gensec: clarify memory ownership for gensec_session_info() and gensec_session_key()
[samba.git] / source4 / auth / gensec / spnego.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    RFC2478 Compliant SPNEGO implementation
5    
6    Copyright (C) Jim McDonough <jmcd@us.ibm.com>      2003
7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
8    Copyright (C) Stefan Metzmacher <metze@samba.org>  2004-2008
9
10    This program is free software; you can redistribute it and/or modify
11    it under the terms of the GNU General Public License as published by
12    the Free Software Foundation; either version 3 of the License, or
13    (at your option) any later version.
14    
15    This program is distributed in the hope that it will be useful,
16    but WITHOUT ANY WARRANTY; without even the implied warranty of
17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18    GNU General Public License for more details.
19
20    
21    You should have received a copy of the GNU General Public License
22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "../libcli/auth/spnego.h"
27 #include "librpc/gen_ndr/ndr_dcerpc.h"
28 #include "auth/credentials/credentials.h"
29 #include "auth/gensec/gensec.h"
30 #include "auth/gensec/gensec_proto.h"
31 #include "auth/gensec/gensec_toplevel_proto.h"
32 #include "param/param.h"
33
34 _PUBLIC_ NTSTATUS gensec_spnego_init(void);
35
36 enum spnego_state_position {
37         SPNEGO_SERVER_START,
38         SPNEGO_CLIENT_START,
39         SPNEGO_SERVER_TARG,
40         SPNEGO_CLIENT_TARG,
41         SPNEGO_FALLBACK,
42         SPNEGO_DONE
43 };
44
45 struct spnego_state {
46         enum spnego_message_type expected_packet;
47         enum spnego_state_position state_position;
48         struct gensec_security *sub_sec_security;
49         bool no_response_expected;
50
51         const char *neg_oid;
52
53         DATA_BLOB mech_types;
54 };
55
56
57 static NTSTATUS gensec_spnego_client_start(struct gensec_security *gensec_security)
58 {
59         struct spnego_state *spnego_state;
60
61         spnego_state = talloc(gensec_security, struct spnego_state);
62         if (!spnego_state) {
63                 return NT_STATUS_NO_MEMORY;
64         }
65
66         spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
67         spnego_state->state_position = SPNEGO_CLIENT_START;
68         spnego_state->sub_sec_security = NULL;
69         spnego_state->no_response_expected = false;
70         spnego_state->mech_types = data_blob(NULL, 0);
71
72         gensec_security->private_data = spnego_state;
73         return NT_STATUS_OK;
74 }
75
76 static NTSTATUS gensec_spnego_server_start(struct gensec_security *gensec_security)
77 {
78         struct spnego_state *spnego_state;
79
80         spnego_state = talloc(gensec_security, struct spnego_state);            
81         if (!spnego_state) {
82                 return NT_STATUS_NO_MEMORY;
83         }
84
85         spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
86         spnego_state->state_position = SPNEGO_SERVER_START;
87         spnego_state->sub_sec_security = NULL;
88         spnego_state->no_response_expected = false;
89         spnego_state->mech_types = data_blob(NULL, 0);
90
91         gensec_security->private_data = spnego_state;
92         return NT_STATUS_OK;
93 }
94
95 /*
96   wrappers for the spnego_*() functions
97 */
98 static NTSTATUS gensec_spnego_unseal_packet(struct gensec_security *gensec_security, 
99                                             uint8_t *data, size_t length, 
100                                             const uint8_t *whole_pdu, size_t pdu_length, 
101                                             const DATA_BLOB *sig)
102 {
103         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
104
105         if (spnego_state->state_position != SPNEGO_DONE 
106             && spnego_state->state_position != SPNEGO_FALLBACK) {
107                 return NT_STATUS_INVALID_PARAMETER;
108         }
109         
110         return gensec_unseal_packet(spnego_state->sub_sec_security, 
111                                     data, length, 
112                                     whole_pdu, pdu_length,
113                                     sig); 
114 }
115
116 static NTSTATUS gensec_spnego_check_packet(struct gensec_security *gensec_security, 
117                                            const uint8_t *data, size_t length, 
118                                            const uint8_t *whole_pdu, size_t pdu_length, 
119                                            const DATA_BLOB *sig)
120 {
121         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
122
123         if (spnego_state->state_position != SPNEGO_DONE 
124             && spnego_state->state_position != SPNEGO_FALLBACK) {
125                 return NT_STATUS_INVALID_PARAMETER;
126         }
127         
128         return gensec_check_packet(spnego_state->sub_sec_security, 
129                                    data, length, 
130                                    whole_pdu, pdu_length,
131                                    sig);
132 }
133
134 static NTSTATUS gensec_spnego_seal_packet(struct gensec_security *gensec_security, 
135                                           TALLOC_CTX *mem_ctx, 
136                                           uint8_t *data, size_t length, 
137                                           const uint8_t *whole_pdu, size_t pdu_length, 
138                                           DATA_BLOB *sig)
139 {
140         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
141
142         if (spnego_state->state_position != SPNEGO_DONE 
143             && spnego_state->state_position != SPNEGO_FALLBACK) {
144                 return NT_STATUS_INVALID_PARAMETER;
145         }
146         
147         return gensec_seal_packet(spnego_state->sub_sec_security, 
148                                   mem_ctx, 
149                                   data, length, 
150                                   whole_pdu, pdu_length,
151                                   sig);
152 }
153
154 static NTSTATUS gensec_spnego_sign_packet(struct gensec_security *gensec_security, 
155                                           TALLOC_CTX *mem_ctx, 
156                                           const uint8_t *data, size_t length, 
157                                           const uint8_t *whole_pdu, size_t pdu_length, 
158                                           DATA_BLOB *sig)
159 {
160         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
161
162         if (spnego_state->state_position != SPNEGO_DONE 
163             && spnego_state->state_position != SPNEGO_FALLBACK) {
164                 return NT_STATUS_INVALID_PARAMETER;
165         }
166         
167         return gensec_sign_packet(spnego_state->sub_sec_security, 
168                                   mem_ctx, 
169                                   data, length, 
170                                   whole_pdu, pdu_length,
171                                   sig);
172 }
173
174 static NTSTATUS gensec_spnego_wrap(struct gensec_security *gensec_security, 
175                                    TALLOC_CTX *mem_ctx, 
176                                    const DATA_BLOB *in, 
177                                    DATA_BLOB *out)
178 {
179         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
180
181         if (spnego_state->state_position != SPNEGO_DONE 
182             && spnego_state->state_position != SPNEGO_FALLBACK) {
183                 DEBUG(1, ("gensec_spnego_wrap: wrong state for wrap\n"));
