?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
auth/spnego: add an early return for OK or MORE PROCESSING in gensec_spnego_parse_neg...
[Samba.git] / auth / gensec / spnego.c
blob1a4c28be11157f0fa7f3cddd510f17b6ff912fff
1 /*
2 Unix SMB/CIFS implementation.
3
4 RFC2478 Compliant SPNEGO implementation
5
6 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
8 Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2008
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include <tevent.h>
27 #include "lib/util/tevent_ntstatus.h"
28 #include "../libcli/auth/spnego.h"
29 #include "librpc/gen_ndr/ndr_dcerpc.h"
30 #include "auth/credentials/credentials.h"
31 #include "auth/gensec/gensec.h"
32 #include "auth/gensec/gensec_internal.h"
33 #include "param/param.h"
34 #include "lib/util/asn1.h"
35 #include "lib/util/base64.h"
36
37 #undef strcasecmp
38
39 _PUBLIC_ NTSTATUS gensec_spnego_init(TALLOC_CTX *ctx);
40
41 enum spnego_state_position {
42 SPNEGO_SERVER_START,
43 SPNEGO_CLIENT_START,
44 SPNEGO_SERVER_TARG,
45 SPNEGO_CLIENT_TARG,
46 SPNEGO_FALLBACK,
47 SPNEGO_DONE
48 };
49
50 struct spnego_state {
51 enum spnego_message_type expected_packet;
52 enum spnego_state_position state_position;
53 struct gensec_security *sub_sec_security;
54 bool sub_sec_ready;
55
56 const char *neg_oid;
57
58 DATA_BLOB mech_types;
59 size_t num_targs;
60 bool downgraded;
61 bool mic_requested;
62 bool needs_mic_sign;
63 bool needs_mic_check;
64 bool may_skip_mic_check;
65 bool done_mic_check;
66
67 bool simulate_w2k;
68
69 /*
70 * The following is used to implement
71 * the update token fragmentation
72 */
73 size_t in_needed;
74 DATA_BLOB in_frag;
75 size_t out_max_length;
76 DATA_BLOB out_frag;
77 NTSTATUS out_status;
78 };
79
80 static void gensec_spnego_update_sub_abort(struct spnego_state *spnego_state)
81 {
82 spnego_state->sub_sec_ready = false;
83 TALLOC_FREE(spnego_state->sub_sec_security);
84 }
85
86 static NTSTATUS gensec_spnego_client_start(struct gensec_security *gensec_security)
87 {
88 struct spnego_state *spnego_state;
89
90 spnego_state = talloc_zero(gensec_security, struct spnego_state);
91 if (!spnego_state) {
92 return NT_STATUS_NO_MEMORY;
93 }
94
95 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
96 spnego_state->state_position = SPNEGO_CLIENT_START;
97 spnego_state->sub_sec_security = NULL;
98 spnego_state->sub_sec_ready = false;
99 spnego_state->mech_types = data_blob_null;
100 spnego_state->out_max_length = gensec_max_update_size(gensec_security);
101 spnego_state->out_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
102
103 spnego_state->simulate_w2k = gensec_setting_bool(gensec_security->settings,
104 "spnego", "simulate_w2k", false);
105
106 gensec_security->private_data = spnego_state;
107 return NT_STATUS_OK;
108 }
109
110 static NTSTATUS gensec_spnego_server_start(struct gensec_security *gensec_security)
111 {
112 struct spnego_state *spnego_state;
113
114 spnego_state = talloc_zero(gensec_security, struct spnego_state);
115 if (!spnego_state) {
116 return NT_STATUS_NO_MEMORY;
117 }
118
119 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
120 spnego_state->state_position = SPNEGO_SERVER_START;
121 spnego_state->sub_sec_security = NULL;
122 spnego_state->sub_sec_ready = false;
123 spnego_state->mech_types = data_blob_null;
124 spnego_state->out_max_length = gensec_max_update_size(gensec_security);
125 spnego_state->out_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
126
127 spnego_state->simulate_w2k = gensec_setting_bool(gensec_security->settings,
128 "spnego", "simulate_w2k", false);
129
130 gensec_security->private_data = spnego_state;
131 return NT_STATUS_OK;
132 }
133
134 /** Fallback to another GENSEC mechanism, based on magic strings
135 *
136 * This is the 'fallback' case, where we don't get SPNEGO, and have to
137 * try all the other options (and hope they all have a magic string
138 * they check)
139 */
140
141 static NTSTATUS gensec_spnego_server_try_fallback(struct gensec_security *gensec_security,
142 struct spnego_state *spnego_state,
143 TALLOC_CTX *mem_ctx,
144 const DATA_BLOB in)
145 {
146 int i,j;
147 const struct gensec_security_ops **all_ops;
148
149 all_ops = gensec_security_mechs(gensec_security, mem_ctx);
150
151 for (i=0; all_ops && all_ops[i]; i++) {
152 bool is_spnego;
153 NTSTATUS nt_status;
154
155 if (gensec_security != NULL &&
156 !gensec_security_ops_enabled(all_ops[i], gensec_security))
157 {
158 continue;
159 }
160
161 if (!all_ops[i]->oid) {
162 continue;
163 }
164
165 is_spnego = false;
166 for (j=0; all_ops[i]->oid[j]; j++) {
167 if (strcasecmp(GENSEC_OID_SPNEGO,all_ops[i]->oid[j]) == 0) {
168 is_spnego = true;
169 }
170 }
171 if (is_spnego) {
172 continue;
173 }
174
175 if (!all_ops[i]->magic) {
176 continue;
177 }
178
179 nt_status = all_ops[i]->magic(gensec_security, &in);
180 if (!NT_STATUS_IS_OK(nt_status)) {
181 continue;
182 }
183
184 spnego_state->state_position = SPNEGO_FALLBACK;
185
186 nt_status = gensec_subcontext_start(spnego_state,
187 gensec_security,
188 &spnego_state->sub_sec_security);
189
190 if (!NT_STATUS_IS_OK(nt_status)) {
191 return nt_status;
192 }
193 /* select the sub context */
194 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
195 all_ops[i]);
196 if (!NT_STATUS_IS_OK(nt_status)) {
197 return nt_status;
198 }
199
200 return NT_STATUS_OK;
201 }
202 DEBUG(1, ("Failed to parse SPNEGO request\n"));
203 return NT_STATUS_INVALID_PARAMETER;
204 }
205
206 /*
207 Parse the netTokenInit, either from the client, to the server, or
208 from the server to the client.
