Context Navigation

source: vendor/3.5.7/source3/libads/sasl.c

Visit:

Last change on this file was 587, checked in by Herwig Bauernfeind, 14 years ago
Samba 3.5: Update vendor to version 3.5.6
File size: 30.4 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	ads sasl code
4	Copyright (C) Andrew Tridgell 2001
5
6	This program is free software; you can redistribute it and/or modify
7	it under the terms of the GNU General Public License as published by
8	the Free Software Foundation; either version 3 of the License, or
9	(at your option) any later version.
10
11	This program is distributed in the hope that it will be useful,
12	but WITHOUT ANY WARRANTY; without even the implied warranty of
13	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14	GNU General Public License for more details.
15
16	You should have received a copy of the GNU General Public License
17	along with this program. If not, see <http://www.gnu.org/licenses/>.
18	*/
19
20	#include "includes.h"
21	#include "../libcli/auth/spnego.h"
22
23	#ifdef HAVE_LDAP
24
25	static ADS_STATUS ads_sasl_ntlmssp_wrap(ADS_STRUCT ads, uint8 buf, uint32 len)
26	{
27	struct ntlmssp_state *ntlmssp_state =
28	(struct ntlmssp_state *)ads->ldap.wrap_private_data;
29	ADS_STATUS status;
30	NTSTATUS nt_status;
31	DATA_BLOB sig;
32	uint8 *dptr = ads->ldap.out.buf + (4 + NTLMSSP_SIG_SIZE);
33
34	/* copy the data to the right location */
35	memcpy(dptr, buf, len);
36
37	/* create the signature and may encrypt the data */
38	if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
39	nt_status = ntlmssp_seal_packet(ntlmssp_state,
40	dptr, len,
41	dptr, len,
42	&sig);
43	} else {
44	nt_status = ntlmssp_sign_packet(ntlmssp_state,
45	dptr, len,
46	dptr, len,
47	&sig);
48	}
49	status = ADS_ERROR_NT(nt_status);
50	if (!ADS_ERR_OK(status)) return status;
51
52	/* copy the signature to the right location */
53	memcpy(ads->ldap.out.buf + 4,
54	sig.data, NTLMSSP_SIG_SIZE);
55
56	data_blob_free(&sig);
57
58	/* set how many bytes must be written to the underlying socket */
59	ads->ldap.out.left = 4 + NTLMSSP_SIG_SIZE + len;
60
61	return ADS_SUCCESS;
62	}
63
64	static ADS_STATUS ads_sasl_ntlmssp_unwrap(ADS_STRUCT *ads)
65	{
66	struct ntlmssp_state *ntlmssp_state =
67	(struct ntlmssp_state *)ads->ldap.wrap_private_data;
68	ADS_STATUS status;
69	NTSTATUS nt_status;
70	DATA_BLOB sig;
71	uint8 *dptr = ads->ldap.in.buf + (4 + NTLMSSP_SIG_SIZE);
72	uint32 dlen = ads->ldap.in.ofs - (4 + NTLMSSP_SIG_SIZE);
73
74	/* wrap the signature into a DATA_BLOB */
75	sig = data_blob_const(ads->ldap.in.buf + 4, NTLMSSP_SIG_SIZE);
76
77	/* verify the signature and maybe decrypt the data */
78	if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
79	nt_status = ntlmssp_unseal_packet(ntlmssp_state,
80	dptr, dlen,
81	dptr, dlen,
82	&sig);
83	} else {
84	nt_status = ntlmssp_check_packet(ntlmssp_state,
85	dptr, dlen,
86	dptr, dlen,
87	&sig);
88	}
89	status = ADS_ERROR_NT(nt_status);
90	if (!ADS_ERR_OK(status)) return status;
91
92	/* set the amount of bytes for the upper layer and set the ofs to the data */
93	ads->ldap.in.left = dlen;
94	ads->ldap.in.ofs = 4 + NTLMSSP_SIG_SIZE;
95
96	return ADS_SUCCESS;
97	}
98
99	static void ads_sasl_ntlmssp_disconnect(ADS_STRUCT *ads)
100	{
101	struct ntlmssp_state *ntlmssp_state =
102	(struct ntlmssp_state *)ads->ldap.wrap_private_data;
103
104	ntlmssp_end(&ntlmssp_state);
105
106	ads->ldap.wrap_ops = NULL;
107	ads->ldap.wrap_private_data = NULL;
108	}
109
110	static const struct ads_saslwrap_ops ads_sasl_ntlmssp_ops = {
111	.name = "ntlmssp",
112	.wrap = ads_sasl_ntlmssp_wrap,
113	.unwrap = ads_sasl_ntlmssp_unwrap,
114	.disconnect = ads_sasl_ntlmssp_disconnect
115	};
116
117	/*
118	perform a LDAP/SASL/SPNEGO/NTLMSSP bind (just how many layers can
119	we fit on one socket??)