184                 return NT_STATUS_INVALID_PARAMETER;
185         }
186         
187         return gensec_wrap(spnego_state->sub_sec_security, 
188                            mem_ctx, in, out);
189 }
190
191 static NTSTATUS gensec_spnego_unwrap(struct gensec_security *gensec_security, 
192                                      TALLOC_CTX *mem_ctx, 
193                                      const DATA_BLOB *in, 
194                                      DATA_BLOB *out)
195 {
196         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
197
198         if (spnego_state->state_position != SPNEGO_DONE 
199             && spnego_state->state_position != SPNEGO_FALLBACK) {
200                 DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
201                 return NT_STATUS_INVALID_PARAMETER;
202         }
203         
204         return gensec_unwrap(spnego_state->sub_sec_security, 
205                              mem_ctx, in, out);
206 }
207
208 static NTSTATUS gensec_spnego_wrap_packets(struct gensec_security *gensec_security, 
209                                            TALLOC_CTX *mem_ctx, 
210                                            const DATA_BLOB *in, 
211                                            DATA_BLOB *out,
212                                            size_t *len_processed) 
213 {
214         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
215
216         if (spnego_state->state_position != SPNEGO_DONE 
217             && spnego_state->state_position != SPNEGO_FALLBACK) {
218                 DEBUG(1, ("gensec_spnego_wrap: wrong state for wrap\n"));
219                 return NT_STATUS_INVALID_PARAMETER;
220         }
221         
222         return gensec_wrap_packets(spnego_state->sub_sec_security, 
223                                    mem_ctx, in, out,
224                                    len_processed);
225 }
226
227 static NTSTATUS gensec_spnego_packet_full_request(struct gensec_security *gensec_security, 
228                                                 DATA_BLOB blob, size_t *size)
229 {
230         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
231
232         if (spnego_state->state_position != SPNEGO_DONE 
233             && spnego_state->state_position != SPNEGO_FALLBACK) {
234                 DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
235                 return NT_STATUS_INVALID_PARAMETER;
236         }
237         
238         return gensec_packet_full_request(spnego_state->sub_sec_security, 
239                                           blob, size);
240 }
241
242 static NTSTATUS gensec_spnego_unwrap_packets(struct gensec_security *gensec_security, 
243                                              TALLOC_CTX *mem_ctx, 
244                                              const DATA_BLOB *in, 
245                                              DATA_BLOB *out,
246                                              size_t *len_processed) 
247 {
248         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
249
250         if (spnego_state->state_position != SPNEGO_DONE 
251             && spnego_state->state_position != SPNEGO_FALLBACK) {
252                 DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
253                 return NT_STATUS_INVALID_PARAMETER;
254         }
255         
256         return gensec_unwrap_packets(spnego_state->sub_sec_security, 
257                                      mem_ctx, in, out,
258                                      len_processed);
259 }
260
261 static size_t gensec_spnego_sig_size(struct gensec_security *gensec_security, size_t data_size) 
262 {
263         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
264
265         if (spnego_state->state_position != SPNEGO_DONE 
266             && spnego_state->state_position != SPNEGO_FALLBACK) {
267                 return 0;
268         }
269         
270         return gensec_sig_size(spnego_state->sub_sec_security, data_size);
271 }
272
273 static size_t gensec_spnego_max_input_size(struct gensec_security *gensec_security) 
274 {
275         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
276
277         if (spnego_state->state_position != SPNEGO_DONE 
278             && spnego_state->state_position != SPNEGO_FALLBACK) {
279                 return 0;
280         }
281         
282         return gensec_max_input_size(spnego_state->sub_sec_security);
283 }
284
285 static size_t gensec_spnego_max_wrapped_size(struct gensec_security *gensec_security) 
286 {
287         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
288
289         if (spnego_state->state_position != SPNEGO_DONE 
290             && spnego_state->state_position != SPNEGO_FALLBACK) {
291                 return 0;
292         }
293         
294         return gensec_max_wrapped_size(spnego_state->sub_sec_security);
295 }
296
297 static NTSTATUS gensec_spnego_session_key(struct gensec_security *gensec_security, 
298                                           TALLOC_CTX *mem_ctx,
299                                           DATA_BLOB *session_key)
300 {
301         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
302         if (!spnego_state->sub_sec_security) {
303                 return NT_STATUS_INVALID_PARAMETER;
304         }
305         
306         return gensec_session_key(spnego_state->sub_sec_security, 
307                                   mem_ctx,
308                                   session_key);
309 }
310
311 static NTSTATUS gensec_spnego_session_info(struct gensec_security *gensec_security,
312                                            TALLOC_CTX *mem_ctx,
313                                            struct auth_session_info **session_info)
314 {
315         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
316         if (!spnego_state->sub_sec_security) {
317                 return NT_STATUS_INVALID_PARAMETER;
318         }
319         
320         return gensec_session_info(spnego_state->sub_sec_security, 
321                                    mem_ctx,
322                                    session_info);
323 }
324
325 /** Fallback to another GENSEC mechanism, based on magic strings 
326  *
327  * This is the 'fallback' case, where we don't get SPNEGO, and have to
328  * try all the other options (and hope they all have a magic string
329  * they check)
330 */
331
332 static NTSTATUS gensec_spnego_server_try_fallback(struct gensec_security *gensec_security, 
333                                                   struct spnego_state *spnego_state,
334                                                   TALLOC_CTX *out_mem_ctx, 
335                                                   const DATA_BLOB in, DATA_BLOB *out) 
336 {
337         int i,j;
338         struct gensec_security_ops **all_ops
339                 = gensec_security_mechs(gensec_security, out_mem_ctx);
340         for (i=0; all_ops[i]; i++) {
341                 bool is_spnego;
342                 NTSTATUS nt_status;
343
344                 if (gensec_security != NULL && 
345                                 !gensec_security_ops_enabled(all_ops[i], gensec_security))
346                     continue;
347
348                 if (!all_ops[i]->oid) {
349                         continue;
350                 }
351
352                 is_spnego = false;
353                 for (j=0; all_ops[i]->oid[j]; j++) {
354                         if (strcasecmp(GENSEC_OID_SPNEGO,all_ops[i]->oid[j]) == 0) {
355                                 is_spnego = true;
356                         }
357                 }
358                 if (is_spnego) {
