source/auth/gensec/spnego.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    RFC2478 Compliant SPNEGO implementation
   5
   6    Copyright (C) Jim McDonough <jmcd@us.ibm.com>      2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "auth/gensec/spnego.h"
  26 #include "librpc/gen_ndr/ndr_dcerpc.h"
  27 #include "auth/credentials/credentials.h"
  28 #include "auth/gensec/gensec.h"
  29 #include "auth/gensec/socket.h"
  30
  31 enum spnego_state_position {
  32         SPNEGO_SERVER_START,
  33         SPNEGO_CLIENT_START,
  34         SPNEGO_SERVER_TARG,
  35         SPNEGO_CLIENT_TARG,
  36         SPNEGO_FALLBACK,
  37         SPNEGO_DONE
  38 };
  39
  40 struct spnego_state {
  41         enum spnego_message_type expected_packet;
  42         enum spnego_state_position state_position;
  43         struct gensec_security *sub_sec_security;
  44         bool no_response_expected;
  45
  46         const char *neg_oid;
  47 };
  48
  49
  50 static NTSTATUS gensec_spnego_client_start(struct gensec_security *gensec_security)
  51 {
  52         struct spnego_state *spnego_state;
  53
  54         spnego_state = talloc(gensec_security, struct spnego_state);
  55         if (!spnego_state) {
  56                 return NT_STATUS_NO_MEMORY;
  57         }
  58
  59         spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
  60         spnego_state->state_position = SPNEGO_CLIENT_START;
  61         spnego_state->sub_sec_security = NULL;
  62         spnego_state->no_response_expected = false;
  63
  64         gensec_security->private_data = spnego_state;
  65         return NT_STATUS_OK;
  66 }
  67
  68 static NTSTATUS gensec_spnego_server_start(struct gensec_security *gensec_security)
  69 {
  70         struct spnego_state *spnego_state;
  71
  72         spnego_state = talloc(gensec_security, struct spnego_state);
  73         if (!spnego_state) {
  74                 return NT_STATUS_NO_MEMORY;
  75         }
  76
  77         spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
  78         spnego_state->state_position = SPNEGO_SERVER_START;
  79         spnego_state->sub_sec_security = NULL;
  80         spnego_state->no_response_expected = false;
  81
  82         gensec_security->private_data = spnego_state;
  83         return NT_STATUS_OK;
  84 }
  85
  86 /*
  87   wrappers for the spnego_*() functions
  88 */
  89 static NTSTATUS gensec_spnego_unseal_packet(struct gensec_security *gensec_security,
  90                                             TALLOC_CTX *mem_ctx,
  91                                             uint8_t *data, size_t length,
  92                                             const uint8_t *whole_pdu, size_t pdu_length,
  93                                             const DATA_BLOB *sig)
  94 {
  95         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
  96
  97         if (spnego_state->state_position != SPNEGO_DONE
  98             && spnego_state->state_position != SPNEGO_FALLBACK) {
  99                 return NT_STATUS_INVALID_PARAMETER;
 100         }
 101
 102         return gensec_unseal_packet(spnego_state->sub_sec_security,
 103                                     mem_ctx,
 104                                     data, length,
 105                                     whole_pdu, pdu_length,
 106                                     sig);
 107 }
 108
 109 static NTSTATUS gensec_spnego_check_packet(struct gensec_security *gensec_security,
 110                                            TALLOC_CTX *mem_ctx,
 111                                            const uint8_t *data, size_t length,
 112                                            const uint8_t *whole_pdu, size_t pdu_length,
 113                                            const DATA_BLOB *sig)
 114 {
 115         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 116
 117         if (spnego_state->state_position != SPNEGO_DONE
 118             && spnego_state->state_position != SPNEGO_FALLBACK) {
 119                 return NT_STATUS_INVALID_PARAMETER;
 120         }
 121
 122         return gensec_check_packet(spnego_state->sub_sec_security,
 123                                    mem_ctx,
 124                                    data, length,
 125                                    whole_pdu, pdu_length,
 126                                    sig);
 127 }
 128
 129 static NTSTATUS gensec_spnego_seal_packet(struct gensec_security *gensec_security,
 130                                           TALLOC_CTX *mem_ctx,
 131                                           uint8_t *data, size_t length,
 132                                           const uint8_t *whole_pdu, size_t pdu_length,
 133                                           DATA_BLOB *sig)
 134 {
 135         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 136
 137         if (spnego_state->state_position != SPNEGO_DONE
 138             && spnego_state->state_position != SPNEGO_FALLBACK) {
 139                 return NT_STATUS_INVALID_PARAMETER;
 140         }
 141
 142         return gensec_seal_packet(spnego_state->sub_sec_security,
 143                                   mem_ctx,
 144                                   data, length,
 145                                   whole_pdu, pdu_length,
 146                                   sig);
 147 }
 148
 149 static NTSTATUS gensec_spnego_sign_packet(struct gensec_security *gensec_security,
 150                                           TALLOC_CTX *mem_ctx,
 151                                           const uint8_t *data, size_t length,
 152                                           const uint8_t *whole_pdu, size_t pdu_length,
 153                                           DATA_BLOB *sig)
 154 {
 155         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 156
 157         if (spnego_state->state_position != SPNEGO_DONE
 158             && spnego_state->state_position != SPNEGO_FALLBACK) {
 159                 return NT_STATUS_INVALID_PARAMETER;
 160         }
 161
 162         return gensec_sign_packet(spnego_state->sub_sec_security,
 163                                   mem_ctx,
 164                                   data, length,
 165                                   whole_pdu, pdu_length,
 166                                   sig);
 167 }
 168
 169 static NTSTATUS gensec_spnego_wrap(struct gensec_security *gensec_security,
 170                                    TALLOC_CTX *mem_ctx,
 171                                    const DATA_BLOB *in,