120	*/
121	static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
122	{
123	DATA_BLOB msg1 = data_blob_null;
124	DATA_BLOB blob = data_blob_null;
125	DATA_BLOB blob_in = data_blob_null;
126	DATA_BLOB blob_out = data_blob_null;
127	struct berval cred, *scred = NULL;
128	int rc;
129	NTSTATUS nt_status;
130	ADS_STATUS status;
131	int turn = 1;
132	uint32 features = 0;
133
134	struct ntlmssp_state *ntlmssp_state;
135
136	if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
137	return ADS_ERROR_NT(nt_status);
138	}
139	ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SIGN;
140
141	if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, ads->auth.user_name))) {
142	return ADS_ERROR_NT(nt_status);
143	}
144	if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, ads->auth.realm))) {
145	return ADS_ERROR_NT(nt_status);
146	}
147	if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, ads->auth.password))) {
148	return ADS_ERROR_NT(nt_status);
149	}
150
151	switch (ads->ldap.wrap_type) {
152	case ADS_SASLWRAP_TYPE_SEAL:
153	features = NTLMSSP_FEATURE_SIGN \| NTLMSSP_FEATURE_SEAL;
154	break;
155	case ADS_SASLWRAP_TYPE_SIGN:
156	if (ads->auth.flags & ADS_AUTH_SASL_FORCE) {
157	features = NTLMSSP_FEATURE_SIGN;
158	} else {
159	/*
160	* windows servers are broken with sign only,
161	* so we need to use seal here too
162	*/
163	features = NTLMSSP_FEATURE_SIGN \| NTLMSSP_FEATURE_SEAL;
164	ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SEAL;
165	}
166	break;
167	case ADS_SASLWRAP_TYPE_PLAIN:
168	break;
169	}
170
171	ntlmssp_want_feature(ntlmssp_state, features);
172
173	blob_in = data_blob_null;
174
175	do {
176	nt_status = ntlmssp_update(ntlmssp_state,
177	blob_in, &blob_out);
178	data_blob_free(&blob_in);
179	if ((NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)
180	\|\| NT_STATUS_IS_OK(nt_status))
181	&& blob_out.length) {
182	if (turn == 1) {
183	/* and wrap it in a SPNEGO wrapper */
184	msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
185	} else {
186	/* wrap it in SPNEGO */
187	msg1 = spnego_gen_auth(blob_out);
188	}
189
190	data_blob_free(&blob_out);
191
192	cred.bv_val = (char *)msg1.data;
193	cred.bv_len = msg1.length;
194	scred = NULL;
195	rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL, &scred);
196	data_blob_free(&msg1);
197	if ((rc != LDAP_SASL_BIND_IN_PROGRESS) && (rc != 0)) {
198	if (scred) {
199	ber_bvfree(scred);
200	}
201
202	ntlmssp_end(&ntlmssp_state);
203	return ADS_ERROR(rc);
204	}
205	if (scred) {
206	blob = data_blob(scred->bv_val, scred->bv_len);
207	ber_bvfree(scred);
208	} else {
209	blob = data_blob_null;
210	}
211
212	} else {
213
214	ntlmssp_end(&ntlmssp_state);
215	data_blob_free(&blob_out);
216	return ADS_ERROR_NT(nt_status);
217	}
218
219	if ((turn == 1) &&
220	(rc == LDAP_SASL_BIND_IN_PROGRESS)) {
221	DATA_BLOB tmp_blob = data_blob_null;
222	/* the server might give us back two challenges */
223	if (!spnego_parse_challenge(blob, &blob_in,
224	&tmp_blob)) {
225
226	ntlmssp_end(&ntlmssp_state);
227	data_blob_free(&blob);
228	DEBUG(3,("Failed to parse challenges\n"));
229	return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
230	}
231	data_blob_free(&tmp_blob);
232	} else if (rc == LDAP_SASL_BIND_IN_PROGRESS) {
233	if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
234	&blob_in)) {
235
236	ntlmssp_end(&ntlmssp_state);
237	data_blob_free(&blob);
238	DEBUG(3,("Failed to parse auth response\n"));
239	return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
240	}
241	}
242	data_blob_free(&blob);
243	data_blob_free(&blob_out);
244	turn++;
245	} while (rc == LDAP_SASL_BIND_IN_PROGRESS && !NT_STATUS_IS_OK(nt_status));
246
247	/* we have a reference conter on ntlmssp_state, if we are signing
248	then the state will be kept by the signing engine */
249
250	if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
251	ads->ldap.out.max_unwrapped = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED - NTLMSSP_SIG_SIZE;
252	ads->ldap.out.sig_size = NTLMSSP_SIG_SIZE;
253	ads->ldap.in.min_wrapped = ads->ldap.out.sig_size;
254	ads->ldap.in.max_wrapped = ADS_SASL_WRAPPING_IN_MAX_WRAPPED;
255	status = ads_setup_sasl_wrapping(ads, &ads_sasl_ntlmssp_ops, ntlmssp_state);
256	if (!ADS_ERR_OK(status)) {
257	DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
258	ads_errstr(status)));
259	ntlmssp_end(&ntlmssp_state);
260	return status;
261	}
262	} else {
