?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3fs-printing: Fix RAW printing for normal users.
[Samba.git] / auth / gensec / spnego.c
blob5923200de75ee2cc266b6506ccd78ac6b9e9adbe
1 /*
2 Unix SMB/CIFS implementation.
3
4 RFC2478 Compliant SPNEGO implementation
5
6 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
8 Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2008
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "../libcli/auth/spnego.h"
27 #include "librpc/gen_ndr/ndr_dcerpc.h"
28 #include "auth/credentials/credentials.h"
29 #include "auth/gensec/gensec.h"
30 #include "param/param.h"
31 #include "lib/util/asn1.h"
32
33 #undef strcasecmp
34
35 _PUBLIC_ NTSTATUS gensec_spnego_init(void);
36
37 enum spnego_state_position {
38 SPNEGO_SERVER_START,
39 SPNEGO_CLIENT_START,
40 SPNEGO_SERVER_TARG,
41 SPNEGO_CLIENT_TARG,
42 SPNEGO_FALLBACK,
43 SPNEGO_DONE
44 };
45
46 struct spnego_state {
47 enum spnego_message_type expected_packet;
48 enum spnego_state_position state_position;
49 struct gensec_security *sub_sec_security;
50 bool no_response_expected;
51
52 const char *neg_oid;
53
54 DATA_BLOB mech_types;
55
56 /*
57 * The following is used to implement
58 * the update token fragmentation
59 */
60 size_t in_needed;
61 DATA_BLOB in_frag;
62 size_t out_max_length;
63 DATA_BLOB out_frag;
64 NTSTATUS out_status;
65 };
66
67
68 static NTSTATUS gensec_spnego_client_start(struct gensec_security *gensec_security)
69 {
70 struct spnego_state *spnego_state;
71
72 spnego_state = talloc_zero(gensec_security, struct spnego_state);
73 if (!spnego_state) {
74 return NT_STATUS_NO_MEMORY;
75 }
76
77 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
78 spnego_state->state_position = SPNEGO_CLIENT_START;
79 spnego_state->sub_sec_security = NULL;
80 spnego_state->no_response_expected = false;
81 spnego_state->mech_types = data_blob(NULL, 0);
82 spnego_state->out_max_length = gensec_max_update_size(gensec_security);
83 spnego_state->out_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
84
85 gensec_security->private_data = spnego_state;
86 return NT_STATUS_OK;
87 }
88
89 static NTSTATUS gensec_spnego_server_start(struct gensec_security *gensec_security)
90 {
91 struct spnego_state *spnego_state;
92
93 spnego_state = talloc_zero(gensec_security, struct spnego_state);
94 if (!spnego_state) {
95 return NT_STATUS_NO_MEMORY;
96 }
97
98 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
99 spnego_state->state_position = SPNEGO_SERVER_START;
100 spnego_state->sub_sec_security = NULL;
101 spnego_state->no_response_expected = false;
102 spnego_state->mech_types = data_blob(NULL, 0);
103 spnego_state->out_max_length = gensec_max_update_size(gensec_security);
104 spnego_state->out_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
105
106 gensec_security->private_data = spnego_state;
107 return NT_STATUS_OK;
108 }
109
110 /*
111 wrappers for the spnego_*() functions
112 */
113 static NTSTATUS gensec_spnego_unseal_packet(struct gensec_security *gensec_security,
114 uint8_t *data, size_t length,
115 const uint8_t *whole_pdu, size_t pdu_length,
116 const DATA_BLOB *sig)
117 {
118 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
119
120 if (spnego_state->state_position != SPNEGO_DONE
121 && spnego_state->state_position != SPNEGO_FALLBACK) {
122 return NT_STATUS_INVALID_PARAMETER;
123 }
124
125 return gensec_unseal_packet(spnego_state->sub_sec_security,
126 data, length,
127 whole_pdu, pdu_length,
128 sig);
129 }
130
131 static NTSTATUS gensec_spnego_check_packet(struct gensec_security *gensec_security,
132 const uint8_t *data, size_t length,
133 const uint8_t *whole_pdu, size_t pdu_length,
134 const DATA_BLOB *sig)
135 {
136 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
137
138 if (spnego_state->state_position != SPNEGO_DONE
139 && spnego_state->state_position != SPNEGO_FALLBACK) {
140 return NT_STATUS_INVALID_PARAMETER;
141 }
142
143 return gensec_check_packet(spnego_state->sub_sec_security,
144 data, length,
145 whole_pdu, pdu_length,
146 sig);
147 }
148
149 static NTSTATUS gensec_spnego_seal_packet(struct gensec_security *gensec_security,
150 TALLOC_CTX *mem_ctx,
151 uint8_t *data, size_t length,
152 const uint8_t *whole_pdu, size_t pdu_length,
153 DATA_BLOB *sig)
154 {
155 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
156
157 if (spnego_state->state_position != SPNEGO_DONE
158 && spnego_state->state_position != SPNEGO_FALLBACK) {
159 return NT_STATUS_INVALID_PARAMETER;
160 }
161
162 return gensec_seal_packet(spnego_state->sub_sec_security,
163 mem_ctx,
164 data, length,
165 whole_pdu, pdu_length,
166 sig);
167 }
168
169 static NTSTATUS gensec_spnego_sign_packet(struct gensec_security *gensec_security,
170 TALLOC_CTX *mem_ctx,
171 const uint8_t *data, size_t length,
172 const uint8_t *whole_pdu, size_t pdu_length,
173 DATA_BLOB *sig)
174 {
175 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
176
177 if (spnego_state->state_position != SPNEGO_DONE
178 && spnego_state->state_position != SPNEGO_FALLBACK) {
179 return NT_STATUS_INVALID_PARAMETER;
180 }
181
182 return gensec_sign_packet(spnego_state->sub_sec_security,
183 mem_ctx,
184 data, length,
185 whole_pdu, pdu_length,
186 sig);
187 }
188
189 static NTSTATUS gensec_spnego_wrap(struct gensec_security *gensec_security,
190 TALLOC_CTX *mem_ctx,
191 const DATA_BLOB *in,
192 DATA_BLOB *out)
193 {
194 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
195
196 if (spnego_state->state_position != SPNEGO_DONE
197 && spnego_state->state_position != SPNEGO_FALLBACK) {
198 DEBUG(1, ("gensec_spnego_wrap: wrong state for wrap\n"));
199 return NT_STATUS_INVALID_PARAMETER;
200 }
201
202 return gensec_wrap(spnego_state->sub_sec_security,
203 mem_ctx, in, out);
204 }
205
206 static NTSTATUS gensec_spnego_unwrap(struct gensec_security *gensec_security,
207 TALLOC_CTX *mem_ctx,
208 const DATA_BLOB *in,
209 DATA_BLOB *out)
210 {
211 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