 172                                    DATA_BLOB *out)
 173 {
 174         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 175
 176         if (spnego_state->state_position != SPNEGO_DONE
 177             && spnego_state->state_position != SPNEGO_FALLBACK) {
 178                 DEBUG(1, ("gensec_spnego_wrap: wrong state for wrap\n"));
 179                 return NT_STATUS_INVALID_PARAMETER;
 180         }
 181
 182         return gensec_wrap(spnego_state->sub_sec_security,
 183                            mem_ctx, in, out);
 184 }
 185
 186 static NTSTATUS gensec_spnego_unwrap(struct gensec_security *gensec_security,
 187                                      TALLOC_CTX *mem_ctx,
 188                                      const DATA_BLOB *in,
 189                                      DATA_BLOB *out)
 190 {
 191         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 192
 193         if (spnego_state->state_position != SPNEGO_DONE
 194             && spnego_state->state_position != SPNEGO_FALLBACK) {
 195                 DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
 196                 return NT_STATUS_INVALID_PARAMETER;
 197         }
 198
 199         return gensec_unwrap(spnego_state->sub_sec_security,
 200                              mem_ctx, in, out);
 201 }
 202
 203 static NTSTATUS gensec_spnego_wrap_packets(struct gensec_security *gensec_security,
 204                                            TALLOC_CTX *mem_ctx,
 205                                            const DATA_BLOB *in,
 206                                            DATA_BLOB *out,
 207                                            size_t *len_processed)
 208 {
 209         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 210
 211         if (spnego_state->state_position != SPNEGO_DONE
 212             && spnego_state->state_position != SPNEGO_FALLBACK) {
 213                 DEBUG(1, ("gensec_spnego_wrap: wrong state for wrap\n"));
 214                 return NT_STATUS_INVALID_PARAMETER;
 215         }
 216
 217         return gensec_wrap_packets(spnego_state->sub_sec_security,
 218                                    mem_ctx, in, out,
 219                                    len_processed);
 220 }
 221
 222 static NTSTATUS gensec_spnego_packet_full_request(struct gensec_security *gensec_security,
 223                                                 DATA_BLOB blob, size_t *size)
 224 {
 225         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 226
 227         if (spnego_state->state_position != SPNEGO_DONE
 228             && spnego_state->state_position != SPNEGO_FALLBACK) {
 229                 DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
 230                 return NT_STATUS_INVALID_PARAMETER;
 231         }
 232
 233         return gensec_packet_full_request(spnego_state->sub_sec_security,
 234                                           blob, size);
 235 }
 236
 237 static NTSTATUS gensec_spnego_unwrap_packets(struct gensec_security *gensec_security,
 238                                              TALLOC_CTX *mem_ctx,
 239                                              const DATA_BLOB *in,
 240                                              DATA_BLOB *out,
 241                                              size_t *len_processed)
 242 {
 243         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 244
 245         if (spnego_state->state_position != SPNEGO_DONE
 246             && spnego_state->state_position != SPNEGO_FALLBACK) {
 247                 DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
 248                 return NT_STATUS_INVALID_PARAMETER;
 249         }
 250
 251         return gensec_unwrap_packets(spnego_state->sub_sec_security,
 252                                      mem_ctx, in, out,
 253                                      len_processed);
 254 }
 255
 256 static size_t gensec_spnego_sig_size(struct gensec_security *gensec_security, size_t data_size)
 257 {
 258         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 259
 260         if (spnego_state->state_position != SPNEGO_DONE
 261             && spnego_state->state_position != SPNEGO_FALLBACK) {
 262                 return 0;
 263         }
 264
 265         return gensec_sig_size(spnego_state->sub_sec_security, data_size);
 266 }
 267
 268 static size_t gensec_spnego_max_input_size(struct gensec_security *gensec_security)
 269 {
 270         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 271
 272         if (spnego_state->state_position != SPNEGO_DONE
 273             && spnego_state->state_position != SPNEGO_FALLBACK) {
 274                 return 0;
 275         }
 276
 277         return gensec_max_input_size(spnego_state->sub_sec_security);
 278 }
 279
 280 static size_t gensec_spnego_max_wrapped_size(struct gensec_security *gensec_security)
 281 {
 282         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 283
 284         if (spnego_state->state_position != SPNEGO_DONE
 285             && spnego_state->state_position != SPNEGO_FALLBACK) {
 286                 return 0;
 287         }
 288
 289         return gensec_max_wrapped_size(spnego_state->sub_sec_security);
 290 }
 291
 292 static NTSTATUS gensec_spnego_session_key(struct gensec_security *gensec_security,
 293                                           DATA_BLOB *session_key)
 294 {
 295         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 296         if (!spnego_state->sub_sec_security) {
 297                 return NT_STATUS_INVALID_PARAMETER;
 298         }
 299
 300         return gensec_session_key(spnego_state->sub_sec_security,
 301                                   session_key);
 302 }
 303
 304 static NTSTATUS gensec_spnego_session_info(struct gensec_security *gensec_security,
 305                                                                       struct auth_session_info **session_info)
 306 {
 307         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 308         if (!spnego_state->sub_sec_security) {
 309                 return NT_STATUS_INVALID_PARAMETER;
 310         }
 311
 312         return gensec_session_info(spnego_state->sub_sec_security,
 313                                    session_info);
 314 }
 315
 316 /** Fallback to another GENSEC mechanism, based on magic strings
 317  *
 318  * This is the 'fallback' case, where we don't get SPNEGO, and have to
 319  * try all the other options (and hope they all have a magic string
