source/heimdal/lib/gssapi/spnego/init_sec_context.c

   1 /*
   2  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * Portions Copyright (c) 2004 PADL Software Pty Ltd.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "spnego/spnego_locl.h"
  35
  36 RCSID("$Id: init_sec_context.c,v 1.6 2006/10/14 10:09:15 lha Exp $");
  37
  38 /*
  39  * Send a reply. Note that we only need to send a reply if we
  40  * need to send a MIC or a mechanism token. Otherwise, we can
  41  * return an empty buffer.
  42  *
  43  * The return value of this will be returned to the API, so it
  44  * must return GSS_S_CONTINUE_NEEDED if a token was generated.
  45  */
  46 static OM_uint32
  47 spnego_reply_internal(OM_uint32 *minor_status,
  48                       gssspnego_ctx context_handle,
  49                       const gss_buffer_t mech_buf,
  50                       gss_buffer_t mech_token,
  51                       gss_buffer_t output_token)
  52 {
  53     NegTokenResp resp;
  54     gss_buffer_desc mic_buf;
  55     OM_uint32 ret;
  56     gss_buffer_desc data;
  57     u_char *buf;
  58
  59     if (mech_buf == GSS_C_NO_BUFFER && mech_token->length == 0) {
  60         output_token->length = 0;
  61         output_token->value = NULL;
  62
  63         return context_handle->open ? GSS_S_COMPLETE : GSS_S_FAILURE;
  64     }
  65
  66     memset(&resp, 0, sizeof(resp));
  67
  68     ALLOC(resp.negResult, 1);
  69     if (resp.negResult == NULL) {
  70         *minor_status = ENOMEM;
  71         return GSS_S_FAILURE;
  72     }
  73
  74     resp.supportedMech = NULL;
  75
  76     output_token->length = 0;
  77     output_token->value = NULL;
  78
  79     if (mech_token->length == 0) {
  80         resp.responseToken = NULL;
  81         *(resp.negResult)  = accept_completed;
  82     } else {
  83         ALLOC(resp.responseToken, 1);
  84         if (resp.responseToken == NULL) {
  85             free_NegTokenResp(&resp);
  86             *minor_status = ENOMEM;
  87             return GSS_S_FAILURE;
  88         }
  89         resp.responseToken->length = mech_token->length;
  90         resp.responseToken->data   = mech_token->value;
  91         mech_token->length = 0;
  92         mech_token->value  = NULL;
  93
  94         *(resp.negResult)  = accept_incomplete;
  95     }
  96
  97     if (mech_buf != GSS_C_NO_BUFFER) {
  98         ALLOC(resp.mechListMIC, 1);
  99         if (resp.mechListMIC == NULL) {
 100             free_NegTokenResp(&resp);
 101             *minor_status = ENOMEM;
 102             return GSS_S_FAILURE;
 103         }
 104
 105         ret = gss_get_mic(minor_status,
 106                           context_handle->negotiated_ctx_id,
 107                           0,
 108                           mech_buf,
 109                           &mic_buf);
 110         if (ret) {
 111             free_NegTokenResp(&resp);
 112             *minor_status = ENOMEM;
 113             return GSS_S_FAILURE;
 114         }
 115
 116         resp.mechListMIC->length = mic_buf.length;
 117         resp.mechListMIC->data   = mic_buf.value;
 118     } else {
 119         resp.mechListMIC = NULL;
 120     }
 121
 122     ret = _gss_spnego_encode_response (minor_status, &resp,
 123                                        &data, &buf);
 124     if (ret) {
 125         free_NegTokenResp(&resp);
 126         return ret;
 127     }
 128
 129     output_token->value = malloc(data.length);
 130     if (output_token->value == NULL) {
 131         *minor_status = ENOMEM;
 132         ret = GSS_S_FAILURE;
 133     } else {
 134         output_token->length = data.length;
 135         memcpy(output_token->value, data.value, output_token->length);
 136     }
 137     free(buf);
 138
 139     if (*(resp.negResult) == accept_completed)
 140         ret = GSS_S_COMPLETE;
 141     else
 142         ret = GSS_S_CONTINUE_NEEDED;
 143
 144     free_NegTokenResp(&resp);
 145     return ret;
 146 }
 147
 148 static OM_uint32
 149 spnego_initial
 150            (OM_uint32 * minor_status,