209 */
210
211 static NTSTATUS gensec_spnego_parse_negTokenInit(struct gensec_security *gensec_security,
212 struct spnego_state *spnego_state,
213 TALLOC_CTX *out_mem_ctx,
214 struct tevent_context *ev,
215 struct spnego_data *spnego_in,
216 DATA_BLOB *unwrapped_out)
217 {
218 int i;
219 NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
220 const char * const *mechType = NULL;
221 DATA_BLOB unwrapped_in = data_blob_null;
222 bool ok;
223 const struct gensec_security_ops_wrapper *all_sec = NULL;
224 uint32_t j;
225
226 if (spnego_state->state_position != SPNEGO_SERVER_START) {
227 return NT_STATUS_INTERNAL_ERROR;
228 }
229
230 if (spnego_in->type != SPNEGO_NEG_TOKEN_INIT) {
231 return NT_STATUS_INTERNAL_ERROR;
232 }
233
234 mechType = spnego_in->negTokenInit.mechTypes;
235 if (mechType == NULL) {
236 return NT_STATUS_INVALID_PARAMETER;
237 }
238 unwrapped_in = spnego_in->negTokenInit.mechToken;
239
240 all_sec = gensec_security_by_oid_list(gensec_security,
241 out_mem_ctx,
242 mechType,
243 GENSEC_OID_SPNEGO);
244 if (all_sec == NULL) {
245 DBG_WARNING("gensec_security_by_oid_list() failed\n");
246 return NT_STATUS_INVALID_PARAMETER;
247 }
248
249 ok = spnego_write_mech_types(spnego_state,
250 mechType,
251 &spnego_state->mech_types);
252 if (!ok) {
253 DEBUG(1, ("SPNEGO: Failed to write mechTypes\n"));
254 return NT_STATUS_NO_MEMORY;
255 }
256
257 for (j=0; mechType && mechType[j]; j++) {
258 const struct gensec_security_ops_wrapper *cur_sec = NULL;
259
260 for (i=0; all_sec && all_sec[i].op; i++) {
261 if (strcmp(mechType[j], all_sec[i].oid) == 0) {
262 cur_sec = &all_sec[i];
263 break;
264 }
265 }
266
267 if (cur_sec == NULL) {
268 continue;
269 }
270
271 nt_status = gensec_subcontext_start(spnego_state,
272 gensec_security,
273 &spnego_state->sub_sec_security);
274 if (!NT_STATUS_IS_OK(nt_status)) {
275 return nt_status;
276 }
277 /* select the sub context */
278 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
279 cur_sec->op);
280 if (!NT_STATUS_IS_OK(nt_status)) {
281 /*
282 * Pretend we never started it
283 */
284 gensec_spnego_update_sub_abort(spnego_state);
285 continue;
286 }
287
288 if (j > 0) {
289 /* no optimistic token */
290 spnego_state->neg_oid = cur_sec->oid;
291 *unwrapped_out = data_blob_null;
292 nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
293 /*
294 * Indicate the downgrade and request a
295 * mic.
296 */
297 spnego_state->downgraded = true;
298 spnego_state->mic_requested = true;
299 return nt_status;
300 }
301
302 nt_status = gensec_update_ev(spnego_state->sub_sec_security,
303 out_mem_ctx,
304 ev,
305 unwrapped_in,
306 unwrapped_out);
307 if (NT_STATUS_IS_OK(nt_status)) {
308 spnego_state->sub_sec_ready = true;
309 }
310 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) ||
311 NT_STATUS_EQUAL(nt_status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
312
313 DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed to parse contents: %s\n",
314 spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
315
316 /*
317 * Pretend we never started it
318 */
319 gensec_spnego_update_sub_abort(spnego_state);
320 continue;
321 }
322
323 if (GENSEC_UPDATE_IS_NTERROR(nt_status)) {
324 DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed: %s\n",
325 spnego_state->sub_sec_security->ops->name,
326 nt_errstr(nt_status)));
327 return nt_status;
328 }
329
330 spnego_state->neg_oid = cur_sec->oid;
331 return nt_status; /* OK or MORE PROCESSING */
332 }
333
334 if (!spnego_state->sub_sec_security) {
335 DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
336 return NT_STATUS_INVALID_PARAMETER;
337 }
338
339 if (spnego_state->sub_sec_security) {
340 /* it is likely that a NULL input token will
341 * not be liked by most server mechs, but this
342 * does the right thing in the CIFS client.
343 * just push us along the merry-go-round
344 * again, and hope for better luck next
345 * time */
346
347 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
348 *unwrapped_out = data_blob_null;
349 nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
350 }
351
352 if (GENSEC_UPDATE_IS_NTERROR(nt_status)) {
353 DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed: %s\n",
354 spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
355
356 /* We started the mech correctly, and the
357 * input from the other side was valid.
358 * Return the error (say bad password, invalid
359 * ticket) */
360 gensec_spnego_update_sub_abort(spnego_state);
361 return nt_status;
362 }
363
364 return nt_status; /* OK or MORE PROCESSING */
365 }
366
367 DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
368 /* we could re-negotiate here, but it would only work
369 * if the client or server lied about what it could
370 * support the first time. Lets keep this code to
371 * reality */
372
373 return nt_status;
374 }
375
376 /** create a negTokenInit
377 *
378 * This is the same packet, no matter if the client or server sends it first, but it is always the first packet
379 */
380 static NTSTATUS gensec_spnego_create_negTokenInit(struct gensec_security *gensec_security,
381 struct spnego_state *spnego_state,
382 TALLOC_CTX *out_mem_ctx,
383 struct tevent_context *ev,
384 DATA_BLOB *out)
385 {
386 int i;
387 NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
388 const char **mechTypes = NULL;
389 DATA_BLOB unwrapped_out = data_blob_null;
390 const struct gensec_security_ops_wrapper *all_sec;
391
392 mechTypes = gensec_security_oids(gensec_security,
393 out_mem_ctx, GENSEC_OID_SPNEGO);
394
395 all_sec = gensec_security_by_oid_list(gensec_security,
396 out_mem_ctx,
397 mechTypes,
398 GENSEC_OID_SPNEGO);
399 for (i=0; all_sec && all_sec[i].op; i++) {
400 struct spnego_data spnego_out;
401 const char **send_mech_types;
402 bool ok;
403
404 nt_status = gensec_subcontext_start(spnego_state,
405 gensec_security,
406 &spnego_state->sub_sec_security);
407 if (!NT_STATUS_IS_OK(nt_status)) {
408 return nt_status;
409 }
410 /* select the sub context */
411 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
412 all_sec[i].op);
413 if (!NT_STATUS_IS_OK(nt_status)) {
414 gensec_spnego_update_sub_abort(spnego_state);
415 continue;
416 }
417
418 /* In the client, try and produce the first (optimistic) packet */
419 if (spnego_state->state_position == SPNEGO_CLIENT_START) {
420 nt_status = gensec_update_ev(spnego_state->sub_sec_security,
421 out_mem_ctx,
422 ev,
423 data_blob_null,
424 &unwrapped_out);
425 if (NT_STATUS_IS_OK(nt_status)) {
426 spnego_state->sub_sec_ready = true;
427 }
428
429 if (GENSEC_UPDATE_IS_NTERROR(nt_status)) {
430 const char *next = NULL;
431 const char *principal = NULL;