212
213 if (spnego_state->state_position != SPNEGO_DONE
214 && spnego_state->state_position != SPNEGO_FALLBACK) {
215 DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
216 return NT_STATUS_INVALID_PARAMETER;
217 }
218
219 return gensec_unwrap(spnego_state->sub_sec_security,
220 mem_ctx, in, out);
221 }
222
223 static NTSTATUS gensec_spnego_wrap_packets(struct gensec_security *gensec_security,
224 TALLOC_CTX *mem_ctx,
225 const DATA_BLOB *in,
226 DATA_BLOB *out,
227 size_t *len_processed)
228 {
229 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
230
231 if (spnego_state->state_position != SPNEGO_DONE
232 && spnego_state->state_position != SPNEGO_FALLBACK) {
233 DEBUG(1, ("gensec_spnego_wrap: wrong state for wrap\n"));
234 return NT_STATUS_INVALID_PARAMETER;
235 }
236
237 return gensec_wrap_packets(spnego_state->sub_sec_security,
238 mem_ctx, in, out,
239 len_processed);
240 }
241
242 static NTSTATUS gensec_spnego_packet_full_request(struct gensec_security *gensec_security,
243 DATA_BLOB blob, size_t *size)
244 {
245 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
246
247 if (spnego_state->state_position != SPNEGO_DONE
248 && spnego_state->state_position != SPNEGO_FALLBACK) {
249 DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
250 return NT_STATUS_INVALID_PARAMETER;
251 }
252
253 return gensec_packet_full_request(spnego_state->sub_sec_security,
254 blob, size);
255 }
256
257 static NTSTATUS gensec_spnego_unwrap_packets(struct gensec_security *gensec_security,
258 TALLOC_CTX *mem_ctx,
259 const DATA_BLOB *in,
260 DATA_BLOB *out,
261 size_t *len_processed)
262 {
263 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
264
265 if (spnego_state->state_position != SPNEGO_DONE
266 && spnego_state->state_position != SPNEGO_FALLBACK) {
267 DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
268 return NT_STATUS_INVALID_PARAMETER;
269 }
270
271 return gensec_unwrap_packets(spnego_state->sub_sec_security,
272 mem_ctx, in, out,
273 len_processed);
274 }
275
276 static size_t gensec_spnego_sig_size(struct gensec_security *gensec_security, size_t data_size)
277 {
278 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
279
280 if (spnego_state->state_position != SPNEGO_DONE
281 && spnego_state->state_position != SPNEGO_FALLBACK) {
282 return 0;
283 }
284
285 return gensec_sig_size(spnego_state->sub_sec_security, data_size);
286 }
287
288 static size_t gensec_spnego_max_input_size(struct gensec_security *gensec_security)
289 {
290 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
291
292 if (spnego_state->state_position != SPNEGO_DONE
293 && spnego_state->state_position != SPNEGO_FALLBACK) {
294 return 0;
295 }
296
297 return gensec_max_input_size(spnego_state->sub_sec_security);
298 }
299
300 static size_t gensec_spnego_max_wrapped_size(struct gensec_security *gensec_security)
301 {
302 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
303
304 if (spnego_state->state_position != SPNEGO_DONE
305 && spnego_state->state_position != SPNEGO_FALLBACK) {
306 return 0;
307 }
308
309 return gensec_max_wrapped_size(spnego_state->sub_sec_security);
310 }
311
312 static NTSTATUS gensec_spnego_session_key(struct gensec_security *gensec_security,
313 TALLOC_CTX *mem_ctx,
314 DATA_BLOB *session_key)
315 {
316 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
317 if (!spnego_state->sub_sec_security) {
318 return NT_STATUS_INVALID_PARAMETER;
319 }
320
321 return gensec_session_key(spnego_state->sub_sec_security,
322 mem_ctx,
323 session_key);
324 }
325
326 static NTSTATUS gensec_spnego_session_info(struct gensec_security *gensec_security,
327 TALLOC_CTX *mem_ctx,
328 struct auth_session_info **session_info)
329 {
330 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
331 if (!spnego_state->sub_sec_security) {
332 return NT_STATUS_INVALID_PARAMETER;
333 }
334
335 return gensec_session_info(spnego_state->sub_sec_security,
336 mem_ctx,
337 session_info);
338 }
339
340 /** Fallback to another GENSEC mechanism, based on magic strings
341 *
342 * This is the 'fallback' case, where we don't get SPNEGO, and have to
343 * try all the other options (and hope they all have a magic string
344 * they check)
345 */
346
347 static NTSTATUS gensec_spnego_server_try_fallback(struct gensec_security *gensec_security,
348 struct spnego_state *spnego_state,
349 struct tevent_context *ev,
350 TALLOC_CTX *out_mem_ctx,
351 const DATA_BLOB in, DATA_BLOB *out)
352 {
353 int i,j;
354 struct gensec_security_ops **all_ops
355 = gensec_security_mechs(gensec_security, out_mem_ctx);
356 for (i=0; all_ops[i]; i++) {
357 bool is_spnego;
358 NTSTATUS nt_status;
359
360 if (gensec_security != NULL &&
361 !gensec_security_ops_enabled(all_ops[i], gensec_security))
362 continue;
363
364 if (!all_ops[i]->oid) {
365 continue;
366 }
367
368 is_spnego = false;
369 for (j=0; all_ops[i]->oid[j]; j++) {
370 if (strcasecmp(GENSEC_OID_SPNEGO,all_ops[i]->oid[j]) == 0) {
371 is_spnego = true;
372 }
373 }
374 if (is_spnego) {
375 continue;
376 }
377
378 if (!all_ops[i]->magic) {
379 continue;
380 }
381
382 nt_status = all_ops[i]->magic(gensec_security, &in);
383 if (!NT_STATUS_IS_OK(nt_status)) {
384 continue;
385 }
386
387 spnego_state->state_position = SPNEGO_FALLBACK;
388
389 nt_status = gensec_subcontext_start(spnego_state,
390 gensec_security,
391 &spnego_state->sub_sec_security);
392
393 if (!NT_STATUS_IS_OK(nt_status)) {
394 return nt_status;
395 }
396 /* select the sub context */
397 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
398 all_ops[i]);
399 if (!NT_STATUS_IS_OK(nt_status)) {
400 return nt_status;
401 }
402 nt_status = gensec_update(spnego_state->sub_sec_security,
403 ev, out_mem_ctx, in, out);
404 return nt_status;
405 }
406 DEBUG(1, ("Failed to parse SPNEGO request\n"));
407 return NT_STATUS_INVALID_PARAMETER;
408
409 }
410
411 /*
412 Parse the netTokenInit, either from the client, to the server, or
413 from the server to the client.