359                         continue;
360                 }
361
362                 if (!all_ops[i]->magic) {
363                         continue;
364                 }
365
366                 nt_status = all_ops[i]->magic(gensec_security, &in);
367                 if (!NT_STATUS_IS_OK(nt_status)) {
368                         continue;
369                 }
370
371                 spnego_state->state_position = SPNEGO_FALLBACK;
372
373                 nt_status = gensec_subcontext_start(spnego_state, 
374                                                     gensec_security, 
375                                                     &spnego_state->sub_sec_security);
376
377                 if (!NT_STATUS_IS_OK(nt_status)) {
378                         return nt_status;
379                 }
380                 /* select the sub context */
381                 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
382                                                      all_ops[i]);
383                 if (!NT_STATUS_IS_OK(nt_status)) {
384                         return nt_status;
385                 }
386                 nt_status = gensec_update(spnego_state->sub_sec_security,
387                                           out_mem_ctx, in, out);
388                 return nt_status;
389         }
390         DEBUG(1, ("Failed to parse SPNEGO request\n"));
391         return NT_STATUS_INVALID_PARAMETER;
392         
393 }
394
395 /* 
396    Parse the netTokenInit, either from the client, to the server, or
397    from the server to the client.
398 */
399
400 static NTSTATUS gensec_spnego_parse_negTokenInit(struct gensec_security *gensec_security,
401                                                  struct spnego_state *spnego_state, 
402                                                  TALLOC_CTX *out_mem_ctx, 
403                                                  const char **mechType,
404                                                  const DATA_BLOB unwrapped_in, DATA_BLOB *unwrapped_out) 
405 {
406         int i;
407         NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
408         DATA_BLOB null_data_blob = data_blob(NULL,0);
409         bool ok;
410
411         const struct gensec_security_ops_wrapper *all_sec
412                 = gensec_security_by_oid_list(gensec_security, 
413                                               out_mem_ctx, 
414                                               mechType,
415                                               GENSEC_OID_SPNEGO);
416
417         ok = spnego_write_mech_types(spnego_state,
418                                      mechType,
419                                      &spnego_state->mech_types);
420         if (!ok) {
421                 DEBUG(1, ("SPNEGO: Failed to write mechTypes\n"));
422                 return NT_STATUS_NO_MEMORY;
423         }
424
425         if (spnego_state->state_position == SPNEGO_SERVER_START) {
426                 uint32_t j;
427                 for (j=0; mechType && mechType[j]; j++) {
428                         for (i=0; all_sec && all_sec[i].op; i++) {
429                                 nt_status = gensec_subcontext_start(spnego_state,
430                                                                     gensec_security,
431                                                                     &spnego_state->sub_sec_security);
432                                 if (!NT_STATUS_IS_OK(nt_status)) {
433                                         return nt_status;
434                                 }
435                                 /* select the sub context */
436                                 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
437                                                                      all_sec[i].op);
438                                 if (!NT_STATUS_IS_OK(nt_status)) {
439                                         talloc_free(spnego_state->sub_sec_security);
440                                         spnego_state->sub_sec_security = NULL;
441                                         break;
442                                 }
443
444                                 if (j > 0) {
445                                         /* no optimistic token */
446                                         spnego_state->neg_oid = all_sec[i].oid;
447                                         *unwrapped_out = data_blob_null;
448                                         nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
449                                         break;
450                                 }
451
452                                 nt_status = gensec_update(spnego_state->sub_sec_security,
453                                                           out_mem_ctx, 
454                                                           unwrapped_in,
455                                                           unwrapped_out);
456                                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) || 
457                                     NT_STATUS_EQUAL(nt_status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
458                                         /* Pretend we never started it (lets the first run find some incompatible demand) */
459                                         
460                                         DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed to parse contents: %s\n", 
461                                                   spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
462                                         talloc_free(spnego_state->sub_sec_security);
463                                         spnego_state->sub_sec_security = NULL;
464                                         break;
465                                 }
466
467                                 spnego_state->neg_oid = all_sec[i].oid;
468                                 break;
469                         }
470                         if (spnego_state->sub_sec_security) {
471                                 break;
472                         }
473                 }
474
475                 if (!spnego_state->sub_sec_security) {
476                         DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
477                         return NT_STATUS_INVALID_PARAMETER;
478                 }
479         }
480         
481         /* Having tried any optimistic token from the client (if we
482          * were the server), if we didn't get anywhere, walk our list
483          * in our preference order */
484         
485         if (!spnego_state->sub_sec_security) {
486                 for (i=0; all_sec && all_sec[i].op; i++) {
487                         nt_status = gensec_subcontext_start(spnego_state,
488                                                             gensec_security,
489                                                             &spnego_state->sub_sec_security);
490                         if (!NT_STATUS_IS_OK(nt_status)) {
491                                 return nt_status;
492                         }
493                         /* select the sub context */
494                         nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
495                                                              all_sec[i].op);
496                         if (!NT_STATUS_IS_OK(nt_status)) {
497                                 talloc_free(spnego_state->sub_sec_security);
498                                 spnego_state->sub_sec_security = NULL;
499                                 continue;
500                         }
