Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : RFC2478 Compliant SPNEGO implementation
5 :
6 : Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
7 : Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
8 : Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2008
9 :
10 : This program is free software; you can redistribute it and/or modify
11 : it under the terms of the GNU General Public License as published by
12 : the Free Software Foundation; either version 3 of the License, or
13 : (at your option) any later version.
14 :
15 : This program is distributed in the hope that it will be useful,
16 : but WITHOUT ANY WARRANTY; without even the implied warranty of
17 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 : GNU General Public License for more details.
19 :
20 :
21 : You should have received a copy of the GNU General Public License
22 : along with this program. If not, see <http://www.gnu.org/licenses/>.
23 : */
24 :
25 : #include "includes.h"
26 : #include <tevent.h>
27 : #include "lib/util/tevent_ntstatus.h"
28 : #include "../libcli/auth/spnego.h"
29 : #include "librpc/gen_ndr/ndr_dcerpc.h"
30 : #include "auth/credentials/credentials.h"
31 : #include "auth/gensec/gensec.h"
32 : #include "auth/gensec/gensec_internal.h"
33 : #include "param/param.h"
34 : #include "lib/util/asn1.h"
35 : #include "lib/util/base64.h"
36 :
37 : #undef DBGC_CLASS
38 : #define DBGC_CLASS DBGC_AUTH
39 :
40 : #undef strcasecmp
41 :
42 : _PUBLIC_ NTSTATUS gensec_spnego_init(TALLOC_CTX *ctx);
43 :
44 : enum spnego_state_position {
45 : SPNEGO_SERVER_START,
46 : SPNEGO_CLIENT_START,
47 : SPNEGO_SERVER_TARG,
48 : SPNEGO_CLIENT_TARG,
49 : SPNEGO_FALLBACK,
50 : SPNEGO_DONE
51 : };
52 :
53 : struct spnego_state;
54 : struct spnego_neg_ops;
55 : struct spnego_neg_state;
56 :
57 : struct spnego_neg_state {
58 : const struct spnego_neg_ops *ops;
59 : const struct gensec_security_ops_wrapper *all_sec;
60 : size_t all_idx;
61 : const char * const *mech_types;
62 : size_t mech_idx;
63 : };
64 :
65 : struct spnego_neg_ops {
66 : const char *name;
67 : /*
68 : * The start hook does the initial processing on the incoming packet and
69 : * may starts the first possible subcontext. It indicates that
70 : * gensec_update() is required on the subcontext by returning
71 : * NT_STATUS_MORE_PROCESSING_REQUIRED and return something useful in
72 : * 'in_next'. Note that 'in_mem_ctx' is just passed as a hint, the
73 : * caller should treat 'in_next' as const and don't attempt to free the
74 : * content. NT_STATUS_OK indicates the finish hook should be invoked
75 : * directly within the need of gensec_update() on the subcontext.
76 : * Every other error indicates an error that's returned to the caller.
77 : */
78 : NTSTATUS (*start_fn)(struct gensec_security *gensec_security,
79 : struct spnego_state *spnego_state,
80 : struct spnego_neg_state *n,
81 : struct spnego_data *spnego_in,
82 : TALLOC_CTX *in_mem_ctx,
83 : DATA_BLOB *in_next);
84 : /*
85 : * The step hook processes the result of a failed gensec_update() and
86 : * can decide to ignore a failure and continue the negotiation by
87 : * setting up the next possible subcontext. It indicates that
88 : * gensec_update() is required on the subcontext by returning
89 : * NT_STATUS_MORE_PROCESSING_REQUIRED and return something useful in
90 : * 'in_next'. Note that 'in_mem_ctx' is just passed as a hint, the
91 : * caller should treat 'in_next' as const and don't attempt to free the
92 : * content. NT_STATUS_OK indicates the finish hook should be invoked
93 : * directly within the need of gensec_update() on the subcontext.
94 : * Every other error indicates an error that's returned to the caller.
95 : */
96 : NTSTATUS (*step_fn)(struct gensec_security *gensec_security,
97 : struct spnego_state *spnego_state,
98 : struct spnego_neg_state *n,
99 : struct spnego_data *spnego_in,
100 : NTSTATUS last_status,
101 : TALLOC_CTX *in_mem_ctx,
102 : DATA_BLOB *in_next);
103 : /*
104 : * The finish hook processes the result of a successful gensec_update()
105 : * (NT_STATUS_OK or NT_STATUS_MORE_PROCESSING_REQUIRED). It forms the
106 : * response pdu that will be returned from the toplevel gensec_update()
107 : * together with NT_STATUS_OK or NT_STATUS_MORE_PROCESSING_REQUIRED. It
108 : * may also alter the state machine to prepare receiving the next pdu
109 : * from the peer.
110 : */
111 : NTSTATUS (*finish_fn)(struct gensec_security *gensec_security,
112 : struct spnego_state *spnego_state,
113 : struct spnego_neg_state *n,
114 : struct spnego_data *spnego_in,
115 : NTSTATUS sub_status,
116 : const DATA_BLOB sub_out,
117 : TALLOC_CTX *out_mem_ctx,
118 : DATA_BLOB *out);
119 : };
120 :
121 : struct spnego_state {
122 : enum spnego_message_type expected_packet;
123 : enum spnego_state_position state_position;
124 : struct gensec_security *sub_sec_security;
125 : bool sub_sec_ready;
126 :
127 : const char *neg_oid;
128 :
129 : DATA_BLOB mech_types;
130 : size_t num_targs;
131 : bool downgraded;
132 : bool mic_requested;
133 : bool needs_mic_sign;
134 : bool needs_mic_check;
135 : bool may_skip_mic_check;
136 : bool done_mic_check;
137 :
138 : bool simulate_w2k;
139 : bool no_optimistic;
140 :
141 : /*
142 : * The following is used to implement
143 : * the update token fragmentation
144 : */
145 : size_t in_needed;
146 : DATA_BLOB in_frag;
147 : size_t out_max_length;
148 : DATA_BLOB out_frag;
149 : NTSTATUS out_status;
150 : };
151 :
152 338671 : static struct spnego_neg_state *gensec_spnego_neg_state(TALLOC_CTX *mem_ctx,
153 : const struct spnego_neg_ops *ops)
154 : {
155 338671 : struct spnego_neg_state *n = NULL;
156 :
157 343813 : n = talloc_zero(mem_ctx, struct spnego_neg_state);
158 338671 : if (n == NULL) {
159 0 : return NULL;
160 : }
161 338671 : n->ops = ops;
162 :
163 338671 : return n;
164 : }
165 :
166 25148 : static void gensec_spnego_reset_sub_sec(struct spnego_state *spnego_state)
167 : {
168 25148 : spnego_state->sub_sec_ready = false;
169 25148 : TALLOC_FREE(spnego_state->sub_sec_security);
170 25142 : }
171 :
172 70976 : static NTSTATUS gensec_spnego_client_start(struct gensec_security *gensec_security)
173 : {
174 1331 : struct spnego_state *spnego_state;
175 :
176 70976 : spnego_state = talloc_zero(gensec_security, struct spnego_state);
177 70976 : if (!spnego_state) {
178 0 : return NT_STATUS_NO_MEMORY;
179 : }
180 :
181 70976 : spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
182 70976 : spnego_state->state_position = SPNEGO_CLIENT_START;
183 70976 : spnego_state->sub_sec_security = NULL;
184 70976 : spnego_state->sub_sec_ready = false;
185 70976 : spnego_state->mech_types = data_blob_null;
186 70976 : spnego_state->out_max_length = gensec_max_update_size(gensec_security);
187 70976 : spnego_state->out_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
188 :
189 70976 : spnego_state->simulate_w2k = gensec_setting_bool(gensec_security->settings,
190 : "spnego", "simulate_w2k", false);
191 70976 : spnego_state->no_optimistic = gensec_setting_bool(gensec_security->settings,
192 : "spnego",
193 : "client_no_optimistic",
194 : false);
195 :
196 70976 : gensec_security->private_data = spnego_state;
197 70976 : return NT_STATUS_OK;
198 : }
199 :
200 120190 : static NTSTATUS gensec_spnego_server_start(struct gensec_security *gensec_security)
201 : {
202 2305 : struct spnego_state *spnego_state;
203 :
204 120190 : spnego_state = talloc_zero(gensec_security, struct spnego_state);
205 120190 : if (!spnego_state) {
206 0 : return NT_STATUS_NO_MEMORY;
207 : }
208 :
209 120190 : spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
210 120190 : spnego_state->state_position = SPNEGO_SERVER_START;
211 120190 : spnego_state->sub_sec_security = NULL;
212 120190 : spnego_state->sub_sec_ready = false;
213 120190 : spnego_state->mech_types = data_blob_null;
214 120190 : spnego_state->out_max_length = gensec_max_update_size(gensec_security);
215 120190 : spnego_state->out_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
216 :
217 120190 : spnego_state->simulate_w2k = gensec_setting_bool(gensec_security->settings,
218 : "spnego", "simulate_w2k", false);
219 :
220 120190 : gensec_security->private_data = spnego_state;
221 120190 : return NT_STATUS_OK;
222 : }
223 :
224 : /** Fallback to another GENSEC mechanism, based on magic strings
225 : *
226 : * This is the 'fallback' case, where we don't get SPNEGO, and have to
227 : * try all the other options (and hope they all have a magic string
228 : * they check)
229 : */
230 :
231 147 : static NTSTATUS gensec_spnego_server_try_fallback(struct gensec_security *gensec_security,
232 : struct spnego_state *spnego_state,
233 : TALLOC_CTX *mem_ctx,
234 : const DATA_BLOB in)
235 : {
236 0 : int i,j;
237 0 : const struct gensec_security_ops **all_ops;
238 :
239 147 : all_ops = gensec_security_mechs(gensec_security, mem_ctx);
240 :
241 345 : for (i=0; all_ops && all_ops[i]; i++) {
242 0 : bool is_spnego;
243 0 : NTSTATUS nt_status;
244 :
245 345 : if (gensec_security != NULL &&
246 345 : !gensec_security_ops_enabled(all_ops[i], gensec_security))
247 : {
248 198 : continue;
249 : }
250 :
251 291 : if (!all_ops[i]->oid) {
252 78 : continue;
253 : }
254 :
255 213 : is_spnego = false;
256 509 : for (j=0; all_ops[i]->oid[j]; j++) {
257 296 : if (strcasecmp(GENSEC_OID_SPNEGO,all_ops[i]->oid[j]) == 0) {
258 28 : is_spnego = true;
259 : }
260 : }
261 213 : if (is_spnego) {
262 28 : continue;
263 : }
264 :
265 185 : if (!all_ops[i]->magic) {
266 0 : continue;
267 : }
268 :
269 185 : nt_status = all_ops[i]->magic(gensec_security, &in);
270 185 : if (!NT_STATUS_IS_OK(nt_status)) {
271 38 : continue;
272 : }
273 :
274 147 : spnego_state->state_position = SPNEGO_FALLBACK;
275 :
276 147 : nt_status = gensec_subcontext_start(spnego_state,
277 : gensec_security,
278 : &spnego_state->sub_sec_security);
279 :
280 147 : if (!NT_STATUS_IS_OK(nt_status)) {
281 147 : return nt_status;
282 : }
283 : /* select the sub context */
284 147 : nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
285 147 : all_ops[i]);
286 147 : if (!NT_STATUS_IS_OK(nt_status)) {
287 0 : return nt_status;
288 : }
289 :
290 147 : return NT_STATUS_OK;
291 : }
292 0 : DEBUG(1, ("Failed to parse SPNEGO request\n"));
293 0 : return NT_STATUS_INVALID_PARAMETER;
294 : }
295 :
296 84005 : static NTSTATUS gensec_spnego_create_negTokenInit_start(
297 : struct gensec_security *gensec_security,
298 : struct spnego_state *spnego_state,
299 : struct spnego_neg_state *n,
300 : struct spnego_data *spnego_in,
301 : TALLOC_CTX *in_mem_ctx,
302 : DATA_BLOB *in_next)
303 : {
304 84005 : n->mech_idx = 0;
