source4/auth/gensec/gensec_gssapi.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Kerberos backend for GENSEC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7    Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "lib/events/events.h"
  26 #include "system/kerberos.h"
  27 #include "system/gssapi.h"
  28 #include "auth/kerberos/kerberos.h"
  29 #include "librpc/gen_ndr/krb5pac.h"
  30 #include "auth/auth.h"
  31 #include <ldb.h>
  32 #include "auth/auth_sam.h"
  33 #include "librpc/gen_ndr/dcerpc.h"
  34 #include "auth/credentials/credentials.h"
  35 #include "auth/credentials/credentials_krb5.h"
  36 #include "auth/gensec/gensec.h"
  37 #include "auth/gensec/gensec_internal.h"
  38 #include "auth/gensec/gensec_proto.h"
  39 #include "auth/gensec/gensec_toplevel_proto.h"
  40 #include "param/param.h"
  41 #include "auth/session_proto.h"
  42 #include "gensec_gssapi.h"
  43 #include "lib/util/util_net.h"
  44 #include "auth/kerberos/pac_utils.h"
  45 #include "auth/kerberos/gssapi_helper.h"
  46
  47 #ifndef gss_mech_spnego
  48 gss_OID_desc spnego_mech_oid_desc =
  49                 { 6, discard_const_p(void, "\x2b\x06\x01\x05\x05\x02") };
  50 #define gss_mech_spnego (&spnego_mech_oid_desc)
  51 #endif
  52
  53 _PUBLIC_ NTSTATUS gensec_gssapi_init(void);
  54
  55 static size_t gensec_gssapi_max_input_size(struct gensec_security *gensec_security);
  56 static size_t gensec_gssapi_max_wrapped_size(struct gensec_security *gensec_security);
  57 static size_t gensec_gssapi_sig_size(struct gensec_security *gensec_security, size_t data_size);
  58
  59 static int gensec_gssapi_destructor(struct gensec_gssapi_state *gensec_gssapi_state)
  60 {
  61         OM_uint32 min_stat;
  62
  63         if (gensec_gssapi_state->delegated_cred_handle != GSS_C_NO_CREDENTIAL) {
  64                 gss_release_cred(&min_stat,
  65                                  &gensec_gssapi_state->delegated_cred_handle);
  66         }
  67
  68         if (gensec_gssapi_state->gssapi_context != GSS_C_NO_CONTEXT) {
  69                 gss_delete_sec_context(&min_stat,
  70                                        &gensec_gssapi_state->gssapi_context,
  71                                        GSS_C_NO_BUFFER);
  72         }
  73
  74         if (gensec_gssapi_state->server_name != GSS_C_NO_NAME) {
  75                 gss_release_name(&min_stat,
  76                                  &gensec_gssapi_state->server_name);
  77         }
  78         if (gensec_gssapi_state->client_name != GSS_C_NO_NAME) {
  79                 gss_release_name(&min_stat,
  80                                  &gensec_gssapi_state->client_name);
  81         }
  82
  83         return 0;
  84 }
  85
  86 static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security)
  87 {
  88         struct gensec_gssapi_state *gensec_gssapi_state;
  89         krb5_error_code ret;
  90 #ifdef SAMBA4_USES_HEIMDAL
  91         const char *realm;
  92 #endif
  93
  94         gensec_gssapi_state = talloc_zero(gensec_security, struct gensec_gssapi_state);
  95         if (!gensec_gssapi_state) {
  96                 return NT_STATUS_NO_MEMORY;
  97         }
  98
  99         gensec_security->private_data = gensec_gssapi_state;
 100
 101         gensec_gssapi_state->gssapi_context = GSS_C_NO_CONTEXT;
 102
 103         /* TODO: Fill in channel bindings */
 104         gensec_gssapi_state->input_chan_bindings = GSS_C_NO_CHANNEL_BINDINGS;
 105
 106         gensec_gssapi_state->server_name = GSS_C_NO_NAME;
 107         gensec_gssapi_state->client_name = GSS_C_NO_NAME;
 108
 109         gensec_gssapi_state->gss_want_flags = 0;
 110         gensec_gssapi_state->expire_time = GENSEC_EXPIRE_TIME_INFINITY;
 111
 112         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation_by_kdc_policy", true)) {
 113                 gensec_gssapi_state->gss_want_flags |= GSS_C_DELEG_POLICY_FLAG;
 114         }
 115         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "mutual", true)) {
 116                 gensec_gssapi_state->gss_want_flags |= GSS_C_MUTUAL_FLAG;
 117         }
 118         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", false)) {
 119                 gensec_gssapi_state->gss_want_flags |= GSS_C_DELEG_FLAG;
 120         }
 121         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "replay", true)) {
 122                 gensec_gssapi_state->gss_want_flags |= GSS_C_REPLAY_FLAG;
 123         }
 124         if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "sequence", true)) {
 125                 gensec_gssapi_state->gss_want_flags |= GSS_C_SEQUENCE_FLAG;
 126         }
 127
 128         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
 129                 gensec_gssapi_state->gss_want_flags |= GSS_C_INTEG_FLAG;
 130         }
 131         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
 132                 gensec_gssapi_state->gss_want_flags |= GSS_C_INTEG_FLAG;
 133                 gensec_gssapi_state->gss_want_flags |= GSS_C_CONF_FLAG;
 134         }
 135         if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
 136                 gensec_gssapi_state->gss_want_flags |= GSS_C_DCE_STYLE;
 137         }
 138
 139         gensec_gssapi_state->gss_got_flags = 0;
 140
 141         switch (gensec_security->ops->auth_type) {
 142         case DCERPC_AUTH_TYPE_SPNEGO:
 143                 gensec_gssapi_state->gss_oid = gss_mech_spnego;
 144                 break;
 145         case DCERPC_AUTH_TYPE_KRB5:
 146         default:
 147                 gensec_gssapi_state->gss_oid =
 148                         discard_const_p(void, gss_mech_krb5);
 149                 break;
 150         }
 151
 152         ret = smb_krb5_init_context(gensec_gssapi_state,
 153                                     gensec_security->settings->lp_ctx,
 154                                     &gensec_gssapi_state->smb_krb5_context);
 155         if (ret) {
 156                 DEBUG(1,("gensec_gssapi_start: smb_krb5_init_context failed (%s)\n",
 157                          error_message(ret)));
 158                 talloc_free(gensec_gssapi_state);
 159                 return NT_STATUS_INTERNAL_ERROR;
 160         }
 161
 162         gensec_gssapi_state->client_cred = NULL;
 163         gensec_gssapi_state->server_cred = NULL;
 164
 165         gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
 166
 167         gensec_gssapi_state->sasl = false;
 168         gensec_gssapi_state->sasl_state = STAGE_GSS_NEG;
 169         gensec_gssapi_state->sasl_protection = 0;
 170
 171         gensec_gssapi_state->max_wrap_buf_size
 172                 = gensec_setting_int(gensec_security->settings, "gensec_gssapi", "max wrap buf size", 65536);
 173         gensec_gssapi_state->gss_exchange_count = 0;
 174         gensec_gssapi_state->sig_size = 0;
 175
 176         talloc_set_destructor(gensec_gssapi_state, gensec_gssapi_destructor);
 177
 178 #ifdef SAMBA4_USES_HEIMDAL
 179         realm = lpcfg_realm(gensec_security->settings->lp_ctx);
 180         if (realm != NULL) {
 181                 ret = gsskrb5_set_default_realm(realm);
 182                 if (ret) {
 183                         DEBUG(1,("gensec_gssapi_start: gsskrb5_set_default_realm failed\n"));
 184                         talloc_free(gensec_gssapi_state);
 185                         return NT_STATUS_INTERNAL_ERROR;
 186                 }
 187         }
 188
 189         /* don't do DNS lookups of any kind, it might/will fail for a netbios name */
 190         ret = gsskrb5_set_dns_canonicalize(gensec_setting_bool(gensec_security->settings, "krb5", "set_dns_canonicalize", false));
 191         if (ret) {
 192                 DEBUG(1,("gensec_gssapi_start: gsskrb5_set_dns_canonicalize failed\n"));
 193                 talloc_free(gensec_gssapi_state);
 194                 return NT_STATUS_INTERNAL_ERROR;
 195         }
 196 #endif
 197         return NT_STATUS_OK;
 198 }
 199
 200 static NTSTATUS gensec_gssapi_server_start(struct gensec_security *gensec_security)
 201 {
 202         NTSTATUS nt_status;
 203         int ret;
 204         struct gensec_gssapi_state *gensec_gssapi_state;
 205         struct cli_credentials *machine_account;