414 */
415
416 static NTSTATUS gensec_spnego_parse_negTokenInit(struct gensec_security *gensec_security,
417 struct spnego_state *spnego_state,
418 TALLOC_CTX *out_mem_ctx,
419 struct tevent_context *ev,
420 const char **mechType,
421 const DATA_BLOB unwrapped_in, DATA_BLOB *unwrapped_out)
422 {
423 int i;
424 NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
425 DATA_BLOB null_data_blob = data_blob(NULL,0);
426 bool ok;
427
428 const struct gensec_security_ops_wrapper *all_sec
429 = gensec_security_by_oid_list(gensec_security,
430 out_mem_ctx,
431 mechType,
432 GENSEC_OID_SPNEGO);
433
434 ok = spnego_write_mech_types(spnego_state,
435 mechType,
436 &spnego_state->mech_types);
437 if (!ok) {
438 DEBUG(1, ("SPNEGO: Failed to write mechTypes\n"));
439 return NT_STATUS_NO_MEMORY;
440 }
441
442 if (spnego_state->state_position == SPNEGO_SERVER_START) {
443 uint32_t j;
444 for (j=0; mechType && mechType[j]; j++) {
445 for (i=0; all_sec && all_sec[i].op; i++) {
446 if (strcmp(mechType[j], all_sec[i].oid) != 0) {
447 continue;
448 }
449
450 nt_status = gensec_subcontext_start(spnego_state,
451 gensec_security,
452 &spnego_state->sub_sec_security);
453 if (!NT_STATUS_IS_OK(nt_status)) {
454 return nt_status;
455 }
456 /* select the sub context */
457 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
458 all_sec[i].op);
459 if (!NT_STATUS_IS_OK(nt_status)) {
460 talloc_free(spnego_state->sub_sec_security);
461 spnego_state->sub_sec_security = NULL;
462 break;
463 }
464
465 if (j > 0) {
466 /* no optimistic token */
467 spnego_state->neg_oid = all_sec[i].oid;
468 *unwrapped_out = data_blob_null;
469 nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
470 break;
471 }
472
473 nt_status = gensec_update(spnego_state->sub_sec_security,
474 out_mem_ctx,
475 ev,
476 unwrapped_in,
477 unwrapped_out);
478 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) ||
479 NT_STATUS_EQUAL(nt_status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
480 /* Pretend we never started it (lets the first run find some incompatible demand) */
481
482 DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed to parse contents: %s\n",
483 spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
484 talloc_free(spnego_state->sub_sec_security);
485 spnego_state->sub_sec_security = NULL;
486 break;
487 }
488
489 spnego_state->neg_oid = all_sec[i].oid;
490 break;
491 }
492 if (spnego_state->sub_sec_security) {
493 break;
494 }
495 }
496
497 if (!spnego_state->sub_sec_security) {
498 DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
499 return NT_STATUS_INVALID_PARAMETER;
500 }
501 }
502
503 /* Having tried any optimistic token from the client (if we
504 * were the server), if we didn't get anywhere, walk our list
505 * in our preference order */
506
507 if (!spnego_state->sub_sec_security) {
508 for (i=0; all_sec && all_sec[i].op; i++) {
509 nt_status = gensec_subcontext_start(spnego_state,
510 gensec_security,
511 &spnego_state->sub_sec_security);
512 if (!NT_STATUS_IS_OK(nt_status)) {
513 return nt_status;
514 }
515 /* select the sub context */
516 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
517 all_sec[i].op);
518 if (!NT_STATUS_IS_OK(nt_status)) {
519 talloc_free(spnego_state->sub_sec_security);
520 spnego_state->sub_sec_security = NULL;
521 continue;
522 }
523
524 spnego_state->neg_oid = all_sec[i].oid;
525
526 /* only get the helping start blob for the first OID */
527 nt_status = gensec_update(spnego_state->sub_sec_security,
528 out_mem_ctx,
529 ev,
530 null_data_blob,
531 unwrapped_out);
532
533 /* it is likely that a NULL input token will
534 * not be liked by most server mechs, but if
535 * we are in the client, we want the first
536 * update packet to be able to abort the use
537 * of this mech */
538 if (spnego_state->state_position != SPNEGO_SERVER_START) {
539 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) ||
540 NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_LOGON_SERVERS) ||
541 NT_STATUS_EQUAL(nt_status, NT_STATUS_TIME_DIFFERENCE_AT_DC) ||
542 NT_STATUS_EQUAL(nt_status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
543 /* Pretend we never started it (lets the first run find some incompatible demand) */
544
545 DEBUG(3, ("SPNEGO(%s) NEG_TOKEN_INIT failed: %s\n",
546 spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
547 talloc_free(spnego_state->sub_sec_security);
548 spnego_state->sub_sec_security = NULL;
549 continue;
550 }
551 }
552
553 break;
554 }
555 }
556
557 if (spnego_state->sub_sec_security) {
558 /* it is likely that a NULL input token will
559 * not be liked by most server mechs, but this
560 * does the right thing in the CIFS client.
561 * just push us along the merry-go-round
562 * again, and hope for better luck next
563 * time */
564
565 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
566 *unwrapped_out = data_blob(NULL, 0);
567 nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
568 }
569
570 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)
571 && !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)
572 && !NT_STATUS_IS_OK(nt_status)) {
573 DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed: %s\n",
574 spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
575 talloc_free(spnego_state->sub_sec_security);
576 spnego_state->sub_sec_security = NULL;
577
578 /* We started the mech correctly, and the
579 * input from the other side was valid.