305 84005 : n->mech_types = gensec_security_oids(gensec_security, n,
306 : GENSEC_OID_SPNEGO);
307 84005 : if (n->mech_types == NULL) {
308 0 : DBG_WARNING("gensec_security_oids() failed\n");
309 0 : return NT_STATUS_NO_MEMORY;
310 : }
311 :
312 84005 : n->all_idx = 0;
313 84005 : n->all_sec = gensec_security_by_oid_list(gensec_security,
314 : n, n->mech_types,
315 : GENSEC_OID_SPNEGO);
316 84005 : if (n->all_sec == NULL) {
317 0 : DBG_WARNING("gensec_security_by_oid_list() failed\n");
318 0 : return NT_STATUS_NO_MEMORY;
319 : }
320 :
321 84005 : return n->ops->step_fn(gensec_security, spnego_state, n,
322 84005 : spnego_in, NT_STATUS_OK, in_mem_ctx, in_next);
323 : }
324 :
325 84216 : static NTSTATUS gensec_spnego_create_negTokenInit_step(
326 : struct gensec_security *gensec_security,
327 : struct spnego_state *spnego_state,
328 : struct spnego_neg_state *n,
329 : struct spnego_data *spnego_in,
330 : NTSTATUS last_status,
331 : TALLOC_CTX *in_mem_ctx,
332 : DATA_BLOB *in_next)
333 : {
334 84216 : if (!NT_STATUS_IS_OK(last_status)) {
335 211 : const struct gensec_security_ops_wrapper *cur_sec =
336 211 : &n->all_sec[n->all_idx];
337 211 : const struct gensec_security_ops_wrapper *next_sec = NULL;
338 211 : const char *next = NULL;
339 211 : const char *principal = NULL;
340 211 : int dbg_level = DBGLVL_WARNING;
341 211 : NTSTATUS status = last_status;
342 :
343 211 : if (cur_sec[1].op != NULL) {
344 35 : next_sec = &cur_sec[1];
345 : }
346 :
347 211 : if (next_sec != NULL) {
348 35 : next = next_sec->op->name;
349 35 : dbg_level = DBGLVL_NOTICE;
350 : }
351 :
352 211 : if (gensec_security->target.principal != NULL) {
353 0 : principal = gensec_security->target.principal;
354 211 : } else if (gensec_security->target.service != NULL &&
355 211 : gensec_security->target.hostname != NULL)
356 : {
357 211 : principal = talloc_asprintf(spnego_state->sub_sec_security,
358 : "%s/%s",
359 : gensec_security->target.service,
360 : gensec_security->target.hostname);
361 : } else {
362 0 : principal = gensec_security->target.hostname;
363 : }
364 :
365 211 : DBG_PREFIX(dbg_level, (
366 : "%s: creating NEG_TOKEN_INIT for %s failed "
367 : "(next[%s]): %s\n", cur_sec->op->name,
368 : principal, next, nt_errstr(status)));
369 :
370 211 : if (next == NULL) {
371 : /*
372 : * A hard error without a possible fallback.
373 : */
374 176 : return status;
375 : }
376 :
377 : /*
378 : * Pretend we never started it
379 : */
380 35 : gensec_spnego_reset_sub_sec(spnego_state);
381 :
382 : /*
383 : * And try the next one...
384 : */
385 35 : n->all_idx += 1;
386 : }
387 :
388 85683 : for (; n->all_sec[n->all_idx].op != NULL; n->all_idx++) {
389 85679 : const struct gensec_security_ops_wrapper *cur_sec =
390 84179 : &n->all_sec[n->all_idx];
391 1500 : NTSTATUS status;
392 :
393 85679 : status = gensec_subcontext_start(spnego_state,
394 : gensec_security,
395 : &spnego_state->sub_sec_security);
396 85679 : if (!NT_STATUS_IS_OK(status)) {
397 82536 : return status;
398 : }
399 :
400 : /* select the sub context */
401 87179 : status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
402 85679 : cur_sec->op);
403 85679 : if (!NT_STATUS_IS_OK(status)) {
404 1643 : gensec_spnego_reset_sub_sec(spnego_state);
405 1643 : continue;
406 : }
407 :
408 : /* In the client, try and produce the first (optimistic) packet */
409 84036 : if (spnego_state->state_position == SPNEGO_CLIENT_START) {
410 32679 : *in_next = data_blob_null;
411 32679 : return NT_STATUS_MORE_PROCESSING_REQUIRED;
412 : }
413 :
414 51357 : *in_next = data_blob_null;
415 51357 : return NT_STATUS_OK;
416 : }
417 :
418 4 : DBG_WARNING("Failed to setup SPNEGO negTokenInit request\n");
419 4 : return NT_STATUS_INVALID_PARAMETER;
420 : }
421 :
422 83825 : static NTSTATUS gensec_spnego_create_negTokenInit_finish(
423 : struct gensec_security *gensec_security,
424 : struct spnego_state *spnego_state,
425 : struct spnego_neg_state *n,
426 : struct spnego_data *spnego_in,
427 : NTSTATUS sub_status,
428 : const DATA_BLOB sub_out,
429 : TALLOC_CTX *out_mem_ctx,
430 : DATA_BLOB *out)
431 : {
432 83825 : const struct gensec_security_ops_wrapper *cur_sec =
433 83825 : &n->all_sec[n->all_idx];
434 1500 : struct spnego_data spnego_out;
435 1500 : bool ok;
436 :
437 83825 : spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
438 :
439 83825 : n->mech_types = gensec_security_oids_from_ops_wrapped(n, cur_sec);
440 83825 : if (n->mech_types == NULL) {
441 0 : DBG_WARNING("gensec_security_oids_from_ops_wrapped() failed\n");
442 0 : return NT_STATUS_NO_MEMORY;
443 : }
444 :
445 83825 : ok = spnego_write_mech_types(spnego_state,
446 : n->mech_types,
447 : &spnego_state->mech_types);
448 83825 : if (!ok) {
449 0 : DBG_ERR("Failed to write mechTypes\n");
450 0 : return NT_STATUS_NO_MEMORY;
451 : }
452 :
453 : /* List the remaining mechs as options */
454 83825 : spnego_out.negTokenInit.mechTypes = n->mech_types;
455 83825 : spnego_out.negTokenInit.reqFlags = data_blob_null;
456 83825 : spnego_out.negTokenInit.reqFlagsPadding = 0;
457 :
458 83825 : if (spnego_state->state_position == SPNEGO_SERVER_START) {
459 1276 : spnego_out.negTokenInit.mechListMIC
460 51357 : = data_blob_string_const(ADS_IGNORE_PRINCIPAL);
461 : } else {
462 32468 : spnego_out.negTokenInit.mechListMIC = data_blob_null;
463 : }
464 :
465 83825 : spnego_out.negTokenInit.mechToken = sub_out;
466 :
467 83825 : if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
468 0 : DBG_ERR("Failed to write NEG_TOKEN_INIT\n");
469 0 : return NT_STATUS_INVALID_PARAMETER;
470 : }
471 :
472 : /*
473 : * Note that 'cur_sec' is temporary memory, but
474 : * cur_sec->oid points to a const string in the
475 : * backends gensec_security_ops structure.
476 : */
477 83825 : spnego_state->neg_oid = cur_sec->oid;
478 :
479 : /* set next state */
480 83825 : if (spnego_state->state_position == SPNEGO_SERVER_START) {
481 51357 : spnego_state->state_position = SPNEGO_SERVER_START;
482 51357 : spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
483 : } else {
484 32468 : spnego_state->state_position = SPNEGO_CLIENT_TARG;
485 32468 : spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
486 : }
487 :
488 83825 : return NT_STATUS_MORE_PROCESSING_REQUIRED;
489 : }
490 :
491 : static const struct spnego_neg_ops gensec_spnego_create_negTokenInit_ops = {
492 : .name = "create_negTokenInit",
493 : .start_fn = gensec_spnego_create_negTokenInit_start,
494 : .step_fn = gensec_spnego_create_negTokenInit_step,
495 : .finish_fn = gensec_spnego_create_negTokenInit_finish,
496 : };
497 :
498 38326 : static NTSTATUS gensec_spnego_client_negTokenInit_start(
499 : struct gensec_security *gensec_security,
500 : struct spnego_state *spnego_state,
501 : struct spnego_neg_state *n,
502 : struct spnego_data *spnego_in,
503 : TALLOC_CTX *in_mem_ctx,
504 : DATA_BLOB *in_next)
505 : {
506 38326 : const char *tp = NULL;
507 :
508 : /* The server offers a list of mechanisms */
509 :
510 38326 : tp = spnego_in->negTokenInit.targetPrincipal;
511 38326 : if (tp != NULL && strcmp(tp, ADS_IGNORE_PRINCIPAL) != 0) {
512 0 : DBG_INFO("Server claims it's principal name is %s\n", tp);
513 0 : if (lpcfg_client_use_spnego_principal(gensec_security->settings->lp_ctx)) {
514 0 : gensec_set_target_principal(gensec_security, tp);
515 : }
516 : }
517 :
518 38326 : n->mech_idx = 0;
519 :
520 : /* Do not use server mech list as it isn't protected. Instead, get all
521 : * supported mechs (excluding SPNEGO). */
522 38326 : n->mech_types = gensec_security_oids(gensec_security, n,
523 : GENSEC_OID_SPNEGO);
524 38326 : if (n->mech_types == NULL) {
525 0 : return NT_STATUS_INVALID_PARAMETER;
526 : }
527 :
528 38326 : n->all_idx = 0;
529 38326 : n->all_sec = gensec_security_by_oid_list(gensec_security,
530 : n, n->mech_types,
531 : GENSEC_OID_SPNEGO);
532 38326 : if (n->all_sec == NULL) {
533 0 : DBG_WARNING("gensec_security_by_oid_list() failed\n");
534 0 : return NT_STATUS_INVALID_PARAMETER;
535 : }
536 :
537 38326 : return n->ops->step_fn(gensec_security, spnego_state, n,
538 38326 : spnego_in, NT_STATUS_OK, in_mem_ctx, in_next);
539 : }
540 :
541 39561 : static NTSTATUS gensec_spnego_client_negTokenInit_step(
542 : struct gensec_security *gensec_security,
543 : struct spnego_state *spnego_state,
544 : struct spnego_neg_state *n,
545 : struct spnego_data *spnego_in,
546 : NTSTATUS last_status,
547 : TALLOC_CTX *in_mem_ctx,
548 : DATA_BLOB *in_next)
549 : {
550 39561 : if (!NT_STATUS_IS_OK(last_status)) {
551 1235 : const struct gensec_security_ops_wrapper *cur_sec =
552 1235 : &n->all_sec[n->all_idx];
553 1235 : const struct gensec_security_ops_wrapper *next_sec = NULL;
554 1235 : const char *next = NULL;
555 1235 : const char *principal = NULL;
556 1235 : int dbg_level = DBGLVL_WARNING;
557 1235 : bool allow_fallback = false;
558 1235 : NTSTATUS status = last_status;
559 :
560 1235 : if (cur_sec[1].op != NULL) {
561 1221 : next_sec = &cur_sec[1];
562 : }
563 :
564 : /*
565 : * it is likely that a NULL input token will
566 : * not be liked by most server mechs, but if
567 : * we are in the client, we want the first
568 : * update packet to be able to abort the use
569 : * of this mech
570 : */
571 1235 : if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER) ||
572 1229 : NT_STATUS_EQUAL(status, NT_STATUS_INVALID_ACCOUNT_NAME) ||
573 1229 : NT_STATUS_EQUAL(status, NT_STATUS_INVALID_COMPUTER_NAME) ||
574 1229 : NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_DOMAIN) ||
575 1229 : NT_STATUS_EQUAL(status, NT_STATUS_NO_LOGON_SERVERS) ||
576 22 : NT_STATUS_EQUAL(status, NT_STATUS_TIME_DIFFERENCE_AT_DC) ||
577 22 : NT_STATUS_EQUAL(status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO))
578 : {
579 1213 : allow_fallback = true;
580 : }
581 :
582 1235 : if (allow_fallback && next_sec != NULL) {
583 1211 : next = next_sec->op->name;
584 1211 : dbg_level = DBGLVL_NOTICE;
585 : }
586 :
587 1235 : if (gensec_security->target.principal != NULL) {
588 0 : principal = gensec_security->target.principal;
589 1235 : } else if (gensec_security->target.service != NULL &&
590 1235 : gensec_security->target.hostname != NULL)
591 : {
592 1235 : principal = talloc_asprintf(spnego_state->sub_sec_security,
593 : "%s/%s",
594 : gensec_security->target.service,
595 : gensec_security->target.hostname);
596 : } else {
597 0 : principal = gensec_security->target.hostname;
598 : }
599 :
600 1235 : DBG_PREFIX(dbg_level, (
601 : "%s: creating NEG_TOKEN_INIT for %s failed "
602 : "(next[%s]): %s\n", cur_sec->op->name,
603 : principal, next, nt_errstr(status)));
604 :
605 1235 : if (next == NULL) {
606 : /*
607 : * A hard error without a possible fallback.
