?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: re-run make samba3-idl.
[Samba/cd1.git] / source3 / libads / sasl.c
blob6a0a1ae3d201b5aaabbbadfb560dcbea20ca5d36
1 /*
2 Unix SMB/CIFS implementation.
3 ads sasl code
4 Copyright (C) Andrew Tridgell 2001
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "../libcli/auth/spnego.h"
22 #include "ntlmssp.h"
23
24 #ifdef HAVE_LDAP
25
26 static ADS_STATUS ads_sasl_ntlmssp_wrap(ADS_STRUCT *ads, uint8 *buf, uint32 len)
27 {
28 struct ntlmssp_state *ntlmssp_state =
29 (struct ntlmssp_state *)ads->ldap.wrap_private_data;
30 ADS_STATUS status;
31 NTSTATUS nt_status;
32 DATA_BLOB sig;
33 uint8 *dptr = ads->ldap.out.buf + (4 + NTLMSSP_SIG_SIZE);
34
35 /* copy the data to the right location */
36 memcpy(dptr, buf, len);
37
38 /* create the signature and may encrypt the data */
39 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
40 nt_status = ntlmssp_seal_packet(ntlmssp_state,
41 dptr, len,
42 dptr, len,
43 &sig);
44 } else {
45 nt_status = ntlmssp_sign_packet(ntlmssp_state,
46 dptr, len,
47 dptr, len,
48 &sig);
49 }
50 status = ADS_ERROR_NT(nt_status);
51 if (!ADS_ERR_OK(status)) return status;
52
53 /* copy the signature to the right location */
54 memcpy(ads->ldap.out.buf + 4,
55 sig.data, NTLMSSP_SIG_SIZE);
56
57 data_blob_free(&sig);
58
59 /* set how many bytes must be written to the underlying socket */
60 ads->ldap.out.left = 4 + NTLMSSP_SIG_SIZE + len;
61
62 return ADS_SUCCESS;
63 }
64
65 static ADS_STATUS ads_sasl_ntlmssp_unwrap(ADS_STRUCT *ads)
66 {
67 struct ntlmssp_state *ntlmssp_state =
68 (struct ntlmssp_state *)ads->ldap.wrap_private_data;
69 ADS_STATUS status;
70 NTSTATUS nt_status;
71 DATA_BLOB sig;
72 uint8 *dptr = ads->ldap.in.buf + (4 + NTLMSSP_SIG_SIZE);
73 uint32 dlen = ads->ldap.in.ofs - (4 + NTLMSSP_SIG_SIZE);
74
75 /* wrap the signature into a DATA_BLOB */
76 sig = data_blob_const(ads->ldap.in.buf + 4, NTLMSSP_SIG_SIZE);
77
78 /* verify the signature and maybe decrypt the data */
79 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
80 nt_status = ntlmssp_unseal_packet(ntlmssp_state,
81 dptr, dlen,
82 dptr, dlen,
83 &sig);
84 } else {
85 nt_status = ntlmssp_check_packet(ntlmssp_state,
86 dptr, dlen,
87 dptr, dlen,
88 &sig);
89 }
90 status = ADS_ERROR_NT(nt_status);
91 if (!ADS_ERR_OK(status)) return status;
92
93 /* set the amount of bytes for the upper layer and set the ofs to the data */
94 ads->ldap.in.left = dlen;
95 ads->ldap.in.ofs = 4 + NTLMSSP_SIG_SIZE;
96
97 return ADS_SUCCESS;
98 }
99
100 static void ads_sasl_ntlmssp_disconnect(ADS_STRUCT *ads)
101 {
102 struct ntlmssp_state *ntlmssp_state =
103 (struct ntlmssp_state *)ads->ldap.wrap_private_data;
104
105 ntlmssp_end(&ntlmssp_state);
106
107 ads->ldap.wrap_ops = NULL;
108 ads->ldap.wrap_private_data = NULL;
109 }
110
111 static const struct ads_saslwrap_ops ads_sasl_ntlmssp_ops = {
112 .name = "ntlmssp",
113 .wrap = ads_sasl_ntlmssp_wrap,
114 .unwrap = ads_sasl_ntlmssp_unwrap,
115 .disconnect = ads_sasl_ntlmssp_disconnect
116 };
117
118 /*
119 perform a LDAP/SASL/SPNEGO/NTLMSSP bind (just how many layers can
120 we fit on one socket??)