580 * Return the error (say bad password, invalid
581 * ticket) */
582 return nt_status;
583 }
584
585
586 return nt_status; /* OK, INVALID_PARAMETER ore MORE PROCESSING */
587 }
588
589 DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
590 /* we could re-negotiate here, but it would only work
591 * if the client or server lied about what it could
592 * support the first time. Lets keep this code to
593 * reality */
594
595 return nt_status;
596 }
597
598 /** create a negTokenInit
599 *
600 * This is the same packet, no matter if the client or server sends it first, but it is always the first packet
601 */
602 static NTSTATUS gensec_spnego_create_negTokenInit(struct gensec_security *gensec_security,
603 struct spnego_state *spnego_state,
604 TALLOC_CTX *out_mem_ctx,
605 struct tevent_context *ev,
606 const DATA_BLOB in, DATA_BLOB *out)
607 {
608 int i;
609 NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
610 DATA_BLOB null_data_blob = data_blob(NULL,0);
611 const char **mechTypes = NULL;
612 DATA_BLOB unwrapped_out = data_blob(NULL, 0);
613 const struct gensec_security_ops_wrapper *all_sec;
614
615 mechTypes = gensec_security_oids(gensec_security,
616 out_mem_ctx, GENSEC_OID_SPNEGO);
617
618 all_sec = gensec_security_by_oid_list(gensec_security,
619 out_mem_ctx,
620 mechTypes,
621 GENSEC_OID_SPNEGO);
622 for (i=0; all_sec && all_sec[i].op; i++) {
623 struct spnego_data spnego_out;
624 const char **send_mech_types;
625 bool ok;
626
627 nt_status = gensec_subcontext_start(spnego_state,
628 gensec_security,
629 &spnego_state->sub_sec_security);
630 if (!NT_STATUS_IS_OK(nt_status)) {
631 return nt_status;
632 }
633 /* select the sub context */
634 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
635 all_sec[i].op);
636 if (!NT_STATUS_IS_OK(nt_status)) {
637 talloc_free(spnego_state->sub_sec_security);
638 spnego_state->sub_sec_security = NULL;
639 continue;
640 }
641
642 /* In the client, try and produce the first (optimistic) packet */
643 if (spnego_state->state_position == SPNEGO_CLIENT_START) {
644 nt_status = gensec_update(spnego_state->sub_sec_security,
645 out_mem_ctx,
646 ev,
647 null_data_blob,
648 &unwrapped_out);
649
650 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)
651 && !NT_STATUS_IS_OK(nt_status)) {
652 DEBUG(1, ("SPNEGO(%s) creating NEG_TOKEN_INIT failed: %s\n",
653 spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
654 talloc_free(spnego_state->sub_sec_security);
655 spnego_state->sub_sec_security = NULL;
656 /* Pretend we never started it (lets the first run find some incompatible demand) */
657
658 continue;
659 }
660 }
661
662 spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
663
664 send_mech_types = gensec_security_oids_from_ops_wrapped(out_mem_ctx,
665 &all_sec[i]);
666
667 ok = spnego_write_mech_types(spnego_state,
668 send_mech_types,
669 &spnego_state->mech_types);
670 if (!ok) {
671 DEBUG(1, ("SPNEGO: Failed to write mechTypes\n"));
672 return NT_STATUS_NO_MEMORY;
673 }
674
675 /* List the remaining mechs as options */
676 spnego_out.negTokenInit.mechTypes = send_mech_types;
677 spnego_out.negTokenInit.reqFlags = null_data_blob;
678 spnego_out.negTokenInit.reqFlagsPadding = 0;
679
680 if (spnego_state->state_position == SPNEGO_SERVER_START) {
681 spnego_out.negTokenInit.mechListMIC
682 = data_blob_string_const(ADS_IGNORE_PRINCIPAL);
683 } else {
684 spnego_out.negTokenInit.mechListMIC = null_data_blob;
685 }
686
687 spnego_out.negTokenInit.mechToken = unwrapped_out;
688
689 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
690 DEBUG(1, ("Failed to write NEG_TOKEN_INIT\n"));
691 return NT_STATUS_INVALID_PARAMETER;
692 }
693
694 /* set next state */
695 spnego_state->neg_oid = all_sec[i].oid;
696
697 if (NT_STATUS_IS_OK(nt_status)) {
698 spnego_state->no_response_expected = true;
699 }
700
701 return NT_STATUS_MORE_PROCESSING_REQUIRED;
702 }
703 talloc_free(spnego_state->sub_sec_security);
704 spnego_state->sub_sec_security = NULL;
705
706 DEBUG(1, ("Failed to setup SPNEGO negTokenInit request: %s\n", nt_errstr(nt_status)));
707 return NT_STATUS_INVALID_PARAMETER;
708 }
709
710
711 /** create a server negTokenTarg
712 *
713 * This is the case, where the client is the first one who sends data
714 */
715
716 static NTSTATUS gensec_spnego_server_negTokenTarg(struct spnego_state *spnego_state,
717 TALLOC_CTX *out_mem_ctx,
718 NTSTATUS nt_status,
719 const DATA_BLOB unwrapped_out,
720 DATA_BLOB mech_list_mic,
721 DATA_BLOB *out)
722 {
723 struct spnego_data spnego_out;
724 DATA_BLOB null_data_blob = data_blob(NULL, 0);
725
726 /* compose reply */
727 spnego_out.type = SPNEGO_NEG_TOKEN_TARG;
728 spnego_out.negTokenTarg.responseToken = unwrapped_out;
729 spnego_out.negTokenTarg.mechListMIC = null_data_blob;
730 spnego_out.negTokenTarg.supportedMech = NULL;
731
732 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
733 spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
734 spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
735 spnego_state->state_position = SPNEGO_SERVER_TARG;
736 } else if (NT_STATUS_IS_OK(nt_status)) {
737 if (unwrapped_out.data) {
738 spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
739 }
740 spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
741 spnego_out.negTokenTarg.mechListMIC = mech_list_mic;
742 spnego_state->state_position = SPNEGO_DONE;
743 } else {
744 spnego_out.negTokenTarg.negResult = SPNEGO_REJECT;
745 DEBUG(2, ("SPNEGO login failed: %s\n", nt_errstr(nt_status)));
746 spnego_state->state_position = SPNEGO_DONE;
747 }
748
749 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
750 DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_TARG\n"));
751 return NT_STATUS_INVALID_PARAMETER;
752 }
753
754 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
755
756 return nt_status;
757 }
758
759
760 static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
761 struct tevent_context *ev,
762 const DATA_BLOB in, DATA_BLOB *out)
763 {
764 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
765 DATA_BLOB null_data_blob = data_blob(NULL, 0);
766 DATA_BLOB mech_list_mic = data_blob(NULL, 0);
767 DATA_BLOB unwrapped_out = data_blob(NULL, 0);
768 struct spnego_data spnego_out;
769 struct spnego_data spnego;
770
771 ssize_t len;
772
773 *out = data_blob(NULL, 0);
774
775 if (!out_mem_ctx) {
776 out_mem_ctx = spnego_state;
777 }
778
779 /* and switch into the state machine */
780
781 switch (spnego_state->state_position) {
782 case SPNEGO_FALLBACK:
783 return gensec_update(spnego_state->sub_sec_security, ev,
784 out_mem_ctx, in, out);
785 case SPNEGO_SERVER_START:
786 {
787 NTSTATUS nt_status;
788 if (in.length) {
789
790 len = spnego_read_data(gensec_security, in, &spnego);
791 if (len == -1) {
792 return gensec_spnego_server_try_fallback(gensec_security, spnego_state,
793 out_mem_ctx, ev, in, out);
794 }
795 /* client sent NegTargetInit, we send NegTokenTarg */
796
797 /* OK, so it's real SPNEGO, check the packet's the one we expect */
798 if (spnego.type != spnego_state->expected_packet) {
799 DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type,
800 spnego_state->expected_packet));
801 dump_data(1, in.data, in.length);
802 spnego_free_data(&spnego);
803 return NT_STATUS_INVALID_PARAMETER;
804 }
805
806 nt_status = gensec_spnego_parse_negTokenInit(gensec_security,
807 spnego_state,
808 out_mem_ctx,
809 ev,
810 spnego.negTokenInit.mechTypes,
811 spnego.negTokenInit.mechToken,
812 &unwrapped_out);
813
814 nt_status = gensec_spnego_server_negTokenTarg(spnego_state,
815 out_mem_ctx,
816 nt_status,
817 unwrapped_out,
818 null_data_blob,
819 out);
820
821 spnego_free_data(&spnego);
822
823 return nt_status;
824 } else {
825 nt_status = gensec_spnego_create_negTokenInit(gensec_security, spnego_state,
826 out_mem_ctx, ev, in, out);
827 spnego_state->state_position = SPNEGO_SERVER_START;
828 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
829 return nt_status;
830 }
831 }
832
833 case SPNEGO_CLIENT_START:
834 {
835 /* The server offers a list of mechanisms */
836
837 const char *my_mechs[] = {NULL, NULL};
838 NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
839
840 if (!in.length) {
841 /* client to produce negTokenInit */
842 nt_status = gensec_spnego_create_negTokenInit(gensec_security, spnego_state,
843 out_mem_ctx, ev, in, out);
844 spnego_state->state_position = SPNEGO_CLIENT_TARG;
845 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
846 return nt_status;
847 }
848
849 len = spnego_read_data(gensec_security, in, &spnego);
850
851 if (len == -1) {
852 DEBUG(1, ("Invalid SPNEGO request:\n"));
853 dump_data(1, in.data, in.length);
854 return NT_STATUS_INVALID_PARAMETER;
855 }
856
857 /* OK, so it's real SPNEGO, check the packet's the one we expect */
858 if (spnego.type != spnego_state->expected_packet) {
859 DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type,
860 spnego_state->expected_packet));
861 dump_data(1, in.data, in.length);
862 spnego_free_data(&spnego);
863 return NT_STATUS_INVALID_PARAMETER;
864 }
865
866 if (spnego.negTokenInit.targetPrincipal
867 && strcmp(spnego.negTokenInit.targetPrincipal, ADS_IGNORE_PRINCIPAL) != 0) {
868 DEBUG(5, ("Server claims it's principal name is %s\n", spnego.negTokenInit.targetPrincipal));
869 if (lpcfg_client_use_spnego_principal(gensec_security->settings->lp_ctx)) {
870 gensec_set_target_principal(gensec_security, spnego.negTokenInit.targetPrincipal);
871 }
872 }
873
874 nt_status = gensec_spnego_parse_negTokenInit(gensec_security,
875 spnego_state,
876 out_mem_ctx,
877 ev,
878 spnego.negTokenInit.mechTypes,
879 spnego.negTokenInit.mechToken,
880 &unwrapped_out);
881
882 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(nt_status)) {
883 spnego_free_data(&spnego);
884 return nt_status;
885 }
886
887 my_mechs[0] = spnego_state->neg_oid;
888 /* compose reply */
889 spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
890 spnego_out.negTokenInit.mechTypes = my_mechs;
891 spnego_out.negTokenInit.reqFlags = null_data_blob;
892 spnego_out.negTokenInit.reqFlagsPadding = 0;
893 spnego_out.negTokenInit.mechListMIC = null_data_blob;
894 spnego_out.negTokenInit.mechToken = unwrapped_out;
895
896 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
897 DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_INIT\n"));
898 return NT_STATUS_INVALID_PARAMETER;
899 }
900
901 /* set next state */
902 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
903 spnego_state->state_position = SPNEGO_CLIENT_TARG;
904
905 if (NT_STATUS_IS_OK(nt_status)) {
906 spnego_state->no_response_expected = true;
907 }
908
909 spnego_free_data(&spnego);
910 return NT_STATUS_MORE_PROCESSING_REQUIRED;
911 }
912 case SPNEGO_SERVER_TARG:
913 {
914 NTSTATUS nt_status;