608 : */
609 24 : return status;
610 : }
611 :
612 : /*
613 : * Pretend we never started it.
614 : */
615 1211 : gensec_spnego_reset_sub_sec(spnego_state);
616 :
617 : /*
618 : * And try the next one...
619 : */
620 1211 : n->all_idx += 1;
621 : }
622 :
623 61794 : for (; n->all_sec[n->all_idx].op != NULL; n->all_idx++) {
624 61785 : const struct gensec_security_ops_wrapper *cur_sec =
625 60672 : &n->all_sec[n->all_idx];
626 1113 : NTSTATUS status;
627 :
628 61785 : status = gensec_subcontext_start(spnego_state,
629 : gensec_security,
630 : &spnego_state->sub_sec_security);
631 61785 : if (!NT_STATUS_IS_OK(status)) {
632 38421 : return status;
633 : }
634 :
635 : /* select the sub context */
636 62898 : status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
637 61785 : cur_sec->op);
638 61785 : if (!NT_STATUS_IS_OK(status)) {
639 22257 : gensec_spnego_reset_sub_sec(spnego_state);
640 22257 : continue;
641 : }
642 :
643 : /*
644 : * Note that 'cur_sec' is temporary memory, but
645 : * cur_sec->oid points to a const string in the
646 : * backends gensec_security_ops structure.
647 : */
648 39528 : spnego_state->neg_oid = cur_sec->oid;
649 :
650 : /*
651 : * As client we don't use an optimistic token from the server.
652 : * But try to produce one for the server.
653 : */
654 39528 : *in_next = data_blob_null;
655 39528 : return NT_STATUS_MORE_PROCESSING_REQUIRED;
656 : }
657 :
658 9 : DBG_WARNING("Could not find a suitable mechtype in NEG_TOKEN_INIT\n");
659 9 : return NT_STATUS_INVALID_PARAMETER;
660 : }
661 :
662 38293 : static NTSTATUS gensec_spnego_client_negTokenInit_finish(
663 : struct gensec_security *gensec_security,
664 : struct spnego_state *spnego_state,
665 : struct spnego_neg_state *n,
666 : struct spnego_data *spnego_in,
667 : NTSTATUS sub_status,
668 : const DATA_BLOB sub_out,
669 : TALLOC_CTX *out_mem_ctx,
670 : DATA_BLOB *out)
671 : {
672 1107 : struct spnego_data spnego_out;
673 38293 : const char * const *mech_types = NULL;
674 1107 : bool ok;
675 :
676 38293 : if (n->mech_types == NULL) {
677 0 : DBG_WARNING("No mech_types list\n");
678 0 : return NT_STATUS_INVALID_PARAMETER;
679 : }
680 :
681 85213 : for (mech_types = n->mech_types; *mech_types != NULL; mech_types++) {
682 85213 : int cmp = strcmp(*mech_types, spnego_state->neg_oid);
683 :
684 85213 : if (cmp == 0) {
685 37186 : break;
686 : }
687 : }
688 :
689 38293 : if (*mech_types == NULL) {
690 0 : DBG_ERR("Can't find selected sub mechanism in mech_types\n");
691 0 : return NT_STATUS_INVALID_PARAMETER;
692 : }
693 :
694 : /* compose reply */
695 38293 : spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
696 38293 : spnego_out.negTokenInit.mechTypes = mech_types;
697 38293 : spnego_out.negTokenInit.reqFlags = data_blob_null;
698 38293 : spnego_out.negTokenInit.reqFlagsPadding = 0;
699 38293 : spnego_out.negTokenInit.mechListMIC = data_blob_null;
700 38293 : spnego_out.negTokenInit.mechToken = sub_out;
701 :
702 38293 : if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
703 0 : DBG_ERR("Failed to write SPNEGO reply to NEG_TOKEN_INIT\n");
704 0 : return NT_STATUS_INVALID_PARAMETER;
705 : }
706 :
707 38293 : ok = spnego_write_mech_types(spnego_state,
708 : mech_types,
709 : &spnego_state->mech_types);
710 38293 : if (!ok) {
711 0 : DBG_ERR("failed to write mechTypes\n");
712 0 : return NT_STATUS_NO_MEMORY;
713 : }
714 :
715 : /* set next state */
716 38293 : spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
717 38293 : spnego_state->state_position = SPNEGO_CLIENT_TARG;
718 :
719 38293 : return NT_STATUS_MORE_PROCESSING_REQUIRED;
720 : }
721 :
722 : static const struct spnego_neg_ops gensec_spnego_client_negTokenInit_ops = {
723 : .name = "client_negTokenInit",
724 : .start_fn = gensec_spnego_client_negTokenInit_start,
725 : .step_fn = gensec_spnego_client_negTokenInit_step,
726 : .finish_fn = gensec_spnego_client_negTokenInit_finish,
727 : };
728 :
729 106227 : static NTSTATUS gensec_spnego_client_negTokenTarg_start(
730 : struct gensec_security *gensec_security,
731 : struct spnego_state *spnego_state,
732 : struct spnego_neg_state *n,
733 : struct spnego_data *spnego_in,
734 : TALLOC_CTX *in_mem_ctx,
735 : DATA_BLOB *in_next)
736 : {
737 106227 : struct spnego_negTokenTarg *ta = &spnego_in->negTokenTarg;
738 1262 : NTSTATUS status;
739 :
740 106227 : spnego_state->num_targs++;
741 :
742 106227 : if (ta->negResult == SPNEGO_REJECT) {
743 0 : return NT_STATUS_LOGON_FAILURE;
744 : }
745 :
746 106227 : if (ta->negResult == SPNEGO_REQUEST_MIC) {
747 2 : spnego_state->mic_requested = true;
748 : }
749 :
750 106227 : if (ta->mechListMIC.length > 0) {
751 37954 : DATA_BLOB *m = &ta->mechListMIC;
752 37954 : const DATA_BLOB *r = &ta->responseToken;
753 :
754 : /*
755 : * Windows 2000 has a bug, it repeats the
756 : * responseToken in the mechListMIC field.
757 : */
758 37954 : if (m->length == r->length) {
759 0 : int cmp;
760 :
761 3380 : cmp = memcmp(m->data, r->data, m->length);
762 3380 : if (cmp == 0) {
763 3380 : data_blob_free(m);
764 : }
765 : }
766 : }
767 :
768 : /* Server didn't like our choice of mech, and chose something else */
769 106227 : if (((ta->negResult == SPNEGO_ACCEPT_INCOMPLETE) ||
770 64150 : (ta->negResult == SPNEGO_REQUEST_MIC)) &&
771 41305 : ta->supportedMech != NULL &&
772 41305 : strcmp(ta->supportedMech, spnego_state->neg_oid) != 0)
773 : {
774 2 : const char *client_mech = NULL;
775 2 : const char *client_oid = NULL;
776 2 : const char *server_mech = NULL;
777 2 : const char *server_oid = NULL;
778 :
779 2 : client_mech = gensec_get_name_by_oid(gensec_security,
780 : spnego_state->neg_oid);
781 2 : client_oid = spnego_state->neg_oid;
782 2 : server_mech = gensec_get_name_by_oid(gensec_security,
783 : ta->supportedMech);
784 2 : server_oid = ta->supportedMech;
785 :
786 2 : DBG_NOTICE("client preferred mech (%s[%s]) not accepted, "
787 : "server wants: %s[%s]\n",
788 : client_mech, client_oid, server_mech, server_oid);
789 :
790 2 : spnego_state->downgraded = true;
791 2 : gensec_spnego_reset_sub_sec(spnego_state);
792 :
793 2 : status = gensec_subcontext_start(spnego_state,
794 : gensec_security,
795 : &spnego_state->sub_sec_security);
796 2 : if (!NT_STATUS_IS_OK(status)) {
797 0 : return status;
798 : }
799 :
800 : /* select the sub context */
801 2 : status = gensec_start_mech_by_oid(spnego_state->sub_sec_security,
802 : ta->supportedMech);
803 2 : if (!NT_STATUS_IS_OK(status)) {
804 0 : return status;
805 : }
806 :
807 2 : spnego_state->neg_oid = talloc_strdup(spnego_state,
808 : ta->supportedMech);
809 2 : if (spnego_state->neg_oid == NULL) {
810 0 : return NT_STATUS_NO_MEMORY;
811 : }
812 : }
813 :
814 106227 : if (ta->mechListMIC.length > 0) {
815 34574 : if (spnego_state->sub_sec_ready) {
816 34570 : spnego_state->needs_mic_check = true;
817 : }
818 : }
819 :
820 106227 : if (spnego_state->needs_mic_check) {
821 34574 : if (ta->responseToken.length != 0) {
822 0 : DBG_WARNING("non empty response token not expected\n");
823 0 : return NT_STATUS_INVALID_PARAMETER;
824 : }
825 :
826 34574 : if (ta->mechListMIC.length == 0
827 4 : && spnego_state->may_skip_mic_check) {
828 : /*
829 : * In this case we don't require
830 : * a mechListMIC from the server.
