diff options
Diffstat (limited to 'source3/rpc_server/dcesrv_auth_generic.c')
| -rw-r--r-- | source3/rpc_server/dcesrv_auth_generic.c | 116 |
1 files changed, 116 insertions, 0 deletions
diff --git a/source3/rpc_server/dcesrv_auth_generic.c b/source3/rpc_server/dcesrv_auth_generic.c new file mode 100644 index 0000000000..c4c08b2dd3 --- /dev/null +++ b/source3/rpc_server/dcesrv_auth_generic.c @@ -0,0 +1,116 @@ +/* + * NTLMSSP Acceptor + * DCERPC Server functions + * Copyright (C) Simo Sorce 2010. + * Copyright (C) Andrew Bartlett 2011. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see <http://www.gnu.org/licenses/>. + */ + + +#include "includes.h" +#include "rpc_server/dcesrv_auth_generic.h" +#include "auth.h" +#include "auth/gensec/gensec.h" + +NTSTATUS auth_generic_server_authtype_start(TALLOC_CTX *mem_ctx, + uint8_t auth_type, uint8_t auth_level, + DATA_BLOB *token_in, + DATA_BLOB *token_out, + const struct tsocket_address *remote_address, + struct gensec_security **ctx) +{ + struct gensec_security *gensec_security = NULL; + NTSTATUS status; + + status = auth_generic_prepare(talloc_tos(), remote_address, &gensec_security); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, (__location__ ": auth_generic_prepare failed: %s\n", + nt_errstr(status))); + return status; + } + + status = gensec_start_mech_by_authtype(gensec_security, auth_type, auth_level); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, (__location__ ": auth_generic_start failed: %s\n", + nt_errstr(status))); + TALLOC_FREE(gensec_security); + return status; + } + + status = gensec_update(gensec_security, mem_ctx, NULL, *token_in, token_out); + if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + DEBUG(2, (__location__ ": gensec_update failed: %s\n", + nt_errstr(status))); + TALLOC_FREE(gensec_security); + return status; + } + + /* steal gensec context to the caller */ + *ctx = talloc_move(mem_ctx, &gensec_security); + return NT_STATUS_OK; +} + +NTSTATUS auth_generic_server_step(struct gensec_security *gensec_security, + TALLOC_CTX *mem_ctx, + DATA_BLOB *token_in, + DATA_BLOB *token_out) +{ + NTSTATUS status; + + /* this has to be done as root in order to verify the password */ + become_root(); + status = gensec_update(gensec_security, mem_ctx, NULL, *token_in, token_out); + unbecome_root(); + + return status; +} + +NTSTATUS auth_generic_server_check_flags(struct gensec_security *gensec_security, + bool do_sign, bool do_seal) +{ + if (do_sign && !gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) { + DEBUG(1, (__location__ "Integrity was requested but client " + "failed to negotiate signing.\n")); + return NT_STATUS_ACCESS_DENIED; + } + + if (do_seal && !gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) { + DEBUG(1, (__location__ "Privacy was requested but client " + "failed to negotiate sealing.\n")); + return NT_STATUS_ACCESS_DENIED; + } + + return NT_STATUS_OK; +} + +NTSTATUS auth_generic_server_get_user_info(struct gensec_security *gensec_security, + TALLOC_CTX *mem_ctx, + struct auth_session_info **session_info) +{ + NTSTATUS status; + + status = gensec_session_info(gensec_security, mem_ctx, session_info); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1, (__location__ ": Failed to get authenticated user " + "info: %s\n", nt_errstr(status))); + return status; + } + + DEBUG(5, (__location__ "OK: user: %s domain: %s\n", + (*session_info)->info->account_name, + (*session_info)->info->domain_name)); + + return NT_STATUS_OK; +} |