 206         struct gssapi_creds_container *gcc;
 207
 208         nt_status = gensec_gssapi_start(gensec_security);
 209         if (!NT_STATUS_IS_OK(nt_status)) {
 210                 return nt_status;
 211         }
 212
 213         gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 214
 215         machine_account = gensec_get_credentials(gensec_security);
 216
 217         if (!machine_account) {
 218                 DEBUG(3, ("No machine account credentials specified\n"));
 219                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 220         } else {
 221                 ret = cli_credentials_get_server_gss_creds(machine_account,
 222                                                            gensec_security->settings->lp_ctx, &gcc);
 223                 if (ret) {
 224                         DEBUG(1, ("Aquiring acceptor credentials failed: %s\n",
 225                                   error_message(ret)));
 226                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 227                 }
 228         }
 229
 230         gensec_gssapi_state->server_cred = gcc;
 231         return NT_STATUS_OK;
 232
 233 }
 234
 235 static NTSTATUS gensec_gssapi_sasl_server_start(struct gensec_security *gensec_security)
 236 {
 237         NTSTATUS nt_status;
 238         struct gensec_gssapi_state *gensec_gssapi_state;
 239         nt_status = gensec_gssapi_server_start(gensec_security);
 240
 241         if (NT_STATUS_IS_OK(nt_status)) {
 242                 gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 243                 gensec_gssapi_state->sasl = true;
 244         }
 245         return nt_status;
 246 }
 247
 248 static NTSTATUS gensec_gssapi_client_creds(struct gensec_security *gensec_security,
 249                                            struct tevent_context *ev)
 250 {
 251         struct gensec_gssapi_state *gensec_gssapi_state;
 252         struct gssapi_creds_container *gcc;
 253         struct cli_credentials *creds = gensec_get_credentials(gensec_security);
 254         const char *error_string;
 255         int ret;
 256
 257         gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 258
 259         /* Only run this the first time the update() call is made */
 260         if (gensec_gssapi_state->client_cred) {
 261                 return NT_STATUS_OK;
 262         }
 263
 264         ret = cli_credentials_get_client_gss_creds(creds,
 265                                                    ev,
 266                                                    gensec_security->settings->lp_ctx, &gcc, &error_string);
 267         switch (ret) {
 268         case 0:
 269                 break;
 270         case EINVAL:
 271                 DEBUG(3, ("Cannot obtain client GSS credentials we need to contact %s : %s\n", gensec_gssapi_state->target_principal, error_string));
 272                 return NT_STATUS_INVALID_PARAMETER;
 273         case KRB5KDC_ERR_PREAUTH_FAILED:
 274         case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
 275         case KRB5KRB_AP_ERR_BAD_INTEGRITY:
 276                 DEBUG(1, ("Wrong username or password: %s\n", error_string));
 277                 return NT_STATUS_LOGON_FAILURE;
 278         case KRB5KDC_ERR_CLIENT_REVOKED:
 279                 DEBUG(1, ("Account locked out: %s\n", error_string));
 280                 return NT_STATUS_ACCOUNT_LOCKED_OUT;
 281         case KRB5_REALM_UNKNOWN:
 282         case KRB5_KDC_UNREACH:
 283                 DEBUG(3, ("Cannot reach a KDC we require to contact %s : %s\n", gensec_gssapi_state->target_principal, error_string));
 284                 return NT_STATUS_NO_LOGON_SERVERS;
 285         case KRB5_CC_NOTFOUND:
 286         case KRB5_CC_END:
 287                 DEBUG(2, ("Error obtaining ticket we require to contact %s: (possibly due to clock skew between us and the KDC) %s\n", gensec_gssapi_state->target_principal, error_string));
 288                 return NT_STATUS_TIME_DIFFERENCE_AT_DC;
 289         default:
 290                 DEBUG(1, ("Aquiring initiator credentials failed: %s\n", error_string));
 291                 return NT_STATUS_UNSUCCESSFUL;
 292         }
 293
 294         gensec_gssapi_state->client_cred = gcc;
 295         if (!talloc_reference(gensec_gssapi_state, gcc)) {
 296                 return NT_STATUS_NO_MEMORY;
 297         }
 298
 299         return NT_STATUS_OK;
 300 }
 301
 302 static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_security)
 303 {
 304         struct gensec_gssapi_state *gensec_gssapi_state;
 305         struct cli_credentials *creds = gensec_get_credentials(gensec_security);
 306         NTSTATUS nt_status;
 307         gss_buffer_desc name_token;
 308         gss_OID name_type;
 309         OM_uint32 maj_stat, min_stat;
 310         const char *hostname = gensec_get_target_hostname(gensec_security);
 311
 312         if (!hostname) {
 313                 DEBUG(3, ("No hostname for target computer passed in, cannot use kerberos for this connection\n"));
 314                 return NT_STATUS_INVALID_PARAMETER;
 315         }
 316         if (is_ipaddress(hostname)) {
 317                 DEBUG(2, ("Cannot do GSSAPI to an IP address\n"));
 318                 return NT_STATUS_INVALID_PARAMETER;
 319         }
 320         if (strcmp(hostname, "localhost") == 0) {
 321                 DEBUG(2, ("GSSAPI to 'localhost' does not make sense\n"));
 322                 return NT_STATUS_INVALID_PARAMETER;
 323         }
 324
 325         nt_status = gensec_gssapi_start(gensec_security);
 326         if (!NT_STATUS_IS_OK(nt_status)) {
 327                 return nt_status;
 328         }
 329
 330         gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 331
 332         if (cli_credentials_get_impersonate_principal(creds)) {
 333                 gensec_gssapi_state->gss_want_flags &= ~(GSS_C_DELEG_FLAG|GSS_C_DELEG_POLICY_FLAG);
 334         }
 335
 336         gensec_gssapi_state->target_principal = gensec_get_target_principal(gensec_security);
 337         if (gensec_gssapi_state->target_principal) {
 338                 name_type = GSS_C_NULL_OID;
 339         } else {
 340                 gensec_gssapi_state->target_principal = talloc_asprintf(gensec_gssapi_state, "%s/%s@%s",
 341                                             gensec_get_target_service(gensec_security),
 342                                             hostname, cli_credentials_get_realm(creds));
 343
 344                 name_type = GSS_C_NT_USER_NAME;
 345         }
 346         name_token.value  = discard_const_p(uint8_t, gensec_gssapi_state->target_principal);
 347         name_token.length = strlen(gensec_gssapi_state->target_principal);
 348
 349
 350         maj_stat = gss_import_name (&min_stat,
 351                                     &name_token,
 352                                     name_type,
 353                                     &gensec_gssapi_state->server_name);
 354         if (maj_stat) {
 355                 DEBUG(2, ("GSS Import name of %s failed: %s\n",
 356                           (char *)name_token.value,
 357                           gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 358                 return NT_STATUS_INVALID_PARAMETER;
 359         }
 360
 361         return NT_STATUS_OK;
 362 }
 363
 364 static NTSTATUS gensec_gssapi_sasl_client_start(struct gensec_security *gensec_security)
 365 {
 366         NTSTATUS nt_status;
 367         struct gensec_gssapi_state *gensec_gssapi_state;
 368         nt_status = gensec_gssapi_client_start(gensec_security);
 369
 370         if (NT_STATUS_IS_OK(nt_status)) {
 371                 gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 372                 gensec_gssapi_state->sasl = true;
 373         }
 374         return nt_status;
 375 }
 376
 377
 378 /**
 379  * Next state function for the GSSAPI GENSEC mechanism
 380  *
 381  * @param gensec_gssapi_state GSSAPI State
 382  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
 383  * @param in The request, as a DATA_BLOB
 384  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 385  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 386  *                or NT_STATUS_OK if the user is authenticated.