501                         
502                         spnego_state->neg_oid = all_sec[i].oid;
503
504                         /* only get the helping start blob for the first OID */
505                         nt_status = gensec_update(spnego_state->sub_sec_security,
506                                                   out_mem_ctx, 
507                                                   null_data_blob, 
508                                                   unwrapped_out);
509
510                         /* it is likely that a NULL input token will
511                          * not be liked by most server mechs, but if
512                          * we are in the client, we want the first
513                          * update packet to be able to abort the use
514                          * of this mech */
515                         if (spnego_state->state_position != SPNEGO_SERVER_START) {
516                                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) || 
517                                     NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_LOGON_SERVERS) ||
518                                     NT_STATUS_EQUAL(nt_status, NT_STATUS_TIME_DIFFERENCE_AT_DC) ||
519                                     NT_STATUS_EQUAL(nt_status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
520                                         /* Pretend we never started it (lets the first run find some incompatible demand) */
521                                         
522                                         DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed to parse: %s\n", 
523                                                   spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
524                                         talloc_free(spnego_state->sub_sec_security);
525                                         spnego_state->sub_sec_security = NULL;
526                                         continue;
527                                 }
528                         }
529
530                         break;
531                 }
532         }
533
534         if (spnego_state->sub_sec_security) {
535                 /* it is likely that a NULL input token will
536                  * not be liked by most server mechs, but this
537                  * does the right thing in the CIFS client.
538                  * just push us along the merry-go-round
539                  * again, and hope for better luck next
540                  * time */
541                 
542                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
543                         *unwrapped_out = data_blob(NULL, 0);
544                         nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
545                 }
546                 
547                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) 
548                     && !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) 
549                     && !NT_STATUS_IS_OK(nt_status)) {
550                         DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed: %s\n", 
551                                   spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
552                         talloc_free(spnego_state->sub_sec_security);
553                         spnego_state->sub_sec_security = NULL;
554                         
555                         /* We started the mech correctly, and the
556                          * input from the other side was valid.
557                          * Return the error (say bad password, invalid
558                          * ticket) */
559                         return nt_status;
560                 }
561         
562                 
563                 return nt_status; /* OK, INVALID_PARAMETER ore MORE PROCESSING */
564         }
565
566         DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
567         /* we could re-negotiate here, but it would only work
568          * if the client or server lied about what it could
569          * support the first time.  Lets keep this code to
570          * reality */
571
572         return nt_status;
573 }
574
575 /** create a negTokenInit 
576  *
577  * This is the same packet, no matter if the client or server sends it first, but it is always the first packet
578 */
579 static NTSTATUS gensec_spnego_create_negTokenInit(struct gensec_security *gensec_security, 
580                                                   struct spnego_state *spnego_state,
581                                                   TALLOC_CTX *out_mem_ctx, 
582                                                   const DATA_BLOB in, DATA_BLOB *out) 
583 {
584         int i;
585         NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
586         DATA_BLOB null_data_blob = data_blob(NULL,0);
587         const char **mechTypes = NULL;
588         DATA_BLOB unwrapped_out = data_blob(NULL, 0);
589         const struct gensec_security_ops_wrapper *all_sec;
590
591         mechTypes = gensec_security_oids(gensec_security, 
592                                          out_mem_ctx, GENSEC_OID_SPNEGO);
593
594         all_sec = gensec_security_by_oid_list(gensec_security, 
595                                               out_mem_ctx, 
596                                               mechTypes,
597                                               GENSEC_OID_SPNEGO);
598         for (i=0; all_sec && all_sec[i].op; i++) {
599                 struct spnego_data spnego_out;
600                 const char **send_mech_types;
601                 bool ok;
602
603                 nt_status = gensec_subcontext_start(spnego_state,
604                                                     gensec_security,
605                                                     &spnego_state->sub_sec_security);
606                 if (!NT_STATUS_IS_OK(nt_status)) {
607                         return nt_status;
608                 }
609                 /* select the sub context */
610                 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
611                                                      all_sec[i].op);
612                 if (!NT_STATUS_IS_OK(nt_status)) {
613                         talloc_free(spnego_state->sub_sec_security);
614                         spnego_state->sub_sec_security = NULL;
615                         continue;
616                 }
617
618                 /* In the client, try and produce the first (optimistic) packet */
619                 if (spnego_state->state_position == SPNEGO_CLIENT_START) {
620                         nt_status = gensec_update(spnego_state->sub_sec_security,
621                                                   out_mem_ctx, 
622                                                   null_data_blob,
623                                                   &unwrapped_out);
624                         
625                         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) 
626                             && !NT_STATUS_IS_OK(nt_status)) {
627                                 DEBUG(1, ("SPNEGO(%s) creating NEG_TOKEN_INIT failed: %s\n", 
628                                           spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
629                                 talloc_free(spnego_state->sub_sec_security);
630                                 spnego_state->sub_sec_security = NULL;
631                                 /* Pretend we never started it (lets the first run find some incompatible demand) */
632                                 
633                                 continue;
