source4/auth/gensec/gensec_gssapi.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Kerberos backend for GENSEC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7    Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "lib/events/events.h"
  26 #include "system/kerberos.h"
  27 #include "heimdal/lib/gssapi/gssapi/gssapi.h"
  28 #include "auth/kerberos/kerberos.h"
  29 #include "librpc/gen_ndr/krb5pac.h"
  30 #include "auth/auth.h"
  31 #include "lib/ldb/include/ldb.h"
  32 #include "auth/auth_sam.h"
  33 #include "librpc/rpc/dcerpc.h"
  34 #include "auth/credentials/credentials.h"
  35 #include "auth/credentials/credentials_krb5.h"
  36 #include "auth/gensec/gensec.h"
  37 #include "param/param.h"
  38
  39 enum gensec_gssapi_sasl_state
  40 {
  41         STAGE_GSS_NEG,
  42         STAGE_SASL_SSF_NEG,
  43         STAGE_SASL_SSF_ACCEPT,
  44         STAGE_DONE
  45 };
  46
  47 #define NEG_SEAL 0x4
  48 #define NEG_SIGN 0x2
  49 #define NEG_NONE 0x1
  50
  51 struct gensec_gssapi_state {
  52         gss_ctx_id_t gssapi_context;
  53         struct gss_channel_bindings_struct *input_chan_bindings;
  54         gss_name_t server_name;
  55         gss_name_t client_name;
  56         OM_uint32 want_flags, got_flags;
  57         const gss_OID_desc *gss_oid;
  58
  59         DATA_BLOB session_key;
  60         DATA_BLOB pac;
  61
  62         struct smb_krb5_context *smb_krb5_context;
  63         struct gssapi_creds_container *client_cred;
  64         struct gssapi_creds_container *server_cred;
  65
  66         gss_cred_id_t delegated_cred_handle;
  67
  68         bool sasl; /* We have two different mechs in this file: One
  69                     * for SASL wrapped GSSAPI and another for normal
  70                     * GSSAPI */
  71         enum gensec_gssapi_sasl_state sasl_state;
  72         uint8_t sasl_protection; /* What was negotiated at the SASL
  73                                   * layer, independent of the GSSAPI
  74                                   * layer... */
  75
  76         size_t max_wrap_buf_size;
  77         int gss_exchange_count;
  78 };
  79
  80 static size_t gensec_gssapi_max_input_size(struct gensec_security *gensec_security);
  81 static size_t gensec_gssapi_max_wrapped_size(struct gensec_security *gensec_security);
  82
  83 static char *gssapi_error_string(TALLOC_CTX *mem_ctx,
  84                                  OM_uint32 maj_stat, OM_uint32 min_stat,
  85                                  const gss_OID_desc *mech)
  86 {
  87         OM_uint32 disp_min_stat, disp_maj_stat;
  88         gss_buffer_desc maj_error_message;
  89         gss_buffer_desc min_error_message;
  90         char *maj_error_string, *min_error_string;
  91         OM_uint32 msg_ctx = 0;
  92
  93         char *ret;
  94
  95         maj_error_message.value = NULL;
  96         min_error_message.value = NULL;
  97         maj_error_message.length = 0;
  98         min_error_message.length = 0;
  99
 100         disp_maj_stat = gss_display_status(&disp_min_stat, maj_stat, GSS_C_GSS_CODE,
 101                            mech, &msg_ctx, &maj_error_message);
 102         disp_maj_stat = gss_display_status(&disp_min_stat, min_stat, GSS_C_MECH_CODE,
 103                            mech, &msg_ctx, &min_error_message);
 104
 105         maj_error_string = talloc_strndup(mem_ctx, (char *)maj_error_message.value, maj_error_message.length);
 106
 107         min_error_string = talloc_strndup(mem_ctx, (char *)min_error_message.value, min_error_message.length);
 108
 109         ret = talloc_asprintf(mem_ctx, "%s: %s", maj_error_string, min_error_string);
 110
 111         talloc_free(maj_error_string);
 112         talloc_free(min_error_string);
 113
 114         gss_release_buffer(&disp_min_stat, &maj_error_message);
 115         gss_release_buffer(&disp_min_stat, &min_error_message);
 116
 117         return ret;
 118 }
 119
 120
 121 static int gensec_gssapi_destructor(struct gensec_gssapi_state *gensec_gssapi_state)
 122 {
 123         OM_uint32 maj_stat, min_stat;
 124
 125         if (gensec_gssapi_state->delegated_cred_handle != GSS_C_NO_CREDENTIAL) {
 126                 maj_stat = gss_release_cred(&min_stat,
 127                                             &gensec_gssapi_state->delegated_cred_handle);
 128         }
 129
 130         if (gensec_gssapi_state->gssapi_context != GSS_C_NO_CONTEXT) {
 131                 maj_stat = gss_delete_sec_context (&min_stat,
 132                                                    &gensec_gssapi_state->gssapi_context,
 133                                                    GSS_C_NO_BUFFER);
 134         }
 135
 136         if (gensec_gssapi_state->server_name != GSS_C_NO_NAME) {
 137                 maj_stat = gss_release_name(&min_stat, &gensec_gssapi_state->server_name);
 138         }
 139         if (gensec_gssapi_state->client_name != GSS_C_NO_NAME) {
 140                 maj_stat = gss_release_name(&min_stat, &gensec_gssapi_state->client_name);
 141         }
 142         return 0;
 143 }
 144
 145 static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security,
 146                                     struct loadparm_context *lp_ctx)
 147 {
 148         struct gensec_gssapi_state *gensec_gssapi_state;
 149         krb5_error_code ret;
 150         struct gsskrb5_send_to_kdc send_to_kdc;
 151
 152         gensec_gssapi_state = talloc(gensec_security, struct gensec_gssapi_state);
 153         if (!gensec_gssapi_state) {
 154                 return NT_STATUS_NO_MEMORY;
 155         }
 156
 157         gensec_gssapi_state->gss_exchange_count = 0;
 158         gensec_gssapi_state->max_wrap_buf_size
 159                 = lp_parm_int(lp_ctx, NULL, "gensec_gssapi", "max wrap buf size", 65536);
 160
 161         gensec_gssapi_state->sasl = false;
 162         gensec_gssapi_state->sasl_state = STAGE_GSS_NEG;
 163
 164         gensec_security->private_data = gensec_gssapi_state;
 165
 166         gensec_gssapi_state->gssapi_context = GSS_C_NO_CONTEXT;
 167         gensec_gssapi_state->server_name = GSS_C_NO_NAME;
 168         gensec_gssapi_state->client_name = GSS_C_NO_NAME;
 169
 170         /* TODO: Fill in channel bindings */
 171         gensec_gssapi_state->input_chan_bindings = GSS_C_NO_CHANNEL_BINDINGS;
 172
 173         gensec_gssapi_state->want_flags = 0;
 174         if (lp_parm_bool(lp_ctx, NULL, "gensec_gssapi", "mutual", true)) {
 175                 gensec_gssapi_state->want_flags |= GSS_C_MUTUAL_FLAG;
 176         }
 177         if (lp_parm_bool(lp_ctx, NULL, "gensec_gssapi", "delegation", true)) {
 178                 gensec_gssapi_state->want_flags |= GSS_C_DELEG_FLAG;
 179         }
 180         if (lp_parm_bool(lp_ctx, NULL, "gensec_gssapi", "replay", true)) {
 181                 gensec_gssapi_state->want_flags |= GSS_C_REPLAY_FLAG;
 182         }
 183         if (lp_parm_bool(lp_ctx, NULL, "gensec_gssapi", "sequence", true)) {
 184                 gensec_gssapi_state->want_flags |= GSS_C_SEQUENCE_FLAG;
 185         }
 186
 187         gensec_gssapi_state->got_flags = 0;
 188
 189         gensec_gssapi_state->session_key = data_blob(NULL, 0);
 190         gensec_gssapi_state->pac = data_blob(NULL, 0);
 191
 192         gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
 193
 194         talloc_set_destructor(gensec_gssapi_state, gensec_gssapi_destructor);
 195
 196         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
 197                 gensec_gssapi_state->want_flags |= GSS_C_INTEG_FLAG;
 198         }
 199         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
 200                 gensec_gssapi_state->want_flags |= GSS_C_CONF_FLAG;
 201         }
 202         if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
 203                 gensec_gssapi_state->want_flags |= GSS_C_DCE_STYLE;
 204         }
 205
 206         gensec_gssapi_state->gss_oid = GSS_C_NULL_OID;
 207
 208         send_to_kdc.func = smb_krb5_send_and_recv_func;
 209         send_to_kdc.ptr = gensec_security->event_ctx;
 210
 211         ret = gsskrb5_set_send_to_kdc(&send_to_kdc);
 212         if (ret) {
 213                 DEBUG(1,("gensec_krb5_start: gsskrb5_set_send_to_kdc failed\n"));