263	ntlmssp_end(&ntlmssp_state);
264	}
265
266	return ADS_ERROR(rc);
267	}
268
269	#ifdef HAVE_GSSAPI
270	static ADS_STATUS ads_sasl_gssapi_wrap(ADS_STRUCT ads, uint8 buf, uint32 len)
271	{
272	gss_ctx_id_t context_handle = (gss_ctx_id_t)ads->ldap.wrap_private_data;
273	ADS_STATUS status;
274	int gss_rc;
275	uint32 minor_status;
276	gss_buffer_desc unwrapped, wrapped;
277	int conf_req_flag, conf_state;
278
279	unwrapped.value = buf;
280	unwrapped.length = len;
281
282	/* for now request sign and seal */
283	conf_req_flag = (ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL);
284
285	gss_rc = gss_wrap(&minor_status, context_handle,
286	conf_req_flag, GSS_C_QOP_DEFAULT,
287	&unwrapped, &conf_state,
288	&wrapped);
289	status = ADS_ERROR_GSS(gss_rc, minor_status);
290	if (!ADS_ERR_OK(status)) return status;
291
292	if (conf_req_flag && conf_state == 0) {
293	return ADS_ERROR_NT(NT_STATUS_ACCESS_DENIED);
294	}
295
296	if ((ads->ldap.out.size - 4) < wrapped.length) {
297	return ADS_ERROR_NT(NT_STATUS_INTERNAL_ERROR);
298	}
299
300	/* copy the wrapped blob to the right location */
301	memcpy(ads->ldap.out.buf + 4, wrapped.value, wrapped.length);
302
303	/* set how many bytes must be written to the underlying socket */
304	ads->ldap.out.left = 4 + wrapped.length;
305
306	gss_release_buffer(&minor_status, &wrapped);
307
308	return ADS_SUCCESS;
309	}
310
311	static ADS_STATUS ads_sasl_gssapi_unwrap(ADS_STRUCT *ads)
312	{
313	gss_ctx_id_t context_handle = (gss_ctx_id_t)ads->ldap.wrap_private_data;
314	ADS_STATUS status;
315	int gss_rc;
316	uint32 minor_status;
317	gss_buffer_desc unwrapped, wrapped;
318	int conf_state;
319
320	wrapped.value = ads->ldap.in.buf + 4;
321	wrapped.length = ads->ldap.in.ofs - 4;
322
323	gss_rc = gss_unwrap(&minor_status, context_handle,
324	&wrapped, &unwrapped,
325	&conf_state, GSS_C_QOP_DEFAULT);
326	status = ADS_ERROR_GSS(gss_rc, minor_status);
327	if (!ADS_ERR_OK(status)) return status;
328
329	if (ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL && conf_state == 0) {
330	return ADS_ERROR_NT(NT_STATUS_ACCESS_DENIED);
331	}
332
333	if (wrapped.length < unwrapped.length) {
334	return ADS_ERROR_NT(NT_STATUS_INTERNAL_ERROR);
335	}
336
337	/* copy the wrapped blob to the right location */
338	memcpy(ads->ldap.in.buf + 4, unwrapped.value, unwrapped.length);
339
340	/* set how many bytes must be written to the underlying socket */
341	ads->ldap.in.left = unwrapped.length;
342	ads->ldap.in.ofs = 4;
343
344	gss_release_buffer(&minor_status, &unwrapped);
345
346	return ADS_SUCCESS;
347	}
348
349	static void ads_sasl_gssapi_disconnect(ADS_STRUCT *ads)
350	{
351	gss_ctx_id_t context_handle = (gss_ctx_id_t)ads->ldap.wrap_private_data;
352	uint32 minor_status;
353
354	gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);
355
356	ads->ldap.wrap_ops = NULL;
357	ads->ldap.wrap_private_data = NULL;
358	}
359
360	static const struct ads_saslwrap_ops ads_sasl_gssapi_ops = {
361	.name = "gssapi",
362	.wrap = ads_sasl_gssapi_wrap,
363	.unwrap = ads_sasl_gssapi_unwrap,
364	.disconnect = ads_sasl_gssapi_disconnect
365	};
366
367	/*
368	perform a LDAP/SASL/SPNEGO/GSSKRB5 bind
369	*/
370	static ADS_STATUS ads_sasl_spnego_gsskrb5_bind(ADS_STRUCT *ads, const gss_name_t serv_name)
371	{
372	ADS_STATUS status;
373	bool ok;
374	uint32 minor_status;
375	int gss_rc, rc;
376	gss_OID_desc krb5_mech_type =
377	{9, CONST_DISCARD(char *, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02") };
378	gss_OID mech_type = &krb5_mech_type;
379	gss_OID actual_mech_type = GSS_C_NULL_OID;
380	const char *spnego_mechs[] = {OID_KERBEROS5_OLD, OID_KERBEROS5, OID_NTLMSSP, NULL};
381	gss_ctx_id_t context_handle = GSS_C_NO_CONTEXT;
382	gss_buffer_desc input_token, output_token;
383	uint32 req_flags, ret_flags;
384	uint32 req_tmp, ret_tmp;
385	DATA_BLOB unwrapped;
386	DATA_BLOB wrapped;
387	struct berval cred, *scred = NULL;
388
389	input_token.value = NULL;
390	input_token.length = 0;
391
392	req_flags = GSS_C_MUTUAL_FLAG \| GSS_C_REPLAY_FLAG;
393	switch (ads->ldap.wrap_type) {
394	case ADS_SASLWRAP_TYPE_SEAL:
395	req_flags \|= GSS_C_INTEG_FLAG \| GSS_C_CONF_FLAG;
396	break;
397	case ADS_SASLWRAP_TYPE_SIGN:
398	req_flags \|= GSS_C_INTEG_FLAG;
399	break;
400	case ADS_SASLWRAP_TYPE_PLAIN:
401	break;
402	}
403
404	/* Note: here we explicit ask for the krb5 mech_type */
405	gss_rc = gss_init_sec_context(&minor_status,
