source: trunk/server/source3/libsmb/clispnego.c@ 750

Last change on this file since 750 was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 14.9 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 simple kerberos5/SPNEGO routines
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
6 Copyright (C) Luke Howard 2003
7 Copyright (C) Jeremy Allison 2010
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "../libcli/auth/spnego.h"
25#include "smb_krb5.h"
26#include "../lib/util/asn1.h"
27
28/*
29 generate a negTokenInit packet given a list of supported
30 OIDs (the mechanisms) a blob, and a principal name string
31*/
32
33DATA_BLOB spnego_gen_negTokenInit(TALLOC_CTX *ctx,
34 const char *OIDs[],
35 DATA_BLOB *psecblob,
36 const char *principal)
37{
38 int i;
39 ASN1_DATA *data;
40 DATA_BLOB ret;
41
42 data = asn1_init(talloc_tos());
43 if (data == NULL) {
44 return data_blob_null;
45 }
46
47 asn1_push_tag(data,ASN1_APPLICATION(0));
48 asn1_write_OID(data,OID_SPNEGO);
49 asn1_push_tag(data,ASN1_CONTEXT(0));
50 asn1_push_tag(data,ASN1_SEQUENCE(0));
51
52 asn1_push_tag(data,ASN1_CONTEXT(0));
53 asn1_push_tag(data,ASN1_SEQUENCE(0));
54 for (i=0; OIDs[i]; i++) {
55 asn1_write_OID(data,OIDs[i]);
56 }
57 asn1_pop_tag(data);
58 asn1_pop_tag(data);
59
60 if (psecblob && psecblob->length && psecblob->data) {
61 asn1_push_tag(data, ASN1_CONTEXT(2));
62 asn1_write_OctetString(data,psecblob->data,
63 psecblob->length);
64 asn1_pop_tag(data);
65 }
66
67 if (principal) {
68 asn1_push_tag(data, ASN1_CONTEXT(3));
69 asn1_push_tag(data, ASN1_SEQUENCE(0));
70 asn1_push_tag(data, ASN1_CONTEXT(0));
71 asn1_write_GeneralString(data,principal);
72 asn1_pop_tag(data);
73 asn1_pop_tag(data);
74 asn1_pop_tag(data);
75 }
76
77 asn1_pop_tag(data);
78 asn1_pop_tag(data);
79
80 asn1_pop_tag(data);
81
82 if (data->has_error) {
83 DEBUG(1,("Failed to build negTokenInit at offset %d\n", (int)data->ofs));
84 }
85
86 ret = data_blob_talloc(ctx, data->data, data->length);
87 asn1_free(data);
88
89 return ret;
90}
91
92/*
93 parse a negTokenInit packet giving a GUID, a list of supported
94 OIDs (the mechanisms) and a principal name string
95*/
96bool spnego_parse_negTokenInit(TALLOC_CTX *ctx,
97 DATA_BLOB blob,
98 char *OIDs[ASN1_MAX_OIDS],
99 char **principal,
100 DATA_BLOB *secblob)
101{
102 int i;
103 bool ret;
104 ASN1_DATA *data;
105
106 data = asn1_init(talloc_tos());
107 if (data == NULL) {
108 return false;
109 }
110
111 asn1_load(data, blob);
112
113 asn1_start_tag(data,ASN1_APPLICATION(0));
114
115 asn1_check_OID(data,OID_SPNEGO);
116
117 /* negTokenInit [0] NegTokenInit */
118 asn1_start_tag(data,ASN1_CONTEXT(0));
119 asn1_start_tag(data,ASN1_SEQUENCE(0));
120
121 /* mechTypes [0] MechTypeList OPTIONAL */
122
123 /* Not really optional, we depend on this to decide
124 * what mechanisms we have to work with. */
125
126 asn1_start_tag(data,ASN1_CONTEXT(0));
127 asn1_start_tag(data,ASN1_SEQUENCE(0));
128 for (i=0; asn1_tag_remaining(data) > 0 && i < ASN1_MAX_OIDS-1; i++) {
129 asn1_read_OID(data,ctx, &OIDs[i]);
130 }
131 OIDs[i] = NULL;
132 asn1_end_tag(data);
133 asn1_end_tag(data);
134
135 if (principal) {
136 *principal = NULL;
137 }
138 if (secblob) {
139 *secblob = data_blob_null;
140 }
141
142 /*
143 Win7 + Live Sign-in Assistant attaches a mechToken
144 ASN1_CONTEXT(2) to the negTokenInit packet
145 which breaks our negotiation if we just assume
146 the next tag is ASN1_CONTEXT(3).
