?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix bug 7694 - Crash bug with invalid SPNEGO token.
[Samba/bb.git] / source3 / libads / sasl.c
blob421faed15921c88ecd2d591c85fdbbfe23eb41a9
1 /*
2 Unix SMB/CIFS implementation.
3 ads sasl code
4 Copyright (C) Andrew Tridgell 2001
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "../libcli/auth/spnego.h"
22
23 #ifdef HAVE_LDAP
24
25 static ADS_STATUS ads_sasl_ntlmssp_wrap(ADS_STRUCT *ads, uint8 *buf, uint32 len)
26 {
27 struct ntlmssp_state *ntlmssp_state =
28 (struct ntlmssp_state *)ads->ldap.wrap_private_data;
29 ADS_STATUS status;
30 NTSTATUS nt_status;
31 DATA_BLOB sig;
32 uint8 *dptr = ads->ldap.out.buf + (4 + NTLMSSP_SIG_SIZE);
33
34 /* copy the data to the right location */
35 memcpy(dptr, buf, len);
36
37 /* create the signature and may encrypt the data */
38 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
39 nt_status = ntlmssp_seal_packet(ntlmssp_state,
40 dptr, len,
41 dptr, len,
42 &sig);
43 } else {
44 nt_status = ntlmssp_sign_packet(ntlmssp_state,
45 dptr, len,
46 dptr, len,
47 &sig);
48 }
49 status = ADS_ERROR_NT(nt_status);
50 if (!ADS_ERR_OK(status)) return status;
51
52 /* copy the signature to the right location */
53 memcpy(ads->ldap.out.buf + 4,
54 sig.data, NTLMSSP_SIG_SIZE);
55
56 data_blob_free(&sig);
57
58 /* set how many bytes must be written to the underlying socket */
59 ads->ldap.out.left = 4 + NTLMSSP_SIG_SIZE + len;
60
61 return ADS_SUCCESS;
62 }
63
64 static ADS_STATUS ads_sasl_ntlmssp_unwrap(ADS_STRUCT *ads)
65 {
66 struct ntlmssp_state *ntlmssp_state =
67 (struct ntlmssp_state *)ads->ldap.wrap_private_data;
68 ADS_STATUS status;
69 NTSTATUS nt_status;
70 DATA_BLOB sig;
71 uint8 *dptr = ads->ldap.in.buf + (4 + NTLMSSP_SIG_SIZE);
72 uint32 dlen = ads->ldap.in.ofs - (4 + NTLMSSP_SIG_SIZE);
73
74 /* wrap the signature into a DATA_BLOB */
75 sig = data_blob_const(ads->ldap.in.buf + 4, NTLMSSP_SIG_SIZE);
76
77 /* verify the signature and maybe decrypt the data */
78 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
79 nt_status = ntlmssp_unseal_packet(ntlmssp_state,
80 dptr, dlen,
81 dptr, dlen,
82 &sig);
83 } else {
84 nt_status = ntlmssp_check_packet(ntlmssp_state,
85 dptr, dlen,
86 dptr, dlen,
87 &sig);
88 }
89 status = ADS_ERROR_NT(nt_status);
90 if (!ADS_ERR_OK(status)) return status;
91
92 /* set the amount of bytes for the upper layer and set the ofs to the data */
93 ads->ldap.in.left = dlen;
94 ads->ldap.in.ofs = 4 + NTLMSSP_SIG_SIZE;
95
96 return ADS_SUCCESS;
97 }
98
99 static void ads_sasl_ntlmssp_disconnect(ADS_STRUCT *ads)
100 {
101 struct ntlmssp_state *ntlmssp_state =
102 (struct ntlmssp_state *)ads->ldap.wrap_private_data;
103
104 ntlmssp_end(&ntlmssp_state);
105
106 ads->ldap.wrap_ops = NULL;
107 ads->ldap.wrap_private_data = NULL;
108 }
109
110 static const struct ads_saslwrap_ops ads_sasl_ntlmssp_ops = {
111 .name = "ntlmssp",
112 .wrap = ads_sasl_ntlmssp_wrap,
113 .unwrap = ads_sasl_ntlmssp_unwrap,
114 .disconnect = ads_sasl_ntlmssp_disconnect
115 };
116
117 /*
118 perform a LDAP/SASL/SPNEGO/NTLMSSP bind (just how many layers can
119 we fit on one socket??)
