULL) {
138 return NT_STATUS_NO_MEMORY;
139 }
140 return NT_STATUS_LOGON_FAILURE;
141 }
142
143 if (gensec_security->remote_addr == NULL) {
144 state->step = GENSEC_NCALRPC_ERROR;
145 *out = data_blob_dup_talloc(mem_ctx, magic_fail);
146 if (out->data == NULL) {
147 return NT_STATUS_NO_MEMORY;
148 }
149 return NT_STATUS_LOGON_FAILURE;
150 }
151
152 unix_path = tsocket_address_unix_path(gensec_security->remote_addr,
153 state);
154 if (unix_path == NULL) {
155 state->step = GENSEC_NCALRPC_ERROR;
156 *out = data_blob_dup_talloc(mem_ctx, magic_fail);
157 if (out->data == NULL) {
158 return NT_STATUS_NO_MEMORY;
159 }
160 return NT_STATUS_LOGON_FAILURE;
161 }
162
163 cmp = strcmp(unix_path, "/root/ncalrpc_as_system");
164 TALLOC_FREE(unix_path);
165 if (cmp != 0) {
166 state->step = GENSEC_NCALRPC_ERROR;
167 *out = data_blob_dup_talloc(mem_ctx, magic_fail);
168 if (out->data == NULL) {
169 return NT_STATUS_NO_MEMORY;
170 }
171 return NT_STATUS_LOGON_FAILURE;
172 }
173
174 status = auth_system_user_info_dc(state,
175 lpcfg_netbios_name(gensec_security->settings->lp_ctx),
176 &state->user_info_dc);
177 if (!NT_STATUS_IS_OK(status)) {
178 state->step = GENSEC_NCALRPC_ERROR;
179 *out = data_blob_dup_talloc(mem_ctx, magic_fail);
180 if (out->data == NULL) {
181 return NT_STATUS_NO_MEMORY;
182 }
183 return status;
184 }
185
186 *out = data_blob_dup_talloc(mem_ctx, magic_ok);
187 if (out->data == NULL) {
188 state->step = GENSEC_NCALRPC_ERROR;
189 return NT_STATUS_NO_MEMORY;
190 }
191
192 state->step = GENSEC_NCALRPC_DONE;
193 return NT_STATUS_OK;
194 }
195
196 state->step = GENSEC_NCALRPC_ERROR;
197 return NT_STATUS_INTERNAL_ERROR;
198}
199
200static NTSTATUS gensec_ncalrpc_session_info(struct gensec_security *gensec_security,
201 TALLOC_CTX *mem_ctx,
202 struct auth_session_info **psession_info)
203{
204 struct gensec_ncalrpc_state *state =
205 talloc_get_type_abort(gensec_security->private_data,
206 struct gensec_ncalrpc_state);
207 struct auth4_context *auth_ctx = gensec_security->auth_context;
208 struct auth_session_info *session_info = NULL;
209 uint32_t session_info_flags = 0;
210 NTSTATUS status;
211
212 if (gensec_security->gensec_role != GENSEC_SERVER) {
213 return NT_STATUS_INVALID_PARAMETER;
214 }
215
216 if (state->step != GENSEC_NCALRPC_DONE) {
217 return NT_STATUS_INVALID_PARAMETER;
218 }
219
220 if (auth_ctx == NULL) {
221 DEBUG(0, ("Cannot generate a session_info without the auth_context\n"));
222 return NT_STATUS_INTERNAL_ERROR;
223 }
224
225 if (auth_ctx->generate_session_info == NULL) {
226 DEBUG(0, ("Cannot generate a session_info without the generate_session_info hook\n"));
227 return NT_STATUS_INTERNAL_ERROR;
228 }
229
230 if (gensec_security->want_features & GENSEC_FEATURE_UNIX_TOKEN) {
231 session_info_flags |= AUTH_SESSION_INFO_UNIX_TOKEN;
232 }
233
234 session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
235
236 status = auth_ctx->generate_session_info(
237 auth_ctx,
238 mem_ctx,
239 state->user_info_dc,
240 state->user_info_dc->info->account_name,
241 session_info_flags,
242 &session_info);
243 if (!NT_STATUS_IS_OK(status)) {
244 return status;
245 }
246
247 *psession_info = session_info;
248 return NT_STATUS_OK;
249}
250
251/* We have no features */
252static bool gensec_ncalrpc_have_feature(struct gensec_security *gensec_security,
253 uint32_t feature)
254{
255 if (feature & GENSEC_FEATURE_DCE_STYLE) {
256 return true;
257 }
258
259 return false;
260}
261
262static const struct gensec_security_ops gensec_ncalrpc_security_ops = {
263 .name = "naclrpc_as_system",
264 .auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM,
265 .client_start = gensec_ncalrpc_client_start,
266 .server_start = gensec_ncalrpc_server_start,
267 .update = gensec_ncalrpc_update,
268 .session_info = gensec_ncalrpc_session_info,
269 .have_feature = gensec_ncalrpc_have_feature,
270 .enabled = true,
271 .priority = GENSEC_EXTERNAL,
272};
273
274_PUBLIC_ NTSTATUS gensec_ncalrpc_as_system_init(void)
275{
276 NTSTATUS status;
277
278 status = gensec_register(&gensec_ncalrpc_security_ops);
279 if (!NT_STATUS_IS_OK(status)) {
280 DEBUG(0, ("Failed to register '%s' gensec backend!\n",
281 gensec_ncalrpc_security_ops.name));
282 return status;
283 }
284
285 return status;
286}
Note: See TracBrowser for help on using the repository browser.