831 : *
832 : * This works around bugs in the Azure
833 : * and Apple spnego implementations.
834 : *
835 : * See
836 : * https://bugzilla.samba.org/show_bug.cgi?id=11994
837 : */
838 2 : spnego_state->needs_mic_check = false;
839 2 : return NT_STATUS_OK;
840 : }
841 :
842 34796 : status = gensec_check_packet(spnego_state->sub_sec_security,
843 34348 : spnego_state->mech_types.data,
844 : spnego_state->mech_types.length,
845 34572 : spnego_state->mech_types.data,
846 : spnego_state->mech_types.length,
847 34572 : &ta->mechListMIC);
848 34572 : if (!NT_STATUS_IS_OK(status)) {
849 2 : DBG_WARNING("failed to verify mechListMIC: %s\n",
850 : nt_errstr(status));
851 2 : return status;
852 : }
853 34570 : spnego_state->needs_mic_check = false;
854 34570 : spnego_state->done_mic_check = true;
855 34570 : return NT_STATUS_OK;
856 : }
857 :
858 71653 : if (!spnego_state->sub_sec_ready) {
859 68702 : *in_next = ta->responseToken;
860 68702 : return NT_STATUS_MORE_PROCESSING_REQUIRED;
861 : }
862 :
863 2951 : return NT_STATUS_OK;
864 : }
865 :
866 98 : static NTSTATUS gensec_spnego_client_negTokenTarg_step(
867 : struct gensec_security *gensec_security,
868 : struct spnego_state *spnego_state,
869 : struct spnego_neg_state *n,
870 : struct spnego_data *spnego_in,
871 : NTSTATUS last_status,
872 : TALLOC_CTX *in_mem_ctx,
873 : DATA_BLOB *in_next)
874 : {
875 98 : if (GENSEC_UPDATE_IS_NTERROR(last_status)) {
876 98 : DBG_WARNING("SPNEGO(%s) login failed: %s\n",
877 : spnego_state->sub_sec_security->ops->name,
878 : nt_errstr(last_status));
879 98 : return last_status;
880 : }
881 :
882 : /*
883 : * This should never be reached!
884 : * The step function is only called on errors!
885 : */
886 0 : smb_panic(__location__);
887 : return NT_STATUS_INTERNAL_ERROR;
888 : }
889 :
890 106127 : static NTSTATUS gensec_spnego_client_negTokenTarg_finish(
891 : struct gensec_security *gensec_security,
892 : struct spnego_state *spnego_state,
893 : struct spnego_neg_state *n,
894 : struct spnego_data *spnego_in,
895 : NTSTATUS sub_status,
896 : const DATA_BLOB sub_out,
897 : TALLOC_CTX *out_mem_ctx,
898 : DATA_BLOB *out)
899 : {
900 106127 : const struct spnego_negTokenTarg *ta =
901 : &spnego_in->negTokenTarg;
902 106127 : DATA_BLOB mech_list_mic = data_blob_null;
903 1262 : NTSTATUS status;
904 1262 : struct spnego_data spnego_out;
905 :
906 106127 : if (!spnego_state->sub_sec_ready) {
907 : /*
908 : * We're not yet ready to deal with signatures.
909 : */
910 8 : goto client_response;
911 : }
912 :
913 106119 : if (spnego_state->done_mic_check) {
914 : /*
915 : * We already checked the mic,
916 : * either the in last round here
917 : * in gensec_spnego_client_negTokenTarg_finish()
918 : * or during this round in
919 : * gensec_spnego_client_negTokenTarg_start().
920 : *
921 : * Both cases we're sure we don't have to
922 : * call gensec_sign_packet().
923 : */
924 34574 : goto client_response;
925 : }
926 :
927 71545 : if (spnego_state->may_skip_mic_check) {
928 : /*
929 : * This can only be set during
930 : * the last round here in
931 : * gensec_spnego_client_negTokenTarg_finish()
932 : * below. And during this round
933 : * we already passed the checks in
934 : * gensec_spnego_client_negTokenTarg_start().
935 : *
936 : * So we need to skip to deal with
937 : * any signatures now.
938 : */
939 1142 : goto client_response;
940 : }
941 :
942 70403 : if (!spnego_state->done_mic_check) {
943 70403 : bool have_sign = true;
944 70403 : bool new_spnego = false;
945 :
946 70403 : have_sign = gensec_have_feature(spnego_state->sub_sec_security,
947 : GENSEC_FEATURE_SIGN);
948 70403 : if (spnego_state->simulate_w2k) {
949 293 : have_sign = false;
950 : }
951 70403 : new_spnego = gensec_have_feature(spnego_state->sub_sec_security,
952 : GENSEC_FEATURE_NEW_SPNEGO);
953 :
954 70403 : switch (ta->negResult) {
955 29204 : case SPNEGO_ACCEPT_COMPLETED:
956 : case SPNEGO_NONE_RESULT:
957 29204 : if (spnego_state->num_targs == 1) {
958 : /*
959 : * the first exchange doesn't require
960 : * verification
961 : */
962 27591 : new_spnego = false;
963 : }
964 :
965 28420 : break;
966 :
967 41199 : case SPNEGO_ACCEPT_INCOMPLETE:
968 41199 : if (ta->mechListMIC.length > 0) {
969 4 : new_spnego = true;
970 4 : break;
971 : }
972 :
973 41195 : if (spnego_state->downgraded) {
974 : /*
975 : * A downgrade should be protected if
976 : * supported
977 : */
978 2 : break;
979 : }
980 :
981 : /*
982 : * The caller may just asked for
983 : * GENSEC_FEATURE_SESSION_KEY, this
984 : * is only reflected in the want_features.
985 : *
986 : * As it will imply
987 : * gensec_have_features(GENSEC_FEATURE_SIGN)
988 : * to return true.
989 : */
990 41193 : if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
991 16153 : break;
992 : }
993 24944 : if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
994 329 : break;
995 : }
996 : /*
997 : * Here we're sure our preferred mech was
998 : * selected by the server and our caller doesn't
999 : * need GENSEC_FEATURE_SIGN nor
1000 : * GENSEC_FEATURE_SEAL support.
1001 : *
1002 : * In this case we don't require
1003 : * a mechListMIC from the server.
1004 : *
1005 : * This works around bugs in the Azure
1006 : * and Apple spnego implementations.
1007 : *
1008 : * See
1009 : * https://bugzilla.samba.org/show_bug.cgi?id=11994
1010 : */
1011 24615 : spnego_state->may_skip_mic_check = true;
1012 24615 : break;
1013 :
1014 0 : case SPNEGO_REQUEST_MIC:
1015 0 : if (ta->mechListMIC.length > 0) {
1016 0 : new_spnego = true;
1017 : }
1018 0 : break;
1019 0 : default:
1020 0 : break;
1021 : }
1022 :
1023 70403 : if (spnego_state->mic_requested) {
1024 2 : if (have_sign) {
1025 2 : new_spnego = true;
1026 : }
1027 : }
1028 :
1029 70403 : if (have_sign && new_spnego) {
1030 38339 : spnego_state->needs_mic_check = true;
1031 38339 : spnego_state->needs_mic_sign = true;
1032 : }
1033 : }
1034 :
1035 70403 : if (ta->mechListMIC.length > 0) {
1036 4 : status = gensec_check_packet(spnego_state->sub_sec_security,
1037 4 : spnego_state->mech_types.data,
1038 : spnego_state->mech_types.length,
1039 4 : spnego_state->mech_types.data,
1040 : spnego_state->mech_types.length,
1041 : &ta->mechListMIC);
1042 4 : if (!NT_STATUS_IS_OK(status)) {
1043 0 : DBG_WARNING("failed to verify mechListMIC: %s\n",
1044 : nt_errstr(status));
1045 0 : return status;
1046 : }
1047 4 : spnego_state->needs_mic_check = false;
1048 4 : spnego_state->done_mic_check = true;
1049 : }
1050 :
1051 70403 : if (spnego_state->needs_mic_sign) {
1052 38573 : status = gensec_sign_packet(spnego_state->sub_sec_security,
1053 : n,
1054 38105 : spnego_state->mech_types.data,
1055 : spnego_state->mech_types.length,
1056 38339 : spnego_state->mech_types.data,
1057 : spnego_state->mech_types.length,
1058 : &mech_list_mic);
1059 38339 : if (!NT_STATUS_IS_OK(status)) {
1060 0 : DBG_WARNING("failed to sign mechListMIC: %s\n",
1061 : nt_errstr(status));
1062 0 : return status;
1063 : }
1064 38339 : spnego_state->needs_mic_sign = false;
1065 : }
1066 :
1067 32064 : client_response:
1068 106127 : if (sub_out.length == 0 && mech_list_mic.length == 0) {
1069 64920 : *out = data_blob_null;
1070 :
1071 64920 : if (!spnego_state->sub_sec_ready) {
1072 : /* somethings wrong here... */
1073 0 : DBG_ERR("gensec_update not ready without output\n");
1074 0 : return NT_STATUS_INTERNAL_ERROR;
1075 : }
1076 :
1077 64920 : if (ta->negResult != SPNEGO_ACCEPT_COMPLETED) {
1078 : /* unless of course it did not accept */
1079 0 : DBG_WARNING("gensec_update ok but not accepted\n");
1080 0 : return NT_STATUS_INVALID_PARAMETER;
1081 : }
1082 :
1083 64920 : if (!spnego_state->needs_mic_check) {
1084 64920 : spnego_state->state_position = SPNEGO_DONE;
1085 64920 : return NT_STATUS_OK;
1086 : }
1087 : }
1088 :
1089 : /* compose reply */
1090 41207 : spnego_out.type = SPNEGO_NEG_TOKEN_TARG;
1091 41207 : spnego_out.negTokenTarg.negResult = SPNEGO_NONE_RESULT;
1092 41207 : spnego_out.negTokenTarg.supportedMech = NULL;
1093 41207 : spnego_out.negTokenTarg.responseToken = sub_out;
1094 41207 : spnego_out.negTokenTarg.mechListMIC = mech_list_mic;
1095 :
1096 41207 : if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
1097 0 : DBG_WARNING("Failed to write NEG_TOKEN_TARG\n");
1098 0 : return NT_STATUS_INVALID_PARAMETER;
1099 : }
1100 :
1101 41207 : spnego_state->num_targs++;
1102 :
1103 : /* set next state */
1104 41207 : spnego_state->state_position = SPNEGO_CLIENT_TARG;
