source3/libsmb/clispnego.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5/SPNEGO routines
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
   6    Copyright (C) Luke Howard     2003
   7    Copyright (C) Jeremy Allison 2010
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "../libcli/auth/spnego.h"
  25 #include "smb_krb5.h"
  26 #include "../lib/util/asn1.h"
  27
  28 /*
  29   generate a negTokenInit packet given a list of supported
  30   OIDs (the mechanisms) a blob, and a principal name string
  31 */
  32
  33 DATA_BLOB spnego_gen_negTokenInit(TALLOC_CTX *ctx,
  34                                   const char *OIDs[],
  35                                   DATA_BLOB *psecblob,
  36                                   const char *principal)
  37 {
  38         int i;
  39         ASN1_DATA *data;
  40         DATA_BLOB ret = data_blob_null;
  41
  42         data = asn1_init(talloc_tos());
  43         if (data == NULL) {
  44                 return data_blob_null;
  45         }
  46
  47         if (!asn1_push_tag(data,ASN1_APPLICATION(0))) goto err;
  48         if (!asn1_write_OID(data,OID_SPNEGO)) goto err;
  49         if (!asn1_push_tag(data,ASN1_CONTEXT(0))) goto err;
  50         if (!asn1_push_tag(data,ASN1_SEQUENCE(0))) goto err;
  51
  52         if (!asn1_push_tag(data,ASN1_CONTEXT(0))) goto err;
  53         if (!asn1_push_tag(data,ASN1_SEQUENCE(0))) goto err;
  54         for (i=0; OIDs[i]; i++) {
  55                 if (!asn1_write_OID(data,OIDs[i])) goto err;
  56         }
  57         if (!asn1_pop_tag(data)) goto err;
  58         if (!asn1_pop_tag(data)) goto err;
  59
  60         if (psecblob && psecblob->length && psecblob->data) {
  61                 if (!asn1_push_tag(data, ASN1_CONTEXT(2))) goto err;
  62                 if (!asn1_write_OctetString(data,psecblob->data,
  63                         psecblob->length)) goto err;
  64                 if (!asn1_pop_tag(data)) goto err;
  65         }
  66
  67         if (principal) {
  68                 if (!asn1_push_tag(data, ASN1_CONTEXT(3))) goto err;
  69                 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
  70                 if (!asn1_push_tag(data, ASN1_CONTEXT(0))) goto err;
  71                 if (!asn1_write_GeneralString(data,principal)) goto err;
  72                 if (!asn1_pop_tag(data)) goto err;
  73                 if (!asn1_pop_tag(data)) goto err;
  74                 if (!asn1_pop_tag(data)) goto err;
  75         }
  76
  77         if (!asn1_pop_tag(data)) goto err;
  78         if (!asn1_pop_tag(data)) goto err;
  79
  80         if (!asn1_pop_tag(data)) goto err;
  81
  82         if (!asn1_extract_blob(data, ctx, &ret)) {
  83                 goto err;
  84         }
  85
  86         asn1_free(data);
  87         data = NULL;
  88
  89   err:
  90
  91         if (data != NULL) {
  92                 if (asn1_has_error(data)) {
  93                         DEBUG(1, ("Failed to build negTokenInit at offset %d\n",
  94                                   (int)asn1_current_ofs(data)));
  95                 }
  96
  97                 asn1_free(data);
  98         }
  99
 100         return ret;
 101 }
 102
 103 /*
 104   parse a negTokenInit packet giving a GUID, a list of supported
 105   OIDs (the mechanisms) and a principal name string
 106 */
 107 bool spnego_parse_negTokenInit(TALLOC_CTX *ctx,
 108                                DATA_BLOB blob,
 109                                char *OIDs[ASN1_MAX_OIDS],
 110                                char **principal,
 111                                DATA_BLOB *secblob)
 112 {
 113         int i;
 114         bool ret = false;
 115         ASN1_DATA *data;
 116
 117         for (i = 0; i < ASN1_MAX_OIDS; i++) {
 118                 OIDs[i] = NULL;
 119         }
 120
 121         if (principal) {
 122                 *principal = NULL;
 123         }
 124         if (secblob) {
 125                 *secblob = data_blob_null;
 126         }
 127
 128         data = asn1_init(talloc_tos());
 129         if (data == NULL) {
 130                 return false;
 131         }
 132
 133         if (!asn1_load(data, blob)) goto err;
 134
 135         if (!asn1_start_tag(data,ASN1_APPLICATION(0))) goto err;
 136
 137         if (!asn1_check_OID(data,OID_SPNEGO)) goto err;
 138
 139         /* negTokenInit  [0]  NegTokenInit */
 140         if (!asn1_start_tag(data,ASN1_CONTEXT(0))) goto err;
 141         if (!asn1_start_tag(data,ASN1_SEQUENCE(0))) goto err;
 142
 143         /* mechTypes [0] MechTypeList  OPTIONAL */
 144
 145         /* Not really optional, we depend on this to decide
 146          * what mechanisms we have to work with. */
 147
 148         if (!asn1_start_tag(data,ASN1_CONTEXT(0))) goto err;
 149         if (!asn1_start_tag(data,ASN1_SEQUENCE(0))) goto err;
 150         for (i=0; asn1_tag_remaining(data) > 0 && i < ASN1_MAX_OIDS-1; i++) {
 151                 if (!asn1_read_OID(data,ctx, &OIDs[i])) {
 152                         goto err;
 153                 }
 154                 if (asn1_has_error(data)) {
 155                         goto err;
 156                 }
 157         }
 158         OIDs[i] = NULL;
 159         if (!asn1_end_tag(data)) goto err;
 160         if (!asn1_end_tag(data)) goto err;
 161
 162         /*
 163           Win7 + Live Sign-in Assistant attaches a mechToken
 164           ASN1_CONTEXT(2) to the negTokenInit packet
 165           which breaks our negotiation if we just assume
 166           the next tag is ASN1_CONTEXT(3).