147 */
148
149 if (asn1_peek_tag(data, ASN1_CONTEXT(1))) {
150 uint8 flags;
151
152 /* reqFlags [1] ContextFlags OPTIONAL */
153 asn1_start_tag(data, ASN1_CONTEXT(1));
154 asn1_start_tag(data, ASN1_BIT_STRING);
155 while (asn1_tag_remaining(data) > 0) {
156 asn1_read_uint8(data, &flags);
157 }
158 asn1_end_tag(data);
159 asn1_end_tag(data);
160 }
161
162 if (asn1_peek_tag(data, ASN1_CONTEXT(2))) {
163 DATA_BLOB sblob = data_blob_null;
164 /* mechToken [2] OCTET STRING OPTIONAL */
165 asn1_start_tag(data, ASN1_CONTEXT(2));
166 asn1_read_OctetString(data, ctx, &sblob);
167 asn1_end_tag(data);
168 if (secblob) {
169 *secblob = sblob;
170 } else {
171 data_blob_free(&sblob);
172 }
173 }
174
175 if (asn1_peek_tag(data, ASN1_CONTEXT(3))) {
176 char *princ = NULL;
177 /* mechListMIC [3] OCTET STRING OPTIONAL */
178 asn1_start_tag(data, ASN1_CONTEXT(3));
179 asn1_start_tag(data, ASN1_SEQUENCE(0));
180 asn1_start_tag(data, ASN1_CONTEXT(0));
181 asn1_read_GeneralString(data, ctx, &princ);
182 asn1_end_tag(data);
183 asn1_end_tag(data);
184 asn1_end_tag(data);
185 if (principal) {
186 *principal = princ;
187 } else {
188 TALLOC_FREE(princ);
189 }
190 }
191
192 asn1_end_tag(data);
193 asn1_end_tag(data);
194
195 asn1_end_tag(data);
196
197 ret = !data->has_error;
198 if (data->has_error) {
199 int j;
200 if (principal) {
201 TALLOC_FREE(*principal);
202 }
203 if (secblob) {
204 data_blob_free(secblob);
205 }
206 for(j = 0; j < i && j < ASN1_MAX_OIDS-1; j++) {
207 TALLOC_FREE(OIDs[j]);
208 }
209 }
210
211 asn1_free(data);
212 return ret;
213}
214
215/*
216 generate a krb5 GSS-API wrapper packet given a ticket
217*/
218DATA_BLOB spnego_gen_krb5_wrap(TALLOC_CTX *ctx, const DATA_BLOB ticket, const uint8 tok_id[2])
219{
220 ASN1_DATA *data;
221 DATA_BLOB ret;
222
223 data = asn1_init(talloc_tos());
224 if (data == NULL) {
225 return data_blob_null;
226 }
227
228 asn1_push_tag(data, ASN1_APPLICATION(0));
229 asn1_write_OID(data, OID_KERBEROS5);
230
231 asn1_write(data, tok_id, 2);
232 asn1_write(data, ticket.data, ticket.length);
233 asn1_pop_tag(data);
234
235 if (data->has_error) {
236 DEBUG(1,("Failed to build krb5 wrapper at offset %d\n", (int)data->ofs));
237 }
238
239 ret = data_blob_talloc(ctx, data->data, data->length);
240 asn1_free(data);
241
242 return ret;
243}
244
245/*
246 parse a krb5 GSS-API wrapper packet giving a ticket
247*/
248bool spnego_parse_krb5_wrap(TALLOC_CTX *ctx, DATA_BLOB blob, DATA_BLOB *ticket, uint8 tok_id[2])
249{
250 bool ret;
251 ASN1_DATA *data;
252 int data_remaining;
253
254 data = asn1_init(talloc_tos());
255 if (data == NULL) {
256 return false;
257 }
258
259 asn1_load(data, blob);
260 asn1_start_tag(data, ASN1_APPLICATION(0));
261 asn1_check_OID(data, OID_KERBEROS5);
262
263 data_remaining = asn1_tag_remaining(data);
264
265 if (data_remaining < 3) {
266 data->has_error = True;
267 } else {
268 asn1_read(data, tok_id, 2);
269 data_remaining -= 2;
270 *ticket = data_blob_talloc(ctx, NULL, data_remaining);
271 asn1_read(data, ticket->data, ticket->length);
272 }
273
274 asn1_end_tag(data);
275
276 ret = !data->has_error;
277
278 if (data->has_error) {
279 data_blob_free(ticket);
280 }
281
282 asn1_free(data);
283
284 return ret;
285}
286
287
288/*
289 generate a SPNEGO krb5 negTokenInit packet, ready for a EXTENDED_SECURITY
290 kerberos session setup
291*/
292int spnego_gen_krb5_negTokenInit(TALLOC_CTX *ctx,
293 const char *principal, int time_offset,
294 DATA_BLOB *targ,
295 DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
296 time_t *expire_time)
297{
298 int retval;
299 DATA_BLOB tkt, tkt_wrapped;
300 const char *krb_mechs[] = {OID_KERBEROS5_OLD, OID_KERBEROS5, OID_NTLMSSP, NULL};
301
302 /* get a kerberos ticket for the service and extract the session key */
303 retval = cli_krb5_get_ticket(ctx, principal, time_offset,
304 &tkt, session_key_krb5,
305 extra_ap_opts, NULL,
306 expire_time, NULL);
307 if (retval) {
308 return retval;
309 }
310
311 /* wrap that up in a nice GSS-API wrapping */
312 tkt_wrapped = spnego_gen_krb5_wrap(ctx, tkt, TOK_ID_KRB_AP_REQ);
313
314 /* and wrap that in a shiny SPNEGO wrapper */
315 *targ = spnego_gen_negTokenInit(ctx, krb_mechs, &tkt_wrapped, NULL);
316
317 data_blob_free(&tkt_wrapped);
318 data_blob_free(&tkt);
319
320 return retval;
321}
322
323
324/*
325 parse a spnego NTLMSSP challenge packet giving two security blobs
326*/
327bool spnego_parse_challenge(TALLOC_CTX *ctx, const DATA_BLOB blob,
328 DATA_BLOB *chal1, DATA_BLOB *chal2)
329{
330 bool ret;
331 ASN1_DATA *data;
332
333 ZERO_STRUCTP(chal1);
334 ZERO_STRUCTP(chal2);
335
336 data = asn1_init(talloc_tos());
337 if (data == NULL) {
338 return false;
339 }
340
341 asn1_load(data, blob);
342 asn1_start_tag(data,ASN1_CONTEXT(1));
343 asn1_start_tag(data,ASN1_SEQUENCE(0));
344
345 asn1_start_tag(data,ASN1_CONTEXT(0));
346 asn1_check_enumerated(data,1);
347 asn1_end_tag(data);
348
349 asn1_start_tag(data,ASN1_CONTEXT(1));
350 asn1_check_OID(data, OID_NTLMSSP);
351 asn1_end_tag(data);
352
353 asn1_start_tag(data,ASN1_CONTEXT(2));
354 asn1_read_OctetString(data, ctx, chal1);
355 asn1_end_tag(data);
356
357 /* the second challenge is optional (XP doesn't send it) */
358 if (asn1_tag_remaining(data)) {
359 asn1_start_tag(data,ASN1_CONTEXT(3));
360 asn1_read_OctetString(data, ctx, chal2);
361 asn1_end_tag(data);
362 }
363
364 asn1_end_tag(data);
365 asn1_end_tag(data);
366
367 ret = !data->has_error;
368
369 if (data->has_error) {
370 data_blob_free(chal1);
371 data_blob_free(chal2);
372 }
373
374 asn1_free(data);
375 return ret;
376}
377
378
379/*
380 generate a SPNEGO auth packet. This will contain the encrypted passwords
381*/
382DATA_BLOB spnego_gen_auth(TALLOC_CTX *ctx, DATA_BLOB blob)
383{
384 ASN1_DATA *data;
385 DATA_BLOB ret;
386
387 data = asn1_init(talloc_tos());
388 if (data == NULL) {
389 return data_blob_null;
390 }
391
392 asn1_push_tag(data, ASN1_CONTEXT(1));
393 asn1_push_tag(data, ASN1_SEQUENCE(0));
394 asn1_push_tag(data, ASN1_CONTEXT(2));
395 asn1_write_OctetString(data,blob.data,blob.length);
396 asn1_pop_tag(data);
397 asn1_pop_tag(data);
398 asn1_pop_tag(data);
399
400 ret = data_blob_talloc(ctx, data->data, data->length);
401
402 asn1_free(data);
403
404 return ret;
405}
406
407/*
408 parse a SPNEGO auth packet. This contains the encrypted passwords
409*/
410bool spnego_parse_auth_and_mic(TALLOC_CTX *ctx, DATA_BLOB blob,
411 DATA_BLOB *auth, DATA_BLOB *signature)
412{
413 ssize_t len;
414 struct spnego_data token;
415
416 len = spnego_read_data(talloc_tos(), blob, &token);
417 if (len == -1) {
418 DEBUG(3,("spnego_parse_auth: spnego_read_data failed\n"));
419 return false;
420 }
421
422 if (token.type != SPNEGO_NEG_TOKEN_TARG) {
423 DEBUG(3,("spnego_parse_auth: wrong token type: %d\n",
424 token.type));
425 spnego_free_data(&token);
426 return false;
427 }
428
429 *auth = data_blob_talloc(ctx,
430 token.negTokenTarg.responseToken.data,
431 token.negTokenTarg.responseToken.length);
432
433 if (!signature) {
434 goto done;
435 }
436
437 *signature = data_blob_talloc(ctx,
438 token.negTokenTarg.mechListMIC.data,
439 token.negTokenTarg.mechListMIC.length);
440
441done:
442 spnego_free_data(&token);
443
444 return true;
445}
446
447bool spnego_parse_auth(TALLOC_CTX *ctx, DATA_BLOB blob, DATA_BLOB *auth)
448{
449 return spnego_parse_auth_and_mic(ctx, blob, auth, NULL);
450}
451
452/*
453 generate a minimal SPNEGO response packet. Doesn't contain much.
454*/
455DATA_BLOB spnego_gen_auth_response_and_mic(TALLOC_CTX *ctx,
456 NTSTATUS nt_status,
457 const char *mechOID,
458 DATA_BLOB *reply,
459 DATA_BLOB *mechlistMIC)
460{
461 ASN1_DATA *data;
462 DATA_BLOB ret;
463 uint8 negResult;
464
465 if (NT_STATUS_IS_OK(nt_status)) {
466 negResult = SPNEGO_ACCEPT_COMPLETED;
467 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
468 negResult = SPNEGO_ACCEPT_INCOMPLETE;
469 } else {
470 negResult = SPNEGO_REJECT;
471 }
472
473 data = asn1_init(talloc_tos());
474 if (data == NULL) {
475 return data_blob_null;
476 }
477
478 asn1_push_tag(data, ASN1_CONTEXT(1));
479 asn1_push_tag(data, ASN1_SEQUENCE(0));
480 asn1_push_tag(data, ASN1_CONTEXT(0));
481 asn1_write_enumerated(data, negResult);
482 asn1_pop_tag(data);
483
484 if (mechOID) {
485 asn1_push_tag(data,ASN1_CONTEXT(1));
486 asn1_write_OID(data, mechOID);
487 asn1_pop_tag(data);
488 }
489
490 if (reply && reply->data != NULL) {
491 asn1_push_tag(data,ASN1_CONTEXT(2));
492 asn1_write_OctetString(data, reply->data, reply->length);
493 asn1_pop_tag(data);
494 }
495
496 if (mechlistMIC && mechlistMIC->data != NULL) {
497 asn1_push_tag(data, ASN1_CONTEXT(3));
498 asn1_write_OctetString(data,
499 mechlistMIC->data,
500 mechlistMIC->length);
501 asn1_pop_tag(data);
502 }
503
504 asn1_pop_tag(data);
505 asn1_pop_tag(data);
506
507 ret = data_blob_talloc(ctx, data->data, data->length);
508 asn1_free(data);
509 return ret;
510}
511
512DATA_BLOB spnego_gen_auth_response(TALLOC_CTX *ctx, DATA_BLOB *reply,
513 NTSTATUS nt_status, const char *mechOID)
514{
515 return spnego_gen_auth_response_and_mic(ctx, nt_status,
516 mechOID, reply, NULL);
517}
518
519/*
520 parse a SPNEGO auth packet. This contains the encrypted passwords
521*/
522bool spnego_parse_auth_response(TALLOC_CTX *ctx,
523 DATA_BLOB blob, NTSTATUS nt_status,
524 const char *mechOID,
525 DATA_BLOB *auth)
526{
527 ASN1_DATA *data;
528 uint8 negResult;
529
530 if (NT_STATUS_IS_OK(nt_status)) {
531 negResult = SPNEGO_ACCEPT_COMPLETED;
532 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
533 negResult = SPNEGO_ACCEPT_INCOMPLETE;
534 } else {
535 negResult = SPNEGO_REJECT;
536 }
537
538 data = asn1_init(talloc_tos());
539 if (data == NULL) {
540 return false;
541 }
542
543 asn1_load(data, blob);
544 asn1_start_tag(data, ASN1_CONTEXT(1));
545 asn1_start_tag(data, ASN1_SEQUENCE(0));
546 asn1_start_tag(data, ASN1_CONTEXT(0));
547 asn1_check_enumerated(data, negResult);
548 asn1_end_tag(data);
549
550 *auth = data_blob_null;
551
552 if (asn1_tag_remaining(data)) {
553 asn1_start_tag(data,ASN1_CONTEXT(1));
554 asn1_check_OID(data, mechOID);
555 asn1_end_tag(data);
556
557 if (asn1_tag_remaining(data)) {
558 asn1_start_tag(data,ASN1_CONTEXT(2));
559 asn1_read_OctetString(data, ctx, auth);
560 asn1_end_tag(data);
561 }
562 } else if (negResult == SPNEGO_ACCEPT_INCOMPLETE) {
563 data->has_error = 1;
564 }
565
566 /* Binding against Win2K DC returns a duplicate of the responseToken in
567 * the optional mechListMIC field. This is a bug in Win2K. We ignore
568 * this field if it exists. Win2K8 may return a proper mechListMIC at
569 * which point we need to implement the integrity checking. */
570 if (asn1_tag_remaining(data)) {
571 DATA_BLOB mechList = data_blob_null;
572 asn1_start_tag(data, ASN1_CONTEXT(3));
573 asn1_read_OctetString(data, ctx, &mechList);
574 asn1_end_tag(data);
575 data_blob_free(&mechList);
576 DEBUG(5,("spnego_parse_auth_response received mechListMIC, "
577 "ignoring.\n"));
578 }
579
580 asn1_end_tag(data);
581 asn1_end_tag(data);
582
583 if (data->has_error) {
584 DEBUG(3,("spnego_parse_auth_response failed at %d\n", (int)data->ofs));
585 asn1_free(data);
586 data_blob_free(auth);
587 return False;
588 }
589
590 asn1_free(data);
591 return True;
592}
593
594bool spnego_mech_list_blob(TALLOC_CTX *mem_ctx,
595 char **oid_list, DATA_BLOB *raw_data)
596{
597 ASN1_DATA *data;
598 unsigned int idx;
599
600 if (!oid_list || !oid_list[0] || !raw_data) {
601 return false;
602 }
603
604 data = asn1_init(talloc_tos());
605 if (data == NULL) {
606 return false;
607 }
608
609 asn1_push_tag(data, ASN1_SEQUENCE(0));
610 for (idx = 0; oid_list[idx]; idx++) {
611 asn1_write_OID(data, oid_list[idx]);
612 }
613 asn1_pop_tag(data);
614
615 if (data->has_error) {
616 DEBUG(3, (__location__ " failed at %d\n", (int)data->ofs));
617 asn1_free(data);
618 return false;
619 }
620
621 *raw_data = data_blob_talloc(mem_ctx, data->data, data->length);
622 if (!raw_data->data) {
623 DEBUG(3, (__location__": data_blob_talloc() failed!\n"));
624 asn1_free(data);
625 return false;
626 }
627
628 asn1_free(data);
629 return true;
630}
Note: See TracBrowser for help on using the repository browser.