 320  * they check)
 321 */
 322
 323 static NTSTATUS gensec_spnego_server_try_fallback(struct gensec_security *gensec_security,
 324                                                   struct spnego_state *spnego_state,
 325                                                   TALLOC_CTX *out_mem_ctx,
 326                                                   const DATA_BLOB in, DATA_BLOB *out)
 327 {
 328         int i,j;
 329         struct gensec_security_ops **all_ops
 330                 = gensec_security_mechs(gensec_security, out_mem_ctx);
 331         for (i=0; all_ops[i]; i++) {
 332                 bool is_spnego;
 333                 NTSTATUS nt_status;
 334                 if (!all_ops[i]->oid) {
 335                         continue;
 336                 }
 337
 338                 is_spnego = false;
 339                 for (j=0; all_ops[i]->oid[j]; j++) {
 340                         if (strcasecmp(GENSEC_OID_SPNEGO,all_ops[i]->oid[j]) == 0) {
 341                                 is_spnego = true;
 342                         }
 343                 }
 344                 if (is_spnego) {
 345                         continue;
 346                 }
 347
 348                 if (!all_ops[i]->magic) {
 349                         continue;
 350                 }
 351
 352                 nt_status = all_ops[i]->magic(gensec_security, &in);
 353                 if (!NT_STATUS_IS_OK(nt_status)) {
 354                         continue;
 355                 }
 356
 357                 spnego_state->state_position = SPNEGO_FALLBACK;
 358
 359                 nt_status = gensec_subcontext_start(spnego_state,
 360                                                     gensec_security,
 361                                                     &spnego_state->sub_sec_security);
 362
 363                 if (!NT_STATUS_IS_OK(nt_status)) {
 364                         return nt_status;
 365                 }
 366                 /* select the sub context */
 367                 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
 368                                                      all_ops[i]);
 369                 if (!NT_STATUS_IS_OK(nt_status)) {
 370                         return nt_status;
 371                 }
 372                 nt_status = gensec_update(spnego_state->sub_sec_security,
 373                                           out_mem_ctx, in, out);
 374                 return nt_status;
 375         }
 376         DEBUG(1, ("Failed to parse SPNEGO request\n"));
 377         return NT_STATUS_INVALID_PARAMETER;
 378
 379 }
 380
 381 /*
 382    Parse the netTokenInit, either from the client, to the server, or
 383    from the server to the client.
 384 */
 385
 386 static NTSTATUS gensec_spnego_parse_negTokenInit(struct gensec_security *gensec_security,
 387                                                  struct spnego_state *spnego_state,
 388                                                  TALLOC_CTX *out_mem_ctx,
 389                                                  const char **mechType,
 390                                                  const DATA_BLOB unwrapped_in, DATA_BLOB *unwrapped_out)
 391 {
 392         int i;
 393         NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
 394         DATA_BLOB null_data_blob = data_blob(NULL,0);
 395
 396         const struct gensec_security_ops_wrapper *all_sec
 397                 = gensec_security_by_oid_list(gensec_security,
 398                                               out_mem_ctx,
 399                                               mechType,
 400                                               GENSEC_OID_SPNEGO);
 401         if (spnego_state->state_position == SPNEGO_SERVER_START) {
 402                 for (i=0; all_sec && all_sec[i].op; i++) {
 403                         /* optomisitic token */
 404                         if (strcmp(all_sec[i].oid, mechType[0]) == 0) {
 405                                 nt_status = gensec_subcontext_start(spnego_state,
 406                                                                     gensec_security,
 407                                                                     &spnego_state->sub_sec_security);
 408                                 if (!NT_STATUS_IS_OK(nt_status)) {
 409                                         return nt_status;
 410                                 }
 411                                 /* select the sub context */
 412                                 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
 413                                                                      all_sec[i].op);
 414                                 if (!NT_STATUS_IS_OK(nt_status)) {
 415                                         talloc_free(spnego_state->sub_sec_security);
 416                                         spnego_state->sub_sec_security = NULL;
 417                                         break;
 418                                 }
 419
 420                                 nt_status = gensec_update(spnego_state->sub_sec_security,
 421                                                           out_mem_ctx,
 422                                                           unwrapped_in,
 423                                                           unwrapped_out);
 424                                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) ||
 425                                     NT_STATUS_EQUAL(nt_status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
 426                                         /* Pretend we never started it (lets the first run find some incompatible demand) */
 427
 428                                         DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed to parse contents: %s\n",
 429                                                   spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
 430                                         talloc_free(spnego_state->sub_sec_security);
 431                                         spnego_state->sub_sec_security = NULL;
 432                                         break;
 433                                 }
 434
 435                                 spnego_state->neg_oid = all_sec[i].oid;
 436                                 break;
 437                         }
 438                 }
 439         }
 440
 441         /* Having tried any optomisitc token from the client (if we
 442          * were the server), if we didn't get anywhere, walk our list