 167         */
 168
 169         if (asn1_peek_tag(data, ASN1_CONTEXT(1))) {
 170                 uint8_t flags;
 171
 172                 /* reqFlags [1] ContextFlags  OPTIONAL */
 173                 if (!asn1_start_tag(data, ASN1_CONTEXT(1))) goto err;
 174                 if (!asn1_start_tag(data, ASN1_BIT_STRING)) goto err;
 175                 while (asn1_tag_remaining(data) > 0) {
 176                         if (!asn1_read_uint8(data, &flags)) goto err;
 177                 }
 178                 if (!asn1_end_tag(data)) goto err;
 179                 if (!asn1_end_tag(data)) goto err;
 180         }
 181
 182         if (asn1_peek_tag(data, ASN1_CONTEXT(2))) {
 183                 DATA_BLOB sblob = data_blob_null;
 184                 /* mechToken [2] OCTET STRING  OPTIONAL */
 185                 if (!asn1_start_tag(data, ASN1_CONTEXT(2))) goto err;
 186                 if (!asn1_read_OctetString(data, ctx, &sblob)) goto err;
 187                 if (!asn1_end_tag(data)) {
 188                         data_blob_free(&sblob);
 189                         goto err;
 190                 }
 191                 if (secblob) {
 192                         *secblob = sblob;
 193                 } else {
 194                         data_blob_free(&sblob);
 195                 }
 196         }
 197
 198         if (asn1_peek_tag(data, ASN1_CONTEXT(3))) {
 199                 char *princ = NULL;
 200                 /* mechListMIC [3] OCTET STRING  OPTIONAL */
 201                 if (!asn1_start_tag(data, ASN1_CONTEXT(3))) goto err;
 202                 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto err;
 203                 if (!asn1_start_tag(data, ASN1_CONTEXT(0))) goto err;
 204                 if (!asn1_read_GeneralString(data, ctx, &princ)) goto err;
 205                 if (!asn1_end_tag(data)) goto err;
 206                 if (!asn1_end_tag(data)) goto err;
 207                 if (!asn1_end_tag(data)) goto err;
 208                 if (principal) {
 209                         *principal = princ;
 210                 } else {
 211                         TALLOC_FREE(princ);
 212                 }
 213         }
 214
 215         if (!asn1_end_tag(data)) goto err;
 216         if (!asn1_end_tag(data)) goto err;
 217
 218         if (!asn1_end_tag(data)) goto err;
 219
 220         ret = !asn1_has_error(data);
 221
 222   err:
 223
 224         if (asn1_has_error(data)) {
 225                 int j;
 226                 if (principal) {
 227                         TALLOC_FREE(*principal);
 228                 }
 229                 if (secblob) {
 230                         data_blob_free(secblob);
 231                 }
 232                 for(j = 0; j < i && j < ASN1_MAX_OIDS-1; j++) {
 233                         TALLOC_FREE(OIDs[j]);
 234                 }
 235         }
 236
 237         asn1_free(data);
 238         return ret;
 239 }
 240
 241 /*
 242   generate a krb5 GSS-API wrapper packet given a ticket
 243 */
 244 DATA_BLOB spnego_gen_krb5_wrap(TALLOC_CTX *ctx, const DATA_BLOB ticket, const uint8_t tok_id[2])
 245 {
 246         ASN1_DATA *data;
 247         DATA_BLOB ret = data_blob_null;
 248
 249         data = asn1_init(talloc_tos());
 250         if (data == NULL) {
 251                 return data_blob_null;
 252         }
 253
 254         if (!asn1_push_tag(data, ASN1_APPLICATION(0))) goto err;
 255         if (!asn1_write_OID(data, OID_KERBEROS5)) goto err;
 256
 257         if (!asn1_write(data, tok_id, 2)) goto err;
 258         if (!asn1_write(data, ticket.data, ticket.length)) goto err;
 259         if (!asn1_pop_tag(data)) goto err;
 260
 261         if (!asn1_extract_blob(data, ctx, &ret)) {
 262                 goto err;
 263         }
 264
 265         asn1_free(data);
 266         data = NULL;
 267
 268   err:
 269
 270         if (data != NULL) {
 271                 if (asn1_has_error(data)) {
 272                         DEBUG(1, ("Failed to build krb5 wrapper at offset %d\n",