406	GSS_C_NO_CREDENTIAL,
407	&context_handle,
408	serv_name,
409	mech_type,
410	req_flags,
411	0,
412	NULL,
413	&input_token,
414	&actual_mech_type,
415	&output_token,
416	&ret_flags,
417	NULL);
418	if (gss_rc && gss_rc != GSS_S_CONTINUE_NEEDED) {
419	status = ADS_ERROR_GSS(gss_rc, minor_status);
420	goto failed;
421	}
422
423	/*
424	* As some gssapi krb5 mech implementations
425	* automaticly add GSS_C_INTEG_FLAG and GSS_C_CONF_FLAG
426	* to req_flags internaly, it's not possible to
427	* use plain or signing only connection via
428	* the gssapi interface.
429	*
430	* Because of this we need to check it the ret_flags
431	* has more flags as req_flags and correct the value
432	* of ads->ldap.wrap_type.
433	*
434	* I ads->auth.flags has ADS_AUTH_SASL_FORCE
435	* we need to give an error.
436	*/
437	req_tmp = req_flags & (GSS_C_INTEG_FLAG \| GSS_C_CONF_FLAG);
438	ret_tmp = ret_flags & (GSS_C_INTEG_FLAG \| GSS_C_CONF_FLAG);
439
440	if (req_tmp == ret_tmp) {
441	/* everythings fine... */
442
443	} else if (req_flags & GSS_C_CONF_FLAG) {
444	/*
445	* here we wanted sealing but didn't got it
446	* from the gssapi library
447	*/
448	status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
449	goto failed;
450
451	} else if ((req_flags & GSS_C_INTEG_FLAG) &&
452	!(ret_flags & GSS_C_INTEG_FLAG)) {
453	/*
454	* here we wanted siging but didn't got it
455	* from the gssapi library
456	*/
457	status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
458	goto failed;
459
460	} else if (ret_flags & GSS_C_CONF_FLAG) {
461	/*
462	* here we didn't want sealing
463	* but the gssapi library forces it
464	* so correct the needed wrap_type if
465	* the caller didn't forced siging only
466	*/
467	if (ads->auth.flags & ADS_AUTH_SASL_FORCE) {
468	status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
469	goto failed;
470	}
471
472	ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SEAL;
473	req_flags = ret_flags;
474
475	} else if (ret_flags & GSS_C_INTEG_FLAG) {
476	/*
477	* here we didn't want signing
478	* but the gssapi library forces it
479	* so correct the needed wrap_type if
480	* the caller didn't forced plain
481	*/
482	if (ads->auth.flags & ADS_AUTH_SASL_FORCE) {
483	status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
484	goto failed;
485	}
486
487	ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SIGN;
488	req_flags = ret_flags;
489	} else {
490	/*
491	* This could (should?) not happen
492	*/
493	status = ADS_ERROR_NT(NT_STATUS_INTERNAL_ERROR);
494	goto failed;
495
496	}
497
498	/* and wrap that in a shiny SPNEGO wrapper */
499	unwrapped = data_blob_const(output_token.value, output_token.length);
500	wrapped = gen_negTokenTarg(spnego_mechs, unwrapped);
501	gss_release_buffer(&minor_status, &output_token);
502	if (unwrapped.length > wrapped.length) {
503	status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
504	goto failed;
505	}
506
507	cred.bv_val = (char *)wrapped.data;
508	cred.bv_len = wrapped.length;
509
510	rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL,
511	&scred);
512	data_blob_free(&wrapped);
513	if (rc != LDAP_SUCCESS) {
514	status = ADS_ERROR(rc);
515	goto failed;
516	}
517
518	if (scred) {
519	wrapped = data_blob_const(scred->bv_val, scred->bv_len);
520	} else {
521	wrapped = data_blob_null;
522	}
523
524	ok = spnego_parse_auth_response(wrapped, NT_STATUS_OK,
525	OID_KERBEROS5_OLD,
526	&unwrapped);
527	if (scred) ber_bvfree(scred);
528	if (!ok) {
529	status = ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
530	goto failed;
531	}
532
533	input_token.value = unwrapped.data;
534	input_token.length = unwrapped.length;
535
536	/*
537	* As we asked for mutal authentication
538	* we need to pass the servers response
539	* to gssapi
540	*/
541	gss_rc = gss_init_sec_context(&minor_status,
542	GSS_C_NO_CREDENTIAL,
543	&context_handle,
544	serv_name,
545	mech_type,
546	req_flags,
547	0,
548	NULL,
549	&input_token,
550	&actual_mech_type,
551	&output_token,
552	&ret_flags,
553	NULL);
554	data_blob_free(&unwrapped);
555	if (gss_rc) {
556	status = ADS_ERROR_GSS(gss_rc, minor_status);
557	goto failed;
558	}
559
560	gss_release_buffer(&minor_status, &output_token);
561
562	/*
563	* If we the sign and seal options
564	* doesn't match after getting the response
565	* from the server, we don't want to use the connection
566	*/
567	req_tmp = req_flags & (GSS_C_INTEG_FLAG \| GSS_C_CONF_FLAG);