 387  */
 388
 389 static NTSTATUS gensec_gssapi_update(struct gensec_security *gensec_security,
 390                                      TALLOC_CTX *out_mem_ctx,
 391                                      struct tevent_context *ev,
 392                                      const DATA_BLOB in, DATA_BLOB *out)
 393 {
 394         struct gensec_gssapi_state *gensec_gssapi_state
 395                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 396         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
 397         OM_uint32 maj_stat, min_stat;
 398         OM_uint32 min_stat2;
 399         gss_buffer_desc input_token = { 0, NULL };
 400         gss_buffer_desc output_token = { 0, NULL };
 401
 402         gss_OID gss_oid_p = NULL;
 403         OM_uint32 time_req = 0;
 404         OM_uint32 time_rec = 0;
 405         struct timeval tv;
 406
 407         time_req = gensec_setting_int(gensec_security->settings,
 408                                       "gensec_gssapi", "requested_life_time",
 409                                       time_req);
 410
 411         input_token.length = in.length;
 412         input_token.value = in.data;
 413
 414         switch (gensec_gssapi_state->sasl_state) {
 415         case STAGE_GSS_NEG:
 416         {
 417                 switch (gensec_security->gensec_role) {
 418                 case GENSEC_CLIENT:
 419                 {
 420 #ifdef SAMBA4_USES_HEIMDAL
 421                         struct gsskrb5_send_to_kdc send_to_kdc;
 422                         krb5_error_code ret;
 423 #endif
 424
 425                         nt_status = gensec_gssapi_client_creds(gensec_security, ev);
 426                         if (!NT_STATUS_IS_OK(nt_status)) {
 427                                 return nt_status;
 428                         }
 429
 430 #ifdef SAMBA4_USES_HEIMDAL
 431                         send_to_kdc.func = smb_krb5_send_and_recv_func;
 432                         send_to_kdc.ptr = ev;
 433
 434                         min_stat = gsskrb5_set_send_to_kdc(&send_to_kdc);
 435                         if (min_stat) {
 436                                 DEBUG(1,("gensec_gssapi_update: gsskrb5_set_send_to_kdc failed\n"));
 437                                 return NT_STATUS_INTERNAL_ERROR;
 438                         }
 439 #endif
 440                         maj_stat = gss_init_sec_context(&min_stat,
 441                                                         gensec_gssapi_state->client_cred->creds,
 442                                                         &gensec_gssapi_state->gssapi_context,
 443                                                         gensec_gssapi_state->server_name,
 444                                                         gensec_gssapi_state->gss_oid,
 445                                                         gensec_gssapi_state->gss_want_flags,
 446                                                         time_req,
 447                                                         gensec_gssapi_state->input_chan_bindings,
 448                                                         &input_token,
 449                                                         &gss_oid_p,
 450                                                         &output_token,
 451                                                         &gensec_gssapi_state->gss_got_flags, /* ret flags */
 452                                                         &time_rec);
 453                         if (gss_oid_p) {
 454                                 gensec_gssapi_state->gss_oid = gss_oid_p;
 455                         }
 456
 457 #ifdef SAMBA4_USES_HEIMDAL
 458                         send_to_kdc.func = smb_krb5_send_and_recv_func;
 459                         send_to_kdc.ptr = NULL;
 460
 461                         ret = gsskrb5_set_send_to_kdc(&send_to_kdc);
 462                         if (ret) {
 463                                 DEBUG(1,("gensec_gssapi_update: gsskrb5_set_send_to_kdc failed\n"));
 464                                 return NT_STATUS_INTERNAL_ERROR;
 465                         }
 466 #endif
 467                         break;
 468                 }
 469                 case GENSEC_SERVER:
 470                 {
 471                         maj_stat = gss_accept_sec_context(&min_stat,
 472                                                           &gensec_gssapi_state->gssapi_context,
 473                                                           gensec_gssapi_state->server_cred->creds,
 474                                                           &input_token,
 475                                                           gensec_gssapi_state->input_chan_bindings,
 476                                                           &gensec_gssapi_state->client_name,
 477                                                           &gss_oid_p,
 478                                                           &output_token,
 479                                                           &gensec_gssapi_state->gss_got_flags,
 480                                                           &time_rec,
 481                                                           &gensec_gssapi_state->delegated_cred_handle);
 482                         if (gss_oid_p) {
 483                                 gensec_gssapi_state->gss_oid = gss_oid_p;
 484                         }
 485                         break;
 486                 }
 487                 default:
 488                         return NT_STATUS_INVALID_PARAMETER;
 489
 490                 }
 491
 492                 gensec_gssapi_state->gss_exchange_count++;
 493
 494                 if (maj_stat == GSS_S_COMPLETE) {
 495                         *out = data_blob_talloc(out_mem_ctx, output_token.value, output_token.length);
 496                         gss_release_buffer(&min_stat2, &output_token);
 497
 498                         if (gensec_gssapi_state->gss_got_flags & GSS_C_DELEG_FLAG &&
 499                             gensec_gssapi_state->delegated_cred_handle != GSS_C_NO_CREDENTIAL) {
 500                                 DEBUG(5, ("gensec_gssapi: credentials were delegated\n"));
 501                         } else {
 502                                 DEBUG(5, ("gensec_gssapi: NO credentials were delegated\n"));
 503                         }
 504
 505                         tv = timeval_current_ofs(time_rec, 0);
 506                         gensec_gssapi_state->expire_time = timeval_to_nttime(&tv);
 507
 508                         /* We may have been invoked as SASL, so there
 509                          * is more work to do */
 510                         if (gensec_gssapi_state->sasl) {
 511                                 gensec_gssapi_state->sasl_state = STAGE_SASL_SSF_NEG;
 512                                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
 513                         } else {
 514                                 gensec_gssapi_state->sasl_state = STAGE_DONE;
 515
 516                                 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 517                                         DEBUG(5, ("GSSAPI Connection will be cryptographically sealed\n"));
 518                                 } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 519                                         DEBUG(5, ("GSSAPI Connection will be cryptographically signed\n"));
 520                                 } else {
 521                                         DEBUG(5, ("GSSAPI Connection will have no cryptographic protection\n"));
 522                                 }
 523
 524                                 return NT_STATUS_OK;
 525                         }
 526                 } else if (maj_stat == GSS_S_CONTINUE_NEEDED) {
 527                         *out = data_blob_talloc(out_mem_ctx, output_token.value, output_token.length);
 528                         gss_release_buffer(&min_stat2, &output_token);
 529
 530                         return NT_STATUS_MORE_PROCESSING_REQUIRED;
 531                 } else if (maj_stat == GSS_S_CONTEXT_EXPIRED) {
 532                         gss_cred_id_t creds = NULL;
 533                         gss_name_t name;
 534                         gss_buffer_desc buffer;
 535                         OM_uint32 lifetime = 0;
 536                         gss_cred_usage_t usage;
 537                         const char *role = NULL;
 538                         DEBUG(0, ("GSS %s Update(krb5)(%d) Update failed, credentials expired during GSSAPI handshake!\n",
 539                                   role,
 540                                   gensec_gssapi_state->gss_exchange_count));
 541
 542
 543                         switch (gensec_security->gensec_role) {
 544                         case GENSEC_CLIENT:
 545                                 creds = gensec_gssapi_state->client_cred->creds;
 546                                 role = "client";
 547                                 break;
 548                         case GENSEC_SERVER:
 549                                 creds = gensec_gssapi_state->server_cred->creds;
 550                                 role = "server";
 551                                 break;
 552                         }
 553
 554                         maj_stat = gss_inquire_cred(&min_stat,
 555                                                     creds,
 556                                                     &name, &lifetime, &usage, NULL);
 557
 558                         if (maj_stat == GSS_S_COMPLETE) {
 559                                 const char *usage_string = NULL;
 560                                 switch (usage) {
 561                                 case GSS_C_BOTH:
 562                                         usage_string = "GSS_C_BOTH";
 563                                         break;
 564                                 case GSS_C_ACCEPT:
 565                                         usage_string = "GSS_C_ACCEPT";