121 */
122 static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
123 {
124 DATA_BLOB msg1 = data_blob_null;
125 DATA_BLOB blob = data_blob_null;
126 DATA_BLOB blob_in = data_blob_null;
127 DATA_BLOB blob_out = data_blob_null;
128 struct berval cred, *scred = NULL;
129 int rc;
130 NTSTATUS nt_status;
131 ADS_STATUS status;
132 int turn = 1;
133 uint32 features = 0;
134
135 struct ntlmssp_state *ntlmssp_state;
136
137 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
138 return ADS_ERROR_NT(nt_status);
139 }
140 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SIGN;
141
142 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, ads->auth.user_name))) {
143 return ADS_ERROR_NT(nt_status);
144 }
145 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, ads->auth.realm))) {
146 return ADS_ERROR_NT(nt_status);
147 }
148 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, ads->auth.password))) {
149 return ADS_ERROR_NT(nt_status);
150 }
151
152 switch (ads->ldap.wrap_type) {
153 case ADS_SASLWRAP_TYPE_SEAL:
154 features = NTLMSSP_FEATURE_SIGN | NTLMSSP_FEATURE_SEAL;
155 break;
156 case ADS_SASLWRAP_TYPE_SIGN:
157 if (ads->auth.flags & ADS_AUTH_SASL_FORCE) {
158 features = NTLMSSP_FEATURE_SIGN;
159 } else {
160 /*
161 * windows servers are broken with sign only,
162 * so we need to use seal here too
163 */
164 features = NTLMSSP_FEATURE_SIGN | NTLMSSP_FEATURE_SEAL;
165 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SEAL;
166 }
167 break;
168 case ADS_SASLWRAP_TYPE_PLAIN:
169 break;
170 }
171
172 ntlmssp_want_feature(ntlmssp_state, features);
173
174 blob_in = data_blob_null;
175
176 do {
177 nt_status = ntlmssp_update(ntlmssp_state,
178 blob_in, &blob_out);
179 data_blob_free(&blob_in);
180 if ((NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)
181 || NT_STATUS_IS_OK(nt_status))
182 && blob_out.length) {
183 if (turn == 1) {
184 /* and wrap it in a SPNEGO wrapper */
185 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
186 } else {
187 /* wrap it in SPNEGO */
188 msg1 = spnego_gen_auth(blob_out);
189 }
190
191 data_blob_free(&blob_out);
192
193 cred.bv_val = (char *)msg1.data;
194 cred.bv_len = msg1.length;
195 scred = NULL;
196 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL, &scred);
197 data_blob_free(&msg1);
198 if ((rc != LDAP_SASL_BIND_IN_PROGRESS) && (rc != 0)) {
199 if (scred) {
200 ber_bvfree(scred);
201 }
202
203 ntlmssp_end(&ntlmssp_state);
204 return ADS_ERROR(rc);
205 }
206 if (scred) {
207 blob = data_blob(scred->bv_val, scred->bv_len);
208 ber_bvfree(scred);
209 } else {
210 blob = data_blob_null;
211 }
212
213 } else {
214
215 ntlmssp_end(&ntlmssp_state);
216 data_blob_free(&blob_out);
217 return ADS_ERROR_NT(nt_status);
218 }
219
220 if ((turn == 1) &&
221 (rc == LDAP_SASL_BIND_IN_PROGRESS)) {
222 DATA_BLOB tmp_blob = data_blob_null;
223 /* the server might give us back two challenges */
224 if (!spnego_parse_challenge(blob, &blob_in,
225 &tmp_blob)) {
226
227 ntlmssp_end(&ntlmssp_state);
228 data_blob_free(&blob);
229 DEBUG(3,("Failed to parse challenges\n"));
230 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
231 }
232 data_blob_free(&tmp_blob);
233 } else if (rc == LDAP_SASL_BIND_IN_PROGRESS) {
234 if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
235 &blob_in)) {
236
237 ntlmssp_end(&ntlmssp_state);
238 data_blob_free(&blob);
239 DEBUG(3,("Failed to parse auth response\n"));
240 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
241 }
242 }
243 data_blob_free(&blob);
244 data_blob_free(&blob_out);
245 turn++;
246 } while (rc == LDAP_SASL_BIND_IN_PROGRESS && !NT_STATUS_IS_OK(nt_status));
247
248 /* we have a reference conter on ntlmssp_state, if we are signing
249 then the state will be kept by the signing engine */
250
251 if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
252 ads->ldap.out.max_unwrapped = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED - NTLMSSP_SIG_SIZE;
253 ads->ldap.out.sig_size = NTLMSSP_SIG_SIZE;
254 ads->ldap.in.min_wrapped = ads->ldap.out.sig_size;
255 ads->ldap.in.max_wrapped = ADS_SASL_WRAPPING_IN_MAX_WRAPPED;
256 status = ads_setup_sasl_wrapping(ads, &ads_sasl_ntlmssp_ops, ntlmssp_state);
257 if (!ADS_ERR_OK(status)) {
258 DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
259 ads_errstr(status)));
260 ntlmssp_end(&ntlmssp_state);
261 return status;
262 }
263 } else {
264 ntlmssp_end(&ntlmssp_state);
265 }
266
267 return ADS_ERROR(rc);
268 }
269
270 #ifdef HAVE_GSSAPI
271 static ADS_STATUS ads_sasl_gssapi_wrap(ADS_STRUCT *ads, uint8 *buf, uint32 len)
272 {
273 gss_ctx_id_t context_handle = (gss_ctx_id_t)ads->ldap.wrap_private_data;
274 ADS_STATUS status;
275 int gss_rc;