568	ret_tmp = ret_flags & (GSS_C_INTEG_FLAG \| GSS_C_CONF_FLAG);
569
570	if (req_tmp != ret_tmp) {
571	/* everythings fine... */
572	status = ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
573	goto failed;
574	}
575
576	if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
577	uint32 max_msg_size = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED;
578
579	gss_rc = gss_wrap_size_limit(&minor_status, context_handle,
580	(ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL),
581	GSS_C_QOP_DEFAULT,
582	max_msg_size, &ads->ldap.out.max_unwrapped);
583	if (gss_rc) {
584	status = ADS_ERROR_GSS(gss_rc, minor_status);
585	goto failed;
586	}
587
588	ads->ldap.out.sig_size = max_msg_size - ads->ldap.out.max_unwrapped;
589	ads->ldap.in.min_wrapped = 0x2C; /* taken from a capture with LDAP unbind */
590	ads->ldap.in.max_wrapped = max_msg_size;
591	status = ads_setup_sasl_wrapping(ads, &ads_sasl_gssapi_ops, context_handle);
592	if (!ADS_ERR_OK(status)) {
593	DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
594	ads_errstr(status)));
595	goto failed;
596	}
597	/* make sure we don't free context_handle */
598	context_handle = GSS_C_NO_CONTEXT;
599	}
600
601	status = ADS_SUCCESS;
602
603	failed:
604	if (context_handle != GSS_C_NO_CONTEXT)
605	gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);
606	return status;
607	}
608
609	#endif /* HAVE_GSSAPI */
610
611	#ifdef HAVE_KRB5
612	struct ads_service_principal {
613	char *string;
614	#ifdef HAVE_GSSAPI
615	gss_name_t name;
616	#endif
617	};
618
619	static void ads_free_service_principal(struct ads_service_principal *p)
620	{
621	SAFE_FREE(p->string);
622
623	#ifdef HAVE_GSSAPI
624	if (p->name) {
625	uint32 minor_status;
626	gss_release_name(&minor_status, &p->name);
627	}
628	#endif
629	ZERO_STRUCTP(p);
630	}
631
632	static ADS_STATUS ads_generate_service_principal(ADS_STRUCT *ads,
633	const char *given_principal,
634	struct ads_service_principal *p)
635	{
636	ADS_STATUS status;
637	#ifdef HAVE_GSSAPI
638	gss_buffer_desc input_name;
639	/* GSS_KRB5_NT_PRINCIPAL_NAME */
640	gss_OID_desc nt_principal =
641	{10, CONST_DISCARD(char *, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x01")};
642	uint32 minor_status;
643	int gss_rc;
644	#endif
645
646	ZERO_STRUCTP(p);
647
648	/* I've seen a child Windows 2000 domain not send
649	the principal name back in the first round of
650	the SASL bind reply. So we guess based on server
651	name and realm. --jerry */
652	/* Also try best guess when we get the w2k8 ignore
653	principal back - gd */
654
655	if (!given_principal \|\|
656	strequal(given_principal, ADS_IGNORE_PRINCIPAL)) {
657
658	status = ads_guess_service_principal(ads, &p->string);
659	if (!ADS_ERR_OK(status)) {
660	return status;
661	}
662	} else {
663	p->string = SMB_STRDUP(given_principal);
664	if (!p->string) {
665	return ADS_ERROR(LDAP_NO_MEMORY);
666	}
667	}
668
669	#ifdef HAVE_GSSAPI
670	input_name.value = p->string;
671	input_name.length = strlen(p->string);
672
673	gss_rc = gss_import_name(&minor_status, &input_name, &nt_principal, &p->name);
674	if (gss_rc) {
675	ads_free_service_principal(p);
676	return ADS_ERROR_GSS(gss_rc, minor_status);
677	}
678	#endif
679
680	return ADS_SUCCESS;
681	}
682
683	/*
684	perform a LDAP/SASL/SPNEGO/KRB5 bind
685	*/
686	static ADS_STATUS ads_sasl_spnego_rawkrb5_bind(ADS_STRUCT ads, const char principal)
687	{
688	DATA_BLOB blob = data_blob_null;
689	struct berval cred, *scred = NULL;
690	DATA_BLOB session_key = data_blob_null;
691	int rc;
692
693	if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
694	return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
695	}
696
697	rc = spnego_gen_negTokenTarg(principal, ads->auth.time_offset, &blob, &session_key, 0,
698	&ads->auth.tgs_expire);
699
700	if (rc) {
701	return ADS_ERROR_KRB5(rc);
702	}
703
704	/* now send the auth packet and we should be done */
705	cred.bv_val = (char *)blob.data;
706	cred.bv_len = blob.length;
707
708	rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL, &scred);
709
710	data_blob_free(&blob);
711	data_blob_free(&session_key);
712	if(scred)
713	ber_bvfree(scred);
714
715	return ADS_ERROR(rc);
716	}
717
718	static ADS_STATUS ads_sasl_spnego_krb5_bind(ADS_STRUCT *ads,
719	struct ads_service_principal *p)
720	{
721	#ifdef HAVE_GSSAPI
722	/*
723	* we only use the gsskrb5 based implementation
724	* when sasl sign or seal is requested.