915 bool new_spnego = false;
916
917 if (!in.length) {
918 return NT_STATUS_INVALID_PARAMETER;
919 }
920
921 len = spnego_read_data(gensec_security, in, &spnego);
922
923 if (len == -1) {
924 DEBUG(1, ("Invalid SPNEGO request:\n"));
925 dump_data(1, in.data, in.length);
926 return NT_STATUS_INVALID_PARAMETER;
927 }
928
929 /* OK, so it's real SPNEGO, check the packet's the one we expect */
930 if (spnego.type != spnego_state->expected_packet) {
931 DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type,
932 spnego_state->expected_packet));
933 dump_data(1, in.data, in.length);
934 spnego_free_data(&spnego);
935 return NT_STATUS_INVALID_PARAMETER;
936 }
937
938 if (!spnego_state->sub_sec_security) {
939 DEBUG(1, ("SPNEGO: Did not setup a mech in NEG_TOKEN_INIT\n"));
940 spnego_free_data(&spnego);
941 return NT_STATUS_INVALID_PARAMETER;
942 }
943
944 nt_status = gensec_update(spnego_state->sub_sec_security,
945 out_mem_ctx, ev,
946 spnego.negTokenTarg.responseToken,
947 &unwrapped_out);
948 if (NT_STATUS_IS_OK(nt_status) && spnego.negTokenTarg.mechListMIC.length > 0) {
949 new_spnego = true;
950 nt_status = gensec_check_packet(spnego_state->sub_sec_security,
951 spnego_state->mech_types.data,
952 spnego_state->mech_types.length,
953 spnego_state->mech_types.data,
954 spnego_state->mech_types.length,
955 &spnego.negTokenTarg.mechListMIC);
956 if (!NT_STATUS_IS_OK(nt_status)) {
957 DEBUG(2,("GENSEC SPNEGO: failed to verify mechListMIC: %s\n",
958 nt_errstr(nt_status)));
959 }
960 }
961 if (NT_STATUS_IS_OK(nt_status) && new_spnego) {
962 nt_status = gensec_sign_packet(spnego_state->sub_sec_security,
963 out_mem_ctx,
964 spnego_state->mech_types.data,
965 spnego_state->mech_types.length,
966 spnego_state->mech_types.data,
967 spnego_state->mech_types.length,
968 &mech_list_mic);
969 if (!NT_STATUS_IS_OK(nt_status)) {
970 DEBUG(2,("GENSEC SPNEGO: failed to sign mechListMIC: %s\n",
971 nt_errstr(nt_status)));
972 }
973 }
974
975 nt_status = gensec_spnego_server_negTokenTarg(spnego_state,
976 out_mem_ctx,
977 nt_status,
978 unwrapped_out,
979 mech_list_mic,
980 out);
981
982 spnego_free_data(&spnego);
983
984 return nt_status;
985 }
986 case SPNEGO_CLIENT_TARG:
987 {
988 NTSTATUS nt_status;
989 if (!in.length) {
990 return NT_STATUS_INVALID_PARAMETER;
991 }
992
993 len = spnego_read_data(gensec_security, in, &spnego);
994
995 if (len == -1) {
996 DEBUG(1, ("Invalid SPNEGO request:\n"));
997 dump_data(1, in.data, in.length);
998 return NT_STATUS_INVALID_PARAMETER;
999 }
1000
1001 /* OK, so it's real SPNEGO, check the packet's the one we expect */
1002 if (spnego.type != spnego_state->expected_packet) {
1003 DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type,
1004 spnego_state->expected_packet));
1005 dump_data(1, in.data, in.length);
1006 spnego_free_data(&spnego);
1007 return NT_STATUS_INVALID_PARAMETER;
1008 }
1009
1010 if (spnego.negTokenTarg.negResult == SPNEGO_REJECT) {
1011 spnego_free_data(&spnego);
1012 return NT_STATUS_ACCESS_DENIED;
1013 }
1014
1015 /* Server didn't like our choice of mech, and chose something else */
1016 if ((spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_INCOMPLETE) &&
1017 spnego.negTokenTarg.supportedMech &&
1018 strcmp(spnego.negTokenTarg.supportedMech, spnego_state->neg_oid) != 0) {
1019 DEBUG(3,("GENSEC SPNEGO: client preferred mech (%s) not accepted, server wants: %s\n",
1020 gensec_get_name_by_oid(gensec_security, spnego.negTokenTarg.supportedMech),
1021 gensec_get_name_by_oid(gensec_security, spnego_state->neg_oid)));
1022
1023 talloc_free(spnego_state->sub_sec_security);
1024 nt_status = gensec_subcontext_start(spnego_state,
1025 gensec_security,
1026 &spnego_state->sub_sec_security);
1027 if (!NT_STATUS_IS_OK(nt_status)) {
1028 spnego_free_data(&spnego);
1029 return nt_status;
1030 }
1031 /* select the sub context */
1032 nt_status = gensec_start_mech_by_oid(spnego_state->sub_sec_security,
1033 spnego.negTokenTarg.supportedMech);
1034 if (!NT_STATUS_IS_OK(nt_status)) {
1035 spnego_free_data(&spnego);
1036 return nt_status;
1037 }
1038
1039 nt_status = gensec_update(spnego_state->sub_sec_security,
1040 out_mem_ctx, ev,
1041 spnego.negTokenTarg.responseToken,
1042 &unwrapped_out);
1043 spnego_state->neg_oid = talloc_strdup(spnego_state, spnego.negTokenTarg.supportedMech);
1044 } else if (spnego_state->no_response_expected) {
1045 if (spnego.negTokenTarg.negResult != SPNEGO_ACCEPT_COMPLETED) {
1046 DEBUG(3,("GENSEC SPNEGO: client GENSEC accepted, but server rejected (bad password?)\n"));
1047 nt_status = NT_STATUS_INVALID_PARAMETER;
1048 } else if (spnego.negTokenTarg.responseToken.length) {
1049 DEBUG(2,("GENSEC SPNEGO: client GENSEC accepted, but server continued negotiation!\n"));
1050 nt_status = NT_STATUS_INVALID_PARAMETER;
1051 } else {
1052 nt_status = NT_STATUS_OK;
1053 }
1054 if (NT_STATUS_IS_OK(nt_status) && spnego.negTokenTarg.mechListMIC.length > 0) {
1055 nt_status = gensec_check_packet(spnego_state->sub_sec_security,
1056 spnego_state->mech_types.data,
1057 spnego_state->mech_types.length,
1058 spnego_state->mech_types.data,
1059 spnego_state->mech_types.length,
1060 &spnego.negTokenTarg.mechListMIC);
1061 if (!NT_STATUS_IS_OK(nt_status)) {
1062 DEBUG(2,("GENSEC SPNEGO: failed to verify mechListMIC: %s\n",
1063 nt_errstr(nt_status)));
1064 }
1065 }
1066 } else {
1067 bool new_spnego = false;
1068