 273                                   (int)asn1_current_ofs(data)));
 274                 }
 275
 276                 asn1_free(data);
 277         }
 278
 279         return ret;
 280 }
 281
 282 /*
 283    generate a SPNEGO krb5 negTokenInit packet, ready for a EXTENDED_SECURITY
 284    kerberos session setup
 285 */
 286 int spnego_gen_krb5_negTokenInit(TALLOC_CTX *ctx,
 287                             const char *principal, int time_offset,
 288                             DATA_BLOB *targ,
 289                             DATA_BLOB *session_key_krb5, uint32_t extra_ap_opts,
 290                             const char *ccname, time_t *expire_time)
 291 {
 292         int retval;
 293         DATA_BLOB tkt, tkt_wrapped;
 294         const char *krb_mechs[] = {OID_KERBEROS5_OLD, OID_KERBEROS5, OID_NTLMSSP, NULL};
 295
 296         /* get a kerberos ticket for the service and extract the session key */
 297         retval = cli_krb5_get_ticket(ctx, principal, time_offset,
 298                                           &tkt, session_key_krb5,
 299                                           extra_ap_opts, ccname,
 300                                           expire_time, NULL);
 301         if (retval) {
 302                 return retval;
 303         }
 304
 305         /* wrap that up in a nice GSS-API wrapping */
 306         tkt_wrapped = spnego_gen_krb5_wrap(ctx, tkt, TOK_ID_KRB_AP_REQ);
 307
 308         /* and wrap that in a shiny SPNEGO wrapper */
 309         *targ = spnego_gen_negTokenInit(ctx, krb_mechs, &tkt_wrapped, NULL);
 310
 311         data_blob_free(&tkt_wrapped);
 312         data_blob_free(&tkt);
 313
 314         return retval;
 315 }
 316
 317
 318 /*
 319   parse a spnego NTLMSSP challenge packet giving two security blobs
 320 */
 321 bool spnego_parse_challenge(TALLOC_CTX *ctx, const DATA_BLOB blob,
 322                             DATA_BLOB *chal1, DATA_BLOB *chal2)
 323 {
 324         bool ret = false;
 325         ASN1_DATA *data;
 326
 327         ZERO_STRUCTP(chal1);
 328         ZERO_STRUCTP(chal2);
 329
 330         data = asn1_init(talloc_tos());
 331         if (data == NULL) {
 332                 return false;
 333         }
 334
 335         if (!asn1_load(data, blob)) goto err;
 336         if (!asn1_start_tag(data,ASN1_CONTEXT(1))) goto err;
 337         if (!asn1_start_tag(data,ASN1_SEQUENCE(0))) goto err;
 338
 339         if (!asn1_start_tag(data,ASN1_CONTEXT(0))) goto err;
 340         if (!asn1_check_enumerated(data,1)) goto err;
 341         if (!asn1_end_tag(data)) goto err;
 342
 343         if (!asn1_start_tag(data,ASN1_CONTEXT(1))) goto err;
 344         if (!asn1_check_OID(data, OID_NTLMSSP)) goto err;
 345         if (!asn1_end_tag(data)) goto err;
 346
 347         if (!asn1_start_tag(data,ASN1_CONTEXT(2))) goto err;
 348         if (!asn1_read_OctetString(data, ctx, chal1)) goto err;
 349         if (!asn1_end_tag(data)) goto err;
 350
 351         /* the second challenge is optional (XP doesn't send it) */
 352         if (asn1_tag_remaining(data)) {
 353                 if (!asn1_start_tag(data,ASN1_CONTEXT(3))) goto err;
 354                 if (!asn1_read_OctetString(data, ctx, chal2)) goto err;
 355                 if (!asn1_end_tag(data)) goto err;
 356         }
 357
 358         if (!asn1_end_tag(data)) goto err;
 359         if (!asn1_end_tag(data)) goto err;
 360
 361         ret = !asn1_has_error(data);
 362
 363   err:
 364
 365         if (asn1_has_error(data)) {
 366                 data_blob_free(chal1);
 367                 data_blob_free(chal2);
 368         }
 369
 370         asn1_free(data);
 371         return ret;
 372 }
 373
 374
 375 /*
 376  generate a SPNEGO auth packet. This will contain the encrypted passwords
 377 */
 378 DATA_BLOB spnego_gen_auth(TALLOC_CTX *ctx, DATA_BLOB blob)
 379 {
 380         ASN1_DATA *data;
 381         DATA_BLOB ret = data_blob_null;
 382
 383         data = asn1_init(talloc_tos());
 384         if (data == NULL) {
 385                 return data_blob_null;
 386         }