 151             gssspnego_cred cred,
 152             gss_ctx_id_t * context_handle,
 153             const gss_name_t target_name,
 154             const gss_OID mech_type,
 155             OM_uint32 req_flags,
 156             OM_uint32 time_req,
 157             const gss_channel_bindings_t input_chan_bindings,
 158             const gss_buffer_t input_token,
 159             gss_OID * actual_mech_type,
 160             gss_buffer_t output_token,
 161             OM_uint32 * ret_flags,
 162             OM_uint32 * time_rec
 163     )
 164 {
 165     NegTokenInit ni;
 166     int ret;
 167     OM_uint32 sub, minor;
 168     gss_buffer_desc mech_token;
 169     u_char *buf;
 170     size_t buf_size, buf_len;
 171     gss_buffer_desc data;
 172     size_t ni_len;
 173     gss_ctx_id_t context;
 174     gssspnego_ctx ctx;
 175
 176     memset (&ni, 0, sizeof(ni));
 177
 178     *context_handle = GSS_C_NO_CONTEXT;
 179
 180     *minor_status = 0;
 181
 182     sub = _gss_spnego_alloc_sec_context(&minor, &context);
 183     if (GSS_ERROR(sub)) {
 184         *minor_status = minor;
 185         return sub;
 186     }
 187     ctx = (gssspnego_ctx)context;
 188
 189     HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
 190
 191     ctx->local = 1;
 192
 193     sub = _gss_spnego_indicate_mechtypelist(&minor, 0,
 194                                             cred,
 195                                             &ni.mechTypes,
 196                                             &ctx->preferred_mech_type);
 197     if (GSS_ERROR(sub)) {
 198         *minor_status = minor;
 199         _gss_spnego_internal_delete_sec_context(&minor, &context, GSS_C_NO_BUFFER);
 200         return sub;
 201     }
 202
 203     ni.reqFlags = NULL;
 204
 205     /*
 206      * If we have a credential handle, use it to select the mechanism
 207      * that we will use
 208      */
 209
 210     /* generate optimistic token */
 211     sub = gss_init_sec_context(&minor,
 212                                (cred != NULL) ? cred->negotiated_cred_id :
 213                                   GSS_C_NO_CREDENTIAL,
 214                                &ctx->negotiated_ctx_id,
 215                                target_name,
 216                                GSS_C_NO_OID,
 217                                req_flags,
 218                                time_req,
 219                                input_chan_bindings,
 220                                input_token,
 221                                &ctx->negotiated_mech_type,
 222                                &mech_token,
 223                                &ctx->mech_flags,
 224                                &ctx->mech_time_rec);
 225     if (GSS_ERROR(sub)) {
 226         free_NegTokenInit(&ni);
 227         *minor_status = minor;
 228         _gss_spnego_internal_delete_sec_context(&minor, &context, GSS_C_NO_BUFFER);
 229         return sub;
 230     }
 231
 232     if (mech_token.length != 0) {
 233         ALLOC(ni.mechToken, 1);
 234         if (ni.mechToken == NULL) {
 235             free_NegTokenInit(&ni);
 236             gss_release_buffer(&minor, &mech_token);
 237             _gss_spnego_internal_delete_sec_context(&minor, &context, GSS_C_NO_BUFFER);
 238             *minor_status = ENOMEM;
 239             return GSS_S_FAILURE;
 240         }
 241         ni.mechToken->length = mech_token.length;
 242         ni.mechToken->data = malloc(mech_token.length);
 243         if (ni.mechToken->data == NULL && mech_token.length != 0) {
 244             free_NegTokenInit(&ni);
 245             gss_release_buffer(&minor, &mech_token);
 246             *minor_status = ENOMEM;
 247             _gss_spnego_internal_delete_sec_context(&minor, &context, GSS_C_NO_BUFFER);
 248             return GSS_S_FAILURE;
 249         }
 250         memcpy(ni.mechToken->data, mech_token.value, mech_token.length);
 251         gss_release_buffer(&minor, &mech_token);
 252     } else
 253         ni.mechToken = NULL;
 254