1069 nt_status = gensec_update(spnego_state->sub_sec_security,
1070 out_mem_ctx, ev,
1071 spnego.negTokenTarg.responseToken,
1072 &unwrapped_out);
1073
1074 if (NT_STATUS_IS_OK(nt_status)
1075 && spnego.negTokenTarg.negResult != SPNEGO_ACCEPT_COMPLETED) {
1076 new_spnego = gensec_have_feature(spnego_state->sub_sec_security,
1077 GENSEC_FEATURE_NEW_SPNEGO);
1078 }
1079 if (NT_STATUS_IS_OK(nt_status) && new_spnego) {
1080 nt_status = gensec_sign_packet(spnego_state->sub_sec_security,
1081 out_mem_ctx,
1082 spnego_state->mech_types.data,
1083 spnego_state->mech_types.length,
1084 spnego_state->mech_types.data,
1085 spnego_state->mech_types.length,
1086 &mech_list_mic);
1087 if (!NT_STATUS_IS_OK(nt_status)) {
1088 DEBUG(2,("GENSEC SPNEGO: failed to sign mechListMIC: %s\n",
1089 nt_errstr(nt_status)));
1090 }
1091 }
1092 if (NT_STATUS_IS_OK(nt_status)) {
1093 spnego_state->no_response_expected = true;
1094 }
1095 }
1096
1097 spnego_free_data(&spnego);
1098
1099 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)
1100 && !NT_STATUS_IS_OK(nt_status)) {
1101 DEBUG(1, ("SPNEGO(%s) login failed: %s\n",
1102 spnego_state->sub_sec_security->ops->name,
1103 nt_errstr(nt_status)));
1104 return nt_status;
1105 }
1106
1107 if (unwrapped_out.length || mech_list_mic.length) {
1108 /* compose reply */
1109 spnego_out.type = SPNEGO_NEG_TOKEN_TARG;
1110 spnego_out.negTokenTarg.negResult = SPNEGO_NONE_RESULT;
1111 spnego_out.negTokenTarg.supportedMech = NULL;
1112 spnego_out.negTokenTarg.responseToken = unwrapped_out;
1113 spnego_out.negTokenTarg.mechListMIC = mech_list_mic;
1114
1115 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
1116 DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_TARG\n"));
1117 return NT_STATUS_INVALID_PARAMETER;
1118 }
1119
1120 spnego_state->state_position = SPNEGO_CLIENT_TARG;
1121 nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1122 } else {
1123
1124 /* all done - server has accepted, and we agree */
1125 *out = null_data_blob;
1126
1127 if (spnego.negTokenTarg.negResult != SPNEGO_ACCEPT_COMPLETED) {
1128 /* unless of course it did not accept */
1129 DEBUG(1,("gensec_update ok but not accepted\n"));
1130 nt_status = NT_STATUS_INVALID_PARAMETER;
1131 }
1132
1133 spnego_state->state_position = SPNEGO_DONE;
1134 }
1135
1136 return nt_status;
1137 }
1138 case SPNEGO_DONE:
1139 /* We should not be called after we are 'done' */
1140 return NT_STATUS_INVALID_PARAMETER;
1141 }
1142 return NT_STATUS_INVALID_PARAMETER;
1143 }
1144
1145 static NTSTATUS gensec_spnego_update_in(struct gensec_security *gensec_security,
1146 const DATA_BLOB in, DATA_BLOB *full_in)
1147 {
1148 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1149 size_t expected;
1150 NTSTATUS status;
1151 bool ok;
1152
1153 *full_in = data_blob_null;
1154
1155 if (spnego_state->in_needed == 0) {
1156 size_t size = 0;
1157
1158 /*
1159 * try to work out the size of the full
1160 * input token, it might be fragmented
1161 */
1162 status = asn1_peek_full_tag(in, ASN1_APPLICATION(0), &size);
1163 if (!NT_STATUS_IS_OK(status) &&
1164 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
1165 status = asn1_peek_full_tag(in, ASN1_CONTEXT(1), &size);
1166 }
1167
1168 if (NT_STATUS_IS_OK(status) ||
1169 NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
1170 spnego_state->in_needed = size;
1171 } else {
1172 /*
1173 * If it is not an asn1 message
1174 * just call the next layer.
1175 */
1176 spnego_state->in_needed = in.length;
1177 }
1178 }
1179
1180 if (spnego_state->in_needed > UINT16_MAX) {
1181 /*
1182 * limit the incoming message to 0xFFFF
1183 * to avoid DoS attacks.
1184 */
1185 return NT_STATUS_INVALID_BUFFER_SIZE;
1186 }
1187
1188 if ((spnego_state->in_needed > 0) && (in.length == 0)) {
1189 /*
1190 * If we reach this, we know we got at least
1191 * part of an asn1 message, getting 0 means
1192 * the remote peer wants us to spin.
1193 */
1194 return NT_STATUS_INVALID_PARAMETER;
1195 }
1196
1197 expected = spnego_state->in_needed - spnego_state->in_frag.length;
1198 if (in.length > expected) {
1199 /*
1200 * we got more than expected
1201 */
1202 return NT_STATUS_INVALID_PARAMETER;
1203 }
1204
1205 if (in.length == spnego_state->in_needed) {
1206 /*
1207 * if the in.length contains the full blob
1208 * we are done.
1209 *
1210 * Note: this implies spnego_state->in_frag.length == 0,
1211 * but we do not need to check this explicitly
1212 * because we already know that we did not get
1213 * more than expected.
1214 */
1215 *full_in = in;
1216 return NT_STATUS_OK;
1217 }
1218
1219 ok = data_blob_append(spnego_state, &spnego_state->in_frag,
1220 in.data, in.length);
1221 if (!ok) {
1222 return NT_STATUS_NO_MEMORY;
1223 }
1224
1225 if (spnego_state->in_needed > spnego_state->in_frag.length) {
1226 return NT_STATUS_MORE_PROCESSING_REQUIRED;
1227 }
1228
1229 *full_in = spnego_state->in_frag;
1230 return NT_STATUS_OK;
1231 }
1232
1233 static NTSTATUS gensec_spnego_update_out(struct gensec_security *gensec_security,
1234 TALLOC_CTX *out_mem_ctx,
1235 DATA_BLOB *_out)
1236 {
1237 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1238 DATA_BLOB out = data_blob_null;
1239
1240 *_out = data_blob_null;
1241
1242 if (spnego_state->out_frag.length == 0) {
1243 return spnego_state->out_status;
1244 }
1245
1246 /*
1247 * There is still more data to be delivered
1248 * to the remote peer.