 214                 talloc_free(gensec_gssapi_state);
 215                 return NT_STATUS_INTERNAL_ERROR;
 216         }
 217         if (lp_realm(lp_ctx) && *lp_realm(lp_ctx)) {
 218                 char *upper_realm = strupper_talloc(gensec_gssapi_state, lp_realm(lp_ctx));
 219                 if (!upper_realm) {
 220                         DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm(lp_ctx)));
 221                         talloc_free(gensec_gssapi_state);
 222                         return NT_STATUS_NO_MEMORY;
 223                 }
 224                 ret = gsskrb5_set_default_realm(upper_realm);
 225                 talloc_free(upper_realm);
 226                 if (ret) {
 227                         DEBUG(1,("gensec_krb5_start: gsskrb5_set_default_realm failed\n"));
 228                         talloc_free(gensec_gssapi_state);
 229                         return NT_STATUS_INTERNAL_ERROR;
 230                 }
 231         }
 232
 233         /* don't do DNS lookups of any kind, it might/will fail for a netbios name */
 234         ret = gsskrb5_set_dns_canonicalize(lp_parm_bool(lp_ctx, NULL, "krb5", "set_dns_canonicalize", false));
 235         if (ret) {
 236                 DEBUG(1,("gensec_krb5_start: gsskrb5_set_dns_canonicalize failed\n"));
 237                 talloc_free(gensec_gssapi_state);
 238                 return NT_STATUS_INTERNAL_ERROR;
 239         }
 240
 241         ret = smb_krb5_init_context(gensec_gssapi_state,
 242                                     gensec_security->event_ctx,
 243                                     lp_ctx,
 244                                     &gensec_gssapi_state->smb_krb5_context);
 245         if (ret) {
 246                 DEBUG(1,("gensec_krb5_start: krb5_init_context failed (%s)\n",
 247                          error_message(ret)));
 248                 talloc_free(gensec_gssapi_state);
 249                 return NT_STATUS_INTERNAL_ERROR;
 250         }
 251         return NT_STATUS_OK;
 252 }
 253
 254 static NTSTATUS gensec_gssapi_server_start(struct gensec_security *gensec_security)
 255 {
 256         NTSTATUS nt_status;
 257         int ret;
 258         struct gensec_gssapi_state *gensec_gssapi_state;
 259         struct cli_credentials *machine_account;
 260         struct gssapi_creds_container *gcc;
 261
 262         nt_status = gensec_gssapi_start(gensec_security, global_loadparm);
 263         if (!NT_STATUS_IS_OK(nt_status)) {
 264                 return nt_status;
 265         }
 266
 267         gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 268
 269         machine_account = gensec_get_credentials(gensec_security);
 270
 271         if (!machine_account) {
 272                 DEBUG(3, ("No machine account credentials specified\n"));
 273                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 274         } else {
 275                 ret = cli_credentials_get_server_gss_creds(machine_account, &gcc);
 276                 if (ret) {
 277                         DEBUG(1, ("Aquiring acceptor credentials failed: %s\n",
 278                                   error_message(ret)));
 279                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 280                 }
 281         }
 282
 283         gensec_gssapi_state->server_cred = gcc;
 284         return NT_STATUS_OK;
 285
 286 }
 287
 288 static NTSTATUS gensec_gssapi_sasl_server_start(struct gensec_security *gensec_security)
 289 {
 290         NTSTATUS nt_status;
 291         struct gensec_gssapi_state *gensec_gssapi_state;
 292         nt_status = gensec_gssapi_server_start(gensec_security);
 293
 294         if (NT_STATUS_IS_OK(nt_status)) {
 295                 gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 296                 gensec_gssapi_state->sasl = true;
 297         }
 298         return nt_status;
 299 }
 300
 301 static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_security)
 302 {
 303         struct gensec_gssapi_state *gensec_gssapi_state;
 304         struct cli_credentials *creds = gensec_get_credentials(gensec_security);
 305         krb5_error_code ret;
 306         NTSTATUS nt_status;
 307         gss_buffer_desc name_token;
 308         gss_OID name_type;
 309         OM_uint32 maj_stat, min_stat;
 310         const char *hostname = gensec_get_target_hostname(gensec_security);
 311         const char *principal;
 312         struct gssapi_creds_container *gcc;
 313
 314         if (!hostname) {
 315                 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
 316                 return NT_STATUS_INVALID_PARAMETER;
 317         }
 318         if (is_ipaddress(hostname)) {
 319                 DEBUG(2, ("Cannot do GSSAPI to an IP address\n"));
 320                 return NT_STATUS_INVALID_PARAMETER;
 321         }
 322         if (strcmp(hostname, "localhost") == 0) {
 323                 DEBUG(2, ("GSSAPI to 'localhost' does not make sense\n"));
 324                 return NT_STATUS_INVALID_PARAMETER;
 325         }
 326
 327         nt_status = gensec_gssapi_start(gensec_security, global_loadparm);
 328         if (!NT_STATUS_IS_OK(nt_status)) {
 329                 return nt_status;
 330         }
 331
 332         gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 333
 334         gensec_gssapi_state->gss_oid = gss_mech_krb5;
 335
 336         principal = gensec_get_target_principal(gensec_security);
 337         if (principal && lp_client_use_spnego_principal(global_loadparm)) {
 338                 name_type = GSS_C_NULL_OID;
 339         } else {
 340                 principal = talloc_asprintf(gensec_gssapi_state, "%s@%s",
 341                                             gensec_get_target_service(gensec_security),
 342                                             hostname);
 343
 344                 name_type = GSS_C_NT_HOSTBASED_SERVICE;
 345         }
 346         name_token.value  = discard_const_p(uint8_t, principal);
 347         name_token.length = strlen(principal);
 348
 349
 350         maj_stat = gss_import_name (&min_stat,
 351                                     &name_token,
 352                                     name_type,
 353                                     &gensec_gssapi_state->server_name);
 354         if (maj_stat) {
 355                 DEBUG(2, ("GSS Import name of %s failed: %s\n",
 356                           (char *)name_token.value,
 357                           gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 358                 return NT_STATUS_INVALID_PARAMETER;
 359         }
 360
 361         ret = cli_credentials_get_client_gss_creds(creds, &gcc);
 362         switch (ret) {
 363         case 0:
 364                 break;
 365         case KRB5KDC_ERR_PREAUTH_FAILED:
 366                 return NT_STATUS_LOGON_FAILURE;
 367         case KRB5_KDC_UNREACH:
 368                 DEBUG(3, ("Cannot reach a KDC we require to contact %s\n", principal));
 369                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 370         default:
 371                 DEBUG(1, ("Aquiring initiator credentials failed\n"));
 372                 return NT_STATUS_UNSUCCESSFUL;
 373         }
 374
 375         gensec_gssapi_state->client_cred = gcc;
 376         if (!talloc_reference(gensec_gssapi_state, gcc)) {
 377                 return NT_STATUS_NO_MEMORY;
 378         }
 379
 380         return NT_STATUS_OK;
 381 }
 382
 383 static NTSTATUS gensec_gssapi_sasl_client_start(struct gensec_security *gensec_security)
 384 {
 385         NTSTATUS nt_status;
 386         struct gensec_gssapi_state *gensec_gssapi_state;
 387         nt_status = gensec_gssapi_client_start(gensec_security);
 388
 389         if (NT_STATUS_IS_OK(nt_status)) {
 390                 gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 391                 gensec_gssapi_state->sasl = true;
 392         }
 393         return nt_status;
 394 }
 395
 396
 397 /**
 398  * Check if the packet is one for this mechansim
 399  *
 400  * @param gensec_security GENSEC state
 401  * @param in The request, as a DATA_BLOB
 402  * @return Error, INVALID_PARAMETER if it's not a packet for us
 403  *                or NT_STATUS_OK if the packet is ok.
 404  */
 405
 406 static NTSTATUS gensec_gssapi_magic(struct gensec_security *gensec_security,
 407                                     const DATA_BLOB *in)
 408 {
 409         if (gensec_gssapi_check_oid(in, GENSEC_OID_KERBEROS5)) {
 410                 return NT_STATUS_OK;
 411         } else {
 412                 return NT_STATUS_INVALID_PARAMETER;
 413         }
 414 }
 415
 416
 417 /**
 418  * Next state function for the GSSAPI GENSEC mechanism
 419  *
 420  * @param gensec_gssapi_state GSSAPI State
 421  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
 422  * @param in The request, as a DATA_BLOB
 423  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 424  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 425  *                or NT_STATUS_OK if the user is authenticated.
 426  */
 427
 428 static NTSTATUS gensec_gssapi_update(struct gensec_security *gensec_security,
 429                                    TALLOC_CTX *out_mem_ctx,
 430                                    const DATA_BLOB in, DATA_BLOB *out)
 431 {
 432         struct gensec_gssapi_state *gensec_gssapi_state
 433                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 434         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
 435         OM_uint32 maj_stat, min_stat;
 436         OM_uint32 min_stat2;
 437         gss_buffer_desc input_token, output_token;
 438         gss_OID gss_oid_p = NULL;
 439         input_token.length = in.length;
 440         input_token.value = in.data;
 441
 442         switch (gensec_gssapi_state->sasl_state) {
 443         case STAGE_GSS_NEG:
 444         {
 445                 switch (gensec_security->gensec_role) {
 446                 case GENSEC_CLIENT:
 447                 {
 448                         maj_stat = gss_init_sec_context(&min_stat,
 449                                                         gensec_gssapi_state->client_cred->creds,
 450                                                         &gensec_gssapi_state->gssapi_context,
 451                                                         gensec_gssapi_state->server_name,
 452                                                         discard_const_p(gss_OID_desc, gensec_gssapi_state->gss_oid),
 453                                                         gensec_gssapi_state->want_flags,
 454                                                         0,
 455                                                         gensec_gssapi_state->input_chan_bindings,
 456                                                         &input_token,
 457                                                         &gss_oid_p,
 458                                                         &output_token,
 459                                                         &gensec_gssapi_state->got_flags, /* ret flags */
 460                                                         NULL);
 461                         if (gss_oid_p) {
 462                                 gensec_gssapi_state->gss_oid = gss_oid_p;
 463                         }
 464                         break;
 465                 }
 466                 case GENSEC_SERVER:
 467                 {
 468                         maj_stat = gss_accept_sec_context(&min_stat,
 469                                                           &gensec_gssapi_state->gssapi_context,
 470                                                           gensec_gssapi_state->server_cred->creds,
 471                                                           &input_token,
 472                                                           gensec_gssapi_state->input_chan_bindings,
 473                                                           &gensec_gssapi_state->client_name,
 474                                                           &gss_oid_p,
 475                                                           &output_token,
 476                                                           &gensec_gssapi_state->got_flags,
 477                                                           NULL,
 478                                                           &gensec_gssapi_state->delegated_cred_handle);
 479                         if (gss_oid_p) {
 480                                 gensec_gssapi_state->gss_oid = gss_oid_p;
 481                         }
 482                         break;
 483                 }
 484                 default:
 485                         return NT_STATUS_INVALID_PARAMETER;
 486
 487                 }
 488
 489                 gensec_gssapi_state->gss_exchange_count++;
 490
 491                 if (maj_stat == GSS_S_COMPLETE) {
 492                         *out = data_blob_talloc(out_mem_ctx, output_token.value, output_token.length);
 493                         gss_release_buffer(&min_stat2, &output_token);
 494
 495                         if (gensec_gssapi_state->got_flags & GSS_C_DELEG_FLAG) {
 496                                 DEBUG(5, ("gensec_gssapi: credentials were delegated\n"));
 497                         } else {
 498                                 DEBUG(5, ("gensec_gssapi: NO credentials were delegated\n"));
 499                         }
 500
 501                         /* We may have been invoked as SASL, so there
 502                          * is more work to do */
 503                         if (gensec_gssapi_state->sasl) {
 504                                 /* Due to a very subtle interaction
 505                                  * with SASL and the LDAP libs, we
 506                                  * must ensure the data pointer is
 507                                  * != NULL, but the length is 0.
 508                                  *
 509                                  * This ensures we send a 'zero
 510                                  * length' (rather than NULL) response
 511                                  */
 512
 513                                 if (!out->data) {
 514                                         out->data = (uint8_t *)talloc_strdup(out_mem_ctx, "\0");
 515                                 }
 516
 517                                 gensec_gssapi_state->sasl_state = STAGE_SASL_SSF_NEG;
 518                                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
 519                         } else {
 520                                 gensec_gssapi_state->sasl_state = STAGE_DONE;
 521
 522                                 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 523                                         DEBUG(5, ("GSSAPI Connection will be cryptographicly sealed\n"));
 524                                 } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 525                                         DEBUG(5, ("GSSAPI Connection will be cryptographicly signed\n"));
 526                                 } else {
 527                                         DEBUG(5, ("GSSAPI Connection will have no cryptographic protection\n"));
 528                                 }
 529
 530                                 return NT_STATUS_OK;
 531                         }
 532                 } else if (maj_stat == GSS_S_CONTINUE_NEEDED) {
 533                         *out = data_blob_talloc(out_mem_ctx, output_token.value, output_token.length);
 534                         gss_release_buffer(&min_stat2, &output_token);
 535
 536                         return NT_STATUS_MORE_PROCESSING_REQUIRED;
 537                 } else if (gss_oid_equal(gensec_gssapi_state->gss_oid, gss_mech_krb5)) {
 538                         switch (min_stat) {
 539                         case KRB5_KDC_UNREACH:
 540                                 DEBUG(3, ("Cannot reach a KDC we require: %s\n",
 541                                           gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 542                                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 543                         case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
 544                                 DEBUG(3, ("Server is not registered with our KDC: %s\n",
 545                                           gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 546                                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 547                         case KRB5KRB_AP_ERR_MSG_TYPE:
 548                                 /* garbage input, possibly from the auto-mech detection */
 549                                 return NT_STATUS_INVALID_PARAMETER;
 550                         default:
 551                                 DEBUG(1, ("GSS Update(krb5)(%d) Update failed: %s\n",
 552                                           gensec_gssapi_state->gss_exchange_count,
 553                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 554                                 return nt_status;
 555                         }
 556                 } else {
 557                         DEBUG(1, ("GSS Update(%d) failed: %s\n",
 558                                   gensec_gssapi_state->gss_exchange_count,
 559                                   gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 560                         return nt_status;
 561                 }
 562                 break;
 563         }
 564
 565         /* These last two stages are only done if we were invoked as SASL */
 566         case STAGE_SASL_SSF_NEG:
 567         {
 568                 switch (gensec_security->gensec_role) {
 569                 case GENSEC_CLIENT:
 570                 {
 571                         uint8_t maxlength_proposed[4];
 572                         uint8_t maxlength_accepted[4];
 573                         uint8_t security_supported;
 574                         int conf_state;
 575                         gss_qop_t qop_state;
 576                         input_token.length = in.length;
 577                         input_token.value = in.data;
 578
 579                         /* As a client, we have just send a
 580                          * zero-length blob to the server (after the
 581                          * normal GSSAPI exchange), and it has replied
 582                          * with it's SASL negotiation */
 583
 584                         maj_stat = gss_unwrap(&min_stat,
 585                                               gensec_gssapi_state->gssapi_context,
 586                                               &input_token,
 587                                               &output_token,
 588                                               &conf_state,
 589                                               &qop_state);
 590                         if (GSS_ERROR(maj_stat)) {
 591                                 DEBUG(1, ("gensec_gssapi_update: GSS UnWrap of SASL protection negotiation failed: %s\n",
 592                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 593                                 return NT_STATUS_ACCESS_DENIED;
 594                         }
 595
 596                         if (output_token.length < 4) {
 597                                 return NT_STATUS_INVALID_PARAMETER;
 598                         }
 599
 600                         memcpy(maxlength_proposed, output_token.value, 4);
 601                         gss_release_buffer(&min_stat, &output_token);
 602
 603                         /* first byte is the proposed security */
 604                         security_supported = maxlength_proposed[0];
 605                         maxlength_proposed[0] = '\0';
 606
 607                         /* Rest is the proposed max wrap length */
 608                         gensec_gssapi_state->max_wrap_buf_size = MIN(RIVAL(maxlength_proposed, 0),
 609                                                                      gensec_gssapi_state->max_wrap_buf_size);
 610                         gensec_gssapi_state->sasl_protection = 0;
 611                         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 612                                 if (security_supported & NEG_SEAL) {
 613                                         gensec_gssapi_state->sasl_protection |= NEG_SEAL;
 614                                 }
 615                         } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 616                                 if (security_supported & NEG_SIGN) {
 617                                         gensec_gssapi_state->sasl_protection |= NEG_SIGN;
 618                                 }
 619                         } else if (security_supported & NEG_NONE) {
 620                                 gensec_gssapi_state->sasl_protection |= NEG_NONE;
 621                         } else {
 622                                 DEBUG(1, ("Remote server does not support unprotected connections"));
 623                                 return NT_STATUS_ACCESS_DENIED;
 624                         }
 625
 626                         /* Send back the negotiated max length */
 627
 628                         RSIVAL(maxlength_accepted, 0, gensec_gssapi_state->max_wrap_buf_size);
 629
 630                         maxlength_accepted[0] = gensec_gssapi_state->sasl_protection;
 631
 632                         input_token.value = maxlength_accepted;
 633                         input_token.length = sizeof(maxlength_accepted);
 634
 635                         maj_stat = gss_wrap(&min_stat,
 636                                             gensec_gssapi_state->gssapi_context,
 637                                             false,
 638                                             GSS_C_QOP_DEFAULT,
 639                                             &input_token,
 640                                             &conf_state,
 641                                             &output_token);
 642                         if (GSS_ERROR(maj_stat)) {
 643                                 DEBUG(1, ("GSS Update(SSF_NEG): GSS Wrap failed: %s\n",
 644                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 645                                 return NT_STATUS_ACCESS_DENIED;
 646                         }
 647
 648                         *out = data_blob_talloc(out_mem_ctx, output_token.value, output_token.length);
 649                         gss_release_buffer(&min_stat, &output_token);
 650
 651                         /* quirk:  This changes the value that gensec_have_feature returns, to be that after SASL negotiation */
 652                         gensec_gssapi_state->sasl_state = STAGE_DONE;
 653
 654                         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 655                                 DEBUG(3, ("SASL/GSSAPI Connection to server will be cryptographicly sealed\n"));
 656                         } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 657                                 DEBUG(3, ("SASL/GSSAPI Connection to server will be cryptographicly signed\n"));
 658                         } else {
 659                                 DEBUG(3, ("SASL/GSSAPI Connection to server will have no cryptographicly protection\n"));
 660                         }
 661
 662                         return NT_STATUS_OK;
 663                 }
 664                 case GENSEC_SERVER:
 665                 {
 666                         uint8_t maxlength_proposed[4];
 667                         uint8_t security_supported = 0x0;
 668                         int conf_state;
 669
 670                         /* As a server, we have just been sent a zero-length blob (note this, but it isn't fatal) */
 671                         if (in.length != 0) {
 672                                 DEBUG(1, ("SASL/GSSAPI: client sent non-zero length starting SASL negotiation!\n"));
 673                         }
 674
 675                         /* Give the client some idea what we will support */
 676
 677                         RSIVAL(maxlength_proposed, 0, gensec_gssapi_state->max_wrap_buf_size);
 678                         /* first byte is the proposed security */
 679                         maxlength_proposed[0] = '\0';
 680
 681                         gensec_gssapi_state->sasl_protection = 0;
 682                         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 683                                 security_supported |= NEG_SEAL;
 684                         }
 685                         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 686                                 security_supported |= NEG_SIGN;
 687                         }
 688                         if (security_supported == 0) {
 689                                 /* If we don't support anything, this must be 0 */
 690                                 RSIVAL(maxlength_proposed, 0, 0x0);
 691                         }
 692
 693                         /* TODO:  We may not wish to support this */
 694                         security_supported |= NEG_NONE;
 695                         maxlength_proposed[0] = security_supported;
 696
 697                         input_token.value = maxlength_proposed;
 698                         input_token.length = sizeof(maxlength_proposed);
 699
 700                         maj_stat = gss_wrap(&min_stat,
 701                                             gensec_gssapi_state->gssapi_context,
 702                                             false,
 703                                             GSS_C_QOP_DEFAULT,
 704                                             &input_token,
 705                                             &conf_state,
 706                                             &output_token);
 707                         if (GSS_ERROR(maj_stat)) {
 708                                 DEBUG(1, ("GSS Update(SSF_NEG): GSS Wrap failed: %s\n",
 709                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 710                                 return NT_STATUS_ACCESS_DENIED;
 711                         }
 712
 713                         *out = data_blob_talloc(out_mem_ctx, output_token.value, output_token.length);
 714                         gss_release_buffer(&min_stat, &output_token);
 715
 716                         gensec_gssapi_state->sasl_state = STAGE_SASL_SSF_ACCEPT;
 717                         return NT_STATUS_MORE_PROCESSING_REQUIRED;
 718                 }
 719                 default:
 720                         return NT_STATUS_INVALID_PARAMETER;
 721
 722                 }
 723         }
 724         /* This is s server-only stage */
 725         case STAGE_SASL_SSF_ACCEPT:
 726         {
 727                 uint8_t maxlength_accepted[4];
 728                 uint8_t security_accepted;
 729                 int conf_state;
 730                 gss_qop_t qop_state;
 731                 input_token.length = in.length;
 732                 input_token.value = in.data;
 733
 734                 maj_stat = gss_unwrap(&min_stat,
 735                                       gensec_gssapi_state->gssapi_context,
 736                                       &input_token,
 737                                       &output_token,
 738                                       &conf_state,
 739                                       &qop_state);
 740                 if (GSS_ERROR(maj_stat)) {
 741                         DEBUG(1, ("gensec_gssapi_update: GSS UnWrap of SASL protection negotiation failed: %s\n",
 742                                   gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 743                         return NT_STATUS_ACCESS_DENIED;
 744                 }
 745
 746                 if (output_token.length < 4) {
 747                         return NT_STATUS_INVALID_PARAMETER;
 748                 }
 749
 750                 memcpy(maxlength_accepted, output_token.value, 4);
 751                 gss_release_buffer(&min_stat, &output_token);
 752
 753                 /* first byte is the proposed security */
 754                 security_accepted = maxlength_accepted[0];
 755                 maxlength_accepted[0] = '\0';
 756
 757                 /* Rest is the proposed max wrap length */
 758                 gensec_gssapi_state->max_wrap_buf_size = MIN(RIVAL(maxlength_accepted, 0),
 759                                                              gensec_gssapi_state->max_wrap_buf_size);
 760
 761                 gensec_gssapi_state->sasl_protection = 0;
 762                 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 763                         if (security_accepted & NEG_SEAL) {
 764                                 gensec_gssapi_state->sasl_protection |= NEG_SEAL;
 765                         }
 766                 } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 767                         if (security_accepted & NEG_SIGN) {
 768                                 gensec_gssapi_state->sasl_protection |= NEG_SIGN;
 769                         }
 770                 } else if (security_accepted & NEG_NONE) {
 771                         gensec_gssapi_state->sasl_protection |= NEG_NONE;
 772                 } else {
 773                         DEBUG(1, ("Remote client does not support unprotected connections, but we failed to negotiate anything better"));
 774                         return NT_STATUS_ACCESS_DENIED;
 775                 }
 776
 777                 /* quirk:  This changes the value that gensec_have_feature returns, to be that after SASL negotiation */
 778                 gensec_gssapi_state->sasl_state = STAGE_DONE;
 779                 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 780                         DEBUG(5, ("SASL/GSSAPI Connection from client will be cryptographicly sealed\n"));
 781                 } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 782                         DEBUG(5, ("SASL/GSSAPI Connection from client will be cryptographicly signed\n"));
 783                 } else {
 784                         DEBUG(5, ("SASL/GSSAPI Connection from client will have no cryptographic protection\n"));
 785                 }
 786
 787                 *out = data_blob(NULL, 0);
 788                 return NT_STATUS_OK;
 789         }
 790         default:
 791                 return NT_STATUS_INVALID_PARAMETER;
 792         }
 793 }
 794
 795 static NTSTATUS gensec_gssapi_wrap(struct gensec_security *gensec_security,
 796                                    TALLOC_CTX *mem_ctx,
 797                                    const DATA_BLOB *in,
 798                                    DATA_BLOB *out)
 799 {
 800         struct gensec_gssapi_state *gensec_gssapi_state
 801                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 802         OM_uint32 maj_stat, min_stat;
 803         gss_buffer_desc input_token, output_token;
 804         int conf_state;
 805         input_token.length = in->length;
 806         input_token.value = in->data;
 807
 808         maj_stat = gss_wrap(&min_stat,
 809                             gensec_gssapi_state->gssapi_context,
 810                             gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
 811                             GSS_C_QOP_DEFAULT,
 812                             &input_token,
 813                             &conf_state,
 814                             &output_token);
 815         if (GSS_ERROR(maj_stat)) {
 816                 DEBUG(1, ("gensec_gssapi_wrap: GSS Wrap failed: %s\n",
 817                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 818                 return NT_STATUS_ACCESS_DENIED;
 819         }
 820
 821         *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
 822         gss_release_buffer(&min_stat, &output_token);
 823
 824         if (gensec_gssapi_state->sasl) {
 825                 size_t max_wrapped_size = gensec_gssapi_max_wrapped_size(gensec_security);
 826                 if (max_wrapped_size < out->length) {
 827                         DEBUG(1, ("gensec_gssapi_wrap: when wrapped, INPUT data (%u) is grew to be larger than SASL negotiated maximum output size (%u > %u)\n",
 828                                   (unsigned)in->length,
 829                                   (unsigned)out->length,
 830                                   (unsigned int)max_wrapped_size));
 831                         return NT_STATUS_INVALID_PARAMETER;
 832                 }
 833         }
 834
 835         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 836             && !conf_state) {
 837                 return NT_STATUS_ACCESS_DENIED;
 838         }
 839         return NT_STATUS_OK;
 840 }
 841
 842 static NTSTATUS gensec_gssapi_unwrap(struct gensec_security *gensec_security,
 843                                      TALLOC_CTX *mem_ctx,
 844                                      const DATA_BLOB *in,
 845                                      DATA_BLOB *out)
 846 {
 847         struct gensec_gssapi_state *gensec_gssapi_state
 848                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 849         OM_uint32 maj_stat, min_stat;
 850         gss_buffer_desc input_token, output_token;
 851         int conf_state;
 852         gss_qop_t qop_state;
 853         input_token.length = in->length;
 854         input_token.value = in->data;
 855
 856         if (gensec_gssapi_state->sasl) {
 857                 size_t max_wrapped_size = gensec_gssapi_max_wrapped_size(gensec_security);
 858                 if (max_wrapped_size < in->length) {
 859                         DEBUG(1, ("gensec_gssapi_unwrap: WRAPPED data is larger than SASL negotiated maximum size\n"));
 860                         return NT_STATUS_INVALID_PARAMETER;
 861                 }
 862         }
 863
 864         maj_stat = gss_unwrap(&min_stat,
 865                               gensec_gssapi_state->gssapi_context,
 866                               &input_token,
 867                               &output_token,
 868                               &conf_state,
 869                               &qop_state);
 870         if (GSS_ERROR(maj_stat)) {
 871                 DEBUG(1, ("gensec_gssapi_unwrap: GSS UnWrap failed: %s\n",
 872                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 873                 return NT_STATUS_ACCESS_DENIED;
 874         }
 875
 876         *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
 877         gss_release_buffer(&min_stat, &output_token);
 878
 879         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 880             && !conf_state) {
 881                 return NT_STATUS_ACCESS_DENIED;
 882         }
 883         return NT_STATUS_OK;
 884 }
 885
 886 /* Find out the maximum input size negotiated on this connection */
 887
 888 static size_t gensec_gssapi_max_input_size(struct gensec_security *gensec_security)
 889 {
 890         struct gensec_gssapi_state *gensec_gssapi_state
 891                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 892         OM_uint32 maj_stat, min_stat;
 893         OM_uint32 max_input_size;
 894
 895         maj_stat = gss_wrap_size_limit(&min_stat,
 896                                        gensec_gssapi_state->gssapi_context,
 897                                        gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
 898                                        GSS_C_QOP_DEFAULT,
 899                                        gensec_gssapi_state->max_wrap_buf_size,
 900                                        &max_input_size);
 901         if (GSS_ERROR(maj_stat)) {
 902                 TALLOC_CTX *mem_ctx = talloc_new(NULL);
 903                 DEBUG(1, ("gensec_gssapi_max_input_size: determinaing signature size with gss_wrap_size_limit failed: %s\n",
 904                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 905                 talloc_free(mem_ctx);
 906                 return 0;
 907         }
 908
 909         return max_input_size;
 910 }
 911
 912 /* Find out the maximum output size negotiated on this connection */
 913 static size_t gensec_gssapi_max_wrapped_size(struct gensec_security *gensec_security)
 914 {
 915         struct gensec_gssapi_state *gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);;
 916         return gensec_gssapi_state->max_wrap_buf_size;
 917 }
 918
 919 static NTSTATUS gensec_gssapi_seal_packet(struct gensec_security *gensec_security,
 920                                           TALLOC_CTX *mem_ctx,
 921                                           uint8_t *data, size_t length,
 922                                           const uint8_t *whole_pdu, size_t pdu_length,
 923                                           DATA_BLOB *sig)
 924 {
 925         struct gensec_gssapi_state *gensec_gssapi_state
 926                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 927         OM_uint32 maj_stat, min_stat;
 928         gss_buffer_desc input_token, output_token;
 929         int conf_state;
 930         ssize_t sig_length;
 931
 932         input_token.length = length;
 933         input_token.value = data;
 934
 935         maj_stat = gss_wrap(&min_stat,
 936                             gensec_gssapi_state->gssapi_context,
 937                             gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
 938                             GSS_C_QOP_DEFAULT,
 939                             &input_token,
 940                             &conf_state,
 941                             &output_token);
 942         if (GSS_ERROR(maj_stat)) {
 943                 DEBUG(1, ("gensec_gssapi_seal_packet: GSS Wrap failed: %s\n",
 944                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 945                 return NT_STATUS_ACCESS_DENIED;
 946         }
 947
 948         if (output_token.length < input_token.length) {
 949                 DEBUG(1, ("gensec_gssapi_seal_packet: GSS Wrap length [%ld] *less* than caller length [%ld]\n",
 950                           (long)output_token.length, (long)length));
 951                 return NT_STATUS_INTERNAL_ERROR;
 952         }
 953         sig_length = output_token.length - input_token.length;
 954
 955         memcpy(data, ((uint8_t *)output_token.value) + sig_length, length);
 956         *sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, sig_length);
 957
 958         dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
 959         dump_data_pw("gensec_gssapi_seal_packet: clear\n", data, length);
 960         dump_data_pw("gensec_gssapi_seal_packet: sealed\n", ((uint8_t *)output_token.value) + sig_length, output_token.length - sig_length);
 961
 962         gss_release_buffer(&min_stat, &output_token);
 963
 964         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 965             && !conf_state) {
 966                 return NT_STATUS_ACCESS_DENIED;
 967         }
 968         return NT_STATUS_OK;
 969 }
 970
 971 static NTSTATUS gensec_gssapi_unseal_packet(struct gensec_security *gensec_security,
 972                                             TALLOC_CTX *mem_ctx,
 973                                             uint8_t *data, size_t length,
 974                                             const uint8_t *whole_pdu, size_t pdu_length,
 975                                             const DATA_BLOB *sig)
 976 {
 977         struct gensec_gssapi_state *gensec_gssapi_state
 978                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 979         OM_uint32 maj_stat, min_stat;
 980         gss_buffer_desc input_token, output_token;
 981         int conf_state;
 982         gss_qop_t qop_state;
 983         DATA_BLOB in;
 984
 985         dump_data_pw("gensec_gssapi_unseal_packet: sig\n", sig->data, sig->length);
 986
 987         in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
 988
 989         memcpy(in.data, sig->data, sig->length);
 990         memcpy(in.data + sig->length, data, length);
 991
 992         input_token.length = in.length;
 993         input_token.value = in.data;
 994
 995         maj_stat = gss_unwrap(&min_stat,
 996                               gensec_gssapi_state->gssapi_context,
 997                               &input_token,
 998                               &output_token,
 999                               &conf_state,
1000                               &qop_state);
1001         if (GSS_ERROR(maj_stat)) {
1002                 DEBUG(1, ("gensec_gssapi_unseal_packet: GSS UnWrap failed: %s\n",
1003                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
1004                 return NT_STATUS_ACCESS_DENIED;
1005         }
1006
1007         if (output_token.length != length) {
1008                 return NT_STATUS_INTERNAL_ERROR;
1009         }
1010
1011         memcpy(data, output_token.value, length);
1012
1013         gss_release_buffer(&min_stat, &output_token);
1014
1015         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
1016             && !conf_state) {
1017                 return NT_STATUS_ACCESS_DENIED;
1018         }
1019         return NT_STATUS_OK;
1020 }
1021
1022 static NTSTATUS gensec_gssapi_sign_packet(struct gensec_security *gensec_security,
1023                                           TALLOC_CTX *mem_ctx,
1024                                           const uint8_t *data, size_t length,
1025                                           const uint8_t *whole_pdu, size_t pdu_length,
1026                                           DATA_BLOB *sig)
1027 {
1028         struct gensec_gssapi_state *gensec_gssapi_state
1029                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1030         OM_uint32 maj_stat, min_stat;
1031         gss_buffer_desc input_token, output_token;
1032         int conf_state;
1033         ssize_t sig_length = 0;
1034
1035         input_token.length = length;
1036         input_token.value = discard_const_p(uint8_t *, data);
1037
1038         maj_stat = gss_wrap(&min_stat,
1039                             gensec_gssapi_state->gssapi_context,
1040                             0,
1041                             GSS_C_QOP_DEFAULT,
1042                             &input_token,
1043                             &conf_state,
1044                             &output_token);
1045         if (GSS_ERROR(maj_stat)) {
1046                 DEBUG(1, ("GSS Wrap failed: %s\n",
1047                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
1048                 return NT_STATUS_ACCESS_DENIED;
1049         }
1050
1051         if (output_token.length < input_token.length) {
1052                 DEBUG(1, ("gensec_gssapi_sign_packet: GSS Wrap length [%ld] *less* than caller length [%ld]\n",
1053                           (long)output_token.length, (long)length));
1054                 return NT_STATUS_INTERNAL_ERROR;
1055         }
1056
1057         /* Caller must pad to right boundary */
1058         sig_length = output_token.length - input_token.length;
1059
1060         *sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, sig_length);
1061
1062         dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
1063
1064         gss_release_buffer(&min_stat, &output_token);
1065
1066         return NT_STATUS_OK;
1067 }
1068
1069 static NTSTATUS gensec_gssapi_check_packet(struct gensec_security *gensec_security,
1070                                            TALLOC_CTX *mem_ctx,
1071                                            const uint8_t *data, size_t length,
1072                                            const uint8_t *whole_pdu, size_t pdu_length,
1073                                            const DATA_BLOB *sig)
1074 {
1075         struct gensec_gssapi_state *gensec_gssapi_state
1076                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1077         OM_uint32 maj_stat, min_stat;
1078         gss_buffer_desc input_token, output_token;
1079         int conf_state;
1080         gss_qop_t qop_state;
1081         DATA_BLOB in;
1082
1083         dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
1084
1085         in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
1086
1087         memcpy(in.data, sig->data, sig->length);
1088         memcpy(in.data + sig->length, data, length);
1089
1090         input_token.length = in.length;
1091         input_token.value = in.data;
1092
1093         maj_stat = gss_unwrap(&min_stat,
1094                               gensec_gssapi_state->gssapi_context,
1095                               &input_token,
1096                               &output_token,
1097                               &conf_state,
1098                               &qop_state);
1099         if (GSS_ERROR(maj_stat)) {
1100                 DEBUG(1, ("GSS UnWrap failed: %s\n",
1101                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
1102                 return NT_STATUS_ACCESS_DENIED;
1103         }
1104
1105         if (output_token.length != length) {
1106                 return NT_STATUS_INTERNAL_ERROR;
1107         }
1108
1109         gss_release_buffer(&min_stat, &output_token);
1110
1111         return NT_STATUS_OK;
1112 }
1113
1114 /* Try to figure out what features we actually got on the connection */
1115 static bool gensec_gssapi_have_feature(struct gensec_security *gensec_security,
1116                                        uint32_t feature)
1117 {
1118         struct gensec_gssapi_state *gensec_gssapi_state
1119                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1120         if (feature & GENSEC_FEATURE_SIGN) {
1121                 /* If we are going GSSAPI SASL, then we honour the second negotiation */
1122                 if (gensec_gssapi_state->sasl
1123                     && gensec_gssapi_state->sasl_state == STAGE_DONE) {
1124                         return ((gensec_gssapi_state->sasl_protection & NEG_SIGN)
1125                                 && (gensec_gssapi_state->got_flags & GSS_C_INTEG_FLAG));
1126                 }
1127                 return gensec_gssapi_state->got_flags & GSS_C_INTEG_FLAG;
1128         }
1129         if (feature & GENSEC_FEATURE_SEAL) {
1130                 /* If we are going GSSAPI SASL, then we honour the second negotiation */
1131                 if (gensec_gssapi_state->sasl
1132                     && gensec_gssapi_state->sasl_state == STAGE_DONE) {
1133                         return ((gensec_gssapi_state->sasl_protection & NEG_SEAL)
1134                                  && (gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG));
1135                 }
1136                 return gensec_gssapi_state->got_flags & GSS_C_CONF_FLAG;
1137         }
1138         if (feature & GENSEC_FEATURE_SESSION_KEY) {
1139                 /* Only for GSSAPI/Krb5 */
1140                 if (gss_oid_equal(gensec_gssapi_state->gss_oid, gss_mech_krb5)) {
1141                         return true;
1142                 }
1143         }
1144         if (feature & GENSEC_FEATURE_DCE_STYLE) {
1145                 return gensec_gssapi_state->got_flags & GSS_C_DCE_STYLE;
1146         }
1147         /* We can always do async (rather than strict request/reply) packets.  */
1148         if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
1149                 return true;
1150         }
1151         return false;
1152 }
1153
1154 /*
1155  * Extract the 'sesssion key' needed by SMB signing and ncacn_np
1156  * (for encrypting some passwords).
1157  *
1158  * This breaks all the abstractions, but what do you expect...
1159  */
1160 static NTSTATUS gensec_gssapi_session_key(struct gensec_security *gensec_security,
1161                                           DATA_BLOB *session_key)
1162 {
1163         struct gensec_gssapi_state *gensec_gssapi_state
1164                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1165         OM_uint32 maj_stat, min_stat;
1166         krb5_keyblock *subkey;
1167
1168         if (gensec_gssapi_state->session_key.data) {
1169                 *session_key = gensec_gssapi_state->session_key;
1170                 return NT_STATUS_OK;
1171         }
1172
1173         maj_stat = gsskrb5_get_initiator_subkey(&min_stat,
1174                                                 gensec_gssapi_state->gssapi_context,
1175                                                 &subkey);
1176         if (maj_stat != 0) {
1177                 DEBUG(1, ("NO session key for this mech\n"));
1178                 return NT_STATUS_NO_USER_SESSION_KEY;
1179         }
1180
1181         DEBUG(10, ("Got KRB5 session key of length %d\n",
1182                    (int)KRB5_KEY_LENGTH(subkey)));
1183         gensec_gssapi_state->session_key = data_blob_talloc(gensec_gssapi_state,
1184                                                             KRB5_KEY_DATA(subkey), KRB5_KEY_LENGTH(subkey));
1185         krb5_free_keyblock(gensec_gssapi_state->smb_krb5_context->krb5_context, subkey);
1186         *session_key = gensec_gssapi_state->session_key;
1187         dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
1188
1189         return NT_STATUS_OK;
1190 }
1191
1192 /* Get some basic (and authorization) information about the user on
1193  * this session.  This uses either the PAC (if present) or a local
1194  * database lookup */
1195 static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_security,
1196                                            struct auth_session_info **_session_info)
1197 {
1198         NTSTATUS nt_status;
1199         TALLOC_CTX *mem_ctx;
1200         struct gensec_gssapi_state *gensec_gssapi_state
1201                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1202         struct auth_serversupplied_info *server_info = NULL;
1203         struct auth_session_info *session_info = NULL;
1204         struct PAC_LOGON_INFO *logon_info;
1205         OM_uint32 maj_stat, min_stat;
1206         gss_buffer_desc name_token;
1207         gss_buffer_desc pac;
1208         krb5_keyblock *keyblock;
1209         time_t authtime;
1210         krb5_principal principal;
1211         char *principal_string;
1212         DATA_BLOB pac_blob;
1213
1214         if ((gensec_gssapi_state->gss_oid->length != gss_mech_krb5->length)
1215             || (memcmp(gensec_gssapi_state->gss_oid->elements, gss_mech_krb5->elements,
1216                        gensec_gssapi_state->gss_oid->length) != 0)) {
1217                 DEBUG(1, ("NO session info available for this mech\n"));
1218                 return NT_STATUS_INVALID_PARAMETER;
1219         }
1220
1221         mem_ctx = talloc_named(gensec_gssapi_state, 0, "gensec_gssapi_session_info context");
1222         NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
1223
1224         maj_stat = gss_display_name (&min_stat,
1225                                      gensec_gssapi_state->client_name,
1226                                      &name_token,
1227                                      NULL);
1228         if (GSS_ERROR(maj_stat)) {
1229                 DEBUG(1, ("GSS display_name failed: %s\n",
1230                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
1231                 talloc_free(mem_ctx);
1232                 return NT_STATUS_FOOBAR;
1233         }
1234
1235         principal_string = talloc_strndup(mem_ctx,
1236                                           (const char *)name_token.value,
1237                                           name_token.length);
1238
1239         gss_release_buffer(&min_stat, &name_token);
1240
1241         if (!principal_string) {
1242                 talloc_free(mem_ctx);
1243                 return NT_STATUS_NO_MEMORY;
1244         }
1245
1246         maj_stat = gsskrb5_extract_authz_data_from_sec_context(&min_stat,
1247                                                                gensec_gssapi_state->gssapi_context,
1248                                                                KRB5_AUTHDATA_WIN2K_PAC,
1249                                                                &pac);
1250
1251
1252         if (maj_stat == 0) {
1253                 pac_blob = data_blob_talloc(mem_ctx, pac.value, pac.length);
1254                 gss_release_buffer(&min_stat, &pac);
1255
1256         } else {
1257                 pac_blob = data_blob(NULL, 0);
1258         }
1259
1260         /* IF we have the PAC - otherwise we need to get this
1261          * data from elsewere - local ldb, or (TODO) lookup of some
1262          * kind...
1263          */
1264         if (pac_blob.length) {
1265                 krb5_error_code ret;
1266                 union netr_Validation validation;
1267
1268                 maj_stat = gsskrb5_extract_authtime_from_sec_context(&min_stat,
1269                                                                      gensec_gssapi_state->gssapi_context,
1270                                                                      &authtime);
1271
1272                 if (GSS_ERROR(maj_stat)) {
1273                         DEBUG(1, ("gsskrb5_extract_authtime_from_sec_context: %s\n",
1274                                   gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
1275                         talloc_free(mem_ctx);
1276                         return NT_STATUS_FOOBAR;
1277                 }
1278
1279                 maj_stat = gsskrb5_extract_service_keyblock(&min_stat,
1280                                                             gensec_gssapi_state->gssapi_context,
1281                                                             &keyblock);
1282
1283                 if (GSS_ERROR(maj_stat)) {
1284                         DEBUG(1, ("gsskrb5_copy_service_keyblock failed: %s\n",
1285                                   gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
1286                         talloc_free(mem_ctx);
1287                         return NT_STATUS_FOOBAR;
1288                 }
1289
1290                 ret = krb5_parse_name_flags(gensec_gssapi_state->smb_krb5_context->krb5_context,
1291                                             principal_string,
1292                                             KRB5_PRINCIPAL_PARSE_MUST_REALM,
1293                                             &principal);
1294                 if (ret) {
1295                         krb5_free_keyblock(gensec_gssapi_state->smb_krb5_context->krb5_context,
1296                                            keyblock);
1297                         talloc_free(mem_ctx);
1298                         return NT_STATUS_INVALID_PARAMETER;
1299                 }
1300
1301                 /* decode and verify the pac */
1302                 nt_status = kerberos_pac_logon_info(mem_ctx, &logon_info, pac_blob,
1303                                                     gensec_gssapi_state->smb_krb5_context->krb5_context,
1304                                                     NULL, keyblock, principal, authtime, NULL);
1305                 krb5_free_principal(gensec_gssapi_state->smb_krb5_context->krb5_context, principal);
1306                 krb5_free_keyblock(gensec_gssapi_state->smb_krb5_context->krb5_context,
1307                                    keyblock);
1308
1309                 if (!NT_STATUS_IS_OK(nt_status)) {
1310                         talloc_free(mem_ctx);
1311                         return nt_status;
1312                 }
1313                 validation.sam3 = &logon_info->info3;
1314                 nt_status = make_server_info_netlogon_validation(gensec_gssapi_state,
1315                                                                  NULL,
1316                                                                  3, &validation,
1317                                                                  &server_info);
1318                 if (!NT_STATUS_IS_OK(nt_status)) {
1319                         talloc_free(mem_ctx);
1320                         return nt_status;
1321                 }
1322         } else if (!lp_parm_bool(global_loadparm, NULL, "gensec", "require_pac", false)) {
1323                 DEBUG(1, ("Unable to find PAC, resorting to local user lookup: %s\n",
1324                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
1325                 nt_status = sam_get_server_info_principal(mem_ctx, global_loadparm, principal_string,
1326                                                           &server_info);
1327
1328                 if (!NT_STATUS_IS_OK(nt_status)) {
1329                         talloc_free(mem_ctx);
1330                         return nt_status;
1331                 }
1332         } else {
1333                 DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access: %s\n",
1334                           principal_string,
1335                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
1336                 return NT_STATUS_ACCESS_DENIED;
1337         }
1338
1339         /* references the server_info into the session_info */
1340         nt_status = auth_generate_session_info(mem_ctx, server_info, &session_info);
1341         if (!NT_STATUS_IS_OK(nt_status)) {
1342                 talloc_free(mem_ctx);
1343                 return nt_status;
1344         }
1345
1346         nt_status = gensec_gssapi_session_key(gensec_security, &session_info->session_key);
1347         if (!NT_STATUS_IS_OK(nt_status)) {
1348                 talloc_free(mem_ctx);
1349                 return nt_status;
1350         }
1351
1352         if (!(gensec_gssapi_state->got_flags & GSS_C_DELEG_FLAG)) {
1353                 DEBUG(10, ("gensec_gssapi: NO delegated credentials supplied by client\n"));
1354         } else {
1355                 krb5_error_code ret;
1356                 DEBUG(10, ("gensec_gssapi: delegated credentials supplied by client\n"));
1357                 session_info->credentials = cli_credentials_init(session_info);
1358                 if (!session_info->credentials) {
1359                         talloc_free(mem_ctx);
1360                         return NT_STATUS_NO_MEMORY;
1361                 }
1362
1363                 cli_credentials_set_event_context(session_info->credentials, gensec_security->event_ctx);
1364                 cli_credentials_set_conf(session_info->credentials, global_loadparm);
1365                 /* Just so we don't segfault trying to get at a username */
1366                 cli_credentials_set_anonymous(session_info->credentials);
1367
1368                 ret = cli_credentials_set_client_gss_creds(session_info->credentials,
1369                                                            gensec_gssapi_state->delegated_cred_handle,
1370                                                            CRED_SPECIFIED);
1371                 if (ret) {
1372                         talloc_free(mem_ctx);
1373                         return NT_STATUS_NO_MEMORY;
1374                 }
1375
1376                 /* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */
1377                 cli_credentials_set_kerberos_state(session_info->credentials, CRED_MUST_USE_KERBEROS);
1378
1379                 /* It has been taken from this place... */
1380                 gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
1381         }
1382         talloc_steal(gensec_gssapi_state, session_info);
1383         talloc_free(mem_ctx);
1384         *_session_info = session_info;
1385
1386         return NT_STATUS_OK;
1387 }
1388
1389 static const char *gensec_gssapi_krb5_oids[] = {
1390         GENSEC_OID_KERBEROS5_OLD,
1391         GENSEC_OID_KERBEROS5,
1392         NULL
1393 };
1394
1395 static const char *gensec_gssapi_spnego_oids[] = {
1396         GENSEC_OID_SPNEGO,
1397         NULL
1398 };
1399
1400 /* As a server, this could in theory accept any GSSAPI mech */
1401 static const struct gensec_security_ops gensec_gssapi_spnego_security_ops = {
1402         .name           = "gssapi_spnego",
1403         .sasl_name      = "GSS-SPNEGO",
1404         .auth_type      = DCERPC_AUTH_TYPE_SPNEGO,
1405         .oid            = gensec_gssapi_spnego_oids,
1406         .client_start   = gensec_gssapi_client_start,
1407         .server_start   = gensec_gssapi_server_start,
1408         .magic          = gensec_gssapi_magic,
1409         .update         = gensec_gssapi_update,
1410         .session_key    = gensec_gssapi_session_key,
1411         .session_info   = gensec_gssapi_session_info,
1412         .sign_packet    = gensec_gssapi_sign_packet,
1413         .check_packet   = gensec_gssapi_check_packet,
1414         .seal_packet    = gensec_gssapi_seal_packet,
1415         .unseal_packet  = gensec_gssapi_unseal_packet,
1416         .wrap           = gensec_gssapi_wrap,
1417         .unwrap         = gensec_gssapi_unwrap,
1418         .have_feature   = gensec_gssapi_have_feature,
1419         .enabled        = false,
1420         .kerberos       = true,
1421         .priority       = GENSEC_GSSAPI
1422 };
1423
1424 /* As a server, this could in theory accept any GSSAPI mech */
1425 static const struct gensec_security_ops gensec_gssapi_krb5_security_ops = {
1426         .name           = "gssapi_krb5",
1427         .auth_type      = DCERPC_AUTH_TYPE_KRB5,
1428         .oid            = gensec_gssapi_krb5_oids,
1429         .client_start   = gensec_gssapi_client_start,
1430         .server_start   = gensec_gssapi_server_start,
1431         .magic          = gensec_gssapi_magic,
1432         .update         = gensec_gssapi_update,
1433         .session_key    = gensec_gssapi_session_key,
1434         .session_info   = gensec_gssapi_session_info,
1435         .sign_packet    = gensec_gssapi_sign_packet,
1436         .check_packet   = gensec_gssapi_check_packet,
1437         .seal_packet    = gensec_gssapi_seal_packet,
1438         .unseal_packet  = gensec_gssapi_unseal_packet,
1439         .wrap           = gensec_gssapi_wrap,
1440         .unwrap         = gensec_gssapi_unwrap,
1441         .have_feature   = gensec_gssapi_have_feature,
1442         .enabled        = true,
1443         .kerberos       = true,
1444         .priority       = GENSEC_GSSAPI
1445 };
1446
1447 /* As a server, this could in theory accept any GSSAPI mech */
1448 static const struct gensec_security_ops gensec_gssapi_sasl_krb5_security_ops = {
1449         .name             = "gssapi_krb5_sasl",
1450         .sasl_name        = "GSSAPI",
1451         .client_start     = gensec_gssapi_sasl_client_start,
1452         .server_start     = gensec_gssapi_sasl_server_start,
1453         .update           = gensec_gssapi_update,
1454         .session_key      = gensec_gssapi_session_key,
1455         .session_info     = gensec_gssapi_session_info,
1456         .max_input_size   = gensec_gssapi_max_input_size,
1457         .max_wrapped_size = gensec_gssapi_max_wrapped_size,
1458         .wrap             = gensec_gssapi_wrap,
1459         .unwrap           = gensec_gssapi_unwrap,
1460         .have_feature     = gensec_gssapi_have_feature,
1461         .enabled          = true,
1462         .kerberos         = true,
1463         .priority         = GENSEC_GSSAPI
1464 };
1465
1466 NTSTATUS gensec_gssapi_init(void)
1467 {
1468         NTSTATUS ret;
1469
1470         ret = gensec_register(&gensec_gssapi_spnego_security_ops);
1471         if (!NT_STATUS_IS_OK(ret)) {
1472                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1473                         gensec_gssapi_spnego_security_ops.name));
1474                 return ret;
1475         }
1476
1477         ret = gensec_register(&gensec_gssapi_krb5_security_ops);
1478         if (!NT_STATUS_IS_OK(ret)) {
1479                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1480                         gensec_gssapi_krb5_security_ops.name));
1481                 return ret;
1482         }
1483
1484         ret = gensec_register(&gensec_gssapi_sasl_krb5_security_ops);
1485         if (!NT_STATUS_IS_OK(ret)) {
1486                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1487                         gensec_gssapi_sasl_krb5_security_ops.name));
1488                 return ret;
1489         }
1490
1491         return ret;
1492 }