 255     ni.mechListMIC = NULL;
 256
 257     ni_len = length_NegTokenInit(&ni);
 258     buf_size = 1 + der_length_len(ni_len) + ni_len;
 259
 260     buf = malloc(buf_size);
 261     if (buf == NULL) {
 262         free_NegTokenInit(&ni);
 263         *minor_status = ENOMEM;
 264         _gss_spnego_internal_delete_sec_context(&minor, &context, GSS_C_NO_BUFFER);
 265         return GSS_S_FAILURE;
 266     }
 267
 268     ret = encode_NegTokenInit(buf + buf_size - 1,
 269                               ni_len,
 270                               &ni, &buf_len);
 271     if (ret == 0 && ni_len != buf_len)
 272         abort();
 273
 274     if (ret == 0) {
 275         size_t tmp;
 276
 277         ret = der_put_length_and_tag(buf + buf_size - buf_len - 1,
 278                                      buf_size - buf_len,
 279                                      buf_len,
 280                                      ASN1_C_CONTEXT,
 281                                      CONS,
 282                                      0,
 283                                      &tmp);
 284         if (ret == 0 && tmp + buf_len != buf_size)
 285             abort();
 286     }
 287     if (ret) {
 288         *minor_status = ret;
 289         free(buf);
 290         free_NegTokenInit(&ni);
 291         _gss_spnego_internal_delete_sec_context(&minor, &context, GSS_C_NO_BUFFER);
 292         return GSS_S_FAILURE;
 293     }
 294
 295     data.value  = buf;
 296     data.length = buf_size;
 297
 298     ctx->initiator_mech_types.len = ni.mechTypes.len;
 299     ctx->initiator_mech_types.val = ni.mechTypes.val;
 300     ni.mechTypes.len = 0;
 301     ni.mechTypes.val = NULL;
 302
 303     free_NegTokenInit(&ni);
 304
 305     sub = gss_encapsulate_token(&data,
 306                                 GSS_SPNEGO_MECHANISM,
 307                                 output_token);
 308     free (buf);
 309
 310     if (sub) {
 311         _gss_spnego_internal_delete_sec_context(&minor, &context, GSS_C_NO_BUFFER);
 312         return sub;
 313     }
 314
 315     if (actual_mech_type)
 316         *actual_mech_type = ctx->negotiated_mech_type;
 317     if (ret_flags)
 318         *ret_flags = ctx->mech_flags;
 319     if (time_rec)
 320         *time_rec = ctx->mech_time_rec;
 321
 322     HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 323
 324     *context_handle = context;
 325
 326     return GSS_S_CONTINUE_NEEDED;
 327 }
 328
 329 static OM_uint32
 330 spnego_reply
 331            (OM_uint32 * minor_status,
 332             const gssspnego_cred cred,
 333             gss_ctx_id_t * context_handle,
 334             const gss_name_t target_name,
 335             const gss_OID mech_type,
 336             OM_uint32 req_flags,
 337             OM_uint32 time_req,
 338             const gss_channel_bindings_t input_chan_bindings,
 339             const gss_buffer_t input_token,
 340             gss_OID * actual_mech_type,
 341             gss_buffer_t output_token,
 342             OM_uint32 * ret_flags,
 343             OM_uint32 * time_rec
 344     )
 345 {
 346     OM_uint32 ret, minor;
 347     NegTokenResp resp;
 348     u_char oidbuf[17];
 349     size_t oidlen;
 350     size_t len, taglen;
 351     gss_OID_desc mech;
 352     int require_mic;
 353     size_t buf_len;
 354     gss_buffer_desc mic_buf, mech_buf;
 355     gss_buffer_desc mech_output_token;
 356     gssspnego_ctx ctx;
 357
 358     *minor_status = 0;
 359
 360     ctx = (gssspnego_ctx)*context_handle;
 361
 362     output_token->length = 0;
 363     output_token->value  = NULL;
 364
 365     mech_output_token.length = 0;
 366     mech_output_token.value = NULL;
 367
 368     mech_buf.value = NULL;
 369     mech_buf.length = 0;
 370
 371     ret = der_match_tag_and_length(input_token->value, input_token->length,
 372                                    ASN1_C_CONTEXT, CONS, 1, &len, &taglen);
 373     if (ret)
 374         return ret;
 375
 376     if (len > input_token->length - taglen)
 377         return ASN1_OVERRUN;
 378