432 int dbg_level = DBGLVL_WARNING;
433
434 if (all_sec[i+1].op != NULL) {
435 next = all_sec[i+1].op->name;
436 dbg_level = DBGLVL_NOTICE;
437 }
438
439 if (gensec_security->target.principal != NULL) {
440 principal = gensec_security->target.principal;
441 } else if (gensec_security->target.service != NULL &&
442 gensec_security->target.hostname != NULL)
443 {
444 principal = talloc_asprintf(spnego_state->sub_sec_security,
445 "%s/%s",
446 gensec_security->target.service,
447 gensec_security->target.hostname);
448 } else {
449 principal = gensec_security->target.hostname;
450 }
451
452 DEBUG(dbg_level, ("SPNEGO(%s) creating NEG_TOKEN_INIT for %s failed (next[%s]): %s\n",
453 spnego_state->sub_sec_security->ops->name,
454 principal,
455 next, nt_errstr(nt_status)));
456
457 /*
458 * Pretend we never started it
459 */
460 gensec_spnego_update_sub_abort(spnego_state);
461 continue;
462 }
463 }
464
465 spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
466
467 send_mech_types = gensec_security_oids_from_ops_wrapped(out_mem_ctx,
468 &all_sec[i]);
469
470 ok = spnego_write_mech_types(spnego_state,
471 send_mech_types,
472 &spnego_state->mech_types);
473 if (!ok) {
474 DEBUG(1, ("SPNEGO: Failed to write mechTypes\n"));
475 return NT_STATUS_NO_MEMORY;
476 }
477
478 /* List the remaining mechs as options */
479 spnego_out.negTokenInit.mechTypes = send_mech_types;
480 spnego_out.negTokenInit.reqFlags = data_blob_null;
481 spnego_out.negTokenInit.reqFlagsPadding = 0;
482
483 if (spnego_state->state_position == SPNEGO_SERVER_START) {
484 spnego_out.negTokenInit.mechListMIC
485 = data_blob_string_const(ADS_IGNORE_PRINCIPAL);
486 } else {
487 spnego_out.negTokenInit.mechListMIC = data_blob_null;
488 }
489
490 spnego_out.negTokenInit.mechToken = unwrapped_out;
491
492 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
493 DEBUG(1, ("Failed to write NEG_TOKEN_INIT\n"));
494 return NT_STATUS_INVALID_PARAMETER;
495 }
496
497 /* set next state */
498 spnego_state->neg_oid = all_sec[i].oid;
499
500 if (spnego_state->state_position == SPNEGO_SERVER_START) {
501 spnego_state->state_position = SPNEGO_SERVER_START;
502 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
503 } else {
504 spnego_state->state_position = SPNEGO_CLIENT_TARG;
505 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
506 }
507
508 return NT_STATUS_MORE_PROCESSING_REQUIRED;
509 }
510 gensec_spnego_update_sub_abort(spnego_state);
511
512 DEBUG(10, ("Failed to setup SPNEGO negTokenInit request: %s\n", nt_errstr(nt_status)));
513 return nt_status;
514 }
515
516 static NTSTATUS gensec_spnego_client_negTokenInit(struct gensec_security *gensec_security,
517 struct spnego_state *spnego_state,
518 struct tevent_context *ev,
519 struct spnego_data *spnego_in,
520 TALLOC_CTX *out_mem_ctx,
521 DATA_BLOB *out)
522 {
523 TALLOC_CTX *frame = talloc_stackframe();
524 DATA_BLOB sub_out = data_blob_null;
525 const char *tp = NULL;
526 const char * const *mech_types = NULL;
527 size_t all_idx = 0;
528 const struct gensec_security_ops_wrapper *all_sec = NULL;
529 struct spnego_data spnego_out;
530 const char *my_mechs[] = {NULL, NULL};
531 NTSTATUS status;
532 bool ok;
533
534 *out = data_blob_null;
535
536 /* The server offers a list of mechanisms */
537
538 tp = spnego_in->negTokenInit.targetPrincipal;
539 if (tp != NULL && strcmp(tp, ADS_IGNORE_PRINCIPAL) != 0) {
540 DBG_INFO("Server claims it's principal name is %s\n", tp);
541 if (lpcfg_client_use_spnego_principal(gensec_security->settings->lp_ctx)) {
542 gensec_set_target_principal(gensec_security, tp);
543 }
544 }
545
546 mech_types = spnego_in->negTokenInit.mechTypes;
547 if (mech_types == NULL) {
548 TALLOC_FREE(frame);
549 return NT_STATUS_INVALID_PARAMETER;
550 }
551
552 all_sec = gensec_security_by_oid_list(gensec_security,
553 frame, mech_types,
554 GENSEC_OID_SPNEGO);
555 if (all_sec == NULL) {
556 DBG_WARNING("gensec_security_by_oid_list() failed\n");
557 TALLOC_FREE(frame);
558 return NT_STATUS_INVALID_PARAMETER;
559 }
560
561 for (; all_sec[all_idx].op; all_idx++) {
562 const struct gensec_security_ops_wrapper *cur_sec =
563 &all_sec[all_idx];
564 const char *next = NULL;
565 const char *principal = NULL;
566 int dbg_level = DBGLVL_WARNING;
567 bool allow_fallback = false;
568
569 status = gensec_subcontext_start(spnego_state,
570 gensec_security,
571 &spnego_state->sub_sec_security);
572 if (!NT_STATUS_IS_OK(status)) {
573 TALLOC_FREE(frame);
574 return status;
575 }
576
577 /* select the sub context */
578 status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
579 cur_sec->op);
580 if (!NT_STATUS_IS_OK(status)) {
581 /*
582 * Pretend we never started it.
583 */
584 gensec_spnego_update_sub_abort(spnego_state);
585 continue;
586 }
587
588 spnego_state->neg_oid = cur_sec->oid;
589
590 /*
591 * As client we don't use an optimistic token from the server.
592 */
593 status = gensec_update_ev(spnego_state->sub_sec_security,
594 frame, ev, data_blob_null, &sub_out);
595 if (NT_STATUS_IS_OK(status)) {
596 spnego_state->sub_sec_ready = true;
597 }
598
599 if (!GENSEC_UPDATE_IS_NTERROR(status)) {
600 /* OK or MORE_PROCESSING_REQUIRED */
601 goto reply;
602 }
603
604 /*
605 * it is likely that a NULL input token will
606 * not be liked by most server mechs, but if
607 * we are in the client, we want the first
608 * update packet to be able to abort the use
609 * of this mech
610 */
611 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER) ||
612 NT_STATUS_EQUAL(status, NT_STATUS_NO_LOGON_SERVERS) ||
613 NT_STATUS_EQUAL(status, NT_STATUS_TIME_DIFFERENCE_AT_DC) ||
614 NT_STATUS_EQUAL(status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO))
615 {
616 allow_fallback = true;
617 }
618
619 if (allow_fallback && cur_sec[1].op != NULL) {
620 next = cur_sec[1].op->name;
621 dbg_level = DBGLVL_NOTICE;
622 }
623
624 if (gensec_security->target.principal != NULL) {
625 principal = gensec_security->target.principal;
626 } else if (gensec_security->target.service != NULL &&
627 gensec_security->target.hostname != NULL)
628 {
629 principal = talloc_asprintf(spnego_state->sub_sec_security,
630 "%s/%s",
631 gensec_security->target.service,
632 gensec_security->target.hostname);
633 } else {
634 principal = gensec_security->target.hostname;
635 }
636
637 DBG_PREFIX(dbg_level, (
638 "%s: creating NEG_TOKEN_INIT "
639 "for %s failed (next[%s]): %s\n",
640 spnego_state->sub_sec_security->ops->name,
641 principal, next, nt_errstr(status)));
642
643 if (allow_fallback && next != NULL) {
644 /*
645 * Pretend we never started it.
646 */
647 gensec_spnego_update_sub_abort(spnego_state);
648 continue;
649 }
650
651 /*
652 * Hard error.