725	*
726	* This has the following reasons:
727	* - it's likely that the gssapi krb5 mech implementation
728	* doesn't support to negotiate plain connections
729	* - the ads_sasl_spnego_rawkrb5_bind is more robust
730	* against clock skew errors
731	*/
732	if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
733	return ads_sasl_spnego_gsskrb5_bind(ads, p->name);
734	}
735	#endif
736	return ads_sasl_spnego_rawkrb5_bind(ads, p->string);
737	}
738	#endif /* HAVE_KRB5 */
739
740	/*
741	this performs a SASL/SPNEGO bind
742	*/
743	static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
744	{
745	struct berval *scred=NULL;
746	int rc, i;
747	ADS_STATUS status;
748	DATA_BLOB blob;
749	char *given_principal = NULL;
750	char *OIDs[ASN1_MAX_OIDS];
751	#ifdef HAVE_KRB5
752	bool got_kerberos_mechanism = False;
753	#endif
754
755	rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", NULL, NULL, NULL, &scred);
756
757	if (rc != LDAP_SASL_BIND_IN_PROGRESS) {
758	status = ADS_ERROR(rc);
759	goto failed;
760	}
761
762	blob = data_blob(scred->bv_val, scred->bv_len);
763
764	ber_bvfree(scred);
765
766	#if 0
767	file_save("sasl_spnego.dat", blob.data, blob.length);
768	#endif
769
770	/* the server sent us the first part of the SPNEGO exchange in the negprot
771	reply */
772	if (!spnego_parse_negTokenInit(blob, OIDs, &given_principal) \|\|
773	OIDs[0] == NULL) {
774	data_blob_free(&blob);
775	status = ADS_ERROR(LDAP_OPERATIONS_ERROR);
776	goto failed;
777	}
778	data_blob_free(&blob);
779
780	/* make sure the server understands kerberos */
781	for (i=0;OIDs[i];i++) {
782	DEBUG(3,("ads_sasl_spnego_bind: got OID=%s\n", OIDs[i]));
783	#ifdef HAVE_KRB5
784	if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 \|\|
785	strcmp(OIDs[i], OID_KERBEROS5) == 0) {
786	got_kerberos_mechanism = True;
787	}
788	#endif
789	talloc_free(OIDs[i]);
790	}
791	DEBUG(3,("ads_sasl_spnego_bind: got server principal name = %s\n", given_principal));
792
793	#ifdef HAVE_KRB5
794	if (!(ads->auth.flags & ADS_AUTH_DISABLE_KERBEROS) &&
795	got_kerberos_mechanism)
796	{
797	struct ads_service_principal p;
798
799	status = ads_generate_service_principal(ads, given_principal, &p);
800	TALLOC_FREE(given_principal);
801	if (!ADS_ERR_OK(status)) {
802	return status;
803	}
804
805	status = ads_sasl_spnego_krb5_bind(ads, &p);
806	if (ADS_ERR_OK(status)) {
807	ads_free_service_principal(&p);
808	return status;
809	}
810
811	DEBUG(10,("ads_sasl_spnego_krb5_bind failed with: %s, "
812	"calling kinit\n", ads_errstr(status)));
813
814	status = ADS_ERROR_KRB5(ads_kinit_password(ads));
815
816	if (ADS_ERR_OK(status)) {
817	status = ads_sasl_spnego_krb5_bind(ads, &p);
818	if (!ADS_ERR_OK(status)) {
819	DEBUG(0,("kinit succeeded but "
820	"ads_sasl_spnego_krb5_bind failed: %s\n",
821	ads_errstr(status)));
822	}
823	}
824
825	ads_free_service_principal(&p);
826
827	/* only fallback to NTLMSSP if allowed */
828	if (ADS_ERR_OK(status) \|\|
829	!(ads->auth.flags & ADS_AUTH_ALLOW_NTLMSSP)) {
830	return status;
831	}
832	} else
833	#endif
834	{
835	TALLOC_FREE(given_principal);
836	}
837
838	/* lets do NTLMSSP ... this has the big advantage that we don't need
839	to sync clocks, and we don't rely on special versions of the krb5
840	library for HMAC_MD4 encryption */
841	return ads_sasl_spnego_ntlmssp_bind(ads);
842
843	failed:
844	return status;
845	}
846
847	#ifdef HAVE_GSSAPI
848	#define MAX_GSS_PASSES 3
849
850	/* this performs a SASL/gssapi bind
851	we avoid using cyrus-sasl to make Samba more robust. cyrus-sasl
852	is very dependent on correctly configured DNS whereas
853	this routine is much less fragile