276 uint32 minor_status;
277 gss_buffer_desc unwrapped, wrapped;
278 int conf_req_flag, conf_state;
279
280 unwrapped.value = buf;
281 unwrapped.length = len;
282
283 /* for now request sign and seal */
284 conf_req_flag = (ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL);
285
286 gss_rc = gss_wrap(&minor_status, context_handle,
287 conf_req_flag, GSS_C_QOP_DEFAULT,
288 &unwrapped, &conf_state,
289 &wrapped);
290 status = ADS_ERROR_GSS(gss_rc, minor_status);
291 if (!ADS_ERR_OK(status)) return status;
292
293 if (conf_req_flag && conf_state == 0) {
294 return ADS_ERROR_NT(NT_STATUS_ACCESS_DENIED);
295 }
296
297 if ((ads->ldap.out.size - 4) < wrapped.length) {
298 return ADS_ERROR_NT(NT_STATUS_INTERNAL_ERROR);
299 }
300
301 /* copy the wrapped blob to the right location */
302 memcpy(ads->ldap.out.buf + 4, wrapped.value, wrapped.length);
303
304 /* set how many bytes must be written to the underlying socket */
305 ads->ldap.out.left = 4 + wrapped.length;
306
307 gss_release_buffer(&minor_status, &wrapped);
308
309 return ADS_SUCCESS;
310 }
311
312 static ADS_STATUS ads_sasl_gssapi_unwrap(ADS_STRUCT *ads)
313 {
314 gss_ctx_id_t context_handle = (gss_ctx_id_t)ads->ldap.wrap_private_data;
315 ADS_STATUS status;
316 int gss_rc;
317 uint32 minor_status;
318 gss_buffer_desc unwrapped, wrapped;
319 int conf_state;
320
321 wrapped.value = ads->ldap.in.buf + 4;
322 wrapped.length = ads->ldap.in.ofs - 4;
323
324 gss_rc = gss_unwrap(&minor_status, context_handle,
325 &wrapped, &unwrapped,
326 &conf_state, GSS_C_QOP_DEFAULT);
327 status = ADS_ERROR_GSS(gss_rc, minor_status);
328 if (!ADS_ERR_OK(status)) return status;
329
330 if (ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL && conf_state == 0) {
331 return ADS_ERROR_NT(NT_STATUS_ACCESS_DENIED);
332 }
333
334 if (wrapped.length < unwrapped.length) {
335 return ADS_ERROR_NT(NT_STATUS_INTERNAL_ERROR);
336 }
337
338 /* copy the wrapped blob to the right location */
339 memcpy(ads->ldap.in.buf + 4, unwrapped.value, unwrapped.length);
340
341 /* set how many bytes must be written to the underlying socket */
342 ads->ldap.in.left = unwrapped.length;
343 ads->ldap.in.ofs = 4;
344
345 gss_release_buffer(&minor_status, &unwrapped);
346
347 return ADS_SUCCESS;
348 }
349
350 static void ads_sasl_gssapi_disconnect(ADS_STRUCT *ads)
351 {
352 gss_ctx_id_t context_handle = (gss_ctx_id_t)ads->ldap.wrap_private_data;
353 uint32 minor_status;
354
355 gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);
356
357 ads->ldap.wrap_ops = NULL;
358 ads->ldap.wrap_private_data = NULL;
359 }
360
361 static const struct ads_saslwrap_ops ads_sasl_gssapi_ops = {
362 .name = "gssapi",
363 .wrap = ads_sasl_gssapi_wrap,
364 .unwrap = ads_sasl_gssapi_unwrap,
365 .disconnect = ads_sasl_gssapi_disconnect
366 };
367
368 /*
369 perform a LDAP/SASL/SPNEGO/GSSKRB5 bind
370 */
371 static ADS_STATUS ads_sasl_spnego_gsskrb5_bind(ADS_STRUCT *ads, const gss_name_t serv_name)
372 {
373 ADS_STATUS status;
374 bool ok;
375 uint32 minor_status;
376 int gss_rc, rc;
377 gss_OID_desc krb5_mech_type =
378 {9, CONST_DISCARD(char *, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02") };
379 gss_OID mech_type = &krb5_mech_type;
380 gss_OID actual_mech_type = GSS_C_NULL_OID;
381 const char *spnego_mechs[] = {OID_KERBEROS5_OLD, OID_KERBEROS5, OID_NTLMSSP, NULL};
382 gss_ctx_id_t context_handle = GSS_C_NO_CONTEXT;
383 gss_buffer_desc input_token, output_token;
384 uint32 req_flags, ret_flags;
385 uint32 req_tmp, ret_tmp;
386 DATA_BLOB unwrapped;
387 DATA_BLOB wrapped;
388 struct berval cred, *scred = NULL;
389
390 input_token.value = NULL;
391 input_token.length = 0;
392
393 req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG;
394 switch (ads->ldap.wrap_type) {
395 case ADS_SASLWRAP_TYPE_SEAL:
396 req_flags |= GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG;
397 break;
398 case ADS_SASLWRAP_TYPE_SIGN:
399 req_flags |= GSS_C_INTEG_FLAG;
400 break;
401 case ADS_SASLWRAP_TYPE_PLAIN:
402 break;
403 }
404
405 /* Note: here we explicit ask for the krb5 mech_type */
406 gss_rc = gss_init_sec_context(&minor_status,
407 GSS_C_NO_CREDENTIAL,
408 &context_handle,
409 serv_name,
410 mech_type,
411 req_flags,
412 0,
413 NULL,
414 &input_token,
415 &actual_mech_type,
416 &output_token,
417 &ret_flags,
418 NULL);
419 if (gss_rc && gss_rc != GSS_S_CONTINUE_NEEDED) {
420 status = ADS_ERROR_GSS(gss_rc, minor_status);
421 goto failed;
422 }
423
424 /*
425 * As some gssapi krb5 mech implementations
426 * automaticly add GSS_C_INTEG_FLAG and GSS_C_CONF_FLAG
427 * to req_flags internaly, it's not possible to
428 * use plain or signing only connection via
429 * the gssapi interface.