 443          * in our preference order */
 444
 445         if (!spnego_state->sub_sec_security) {
 446                 for (i=0; all_sec && all_sec[i].op; i++) {
 447                         nt_status = gensec_subcontext_start(spnego_state,
 448                                                             gensec_security,
 449                                                             &spnego_state->sub_sec_security);
 450                         if (!NT_STATUS_IS_OK(nt_status)) {
 451                                 return nt_status;
 452                         }
 453                         /* select the sub context */
 454                         nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
 455                                                              all_sec[i].op);
 456                         if (!NT_STATUS_IS_OK(nt_status)) {
 457                                 talloc_free(spnego_state->sub_sec_security);
 458                                 spnego_state->sub_sec_security = NULL;
 459                                 continue;
 460                         }
 461
 462                         spnego_state->neg_oid = all_sec[i].oid;
 463
 464                         /* only get the helping start blob for the first OID */
 465                         nt_status = gensec_update(spnego_state->sub_sec_security,
 466                                                   out_mem_ctx,
 467                                                   null_data_blob,
 468                                                   unwrapped_out);
 469
 470                         /* it is likely that a NULL input token will
 471                          * not be liked by most server mechs, but if
 472                          * we are in the client, we want the first
 473                          * update packet to be able to abort the use
 474                          * of this mech */
 475                         if (spnego_state->state_position != SPNEGO_SERVER_START) {
 476                                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) ||
 477                                     NT_STATUS_EQUAL(nt_status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
 478                                         /* Pretend we never started it (lets the first run find some incompatible demand) */
 479
 480                                         DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed to parse: %s\n",
 481                                                   spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
 482                                         talloc_free(spnego_state->sub_sec_security);
 483                                         spnego_state->sub_sec_security = NULL;
 484                                         continue;
 485                                 }
 486                         }
 487
 488                         break;
 489                 }
 490         }
 491
 492         if (spnego_state->sub_sec_security) {
 493                 /* it is likely that a NULL input token will
 494                  * not be liked by most server mechs, but this
 495                  * does the right thing in the CIFS client.
 496                  * just push us along the merry-go-round
 497                  * again, and hope for better luck next
 498                  * time */
 499
 500                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
 501                         *unwrapped_out = data_blob(NULL, 0);
 502                         nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 503                 }
 504
 505                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)
 506                     && !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)
 507                     && !NT_STATUS_IS_OK(nt_status)) {
 508                         DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed: %s\n",
 509                                   spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
 510                         talloc_free(spnego_state->sub_sec_security);
 511                         spnego_state->sub_sec_security = NULL;
 512
 513                         /* We started the mech correctly, and the
 514                          * input from the other side was valid.
 515                          * Return the error (say bad password, invalid
 516                          * ticket) */
 517                         return nt_status;
 518                 }
 519
 520
 521                 return nt_status; /* OK, INVALID_PARAMETER ore MORE PROCESSING */
 522         }
 523
 524         DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
 525         /* we could re-negotiate here, but it would only work
 526          * if the client or server lied about what it could
 527          * support the first time.  Lets keep this code to
 528          * reality */
 529
 530         return nt_status;
 531 }
 532
 533 /** create a negTokenInit
 534  *
 535  * This is the same packet, no matter if the client or server sends it first, but it is always the first packet
 536 */
 537 static NTSTATUS gensec_spnego_create_negTokenInit(struct gensec_security *gensec_security,
 538                                                   struct spnego_state *spnego_state,
 539                                                   TALLOC_CTX *out_mem_ctx,
 540                                                   const DATA_BLOB in, DATA_BLOB *out)
 541 {
 542         int i;
 543         NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
 544         DATA_BLOB null_data_blob = data_blob(NULL,0);
 545         const char **mechTypes = NULL;
 546         DATA_BLOB unwrapped_out = data_blob(NULL, 0);
 547         const struct gensec_security_ops_wrapper *all_sec;
 548         const char *principal = NULL;
 549
 550         mechTypes = gensec_security_oids(gensec_security,
 551                                          out_mem_ctx, GENSEC_OID_SPNEGO);
 552
 553         all_sec = gensec_security_by_oid_list(gensec_security,
 554                                               out_mem_ctx,
 555                                               mechTypes,
 556                                               GENSEC_OID_SPNEGO);
 557         for (i=0; all_sec && all_sec[i].op; i++) {
 558                 struct spnego_data spnego_out;
 559                 nt_status = gensec_subcontext_start(spnego_state,
 560                                                     gensec_security,