 566                                         break;
 567                                 case GSS_C_INITIATE:
 568                                         usage_string = "GSS_C_INITIATE";
 569                                         break;
 570                                 }
 571                                 maj_stat = gss_display_name(&min_stat, name, &buffer, NULL);
 572                                 if (maj_stat) {
 573                                         buffer.value = NULL;
 574                                         buffer.length = 0;
 575                                 }
 576                                 if (lifetime > 0) {
 577                                         DEBUG(0, ("GSSAPI gss_inquire_cred indicates expiry of %*.*s in %u sec for %s\n",
 578                                                   (int)buffer.length, (int)buffer.length, (char *)buffer.value,
 579                                                   lifetime, usage_string));
 580                                 } else {
 581                                         DEBUG(0, ("GSSAPI gss_inquire_cred indicates %*.*s has already expired for %s\n",
 582                                                   (int)buffer.length, (int)buffer.length, (char *)buffer.value,
 583                                                   usage_string));
 584                                 }
 585                                 gss_release_buffer(&min_stat, &buffer);
 586                                 gss_release_name(&min_stat, &name);
 587                         } else if (maj_stat != GSS_S_COMPLETE) {
 588                                 DEBUG(0, ("inquiry of credential lifefime via GSSAPI gss_inquire_cred failed: %s\n",
 589                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 590                         }
 591                         return NT_STATUS_INVALID_PARAMETER;
 592                 } else if (smb_gss_oid_equal(gensec_gssapi_state->gss_oid,
 593                                              gss_mech_krb5)) {
 594                         switch (min_stat) {
 595                         case KRB5KRB_AP_ERR_TKT_NYV:
 596                                 DEBUG(1, ("Error with ticket to contact %s: possible clock skew between us and the KDC or target server: %s\n",
 597                                           gensec_gssapi_state->target_principal,
 598                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 599                                 return NT_STATUS_TIME_DIFFERENCE_AT_DC; /* Make SPNEGO ignore us, we can't go any further here */
 600                         case KRB5KRB_AP_ERR_TKT_EXPIRED:
 601                                 DEBUG(1, ("Error with ticket to contact %s: ticket is expired, possible clock skew between us and the KDC or target server: %s\n",
 602                                           gensec_gssapi_state->target_principal,
 603                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 604                                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 605                         case KRB5_KDC_UNREACH:
 606                                 DEBUG(3, ("Cannot reach a KDC we require in order to obtain a ticket to %s: %s\n",
 607                                           gensec_gssapi_state->target_principal,
 608                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 609                                 return NT_STATUS_NO_LOGON_SERVERS; /* Make SPNEGO ignore us, we can't go any further here */
 610                         case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
 611                                 DEBUG(3, ("Server %s is not registered with our KDC: %s\n",
 612                                           gensec_gssapi_state->target_principal,
 613                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 614                                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 615                         case KRB5KRB_AP_ERR_MSG_TYPE:
 616                                 /* garbage input, possibly from the auto-mech detection */
 617                                 return NT_STATUS_INVALID_PARAMETER;
 618                         default:
 619                                 DEBUG(1, ("GSS %s Update(krb5)(%d) Update failed: %s\n",
 620                                           gensec_security->gensec_role == GENSEC_CLIENT ? "client" : "server",
 621                                           gensec_gssapi_state->gss_exchange_count,
 622                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 623                                 return NT_STATUS_LOGON_FAILURE;
 624                         }
 625                 } else {
 626                         DEBUG(1, ("GSS %s Update(%d) failed: %s\n",
 627                                   gensec_security->gensec_role == GENSEC_CLIENT ? "client" : "server",
 628                                   gensec_gssapi_state->gss_exchange_count,
 629                                   gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 630                         return NT_STATUS_LOGON_FAILURE;
 631                 }
 632                 break;
 633         }
 634
 635         /* These last two stages are only done if we were invoked as SASL */
 636         case STAGE_SASL_SSF_NEG:
 637         {
 638                 switch (gensec_security->gensec_role) {
 639                 case GENSEC_CLIENT:
 640                 {
 641                         uint8_t maxlength_proposed[4];
 642                         uint8_t maxlength_accepted[4];
 643                         uint8_t security_supported;
 644                         int conf_state;
 645                         gss_qop_t qop_state;
 646                         input_token.length = in.length;
 647                         input_token.value = in.data;
 648
 649                         /* As a client, we have just send a
 650                          * zero-length blob to the server (after the
 651                          * normal GSSAPI exchange), and it has replied
 652                          * with it's SASL negotiation */
 653
 654                         maj_stat = gss_unwrap(&min_stat,
 655                                               gensec_gssapi_state->gssapi_context,
 656                                               &input_token,
 657                                               &output_token,
 658                                               &conf_state,
 659                                               &qop_state);
 660                         if (GSS_ERROR(maj_stat)) {
 661                                 DEBUG(1, ("gensec_gssapi_update: GSS UnWrap of SASL protection negotiation failed: %s\n",
 662                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 663                                 return NT_STATUS_ACCESS_DENIED;
 664                         }
 665
 666                         if (output_token.length < 4) {
 667                                 return NT_STATUS_INVALID_PARAMETER;
 668                         }
 669
 670                         memcpy(maxlength_proposed, output_token.value, 4);
 671                         gss_release_buffer(&min_stat, &output_token);
 672
 673                         /* first byte is the proposed security */
 674                         security_supported = maxlength_proposed[0];
 675                         maxlength_proposed[0] = '\0';
 676
 677                         /* Rest is the proposed max wrap length */
 678                         gensec_gssapi_state->max_wrap_buf_size = MIN(RIVAL(maxlength_proposed, 0),
 679                                                                      gensec_gssapi_state->max_wrap_buf_size);
 680                         gensec_gssapi_state->sasl_protection = 0;
 681                         if (security_supported & NEG_SEAL) {
 682                                 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 683                                         gensec_gssapi_state->sasl_protection |= NEG_SEAL;
 684                                 }
 685                         }
 686                         if (security_supported & NEG_SIGN) {
 687                                 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 688                                         gensec_gssapi_state->sasl_protection |= NEG_SIGN;
 689                                 }
 690                         }
 691                         if (security_supported & NEG_NONE) {
 692                                 gensec_gssapi_state->sasl_protection |= NEG_NONE;
 693                         }
 694                         if (gensec_gssapi_state->sasl_protection == 0) {
 695                                 DEBUG(1, ("Remote server does not support unprotected connections\n"));
 696                                 return NT_STATUS_ACCESS_DENIED;
 697                         }
 698
 699                         /* Send back the negotiated max length */
 700
 701                         RSIVAL(maxlength_accepted, 0, gensec_gssapi_state->max_wrap_buf_size);
 702
 703                         maxlength_accepted[0] = gensec_gssapi_state->sasl_protection;
 704
 705                         input_token.value = maxlength_accepted;
 706                         input_token.length = sizeof(maxlength_accepted);
 707
 708                         maj_stat = gss_wrap(&min_stat,
 709                                             gensec_gssapi_state->gssapi_context,
 710                                             false,
 711                                             GSS_C_QOP_DEFAULT,
 712                                             &input_token,
 713                                             &conf_state,
 714                                             &output_token);
 715                         if (GSS_ERROR(maj_stat)) {
 716                                 DEBUG(1, ("GSS Update(SSF_NEG): GSS Wrap failed: %s\n",