634                         }
635                 }
636
637                 spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
638
639                 send_mech_types = gensec_security_oids_from_ops_wrapped(out_mem_ctx,
640                                                                         &all_sec[i]);
641
642                 ok = spnego_write_mech_types(spnego_state,
643                                              send_mech_types,
644                                              &spnego_state->mech_types);
645                 if (!ok) {
646                         DEBUG(1, ("SPNEGO: Failed to write mechTypes\n"));
647                         return NT_STATUS_NO_MEMORY;
648                 }
649
650                 /* List the remaining mechs as options */
651                 spnego_out.negTokenInit.mechTypes = send_mech_types;
652                 spnego_out.negTokenInit.reqFlags = null_data_blob;
653                 spnego_out.negTokenInit.reqFlagsPadding = 0;
654                 
655                 if (spnego_state->state_position == SPNEGO_SERVER_START) {
656                         spnego_out.negTokenInit.mechListMIC
657                                 = data_blob_string_const(ADS_IGNORE_PRINCIPAL);
658                 } else {
659                         spnego_out.negTokenInit.mechListMIC = null_data_blob;
660                 }
661
662                 spnego_out.negTokenInit.mechToken = unwrapped_out;
663                 
664                 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
665                         DEBUG(1, ("Failed to write NEG_TOKEN_INIT\n"));
666                                 return NT_STATUS_INVALID_PARAMETER;
667                 }
668                 
669                 /* set next state */
670                 spnego_state->neg_oid = all_sec[i].oid;
671                 
672                 if (NT_STATUS_IS_OK(nt_status)) {
673                         spnego_state->no_response_expected = true;
674                 }
675
676                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
677         } 
678         talloc_free(spnego_state->sub_sec_security);
679         spnego_state->sub_sec_security = NULL;
680
681         DEBUG(1, ("Failed to setup SPNEGO negTokenInit request: %s\n", nt_errstr(nt_status)));
682         return NT_STATUS_INVALID_PARAMETER;
683 }
684
685
686 /** create a server negTokenTarg 
687  *
688  * This is the case, where the client is the first one who sends data
689 */
690
691 static NTSTATUS gensec_spnego_server_negTokenTarg(struct gensec_security *gensec_security, 
692                                                   struct spnego_state *spnego_state,
693                                                   TALLOC_CTX *out_mem_ctx, 
694                                                   NTSTATUS nt_status,
695                                                   const DATA_BLOB unwrapped_out,
696                                                   DATA_BLOB mech_list_mic,
697                                                   DATA_BLOB *out)
698 {
699         struct spnego_data spnego_out;
700         DATA_BLOB null_data_blob = data_blob(NULL, 0);
701
702         /* compose reply */
703         spnego_out.type = SPNEGO_NEG_TOKEN_TARG;
704         spnego_out.negTokenTarg.responseToken = unwrapped_out;
705         spnego_out.negTokenTarg.mechListMIC = null_data_blob;
706         spnego_out.negTokenTarg.supportedMech = NULL;
707
708         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {   
709                 spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
710                 spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
711                 spnego_state->state_position = SPNEGO_SERVER_TARG;
712         } else if (NT_STATUS_IS_OK(nt_status)) {
713                 if (unwrapped_out.data) {
714                         spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
715                 }
716                 spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
717                 spnego_out.negTokenTarg.mechListMIC = mech_list_mic;
718                 spnego_state->state_position = SPNEGO_DONE;
719         } else {
720                 spnego_out.negTokenTarg.negResult = SPNEGO_REJECT;
721                 DEBUG(2, ("SPNEGO login failed: %s\n", nt_errstr(nt_status)));
722                 spnego_state->state_position = SPNEGO_DONE;
723         }
724
725         if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
726                 DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_TARG\n"));
727                 return NT_STATUS_INVALID_PARAMETER;
728         }
729
730         spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
731
732         return nt_status;
733 }
734
735
736 static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx, 
737                                      const DATA_BLOB in, DATA_BLOB *out) 
738 {
739         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
740         DATA_BLOB null_data_blob = data_blob(NULL, 0);
741         DATA_BLOB mech_list_mic = data_blob(NULL, 0);
742         DATA_BLOB unwrapped_out = data_blob(NULL, 0);
743         struct spnego_data spnego_out;
744         struct spnego_data spnego;
745
746         ssize_t len;
747
748         *out = data_blob(NULL, 0);
749
750         if (!out_mem_ctx) {
751                 out_mem_ctx = spnego_state;
752         }
753
754         /* and switch into the state machine */
755
756         switch (spnego_state->state_position) {
757         case SPNEGO_FALLBACK:
758                 return gensec_update(spnego_state->sub_sec_security,
759                                      out_mem_ctx, in, out);
760         case SPNEGO_SERVER_START:
761         {
762                 NTSTATUS nt_status;
763                 if (in.length) {
764
765                         len = spnego_read_data(gensec_security, in, &spnego);
766                         if (len == -1) {
767                                 return gensec_spnego_server_try_fallback(gensec_security, spnego_state, 
768                                                                          out_mem_ctx, in, out);
769                         }
770                         /* client sent NegTargetInit, we send NegTokenTarg */
771
772                         /* OK, so it's real SPNEGO, check the packet's the one we expect */
773                         if (spnego.type != spnego_state->expected_packet) {
774                                 DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type, 
775                                           spnego_state->expected_packet));
776                                 dump_data(1, in.data, in.length);
777                                 spnego_free_data(&spnego);
778                                 return NT_STATUS_INVALID_PARAMETER;
779                         }
780                         
781                         nt_status = gensec_spnego_parse_negTokenInit(gensec_security,
782                                                                      spnego_state,
783                                                                      out_mem_ctx, 
784                                                                      spnego.negTokenInit.mechTypes,
785                                                                      spnego.negTokenInit.mechToken, 
786                                                                      &unwrapped_out);
787                         
788                         nt_status = gensec_spnego_server_negTokenTarg(gensec_security,
789                                                                       spnego_state,
790                                                                       out_mem_ctx,
791                                                                       nt_status,
792                                                                       unwrapped_out,
793                                                                       null_data_blob,
794                                                                       out);
795                         
796                         spnego_free_data(&spnego);
797                         
798                         return nt_status;
799                 } else {
800                         nt_status = gensec_spnego_create_negTokenInit(gensec_security, spnego_state, 
801                                                                       out_mem_ctx, in, out);
802                         spnego_state->state_position = SPNEGO_SERVER_START;
803                         spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
804                         return nt_status;
805                 }
806         }
807         
808         case SPNEGO_CLIENT_START:
809         {
810                 /* The server offers a list of mechanisms */
811                 
812                 const char *my_mechs[] = {NULL, NULL};
813                 NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
814
815                 if (!in.length) {
816                         /* client to produce negTokenInit */
817                         nt_status = gensec_spnego_create_negTokenInit(gensec_security, spnego_state, 
818                                                                  out_mem_ctx, in, out);
819                         spnego_state->state_position = SPNEGO_CLIENT_TARG;
820                         spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
821                         return nt_status;
822                 }
823                 
824                 len = spnego_read_data(gensec_security, in, &spnego);
825                 
826                 if (len == -1) {
827                         DEBUG(1, ("Invalid SPNEGO request:\n"));
828                         dump_data(1, in.data, in.length);
829                         return NT_STATUS_INVALID_PARAMETER;
830                 }
831                 
832                 /* OK, so it's real SPNEGO, check the packet's the one we expect */
833                 if (spnego.type != spnego_state->expected_packet) {
834                         DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type, 
835                                   spnego_state->expected_packet));
836                         dump_data(1, in.data, in.length);
837                         spnego_free_data(&spnego);
838                         return NT_STATUS_INVALID_PARAMETER;
839                 }
840
841                 if (spnego.negTokenInit.targetPrincipal
842                     && strcmp(spnego.negTokenInit.targetPrincipal, ADS_IGNORE_PRINCIPAL) != 0) {
843                         DEBUG(5, ("Server claims it's principal name is %s\n", spnego.negTokenInit.targetPrincipal));
844                         if (lpcfg_client_use_spnego_principal(gensec_security->settings->lp_ctx)) {
845                                 gensec_set_target_principal(gensec_security, spnego.negTokenInit.targetPrincipal);
846                         }
847                 }
848
849                 nt_status = gensec_spnego_parse_negTokenInit(gensec_security,
850                                                              spnego_state,
851                                                              out_mem_ctx, 
852                                                              spnego.negTokenInit.mechTypes,
853                                                              spnego.negTokenInit.mechToken, 
854                                                              &unwrapped_out);
855
856                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(nt_status)) {
857                         spnego_free_data(&spnego);
858                         return nt_status;
859                 }
860
861                 my_mechs[0] = spnego_state->neg_oid;
862                 /* compose reply */
863                 spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
864                 spnego_out.negTokenInit.mechTypes = my_mechs;
865                 spnego_out.negTokenInit.reqFlags = null_data_blob;
866                 spnego_out.negTokenInit.reqFlagsPadding = 0;
867                 spnego_out.negTokenInit.mechListMIC = null_data_blob;
868                 spnego_out.negTokenInit.mechToken = unwrapped_out;
869                 
870                 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
871                         DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_INIT\n"));
872                                 return NT_STATUS_INVALID_PARAMETER;
873                 }
874                 
875                 /* set next state */
876                 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
877                 spnego_state->state_position = SPNEGO_CLIENT_TARG;
878
879                 if (NT_STATUS_IS_OK(nt_status)) {
880                         spnego_state->no_response_expected = true;
881                 }
882                 
883                 spnego_free_data(&spnego);
884                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
885         }
886         case SPNEGO_SERVER_TARG:
887         {
888                 NTSTATUS nt_status;
889                 bool new_spnego = false;
890
891                 if (!in.length) {
892                         return NT_STATUS_INVALID_PARAMETER;
893                 }
894                 
895                 len = spnego_read_data(gensec_security, in, &spnego);
896                 
897                 if (len == -1) {
898                         DEBUG(1, ("Invalid SPNEGO request:\n"));
899                         dump_data(1, in.data, in.length);
900                         return NT_STATUS_INVALID_PARAMETER;
901                 }
902                 
903                 /* OK, so it's real SPNEGO, check the packet's the one we expect */
904                 if (spnego.type != spnego_state->expected_packet) {
905                         DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type, 
906                                   spnego_state->expected_packet));
907                         dump_data(1, in.data, in.length);
908                         spnego_free_data(&spnego);
909                         return NT_STATUS_INVALID_PARAMETER;
910                 }
911
912                 if (!spnego_state->sub_sec_security) {
913                         DEBUG(1, ("SPNEGO: Did not setup a mech in NEG_TOKEN_INIT\n"));
914                         spnego_free_data(&spnego);
915                         return NT_STATUS_INVALID_PARAMETER;
916                 }
917
918                 nt_status = gensec_update(spnego_state->sub_sec_security,
919                                           out_mem_ctx, 
920                                           spnego.negTokenTarg.responseToken,
921                                           &unwrapped_out);
922                 if (NT_STATUS_IS_OK(nt_status) && spnego.negTokenTarg.mechListMIC.length > 0) {
923                         new_spnego = true;
924                         nt_status = gensec_check_packet(spnego_state->sub_sec_security,
925                                                         spnego_state->mech_types.data,
926                                                         spnego_state->mech_types.length,
927                                                         spnego_state->mech_types.data,
928                                                         spnego_state->mech_types.length,
929                                                         &spnego.negTokenTarg.mechListMIC);
930                         if (!NT_STATUS_IS_OK(nt_status)) {
931                                 DEBUG(2,("GENSEC SPNEGO: failed to verify mechListMIC: %s\n",
932                                         nt_errstr(nt_status)));
933                         }
934                 }
935                 if (NT_STATUS_IS_OK(nt_status) && new_spnego) {
936                         nt_status = gensec_sign_packet(spnego_state->sub_sec_security,
937                                                        out_mem_ctx,
938                                                        spnego_state->mech_types.data,
939                                                        spnego_state->mech_types.length,
940                                                        spnego_state->mech_types.data,
941                                                        spnego_state->mech_types.length,
942                                                        &mech_list_mic);
943                         if (!NT_STATUS_IS_OK(nt_status)) {
944                                 DEBUG(2,("GENSEC SPNEGO: failed to sign mechListMIC: %s\n",
945                                         nt_errstr(nt_status)));
946                         }
947                 }
948
949                 nt_status = gensec_spnego_server_negTokenTarg(gensec_security,
950                                                               spnego_state,
951                                                               out_mem_ctx, 
952                                                               nt_status,
953                                                               unwrapped_out,
954                                                               mech_list_mic,
955                                                               out);
956                 
957                 spnego_free_data(&spnego);
958                 
959                 return nt_status;
960         }
961         case SPNEGO_CLIENT_TARG:
962         {
963                 NTSTATUS nt_status;
964                 if (!in.length) {
965                         return NT_STATUS_INVALID_PARAMETER;
966                 }
967                 
968                 len = spnego_read_data(gensec_security, in, &spnego);
969                 
970                 if (len == -1) {
971                         DEBUG(1, ("Invalid SPNEGO request:\n"));
972                         dump_data(1, in.data, in.length);
973                         return NT_STATUS_INVALID_PARAMETER;
974                 }
975                 
976                 /* OK, so it's real SPNEGO, check the packet's the one we expect */
977                 if (spnego.type != spnego_state->expected_packet) {
978                         DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type, 
979                                   spnego_state->expected_packet));
980                         dump_data(1, in.data, in.length);
981                         spnego_free_data(&spnego);
982                         return NT_STATUS_INVALID_PARAMETER;
983                 }
984         
985                 if (spnego.negTokenTarg.negResult == SPNEGO_REJECT) {
986                         spnego_free_data(&spnego);
987                         return NT_STATUS_ACCESS_DENIED;
988                 }
989
990                 /* Server didn't like our choice of mech, and chose something else */
991                 if ((spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_INCOMPLETE) &&
992                     spnego.negTokenTarg.supportedMech &&
993                     strcmp(spnego.negTokenTarg.supportedMech, spnego_state->neg_oid) != 0) {
994                         DEBUG(3,("GENSEC SPNEGO: client preferred mech (%s) not accepted, server wants: %s\n",
995                                  gensec_get_name_by_oid(gensec_security, spnego.negTokenTarg.supportedMech), 
996                                  gensec_get_name_by_oid(gensec_security, spnego_state->neg_oid)));
997                         
998                         talloc_free(spnego_state->sub_sec_security);
999                         nt_status = gensec_subcontext_start(spnego_state,
1000                                                             gensec_security,
1001                                                             &spnego_state->sub_sec_security);
1002                         if (!NT_STATUS_IS_OK(nt_status)) {
1003                                 spnego_free_data(&spnego);
1004                                 return nt_status;
1005                         }
1006                         /* select the sub context */
1007                         nt_status = gensec_start_mech_by_oid(spnego_state->sub_sec_security,
1008                                                              spnego.negTokenTarg.supportedMech);
1009                         if (!NT_STATUS_IS_OK(nt_status)) {
1010                                 spnego_free_data(&spnego);
1011                                 return nt_status;
1012                         }
1013
1014                         nt_status = gensec_update(spnego_state->sub_sec_security,
1015                                                   out_mem_ctx, 
1016                                                   spnego.negTokenTarg.responseToken,
1017                                                   &unwrapped_out);
1018                         spnego_state->neg_oid = talloc_strdup(spnego_state, spnego.negTokenTarg.supportedMech);
1019                 } else if (spnego_state->no_response_expected) {
1020                         if (spnego.negTokenTarg.negResult != SPNEGO_ACCEPT_COMPLETED) {
1021                                 DEBUG(3,("GENSEC SPNEGO: client GENSEC accepted, but server rejected (bad password?)\n"));
1022                                 nt_status = NT_STATUS_INVALID_PARAMETER;
1023                         } else if (spnego.negTokenTarg.responseToken.length) {
1024                                 DEBUG(2,("GENSEC SPNEGO: client GENSEC accepted, but server continued negotiation!\n"));
1025                                 nt_status = NT_STATUS_INVALID_PARAMETER;
1026                         } else {
1027                                 nt_status = NT_STATUS_OK;
1028                         }
1029                         if (NT_STATUS_IS_OK(nt_status) && spnego.negTokenTarg.mechListMIC.length > 0) {
1030                                 nt_status = gensec_check_packet(spnego_state->sub_sec_security,
1031                                                                 spnego_state->mech_types.data,
1032                                                                 spnego_state->mech_types.length,
1033                                                                 spnego_state->mech_types.data,
1034                                                                 spnego_state->mech_types.length,
1035                                                                 &spnego.negTokenTarg.mechListMIC);
1036                                 if (!NT_STATUS_IS_OK(nt_status)) {
1037                                         DEBUG(2,("GENSEC SPNEGO: failed to verify mechListMIC: %s\n",
1038                                                 nt_errstr(nt_status)));
1039                                 }
1040                         }
1041                 } else {
1042                         bool new_spnego = false;
1043
1044                         nt_status = gensec_update(spnego_state->sub_sec_security,
1045                                                   out_mem_ctx, 
1046                                                   spnego.negTokenTarg.responseToken, 
1047                                                   &unwrapped_out);
1048
1049                         if (NT_STATUS_IS_OK(nt_status)
1050                             && spnego.negTokenTarg.negResult != SPNEGO_ACCEPT_COMPLETED) {
1051                                 new_spnego = gensec_have_feature(spnego_state->sub_sec_security,
1052                                                                  GENSEC_FEATURE_NEW_SPNEGO);
1053                         }
1054                         if (NT_STATUS_IS_OK(nt_status) && new_spnego) {
1055                                 nt_status = gensec_sign_packet(spnego_state->sub_sec_security,
1056                                                                out_mem_ctx,
1057                                                                spnego_state->mech_types.data,
1058                                                                spnego_state->mech_types.length,
1059                                                                spnego_state->mech_types.data,
1060                                                                spnego_state->mech_types.length,
1061                                                                &mech_list_mic);
1062                                 if (!NT_STATUS_IS_OK(nt_status)) {
1063                                         DEBUG(2,("GENSEC SPNEGO: failed to sign mechListMIC: %s\n",
1064                                                 nt_errstr(nt_status)));
1065                                 }
1066                         }
1067                         if (NT_STATUS_IS_OK(nt_status)) {
1068                                 spnego_state->no_response_expected = true;
1069                         }
1070                 } 
1071                 
1072                 spnego_free_data(&spnego);
1073
1074                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)
1075                         && !NT_STATUS_IS_OK(nt_status)) {
1076                         DEBUG(1, ("SPNEGO(%s) login failed: %s\n", 
1077                                   spnego_state->sub_sec_security->ops->name, 
1078                                   nt_errstr(nt_status)));
1079                         return nt_status;
1080                 }
1081
1082                 if (unwrapped_out.length || mech_list_mic.length) {
1083                         /* compose reply */
1084                         spnego_out.type = SPNEGO_NEG_TOKEN_TARG;
1085                         spnego_out.negTokenTarg.negResult = SPNEGO_NONE_RESULT;
1086                         spnego_out.negTokenTarg.supportedMech = NULL;
1087                         spnego_out.negTokenTarg.responseToken = unwrapped_out;
1088                         spnego_out.negTokenTarg.mechListMIC = mech_list_mic;
1089                         
1090                         if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
1091                                 DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_TARG\n"));
1092                                 return NT_STATUS_INVALID_PARAMETER;
1093                         }
1094                 
1095                         spnego_state->state_position = SPNEGO_CLIENT_TARG;
1096                         nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1097                 } else {
1098
1099                         /* all done - server has accepted, and we agree */
1100                         *out = null_data_blob;
1101
1102                         if (spnego.negTokenTarg.negResult != SPNEGO_ACCEPT_COMPLETED) {
1103                                 /* unless of course it did not accept */
1104                                 DEBUG(1,("gensec_update ok but not accepted\n"));
1105                                 nt_status = NT_STATUS_INVALID_PARAMETER;
1106                         }
1107                 
1108                         spnego_state->state_position = SPNEGO_DONE;
1109                 }
1110
1111                 return nt_status;
1112         }
1113         case SPNEGO_DONE:
1114                 /* We should not be called after we are 'done' */
1115                 return NT_STATUS_INVALID_PARAMETER;
1116         }
1117         return NT_STATUS_INVALID_PARAMETER;
1118 }
1119
1120 static void gensec_spnego_want_feature(struct gensec_security *gensec_security,
1121                                        uint32_t feature)
1122 {
1123         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1124
1125         if (!spnego_state || !spnego_state->sub_sec_security) {
1126                 gensec_security->want_features |= feature;
1127                 return;
1128         }
1129
1130         gensec_want_feature(spnego_state->sub_sec_security,
1131                             feature);
1132 }
1133
1134 static bool gensec_spnego_have_feature(struct gensec_security *gensec_security,
1135                                        uint32_t feature) 
1136 {
1137         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1138         if (!spnego_state->sub_sec_security) {
1139                 return false;
1140         }
1141         
1142         return gensec_have_feature(spnego_state->sub_sec_security, 
1143                                    feature);
1144 }
1145
1146 static const char *gensec_spnego_oids[] = { 
1147         GENSEC_OID_SPNEGO,
1148         NULL 
1149 };
1150
1151 static const struct gensec_security_ops gensec_spnego_security_ops = {
1152         .name             = "spnego",
1153         .sasl_name        = "GSS-SPNEGO",
1154         .auth_type        = DCERPC_AUTH_TYPE_SPNEGO,
1155         .oid              = gensec_spnego_oids,
1156         .client_start     = gensec_spnego_client_start,
1157         .server_start     = gensec_spnego_server_start,
1158         .update           = gensec_spnego_update,
1159         .seal_packet      = gensec_spnego_seal_packet,
1160         .sign_packet      = gensec_spnego_sign_packet,
1161         .sig_size         = gensec_spnego_sig_size,
1162         .max_wrapped_size = gensec_spnego_max_wrapped_size,
1163         .max_input_size   = gensec_spnego_max_input_size,
1164         .check_packet     = gensec_spnego_check_packet,
1165         .unseal_packet    = gensec_spnego_unseal_packet,
1166         .packet_full_request = gensec_spnego_packet_full_request,
1167         .wrap             = gensec_spnego_wrap,
1168         .unwrap           = gensec_spnego_unwrap,
1169         .wrap_packets     = gensec_spnego_wrap_packets,
1170         .unwrap_packets   = gensec_spnego_unwrap_packets,
1171         .session_key      = gensec_spnego_session_key,
1172         .session_info     = gensec_spnego_session_info,
1173         .want_feature     = gensec_spnego_want_feature,
1174         .have_feature     = gensec_spnego_have_feature,
1175         .enabled          = true,
1176         .priority         = GENSEC_SPNEGO
1177 };
1178
1179 _PUBLIC_ NTSTATUS gensec_spnego_init(void)
1180 {
1181         NTSTATUS ret;
1182         ret = gensec_register(&gensec_spnego_security_ops);
1183         if (!NT_STATUS_IS_OK(ret)) {
1184                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1185                         gensec_spnego_security_ops.name));
1186                 return ret;
1187         }
1188
1189         return ret;
1190 }