120 */
121 static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
122 {
123 DATA_BLOB msg1 = data_blob_null;
124 DATA_BLOB blob = data_blob_null;
125 DATA_BLOB blob_in = data_blob_null;
126 DATA_BLOB blob_out = data_blob_null;
127 struct berval cred, *scred = NULL;
128 int rc;
129 NTSTATUS nt_status;
130 ADS_STATUS status;
131 int turn = 1;
132 uint32 features = 0;
133
134 struct ntlmssp_state *ntlmssp_state;
135
136 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
137 return ADS_ERROR_NT(nt_status);
138 }
139 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SIGN;
140
141 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, ads->auth.user_name))) {
142 return ADS_ERROR_NT(nt_status);
143 }
144 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, ads->auth.realm))) {
145 return ADS_ERROR_NT(nt_status);
146 }
147 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, ads->auth.password))) {
148 return ADS_ERROR_NT(nt_status);
149 }
150
151 switch (ads->ldap.wrap_type) {
152 case ADS_SASLWRAP_TYPE_SEAL:
153 features = NTLMSSP_FEATURE_SIGN | NTLMSSP_FEATURE_SEAL;
154 break;
155 case ADS_SASLWRAP_TYPE_SIGN:
156 if (ads->auth.flags & ADS_AUTH_SASL_FORCE) {
157 features = NTLMSSP_FEATURE_SIGN;
158 } else {
159 /*
160 * windows servers are broken with sign only,
161 * so we need to use seal here too
162 */
163 features = NTLMSSP_FEATURE_SIGN | NTLMSSP_FEATURE_SEAL;
164 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SEAL;
165 }
166 break;
167 case ADS_SASLWRAP_TYPE_PLAIN:
168 break;
169 }
170
171 ntlmssp_want_feature(ntlmssp_state, features);
172
173 blob_in = data_blob_null;
174
175 do {
176 nt_status = ntlmssp_update(ntlmssp_state,
177 blob_in, &blob_out);
178 data_blob_free(&blob_in);
179 if ((NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)
180 || NT_STATUS_IS_OK(nt_status))
181 && blob_out.length) {
182 if (turn == 1) {
183 /* and wrap it in a SPNEGO wrapper */
184 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
185 } else {
186 /* wrap it in SPNEGO */
187 msg1 = spnego_gen_auth(blob_out);
188 }
189
190 data_blob_free(&blob_out);
191
192 cred.bv_val = (char *)msg1.data;
193 cred.bv_len = msg1.length;
194 scred = NULL;
195 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL, &scred);
196 data_blob_free(&msg1);
197 if ((rc != LDAP_SASL_BIND_IN_PROGRESS) && (rc != 0)) {
198 if (scred) {
199 ber_bvfree(scred);
200 }
201
202 ntlmssp_end(&ntlmssp_state);
203 return ADS_ERROR(rc);
204 }
205 if (scred) {
206 blob = data_blob(scred->bv_val, scred->bv_len);
207 ber_bvfree(scred);
208 } else {
209 blob = data_blob_null;
210 }
211
212 } else {
213
214 ntlmssp_end(&ntlmssp_state);
215 data_blob_free(&blob_out);
216 return ADS_ERROR_NT(nt_status);
217 }
218
219 if ((turn == 1) &&
220 (rc == LDAP_SASL_BIND_IN_PROGRESS)) {
221 DATA_BLOB tmp_blob = data_blob_null;
222 /* the server might give us back two challenges */
223 if (!spnego_parse_challenge(blob, &blob_in,
224 &tmp_blob)) {
225
226 ntlmssp_end(&ntlmssp_state);
227 data_blob_free(&blob);
228 DEBUG(3,("Failed to parse challenges\n"));
229 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
230 }
231 data_blob_free(&tmp_blob);
232 } else if (rc == LDAP_SASL_BIND_IN_PROGRESS) {
233 if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
234 &blob_in)) {
235
236 ntlmssp_end(&ntlmssp_state);
237 data_blob_free(&blob);
238 DEBUG(3,("Failed to parse auth response\n"));
239 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
240 }
241 }
242 data_blob_free(&blob);
243 data_blob_free(&blob_out);
244 turn++;
245 } while (rc == LDAP_SASL_BIND_IN_PROGRESS && !NT_STATUS_IS_OK(nt_status));
246
247 /* we have a reference conter on ntlmssp_state, if we are signing
248 then the state will be kept by the signing engine */
249
250 if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
251 ads->ldap.out.max_unwrapped = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED - NTLMSSP_SIG_SIZE;
252 ads->ldap.out.sig_size = NTLMSSP_SIG_SIZE;
253 ads->ldap.in.min_wrapped = ads->ldap.out.sig_size;
254 ads->ldap.in.max_wrapped = ADS_SASL_WRAPPING_IN_MAX_WRAPPED;
255 status = ads_setup_sasl_wrapping(ads, &ads_sasl_ntlmssp_ops, ntlmssp_state);
256 if (!ADS_ERR_OK(status)) {
257 DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
258 ads_errstr(status)));
259 ntlmssp_end(&ntlmssp_state);
260 return status;
261 }
262 } else {
263 ntlmssp_end(&ntlmssp_state);
264 }
265
266 return ADS_ERROR(rc);
267 }
268
269 #ifdef HAVE_GSSAPI
270 static ADS_STATUS ads_sasl_gssapi_wrap(ADS_STRUCT *ads, uint8 *buf, uint32 len)
271 {
272 gss_ctx_id_t context_handle = (gss_ctx_id_t)ads->ldap.wrap_private_data;
273 ADS_STATUS status;
274 int gss_rc;
275 uint32 minor_status;
276 gss_buffer_desc unwrapped, wrapped;
277 int conf_req_flag, conf_state;
278
279 unwrapped.value = buf;
280 unwrapped.length = len;
281
282 /* for now request sign and seal */
283 conf_req_flag = (ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL);
284
285 gss_rc = gss_wrap(&minor_status, context_handle,
286 conf_req_flag, GSS_C_QOP_DEFAULT,
287 &unwrapped, &conf_state,
288 &wrapped);
289 status = ADS_ERROR_GSS(gss_rc, minor_status);
290 if (!ADS_ERR_OK(status)) return status;
291
292 if (conf_req_flag && conf_state == 0) {
293 return ADS_ERROR_NT(NT_STATUS_ACCESS_DENIED);
294 }
295
296 if ((ads->ldap.out.size - 4) < wrapped.length) {
297 return ADS_ERROR_NT(NT_STATUS_INTERNAL_ERROR);
298 }
299
300 /* copy the wrapped blob to the right location */
301 memcpy(ads->ldap.out.buf + 4, wrapped.value, wrapped.length);
302
303 /* set how many bytes must be written to the underlying socket */
304 ads->ldap.out.left = 4 + wrapped.length;
305
306 gss_release_buffer(&minor_status, &wrapped);
307
308 return ADS_SUCCESS;
309 }
310
311 static ADS_STATUS ads_sasl_gssapi_unwrap(ADS_STRUCT *ads)
312 {
313 gss_ctx_id_t context_handle = (gss_ctx_id_t)ads->ldap.wrap_private_data;
314 ADS_STATUS status;
315 int gss_rc;
316 uint32 minor_status;
317 gss_buffer_desc unwrapped, wrapped;
318 int conf_state;
319
320 wrapped.value = ads->ldap.in.buf + 4;
321 wrapped.length = ads->ldap.in.ofs - 4;
322
323 gss_rc = gss_unwrap(&minor_status, context_handle,
324 &wrapped, &unwrapped,
325 &conf_state, GSS_C_QOP_DEFAULT);
326 status = ADS_ERROR_GSS(gss_rc, minor_status);
327 if (!ADS_ERR_OK(status)) return status;
328
329 if (ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL && conf_state == 0) {
330 return ADS_ERROR_NT(NT_STATUS_ACCESS_DENIED);
331 }
332
333 if (wrapped.length < unwrapped.length) {
334 return ADS_ERROR_NT(NT_STATUS_INTERNAL_ERROR);
335 }
336
337 /* copy the wrapped blob to the right location */
338 memcpy(ads->ldap.in.buf + 4, unwrapped.value, unwrapped.length);
339
340 /* set how many bytes must be written to the underlying socket */
341 ads->ldap.in.left = unwrapped.length;
342 ads->ldap.in.ofs = 4;
343
344 gss_release_buffer(&minor_status, &unwrapped);
345
346 return ADS_SUCCESS;
347 }
348
349 static void ads_sasl_gssapi_disconnect(ADS_STRUCT *ads)
350 {
351 gss_ctx_id_t context_handle = (gss_ctx_id_t)ads->ldap.wrap_private_data;
352 uint32 minor_status;
353
354 gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);
355
356 ads->ldap.wrap_ops = NULL;
357 ads->ldap.wrap_private_data = NULL;
358 }
359
360 static const struct ads_saslwrap_ops ads_sasl_gssapi_ops = {
361 .name = "gssapi",
362 .wrap = ads_sasl_gssapi_wrap,
363 .unwrap = ads_sasl_gssapi_unwrap,
364 .disconnect = ads_sasl_gssapi_disconnect
365 };
366
367 /*
368 perform a LDAP/SASL/SPNEGO/GSSKRB5 bind
369 */
370 static ADS_STATUS ads_sasl_spnego_gsskrb5_bind(ADS_STRUCT *ads, const gss_name_t serv_name)
371 {
372 ADS_STATUS status;
373 bool ok;
374 uint32 minor_status;
375 int gss_rc, rc;
376 gss_OID_desc krb5_mech_type =
377 {9, CONST_DISCARD(char *, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02") };
378 gss_OID mech_type = &krb5_mech_type;
379 gss_OID actual_mech_type = GSS_C_NULL_OID;
380 const char *spnego_mechs[] = {OID_KERBEROS5_OLD, OID_KERBEROS5, OID_NTLMSSP, NULL};
381 gss_ctx_id_t context_handle = GSS_C_NO_CONTEXT;
382 gss_buffer_desc input_token, output_token;
383 uint32 req_flags, ret_flags;
384 uint32 req_tmp, ret_tmp;
385 DATA_BLOB unwrapped;
386 DATA_BLOB wrapped;
387 struct berval cred, *scred = NULL;
388
389 input_token.value = NULL;
390 input_token.length = 0;
391
392 req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG;
393 switch (ads->ldap.wrap_type) {
394 case ADS_SASLWRAP_TYPE_SEAL:
395 req_flags |= GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG;
396 break;
397 case ADS_SASLWRAP_TYPE_SIGN:
398 req_flags |= GSS_C_INTEG_FLAG;
399 break;
400 case ADS_SASLWRAP_TYPE_PLAIN:
401 break;
402 }
403
404 /* Note: here we explicit ask for the krb5 mech_type */
405 gss_rc = gss_init_sec_context(&minor_status,
406 GSS_C_NO_CREDENTIAL,
407 &context_handle,
408 serv_name,
409 mech_type,
410 req_flags,
411 0,
412 NULL,
413 &input_token,
414 &actual_mech_type,
415 &output_token,
416 &ret_flags,
417 NULL);
418 if (gss_rc && gss_rc != GSS_S_CONTINUE_NEEDED) {
419 status = ADS_ERROR_GSS(gss_rc, minor_status);
420 goto failed;
421 }
422
423 /*
424 * As some gssapi krb5 mech implementations
425 * automaticly add GSS_C_INTEG_FLAG and GSS_C_CONF_FLAG
426 * to req_flags internaly, it's not possible to
427 * use plain or signing only connection via
428 * the gssapi interface.
429 *
430 * Because of this we need to check it the ret_flags
431 * has more flags as req_flags and correct the value
432 * of ads->ldap.wrap_type.
433 *
434 * I ads->auth.flags has ADS_AUTH_SASL_FORCE
435 * we need to give an error.
436 */
437 req_tmp = req_flags & (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG);
438 ret_tmp = ret_flags & (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG);
439
440 if (req_tmp == ret_tmp) {
441 /* everythings fine... */
442
443 } else if (req_flags & GSS_C_CONF_FLAG) {
444 /*
445 * here we wanted sealing but didn't got it
446 * from the gssapi library
447 */
448 status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
449 goto failed;
450
451 } else if ((req_flags & GSS_C_INTEG_FLAG) &&
452 !(ret_flags & GSS_C_INTEG_FLAG)) {
453 /*
454 * here we wanted siging but didn't got it
455 * from the gssapi library
456 */
457 status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
458 goto failed;
459
460 } else if (ret_flags & GSS_C_CONF_FLAG) {
461 /*
462 * here we didn't want sealing
463 * but the gssapi library forces it
464 * so correct the needed wrap_type if
465 * the caller didn't forced siging only
466 */
467 if (ads->auth.flags & ADS_AUTH_SASL_FORCE) {
468 status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
469 goto failed;
470 }
471
472 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SEAL;
473 req_flags = ret_flags;
474
475 } else if (ret_flags & GSS_C_INTEG_FLAG) {
476 /*
477 * here we didn't want signing
478 * but the gssapi library forces it
479 * so correct the needed wrap_type if
480 * the caller didn't forced plain
481 */
482 if (ads->auth.flags & ADS_AUTH_SASL_FORCE) {
483 status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
484 goto failed;
485 }
486
487 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SIGN;
488 req_flags = ret_flags;
489 } else {
490 /*
491 * This could (should?) not happen
492 */
493 status = ADS_ERROR_NT(NT_STATUS_INTERNAL_ERROR);
494 goto failed;
495
496 }
497
498 /* and wrap that in a shiny SPNEGO wrapper */
499 unwrapped = data_blob_const(output_token.value, output_token.length);
500 wrapped = gen_negTokenTarg(spnego_mechs, unwrapped);
501 gss_release_buffer(&minor_status, &output_token);
502 if (unwrapped.length > wrapped.length) {
503 status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
504 goto failed;
505 }
506
507 cred.bv_val = (char *)wrapped.data;
508 cred.bv_len = wrapped.length;
509
510 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL,
511 &scred);
512 data_blob_free(&wrapped);
513 if (rc != LDAP_SUCCESS) {
514 status = ADS_ERROR(rc);
515 goto failed;
516 }
517
518 if (scred) {
519 wrapped = data_blob_const(scred->bv_val, scred->bv_len);
520 } else {
521 wrapped = data_blob_null;
522 }
523
524 ok = spnego_parse_auth_response(wrapped, NT_STATUS_OK,
525 OID_KERBEROS5_OLD,
526 &unwrapped);
527 if (scred) ber_bvfree(scred);
528 if (!ok) {
529 status = ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
530 goto failed;
531 }
532
533 input_token.value = unwrapped.data;
534 input_token.length = unwrapped.length;
535
536 /*
537 * As we asked for mutal authentication
538 * we need to pass the servers response
539 * to gssapi
540 */
541 gss_rc = gss_init_sec_context(&minor_status,
542 GSS_C_NO_CREDENTIAL,
543 &context_handle,
544 serv_name,
545 mech_type,
546 req_flags,
547 0,
548 NULL,
549 &input_token,
550 &actual_mech_type,
551 &output_token,
552 &ret_flags,
553 NULL);
554 data_blob_free(&unwrapped);
555 if (gss_rc) {
556 status = ADS_ERROR_GSS(gss_rc, minor_status);
557 goto failed;
558 }
559
560 gss_release_buffer(&minor_status, &output_token);
561
562 /*
563 * If we the sign and seal options
564 * doesn't match after getting the response
565 * from the server, we don't want to use the connection
566 */
567 req_tmp = req_flags & (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG);
568 ret_tmp = ret_flags & (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG);
569
570 if (req_tmp != ret_tmp) {
571 /* everythings fine... */
572 status = ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
573 goto failed;
574 }
575
576 if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
577 uint32 max_msg_size = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED;
578
579 gss_rc = gss_wrap_size_limit(&minor_status, context_handle,
580 (ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL),
581 GSS_C_QOP_DEFAULT,
582 max_msg_size, &ads->ldap.out.max_unwrapped);
583 if (gss_rc) {
584 status = ADS_ERROR_GSS(gss_rc, minor_status);
585 goto failed;
586 }
587
588 ads->ldap.out.sig_size = max_msg_size - ads->ldap.out.max_unwrapped;
589 ads->ldap.in.min_wrapped = 0x2C; /* taken from a capture with LDAP unbind */
590 ads->ldap.in.max_wrapped = max_msg_size;
591 status = ads_setup_sasl_wrapping(ads, &ads_sasl_gssapi_ops, context_handle);
592 if (!ADS_ERR_OK(status)) {
593 DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
594 ads_errstr(status)));
595 goto failed;
596 }
597 /* make sure we don't free context_handle */
598 context_handle = GSS_C_NO_CONTEXT;
599 }
600
601 status = ADS_SUCCESS;
602
603 failed:
604 if (context_handle != GSS_C_NO_CONTEXT)
605 gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);
606 return status;
607 }
608
609 #endif /* HAVE_GSSAPI */
610
611 #ifdef HAVE_KRB5
612 struct ads_service_principal {
613 char *string;
614 #ifdef HAVE_GSSAPI
615 gss_name_t name;
616 #endif
617 };
618
619 static void ads_free_service_principal(struct ads_service_principal *p)
620 {
621 SAFE_FREE(p->string);
622
623 #ifdef HAVE_GSSAPI
624 if (p->name) {
625 uint32 minor_status;
626 gss_release_name(&minor_status, &p->name);
627 }
628 #endif
629 ZERO_STRUCTP(p);
630 }
631
632 static ADS_STATUS ads_generate_service_principal(ADS_STRUCT *ads,
633 const char *given_principal,
634 struct ads_service_principal *p)
635 {
636 ADS_STATUS status;
637 #ifdef HAVE_GSSAPI
638 gss_buffer_desc input_name;
639 /* GSS_KRB5_NT_PRINCIPAL_NAME */
640 gss_OID_desc nt_principal =
641 {10, CONST_DISCARD(char *, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x01")};
642 uint32 minor_status;
643 int gss_rc;
644 #endif
645
646 ZERO_STRUCTP(p);
647
648 /* I've seen a child Windows 2000 domain not send
649 the principal name back in the first round of
650 the SASL bind reply. So we guess based on server
651 name and realm. --jerry */
652 /* Also try best guess when we get the w2k8 ignore
653 principal back - gd */
654
655 if (!given_principal ||
656 strequal(given_principal, ADS_IGNORE_PRINCIPAL)) {
657
658 status = ads_guess_service_principal(ads, &p->string);
659 if (!ADS_ERR_OK(status)) {
660 return status;
661 }
662 } else {
663 p->string = SMB_STRDUP(given_principal);
664 if (!p->string) {
665 return ADS_ERROR(LDAP_NO_MEMORY);
666 }
667 }
668
669 #ifdef HAVE_GSSAPI
670 input_name.value = p->string;
671 input_name.length = strlen(p->string);
672
673 gss_rc = gss_import_name(&minor_status, &input_name, &nt_principal, &p->name);
674 if (gss_rc) {
675 ads_free_service_principal(p);
676 return ADS_ERROR_GSS(gss_rc, minor_status);
677 }
678 #endif
679
680 return ADS_SUCCESS;
681 }
682
683 /*
684 perform a LDAP/SASL/SPNEGO/KRB5 bind
685 */
686 static ADS_STATUS ads_sasl_spnego_rawkrb5_bind(ADS_STRUCT *ads, const char *principal)
687 {
688 DATA_BLOB blob = data_blob_null;
689 struct berval cred, *scred = NULL;
690 DATA_BLOB session_key = data_blob_null;
691 int rc;
692
693 if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
694 return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
695 }
696
697 rc = spnego_gen_negTokenTarg(principal, ads->auth.time_offset, &blob, &session_key, 0,
698 &ads->auth.tgs_expire);
699
700 if (rc) {
701 return ADS_ERROR_KRB5(rc);
702 }
703
704 /* now send the auth packet and we should be done */
705 cred.bv_val = (char *)blob.data;
706 cred.bv_len = blob.length;
707
708 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL, &scred);
709
710 data_blob_free(&blob);
711 data_blob_free(&session_key);
712 if(scred)
713 ber_bvfree(scred);
714
715 return ADS_ERROR(rc);
716 }
717
718 static ADS_STATUS ads_sasl_spnego_krb5_bind(ADS_STRUCT *ads,
719 struct ads_service_principal *p)
720 {
721 #ifdef HAVE_GSSAPI
722 /*
723 * we only use the gsskrb5 based implementation
724 * when sasl sign or seal is requested.
725 *
726 * This has the following reasons:
727 * - it's likely that the gssapi krb5 mech implementation
728 * doesn't support to negotiate plain connections
729 * - the ads_sasl_spnego_rawkrb5_bind is more robust
730 * against clock skew errors
731 */
732 if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
733 return ads_sasl_spnego_gsskrb5_bind(ads, p->name);
734 }
735 #endif
736 return ads_sasl_spnego_rawkrb5_bind(ads, p->string);
737 }
738 #endif /* HAVE_KRB5 */
739
740 /*
741 this performs a SASL/SPNEGO bind
742 */
743 static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
744 {
745 struct berval *scred=NULL;
746 int rc, i;
747 ADS_STATUS status;
748 DATA_BLOB blob;
749 char *given_principal = NULL;
750 char *OIDs[ASN1_MAX_OIDS];
751 #ifdef HAVE_KRB5
752 bool got_kerberos_mechanism = False;
753 #endif
754
755 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", NULL, NULL, NULL, &scred);
756
757 if (rc != LDAP_SASL_BIND_IN_PROGRESS) {
758 status = ADS_ERROR(rc);
759 goto failed;
760 }
761
762 blob = data_blob(scred->bv_val, scred->bv_len);
763
764 ber_bvfree(scred);
765
766 #if 0
767 file_save("sasl_spnego.dat", blob.data, blob.length);
768 #endif
769
770 /* the server sent us the first part of the SPNEGO exchange in the negprot
771 reply */
772 if (!spnego_parse_negTokenInit(blob, OIDs, &given_principal) ||
773 OIDs[0] == NULL) {
774 data_blob_free(&blob);
775 status = ADS_ERROR(LDAP_OPERATIONS_ERROR);
776 goto failed;
777 }
778 data_blob_free(&blob);
779
780 /* make sure the server understands kerberos */
781 for (i=0;OIDs[i];i++) {
782 DEBUG(3,("ads_sasl_spnego_bind: got OID=%s\n", OIDs[i]));
783 #ifdef HAVE_KRB5
784 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
785 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
786 got_kerberos_mechanism = True;
787 }
788 #endif
789 talloc_free(OIDs[i]);
790 }
791 DEBUG(3,("ads_sasl_spnego_bind: got server principal name = %s\n", given_principal));
792
793 #ifdef HAVE_KRB5
794 if (!(ads->auth.flags & ADS_AUTH_DISABLE_KERBEROS) &&
795 got_kerberos_mechanism)
796 {
797 struct ads_service_principal p;
798
799 status = ads_generate_service_principal(ads, given_principal, &p);
800 TALLOC_FREE(given_principal);
801 if (!ADS_ERR_OK(status)) {
802 return status;
803 }
804
805 status = ads_sasl_spnego_krb5_bind(ads, &p);
806 if (ADS_ERR_OK(status)) {
807 ads_free_service_principal(&p);
808 return status;
809 }
810
811 DEBUG(10,("ads_sasl_spnego_krb5_bind failed with: %s, "
812 "calling kinit\n", ads_errstr(status)));
813
814 status = ADS_ERROR_KRB5(ads_kinit_password(ads));
815
816 if (ADS_ERR_OK(status)) {
817 status = ads_sasl_spnego_krb5_bind(ads, &p);
818 if (!ADS_ERR_OK(status)) {
819 DEBUG(0,("kinit succeeded but "
820 "ads_sasl_spnego_krb5_bind failed: %s\n",
821 ads_errstr(status)));
822 }
823 }
824
825 ads_free_service_principal(&p);
826
827 /* only fallback to NTLMSSP if allowed */
828 if (ADS_ERR_OK(status) ||
829 !(ads->auth.flags & ADS_AUTH_ALLOW_NTLMSSP)) {
830 return status;
831 }
832 } else
833 #endif
834 {
835 TALLOC_FREE(given_principal);
836 }
837
838 /* lets do NTLMSSP ... this has the big advantage that we don't need
839 to sync clocks, and we don't rely on special versions of the krb5
840 library for HMAC_MD4 encryption */
841 return ads_sasl_spnego_ntlmssp_bind(ads);
842
843 failed:
844 return status;
845 }
846
847 #ifdef HAVE_GSSAPI
848 #define MAX_GSS_PASSES 3
849
850 /* this performs a SASL/gssapi bind
851 we avoid using cyrus-sasl to make Samba more robust. cyrus-sasl
852 is very dependent on correctly configured DNS whereas
