source: trunk/server/source3/rpc_server/dcesrv_spnego.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 8.2 KB
Line 
1/*
2 * SPNEGO Encapsulation
3 * DCERPC Server functions
4 * Copyright (C) Simo Sorce 2010.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20#include "includes.h"
21#include "../libcli/auth/spnego.h"
22#include "dcesrv_ntlmssp.h"
23#include "dcesrv_gssapi.h"
24#include "dcesrv_spnego.h"
25
26static NTSTATUS spnego_init_server(TALLOC_CTX *mem_ctx,
27 bool do_sign, bool do_seal,
28 bool is_dcerpc,
29 struct spnego_context **spnego_ctx)
30{
31 struct spnego_context *sp_ctx = NULL;
32
33 sp_ctx = talloc_zero(mem_ctx, struct spnego_context);
34 if (!sp_ctx) {
35 return NT_STATUS_NO_MEMORY;
36 }
37
38 sp_ctx->do_sign = do_sign;
39 sp_ctx->do_seal = do_seal;
40 sp_ctx->is_dcerpc = is_dcerpc;
41
42 *spnego_ctx = sp_ctx;
43 return NT_STATUS_OK;
44}
45
46static NTSTATUS spnego_server_mech_init(struct spnego_context *sp_ctx,
47 DATA_BLOB *token_in,
48 DATA_BLOB *token_out)
49{
50 struct auth_ntlmssp_state *ntlmssp_ctx;
51 struct gse_context *gse_ctx;
52 NTSTATUS status;
53
54 switch (sp_ctx->mech) {
55 case SPNEGO_KRB5:
56 status = gssapi_server_auth_start(sp_ctx,
57 sp_ctx->do_sign,
58 sp_ctx->do_seal,
59 sp_ctx->is_dcerpc,
60 token_in,
61 token_out,
62 &gse_ctx);
63 if (!NT_STATUS_IS_OK(status)) {
64 DEBUG(0, ("Failed to init gssapi server "
65 "(%s)\n", nt_errstr(status)));
66 return status;
67 }
68
69 sp_ctx->mech_ctx.gssapi_state = gse_ctx;
70 break;
71
72 case SPNEGO_NTLMSSP:
73 status = ntlmssp_server_auth_start(sp_ctx,
74 sp_ctx->do_sign,
75 sp_ctx->do_seal,
76 sp_ctx->is_dcerpc,
77 token_in,
78 token_out,
79 &ntlmssp_ctx);
80 if (!NT_STATUS_IS_OK(status)) {
81 DEBUG(0, ("Failed to init ntlmssp server "
82 "(%s)\n", nt_errstr(status)));
83 return status;
84 }
85
86 sp_ctx->mech_ctx.ntlmssp_state = ntlmssp_ctx;
87 break;
88
89 default:
90 DEBUG(3, ("No known mechanisms available\n"));
91 return NT_STATUS_INVALID_PARAMETER;
92 }
93
94 return NT_STATUS_OK;
95}
96
97NTSTATUS spnego_server_step(struct spnego_context *sp_ctx,
98 TALLOC_CTX *mem_ctx,
99 DATA_BLOB *spnego_in,
100 DATA_BLOB *spnego_out)
101{
102 DATA_BLOB token_in = data_blob_null;
103 DATA_BLOB token_out = data_blob_null;
104 DATA_BLOB signature = data_blob_null;
105 DATA_BLOB MICblob = data_blob_null;
106 struct spnego_data sp_in;
107 ssize_t len_in = 0;
108 NTSTATUS status;
109 bool ret;
110
111 len_in = spnego_read_data(mem_ctx, *spnego_in, &sp_in);
112 if (len_in == -1) {
113 DEBUG(1, (__location__ ": invalid SPNEGO blob.\n"));
114 dump_data(10, spnego_in->data, spnego_in->length);
115 status = NT_STATUS_INVALID_PARAMETER;
116 sp_ctx->state = SPNEGO_CONV_AUTH_DONE;
117 goto done;
118 }
119 if (sp_in.type != SPNEGO_NEG_TOKEN_TARG) {
120 status = NT_STATUS_INVALID_PARAMETER;
121 goto done;
122 }
123 token_in = sp_in.negTokenTarg.responseToken;
124 signature = sp_in.negTokenTarg.mechListMIC;
125
126 switch (sp_ctx->state) {
127 case SPNEGO_CONV_NEGO:
128 /* still to initialize */
129 status = spnego_server_mech_init(sp_ctx,
130 &token_in,
131 &token_out);
132 if (!NT_STATUS_IS_OK(status)) {
133 goto done;
134 }
135 /* server always need at least one reply from client */
136 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
137 sp_ctx->state = SPNEGO_CONV_AUTH_MORE;
138 break;
139
140 case SPNEGO_CONV_AUTH_MORE:
141
142 switch(sp_ctx->mech) {
143 case SPNEGO_KRB5:
144 status = gssapi_server_step(
145 sp_ctx->mech_ctx.gssapi_state,
146 mem_ctx, &token_in, &token_out);
147 break;
148 case SPNEGO_NTLMSSP:
149 status = ntlmssp_server_step(
150 sp_ctx->mech_ctx.ntlmssp_state,
151 mem_ctx, &token_in, &token_out);
152 break;
153 default:
154 status = NT_STATUS_INVALID_PARAMETER;
155 goto done;
156 }
157
158 break;
159
160 case SPNEGO_CONV_AUTH_DONE:
161 /* we are already done, can't step further */
162 /* fall thorugh and return error */
163 default:
164 /* wrong case */
165 return NT_STATUS_INVALID_PARAMETER;
166 }
167
168 if (NT_STATUS_IS_OK(status) && signature.length != 0) {
169 /* last packet and requires signature check */
170 ret = spnego_mech_list_blob(talloc_tos(),
171 sp_ctx->oid_list, &MICblob);
172 if (ret) {
173 status = spnego_sigcheck(talloc_tos(), sp_ctx,
174 &MICblob, &MICblob,
175 &signature);
176 } else {
177 status = NT_STATUS_UNSUCCESSFUL;
178 }
179 }
180 if (NT_STATUS_IS_OK(status) && signature.length != 0) {
181 /* if signature was good, sign our own packet too */
182 status = spnego_sign(talloc_tos(), sp_ctx,
183 &MICblob, &MICblob, &signature);
184 }
185
186done:
187 *spnego_out = spnego_gen_auth_response_and_mic(mem_ctx, status,
188 sp_ctx->mech_oid,
189 &token_out,
190 &signature);
191 if (!spnego_out->data) {
192 DEBUG(1, ("SPNEGO wrapping failed!\n"));
193 status = NT_STATUS_UNSUCCESSFUL;
194 }
195
196 if (NT_STATUS_IS_OK(status) ||
197 !NT_STATUS_EQUAL(status,
198 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
199 sp_ctx->state = SPNEGO_CONV_AUTH_DONE;
200 }
201
202 data_blob_free(&token_in);
203 data_blob_free(&token_out);
204 return status;
205}
206
207NTSTATUS spnego_server_auth_start(TALLOC_CTX *mem_ctx,
208 bool do_sign,
209 bool do_seal,
210 bool is_dcerpc,
211 DATA_BLOB *spnego_in,
212 DATA_BLOB *spnego_out,
213 struct spnego_context **spnego_ctx)
214{
215 struct spnego_context *sp_ctx;
216 DATA_BLOB token_in = data_blob_null;
217 DATA_BLOB token_out = data_blob_null;
218 unsigned int i;
219 NTSTATUS status;
220 bool ret;
221
222 if (!spnego_in->length) {
223 return NT_STATUS_INVALID_PARAMETER;
224 }
225
226 status = spnego_init_server(mem_ctx, do_sign, do_seal, is_dcerpc, &sp_ctx);
227 if (!NT_STATUS_IS_OK(status)) {
228 return status;
229 }
230
231 ret = spnego_parse_negTokenInit(sp_ctx, *spnego_in,
232 sp_ctx->oid_list, NULL, &token_in);
233 if (!ret || sp_ctx->oid_list[0] == NULL) {
234 DEBUG(3, ("Invalid SPNEGO message\n"));
235 status = NT_STATUS_INVALID_PARAMETER;
236 goto done;
237 }
238
239 /* try for krb auth first */
240 for (i = 0; sp_ctx->oid_list[i] && sp_ctx->mech == SPNEGO_NONE; i++) {
241 if (strcmp(OID_KERBEROS5, sp_ctx->oid_list[i]) == 0 ||
242 strcmp(OID_KERBEROS5_OLD, sp_ctx->oid_list[i]) == 0) {
243
244 if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
245 sp_ctx->mech = SPNEGO_KRB5;
246 sp_ctx->mech_oid = sp_ctx->oid_list[i];
247 }
248 }
249 }
250
251 /* if auth type still undetermined, try for NTLMSSP */
252 for (i = 0; sp_ctx->oid_list[i] && sp_ctx->mech == SPNEGO_NONE; i++) {
253 if (strcmp(OID_NTLMSSP, sp_ctx->oid_list[i]) == 0) {
254 sp_ctx->mech = SPNEGO_NTLMSSP;
255 sp_ctx->mech_oid = sp_ctx->oid_list[i];
256 }
257 }
258
259 if (!sp_ctx->mech_oid) {
260 DEBUG(3, ("No known mechanisms available\n"));
261 status = NT_STATUS_INVALID_PARAMETER;
262 goto done;
263 }
264
265 if (DEBUGLEVEL >= 10) {
266 DEBUG(10, ("Client Provided OIDs:\n"));
267 for (i = 0; sp_ctx->oid_list[i]; i++) {
268 DEBUG(10, (" %d: %s\n", i, sp_ctx->oid_list[i]));
269 }
270 DEBUG(10, ("Chosen OID: %s\n", sp_ctx->mech_oid));
271 }
272
273 /* If it is not the first OID, then token_in is not valid for the
274 * choosen mech */
275 if (sp_ctx->mech_oid != sp_ctx->oid_list[0]) {
276 /* request more and send back empty token */
277 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
278 sp_ctx->state = SPNEGO_CONV_NEGO;
279 goto done;
280 }
281
282 status = spnego_server_mech_init(sp_ctx, &token_in, &token_out);
283 if (!NT_STATUS_IS_OK(status)) {
284 goto done;
285 }
286
287 DEBUG(10, ("SPNEGO(%d) auth started\n", sp_ctx->mech));
288
289 /* server always need at least one reply from client */
290 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
291 sp_ctx->state = SPNEGO_CONV_AUTH_MORE;
292
293done:
294 *spnego_out = spnego_gen_auth_response(mem_ctx, &token_out,
295 status, sp_ctx->mech_oid);
296 if (!spnego_out->data) {
297 status = NT_STATUS_INVALID_PARAMETER;
298 TALLOC_FREE(sp_ctx);
299 } else {
300 status = NT_STATUS_OK;
301 *spnego_ctx = sp_ctx;
302 }
303
304 data_blob_free(&token_in);
305 data_blob_free(&token_out);
306
307 return status;
308}
Note: See TracBrowser for help on using the repository browser.