 717                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 718                                 return NT_STATUS_ACCESS_DENIED;
 719                         }
 720
 721                         *out = data_blob_talloc(out_mem_ctx, output_token.value, output_token.length);
 722                         gss_release_buffer(&min_stat, &output_token);
 723
 724                         /* quirk:  This changes the value that gensec_have_feature returns, to be that after SASL negotiation */
 725                         gensec_gssapi_state->sasl_state = STAGE_DONE;
 726
 727                         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 728                                 DEBUG(3, ("SASL/GSSAPI Connection to server will be cryptographically sealed\n"));
 729                         } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 730                                 DEBUG(3, ("SASL/GSSAPI Connection to server will be cryptographically signed\n"));
 731                         } else {
 732                                 DEBUG(3, ("SASL/GSSAPI Connection to server will have no cryptographically protection\n"));
 733                         }
 734
 735                         return NT_STATUS_OK;
 736                 }
 737                 case GENSEC_SERVER:
 738                 {
 739                         uint8_t maxlength_proposed[4];
 740                         uint8_t security_supported = 0x0;
 741                         int conf_state;
 742
 743                         /* As a server, we have just been sent a zero-length blob (note this, but it isn't fatal) */
 744                         if (in.length != 0) {
 745                                 DEBUG(1, ("SASL/GSSAPI: client sent non-zero length starting SASL negotiation!\n"));
 746                         }
 747
 748                         /* Give the client some idea what we will support */
 749
 750                         RSIVAL(maxlength_proposed, 0, gensec_gssapi_state->max_wrap_buf_size);
 751                         /* first byte is the proposed security */
 752                         maxlength_proposed[0] = '\0';
 753
 754                         gensec_gssapi_state->sasl_protection = 0;
 755                         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 756                                 security_supported |= NEG_SEAL;
 757                         }
 758                         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 759                                 security_supported |= NEG_SIGN;
 760                         }
 761                         if (security_supported == 0) {
 762                                 /* If we don't support anything, this must be 0 */
 763                                 RSIVAL(maxlength_proposed, 0, 0x0);
 764                         }
 765
 766                         /* TODO:  We may not wish to support this */
 767                         security_supported |= NEG_NONE;
 768                         maxlength_proposed[0] = security_supported;
 769
 770                         input_token.value = maxlength_proposed;
 771                         input_token.length = sizeof(maxlength_proposed);
 772
 773                         maj_stat = gss_wrap(&min_stat,
 774                                             gensec_gssapi_state->gssapi_context,
 775                                             false,
 776                                             GSS_C_QOP_DEFAULT,
 777                                             &input_token,
 778                                             &conf_state,
 779                                             &output_token);
 780                         if (GSS_ERROR(maj_stat)) {
 781                                 DEBUG(1, ("GSS Update(SSF_NEG): GSS Wrap failed: %s\n",
 782                                           gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 783                                 return NT_STATUS_ACCESS_DENIED;
 784                         }
 785
 786                         *out = data_blob_talloc(out_mem_ctx, output_token.value, output_token.length);
 787                         gss_release_buffer(&min_stat, &output_token);
 788
 789                         gensec_gssapi_state->sasl_state = STAGE_SASL_SSF_ACCEPT;
 790                         return NT_STATUS_MORE_PROCESSING_REQUIRED;
 791                 }
 792                 default:
 793                         return NT_STATUS_INVALID_PARAMETER;
 794
 795                 }
 796         }
 797         /* This is s server-only stage */
 798         case STAGE_SASL_SSF_ACCEPT:
 799         {
 800                 uint8_t maxlength_accepted[4];
 801                 uint8_t security_accepted;
 802                 int conf_state;
 803                 gss_qop_t qop_state;
 804                 input_token.length = in.length;
 805                 input_token.value = in.data;
 806
 807                 maj_stat = gss_unwrap(&min_stat,
 808                                       gensec_gssapi_state->gssapi_context,
 809                                       &input_token,
 810                                       &output_token,
 811                                       &conf_state,
 812                                       &qop_state);
 813                 if (GSS_ERROR(maj_stat)) {
 814                         DEBUG(1, ("gensec_gssapi_update: GSS UnWrap of SASL protection negotiation failed: %s\n",
 815                                   gssapi_error_string(out_mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 816                         return NT_STATUS_ACCESS_DENIED;
 817                 }
 818
 819                 if (output_token.length < 4) {
 820                         return NT_STATUS_INVALID_PARAMETER;
 821                 }
 822
 823                 memcpy(maxlength_accepted, output_token.value, 4);
 824                 gss_release_buffer(&min_stat, &output_token);
 825
 826                 /* first byte is the proposed security */
 827                 security_accepted = maxlength_accepted[0];
 828                 maxlength_accepted[0] = '\0';
 829
 830                 /* Rest is the proposed max wrap length */
 831                 gensec_gssapi_state->max_wrap_buf_size = MIN(RIVAL(maxlength_accepted, 0),
 832                                                              gensec_gssapi_state->max_wrap_buf_size);
 833
 834                 gensec_gssapi_state->sasl_protection = 0;
 835                 if (security_accepted & NEG_SEAL) {
 836                         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 837                                 DEBUG(1, ("Remote client wanted seal, but gensec refused\n"));
 838                                 return NT_STATUS_ACCESS_DENIED;
 839                         }
 840                         gensec_gssapi_state->sasl_protection |= NEG_SEAL;
 841                 }
 842                 if (security_accepted & NEG_SIGN) {
 843                         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 844                                 DEBUG(1, ("Remote client wanted sign, but gensec refused\n"));
 845                                 return NT_STATUS_ACCESS_DENIED;
 846                         }
 847                         gensec_gssapi_state->sasl_protection |= NEG_SIGN;
 848                 }
 849                 if (security_accepted & NEG_NONE) {
 850                         gensec_gssapi_state->sasl_protection |= NEG_NONE;
 851                 }
 852
 853                 /* quirk:  This changes the value that gensec_have_feature returns, to be that after SASL negotiation */
 854                 gensec_gssapi_state->sasl_state = STAGE_DONE;
 855                 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 856                         DEBUG(5, ("SASL/GSSAPI Connection from client will be cryptographically sealed\n"));
 857                 } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 858                         DEBUG(5, ("SASL/GSSAPI Connection from client will be cryptographically signed\n"));
 859                 } else {
 860                         DEBUG(5, ("SASL/GSSAPI Connection from client will have no cryptographic protection\n"));
 861                 }
 862
 863                 *out = data_blob(NULL, 0);
 864                 return NT_STATUS_OK;
 865         }
 866         default:
 867                 return NT_STATUS_INVALID_PARAMETER;
 868         }
 869 }
 870
 871 static NTSTATUS gensec_gssapi_wrap(struct gensec_security *gensec_security,
 872                                    TALLOC_CTX *mem_ctx,
 873                                    const DATA_BLOB *in,
 874                                    DATA_BLOB *out)
 875 {
 876         struct gensec_gssapi_state *gensec_gssapi_state
 877                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 878         OM_uint32 maj_stat, min_stat;
 879         gss_buffer_desc input_token, output_token;
 880         int conf_state;
 881         input_token.length = in->length;
 882         input_token.value = in->data;
 883
 884         maj_stat = gss_wrap(&min_stat,
 885                             gensec_gssapi_state->gssapi_context,
 886                             gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
 887                             GSS_C_QOP_DEFAULT,
 888                             &input_token,
 889                             &conf_state,
 890                             &output_token);
 891         if (GSS_ERROR(maj_stat)) {
 892                 DEBUG(1, ("gensec_gssapi_wrap: GSS Wrap failed: %s\n",
 893                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 894                 return NT_STATUS_ACCESS_DENIED;
 895         }
 896
 897         *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
 898         gss_release_buffer(&min_stat, &output_token);
 899
 900         if (gensec_gssapi_state->sasl) {