853 this routine is much less fragile
854 see RFC2078 and RFC2222 for details
855 */
856 static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv_name)
857 {
858 uint32 minor_status;
859 gss_ctx_id_t context_handle = GSS_C_NO_CONTEXT;
860 gss_OID mech_type = GSS_C_NULL_OID;
861 gss_buffer_desc output_token, input_token;
862 uint32 req_flags, ret_flags;
863 int conf_state;
864 struct berval cred;
865 struct berval *scred = NULL;
866 int i=0;
867 int gss_rc, rc;
868 uint8 *p;
869 uint32 max_msg_size = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED;
870 uint8 wrap_type = ADS_SASLWRAP_TYPE_PLAIN;
871 ADS_STATUS status;
872
873 input_token.value = NULL;
874 input_token.length = 0;
875
876 /*
877 * Note: here we always ask the gssapi for sign and seal
878 * as this is negotiated later after the mutal
879 * authentication
880 */
881 req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG;
882
883 for (i=0; i < MAX_GSS_PASSES; i++) {
884 gss_rc = gss_init_sec_context(&minor_status,
885 GSS_C_NO_CREDENTIAL,
886 &context_handle,
887 serv_name,
888 mech_type,
889 req_flags,
890 0,
891 NULL,
892 &input_token,
893 NULL,
894 &output_token,
895 &ret_flags,
896 NULL);
897 if (scred) {
898 ber_bvfree(scred);
899 scred = NULL;
900 }
901 if (gss_rc && gss_rc != GSS_S_CONTINUE_NEEDED) {
902 status = ADS_ERROR_GSS(gss_rc, minor_status);
903 goto failed;
904 }
905
906 cred.bv_val = (char *)output_token.value;
907 cred.bv_len = output_token.length;
908
909 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSSAPI", &cred, NULL, NULL,
910 &scred);
911 if (rc != LDAP_SASL_BIND_IN_PROGRESS) {
912 status = ADS_ERROR(rc);
913 goto failed;
914 }
915
916 if (output_token.value) {
917 gss_release_buffer(&minor_status, &output_token);
918 }
919
920 if (scred) {
921 input_token.value = scred->bv_val;
922 input_token.length = scred->bv_len;
923 } else {
924 input_token.value = NULL;
925 input_token.length = 0;
926 }
927
928 if (gss_rc == 0) break;
929 }
930
931 gss_rc = gss_unwrap(&minor_status,context_handle,&input_token,&output_token,
932 &conf_state,NULL);
933 if (scred) {
934 ber_bvfree(scred);
935 scred = NULL;
936 }
937 if (gss_rc) {
938 status = ADS_ERROR_GSS(gss_rc, minor_status);
939 goto failed;
940 }
941
942 p = (uint8 *)output_token.value;
943
944 #if 0
945 file_save("sasl_gssapi.dat", output_token.value, output_token.length);
946 #endif
947
948 if (p) {
949 wrap_type = CVAL(p,0);
950 SCVAL(p,0,0);
951 max_msg_size = RIVAL(p,0);
952 }
953
954 gss_release_buffer(&minor_status, &output_token);
955
956 if (!(wrap_type & ads->ldap.wrap_type)) {
957 /*
958 * the server doesn't supports the wrap
959 * type we want :-(
960 */
961 DEBUG(0,("The ldap sasl wrap type doesn't match wanted[%d] server[%d]\n",
962 ads->ldap.wrap_type, wrap_type));
963 DEBUGADD(0,("You may want to set the 'client ldap sasl wrapping' option\n"));
964 status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
965 goto failed;
966 }
967
968 /* 0x58 is the minimum windows accepts */
969 if (max_msg_size < 0x58) {
970 max_msg_size = 0x58;
971 }
972
973 output_token.length = 4;
974 output_token.value = SMB_MALLOC(output_token.length);
975 p = (uint8 *)output_token.value;
976
977 RSIVAL(p,0,max_msg_size);
978 SCVAL(p,0,ads->ldap.wrap_type);
979
980 /*
981 * we used to add sprintf("dn:%s", ads->config.bind_path) here.
982 * but using ads->config.bind_path is the wrong! It should be
983 * the DN of the user object!
984 *
985 * w2k3 gives an error when we send an incorrect DN, but sending nothing
986 * is ok and matches the information flow used in GSS-SPNEGO.