 379     ret = decode_NegTokenResp((const unsigned char *)input_token->value+taglen,
 380                               len, &resp, NULL);
 381     if (ret) {
 382         *minor_status = ENOMEM;
 383         return GSS_S_FAILURE;
 384     }
 385
 386     if (resp.negResult == NULL
 387         || *(resp.negResult) == reject
 388         || resp.supportedMech == NULL) {
 389         free_NegTokenResp(&resp);
 390         return GSS_S_BAD_MECH;
 391     }
 392
 393     ret = der_put_oid(oidbuf + sizeof(oidbuf) - 1,
 394                       sizeof(oidbuf),
 395                       resp.supportedMech,
 396                       &oidlen);
 397     if (ret || (oidlen == GSS_SPNEGO_MECHANISM->length &&
 398                 memcmp(oidbuf + sizeof(oidbuf) - oidlen,
 399                        GSS_SPNEGO_MECHANISM->elements,
 400                        oidlen) == 0)) {
 401         /* Avoid recursively embedded SPNEGO */
 402         free_NegTokenResp(&resp);
 403         return GSS_S_BAD_MECH;
 404     }
 405
 406     HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
 407
 408     if (resp.responseToken != NULL) {
 409         gss_buffer_desc mech_input_token;
 410
 411         mech_input_token.length = resp.responseToken->length;
 412         mech_input_token.value  = resp.responseToken->data;
 413
 414         mech.length = oidlen;
 415         mech.elements = oidbuf + sizeof(oidbuf) - oidlen;
 416
 417         /* Fall through as if the negotiated mechanism
 418            was requested explicitly */
 419         ret = gss_init_sec_context(&minor,
 420                                    (cred != NULL) ? cred->negotiated_cred_id :
 421                                        GSS_C_NO_CREDENTIAL,
 422                                    &ctx->negotiated_ctx_id,
 423                                    target_name,
 424                                    &mech,
 425                                    req_flags,
 426                                    time_req,
 427                                    input_chan_bindings,
 428                                    &mech_input_token,
 429                                    &ctx->negotiated_mech_type,
 430                                    &mech_output_token,
 431                                    &ctx->mech_flags,
 432                                    &ctx->mech_time_rec);
 433         if (GSS_ERROR(ret)) {
 434             HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 435             free_NegTokenResp(&resp);
 436             *minor_status = minor;
 437             return ret;
 438         }
 439         if (ret == GSS_S_COMPLETE) {
 440             ctx->open = 1;
 441         }
 442     }
 443
 444     if (*(resp.negResult) == request_mic) {
 445         ctx->require_mic = 1;
 446     }
 447
 448     if (ctx->open) {
 449         /*
 450          * Verify the mechListMIC if one was provided or CFX was
 451          * used and a non-preferred mechanism was selected
 452          */
 453         if (resp.mechListMIC != NULL) {
 454             require_mic = 1;
 455         } else {
 456             ret = _gss_spnego_require_mechlist_mic(minor_status, ctx,
 457                                                    &require_mic);
 458             if (ret) {
 459                 HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 460                 free_NegTokenResp(&resp);
 461                 gss_release_buffer(&minor, &mech_output_token);
 462                 return ret;
 463             }
 464         }
 465     } else {
 466         require_mic = 0;
 467     }
 468
 469     if (require_mic) {
 470         ASN1_MALLOC_ENCODE(MechTypeList, mech_buf.value, mech_buf.length,
 471                            &ctx->initiator_mech_types, &buf_len, ret);
 472         if (ret) {
 473             HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 474             free_NegTokenResp(&resp);
 475             gss_release_buffer(&minor, &mech_output_token);
 476             *minor_status = ret;
 477             return GSS_S_FAILURE;