 901                 size_t max_wrapped_size = gensec_gssapi_max_wrapped_size(gensec_security);
 902                 if (max_wrapped_size < out->length) {
 903                         DEBUG(1, ("gensec_gssapi_wrap: when wrapped, INPUT data (%u) is grew to be larger than SASL negotiated maximum output size (%u > %u)\n",
 904                                   (unsigned)in->length,
 905                                   (unsigned)out->length,
 906                                   (unsigned int)max_wrapped_size));
 907                         return NT_STATUS_INVALID_PARAMETER;
 908                 }
 909         }
 910
 911         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 912             && !conf_state) {
 913                 return NT_STATUS_ACCESS_DENIED;
 914         }
 915         return NT_STATUS_OK;
 916 }
 917
 918 static NTSTATUS gensec_gssapi_unwrap(struct gensec_security *gensec_security,
 919                                      TALLOC_CTX *mem_ctx,
 920                                      const DATA_BLOB *in,
 921                                      DATA_BLOB *out)
 922 {
 923         struct gensec_gssapi_state *gensec_gssapi_state
 924                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 925         OM_uint32 maj_stat, min_stat;
 926         gss_buffer_desc input_token, output_token;
 927         int conf_state;
 928         gss_qop_t qop_state;
 929         input_token.length = in->length;
 930         input_token.value = in->data;
 931
 932         if (gensec_gssapi_state->sasl) {
 933                 size_t max_wrapped_size = gensec_gssapi_max_wrapped_size(gensec_security);
 934                 if (max_wrapped_size < in->length) {
 935                         DEBUG(1, ("gensec_gssapi_unwrap: WRAPPED data is larger than SASL negotiated maximum size\n"));
 936                         return NT_STATUS_INVALID_PARAMETER;
 937                 }
 938         }
 939
 940         maj_stat = gss_unwrap(&min_stat,
 941                               gensec_gssapi_state->gssapi_context,
 942                               &input_token,
 943                               &output_token,
 944                               &conf_state,
 945                               &qop_state);
 946         if (GSS_ERROR(maj_stat)) {
 947                 DEBUG(1, ("gensec_gssapi_unwrap: GSS UnWrap failed: %s\n",
 948                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 949                 return NT_STATUS_ACCESS_DENIED;
 950         }
 951
 952         *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
 953         gss_release_buffer(&min_stat, &output_token);
 954
 955         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 956             && !conf_state) {
 957                 return NT_STATUS_ACCESS_DENIED;
 958         }
 959         return NT_STATUS_OK;
 960 }
 961
 962 /* Find out the maximum input size negotiated on this connection */
 963
 964 static size_t gensec_gssapi_max_input_size(struct gensec_security *gensec_security)
 965 {
 966         struct gensec_gssapi_state *gensec_gssapi_state
 967                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
 968         OM_uint32 maj_stat, min_stat;
 969         OM_uint32 max_input_size;
 970
 971         maj_stat = gss_wrap_size_limit(&min_stat,
 972                                        gensec_gssapi_state->gssapi_context,
 973                                        gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
 974                                        GSS_C_QOP_DEFAULT,
 975                                        gensec_gssapi_state->max_wrap_buf_size,
 976                                        &max_input_size);
 977         if (GSS_ERROR(maj_stat)) {
 978                 TALLOC_CTX *mem_ctx = talloc_new(NULL);
 979                 DEBUG(1, ("gensec_gssapi_max_input_size: determining signature size with gss_wrap_size_limit failed: %s\n",
 980                           gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
 981                 talloc_free(mem_ctx);
 982                 return 0;
 983         }
 984
 985         return max_input_size;
 986 }
 987
 988 /* Find out the maximum output size negotiated on this connection */
 989 static size_t gensec_gssapi_max_wrapped_size(struct gensec_security *gensec_security)
 990 {
 991         struct gensec_gssapi_state *gensec_gssapi_state = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);;
 992         return gensec_gssapi_state->max_wrap_buf_size;
 993 }
 994
 995 static NTSTATUS gensec_gssapi_seal_packet(struct gensec_security *gensec_security,
 996                                           TALLOC_CTX *mem_ctx,
 997                                           uint8_t *data, size_t length,
 998                                           const uint8_t *whole_pdu, size_t pdu_length,
 999                                           DATA_BLOB *sig)
1000 {
1001         struct gensec_gssapi_state *gensec_gssapi_state
1002                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1003         bool hdr_signing = false;
1004         size_t sig_size = 0;
1005         NTSTATUS status;
1006
1007         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1008                 hdr_signing = true;
1009         }
1010
1011         sig_size = gensec_gssapi_sig_size(gensec_security, length);
1012
1013         status = gssapi_seal_packet(gensec_gssapi_state->gssapi_context,
1014                                     gensec_gssapi_state->gss_oid,
1015                                     hdr_signing, sig_size,
1016                                     data, length,
1017                                     whole_pdu, pdu_length,
1018                                     mem_ctx, sig);
1019         if (!NT_STATUS_IS_OK(status)) {
1020                 DEBUG(0, ("gssapi_seal_packet(hdr_signing=%u,sig_size=%zu,"
1021                           "data=%zu,pdu=%zu) failed: %s\n",
1022                           hdr_signing, sig_size, length, pdu_length,
1023                           nt_errstr(status)));
1024                 return status;
1025         }
1026
1027         return NT_STATUS_OK;
1028 }
1029
1030 static NTSTATUS gensec_gssapi_unseal_packet(struct gensec_security *gensec_security,
1031                                             uint8_t *data, size_t length,
1032                                             const uint8_t *whole_pdu, size_t pdu_length,
1033                                             const DATA_BLOB *sig)
1034 {
1035         struct gensec_gssapi_state *gensec_gssapi_state
1036                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1037         bool hdr_signing = false;
1038         NTSTATUS status;
1039
1040         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1041                 hdr_signing = true;
1042         }
1043
1044         status = gssapi_unseal_packet(gensec_gssapi_state->gssapi_context,
1045                                       gensec_gssapi_state->gss_oid,
1046                                       hdr_signing,
1047                                       data, length,
1048                                       whole_pdu, pdu_length,
1049                                       sig);
1050         if (!NT_STATUS_IS_OK(status)) {
1051                 DEBUG(0, ("gssapi_unseal_packet(hdr_signing=%u,sig_size=%zu,"
1052                           "data=%zu,pdu=%zu) failed: %s\n",
1053                           hdr_signing, sig->length, length, pdu_length,
1054                           nt_errstr(status)));
1055                 return status;
1056         }
1057
1058         return NT_STATUS_OK;
1059 }
1060
1061 static NTSTATUS gensec_gssapi_sign_packet(struct gensec_security *gensec_security,
1062                                           TALLOC_CTX *mem_ctx,
1063                                           const uint8_t *data, size_t length,
1064                                           const uint8_t *whole_pdu, size_t pdu_length,
1065                                           DATA_BLOB *sig)
1066 {
1067         struct gensec_gssapi_state *gensec_gssapi_state
1068                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1069         bool hdr_signing = false;
1070         NTSTATUS status;
1071
1072         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1073                 hdr_signing = true;
1074         }
1075
1076         status = gssapi_sign_packet(gensec_gssapi_state->gssapi_context,
1077                                     gensec_gssapi_state->gss_oid,
1078                                     hdr_signing,
1079                                     data, length,
1080                                     whole_pdu, pdu_length,
1081                                     mem_ctx, sig);
1082         if (!NT_STATUS_IS_OK(status)) {
1083                 DEBUG(0, ("gssapi_sign_packet(hdr_signing=%u,"
1084                           "data=%zu,pdu=%zu) failed: %s\n",
1085                           hdr_signing, length, pdu_length,
1086                           nt_errstr(status)));
1087                 return status;
1088         }
1089
1090         return NT_STATUS_OK;
1091 }
1092
1093 static NTSTATUS gensec_gssapi_check_packet(struct gensec_security *gensec_security,
1094                                            const uint8_t *data, size_t length,
1095                                            const uint8_t *whole_pdu, size_t pdu_length,
1096                                            const DATA_BLOB *sig)
1097 {
1098         struct gensec_gssapi_state *gensec_gssapi_state
1099                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1100         bool hdr_signing = false;
1101         NTSTATUS status;
1102
1103         if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1104                 hdr_signing = true;
1105         }
1106
1107         status = gssapi_check_packet(gensec_gssapi_state->gssapi_context,
1108                                      gensec_gssapi_state->gss_oid,