1105 41207 : spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
1106 :
1107 41207 : return NT_STATUS_MORE_PROCESSING_REQUIRED;
1108 : }
1109 :
1110 : static const struct spnego_neg_ops gensec_spnego_client_negTokenTarg_ops = {
1111 : .name = "client_negTokenTarg",
1112 : .start_fn = gensec_spnego_client_negTokenTarg_start,
1113 : .step_fn = gensec_spnego_client_negTokenTarg_step,
1114 : .finish_fn = gensec_spnego_client_negTokenTarg_finish,
1115 : };
1116 :
1117 : /** create a server negTokenTarg
1118 : *
1119 : * This is the case, where the client is the first one who sends data
1120 : */
1121 :
1122 106315 : static NTSTATUS gensec_spnego_server_response(struct spnego_state *spnego_state,
1123 : TALLOC_CTX *out_mem_ctx,
1124 : NTSTATUS nt_status,
1125 : const DATA_BLOB unwrapped_out,
1126 : DATA_BLOB mech_list_mic,
1127 : DATA_BLOB *out)
1128 : {
1129 1264 : struct spnego_data spnego_out;
1130 :
1131 : /* compose reply */
1132 106315 : spnego_out.type = SPNEGO_NEG_TOKEN_TARG;
1133 106315 : spnego_out.negTokenTarg.responseToken = unwrapped_out;
1134 106315 : spnego_out.negTokenTarg.mechListMIC = mech_list_mic;
1135 106315 : spnego_out.negTokenTarg.supportedMech = NULL;
1136 :
1137 106315 : if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1138 41184 : spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
1139 41184 : if (spnego_state->mic_requested) {
1140 2 : spnego_out.negTokenTarg.negResult = SPNEGO_REQUEST_MIC;
1141 2 : spnego_state->mic_requested = false;
1142 : } else {
1143 41182 : spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
1144 : }
1145 41184 : spnego_state->state_position = SPNEGO_SERVER_TARG;
1146 65131 : } else if (NT_STATUS_IS_OK(nt_status)) {
1147 65131 : if (unwrapped_out.data) {
1148 27674 : spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
1149 : }
1150 65131 : spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
1151 65131 : spnego_state->state_position = SPNEGO_DONE;
1152 : }
1153 :
1154 106315 : if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
1155 0 : DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_TARG\n"));
1156 0 : return NT_STATUS_INVALID_PARAMETER;
1157 : }
1158 :
1159 106315 : spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
1160 106315 : spnego_state->num_targs++;
1161 :
1162 106315 : return nt_status;
1163 : }
1164 :
1165 69051 : static NTSTATUS gensec_spnego_server_negTokenInit_start(
1166 : struct gensec_security *gensec_security,
1167 : struct spnego_state *spnego_state,
1168 : struct spnego_neg_state *n,
1169 : struct spnego_data *spnego_in,
1170 : TALLOC_CTX *in_mem_ctx,
1171 : DATA_BLOB *in_next)
1172 : {
1173 1029 : bool ok;
1174 :
1175 69051 : n->mech_idx = 0;
1176 69051 : n->mech_types = spnego_in->negTokenInit.mechTypes;
1177 69051 : if (n->mech_types == NULL) {
1178 0 : return NT_STATUS_INVALID_PARAMETER;
1179 : }
1180 :
1181 69051 : n->all_idx = 0;
1182 69051 : n->all_sec = gensec_security_by_oid_list(gensec_security,
1183 : n, n->mech_types,
1184 : GENSEC_OID_SPNEGO);
1185 69051 : if (n->all_sec == NULL) {
1186 0 : DBG_WARNING("gensec_security_by_oid_list() failed\n");
1187 0 : return NT_STATUS_INVALID_PARAMETER;
1188 : }
1189 :
1190 69051 : ok = spnego_write_mech_types(spnego_state,
1191 : n->mech_types,
1192 : &spnego_state->mech_types);
1193 69051 : if (!ok) {
1194 0 : DBG_ERR("Failed to write mechTypes\n");
1195 0 : return NT_STATUS_NO_MEMORY;
1196 : }
1197 :
1198 69051 : return n->ops->step_fn(gensec_security, spnego_state, n,
1199 69051 : spnego_in, NT_STATUS_OK, in_mem_ctx, in_next);
1200 : }
1201 :
1202 69056 : static NTSTATUS gensec_spnego_server_negTokenInit_step(
1203 : struct gensec_security *gensec_security,
1204 : struct spnego_state *spnego_state,
1205 : struct spnego_neg_state *n,
1206 : struct spnego_data *spnego_in,
1207 : NTSTATUS last_status,
1208 : TALLOC_CTX *in_mem_ctx,
1209 : DATA_BLOB *in_next)
1210 : {
1211 69056 : if (!NT_STATUS_IS_OK(last_status)) {
1212 5 : const struct gensec_security_ops_wrapper *cur_sec =
1213 5 : &n->all_sec[n->all_idx];
1214 5 : const char *next_mech = n->mech_types[n->mech_idx+1];
1215 5 : const struct gensec_security_ops_wrapper *next_sec = NULL;
1216 5 : const char *next = NULL;
1217 5 : int dbg_level = DBGLVL_WARNING;
1218 5 : bool allow_fallback = false;
1219 5 : NTSTATUS status = last_status;
1220 0 : size_t i;
1221 :
1222 8 : for (i = 0; next_mech != NULL && n->all_sec[i].op != NULL; i++) {
1223 3 : if (strcmp(next_mech, n->all_sec[i].oid) != 0) {
1224 3 : continue;
1225 : }
1226 :
1227 0 : next_sec = &n->all_sec[i];
1228 0 : break;
1229 : }
1230 :
1231 5 : if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER) ||
1232 5 : NT_STATUS_EQUAL(status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO))
1233 : {
1234 0 : allow_fallback = true;
1235 : }
1236 :
1237 5 : if (allow_fallback && next_sec != NULL) {
1238 0 : next = next_sec->op->name;
1239 0 : dbg_level = DBGLVL_NOTICE;
1240 : }
1241 :
1242 5 : DBG_PREFIX(dbg_level, (
1243 : "%s: parsing NEG_TOKEN_INIT content failed "
1244 : "(next[%s]): %s\n", cur_sec->op->name,
1245 : next, nt_errstr(status)));
1246 :
1247 5 : if (next == NULL) {
1248 : /*
1249 : * A hard error without a possible fallback.
1250 : */
1251 5 : return status;
1252 : }
1253 :
1254 : /*
1255 : * Pretend we never started it
1256 : */
1257 0 : gensec_spnego_reset_sub_sec(spnego_state);
1258 :
1259 : /*
1260 : * And try the next one, based on the clients
1261 : * mech type list...
1262 : */
1263 0 : n->mech_idx += 1;
1264 : }
1265 :
1266 : /*
1267 : * we always reset all_idx here, as the negotiation is
1268 : * done via mech_idx!
1269 : */
1270 69051 : n->all_idx = 0;
1271 :
1272 69059 : for (; n->mech_types[n->mech_idx] != NULL; n->mech_idx++) {
1273 69057 : const char *cur_mech = n->mech_types[n->mech_idx];
1274 69057 : const struct gensec_security_ops_wrapper *cur_sec = NULL;
1275 1029 : NTSTATUS status;
1276 69057 : DATA_BLOB sub_in = data_blob_null;
1277 1029 : size_t i;
1278 :
1279 69061 : for (i = 0; n->all_sec[i].op != NULL; i++) {
1280 69053 : if (strcmp(cur_mech, n->all_sec[i].oid) != 0) {
1281 4 : continue;
1282 : }
1283 :
1284 69049 : cur_sec = &n->all_sec[i];
1285 69049 : n->all_idx = i;
1286 69049 : break;
1287 : }
1288 :
1289 69057 : if (cur_sec == NULL) {
1290 8 : continue;
1291 : }
1292 :
1293 69049 : status = gensec_subcontext_start(spnego_state,
1294 : gensec_security,
1295 : &spnego_state->sub_sec_security);
1296 69049 : if (!NT_STATUS_IS_OK(status)) {
1297 68020 : return status;
1298 : }
1299 :
1300 : /* select the sub context */
1301 70078 : status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
1302 69049 : cur_sec->op);
1303 69049 : if (!NT_STATUS_IS_OK(status)) {
1304 : /*
1305 : * Pretend we never started it
1306 : */
1307 0 : gensec_spnego_reset_sub_sec(spnego_state);
1308 0 : continue;
1309 : }
1310 :
1311 69049 : if (n->mech_idx == 0) {
1312 : /*
1313 : * We can use the optimistic token.
1314 : */
1315 69047 : sub_in = spnego_in->negTokenInit.mechToken;
1316 : } else {
1317 : /*
1318 : * Indicate the downgrade and request a
1319 : * mic.
1320 : */
1321 2 : spnego_state->downgraded = true;
1322 2 : spnego_state->mic_requested = true;
1323 : }
1324 :
1325 69049 : if (sub_in.length == 0) {
1326 8 : spnego_state->no_optimistic = true;
1327 : }
1328 :
1329 : /*
1330 : * Note that 'cur_sec' is temporary memory, but
1331 : * cur_sec->oid points to a const string in the
1332 : * backends gensec_security_ops structure.
1333 : */
1334 69049 : spnego_state->neg_oid = cur_sec->oid;
1335 :
1336 : /* we need some content from the mech */
1337 69049 : *in_next = sub_in;
1338 69049 : return NT_STATUS_MORE_PROCESSING_REQUIRED;
1339 : }
1340 :
1341 2 : DBG_WARNING("Could not find a suitable mechtype in NEG_TOKEN_INIT\n");
1342 2 : return NT_STATUS_INVALID_PARAMETER;
1343 : }
1344 :
1345 69044 : static NTSTATUS gensec_spnego_server_negTokenInit_finish(
1346 : struct gensec_security *gensec_security,
1347 : struct spnego_state *spnego_state,
1348 : struct spnego_neg_state *n,
1349 : struct spnego_data *spnego_in,
1350 : NTSTATUS sub_status,
1351 : const DATA_BLOB sub_out,
1352 : TALLOC_CTX *out_mem_ctx,
1353 : DATA_BLOB *out)
1354 : {
1355 69044 : DATA_BLOB mech_list_mic = data_blob_null;
1356 :
1357 69044 : if (spnego_state->simulate_w2k) {
1358 : /*
1359 : * Windows 2000 returns the unwrapped token
1360 : * also in the mech_list_mic field.