 387
 388         if (!asn1_push_tag(data, ASN1_CONTEXT(1))) goto err;
 389         if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
 390         if (!asn1_push_tag(data, ASN1_CONTEXT(2))) goto err;
 391         if (!asn1_write_OctetString(data,blob.data,blob.length)) goto err;
 392         if (!asn1_pop_tag(data)) goto err;
 393         if (!asn1_pop_tag(data)) goto err;
 394         if (!asn1_pop_tag(data)) goto err;
 395
 396         if (!asn1_extract_blob(data, ctx, &ret)) {
 397                 goto err;
 398         }
 399
 400  err:
 401
 402         asn1_free(data);
 403
 404         return ret;
 405 }
 406
 407 /*
 408  parse a SPNEGO auth packet. This contains the encrypted passwords
 409 */
 410 bool spnego_parse_auth_response(TALLOC_CTX *ctx,
 411                                 DATA_BLOB blob, NTSTATUS nt_status,
 412                                 const char *mechOID,
 413                                 DATA_BLOB *auth)
 414 {
 415         ASN1_DATA *data;
 416         uint8_t negResult;
 417         bool ret = false;
 418
 419         if (NT_STATUS_IS_OK(nt_status)) {
 420                 negResult = SPNEGO_ACCEPT_COMPLETED;
 421         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 422                 negResult = SPNEGO_ACCEPT_INCOMPLETE;
 423         } else {
 424                 negResult = SPNEGO_REJECT;
 425         }
 426
 427         data = asn1_init(talloc_tos());
 428         if (data == NULL) {
 429                 return false;
 430         }
 431
 432         *auth = data_blob_null;
 433
 434         if (!asn1_load(data, blob)) goto err;
 435         if (!asn1_start_tag(data, ASN1_CONTEXT(1))) goto err;
 436         if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto err;
 437         if (!asn1_start_tag(data, ASN1_CONTEXT(0))) goto err;
 438         if (!asn1_check_enumerated(data, negResult)) goto err;
 439         if (!asn1_end_tag(data)) goto err;
 440
 441         if (asn1_tag_remaining(data)) {
 442                 if (!asn1_start_tag(data,ASN1_CONTEXT(1))) goto err;
 443                 if (!asn1_check_OID(data, mechOID)) goto err;
 444                 if (!asn1_end_tag(data)) goto err;
 445
 446                 if (asn1_tag_remaining(data)) {
 447                         if (!asn1_start_tag(data,ASN1_CONTEXT(2))) goto err;
 448                         if (!asn1_read_OctetString(data, ctx, auth)) goto err;
 449                         if (!asn1_end_tag(data)) goto err;
 450                 }
 451         } else if (negResult == SPNEGO_ACCEPT_INCOMPLETE) {
 452                 asn1_set_error(data);
 453                 goto err;
 454         }
 455
 456         /* Binding against Win2K DC returns a duplicate of the responseToken in
 457          * the optional mechListMIC field. This is a bug in Win2K. We ignore
 458          * this field if it exists. Win2K8 may return a proper mechListMIC at
 459          * which point we need to implement the integrity checking. */
 460         if (asn1_tag_remaining(data)) {
 461                 DATA_BLOB mechList = data_blob_null;
 462                 if (!asn1_start_tag(data, ASN1_CONTEXT(3))) goto err;
 463                 if (!asn1_read_OctetString(data, ctx, &mechList)) goto err;
 464                 data_blob_free(&mechList);
 465                 if (!asn1_end_tag(data)) goto err;
 466                 DEBUG(5,("spnego_parse_auth_response received mechListMIC, "
 467                     "ignoring.\n"));
 468         }
 469
 470         if (!asn1_end_tag(data)) goto err;
 471         if (!asn1_end_tag(data)) goto err;
 472
 473         ret = !asn1_has_error(data);
 474
 475   err:
 476
 477         if (asn1_has_error(data)) {
 478                 DEBUG(3, ("spnego_parse_auth_response failed at %d\n",
 479                           (int)asn1_current_ofs(data)));
 480                 asn1_free(data);
 481                 data_blob_free(auth);
 482                 return false;
 483         }
 484
 485         asn1_free(data);
 486         return ret;
 487 }