1109                                      hdr_signing,
1110                                      data, length,
1111                                      whole_pdu, pdu_length,
1112                                      sig);
1113         if (!NT_STATUS_IS_OK(status)) {
1114                 DEBUG(0, ("gssapi_check_packet(hdr_signing=%u,sig_size=%zu,"
1115                           "data=%zu,pdu=%zu) failed: %s\n",
1116                           hdr_signing, sig->length, length, pdu_length,
1117                           nt_errstr(status)));
1118                 return status;
1119         }
1120
1121         return NT_STATUS_OK;
1122 }
1123
1124 /* Try to figure out what features we actually got on the connection */
1125 static bool gensec_gssapi_have_feature(struct gensec_security *gensec_security,
1126                                        uint32_t feature)
1127 {
1128         struct gensec_gssapi_state *gensec_gssapi_state
1129                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1130         if (feature & GENSEC_FEATURE_SIGN) {
1131                 /* If we are going GSSAPI SASL, then we honour the second negotiation */
1132                 if (gensec_gssapi_state->sasl
1133                     && gensec_gssapi_state->sasl_state == STAGE_DONE) {
1134                         return ((gensec_gssapi_state->sasl_protection & NEG_SIGN)
1135                                 && (gensec_gssapi_state->gss_got_flags & GSS_C_INTEG_FLAG));
1136                 }
1137                 return gensec_gssapi_state->gss_got_flags & GSS_C_INTEG_FLAG;
1138         }
1139         if (feature & GENSEC_FEATURE_SEAL) {
1140                 /* If we are going GSSAPI SASL, then we honour the second negotiation */
1141                 if (gensec_gssapi_state->sasl
1142                     && gensec_gssapi_state->sasl_state == STAGE_DONE) {
1143                         return ((gensec_gssapi_state->sasl_protection & NEG_SEAL)
1144                                  && (gensec_gssapi_state->gss_got_flags & GSS_C_CONF_FLAG));
1145                 }
1146                 return gensec_gssapi_state->gss_got_flags & GSS_C_CONF_FLAG;
1147         }
1148         if (feature & GENSEC_FEATURE_SESSION_KEY) {
1149                 /* Only for GSSAPI/Krb5 */
1150                 if (smb_gss_oid_equal(gensec_gssapi_state->gss_oid,
1151                                       gss_mech_krb5)) {
1152                         return true;
1153                 }
1154         }
1155         if (feature & GENSEC_FEATURE_DCE_STYLE) {
1156                 return gensec_gssapi_state->gss_got_flags & GSS_C_DCE_STYLE;
1157         }
1158         if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
1159                 NTSTATUS status;
1160                 uint32_t keytype;
1161
1162                 if (!(gensec_gssapi_state->gss_got_flags & GSS_C_INTEG_FLAG)) {
1163                         return false;
1164                 }
1165
1166                 if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "force_new_spnego", false)) {
1167                         return true;
1168                 }
1169                 if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "disable_new_spnego", false)) {
1170                         return false;
1171                 }
1172
1173                 status = gssapi_get_session_key(gensec_gssapi_state,
1174                                                 gensec_gssapi_state->gssapi_context, NULL, &keytype);
1175                 /*
1176                  * We should do a proper sig on the mechListMic unless
1177                  * we know we have to be backwards compatible with
1178                  * earlier windows versions.
1179                  *
1180                  * Negotiating a non-krb5
1181                  * mech for example should be regarded as having
1182                  * NEW_SPNEGO
1183                  */
1184                 if (NT_STATUS_IS_OK(status)) {
1185                         switch (keytype) {
1186                         case ENCTYPE_DES_CBC_CRC:
1187                         case ENCTYPE_DES_CBC_MD5:
1188                         case ENCTYPE_ARCFOUR_HMAC:
1189                         case ENCTYPE_DES3_CBC_SHA1:
1190                                 return false;
1191                         }
1192                 }
1193                 return true;
1194         }
1195         /* We can always do async (rather than strict request/reply) packets.  */
1196         if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
1197                 return true;
1198         }
1199         if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
1200                 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
1201                         return true;
1202                 }
1203
1204                 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
1205                         return true;
1206                 }
1207
1208                 return false;
1209         }
1210         return false;
1211 }
1212
1213 static NTTIME gensec_gssapi_expire_time(struct gensec_security *gensec_security)
1214 {
1215         struct gensec_gssapi_state *gensec_gssapi_state =
1216                 talloc_get_type_abort(gensec_security->private_data,
1217                 struct gensec_gssapi_state);
1218
1219         return gensec_gssapi_state->expire_time;
1220 }
1221
1222 /*
1223  * Extract the 'sesssion key' needed by SMB signing and ncacn_np
1224  * (for encrypting some passwords).
1225  *
1226  * This breaks all the abstractions, but what do you expect...
1227  */
1228 static NTSTATUS gensec_gssapi_session_key(struct gensec_security *gensec_security,
1229                                           TALLOC_CTX *mem_ctx,
1230                                           DATA_BLOB *session_key)
1231 {
1232         struct gensec_gssapi_state *gensec_gssapi_state
1233                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1234         return gssapi_get_session_key(mem_ctx, gensec_gssapi_state->gssapi_context, session_key, NULL);
1235 }
1236
1237 /* Get some basic (and authorization) information about the user on
1238  * this session.  This uses either the PAC (if present) or a local
1239  * database lookup */
1240 static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_security,
1241                                            TALLOC_CTX *mem_ctx,
1242                                            struct auth_session_info **_session_info)
1243 {
1244         NTSTATUS nt_status;
1245         TALLOC_CTX *tmp_ctx;
1246         struct gensec_gssapi_state *gensec_gssapi_state
1247                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1248         struct auth_session_info *session_info = NULL;
1249         OM_uint32 maj_stat, min_stat;
1250         DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
1251
1252         gss_buffer_desc name_token;
1253         char *principal_string;
1254
1255         tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gssapi_session_info context");
1256         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1257
1258         maj_stat = gss_display_name (&min_stat,
1259                                      gensec_gssapi_state->client_name,
1260                                      &name_token,
1261                                      NULL);
1262         if (GSS_ERROR(maj_stat)) {
1263                 DEBUG(1, ("GSS display_name failed: %s\n",
1264                           gssapi_error_string(tmp_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
1265                 talloc_free(tmp_ctx);
1266                 return NT_STATUS_FOOBAR;
1267         }
1268
1269         principal_string = talloc_strndup(tmp_ctx,
1270                                           (const char *)name_token.value,
1271                                           name_token.length);
1272
1273         gss_release_buffer(&min_stat, &name_token);
1274
1275         if (!principal_string) {
1276                 talloc_free(tmp_ctx);
1277                 return NT_STATUS_NO_MEMORY;
1278         }
1279
1280         nt_status = gssapi_obtain_pac_blob(tmp_ctx,  gensec_gssapi_state->gssapi_context,
1281                                            gensec_gssapi_state->client_name,
1282                                            &pac_blob);
1283
1284         /* IF we have the PAC - otherwise we need to get this
1285          * data from elsewere - local ldb, or (TODO) lookup of some
1286          * kind...
1287          */
1288         if (NT_STATUS_IS_OK(nt_status)) {
1289                 pac_blob_ptr = &pac_blob;
1290         }
1291         nt_status = gensec_generate_session_info_pac(tmp_ctx,
1292                                                      gensec_security,
1293                                                      gensec_gssapi_state->smb_krb5_context,
1294                                                      pac_blob_ptr, principal_string,
1295                                                      gensec_get_remote_address(gensec_security),
1296                                                      &session_info);
1297         if (!NT_STATUS_IS_OK(nt_status)) {
1298                 talloc_free(tmp_ctx);
1299                 return nt_status;
1300         }
1301
1302         nt_status = gensec_gssapi_session_key(gensec_security, session_info, &session_info->session_key);
1303         if (!NT_STATUS_IS_OK(nt_status)) {
1304                 talloc_free(tmp_ctx);
1305                 return nt_status;
1306         }
1307
1308         if (gensec_gssapi_state->gss_got_flags & GSS_C_DELEG_FLAG &&
1309             gensec_gssapi_state->delegated_cred_handle != GSS_C_NO_CREDENTIAL) {
1310                 krb5_error_code ret;
1311                 const char *error_string;
1312
1313                 DEBUG(10, ("gensec_gssapi: delegated credentials supplied by client\n"));
1314
1315                 /*
1316                  * Create anonymous credentials for now.