653 */
654 TALLOC_FREE(frame);
655 return status;
656 }
657
658 DBG_WARNING("Could not find a suitable mechtype in NEG_TOKEN_INIT\n");
659 TALLOC_FREE(frame);
660 return NT_STATUS_INVALID_PARAMETER;
661
662 reply:
663 my_mechs[0] = spnego_state->neg_oid;
664 /* compose reply */
665 spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
666 spnego_out.negTokenInit.mechTypes = my_mechs;
667 spnego_out.negTokenInit.reqFlags = data_blob_null;
668 spnego_out.negTokenInit.reqFlagsPadding = 0;
669 spnego_out.negTokenInit.mechListMIC = data_blob_null;
670 spnego_out.negTokenInit.mechToken = sub_out;
671
672 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
673 DBG_ERR("Failed to write SPNEGO reply to NEG_TOKEN_INIT\n");
674 TALLOC_FREE(frame);
675 return NT_STATUS_INVALID_PARAMETER;
676 }
677
678 ok = spnego_write_mech_types(spnego_state,
679 my_mechs,
680 &spnego_state->mech_types);
681 if (!ok) {
682 DBG_ERR("failed to write mechTypes\n");
683 TALLOC_FREE(frame);
684 return NT_STATUS_NO_MEMORY;
685 }
686
687 /* set next state */
688 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
689 spnego_state->state_position = SPNEGO_CLIENT_TARG;
690
691 TALLOC_FREE(frame);
692 return NT_STATUS_MORE_PROCESSING_REQUIRED;
693 }
694
695 static NTSTATUS gensec_spnego_client_negTokenTarg(struct gensec_security *gensec_security,
696 struct spnego_state *spnego_state,
697 struct tevent_context *ev,
698 struct spnego_data *spnego_in,
699 TALLOC_CTX *out_mem_ctx,
700 DATA_BLOB *out)
701 {
702 struct spnego_negTokenTarg *ta = &spnego_in->negTokenTarg;
703 DATA_BLOB sub_in = ta->responseToken;
704 DATA_BLOB mech_list_mic = data_blob_null;
705 DATA_BLOB sub_out = data_blob_null;
706 struct spnego_data spnego_out;
707 NTSTATUS status;
708
709 *out = data_blob_null;
710
711 spnego_state->num_targs++;
712
713 if (ta->negResult == SPNEGO_REJECT) {
714 return NT_STATUS_LOGON_FAILURE;
715 }
716
717 if (ta->negResult == SPNEGO_REQUEST_MIC) {
718 spnego_state->mic_requested = true;
719 }
720
721 if (ta->mechListMIC.length > 0) {
722 DATA_BLOB *m = &ta->mechListMIC;
723 const DATA_BLOB *r = &ta->responseToken;
724
725 /*
726 * Windows 2000 has a bug, it repeats the
727 * responseToken in the mechListMIC field.
728 */
729 if (m->length == r->length) {
730 int cmp;
731
732 cmp = memcmp(m->data, r->data, m->length);
733 if (cmp == 0) {
734 data_blob_free(m);
735 }
736 }
737 }
738
739 /* Server didn't like our choice of mech, and chose something else */
740 if (((ta->negResult == SPNEGO_ACCEPT_INCOMPLETE) ||
741 (ta->negResult == SPNEGO_REQUEST_MIC)) &&
742 ta->supportedMech != NULL &&
743 strcmp(ta->supportedMech, spnego_state->neg_oid) != 0)
744 {
745 const char *client_mech = NULL;
746 const char *client_oid = NULL;
747 const char *server_mech = NULL;
748 const char *server_oid = NULL;
749
750 client_mech = gensec_get_name_by_oid(gensec_security,
751 spnego_state->neg_oid);
752 client_oid = spnego_state->neg_oid;
753 server_mech = gensec_get_name_by_oid(gensec_security,
754 ta->supportedMech);
755 server_oid = ta->supportedMech;
756
757 DBG_NOTICE("client preferred mech (%s[%s]) not accepted, "
758 "server wants: %s[%s]\n",
759 client_mech, client_oid, server_mech, server_oid);
760
761 spnego_state->downgraded = true;
762 gensec_spnego_update_sub_abort(spnego_state);
763
764 status = gensec_subcontext_start(spnego_state,
765 gensec_security,
766 &spnego_state->sub_sec_security);
767 if (!NT_STATUS_IS_OK(status)) {
768 return status;
769 }
770
771 /* select the sub context */
772 status = gensec_start_mech_by_oid(spnego_state->sub_sec_security,
773 ta->supportedMech);
774 if (!NT_STATUS_IS_OK(status)) {
775 return status;
776 }
777
778 spnego_state->neg_oid = talloc_strdup(spnego_state,
779 ta->supportedMech);
780 if (spnego_state->neg_oid == NULL) {
781 return NT_STATUS_NO_MEMORY;
782 }
783 }
784
785 if (ta->mechListMIC.length > 0) {
786 if (spnego_state->sub_sec_ready) {
787 spnego_state->needs_mic_check = true;
788 }
789 }
790
791 if (spnego_state->needs_mic_check) {
792 if (ta->responseToken.length != 0) {
793 DBG_WARNING("non empty response token not expected\n");
794 return NT_STATUS_INVALID_PARAMETER;
795 }
796
797 if (ta->mechListMIC.length == 0
798 && spnego_state->may_skip_mic_check) {
799 /*
800 * In this case we don't require
801 * a mechListMIC from the server.
802 *
803 * This works around bugs in the Azure
804 * and Apple spnego implementations.
805 *
806 * See
807 * https://bugzilla.samba.org/show_bug.cgi?id=11994
808 */
809 spnego_state->needs_mic_check = false;
810 status = NT_STATUS_OK;
811 goto client_response;
812 }
813
814 status = gensec_check_packet(spnego_state->sub_sec_security,
815 spnego_state->mech_types.data,
816 spnego_state->mech_types.length,
817 spnego_state->mech_types.data,
818 spnego_state->mech_types.length,
819 &ta->mechListMIC);
820 if (!NT_STATUS_IS_OK(status)) {
821 DBG_WARNING("failed to verify mechListMIC: %s\n",
822 nt_errstr(status));
823 return status;
824 }
825 spnego_state->needs_mic_check = false;
826 spnego_state->done_mic_check = true;
827 goto client_response;
828 }
829
830 if (!spnego_state->sub_sec_ready) {
831 status = gensec_update_ev(spnego_state->sub_sec_security,
832 out_mem_ctx, ev,
833 sub_in,
834 &sub_out);
835 if (NT_STATUS_IS_OK(status)) {
836 spnego_state->sub_sec_ready = true;
837 }
838 if (!NT_STATUS_IS_OK(status)) {
839 goto client_response;
840 }
841 } else {
842 status = NT_STATUS_OK;
843 }
844
845 if (!spnego_state->done_mic_check) {
846 bool have_sign = true;
847 bool new_spnego = false;
848
849 have_sign = gensec_have_feature(spnego_state->sub_sec_security,
850 GENSEC_FEATURE_SIGN);
851 if (spnego_state->simulate_w2k) {
852 have_sign = false;
853 }
854 new_spnego = gensec_have_feature(spnego_state->sub_sec_security,
855 GENSEC_FEATURE_NEW_SPNEGO);
856
857 switch (ta->negResult) {
858 case SPNEGO_ACCEPT_COMPLETED:
859 case SPNEGO_NONE_RESULT:
860 if (spnego_state->num_targs == 1) {
861 /*
862 * the first exchange doesn't require
863 * verification
864 */
865 new_spnego = false;
866 }
867
868 break;
869
870 case SPNEGO_ACCEPT_INCOMPLETE:
871 if (ta->mechListMIC.length > 0) {
872 new_spnego = true;
873 break;
874 }
875
876 if (spnego_state->downgraded) {
877 /*
878 * A downgrade should be protected if
879 * supported
880 */
881 break;
882 }
883
884 /*
885 * The caller may just asked for
886 * GENSEC_FEATURE_SESSION_KEY, this
887 * is only reflected in the want_features.
888 *
889 * As it will imply
890 * gensec_have_features(GENSEC_FEATURE_SIGN)
891 * to return true.
892 */
893 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
894 break;
895 }
896 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
897 break;
898 }
899 /*
900 * Here we're sure our preferred mech was
901 * selected by the server and our caller doesn't
902 * need GENSEC_FEATURE_SIGN nor
903 * GENSEC_FEATURE_SEAL support.
904 *
905 * In this case we don't require
906 * a mechListMIC from the server.
907 *
908 * This works around bugs in the Azure
909 * and Apple spnego implementations.
910 *
911 * See
912 * https://bugzilla.samba.org/show_bug.cgi?id=11994
913 */
914 spnego_state->may_skip_mic_check = true;
915 break;
916
917 case SPNEGO_REQUEST_MIC:
918 if (ta->mechListMIC.length > 0) {
919 new_spnego = true;
920 }
921 break;
922 default:
923 break;
924 }
925
926 if (spnego_state->mic_requested) {
927 if (have_sign) {
928 new_spnego = true;
929 }
930 }
931
932 if (have_sign && new_spnego) {
933 spnego_state->needs_mic_check = true;
934 spnego_state->needs_mic_sign = true;
935 }
936 }
937
938 if (ta->mechListMIC.length > 0) {
939 status = gensec_check_packet(spnego_state->sub_sec_security,
940 spnego_state->mech_types.data,
941 spnego_state->mech_types.length,
942 spnego_state->mech_types.data,
943 spnego_state->mech_types.length,
944 &ta->mechListMIC);
945 if (!NT_STATUS_IS_OK(status)) {
946 DBG_WARNING("failed to verify mechListMIC: %s\n",
947 nt_errstr(status));
948 return status;
949 }
950 spnego_state->needs_mic_check = false;
951 spnego_state->done_mic_check = true;
952 }
953
954 if (spnego_state->needs_mic_sign) {
955 status = gensec_sign_packet(spnego_state->sub_sec_security,
956 out_mem_ctx,
957 spnego_state->mech_types.data,
958 spnego_state->mech_types.length,
959 spnego_state->mech_types.data,
960 spnego_state->mech_types.length,
961 &mech_list_mic);
962 if (!NT_STATUS_IS_OK(status)) {
963 DBG_WARNING("failed to sign mechListMIC: %s\n",
964 nt_errstr(status));
965 return status;
966 }
967 spnego_state->needs_mic_sign = false;
968 }
969
970 if (spnego_state->needs_mic_check) {
971 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
972 }
973
974 client_response:
975 if (GENSEC_UPDATE_IS_NTERROR(status)) {
976 DBG_WARNING("SPNEGO(%s) login failed: %s\n",
977 spnego_state->sub_sec_security->ops->name,
978 nt_errstr(status));
979 return status;
980 }
981
982 if (sub_out.length || mech_list_mic.length) {
983 /* compose reply */
984 spnego_out.type = SPNEGO_NEG_TOKEN_TARG;
985 spnego_out.negTokenTarg.negResult = SPNEGO_NONE_RESULT;
986 spnego_out.negTokenTarg.supportedMech = NULL;
987 spnego_out.negTokenTarg.responseToken = sub_out;
988 spnego_out.negTokenTarg.mechListMIC = mech_list_mic;
989
990 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
991 DBG_WARNING("Failed to write NEG_TOKEN_TARG\n");
992 return NT_STATUS_INVALID_PARAMETER;
993 }
994
995 spnego_state->num_targs++;
996 spnego_state->state_position = SPNEGO_CLIENT_TARG;
997 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
998 } else {
999
1000 /* all done - server has accepted, and we agree */
1001 *out = data_blob_null;
1002
1003 if (ta->negResult != SPNEGO_ACCEPT_COMPLETED) {
1004 /* unless of course it did not accept */
1005 DBG_WARNING("gensec_update ok but not accepted\n");
1006 status = NT_STATUS_INVALID_PARAMETER;
1007 }
1008
1009 spnego_state->state_position = SPNEGO_DONE;
1010 }
1011
1012 return status;
1013 }
1014
1015 /** create a server negTokenTarg
1016 *
1017 * This is the case, where the client is the first one who sends data
1018 */
1019
1020 static NTSTATUS gensec_spnego_server_response(struct spnego_state *spnego_state,
1021 TALLOC_CTX *out_mem_ctx,
1022 NTSTATUS nt_status,
1023 const DATA_BLOB unwrapped_out,
1024 DATA_BLOB mech_list_mic,
1025 DATA_BLOB *out)
1026 {
1027 struct spnego_data spnego_out;
1028
1029 /* compose reply */
1030 spnego_out.type = SPNEGO_NEG_TOKEN_TARG;
1031 spnego_out.negTokenTarg.responseToken = unwrapped_out;
1032 spnego_out.negTokenTarg.mechListMIC = mech_list_mic;
1033 spnego_out.negTokenTarg.supportedMech = NULL;
1034
1035 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1036 spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
1037 if (spnego_state->mic_requested) {
1038 spnego_out.negTokenTarg.negResult = SPNEGO_REQUEST_MIC;
1039 spnego_state->mic_requested = false;
1040 } else {
1041 spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
1042 }
1043 spnego_state->state_position = SPNEGO_SERVER_TARG;
1044 } else if (NT_STATUS_IS_OK(nt_status)) {
1045 if (unwrapped_out.data) {
1046 spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
1047 }
1048 spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
1049 spnego_state->state_position = SPNEGO_DONE;
1050 } else {
1051 spnego_out.negTokenTarg.negResult = SPNEGO_REJECT;
1052 spnego_out.negTokenTarg.mechListMIC = data_blob_null;
1053 DEBUG(2, ("SPNEGO login failed: %s\n", nt_errstr(nt_status)));
1054 spnego_state->state_position = SPNEGO_DONE;
1055 }
1056
1057 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
1058 DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_TARG\n"));
1059 return NT_STATUS_INVALID_PARAMETER;
1060 }
1061
1062 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
1063 spnego_state->num_targs++;
1064
1065 return nt_status;
1066 }
1067
1068 static NTSTATUS gensec_spnego_server_negTokenInit(struct gensec_security *gensec_security,
1069 struct spnego_state *spnego_state,
1070 struct tevent_context *ev,
1071 struct spnego_data *spnego_in,
1072 TALLOC_CTX *out_mem_ctx,
1073 DATA_BLOB *out)
1074 {
1075 DATA_BLOB sub_out = data_blob_null;
1076 DATA_BLOB mech_list_mic = data_blob_null;
1077 NTSTATUS status;
1078
1079 status = gensec_spnego_parse_negTokenInit(gensec_security,
1080 spnego_state,
1081 out_mem_ctx,
1082 ev,
1083 spnego_in,
1084 &sub_out);
1085
1086 if (spnego_state->simulate_w2k) {
1087 /*
1088 * Windows 2000 returns the unwrapped token
1089 * also in the mech_list_mic field.
1090 *
1091 * In order to verify our client code,
1092 * we need a way to have a server with this
1093 * broken behaviour
1094 */
1095 mech_list_mic = sub_out;
1096 }
1097
1098 return gensec_spnego_server_response(spnego_state,
1099 out_mem_ctx,
1100 status,
1101 sub_out,
1102 mech_list_mic,
1103 out);
1104 }
1105
1106 static NTSTATUS gensec_spnego_server_negTokenTarg(struct gensec_security *gensec_security,
1107 struct spnego_state *spnego_state,
1108 struct tevent_context *ev,
1109 struct spnego_data *spnego_in,
1110 TALLOC_CTX *out_mem_ctx,
1111 DATA_BLOB *out)
1112 {
1113 const struct spnego_negTokenTarg *ta = &spnego_in->negTokenTarg;
1114 DATA_BLOB sub_in = ta->responseToken;
1115 DATA_BLOB mech_list_mic = data_blob_null;
1116 DATA_BLOB sub_out = data_blob_null;
1117 NTSTATUS status;
1118 bool have_sign = true;
1119 bool new_spnego = false;
1120
1121 spnego_state->num_targs++;
1122
1123 if (spnego_state->sub_sec_security == NULL) {
1124 DBG_ERR("SPNEGO: Did not setup a mech in NEG_TOKEN_INIT\n");
1125 return NT_STATUS_INVALID_PARAMETER;
1126 }
1127
1128 if (spnego_state->needs_mic_check) {
1129 if (ta->responseToken.length != 0) {
1130 DBG_WARNING("non empty response token not expected\n");
1131 return NT_STATUS_INVALID_PARAMETER;
1132 }
1133
1134 status = gensec_check_packet(spnego_state->sub_sec_security,
1135 spnego_state->mech_types.data,
1136 spnego_state->mech_types.length,
1137 spnego_state->mech_types.data,
1138 spnego_state->mech_types.length,
1139 &ta->mechListMIC);
1140 if (!NT_STATUS_IS_OK(status)) {
1141 DBG_WARNING("failed to verify mechListMIC: %s\n",
1142 nt_errstr(status));
1143 goto server_response;
1144 }
1145
1146 spnego_state->needs_mic_check = false;
1147 spnego_state->done_mic_check = true;
1148 goto server_response;
1149 }
1150
1151 if (!spnego_state->sub_sec_ready) {
1152 status = gensec_update_ev(spnego_state->sub_sec_security,
1153 out_mem_ctx, ev,
1154 sub_in, &sub_out);
1155 if (NT_STATUS_IS_OK(status)) {
1156 spnego_state->sub_sec_ready = true;
1157 }
1158 if (!NT_STATUS_IS_OK(status)) {
1159 goto server_response;
1160 }
1161 } else {
1162 status = NT_STATUS_OK;
1163 }
1164
1165 have_sign = gensec_have_feature(spnego_state->sub_sec_security,
1166 GENSEC_FEATURE_SIGN);
1167 if (spnego_state->simulate_w2k) {
1168 have_sign = false;
1169 }
1170 new_spnego = gensec_have_feature(spnego_state->sub_sec_security,
1171 GENSEC_FEATURE_NEW_SPNEGO);
1172 if (ta->mechListMIC.length > 0) {
1173 new_spnego = true;
1174 }
1175
1176 if (have_sign && new_spnego) {
1177 spnego_state->needs_mic_check = true;
1178 spnego_state->needs_mic_sign = true;
1179 }
1180
1181 if (have_sign && ta->mechListMIC.length > 0) {
1182 status = gensec_check_packet(spnego_state->sub_sec_security,
1183 spnego_state->mech_types.data,
1184 spnego_state->mech_types.length,
1185 spnego_state->mech_types.data,
1186 spnego_state->mech_types.length,
1187 &ta->mechListMIC);
1188 if (!NT_STATUS_IS_OK(status)) {
1189 DBG_WARNING("failed to verify mechListMIC: %s\n",
1190 nt_errstr(status));
1191 goto server_response;
1192 }
1193
1194 spnego_state->needs_mic_check = false;
1195 spnego_state->done_mic_check = true;
1196 }
1197
1198 if (spnego_state->needs_mic_sign) {
1199 status = gensec_sign_packet(spnego_state->sub_sec_security,
1200 out_mem_ctx,
1201 spnego_state->mech_types.data,
1202 spnego_state->mech_types.length,
1203 spnego_state->mech_types.data,
1204 spnego_state->mech_types.length,
1205 &mech_list_mic);
1206 if (!NT_STATUS_IS_OK(status)) {
1207 DBG_WARNING("failed to sign mechListMIC: %s\n",
1208 nt_errstr(status));
1209 return status;
1210 }
1211 spnego_state->needs_mic_sign = false;
1212 }
1213
1214 if (spnego_state->needs_mic_check) {
1215 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1216 }
1217
1218 server_response:
1219 return gensec_spnego_server_response(spnego_state,
1220 out_mem_ctx,
1221 status,
1222 sub_out,
1223 mech_list_mic,
1224 out);
1225 }
1226
1227 struct gensec_spnego_update_state {
1228 struct gensec_security *gensec;
1229 struct spnego_state *spnego;
1230 DATA_BLOB full_in;
1231 struct spnego_data _spnego_in;
1232 struct spnego_data *spnego_in;
1233 NTSTATUS status;
1234 DATA_BLOB out;
1235 };
1236
1237 static void gensec_spnego_update_cleanup(struct tevent_req *req,
1238 enum tevent_req_state req_state)
1239 {
1240 struct gensec_spnego_update_state *state =
1241 tevent_req_data(req,
1242 struct gensec_spnego_update_state);
1243
1244 switch (req_state) {
1245 case TEVENT_REQ_USER_ERROR:
1246 case TEVENT_REQ_TIMED_OUT:
1247 case TEVENT_REQ_NO_MEMORY:
1248 /*
1249 * A fatal error, further updates are not allowed.
1250 */
1251 state->spnego->state_position = SPNEGO_DONE;
1252 break;
1253 default:
1254 break;
1255 }
1256 }
1257
1258 static NTSTATUS gensec_spnego_update_in(struct gensec_security *gensec_security,
1259 const DATA_BLOB in, TALLOC_CTX *mem_ctx,
1260 DATA_BLOB *full_in);
1261 static NTSTATUS gensec_spnego_update_out(struct gensec_security *gensec_security,
1262 TALLOC_CTX *out_mem_ctx,
1263 DATA_BLOB *_out);
1264
1265 static struct tevent_req *gensec_spnego_update_send(TALLOC_CTX *mem_ctx,
1266 struct tevent_context *ev,
1267 struct gensec_security *gensec_security,
1268 const DATA_BLOB in)
1269 {
1270 struct spnego_state *spnego_state =
1271 talloc_get_type_abort(gensec_security->private_data,
1272 struct spnego_state);
1273 struct tevent_req *req = NULL;
1274 struct gensec_spnego_update_state *state = NULL;
1275 NTSTATUS status;
1276 ssize_t len;
1277
1278 req = tevent_req_create(mem_ctx, &state,
1279 struct gensec_spnego_update_state);
1280 if (req == NULL) {
1281 return NULL;
1282 }
1283 state->gensec = gensec_security;
1284 state->spnego = spnego_state;
1285 tevent_req_set_cleanup_fn(req, gensec_spnego_update_cleanup);
1286
1287 if (spnego_state->out_frag.length > 0) {
1288 if (in.length > 0) {
1289 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1290 return tevent_req_post(req, ev);
1291 }
1292
1293 status = gensec_spnego_update_out(gensec_security,
1294 state, &state->out);
1295 if (GENSEC_UPDATE_IS_NTERROR(status)) {
1296 tevent_req_nterror(req, status);
1297 return tevent_req_post(req, ev);
1298 }
1299
1300 state->status = status;
1301 tevent_req_done(req);
1302 return tevent_req_post(req, ev);
1303 }
1304
1305 status = gensec_spnego_update_in(gensec_security, in,
1306 state, &state->full_in);
1307 state->status = status;
1308 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1309 tevent_req_done(req);
1310 return tevent_req_post(req, ev);
1311 }
1312 if (tevent_req_nterror(req, status)) {
1313 return tevent_req_post(req, ev);
1314 }
1315
1316 /* Check if we got a valid SPNEGO blob... */
1317
1318 switch (spnego_state->state_position) {
1319 case SPNEGO_FALLBACK:
1320 break;
1321
1322 case SPNEGO_CLIENT_TARG:
1323 case SPNEGO_SERVER_TARG:
1324 if (state->full_in.length == 0) {
1325 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1326 return tevent_req_post(req, ev);
1327 }
1328
1329 /* fall through */
1330 case SPNEGO_CLIENT_START:
1331 case SPNEGO_SERVER_START:
1332
1333 if (state->full_in.length == 0) {
1334 /* create_negTokenInit later */
1335 break;
1336 }
1337
1338 len = spnego_read_data(state,
1339 state->full_in,
1340 &state->_spnego_in);
1341 if (len == -1) {
1342 if (spnego_state->state_position != SPNEGO_SERVER_START) {
1343 DEBUG(1, ("Invalid SPNEGO request:\n"));
1344 dump_data(1, state->full_in.data,
1345 state->full_in.length);
1346 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1347 return tevent_req_post(req, ev);
1348 }
1349
1350 /*
1351 * This is the 'fallback' case, where we don't get
1352 * SPNEGO, and have to try all the other options (and
1353 * hope they all have a magic string they check)
1354 */
1355 status = gensec_spnego_server_try_fallback(gensec_security,
1356 spnego_state,
1357 state,
1358 state->full_in);
1359 if (tevent_req_nterror(req, status)) {
1360 return tevent_req_post(req, ev);
1361 }
1362
1363 /*
1364 * We'll continue with SPNEGO_FALLBACK below...
1365 */
1366 break;
1367 }
1368 state->spnego_in = &state->_spnego_in;
1369
1370 /* OK, so it's real SPNEGO, check the packet's the one we expect */
1371 if (state->spnego_in->type != spnego_state->expected_packet) {
1372 DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n",
1373 state->spnego_in->type,
1374 spnego_state->expected_packet));
1375 dump_data(1, state->full_in.data,
1376 state->full_in.length);
1377 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1378 return tevent_req_post(req, ev);
1379 }
1380
1381 break;
1382
1383 default:
1384 smb_panic(__location__);
1385 return NULL;
1386 }
1387
1388 /* and switch into the state machine */
1389
1390 switch (spnego_state->state_position) {
1391 case SPNEGO_FALLBACK:
1392 status = gensec_update_ev(spnego_state->sub_sec_security,
1393 state, ev,
1394 state->full_in,
1395 &spnego_state->out_frag);
1396 break;
1397
1398 case SPNEGO_CLIENT_START:
1399 if (state->spnego_in == NULL) {
1400 /* client to produce negTokenInit */
1401 status = gensec_spnego_create_negTokenInit(gensec_security,
1402 spnego_state, state, ev,
1403 &spnego_state->out_frag);
1404 break;
1405 }
1406
1407 status = gensec_spnego_client_negTokenInit(gensec_security,
1408 spnego_state, ev,
1409 state->spnego_in, state,
1410 &spnego_state->out_frag);
1411 break;
1412
1413 case SPNEGO_CLIENT_TARG:
1414 status = gensec_spnego_client_negTokenTarg(gensec_security,
1415 spnego_state, ev,
1416 state->spnego_in, state,
1417 &spnego_state->out_frag);
1418 break;
1419
1420 case SPNEGO_SERVER_START:
1421 if (state->spnego_in == NULL) {
1422 /* server to produce negTokenInit */
1423 status = gensec_spnego_create_negTokenInit(gensec_security,
1424 spnego_state, state, ev,
1425 &spnego_state->out_frag);
1426 break;
1427 }
1428
1429 status = gensec_spnego_server_negTokenInit(gensec_security,
1430 spnego_state, ev,
1431 state->spnego_in, state,
1432 &spnego_state->out_frag);
1433 break;
1434
1435 case SPNEGO_SERVER_TARG:
1436 status = gensec_spnego_server_negTokenTarg(gensec_security,
1437 spnego_state, ev,
1438 state->spnego_in, state,
1439 &spnego_state->out_frag);
1440 break;
1441
1442 default:
1443 smb_panic(__location__);
1444 return NULL;
1445 }
1446
1447 if (GENSEC_UPDATE_IS_NTERROR(status)) {
1448 tevent_req_nterror(req, status);
1449 return tevent_req_post(req, ev);
1450 }
1451
1452 if (NT_STATUS_IS_OK(status)) {
1453 bool reset_full = true;
1454
1455 reset_full = !spnego_state->done_mic_check;
1456
1457 status = gensec_may_reset_crypto(spnego_state->sub_sec_security,
1458 reset_full);
1459 if (tevent_req_nterror(req, status)) {
1460 return tevent_req_post(req, ev);
1461 }
1462 }
1463
1464 spnego_state->out_status = status;
1465
1466 status = gensec_spnego_update_out(gensec_security,
1467 state, &state->out);
1468 if (GENSEC_UPDATE_IS_NTERROR(status)) {
1469 tevent_req_nterror(req, status);
1470 return tevent_req_post(req, ev);
1471 }
1472
1473 state->status = status;
1474 tevent_req_done(req);
1475 return tevent_req_post(req, ev);
1476 }
1477
1478 static NTSTATUS gensec_spnego_update_in(struct gensec_security *gensec_security,
1479 const DATA_BLOB in, TALLOC_CTX *mem_ctx,
1480 DATA_BLOB *full_in)
1481 {
1482 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1483 size_t expected;
1484 bool ok;
1485
1486 *full_in = data_blob_null;
1487
1488 switch (spnego_state->state_position) {
1489 case SPNEGO_FALLBACK:
1490 *full_in = in;
1491 spnego_state->in_needed = 0;
1492 return NT_STATUS_OK;
1493
1494 case SPNEGO_CLIENT_START:
1495 case SPNEGO_CLIENT_TARG:
1496 case SPNEGO_SERVER_START:
1497 case SPNEGO_SERVER_TARG:
1498 break;
1499
1500 case SPNEGO_DONE:
1501 default:
1502 return NT_STATUS_INVALID_PARAMETER;
1503 }
1504
1505 if (spnego_state->in_needed == 0) {
1506 size_t size = 0;
1507 int ret;
1508
1509 /*
1510 * try to work out the size of the full
1511 * input token, it might be fragmented
1512 */
1513 ret = asn1_peek_full_tag(in, ASN1_APPLICATION(0), &size);
1514 if ((ret != 0) && (ret != EAGAIN)) {
1515 ret = asn1_peek_full_tag(in, ASN1_CONTEXT(1), &size);
1516 }
1517
1518 if ((ret == 0) || (ret == EAGAIN)) {
1519 spnego_state->in_needed = size;
1520 } else {
1521 /*
1522 * If it is not an asn1 message
1523 * just call the next layer.