1249 */
1250
1251 if (spnego_state->out_frag.length <= spnego_state->out_max_length) {
1252 /*
1253 * Fast path, we can deliver everything
1254 */
1255
1256 *_out = spnego_state->out_frag;
1257 talloc_steal(out_mem_ctx, _out->data);
1258 spnego_state->out_frag = data_blob_null;
1259 return spnego_state->out_status;
1260 }
1261
1262 out = spnego_state->out_frag;
1263
1264 /*
1265 * copy the remaining bytes
1266 */
1267 spnego_state->out_frag = data_blob_talloc(spnego_state,
1268 out.data + spnego_state->out_max_length,
1269 out.length - spnego_state->out_max_length);
1270 if (spnego_state->out_frag.data == NULL) {
1271 return NT_STATUS_NO_MEMORY;
1272 }
1273
1274 /*
1275 * truncate the buffer
1276 */
1277 data_blob_realloc(spnego_state, &out, spnego_state->out_max_length);
1278
1279 talloc_steal(out_mem_ctx, out.data);
1280 *_out = out;
1281 return NT_STATUS_MORE_PROCESSING_REQUIRED;
1282 }
1283
1284 static NTSTATUS gensec_spnego_update_wrapper(struct gensec_security *gensec_security,
1285 TALLOC_CTX *out_mem_ctx,
1286 struct tevent_context *ev,
1287 const DATA_BLOB in, DATA_BLOB *out)
1288 {
1289 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1290 DATA_BLOB full_in = data_blob_null;
1291 NTSTATUS status;
1292
1293 *out = data_blob_null;
1294
1295 if (spnego_state->out_frag.length > 0) {
1296 if (in.length > 0) {
1297 return NT_STATUS_INVALID_PARAMETER;
1298 }
1299
1300 return gensec_spnego_update_out(gensec_security,
1301 out_mem_ctx,
1302 out);
1303 }
1304
1305 status = gensec_spnego_update_in(gensec_security,
1306 in, &full_in);
1307 if (!NT_STATUS_IS_OK(status)) {
1308 return status;
1309 }
1310
1311 status = gensec_spnego_update(gensec_security,
1312 spnego_state, ev,
1313 full_in,
1314 &spnego_state->out_frag);
1315 data_blob_free(&spnego_state->in_frag);
1316 spnego_state->in_needed = 0;
1317 if (!NT_STATUS_IS_OK(status) &&
1318 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1319 return status;
1320 }
1321
1322 spnego_state->out_status = status;
1323
1324 return gensec_spnego_update_out(gensec_security,
1325 out_mem_ctx,
1326 out);
1327 }
1328
1329 static void gensec_spnego_want_feature(struct gensec_security *gensec_security,
1330 uint32_t feature)
1331 {
1332 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1333
1334 if (!spnego_state || !spnego_state->sub_sec_security) {
1335 gensec_security->want_features |= feature;
1336 return;
1337 }
1338
1339 gensec_want_feature(spnego_state->sub_sec_security,
1340 feature);
1341 }
1342
1343 static bool gensec_spnego_have_feature(struct gensec_security *gensec_security,
1344 uint32_t feature)
1345 {
1346 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1347 if (!spnego_state->sub_sec_security) {
1348 return false;
1349 }
1350
1351 return gensec_have_feature(spnego_state->sub_sec_security,
1352 feature);
1353 }
1354
1355 static NTTIME gensec_spnego_expire_time(struct gensec_security *gensec_security)
1356 {
1357 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1358
1359 if (!spnego_state->sub_sec_security) {
1360 return GENSEC_EXPIRE_TIME_INFINITY;
1361 }
1362
1363 return gensec_expire_time(spnego_state->sub_sec_security);
1364 }
1365
1366 static const char *gensec_spnego_oids[] = {
1367 GENSEC_OID_SPNEGO,
1368 NULL
1369 };
1370
1371 static const struct gensec_security_ops gensec_spnego_security_ops = {
1372 .name = "spnego",
1373 .sasl_name = "GSS-SPNEGO",
1374 .auth_type = DCERPC_AUTH_TYPE_SPNEGO,
1375 .oid = gensec_spnego_oids,
1376 .client_start = gensec_spnego_client_start,
1377 .server_start = gensec_spnego_server_start,
1378 .update = gensec_spnego_update_wrapper,
1379 .seal_packet = gensec_spnego_seal_packet,
1380 .sign_packet = gensec_spnego_sign_packet,
1381 .sig_size = gensec_spnego_sig_size,
1382 .max_wrapped_size = gensec_spnego_max_wrapped_size,
1383 .max_input_size = gensec_spnego_max_input_size,
1384 .check_packet = gensec_spnego_check_packet,
1385 .unseal_packet = gensec_spnego_unseal_packet,
1386 .packet_full_request = gensec_spnego_packet_full_request,
1387 .wrap = gensec_spnego_wrap,
1388 .unwrap = gensec_spnego_unwrap,
1389 .wrap_packets = gensec_spnego_wrap_packets,
1390 .unwrap_packets = gensec_spnego_unwrap_packets,
1391 .session_key = gensec_spnego_session_key,
1392 .session_info = gensec_spnego_session_info,
1393 .want_feature = gensec_spnego_want_feature,
1394 .have_feature = gensec_spnego_have_feature,
1395 .expire_time = gensec_spnego_expire_time,
1396 .enabled = true,
1397 .priority = GENSEC_SPNEGO
1398 };
1399
1400 _PUBLIC_ NTSTATUS gensec_spnego_init(void)
1401 {
1402 NTSTATUS ret;
1403 ret = gensec_register(&gensec_spnego_security_ops);
1404 if (!NT_STATUS_IS_OK(ret)) {
1405 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1406 gensec_spnego_security_ops.name));
1407 return ret;
1408 }
1409
1410 return ret;
1411 }
Samba GIT mirror