1317                  *
1318                  * We will update them with the provided client gss creds.
1319                  */
1320                 session_info->credentials = cli_credentials_init_anon(session_info);
1321                 if (session_info->credentials == NULL) {
1322                         talloc_free(tmp_ctx);
1323                         return NT_STATUS_NO_MEMORY;
1324                 }
1325
1326                 ret = cli_credentials_set_client_gss_creds(session_info->credentials,
1327                                                            gensec_security->settings->lp_ctx,
1328                                                            gensec_gssapi_state->delegated_cred_handle,
1329                                                            CRED_SPECIFIED, &error_string);
1330                 if (ret) {
1331                         talloc_free(tmp_ctx);
1332                         DEBUG(2,("Failed to get gss creds: %s\n", error_string));
1333                         return NT_STATUS_NO_MEMORY;
1334                 }
1335
1336                 /* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */
1337                 cli_credentials_set_kerberos_state(session_info->credentials, CRED_MUST_USE_KERBEROS);
1338
1339                 /* It has been taken from this place... */
1340                 gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
1341         } else {
1342                 DEBUG(10, ("gensec_gssapi: NO delegated credentials supplied by client\n"));
1343         }
1344
1345         *_session_info = talloc_steal(mem_ctx, session_info);
1346         talloc_free(tmp_ctx);
1347
1348         return NT_STATUS_OK;
1349 }
1350
1351 static size_t gensec_gssapi_sig_size(struct gensec_security *gensec_security, size_t data_size)
1352 {
1353         struct gensec_gssapi_state *gensec_gssapi_state
1354                 = talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
1355         size_t sig_size;
1356
1357         if (gensec_gssapi_state->sig_size > 0) {
1358                 return gensec_gssapi_state->sig_size;
1359         }
1360
1361         sig_size = gssapi_get_sig_size(gensec_gssapi_state->gssapi_context,
1362                                        gensec_gssapi_state->gss_oid,
1363                                        gensec_gssapi_state->gss_got_flags,
1364                                        data_size);
1365
1366         gensec_gssapi_state->sig_size = sig_size;
1367         return gensec_gssapi_state->sig_size;
1368 }
1369
1370 static const char *gensec_gssapi_krb5_oids[] = {
1371         GENSEC_OID_KERBEROS5_OLD,
1372         GENSEC_OID_KERBEROS5,
1373         NULL
1374 };
1375
1376 static const char *gensec_gssapi_spnego_oids[] = {
1377         GENSEC_OID_SPNEGO,
1378         NULL
1379 };
1380
1381 /* As a server, this could in theory accept any GSSAPI mech */
1382 static const struct gensec_security_ops gensec_gssapi_spnego_security_ops = {
1383         .name           = "gssapi_spnego",
1384         .sasl_name      = "GSS-SPNEGO",
1385         .auth_type      = DCERPC_AUTH_TYPE_SPNEGO,
1386         .oid            = gensec_gssapi_spnego_oids,
1387         .client_start   = gensec_gssapi_client_start,
1388         .server_start   = gensec_gssapi_server_start,
1389         .magic          = gensec_magic_check_krb5_oid,
1390         .update         = gensec_gssapi_update,
1391         .session_key    = gensec_gssapi_session_key,
1392         .session_info   = gensec_gssapi_session_info,
1393         .sign_packet    = gensec_gssapi_sign_packet,
1394         .check_packet   = gensec_gssapi_check_packet,
1395         .seal_packet    = gensec_gssapi_seal_packet,
1396         .unseal_packet  = gensec_gssapi_unseal_packet,
1397         .max_input_size   = gensec_gssapi_max_input_size,
1398         .max_wrapped_size = gensec_gssapi_max_wrapped_size,
1399         .wrap           = gensec_gssapi_wrap,
1400         .unwrap         = gensec_gssapi_unwrap,
1401         .have_feature   = gensec_gssapi_have_feature,
1402         .expire_time    = gensec_gssapi_expire_time,
1403         .enabled        = false,
1404         .kerberos       = true,
1405         .priority       = GENSEC_GSSAPI
1406 };
1407
1408 /* As a server, this could in theory accept any GSSAPI mech */
1409 static const struct gensec_security_ops gensec_gssapi_krb5_security_ops = {
1410         .name           = "gssapi_krb5",
1411         .auth_type      = DCERPC_AUTH_TYPE_KRB5,
1412         .oid            = gensec_gssapi_krb5_oids,
1413         .client_start   = gensec_gssapi_client_start,
1414         .server_start   = gensec_gssapi_server_start,
1415         .magic          = gensec_magic_check_krb5_oid,
1416         .update         = gensec_gssapi_update,
1417         .session_key    = gensec_gssapi_session_key,
1418         .session_info   = gensec_gssapi_session_info,
1419         .sig_size       = gensec_gssapi_sig_size,
1420         .sign_packet    = gensec_gssapi_sign_packet,
1421         .check_packet   = gensec_gssapi_check_packet,
1422         .seal_packet    = gensec_gssapi_seal_packet,
1423         .unseal_packet  = gensec_gssapi_unseal_packet,
1424         .max_input_size   = gensec_gssapi_max_input_size,
1425         .max_wrapped_size = gensec_gssapi_max_wrapped_size,
1426         .wrap           = gensec_gssapi_wrap,
1427         .unwrap         = gensec_gssapi_unwrap,
1428         .have_feature   = gensec_gssapi_have_feature,
1429         .expire_time    = gensec_gssapi_expire_time,
1430         .enabled        = true,
1431         .kerberos       = true,
1432         .priority       = GENSEC_GSSAPI
1433 };
1434
1435 /* As a server, this could in theory accept any GSSAPI mech */
1436 static const struct gensec_security_ops gensec_gssapi_sasl_krb5_security_ops = {
1437         .name             = "gssapi_krb5_sasl",
1438         .sasl_name        = "GSSAPI",
1439         .client_start     = gensec_gssapi_sasl_client_start,
1440         .server_start     = gensec_gssapi_sasl_server_start,
1441         .update           = gensec_gssapi_update,
1442         .session_key      = gensec_gssapi_session_key,
1443         .session_info     = gensec_gssapi_session_info,
1444         .max_input_size   = gensec_gssapi_max_input_size,
1445         .max_wrapped_size = gensec_gssapi_max_wrapped_size,
1446         .wrap             = gensec_gssapi_wrap,
1447         .unwrap           = gensec_gssapi_unwrap,
1448         .have_feature     = gensec_gssapi_have_feature,
1449         .expire_time      = gensec_gssapi_expire_time,
1450         .enabled          = true,
1451         .kerberos         = true,
1452         .priority         = GENSEC_GSSAPI
1453 };
1454
1455 _PUBLIC_ NTSTATUS gensec_gssapi_init(void)
1456 {
1457         NTSTATUS ret;
1458
1459         ret = gensec_register(&gensec_gssapi_spnego_security_ops);
1460         if (!NT_STATUS_IS_OK(ret)) {
1461                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1462                         gensec_gssapi_spnego_security_ops.name));
1463                 return ret;
1464         }
1465
1466         ret = gensec_register(&gensec_gssapi_krb5_security_ops);
1467         if (!NT_STATUS_IS_OK(ret)) {
1468                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1469                         gensec_gssapi_krb5_security_ops.name));
1470                 return ret;
1471         }
1472
1473         ret = gensec_register(&gensec_gssapi_sasl_krb5_security_ops);
1474         if (!NT_STATUS_IS_OK(ret)) {
1475                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
1476                         gensec_gssapi_sasl_krb5_security_ops.name));
1477                 return ret;
1478         }
1479
1480         return ret;
1481 }