1361 : *
1362 : * In order to verify our client code,
1363 : * we need a way to have a server with this
1364 : * broken behaviour
1365 : */
1366 3430 : mech_list_mic = sub_out;
1367 : }
1368 :
1369 69044 : return gensec_spnego_server_response(spnego_state,
1370 : out_mem_ctx,
1371 : sub_status,
1372 : sub_out,
1373 : mech_list_mic,
1374 : out);
1375 : }
1376 :
1377 : static const struct spnego_neg_ops gensec_spnego_server_negTokenInit_ops = {
1378 : .name = "server_negTokenInit",
1379 : .start_fn = gensec_spnego_server_negTokenInit_start,
1380 : .step_fn = gensec_spnego_server_negTokenInit_step,
1381 : .finish_fn = gensec_spnego_server_negTokenInit_finish,
1382 : };
1383 :
1384 41062 : static NTSTATUS gensec_spnego_server_negTokenTarg_start(
1385 : struct gensec_security *gensec_security,
1386 : struct spnego_state *spnego_state,
1387 : struct spnego_neg_state *n,
1388 : struct spnego_data *spnego_in,
1389 : TALLOC_CTX *in_mem_ctx,
1390 : DATA_BLOB *in_next)
1391 : {
1392 41062 : const struct spnego_negTokenTarg *ta = &spnego_in->negTokenTarg;
1393 244 : NTSTATUS status;
1394 :
1395 41062 : spnego_state->num_targs++;
1396 :
1397 41062 : if (spnego_state->sub_sec_security == NULL) {
1398 0 : DBG_ERR("SPNEGO: Did not setup a mech in NEG_TOKEN_INIT\n");
1399 0 : return NT_STATUS_INVALID_PARAMETER;
1400 : }
1401 :
1402 41062 : if (spnego_state->needs_mic_check) {
1403 4 : if (ta->responseToken.length != 0) {
1404 0 : DBG_WARNING("non empty response token not expected\n");
1405 0 : return NT_STATUS_INVALID_PARAMETER;
1406 : }
1407 :
1408 4 : status = gensec_check_packet(spnego_state->sub_sec_security,
1409 4 : spnego_state->mech_types.data,
1410 : spnego_state->mech_types.length,
1411 4 : spnego_state->mech_types.data,
1412 : spnego_state->mech_types.length,
1413 : &ta->mechListMIC);
1414 4 : if (!NT_STATUS_IS_OK(status)) {
1415 0 : DBG_WARNING("failed to verify mechListMIC: %s\n",
1416 : nt_errstr(status));
1417 0 : return status;
1418 : }
1419 :
1420 4 : spnego_state->needs_mic_check = false;
1421 4 : spnego_state->done_mic_check = true;
1422 4 : return NT_STATUS_OK;
1423 : }
1424 :
1425 41058 : if (!spnego_state->sub_sec_ready) {
1426 41058 : *in_next = ta->responseToken;
1427 41058 : return NT_STATUS_MORE_PROCESSING_REQUIRED;
1428 : }
1429 :
1430 0 : return NT_STATUS_OK;
1431 : }
1432 :
1433 3791 : static NTSTATUS gensec_spnego_server_negTokenTarg_step(
1434 : struct gensec_security *gensec_security,
1435 : struct spnego_state *spnego_state,
1436 : struct spnego_neg_state *n,
1437 : struct spnego_data *spnego_in,
1438 : NTSTATUS last_status,
1439 : TALLOC_CTX *in_mem_ctx,
1440 : DATA_BLOB *in_next)
1441 : {
1442 3791 : if (GENSEC_UPDATE_IS_NTERROR(last_status)) {
1443 3791 : DBG_NOTICE("SPNEGO(%s) login failed: %s\n",
1444 : spnego_state->sub_sec_security->ops->name,
1445 : nt_errstr(last_status));
1446 3791 : return last_status;
1447 : }
1448 :
1449 : /*
1450 : * This should never be reached!
1451 : * The step function is only called on errors!
1452 : */
1453 0 : smb_panic(__location__);
1454 : return NT_STATUS_INTERNAL_ERROR;
1455 : }
1456 :
1457 37271 : static NTSTATUS gensec_spnego_server_negTokenTarg_finish(
1458 : struct gensec_security *gensec_security,
1459 : struct spnego_state *spnego_state,
1460 : struct spnego_neg_state *n,
1461 : struct spnego_data *spnego_in,
1462 : NTSTATUS sub_status,
1463 : const DATA_BLOB sub_out,
1464 : TALLOC_CTX *out_mem_ctx,
1465 : DATA_BLOB *out)
1466 : {
1467 37271 : const struct spnego_negTokenTarg *ta = &spnego_in->negTokenTarg;
1468 37271 : DATA_BLOB mech_list_mic = data_blob_null;
1469 235 : NTSTATUS status;
1470 37271 : bool have_sign = true;
1471 37271 : bool new_spnego = false;
1472 :
1473 37271 : status = sub_status;
1474 :
1475 37271 : if (!spnego_state->sub_sec_ready) {
1476 : /*
1477 : * We're not yet ready to deal with signatures.
1478 : */
1479 4 : goto server_response;
1480 : }
1481 :
1482 37267 : if (spnego_state->done_mic_check) {
1483 : /*
1484 : * We already checked the mic,
1485 : * either the in last round here
1486 : * in gensec_spnego_server_negTokenTarg_finish()
1487 : * or during this round in
1488 : * gensec_spnego_server_negTokenTarg_start().
1489 : *
1490 : * Both cases we're sure we don't have to
1491 : * call gensec_sign_packet().
1492 : */
1493 4 : goto server_response;
1494 : }
1495 :
1496 37263 : have_sign = gensec_have_feature(spnego_state->sub_sec_security,
1497 : GENSEC_FEATURE_SIGN);
1498 37263 : if (spnego_state->simulate_w2k) {
1499 1644 : have_sign = false;
1500 : }
1501 37263 : new_spnego = gensec_have_feature(spnego_state->sub_sec_security,
1502 : GENSEC_FEATURE_NEW_SPNEGO);
1503 37263 : if (ta->mechListMIC.length > 0) {
1504 34392 : new_spnego = true;
1505 : }
1506 :
1507 37263 : if (have_sign && new_spnego) {
1508 34370 : spnego_state->needs_mic_check = true;
1509 34370 : spnego_state->needs_mic_sign = true;
1510 : }
1511 :
1512 37263 : if (have_sign && ta->mechListMIC.length > 0) {
1513 34591 : status = gensec_check_packet(spnego_state->sub_sec_security,
1514 34141 : spnego_state->mech_types.data,
1515 : spnego_state->mech_types.length,
1516 34366 : spnego_state->mech_types.data,
1517 : spnego_state->mech_types.length,
1518 : &ta->mechListMIC);
1519 34366 : if (!NT_STATUS_IS_OK(status)) {
1520 0 : DBG_WARNING("failed to verify mechListMIC: %s\n",
1521 : nt_errstr(status));
1522 0 : return status;
1523 : }
1524 :
1525 34366 : spnego_state->needs_mic_check = false;
1526 34366 : spnego_state->done_mic_check = true;
1527 : }
1528 :
1529 37263 : if (spnego_state->needs_mic_sign) {
1530 34595 : status = gensec_sign_packet(spnego_state->sub_sec_security,
1531 : n,
1532 34145 : spnego_state->mech_types.data,
1533 : spnego_state->mech_types.length,
1534 34370 : spnego_state->mech_types.data,
1535 : spnego_state->mech_types.length,
1536 : &mech_list_mic);
1537 34370 : if (!NT_STATUS_IS_OK(status)) {
1538 0 : DBG_WARNING("failed to sign mechListMIC: %s\n",
1539 : nt_errstr(status));
1540 0 : return status;
1541 : }
1542 34370 : spnego_state->needs_mic_sign = false;
1543 : }
1544 :
1545 37263 : if (spnego_state->needs_mic_check) {
1546 4 : status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1547 : }
1548 :
1549 37259 : server_response:
1550 37271 : return gensec_spnego_server_response(spnego_state,
1551 : out_mem_ctx,
1552 : status,
1553 : sub_out,
1554 : mech_list_mic,
1555 : out);
1556 : }
1557 :
1558 : static const struct spnego_neg_ops gensec_spnego_server_negTokenTarg_ops = {
1559 : .name = "server_negTokenTarg",
1560 : .start_fn = gensec_spnego_server_negTokenTarg_start,
1561 : .step_fn = gensec_spnego_server_negTokenTarg_step,
1562 : .finish_fn = gensec_spnego_server_negTokenTarg_finish,
1563 : };
1564 :
1565 : struct gensec_spnego_update_state {
1566 : struct tevent_context *ev;
1567 : struct gensec_security *gensec;
1568 : struct spnego_state *spnego;
1569 :
1570 : DATA_BLOB full_in;
1571 : struct spnego_data _spnego_in;
1572 : struct spnego_data *spnego_in;
1573 :
1574 : struct {
1575 : bool needed;
1576 : DATA_BLOB in;
1577 : NTSTATUS status;
1578 : DATA_BLOB out;
1579 : } sub;
1580 :
1581 : struct spnego_neg_state *n;
1582 :
1583 : NTSTATUS status;
1584 : DATA_BLOB out;
1585 : };
1586 :
1587 683708 : static void gensec_spnego_update_cleanup(struct tevent_req *req,
1588 : enum tevent_req_state req_state)
1589 : {
1590 10284 : struct gensec_spnego_update_state *state =
1591 683708 : tevent_req_data(req,
1592 : struct gensec_spnego_update_state);
1593 :
1594 683708 : switch (req_state) {
1595 4111 : case TEVENT_REQ_USER_ERROR:
1596 : case TEVENT_REQ_TIMED_OUT:
1597 : case TEVENT_REQ_NO_MEMORY:
1598 : /*
1599 : * A fatal error, further updates are not allowed.
1600 : */
1601 4111 : state->spnego->state_position = SPNEGO_DONE;
1602 4111 : break;
1603 669322 : default:
1604 669322 : break;
1605 : }
1606 683708 : }
1607 :
1608 : static NTSTATUS gensec_spnego_update_in(struct gensec_security *gensec_security,
1609 : const DATA_BLOB in, TALLOC_CTX *mem_ctx,
1610 : DATA_BLOB *full_in);
1611 : static void gensec_spnego_update_pre(struct tevent_req *req);
1612 : static void gensec_spnego_update_done(struct tevent_req *subreq);
1613 : static void gensec_spnego_update_post(struct tevent_req *req);
1614 : static NTSTATUS gensec_spnego_update_out(struct gensec_security *gensec_security,
1615 : TALLOC_CTX *out_mem_ctx,
1616 : DATA_BLOB *_out);
1617 :
1618 341854 : static struct tevent_req *gensec_spnego_update_send(TALLOC_CTX *mem_ctx,
1619 : struct tevent_context *ev,
1620 : struct gensec_security *gensec_security,
1621 : const DATA_BLOB in)
1622 : {
1623 5142 : struct spnego_state *spnego_state =
1624 341854 : talloc_get_type_abort(gensec_security->private_data,
1625 : struct spnego_state);
1626 341854 : struct tevent_req *req = NULL;
1627 341854 : struct gensec_spnego_update_state *state = NULL;
1628 5142 : NTSTATUS status;
1629 5142 : ssize_t len;
1630 :
1631 341854 : req = tevent_req_create(mem_ctx, &state,
1632 : struct gensec_spnego_update_state);
1633 341854 : if (req == NULL) {
1634 0 : return NULL;
1635 : }
1636 341854 : state->ev = ev;
1637 341854 : state->gensec = gensec_security;
1638 341854 : state->spnego = spnego_state;
1639 341854 : tevent_req_set_cleanup_fn(req, gensec_spnego_update_cleanup);
1640 :
1641 341854 : if (spnego_state->out_frag.length > 0) {
1642 1467 : if (in.length > 0) {
1643 0 : tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1644 0 : return tevent_req_post(req, ev);
1645 : }
1646 :
1647 1467 : status = gensec_spnego_update_out(gensec_security,
1648 1467 : state, &state->out);
1649 1467 : if (GENSEC_UPDATE_IS_NTERROR(status)) {
1650 0 : tevent_req_nterror(req, status);
1651 0 : return tevent_req_post(req, ev);
1652 : }
1653 :
1654 1467 : state->status = status;
1655 1467 : tevent_req_done(req);
1656 1467 : return tevent_req_post(req, ev);
1657 : }
1658 :
1659 345529 : status = gensec_spnego_update_in(gensec_security, in,
1660 340387 : state, &state->full_in);
1661 340387 : state->status = status;
1662 340387 : if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1663 1467 : tevent_req_done(req);
1664 1467 : return tevent_req_post(req, ev);
1665 : }
1666 338920 : if (tevent_req_nterror(req, status)) {
1667 0 : return tevent_req_post(req, ev);
1668 : }
1669 :
1670 : /* Check if we got a valid SPNEGO blob... */
1671 :
1672 338920 : switch (spnego_state->state_position) {
1673 102 : case SPNEGO_FALLBACK:
1674 102 : break;
1675 :
1676 147289 : case SPNEGO_CLIENT_TARG:
1677 : case SPNEGO_SERVER_TARG:
1678 147289 : if (state->full_in.length == 0) {
1679 0 : tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1680 0 : return tevent_req_post(req, ev);
1681 : }
1682 :
1683 5142 : FALL_THROUGH;
1684 : case SPNEGO_CLIENT_START:
1685 : case SPNEGO_SERVER_START:
1686 :
1687 338818 : if (state->full_in.length == 0) {
1688 : /* create_negTokenInit later */
1689 82505 : break;
1690 : }
1691 :
1692 254813 : len = spnego_read_data(state,
1693 251171 : state->full_in,
1694 251171 : &state->_spnego_in);
1695 254813 : if (len == -1) {
1696 147 : if (spnego_state->state_position != SPNEGO_SERVER_START) {
1697 0 : DEBUG(1, ("Invalid SPNEGO request:\n"));
1698 0 : dump_data(1, state->full_in.data,
1699 0 : state->full_in.length);
1700 0 : tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1701 0 : return tevent_req_post(req, ev);
1702 : }
1703 :
1704 : /*
1705 : * This is the 'fallback' case, where we don't get
1706 : * SPNEGO, and have to try all the other options (and
1707 : * hope they all have a magic string they check)
1708 : */
1709 147 : status = gensec_spnego_server_try_fallback(gensec_security,
1710 : spnego_state,
1711 : state,
1712 147 : state->full_in);
1713 147 : if (tevent_req_nterror(req, status)) {
1714 0 : return tevent_req_post(req, ev);
1715 : }
1716 :
1717 : /*
1718 : * We'll continue with SPNEGO_FALLBACK below...