 561                                                     &spnego_state->sub_sec_security);
 562                 if (!NT_STATUS_IS_OK(nt_status)) {
 563                         return nt_status;
 564                 }
 565                 /* select the sub context */
 566                 nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
 567                                                      all_sec[i].op);
 568                 if (!NT_STATUS_IS_OK(nt_status)) {
 569                         talloc_free(spnego_state->sub_sec_security);
 570                         spnego_state->sub_sec_security = NULL;
 571                         continue;
 572                 }
 573
 574                 /* In the client, try and produce the first (optimistic) packet */
 575                 if (spnego_state->state_position == SPNEGO_CLIENT_START) {
 576                         nt_status = gensec_update(spnego_state->sub_sec_security,
 577                                                   out_mem_ctx,
 578                                                   null_data_blob,
 579                                                   &unwrapped_out);
 580
 581                         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)
 582                             && !NT_STATUS_IS_OK(nt_status)) {
 583                                 DEBUG(1, ("SPNEGO(%s) creating NEG_TOKEN_INIT failed: %s\n",
 584                                           spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
 585                                 talloc_free(spnego_state->sub_sec_security);
 586                                 spnego_state->sub_sec_security = NULL;
 587                                 /* Pretend we never started it (lets the first run find some incompatible demand) */
 588
 589                                 continue;
 590                         }
 591                 }
 592
 593                 spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
 594
 595                 /* List the remaining mechs as options */
 596                 spnego_out.negTokenInit.mechTypes = gensec_security_oids_from_ops_wrapped(out_mem_ctx,
 597                                                                                           &all_sec[i]);
 598                 spnego_out.negTokenInit.reqFlags = 0;
 599
 600                 if (spnego_state->state_position == SPNEGO_SERVER_START) {
 601                         /* server credentials */
 602                         struct cli_credentials *creds = gensec_get_credentials(gensec_security);
 603                         if (creds) {
 604                                 principal = cli_credentials_get_principal(creds, out_mem_ctx);
 605                         }
 606                 }
 607                 if (principal) {
 608                         spnego_out.negTokenInit.mechListMIC
 609                                 = data_blob_string_const(principal);
 610                 } else {
 611                         spnego_out.negTokenInit.mechListMIC = null_data_blob;
 612                 }
 613
 614                 spnego_out.negTokenInit.mechToken = unwrapped_out;
 615
 616                 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
 617                         DEBUG(1, ("Failed to write NEG_TOKEN_INIT\n"));
 618                                 return NT_STATUS_INVALID_PARAMETER;
 619                 }
 620
 621                 /* set next state */
 622                 spnego_state->neg_oid = all_sec[i].oid;
 623
 624                 if (NT_STATUS_IS_OK(nt_status)) {
 625                         spnego_state->no_response_expected = true;
 626                 }
 627
 628                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
 629         }
 630         talloc_free(spnego_state->sub_sec_security);
 631         spnego_state->sub_sec_security = NULL;
 632
 633         DEBUG(1, ("Failed to setup SPNEGO negTokenInit request: %s\n", nt_errstr(nt_status)));
 634         return NT_STATUS_INVALID_PARAMETER;
 635 }
 636
 637
 638 /** create a server negTokenTarg
 639  *
 640  * This is the case, where the client is the first one who sends data
 641 */
 642
 643 static NTSTATUS gensec_spnego_server_negTokenTarg(struct gensec_security *gensec_security,
 644                                                   struct spnego_state *spnego_state,
 645                                                   TALLOC_CTX *out_mem_ctx,
 646                                                   NTSTATUS nt_status,
 647                                                   const DATA_BLOB unwrapped_out, DATA_BLOB *out)
 648 {
 649         struct spnego_data spnego_out;
 650         DATA_BLOB null_data_blob = data_blob(NULL, 0);
 651
 652         /* compose reply */
 653         spnego_out.type = SPNEGO_NEG_TOKEN_TARG;
 654         spnego_out.negTokenTarg.responseToken = unwrapped_out;
 655         spnego_out.negTokenTarg.mechListMIC = null_data_blob;
 656         spnego_out.negTokenTarg.supportedMech = NULL;
 657
 658         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 659                 spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
 660                 spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
 661                 spnego_state->state_position = SPNEGO_SERVER_TARG;
 662         } else if (NT_STATUS_IS_OK(nt_status)) {
 663                 if (unwrapped_out.data) {
 664                         spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
 665                 }
 666                 spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
 667                 spnego_state->state_position = SPNEGO_DONE;
 668         } else {
 669                 spnego_out.negTokenTarg.negResult = SPNEGO_REJECT;
 670                 DEBUG(2, ("SPNEGO login failed: %s\n", nt_errstr(nt_status)));
 671                 spnego_state->state_position = SPNEGO_DONE;
 672         }
 673
 674         if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
 675                 DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_TARG\n"));
 676                 return NT_STATUS_INVALID_PARAMETER;
 677         }
 678
 679         spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
 680
 681         return nt_status;
 682 }
 683
 684
 685 static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
 686                                      const DATA_BLOB in, DATA_BLOB *out)
 687 {
 688         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