430 *
431 * Because of this we need to check it the ret_flags
432 * has more flags as req_flags and correct the value
433 * of ads->ldap.wrap_type.
434 *
435 * I ads->auth.flags has ADS_AUTH_SASL_FORCE
436 * we need to give an error.
437 */
438 req_tmp = req_flags & (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG);
439 ret_tmp = ret_flags & (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG);
440
441 if (req_tmp == ret_tmp) {
442 /* everythings fine... */
443
444 } else if (req_flags & GSS_C_CONF_FLAG) {
445 /*
446 * here we wanted sealing but didn't got it
447 * from the gssapi library
448 */
449 status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
450 goto failed;
451
452 } else if ((req_flags & GSS_C_INTEG_FLAG) &&
453 !(ret_flags & GSS_C_INTEG_FLAG)) {
454 /*
455 * here we wanted siging but didn't got it
456 * from the gssapi library
457 */
458 status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
459 goto failed;
460
461 } else if (ret_flags & GSS_C_CONF_FLAG) {
462 /*
463 * here we didn't want sealing
464 * but the gssapi library forces it
465 * so correct the needed wrap_type if
466 * the caller didn't forced siging only
467 */
468 if (ads->auth.flags & ADS_AUTH_SASL_FORCE) {
469 status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
470 goto failed;
471 }
472
473 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SEAL;
474 req_flags = ret_flags;
475
476 } else if (ret_flags & GSS_C_INTEG_FLAG) {
477 /*
478 * here we didn't want signing
479 * but the gssapi library forces it
480 * so correct the needed wrap_type if
481 * the caller didn't forced plain
482 */
483 if (ads->auth.flags & ADS_AUTH_SASL_FORCE) {
484 status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
485 goto failed;
486 }
487
488 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SIGN;
489 req_flags = ret_flags;
490 } else {
491 /*
492 * This could (should?) not happen
493 */
494 status = ADS_ERROR_NT(NT_STATUS_INTERNAL_ERROR);
495 goto failed;
496
497 }
498
499 /* and wrap that in a shiny SPNEGO wrapper */
500 unwrapped = data_blob_const(output_token.value, output_token.length);
501 wrapped = gen_negTokenTarg(spnego_mechs, unwrapped);
502 gss_release_buffer(&minor_status, &output_token);
503 if (unwrapped.length > wrapped.length) {
504 status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
505 goto failed;
506 }
507
508 cred.bv_val = (char *)wrapped.data;
509 cred.bv_len = wrapped.length;
510
511 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL,
512 &scred);
513 data_blob_free(&wrapped);
514 if (rc != LDAP_SUCCESS) {
515 status = ADS_ERROR(rc);
516 goto failed;
517 }
518
519 if (scred) {
520 wrapped = data_blob_const(scred->bv_val, scred->bv_len);
521 } else {
522 wrapped = data_blob_null;
523 }
524
525 ok = spnego_parse_auth_response(wrapped, NT_STATUS_OK,
526 OID_KERBEROS5_OLD,
527 &unwrapped);
528 if (scred) ber_bvfree(scred);
529 if (!ok) {
530 status = ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
531 goto failed;
532 }
533
534 input_token.value = unwrapped.data;
535 input_token.length = unwrapped.length;
536
537 /*
538 * As we asked for mutal authentication
539 * we need to pass the servers response
540 * to gssapi
541 */
542 gss_rc = gss_init_sec_context(&minor_status,
543 GSS_C_NO_CREDENTIAL,
544 &context_handle,
545 serv_name,
546 mech_type,
547 req_flags,
548 0,
549 NULL,
550 &input_token,
551 &actual_mech_type,
552 &output_token,
553 &ret_flags,
554 NULL);
555 data_blob_free(&unwrapped);
556 if (gss_rc) {
557 status = ADS_ERROR_GSS(gss_rc, minor_status);
558 goto failed;
559 }
560
561 gss_release_buffer(&minor_status, &output_token);
562
563 /*
564 * If we the sign and seal options
565 * doesn't match after getting the response
566 * from the server, we don't want to use the connection
567 */
568 req_tmp = req_flags & (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG);
569 ret_tmp = ret_flags & (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG);
570
571 if (req_tmp != ret_tmp) {
572 /* everythings fine... */
573 status = ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
574 goto failed;
575 }
576