1719 : */
1720 147 : break;
1721 : }
1722 254666 : state->spnego_in = &state->_spnego_in;
1723 :
1724 : /* OK, so it's real SPNEGO, check the packet's the one we expect */
1725 254666 : if (state->spnego_in->type != spnego_state->expected_packet) {
1726 0 : DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n",
1727 : state->spnego_in->type,
1728 : spnego_state->expected_packet));
1729 0 : dump_data(1, state->full_in.data,
1730 0 : state->full_in.length);
1731 0 : tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1732 0 : return tevent_req_post(req, ev);
1733 : }
1734 :
1735 251024 : break;
1736 :
1737 0 : default:
1738 0 : smb_panic(__location__);
1739 : return NULL;
1740 : }
1741 :
1742 338920 : gensec_spnego_update_pre(req);
1743 338920 : if (!tevent_req_is_in_progress(req)) {
1744 17 : return tevent_req_post(req, ev);
1745 : }
1746 :
1747 338903 : if (state->sub.needed) {
1748 250005 : struct tevent_req *subreq = NULL;
1749 :
1750 : /*
1751 : * We may need one more roundtrip...
1752 : */
1753 250005 : subreq = gensec_update_send(state, state->ev,
1754 : spnego_state->sub_sec_security,
1755 246373 : state->sub.in);
1756 250005 : if (tevent_req_nomem(subreq, req)) {
1757 0 : return tevent_req_post(req, ev);
1758 : }
1759 250005 : tevent_req_set_callback(subreq,
1760 : gensec_spnego_update_done,
1761 : req);
1762 250005 : state->sub.needed = false;
1763 250005 : return req;
1764 : }
1765 :
1766 88898 : gensec_spnego_update_post(req);
1767 88898 : if (!tevent_req_is_in_progress(req)) {
1768 88898 : return tevent_req_post(req, ev);
1769 : }
1770 :
1771 0 : return req;
1772 : }
1773 :
1774 340387 : static NTSTATUS gensec_spnego_update_in(struct gensec_security *gensec_security,
1775 : const DATA_BLOB in, TALLOC_CTX *mem_ctx,
1776 : DATA_BLOB *full_in)
1777 : {
1778 5142 : struct spnego_state *spnego_state =
1779 340387 : talloc_get_type_abort(gensec_security->private_data,
1780 : struct spnego_state);
1781 5142 : size_t expected;
1782 5142 : bool ok;
1783 :
1784 340387 : *full_in = data_blob_null;
1785 :
1786 340387 : switch (spnego_state->state_position) {
1787 102 : case SPNEGO_FALLBACK:
1788 102 : *full_in = in;
1789 102 : spnego_state->in_needed = 0;
1790 102 : return NT_STATUS_OK;
1791 :
1792 335143 : case SPNEGO_CLIENT_START:
1793 : case SPNEGO_CLIENT_TARG:
1794 : case SPNEGO_SERVER_START:
1795 : case SPNEGO_SERVER_TARG:
1796 340285 : break;
1797 :
1798 0 : case SPNEGO_DONE:
1799 : default:
1800 0 : return NT_STATUS_INVALID_PARAMETER;
1801 : }
1802 :
1803 340285 : if (spnego_state->in_needed == 0) {
1804 338818 : size_t size = 0;
1805 5142 : int ret;
1806 :
1807 : /*
1808 : * try to work out the size of the full
1809 : * input token, it might be fragmented
1810 : */
1811 338818 : ret = asn1_peek_full_tag(in, ASN1_APPLICATION(0), &size);
1812 338818 : if ((ret != 0) && (ret != EAGAIN)) {
1813 231396 : ret = asn1_peek_full_tag(in, ASN1_CONTEXT(1), &size);
1814 : }
1815 :
1816 338818 : if ((ret == 0) || (ret == EAGAIN)) {
1817 254711 : spnego_state->in_needed = size;
1818 : } else {
1819 : /*
1820 : * If it is not an asn1 message
1821 : * just call the next layer.
1822 : */
1823 84107 : spnego_state->in_needed = in.length;
1824 : }
1825 : }
1826 :
1827 340285 : if (spnego_state->in_needed > UINT16_MAX) {
1828 : /*
1829 : * limit the incoming message to 0xFFFF
1830 : * to avoid DoS attacks.
1831 : */
1832 0 : return NT_STATUS_INVALID_BUFFER_SIZE;
1833 : }
1834 :
1835 340285 : if ((spnego_state->in_needed > 0) && (in.length == 0)) {
1836 : /*
1837 : * If we reach this, we know we got at least
1838 : * part of an asn1 message, getting 0 means
1839 : * the remote peer wants us to spin.
1840 : */
1841 0 : return NT_STATUS_INVALID_PARAMETER;
1842 : }
1843 :
1844 340285 : expected = spnego_state->in_needed - spnego_state->in_frag.length;
1845 340285 : if (in.length > expected) {
1846 : /*
1847 : * we got more than expected
1848 : */
1849 0 : return NT_STATUS_INVALID_PARAMETER;
1850 : }
1851 :
1852 340285 : if (in.length == spnego_state->in_needed) {
1853 : /*
1854 : * if the in.length contains the full blob
1855 : * we are done.
1856 : *
1857 : * Note: this implies spnego_state->in_frag.length == 0,
1858 : * but we do not need to check this explicitly
1859 : * because we already know that we did not get
1860 : * more than expected.
1861 : */
1862 338814 : *full_in = in;
1863 338814 : spnego_state->in_needed = 0;
1864 338814 : return NT_STATUS_OK;
1865 : }
1866 :
1867 1471 : ok = data_blob_append(spnego_state, &spnego_state->in_frag,
1868 1471 : in.data, in.length);
1869 1471 : if (!ok) {
1870 0 : return NT_STATUS_NO_MEMORY;
1871 : }
1872 :
1873 1471 : if (spnego_state->in_needed > spnego_state->in_frag.length) {
1874 1467 : return NT_STATUS_MORE_PROCESSING_REQUIRED;
1875 : }
1876 :
1877 4 : *full_in = spnego_state->in_frag;
1878 4 : talloc_steal(mem_ctx, full_in->data);
1879 4 : spnego_state->in_frag = data_blob_null;
1880 4 : spnego_state->in_needed = 0;
1881 4 : return NT_STATUS_OK;
1882 : }
1883 :
1884 338920 : static void gensec_spnego_update_pre(struct tevent_req *req)
1885 : {
1886 5142 : struct gensec_spnego_update_state *state =
1887 338920 : tevent_req_data(req,
1888 : struct gensec_spnego_update_state);
1889 338920 : struct spnego_state *spnego_state = state->spnego;
1890 338920 : const struct spnego_neg_ops *ops = NULL;
1891 5142 : NTSTATUS status;
1892 :
1893 338920 : state->sub.needed = false;
1894 338920 : state->sub.in = data_blob_null;
1895 338920 : state->sub.status = NT_STATUS_INTERNAL_ERROR;
1896 338920 : state->sub.out = data_blob_null;
1897 :
1898 338920 : if (spnego_state->state_position == SPNEGO_FALLBACK) {
1899 249 : state->sub.in = state->full_in;
1900 249 : state->full_in = data_blob_null;
1901 249 : state->sub.needed = true;
1902 266 : return;
1903 : }
1904 :
1905 338671 : switch (spnego_state->state_position) {
1906 70974 : case SPNEGO_CLIENT_START:
1907 70974 : if (state->spnego_in == NULL) {
1908 : /* client to produce negTokenInit */
1909 32424 : ops = &gensec_spnego_create_negTokenInit_ops;
1910 32424 : break;
1911 : }
1912 :
1913 38326 : ops = &gensec_spnego_client_negTokenInit_ops;
1914 38326 : break;
1915 :
1916 104965 : case SPNEGO_CLIENT_TARG:
1917 104965 : ops = &gensec_spnego_client_negTokenTarg_ops;
1918 104965 : break;
1919 :
1920 120408 : case SPNEGO_SERVER_START:
1921 120408 : if (state->spnego_in == NULL) {
1922 : /* server to produce negTokenInit */
1923 50081 : ops = &gensec_spnego_create_negTokenInit_ops;
1924 50081 : break;
1925 : }
1926 :
1927 69051 : ops = &gensec_spnego_server_negTokenInit_ops;
1928 69051 : break;
1929 :
1930 41062 : case SPNEGO_SERVER_TARG:
1931 41062 : ops = &gensec_spnego_server_negTokenTarg_ops;
1932 41062 : break;
1933 :
1934 0 : default:
1935 0 : smb_panic(__location__);
1936 5142 : return;
1937 : }
1938 :
1939 338671 : state->n = gensec_spnego_neg_state(state, ops);
1940 338671 : if (tevent_req_nomem(state->n, req)) {
1941 0 : return;
1942 : }
1943 :
1944 338671 : status = ops->start_fn(state->gensec, spnego_state, state->n,
1945 : state->spnego_in, state, &state->sub.in);
1946 338671 : if (GENSEC_UPDATE_IS_NTERROR(status)) {
1947 17 : tevent_req_nterror(req, status);
1948 17 : return;
1949 : }
1950 :
1951 338654 : if (NT_STATUS_IS_OK(status)) {
1952 : /*
1953 : * Call finish_fn() with an empty
1954 : * blob and NT_STATUS_OK.
1955 : */
1956 88884 : state->sub.status = NT_STATUS_OK;
1957 249770 : } else if (spnego_state->state_position == SPNEGO_CLIENT_START &&
1958 70961 : spnego_state->no_optimistic) {
1959 : /*
1960 : * Skip optimistic token per conf.
1961 : */
1962 6 : state->sub.status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1963 249764 : } else if (spnego_state->state_position == SPNEGO_SERVER_START &&
1964 69049 : state->sub.in.length == 0 && spnego_state->no_optimistic) {
1965 : /*
1966 : * If we didn't like the mechanism for which the client sent us
1967 : * an optimistic token, or if he didn't send any, don't call
1968 : * the sub mechanism just yet.