 689         DATA_BLOB null_data_blob = data_blob(NULL, 0);
 690         DATA_BLOB unwrapped_out = data_blob(NULL, 0);
 691         struct spnego_data spnego_out;
 692         struct spnego_data spnego;
 693
 694         ssize_t len;
 695
 696         *out = data_blob(NULL, 0);
 697
 698         if (!out_mem_ctx) {
 699                 out_mem_ctx = spnego_state;
 700         }
 701
 702         /* and switch into the state machine */
 703
 704         switch (spnego_state->state_position) {
 705         case SPNEGO_FALLBACK:
 706                 return gensec_update(spnego_state->sub_sec_security,
 707                                      out_mem_ctx, in, out);
 708         case SPNEGO_SERVER_START:
 709         {
 710                 NTSTATUS nt_status;
 711                 if (in.length) {
 712
 713                         len = spnego_read_data(gensec_security, in, &spnego);
 714                         if (len == -1) {
 715                                 return gensec_spnego_server_try_fallback(gensec_security, spnego_state,
 716                                                                          out_mem_ctx, in, out);
 717                         }
 718                         /* client sent NegTargetInit, we send NegTokenTarg */
 719
 720                         /* OK, so it's real SPNEGO, check the packet's the one we expect */
 721                         if (spnego.type != spnego_state->expected_packet) {
 722                                 DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type,
 723                                           spnego_state->expected_packet));
 724                                 dump_data(1, in.data, in.length);
 725                                 spnego_free_data(&spnego);
 726                                 return NT_STATUS_INVALID_PARAMETER;
 727                         }
 728
 729                         nt_status = gensec_spnego_parse_negTokenInit(gensec_security,
 730                                                                      spnego_state,
 731                                                                      out_mem_ctx,
 732                                                                      spnego.negTokenInit.mechTypes,
 733                                                                      spnego.negTokenInit.mechToken,
 734                                                                      &unwrapped_out);
 735
 736                         nt_status = gensec_spnego_server_negTokenTarg(gensec_security,
 737                                                                       spnego_state,
 738                                                                       out_mem_ctx,
 739                                                                       nt_status,
 740                                                                       unwrapped_out,
 741                                                                       out);
 742
 743                         spnego_free_data(&spnego);
 744
 745                         return nt_status;
 746                 } else {
 747                         nt_status = gensec_spnego_create_negTokenInit(gensec_security, spnego_state,
 748                                                                       out_mem_ctx, in, out);
 749                         spnego_state->state_position = SPNEGO_SERVER_START;
 750                         spnego_state->expected_packet = SPNEGO_NEG_TOKEN_INIT;
 751                         return nt_status;
 752                 }
 753         }
 754
 755         case SPNEGO_CLIENT_START:
 756         {
 757                 /* The server offers a list of mechanisms */
 758
 759                 const char *my_mechs[] = {NULL, NULL};
 760                 NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
 761
 762                 if (!in.length) {
 763                         /* client to produce negTokenInit */
 764                         nt_status = gensec_spnego_create_negTokenInit(gensec_security, spnego_state,
 765                                                                  out_mem_ctx, in, out);
 766                         spnego_state->state_position = SPNEGO_CLIENT_TARG;
 767                         spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
 768                         return nt_status;
 769                 }
 770
 771                 len = spnego_read_data(gensec_security, in, &spnego);
 772
 773                 if (len == -1) {
 774                         DEBUG(1, ("Invalid SPNEGO request:\n"));
 775                         dump_data(1, in.data, in.length);
 776                         return NT_STATUS_INVALID_PARAMETER;
 777                 }
 778
 779                 /* OK, so it's real SPNEGO, check the packet's the one we expect */
 780                 if (spnego.type != spnego_state->expected_packet) {
 781                         DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type,
 782                                   spnego_state->expected_packet));
 783                         dump_data(1, in.data, in.length);
 784                         spnego_free_data(&spnego);
 785                         return NT_STATUS_INVALID_PARAMETER;
 786                 }
 787
 788                 if (spnego.negTokenInit.targetPrincipal) {
 789                         DEBUG(5, ("Server claims it's principal name is %s\n", spnego.negTokenInit.targetPrincipal));
 790                         gensec_set_target_principal(gensec_security, spnego.negTokenInit.targetPrincipal);
 791                 }
 792
 793                 nt_status = gensec_spnego_parse_negTokenInit(gensec_security,
 794                                                              spnego_state,
 795                                                              out_mem_ctx,
 796                                                              spnego.negTokenInit.mechTypes,
 797                                                              spnego.negTokenInit.mechToken,
 798                                                              &unwrapped_out);
 799
 800                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(nt_status)) {
 801                         spnego_free_data(&spnego);
 802                         return nt_status;
 803                 }
 804
 805                 my_mechs[0] = spnego_state->neg_oid;
 806                 /* compose reply */
 807                 spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
 808                 spnego_out.negTokenInit.mechTypes = my_mechs;
 809                 spnego_out.negTokenInit.reqFlags = 0;
 810                 spnego_out.negTokenInit.mechListMIC = null_data_blob;
 811                 spnego_out.negTokenInit.mechToken = unwrapped_out;
 812
 813                 if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
 814                         DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_INIT\n"));
 815                                 return NT_STATUS_INVALID_PARAMETER;
 816                 }
 817
 818                 /* set next state */
 819                 spnego_state->expected_packet = SPNEGO_NEG_TOKEN_TARG;
 820                 spnego_state->state_position = SPNEGO_CLIENT_TARG;
 821
 822                 if (NT_STATUS_IS_OK(nt_status)) {
 823                         spnego_state->no_response_expected = true;
 824                 }
 825
 826                 spnego_free_data(&spnego);
 827                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
 828         }
 829         case SPNEGO_SERVER_TARG:
 830         {
 831                 NTSTATUS nt_status;
 832                 if (!in.length) {
 833                         return NT_STATUS_INVALID_PARAMETER;
 834                 }
 835
 836                 len = spnego_read_data(gensec_security, in, &spnego);
 837
 838                 if (len == -1) {
 839                         DEBUG(1, ("Invalid SPNEGO request:\n"));
 840                         dump_data(1, in.data, in.length);
 841                         return NT_STATUS_INVALID_PARAMETER;
 842                 }
 843
 844                 /* OK, so it's real SPNEGO, check the packet's the one we expect */
 845                 if (spnego.type != spnego_state->expected_packet) {
 846                         DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type,
 847                                   spnego_state->expected_packet));
 848                         dump_data(1, in.data, in.length);
 849                         spnego_free_data(&spnego);
 850                         return NT_STATUS_INVALID_PARAMETER;
 851                 }
 852
 853                 if (!spnego_state->sub_sec_security) {
 854                         DEBUG(1, ("SPNEGO: Did not setup a mech in NEG_TOKEN_INIT\n"));
 855                         spnego_free_data(&spnego);
 856                         return NT_STATUS_INVALID_PARAMETER;
 857                 }
 858
 859                 nt_status = gensec_update(spnego_state->sub_sec_security,
 860                                           out_mem_ctx,
 861                                           spnego.negTokenTarg.responseToken,
 862                                           &unwrapped_out);
 863
 864                 nt_status = gensec_spnego_server_negTokenTarg(gensec_security,
 865                                                               spnego_state,
 866                                                               out_mem_ctx,
 867                                                               nt_status,
 868                                                               unwrapped_out,
 869                                                               out);
 870
 871                 spnego_free_data(&spnego);
 872
 873                 return nt_status;
 874         }
 875         case SPNEGO_CLIENT_TARG:
 876         {
 877                 NTSTATUS nt_status;
 878                 if (!in.length) {
 879                         return NT_STATUS_INVALID_PARAMETER;
 880                 }
 881
 882                 len = spnego_read_data(gensec_security, in, &spnego);
 883
 884                 if (len == -1) {
 885                         DEBUG(1, ("Invalid SPNEGO request:\n"));
 886                         dump_data(1, in.data, in.length);
 887                         return NT_STATUS_INVALID_PARAMETER;
 888                 }
 889
 890                 /* OK, so it's real SPNEGO, check the packet's the one we expect */
 891                 if (spnego.type != spnego_state->expected_packet) {
 892                         DEBUG(1, ("Invalid SPNEGO request: %d, expected %d\n", spnego.type,
 893                                   spnego_state->expected_packet));
 894                         dump_data(1, in.data, in.length);
 895                         spnego_free_data(&spnego);
 896                         return NT_STATUS_INVALID_PARAMETER;
 897                 }
 898
 899                 if (spnego.negTokenTarg.negResult == SPNEGO_REJECT) {
 900                         spnego_free_data(&spnego);
 901                         return NT_STATUS_ACCESS_DENIED;
 902                 }
 903
 904                 /* Server didn't like our choice of mech, and chose something else */
 905                 if ((spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_INCOMPLETE) &&
 906                     spnego.negTokenTarg.supportedMech &&
 907                     strcmp(spnego.negTokenTarg.supportedMech, spnego_state->neg_oid) != 0) {
 908                         DEBUG(3,("GENSEC SPNEGO: client preferred mech (%s) not accepted, server wants: %s\n",
 909                                  gensec_get_name_by_oid(spnego.negTokenTarg.supportedMech),
 910                                  gensec_get_name_by_oid(spnego_state->neg_oid)));
 911
 912                         talloc_free(spnego_state->sub_sec_security);
 913                         nt_status = gensec_subcontext_start(spnego_state,
 914                                                             gensec_security,
 915                                                             &spnego_state->sub_sec_security);
 916                         if (!NT_STATUS_IS_OK(nt_status)) {
 917                                 spnego_free_data(&spnego);
 918                                 return nt_status;
 919                         }
 920                         /* select the sub context */
 921                         nt_status = gensec_start_mech_by_oid(spnego_state->sub_sec_security,
 922                                                              spnego.negTokenTarg.supportedMech);
 923                         if (!NT_STATUS_IS_OK(nt_status)) {
 924                                 spnego_free_data(&spnego);
 925                                 return nt_status;
 926                         }
 927
 928                         nt_status = gensec_update(spnego_state->sub_sec_security,