1524 */
1525 spnego_state->in_needed = in.length;
1526 }
1527 }
1528
1529 if (spnego_state->in_needed > UINT16_MAX) {
1530 /*
1531 * limit the incoming message to 0xFFFF
1532 * to avoid DoS attacks.
1533 */
1534 return NT_STATUS_INVALID_BUFFER_SIZE;
1535 }
1536
1537 if ((spnego_state->in_needed > 0) && (in.length == 0)) {
1538 /*
1539 * If we reach this, we know we got at least
1540 * part of an asn1 message, getting 0 means
1541 * the remote peer wants us to spin.
1542 */
1543 return NT_STATUS_INVALID_PARAMETER;
1544 }
1545
1546 expected = spnego_state->in_needed - spnego_state->in_frag.length;
1547 if (in.length > expected) {
1548 /*
1549 * we got more than expected
1550 */
1551 return NT_STATUS_INVALID_PARAMETER;
1552 }
1553
1554 if (in.length == spnego_state->in_needed) {
1555 /*
1556 * if the in.length contains the full blob
1557 * we are done.
1558 *
1559 * Note: this implies spnego_state->in_frag.length == 0,
1560 * but we do not need to check this explicitly
1561 * because we already know that we did not get
1562 * more than expected.
1563 */
1564 *full_in = in;
1565 spnego_state->in_needed = 0;
1566 return NT_STATUS_OK;
1567 }
1568
1569 ok = data_blob_append(spnego_state, &spnego_state->in_frag,
1570 in.data, in.length);
1571 if (!ok) {
1572 return NT_STATUS_NO_MEMORY;
1573 }
1574
1575 if (spnego_state->in_needed > spnego_state->in_frag.length) {
1576 return NT_STATUS_MORE_PROCESSING_REQUIRED;
1577 }
1578
1579 *full_in = spnego_state->in_frag;
1580 talloc_steal(mem_ctx, full_in->data);
1581 spnego_state->in_frag = data_blob_null;
1582 spnego_state->in_needed = 0;
1583 return NT_STATUS_OK;
1584 }
1585
1586 static NTSTATUS gensec_spnego_update_out(struct gensec_security *gensec_security,
1587 TALLOC_CTX *out_mem_ctx,
1588 DATA_BLOB *_out)
1589 {
1590 struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1591 DATA_BLOB out = data_blob_null;
1592 bool ok;
1593
1594 *_out = data_blob_null;
1595
1596 if (spnego_state->out_frag.length <= spnego_state->out_max_length) {
1597 /*
1598 * Fast path, we can deliver everything
1599 */
1600
1601 *_out = spnego_state->out_frag;
1602 if (spnego_state->out_frag.length > 0) {
1603 talloc_steal(out_mem_ctx, _out->data);
1604 spnego_state->out_frag = data_blob_null;
1605 }
1606
1607 if (!NT_STATUS_IS_OK(spnego_state->out_status)) {
1608 return spnego_state->out_status;
1609 }
1610
1611 /*
1612 * We're completely done, further updates are not allowed.
1613 */
1614 spnego_state->state_position = SPNEGO_DONE;
1615 return gensec_child_ready(gensec_security,
1616 spnego_state->sub_sec_security);
1617 }
1618
1619 out = spnego_state->out_frag;
1620
1621 /*
1622 * copy the remaining bytes
1623 */
1624 spnego_state->out_frag = data_blob_talloc(spnego_state,
1625 out.data + spnego_state->out_max_length,
1626 out.length - spnego_state->out_max_length);
1627 if (spnego_state->out_frag.data == NULL) {
1628 return NT_STATUS_NO_MEMORY;
1629 }
1630
1631 /*
1632 * truncate the buffer
1633 */
1634 ok = data_blob_realloc(spnego_state, &out,
1635 spnego_state->out_max_length);
1636 if (!ok) {
1637 return NT_STATUS_NO_MEMORY;
1638 }
1639
1640 talloc_steal(out_mem_ctx, out.data);
1641 *_out = out;
1642 return NT_STATUS_MORE_PROCESSING_REQUIRED;
1643 }
1644
1645 static NTSTATUS gensec_spnego_update_recv(struct tevent_req *req,
1646 TALLOC_CTX *out_mem_ctx,
1647 DATA_BLOB *out)
1648 {
1649 struct gensec_spnego_update_state *state =
1650 tevent_req_data(req,
1651 struct gensec_spnego_update_state);
1652 NTSTATUS status;
1653
1654 *out = data_blob_null;
1655
1656 if (tevent_req_is_nterror(req, &status)) {
1657 tevent_req_received(req);
1658 return status;
1659 }
1660
1661 *out = state->out;
1662 talloc_steal(out_mem_ctx, state->out.data);
1663 status = state->status;
1664 tevent_req_received(req);
1665 return status;
1666 }
1667
1668 static const char *gensec_spnego_oids[] = {
1669 GENSEC_OID_SPNEGO,
1670 NULL
1671 };
1672
1673 static const struct gensec_security_ops gensec_spnego_security_ops = {
1674 .name = "spnego",
1675 .sasl_name = "GSS-SPNEGO",
1676 .auth_type = DCERPC_AUTH_TYPE_SPNEGO,
1677 .oid = gensec_spnego_oids,
1678 .client_start = gensec_spnego_client_start,
1679 .server_start = gensec_spnego_server_start,
1680 .update_send = gensec_spnego_update_send,
1681 .update_recv = gensec_spnego_update_recv,
1682 .seal_packet = gensec_child_seal_packet,
1683 .sign_packet = gensec_child_sign_packet,
1684 .sig_size = gensec_child_sig_size,
1685 .max_wrapped_size = gensec_child_max_wrapped_size,
1686 .max_input_size = gensec_child_max_input_size,
1687 .check_packet = gensec_child_check_packet,
1688 .unseal_packet = gensec_child_unseal_packet,
1689 .wrap = gensec_child_wrap,
1690 .unwrap = gensec_child_unwrap,
1691 .session_key = gensec_child_session_key,
1692 .session_info = gensec_child_session_info,
1693 .want_feature = gensec_child_want_feature,
1694 .have_feature = gensec_child_have_feature,
1695 .expire_time = gensec_child_expire_time,
1696 .final_auth_type = gensec_child_final_auth_type,
1697 .enabled = true,
1698 .priority = GENSEC_SPNEGO
1699 };
1700
1701 _PUBLIC_ NTSTATUS gensec_spnego_init(TALLOC_CTX *ctx)
1702 {
1703 NTSTATUS ret;
1704 ret = gensec_register(ctx, &gensec_spnego_security_ops);
1705 if (!NT_STATUS_IS_OK(ret)) {
1706 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1707 gensec_spnego_security_ops.name));
1708 return ret;
1709 }
1710
1711 return ret;
1712 }
Samba GIT mirror