1969 : */
1970 8 : state->sub.status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1971 8 : spnego_state->no_optimistic = false;
1972 : } else {
1973 : /*
1974 : * MORE_PROCESSING_REQUIRED =>
1975 : * we need to call gensec_update_send().
1976 : */
1977 249756 : state->sub.needed = true;
1978 : }
1979 : }
1980 :
1981 251251 : static void gensec_spnego_update_done(struct tevent_req *subreq)
1982 : {
1983 3632 : struct tevent_req *req =
1984 251251 : tevent_req_callback_data(subreq,
1985 : struct tevent_req);
1986 3632 : struct gensec_spnego_update_state *state =
1987 251251 : tevent_req_data(req,
1988 : struct gensec_spnego_update_state);
1989 251251 : struct spnego_state *spnego_state = state->spnego;
1990 :
1991 251251 : state->sub.status = gensec_update_recv(subreq, state, &state->sub.out);
1992 251251 : TALLOC_FREE(subreq);
1993 251251 : if (NT_STATUS_IS_OK(state->sub.status)) {
1994 134068 : spnego_state->sub_sec_ready = true;
1995 : }
1996 :
1997 251251 : gensec_spnego_update_post(req);
1998 251251 : }
1999 :
2000 340149 : static void gensec_spnego_update_post(struct tevent_req *req)
2001 : {
2002 5142 : struct gensec_spnego_update_state *state =
2003 340149 : tevent_req_data(req,
2004 : struct gensec_spnego_update_state);
2005 340149 : struct spnego_state *spnego_state = state->spnego;
2006 340149 : const struct spnego_neg_ops *ops = NULL;
2007 5142 : NTSTATUS status;
2008 :
2009 340149 : state->sub.in = data_blob_null;
2010 340149 : state->sub.needed = false;
2011 :
2012 340149 : if (spnego_state->state_position == SPNEGO_FALLBACK) {
2013 249 : status = state->sub.status;
2014 249 : spnego_state->out_frag = state->sub.out;
2015 249 : talloc_steal(spnego_state, spnego_state->out_frag.data);
2016 249 : state->sub.out = data_blob_null;
2017 249 : goto respond;
2018 : }
2019 :
2020 339900 : ops = state->n->ops;
2021 :
2022 339900 : if (GENSEC_UPDATE_IS_NTERROR(state->sub.status)) {
2023 :
2024 :
2025 : /*
2026 : * gensec_update_recv() returned an error,
2027 : * let's see if the step_fn() want to
2028 : * handle it and negotiate something else.
2029 : */
2030 :
2031 5340 : status = ops->step_fn(state->gensec,
2032 : spnego_state,
2033 : state->n,
2034 : state->spnego_in,
2035 : state->sub.status,
2036 : state,
2037 : &state->sub.in);
2038 5340 : if (GENSEC_UPDATE_IS_NTERROR(status)) {
2039 4094 : tevent_req_nterror(req, status);
2040 4094 : return;
2041 : }
2042 :
2043 1246 : state->sub.out = data_blob_null;
2044 1246 : state->sub.status = NT_STATUS_INTERNAL_ERROR;
2045 :
2046 1246 : if (NT_STATUS_IS_OK(status)) {
2047 : /*
2048 : * Call finish_fn() with an empty
2049 : * blob and NT_STATUS_OK.
2050 : */
2051 0 : state->sub.status = NT_STATUS_OK;
2052 : } else {
2053 : /*
2054 : * MORE_PROCESSING_REQUIRED...
2055 : */
2056 1246 : state->sub.needed = true;
2057 : }
2058 : }
2059 :
2060 335806 : if (state->sub.needed) {
2061 1246 : struct tevent_req *subreq = NULL;
2062 :
2063 : /*
2064 : * We may need one more roundtrip...
2065 : */
2066 1246 : subreq = gensec_update_send(state, state->ev,
2067 : spnego_state->sub_sec_security,
2068 : state->sub.in);
2069 1246 : if (tevent_req_nomem(subreq, req)) {
2070 0 : return;
2071 : }
2072 1246 : tevent_req_set_callback(subreq,
2073 : gensec_spnego_update_done,
2074 : req);
2075 1246 : state->sub.needed = false;
2076 1246 : return;
2077 : }
2078 :
2079 334560 : status = ops->finish_fn(state->gensec,
2080 : spnego_state,
2081 : state->n,
2082 : state->spnego_in,
2083 : state->sub.status,
2084 : state->sub.out,
2085 : spnego_state,
2086 : &spnego_state->out_frag);
2087 334560 : TALLOC_FREE(state->n);
2088 334560 : if (GENSEC_UPDATE_IS_NTERROR(status)) {
2089 0 : tevent_req_nterror(req, status);
2090 0 : return;
2091 : }
2092 :
2093 334560 : if (NT_STATUS_IS_OK(status)) {
2094 130051 : bool reset_full = true;
2095 :
2096 130051 : reset_full = !spnego_state->done_mic_check;
2097 :
2098 130051 : status = gensec_may_reset_crypto(spnego_state->sub_sec_security,
2099 : reset_full);
2100 130051 : if (tevent_req_nterror(req, status)) {
2101 0 : return;
2102 : }
2103 : }
2104 :
2105 334560 : respond:
2106 334809 : spnego_state->out_status = status;
2107 :
2108 334809 : status = gensec_spnego_update_out(state->gensec,
2109 : state, &state->out);
2110 334809 : if (GENSEC_UPDATE_IS_NTERROR(status)) {
2111 0 : tevent_req_nterror(req, status);
2112 0 : return;
2113 : }
2114 :
2115 334809 : state->status = status;
2116 334809 : tevent_req_done(req);
2117 334809 : return;
2118 : }
2119 :
2120 336276 : static NTSTATUS gensec_spnego_update_out(struct gensec_security *gensec_security,
2121 : TALLOC_CTX *out_mem_ctx,
2122 : DATA_BLOB *_out)
2123 : {
2124 5133 : struct spnego_state *spnego_state =
2125 336276 : talloc_get_type_abort(gensec_security->private_data,
2126 : struct spnego_state);
2127 336276 : DATA_BLOB out = data_blob_null;
2128 5133 : bool ok;
2129 :
2130 336276 : *_out = data_blob_null;
2131 :
2132 336276 : if (spnego_state->out_frag.length <= spnego_state->out_max_length) {
2133 : /*
2134 : * Fast path, we can deliver everything
2135 : */
2136 :
2137 334809 : *_out = spnego_state->out_frag;
2138 334809 : if (spnego_state->out_frag.length > 0) {
2139 269787 : talloc_steal(out_mem_ctx, _out->data);
2140 269787 : spnego_state->out_frag = data_blob_null;
2141 : }
2142 :
2143 334809 : if (!NT_STATUS_IS_OK(spnego_state->out_status)) {
2144 204611 : return spnego_state->out_status;
2145 : }
2146 :
2147 : /*
2148 : * We're completely done, further updates are not allowed.
2149 : */
2150 130198 : spnego_state->state_position = SPNEGO_DONE;
2151 130198 : return gensec_child_ready(gensec_security,
2152 : spnego_state->sub_sec_security);
2153 : }
2154 :
2155 1467 : out = spnego_state->out_frag;
2156 :
2157 : /*
2158 : * copy the remaining bytes
2159 : */
2160 1467 : spnego_state->out_frag = data_blob_talloc(spnego_state,
2161 : out.data + spnego_state->out_max_length,
2162 : out.length - spnego_state->out_max_length);
2163 1467 : if (spnego_state->out_frag.data == NULL) {
2164 0 : return NT_STATUS_NO_MEMORY;
2165 : }
2166 :
2167 : /*
2168 : * truncate the buffer
2169 : */
2170 1467 : ok = data_blob_realloc(spnego_state, &out,
2171 : spnego_state->out_max_length);
2172 1467 : if (!ok) {
2173 0 : return NT_STATUS_NO_MEMORY;
2174 : }
2175 :
2176 1467 : talloc_steal(out_mem_ctx, out.data);
2177 1467 : *_out = out;
2178 1467 : return NT_STATUS_MORE_PROCESSING_REQUIRED;
2179 : }
2180 :
2181 341854 : static NTSTATUS gensec_spnego_update_recv(struct tevent_req *req,
2182 : TALLOC_CTX *out_mem_ctx,
2183 : DATA_BLOB *out)
2184 : {
2185 5142 : struct gensec_spnego_update_state *state =
2186 341854 : tevent_req_data(req,
2187 : struct gensec_spnego_update_state);
2188 5142 : NTSTATUS status;
2189 :
2190 341854 : *out = data_blob_null;
2191 :
2192 341854 : if (tevent_req_is_nterror(req, &status)) {
2193 4111 : tevent_req_received(req);
2194 4111 : return status;
2195 : }
2196 :
2197 337743 : *out = state->out;
2198 337743 : talloc_steal(out_mem_ctx, state->out.data);
2199 337743 : status = state->status;
2200 337743 : tevent_req_received(req);
2201 337743 : return status;
2202 : }
2203 :
2204 : static const char *gensec_spnego_oids[] = {
2205 : GENSEC_OID_SPNEGO,
2206 : NULL
2207 : };
2208 :
2209 : static const struct gensec_security_ops gensec_spnego_security_ops = {
2210 : .name = "spnego",
2211 : .sasl_name = "GSS-SPNEGO",
2212 : .auth_type = DCERPC_AUTH_TYPE_SPNEGO,
2213 : .oid = gensec_spnego_oids,
2214 : .client_start = gensec_spnego_client_start,
2215 : .server_start = gensec_spnego_server_start,
2216 : .update_send = gensec_spnego_update_send,
2217 : .update_recv = gensec_spnego_update_recv,
2218 : .seal_packet = gensec_child_seal_packet,
2219 : .sign_packet = gensec_child_sign_packet,
2220 : .sig_size = gensec_child_sig_size,
2221 : .max_wrapped_size = gensec_child_max_wrapped_size,
2222 : .max_input_size = gensec_child_max_input_size,
2223 : .check_packet = gensec_child_check_packet,
2224 : .unseal_packet = gensec_child_unseal_packet,
2225 : .wrap = gensec_child_wrap,
2226 : .unwrap = gensec_child_unwrap,
2227 : .session_key = gensec_child_session_key,
2228 : .session_info = gensec_child_session_info,
2229 : .want_feature = gensec_child_want_feature,
2230 : .have_feature = gensec_child_have_feature,
2231 : .expire_time = gensec_child_expire_time,
2232 : .final_auth_type = gensec_child_final_auth_type,
2233 : .enabled = true,
2234 : .priority = GENSEC_SPNEGO,
2235 : .glue = true,
2236 : };
2237 :
2238 52291 : _PUBLIC_ NTSTATUS gensec_spnego_init(TALLOC_CTX *ctx)
2239 : {
2240 1208 : NTSTATUS ret;
2241 52291 : ret = gensec_register(ctx, &gensec_spnego_security_ops);
2242 52291 : if (!NT_STATUS_IS_OK(ret)) {
2243 0 : DEBUG(0,("Failed to register '%s' gensec backend!\n",
2244 : gensec_spnego_security_ops.name));
2245 0 : return ret;
2246 : }
2247 :
2248 52291 : return ret;
2249 : }
|