 929                                                   out_mem_ctx,
 930                                                   spnego.negTokenTarg.responseToken,
 931                                                   &unwrapped_out);
 932                         spnego_state->neg_oid = talloc_strdup(spnego_state, spnego.negTokenTarg.supportedMech);
 933                 } else if (spnego_state->no_response_expected) {
 934                         if (spnego.negTokenTarg.negResult != SPNEGO_ACCEPT_COMPLETED) {
 935                                 DEBUG(3,("GENSEC SPNEGO: client GENSEC accepted, but server rejected (bad password?)\n"));
 936                                 nt_status = NT_STATUS_INVALID_PARAMETER;
 937                         } else if (spnego.negTokenTarg.responseToken.length) {
 938                                 DEBUG(2,("GENSEC SPNEGO: client GENSEC accepted, but server continued negotiation!\n"));
 939                                 nt_status = NT_STATUS_INVALID_PARAMETER;
 940                         } else {
 941                                 nt_status = NT_STATUS_OK;
 942                         }
 943                 } else {
 944                         nt_status = gensec_update(spnego_state->sub_sec_security,
 945                                                   out_mem_ctx,
 946                                                   spnego.negTokenTarg.responseToken,
 947                                                   &unwrapped_out);
 948
 949                         if (NT_STATUS_IS_OK(nt_status)) {
 950                                 spnego_state->no_response_expected = true;
 951                         }
 952                 }
 953
 954                 spnego_free_data(&spnego);
 955
 956                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)
 957                         && !NT_STATUS_IS_OK(nt_status)) {
 958                         DEBUG(1, ("SPNEGO(%s) login failed: %s\n",
 959                                   spnego_state->sub_sec_security->ops->name,
 960                                   nt_errstr(nt_status)));
 961                         return nt_status;
 962                 }
 963
 964                 if (unwrapped_out.length) {
 965                         /* compose reply */
 966                         spnego_out.type = SPNEGO_NEG_TOKEN_TARG;
 967                         spnego_out.negTokenTarg.negResult = SPNEGO_NONE_RESULT;
 968                         spnego_out.negTokenTarg.supportedMech = NULL;
 969                         spnego_out.negTokenTarg.responseToken = unwrapped_out;
 970                         spnego_out.negTokenTarg.mechListMIC = null_data_blob;
 971
 972                         if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
 973                                 DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_TARG\n"));
 974                                 return NT_STATUS_INVALID_PARAMETER;
 975                         }
 976
 977                         spnego_state->state_position = SPNEGO_CLIENT_TARG;
 978                         nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 979                 } else {
 980
 981                         /* all done - server has accepted, and we agree */
 982                         *out = null_data_blob;
 983
 984                         if (spnego.negTokenTarg.negResult != SPNEGO_ACCEPT_COMPLETED) {
 985                                 /* unless of course it did not accept */
 986                                 DEBUG(1,("gensec_update ok but not accepted\n"));
 987                                 nt_status = NT_STATUS_INVALID_PARAMETER;
 988                         }
 989
 990                         spnego_state->state_position = SPNEGO_DONE;
 991                 }
 992
 993                 return nt_status;
 994         }
 995         case SPNEGO_DONE:
 996                 /* We should not be called after we are 'done' */
 997                 return NT_STATUS_INVALID_PARAMETER;
 998         }
 999         return NT_STATUS_INVALID_PARAMETER;
1000 }
1001
1002 static bool gensec_spnego_have_feature(struct gensec_security *gensec_security,
1003                                        uint32_t feature)
1004 {
1005         struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
1006         if (!spnego_state->sub_sec_security) {
1007                 return false;
1008         }
1009
1010         return gensec_have_feature(spnego_state->sub_sec_security,
1011                                    feature);
1012 }
1013
1014 static const char *gensec_spnego_oids[] = {
1015         GENSEC_OID_SPNEGO,
1016         NULL
1017 };
1018
1019 static const struct gensec_security_ops gensec_spnego_security_ops = {
1020         .name             = "spnego",
1021         .sasl_name        = "GSS-SPNEGO",
1022         .auth_type        = DCERPC_AUTH_TYPE_SPNEGO,
1023         .oid              = gensec_spnego_oids,
1024         .client_start     = gensec_spnego_client_start,
1025         .server_start     = gensec_spnego_server_start,
1026         .update           = gensec_spnego_update,
1027         .seal_packet      = gensec_spnego_seal_packet,
1028         .sign_packet      = gensec_spnego_sign_packet,
1029         .sig_size         = gensec_spnego_sig_size,
1030         .max_wrapped_size = gensec_spnego_max_wrapped_size,
1031         .max_input_size   = gensec_spnego_max_input_size,
1032         .check_packet     = gensec_spnego_check_packet,
1033         .unseal_packet    = gensec_spnego_unseal_packet,
1034         .packet_full_request = gensec_spnego_packet_full_request,
1035         .wrap             = gensec_spnego_wrap,
1036         .unwrap           = gensec_spnego_unwrap,
1037         .wrap_packets     = gensec_spnego_wrap_packets,
1038         .unwrap_packets   = gensec_spnego_unwrap_packets,
1039         .session_key      = gensec_spnego_session_key,
1040         .session_info     = gensec_spnego_session_info,
1041         .have_feature     = gensec_spnego_have_feature,
1042         .enabled          = true,
1043         .priority         = GENSEC_SPNEGO
1044 };
1045
1046 NTSTATUS gensec_spnego_init(void)
1047 {
1048         NTSTATUS ret;
1049         ret = gensec_register(&gensec_spnego_security_ops);
1050         if (!NT_STATUS_IS_OK(ret)) {
1051                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1052                         gensec_spnego_security_ops.name));
1053                 return ret;
1054         }
1055
1056         return ret;
1057 }