854	see RFC2078 and RFC2222 for details
855	*/
856	static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv_name)
857	{
858	uint32 minor_status;
859	gss_ctx_id_t context_handle = GSS_C_NO_CONTEXT;
860	gss_OID mech_type = GSS_C_NULL_OID;
861	gss_buffer_desc output_token, input_token;
862	uint32 req_flags, ret_flags;
863	int conf_state;
864	struct berval cred;
865	struct berval *scred = NULL;
866	int i=0;
867	int gss_rc, rc;
868	uint8 *p;
869	uint32 max_msg_size = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED;
870	uint8 wrap_type = ADS_SASLWRAP_TYPE_PLAIN;
871	ADS_STATUS status;
872
873	input_token.value = NULL;
874	input_token.length = 0;
875
876	/*
877	* Note: here we always ask the gssapi for sign and seal
878	* as this is negotiated later after the mutal
879	* authentication
880	*/
881	req_flags = GSS_C_MUTUAL_FLAG \| GSS_C_REPLAY_FLAG \| GSS_C_INTEG_FLAG \| GSS_C_CONF_FLAG;
882
883	for (i=0; i < MAX_GSS_PASSES; i++) {
884	gss_rc = gss_init_sec_context(&minor_status,
885	GSS_C_NO_CREDENTIAL,
886	&context_handle,
887	serv_name,
888	mech_type,
889	req_flags,
890	0,
891	NULL,
892	&input_token,
893	NULL,
894	&output_token,
895	&ret_flags,
896	NULL);
897	if (scred) {
898	ber_bvfree(scred);
899	scred = NULL;
900	}
901	if (gss_rc && gss_rc != GSS_S_CONTINUE_NEEDED) {
902	status = ADS_ERROR_GSS(gss_rc, minor_status);
903	goto failed;
904	}
905
906	cred.bv_val = (char *)output_token.value;
907	cred.bv_len = output_token.length;
908
909	rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSSAPI", &cred, NULL, NULL,
910	&scred);
911	if (rc != LDAP_SASL_BIND_IN_PROGRESS) {
912	status = ADS_ERROR(rc);
913	goto failed;
914	}
915
916	if (output_token.value) {
917	gss_release_buffer(&minor_status, &output_token);
918	}
919
920	if (scred) {
921	input_token.value = scred->bv_val;
922	input_token.length = scred->bv_len;
923	} else {
924	input_token.value = NULL;
925	input_token.length = 0;
926	}
927
928	if (gss_rc == 0) break;
929	}
930
931	gss_rc = gss_unwrap(&minor_status,context_handle,&input_token,&output_token,
932	&conf_state,NULL);
933	if (scred) {
934	ber_bvfree(scred);
935	scred = NULL;
936	}
937	if (gss_rc) {
938	status = ADS_ERROR_GSS(gss_rc, minor_status);
939	goto failed;
940	}
941
942	p = (uint8 *)output_token.value;
943
944	#if 0
945	file_save("sasl_gssapi.dat", output_token.value, output_token.length);
946	#endif
947
948	if (p) {
949	wrap_type = CVAL(p,0);
950	SCVAL(p,0,0);
951	max_msg_size = RIVAL(p,0);
952	}
953
954	gss_release_buffer(&minor_status, &output_token);
955
956	if (!(wrap_type & ads->ldap.wrap_type)) {
957	/*
958	* the server doesn't supports the wrap
959	* type we want :-(
960	*/
961	DEBUG(0,("The ldap sasl wrap type doesn't match wanted[%d] server[%d]\n",
962	ads->ldap.wrap_type, wrap_type));
963	DEBUGADD(0,("You may want to set the 'client ldap sasl wrapping' option\n"));
964	status = ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
965	goto failed;
966	}
967
968	/* 0x58 is the minimum windows accepts */
969	if (max_msg_size < 0x58) {
970	max_msg_size = 0x58;
971	}
972
973	output_token.length = 4;
974	output_token.value = SMB_MALLOC(output_token.length);
975	p = (uint8 *)output_token.value;
976
977	RSIVAL(p,0,max_msg_size);
978	SCVAL(p,0,ads->ldap.wrap_type);
979
980	/*
981	* we used to add sprintf("dn:%s", ads->config.bind_path) here.
982	* but using ads->config.bind_path is the wrong! It should be
983	* the DN of the user object!
984	*
985	* w2k3 gives an error when we send an incorrect DN, but sending nothing
986	* is ok and matches the information flow used in GSS-SPNEGO.