577 if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
578 uint32 max_msg_size = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED;
579
580 gss_rc = gss_wrap_size_limit(&minor_status, context_handle,
581 (ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL),
582 GSS_C_QOP_DEFAULT,
583 max_msg_size, &ads->ldap.out.max_unwrapped);
584 if (gss_rc) {
585 status = ADS_ERROR_GSS(gss_rc, minor_status);
586 goto failed;
587 }
588
589 ads->ldap.out.sig_size = max_msg_size - ads->ldap.out.max_unwrapped;
590 ads->ldap.in.min_wrapped = 0x2C; /* taken from a capture with LDAP unbind */
591 ads->ldap.in.max_wrapped = max_msg_size;
592 status = ads_setup_sasl_wrapping(ads, &ads_sasl_gssapi_ops, context_handle);
593 if (!ADS_ERR_OK(status)) {
594 DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
595 ads_errstr(status)));
596 goto failed;
597 }
598 /* make sure we don't free context_handle */
599 context_handle = GSS_C_NO_CONTEXT;
600 }
601
602 status = ADS_SUCCESS;
603
604 failed:
605 if (context_handle != GSS_C_NO_CONTEXT)
606 gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);
607 return status;
608 }
609
610 #endif /* HAVE_GSSAPI */
611
612 #ifdef HAVE_KRB5
613 struct ads_service_principal {
614 char *string;
615 #ifdef HAVE_GSSAPI
616 gss_name_t name;
617 #endif
618 };
619
620 static void ads_free_service_principal(struct ads_service_principal *p)
621 {
622 SAFE_FREE(p->string);
623
624 #ifdef HAVE_GSSAPI
625 if (p->name) {
626 uint32 minor_status;
627 gss_release_name(&minor_status, &p->name);
628 }
629 #endif
630 ZERO_STRUCTP(p);
631 }
632
633 static ADS_STATUS ads_generate_service_principal(ADS_STRUCT *ads,
634 const char *given_principal,
635 struct ads_service_principal *p)
636 {
637 ADS_STATUS status;
638 #ifdef HAVE_GSSAPI
639 gss_buffer_desc input_name;
640 /* GSS_KRB5_NT_PRINCIPAL_NAME */
641 gss_OID_desc nt_principal =
642 {10, CONST_DISCARD(char *, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x01")};
643 uint32 minor_status;
644 int gss_rc;
645 #endif
646
647 ZERO_STRUCTP(p);
648
649 /* I've seen a child Windows 2000 domain not send
650 the principal name back in the first round of
651 the SASL bind reply. So we guess based on server
652 name and realm. --jerry */
653 /* Also try best guess when we get the w2k8 ignore
654 principal back - gd */
655
656 if (!given_principal ||
657 strequal(given_principal, ADS_IGNORE_PRINCIPAL)) {
658
659 status = ads_guess_service_principal(ads, &p->string);
660 if (!ADS_ERR_OK(status)) {
661 return status;
662 }
663 } else {
664 p->string = SMB_STRDUP(given_principal);
665 if (!p->string) {
666 return ADS_ERROR(LDAP_NO_MEMORY);
667 }
668 }
669
670 #ifdef HAVE_GSSAPI
671 input_name.value = p->string;
672 input_name.length = strlen(p->string);
673
674 gss_rc = gss_import_name(&minor_status, &input_name, &nt_principal, &p->name);
675 if (gss_rc) {
676 ads_free_service_principal(p);
677 return ADS_ERROR_GSS(gss_rc, minor_status);
678 }
679 #endif
680
681 return ADS_SUCCESS;
682 }
683
684 /*
685 perform a LDAP/SASL/SPNEGO/KRB5 bind
686 */
687 static ADS_STATUS ads_sasl_spnego_rawkrb5_bind(ADS_STRUCT *ads, const char *principal)
688 {
689 DATA_BLOB blob = data_blob_null;
690 struct berval cred, *scred = NULL;
691 DATA_BLOB session_key = data_blob_null;
692 int rc;
693
694 if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
695 return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
696 }
697
698 rc = spnego_gen_negTokenTarg(principal, ads->auth.time_offset, &blob, &session_key, 0,
699 &ads->auth.tgs_expire);
700
701 if (rc) {
702 return ADS_ERROR_KRB5(rc);
703 }
704
705 /* now send the auth packet and we should be done */
706 cred.bv_val = (char *)blob.data;
707 cred.bv_len = blob.length;
708
709 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL, &scred);
710
711 data_blob_free(&blob);
712 data_blob_free(&session_key);
713 if(scred)
714 ber_bvfree(scred);
715
716 return ADS_ERROR(rc);
717 }
718
719 static ADS_STATUS ads_sasl_spnego_krb5_bind(ADS_STRUCT *ads,
720 struct ads_service_principal *p)
721 {
722 #ifdef HAVE_GSSAPI
723 /*
724 * we only use the gsskrb5 based implementation
725 * when sasl sign or seal is requested.
726 *
727 * This has the following reasons:
728 * - it's likely that the gssapi krb5 mech implementation
729 * doesn't support to negotiate plain connections
730 * - the ads_sasl_spnego_rawkrb5_bind is more robust
731 * against clock skew errors
732 */
733 if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
734 return ads_sasl_spnego_gsskrb5_bind(ads, p->name);
735 }
736 #endif
737 return ads_sasl_spnego_rawkrb5_bind(ads, p->string);
738 }
739 #endif /* HAVE_KRB5 */
740
741 /*
742 this performs a SASL/SPNEGO bind
743 */
744 static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
745 {
746 struct berval *scred=NULL;
747 int rc, i;
748 ADS_STATUS status;
749 DATA_BLOB blob;
750 char *given_principal = NULL;
751 char *OIDs[ASN1_MAX_OIDS];
752 #ifdef HAVE_KRB5
753 bool got_kerberos_mechanism = False;
754 #endif
755
756 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", NULL, NULL, NULL, &scred);
757
758 if (rc != LDAP_SASL_BIND_IN_PROGRESS) {
759 status = ADS_ERROR(rc);
760 goto failed;
761 }
762
763 blob = data_blob(scred->bv_val, scred->bv_len);
764
765 ber_bvfree(scred);
766
767 #if 0
768 file_save("sasl_spnego.dat", blob.data, blob.length);
769 #endif
770
771 /* the server sent us the first part of the SPNEGO exchange in the negprot
772 reply */
773 if (!spnego_parse_negTokenInit(blob, OIDs, &given_principal)) {
774 data_blob_free(&blob);
775 status = ADS_ERROR(LDAP_OPERATIONS_ERROR);
776 goto failed;
777 }
778 data_blob_free(&blob);
779
780 /* make sure the server understands kerberos */
781 for (i=0;OIDs[i];i++) {
782 DEBUG(3,("ads_sasl_spnego_bind: got OID=%s\n", OIDs[i]));
783 #ifdef HAVE_KRB5
784 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
785 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
786 got_kerberos_mechanism = True;
787 }
788 #endif
789 talloc_free(OIDs[i]);
790 }
791 DEBUG(3,("ads_sasl_spnego_bind: got server principal name = %s\n", given_principal));
792
793 #ifdef HAVE_KRB5
794 if (!(ads->auth.flags & ADS_AUTH_DISABLE_KERBEROS) &&
795 got_kerberos_mechanism)
796 {
797 struct ads_service_principal p;
798
799 status = ads_generate_service_principal(ads, given_principal, &p);
800 TALLOC_FREE(given_principal);
801 if (!ADS_ERR_OK(status)) {
802 return status;
803 }
804
805 status = ads_sasl_spnego_krb5_bind(ads, &p);
806 if (ADS_ERR_OK(status)) {
807 ads_free_service_principal(&p);
808 return status;
809 }
810
811 DEBUG(10,("ads_sasl_spnego_krb5_bind failed with: %s, "
812 "calling kinit\n", ads_errstr(status)));
813
814 status = ADS_ERROR_KRB5(ads_kinit_password(ads));
815
816 if (ADS_ERR_OK(status)) {
817 status = ads_sasl_spnego_krb5_bind(ads, &p);
818 if (!ADS_ERR_OK(status)) {
819 DEBUG(0,("kinit succeeded but "
820 "ads_sasl_spnego_krb5_bind failed: %s\n",
821 ads_errstr(status)));
822 }
823 }
824
825 ads_free_service_principal(&p);
826
827 /* only fallback to NTLMSSP if allowed */
828 if (ADS_ERR_OK(status) ||
829 !(ads->auth.flags & ADS_AUTH_ALLOW_NTLMSSP)) {
830 return status;
831 }
832 } else
833 #endif
834 {
835 TALLOC_FREE(given_principal);
836 }
837
838 /* lets do NTLMSSP ... this has the big advantage that we don't need
839 to sync clocks, and we don't rely on special versions of the krb5
840 library for HMAC_MD4 encryption */
841 return ads_sasl_spnego_ntlmssp_bind(ads);
842
843 failed:
844 return status;
845 }
846
847 #ifdef HAVE_GSSAPI
848 #define MAX_GSS_PASSES 3
849
850 /* this performs a SASL/gssapi bind
851 we avoid using cyrus-sasl to make Samba more robust. cyrus-sasl
852 is very dependent on correctly configured DNS whereas
853 this routine is much less fragile
854 see RFC2078 and RFC2222 for details
855 */
856 static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv_name)
857 {
858 uint32 minor_status;
859 gss_ctx_id_t context_handle = GSS_C_NO_CONTEXT;
860 gss_OID mech_type = GSS_C_NULL_OID;
861 gss_buffer_desc output_token, input_token;
862 uint32 req_flags, ret_flags;
863 int conf_state;
864 struct berval cred;
865 struct berval *scred = NULL;
866 int i=0;
867 int gss_rc, rc;
868 uint8 *p;
869 uint32 max_msg_size = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED;
870 uint8 wrap_type = ADS_SASLWRAP_TYPE_PLAIN;
871 ADS_STATUS status;
872
873 input_token.value = NULL;
874 input_token.length = 0;
875
876 /*
877 * Note: here we always ask the gssapi for sign and seal
878 * as this is negotiated later after the mutal
879 * authentication
880 */
881 req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG;
882
883 for (i=0; i < MAX_GSS_PASSES; i++) {
884 gss_rc = gss_init_sec_context(&minor_status,
885 GSS_C_NO_CREDENTIAL,
886 &context_handle,
887 serv_name,
888 mech_type,
889 req_flags,
890 0,
891 NULL,
892 &input_token,
893 NULL,
894 &output_token,
895 &ret_flags,
896 NULL);
897 if (scred) {
898 ber_bvfree(scred);
899 scred = NULL;
900 }
901 if (gss_rc && gss_rc != GSS_S_CONTINUE_NEEDED) {
902 status = ADS_ERROR_GSS(gss_rc, minor_status);
903 goto failed;
904 }
905
906 cred.bv_val = (char *)output_token.value;
907 cred.bv_len = output_token.length;
908
909 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSSAPI", &cred, NULL, NULL,
910 &scred);
911 if (rc != LDAP_SASL_BIND_IN_PROGRESS) {
912 status = ADS_ERROR(rc);
913 goto failed;
914 }
915
916 if (output_token.value) {
917 gss_release_buffer(&minor_status, &output_token);
918 }
919
920 if (scred) {
921 input_token.value = scred->bv_val;
922 input_token.length = scred->bv_len;
923 } else {
924 input_token.value = NULL;
925 input_token.length = 0;
926 }
927
928 if (gss_rc == 0) break;
929 }
930
931 gss_rc = gss_unwrap(&minor_status,context_handle,&input_token,&output_token,
932 &conf_state,NULL);
933 if (scred) {
934 ber_bvfree(scred);
935 scred = NULL;
936 }
937 if (gss_rc) {
938 status = ADS_ERROR_GSS(gss_rc, minor_status);
939 goto failed;
940 }
941
942 p = (uint8 *)output_token.value;
943
944 #if 0
945 file_save("sasl_gssapi.dat", output_token.value, output_token.length);
946 #endif
947
948 if (p) {
949 wrap_type = CVAL(p,0);
950 SCVAL(p,0,0);
951 max_msg_size = RIVAL(p,0);
952 }
953
954 gss_release_buffer(&minor_status, &output_token);
955
956 if (!(wrap_type & ads->ldap.wrap_type)) {
957 /*
958 * the server doesn't supports the wrap
959 * type we want :-(
960 */
961 DEBUG(0,("The ldap sasl wrap type doesn't match wanted[%d] server[%d]\n",
962 ads->ldap.wrap_type, wrap_type));
963 DEBUGADD(0,("You may want to set the 'client ldap sasl wrapping' option\n"));
964 status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
965 goto failed;
966 }
967
968 /* 0x58 is the minimum windows accepts */
969 if (max_msg_size < 0x58) {
970 max_msg_size = 0x58;
971 }
972
973 output_token.length = 4;
974 output_token.value = SMB_MALLOC(output_token.length);
975 p = (uint8 *)output_token.value;
976
977 RSIVAL(p,0,max_msg_size);
978 SCVAL(p,0,ads->ldap.wrap_type);
979
980 /*
981 * we used to add sprintf("dn:%s", ads->config.bind_path) here.
982 * but using ads->config.bind_path is the wrong! It should be
983 * the DN of the user object!
984 *
985 * w2k3 gives an error when we send an incorrect DN, but sending nothing
986 * is ok and matches the information flow used in GSS-SPNEGO.
987 */
988
989 gss_rc = gss_wrap(&minor_status, context_handle,0,GSS_C_QOP_DEFAULT,
990 &output_token, &conf_state,
991 &input_token);
992 if (gss_rc) {
993 status = ADS_ERROR_GSS(gss_rc, minor_status);
994 goto failed;
995 }
996
997 free(output_token.value);
998
999 cred.bv_val = (char *)input_token.value;
1000 cred.bv_len = input_token.length;
1001
1002 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSSAPI", &cred, NULL, NULL,
1003 &scred);
1004 gss_release_buffer(&minor_status, &input_token);
1005 status = ADS_ERROR(rc);
1006 if (!ADS_ERR_OK(status)) {
1007 goto failed;
1008 }
1009
1010 if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
1011 gss_rc = gss_wrap_size_limit(&minor_status, context_handle,
1012 (ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL),
1013 GSS_C_QOP_DEFAULT,
1014 max_msg_size, &ads->ldap.out.max_unwrapped);
1015 if (gss_rc) {
1016 status = ADS_ERROR_GSS(gss_rc, minor_status);
1017 goto failed;
1018 }
1019
1020 ads->ldap.out.sig_size = max_msg_size - ads->ldap.out.max_unwrapped;
1021 ads->ldap.in.min_wrapped = 0x2C; /* taken from a capture with LDAP unbind */
1022 ads->ldap.in.max_wrapped = max_msg_size;
1023 status = ads_setup_sasl_wrapping(ads, &ads_sasl_gssapi_ops, context_handle);
1024 if (!ADS_ERR_OK(status)) {
1025 DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
1026 ads_errstr(status)));
1027 goto failed;
1028 }
1029 /* make sure we don't free context_handle */
1030 context_handle = GSS_C_NO_CONTEXT;
1031 }
1032
1033 failed:
1034
1035 if (context_handle != GSS_C_NO_CONTEXT)
1036 gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);
1037
1038 if(scred)
1039 ber_bvfree(scred);
1040 return status;
1041 }
1042
1043 static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads)
1044 {
1045 ADS_STATUS status;
1046 struct ads_service_principal p;
1047
1048 status = ads_generate_service_principal(ads, NULL, &p);
1049 if (!ADS_ERR_OK(status)) {
1050 return status;
1051 }
1052
1053 status = ads_sasl_gssapi_do_bind(ads, p.name);
1054 if (ADS_ERR_OK(status)) {
1055 ads_free_service_principal(&p);
1056 return status;
1057 }
1058
1059 DEBUG(10,("ads_sasl_gssapi_do_bind failed with: %s, "
1060 "calling kinit\n", ads_errstr(status)));
1061
1062 status = ADS_ERROR_KRB5(ads_kinit_password(ads));
1063
1064 if (ADS_ERR_OK(status)) {
1065 status = ads_sasl_gssapi_do_bind(ads, p.name);
1066 }
1067
1068 ads_free_service_principal(&p);
1069
1070 return status;
1071 }
1072
1073 #endif /* HAVE_GSSAPI */
1074
1075 /* mapping between SASL mechanisms and functions */
1076 static struct {
1077 const char *name;
1078 ADS_STATUS (*fn)(ADS_STRUCT *);
1079 } sasl_mechanisms[] = {
1080 {"GSS-SPNEGO", ads_sasl_spnego_bind},
1081 #ifdef HAVE_GSSAPI
1082 {"GSSAPI", ads_sasl_gssapi_bind}, /* doesn't work with .NET RC1. No idea why */
1083 #endif
1084 {NULL, NULL}
1085 };
1086
1087 ADS_STATUS ads_sasl_bind(ADS_STRUCT *ads)
1088 {
1089 const char *attrs[] = {"supportedSASLMechanisms", NULL};
1090 char **values;
1091 ADS_STATUS status;
1092 int i, j;
1093 LDAPMessage *res;
1094
1095 /* get a list of supported SASL mechanisms */
1096 status = ads_do_search(ads, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res);
1097 if (!ADS_ERR_OK(status)) return status;
1098
1099 values = ldap_get_values(ads->ldap.ld, res, "supportedSASLMechanisms");
1100
1101 if (ads->auth.flags & ADS_AUTH_SASL_SEAL) {
1102 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SEAL;
1103 } else if (ads->auth.flags & ADS_AUTH_SASL_SIGN) {
1104 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SIGN;
1105 } else {
1106 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_PLAIN;
1107 }
1108
1109 /* try our supported mechanisms in order */
1110 for (i=0;sasl_mechanisms[i].name;i++) {
1111 /* see if the server supports it */
1112 for (j=0;values && values[j];j++) {
1113 if (strcmp(values[j], sasl_mechanisms[i].name) == 0) {
1114 DEBUG(4,("Found SASL mechanism %s\n", values[j]));
1115 status = sasl_mechanisms[i].fn(ads);
1116 ldap_value_free(values);
1117 ldap_msgfree(res);
1118 return status;
1119 }
1120 }
1121 }
1122
1123 ldap_value_free(values);
1124 ldap_msgfree(res);
1125 return ADS_ERROR(LDAP_AUTH_METHOD_NOT_SUPPORTED);
1126 }
1127
1128 #endif /* HAVE_LDAP */
1129
Crístian's Samba branch