987 */
988
989 gss_rc = gss_wrap(&minor_status, context_handle,0,GSS_C_QOP_DEFAULT,
990 &output_token, &conf_state,
991 &input_token);
992 if (gss_rc) {
993 status = ADS_ERROR_GSS(gss_rc, minor_status);
994 goto failed;
995 }
996
997 free(output_token.value);
998
999 cred.bv_val = (char *)input_token.value;
1000 cred.bv_len = input_token.length;
1001
1002 rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSSAPI", &cred, NULL, NULL,
1003 &scred);
1004 gss_release_buffer(&minor_status, &input_token);
1005 status = ADS_ERROR(rc);
1006 if (!ADS_ERR_OK(status)) {
1007 goto failed;
1008 }
1009
1010 if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
1011 gss_rc = gss_wrap_size_limit(&minor_status, context_handle,
1012 (ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL),
1013 GSS_C_QOP_DEFAULT,
1014 max_msg_size, &ads->ldap.out.max_unwrapped);
1015 if (gss_rc) {
1016 status = ADS_ERROR_GSS(gss_rc, minor_status);
1017 goto failed;
1018 }
1019
1020 ads->ldap.out.sig_size = max_msg_size - ads->ldap.out.max_unwrapped;
1021 ads->ldap.in.min_wrapped = 0x2C; /* taken from a capture with LDAP unbind */
1022 ads->ldap.in.max_wrapped = max_msg_size;
1023 status = ads_setup_sasl_wrapping(ads, &ads_sasl_gssapi_ops, context_handle);
1024 if (!ADS_ERR_OK(status)) {
1025 DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
1026 ads_errstr(status)));
1027 goto failed;
1028 }
1029 /* make sure we don't free context_handle */
1030 context_handle = GSS_C_NO_CONTEXT;
1031 }
1032
1033 failed:
1034
1035 if (context_handle != GSS_C_NO_CONTEXT)
1036 gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);
1037
1038 if(scred)
1039 ber_bvfree(scred);
1040 return status;
1041 }
1042
1043 static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads)
1044 {
1045 ADS_STATUS status;
1046 struct ads_service_principal p;
1047
1048 status = ads_generate_service_principal(ads, NULL, &p);
1049 if (!ADS_ERR_OK(status)) {
1050 return status;
1051 }
1052
1053 status = ads_sasl_gssapi_do_bind(ads, p.name);
1054 if (ADS_ERR_OK(status)) {
1055 ads_free_service_principal(&p);
1056 return status;
1057 }
1058
1059 DEBUG(10,("ads_sasl_gssapi_do_bind failed with: %s, "
1060 "calling kinit\n", ads_errstr(status)));
1061
1062 status = ADS_ERROR_KRB5(ads_kinit_password(ads));
1063
1064 if (ADS_ERR_OK(status)) {
1065 status = ads_sasl_gssapi_do_bind(ads, p.name);
1066 }
1067
1068 ads_free_service_principal(&p);
1069
1070 return status;
1071 }
1072
1073 #endif /* HAVE_GSSAPI */
1074
1075 /* mapping between SASL mechanisms and functions */
1076 static struct {
1077 const char *name;
1078 ADS_STATUS (*fn)(ADS_STRUCT *);
1079 } sasl_mechanisms[] = {
1080 {"GSS-SPNEGO", ads_sasl_spnego_bind},
1081 #ifdef HAVE_GSSAPI
1082 {"GSSAPI", ads_sasl_gssapi_bind}, /* doesn't work with .NET RC1. No idea why */
1083 #endif
1084 {NULL, NULL}
1085 };
1086
1087 ADS_STATUS ads_sasl_bind(ADS_STRUCT *ads)
1088 {
1089 const char *attrs[] = {"supportedSASLMechanisms", NULL};
1090 char **values;
1091 ADS_STATUS status;
1092 int i, j;
1093 LDAPMessage *res;
1094
1095 /* get a list of supported SASL mechanisms */
1096 status = ads_do_search(ads, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res);
1097 if (!ADS_ERR_OK(status)) return status;
1098
1099 values = ldap_get_values(ads->ldap.ld, res, "supportedSASLMechanisms");
1100
1101 if (ads->auth.flags & ADS_AUTH_SASL_SEAL) {
1102 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SEAL;
1103 } else if (ads->auth.flags & ADS_AUTH_SASL_SIGN) {
1104 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SIGN;
1105 } else {
1106 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_PLAIN;
1107 }
1108
1109 /* try our supported mechanisms in order */
1110 for (i=0;sasl_mechanisms[i].name;i++) {
1111 /* see if the server supports it */
1112 for (j=0;values && values[j];j++) {
1113 if (strcmp(values[j], sasl_mechanisms[i].name) == 0) {
1114 DEBUG(4,("Found SASL mechanism %s\n", values[j]));
1115 status = sasl_mechanisms[i].fn(ads);
1116 ldap_value_free(values);
1117 ldap_msgfree(res);
1118 return status;
1119 }
1120 }
1121 }
1122
1123 ldap_value_free(values);
1124 ldap_msgfree(res);
1125 return ADS_ERROR(LDAP_AUTH_METHOD_NOT_SUPPORTED);
1126 }
1127
1128 #endif /* HAVE_LDAP */
1129