 478         }
 479         if (mech_buf.length != buf_len)
 480             abort();
 481
 482         if (resp.mechListMIC == NULL) {
 483             HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 484             free(mech_buf.value);
 485             free_NegTokenResp(&resp);
 486             *minor_status = 0;
 487             return GSS_S_DEFECTIVE_TOKEN;
 488         }
 489         mic_buf.length = resp.mechListMIC->length;
 490         mic_buf.value  = resp.mechListMIC->data;
 491
 492         if (mech_output_token.length == 0) {
 493             ret = gss_verify_mic(minor_status,
 494                                  ctx->negotiated_ctx_id,
 495                                  &mech_buf,
 496                                  &mic_buf,
 497                                  NULL);
 498            if (ret) {
 499                 HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 500                 free(mech_buf.value);
 501                 gss_release_buffer(&minor, &mech_output_token);
 502                 free_NegTokenResp(&resp);
 503                 return GSS_S_DEFECTIVE_TOKEN;
 504             }
 505             ctx->verified_mic = 1;
 506         }
 507     }
 508
 509     ret = spnego_reply_internal(minor_status, ctx,
 510                                 require_mic ? &mech_buf : NULL,
 511                                 &mech_output_token,
 512                                 output_token);
 513
 514     if (mech_buf.value != NULL)
 515         free(mech_buf.value);
 516
 517     free_NegTokenResp(&resp);
 518     gss_release_buffer(&minor, &mech_output_token);
 519
 520     if (actual_mech_type)
 521         *actual_mech_type = ctx->negotiated_mech_type;
 522     if (ret_flags)
 523         *ret_flags = ctx->mech_flags;
 524     if (time_rec)
 525         *time_rec = ctx->mech_time_rec;
 526
 527     HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 528     return ret;
 529 }
 530
 531 OM_uint32 _gss_spnego_init_sec_context
 532            (OM_uint32 * minor_status,
 533             const gss_cred_id_t initiator_cred_handle,
 534             gss_ctx_id_t * context_handle,
 535             const gss_name_t target_name,
 536             const gss_OID mech_type,
 537             OM_uint32 req_flags,
 538             OM_uint32 time_req,
 539             const gss_channel_bindings_t input_chan_bindings,
 540             const gss_buffer_t input_token,
 541             gss_OID * actual_mech_type,
 542             gss_buffer_t output_token,
 543             OM_uint32 * ret_flags,
 544             OM_uint32 * time_rec
 545            )
 546 {
 547     gssspnego_cred cred = (gssspnego_cred)initiator_cred_handle;
 548
 549     if (*context_handle == GSS_C_NO_CONTEXT)
 550         return spnego_initial (minor_status,
 551                                cred,
 552                                context_handle,
 553                                target_name,
 554                                mech_type,
 555                                req_flags,
 556                                time_req,
 557                                input_chan_bindings,
 558                                input_token,
 559                                actual_mech_type,
 560                                output_token,
 561                                ret_flags,
 562                                time_rec);
 563     else
 564         return spnego_reply (minor_status,
 565                              cred,
 566                              context_handle,
 567                              target_name,
 568                              mech_type,
 569                              req_flags,
 570                              time_req,
 571                              input_chan_bindings,
 572                              input_token,
 573                              actual_mech_type,
 574                              output_token,
 575                              ret_flags,
 576                              time_rec);
 577 }
 578