987	*/
988
989	gss_rc = gss_wrap(&minor_status, context_handle,0,GSS_C_QOP_DEFAULT,
990	&output_token, &conf_state,
991	&input_token);
992	if (gss_rc) {
993	status = ADS_ERROR_GSS(gss_rc, minor_status);
994	goto failed;
995	}
996
997	free(output_token.value);
998
999	cred.bv_val = (char *)input_token.value;
1000	cred.bv_len = input_token.length;
1001
1002	rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSSAPI", &cred, NULL, NULL,
1003	&scred);
1004	gss_release_buffer(&minor_status, &input_token);
1005	status = ADS_ERROR(rc);
1006	if (!ADS_ERR_OK(status)) {
1007	goto failed;
1008	}
1009
1010	if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
1011	gss_rc = gss_wrap_size_limit(&minor_status, context_handle,
1012	(ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_SEAL),
1013	GSS_C_QOP_DEFAULT,
1014	max_msg_size, &ads->ldap.out.max_unwrapped);
1015	if (gss_rc) {
1016	status = ADS_ERROR_GSS(gss_rc, minor_status);
1017	goto failed;
1018	}
1019
1020	ads->ldap.out.sig_size = max_msg_size - ads->ldap.out.max_unwrapped;
1021	ads->ldap.in.min_wrapped = 0x2C; /* taken from a capture with LDAP unbind */
1022	ads->ldap.in.max_wrapped = max_msg_size;
1023	status = ads_setup_sasl_wrapping(ads, &ads_sasl_gssapi_ops, context_handle);
1024	if (!ADS_ERR_OK(status)) {
1025	DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
1026	ads_errstr(status)));
1027	goto failed;
1028	}
1029	/* make sure we don't free context_handle */
1030	context_handle = GSS_C_NO_CONTEXT;
1031	}
1032
1033	failed:
1034
1035	if (context_handle != GSS_C_NO_CONTEXT)
1036	gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);
1037
1038	if(scred)
1039	ber_bvfree(scred);
1040	return status;
1041	}
1042
1043	static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads)
1044	{
1045	ADS_STATUS status;
1046	struct ads_service_principal p;
1047
1048	status = ads_generate_service_principal(ads, NULL, &p);
1049	if (!ADS_ERR_OK(status)) {
1050	return status;
1051	}
1052
1053	status = ads_sasl_gssapi_do_bind(ads, p.name);
1054	if (ADS_ERR_OK(status)) {
1055	ads_free_service_principal(&p);
1056	return status;
1057	}
1058
1059	DEBUG(10,("ads_sasl_gssapi_do_bind failed with: %s, "
1060	"calling kinit\n", ads_errstr(status)));
1061
1062	status = ADS_ERROR_KRB5(ads_kinit_password(ads));
1063
1064	if (ADS_ERR_OK(status)) {
1065	status = ads_sasl_gssapi_do_bind(ads, p.name);
1066	}
1067
1068	ads_free_service_principal(&p);
1069
1070	return status;
1071	}
1072
1073	#endif /* HAVE_GSSAPI */
1074
1075	/* mapping between SASL mechanisms and functions */
1076	static struct {
1077	const char *name;
1078	ADS_STATUS (fn)(ADS_STRUCT );
1079	} sasl_mechanisms[] = {
1080	{"GSS-SPNEGO", ads_sasl_spnego_bind},
1081	#ifdef HAVE_GSSAPI
1082	{"GSSAPI", ads_sasl_gssapi_bind}, /* doesn't work with .NET RC1. No idea why */
1083	#endif
1084	{NULL, NULL}
1085	};
1086
1087	ADS_STATUS ads_sasl_bind(ADS_STRUCT *ads)
1088	{
1089	const char *attrs[] = {"supportedSASLMechanisms", NULL};
1090	char **values;
1091	ADS_STATUS status;
1092	int i, j;
1093	LDAPMessage *res;
1094
1095	/* get a list of supported SASL mechanisms */
1096	status = ads_do_search(ads, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res);
1097	if (!ADS_ERR_OK(status)) return status;
1098
1099	values = ldap_get_values(ads->ldap.ld, res, "supportedSASLMechanisms");
1100
1101	if (ads->auth.flags & ADS_AUTH_SASL_SEAL) {
1102	ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SEAL;
1103	} else if (ads->auth.flags & ADS_AUTH_SASL_SIGN) {
1104	ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SIGN;
1105	} else {
1106	ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_PLAIN;
1107	}
1108
1109	/* try our supported mechanisms in order */
1110	for (i=0;sasl_mechanisms[i].name;i++) {
1111	/* see if the server supports it */
1112	for (j=0;values && values[j];j++) {
1113	if (strcmp(values[j], sasl_mechanisms[i].name) == 0) {
1114	DEBUG(4,("Found SASL mechanism %s\n", values[j]));
1115	status = sasl_mechanisms[i].fn(ads);
1116	ldap_value_free(values);
1117	ldap_msgfree(res);
1118	return status;
1119	}
1120	}
1121	}
1122
1123	ldap_value_free(values);
1124	ldap_msgfree(res);
1125	return ADS_ERROR(LDAP_AUTH_METHOD_NOT_SUPPORTED);
1126	}
1127
1128	#endif /* HAVE_LDAP */
1129

Note: See TracBrowser for help on using the repository browser.

Download in other formats: