summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
Diffstat (limited to 'source3')
-rw-r--r--source3/librpc/crypto/gse.c136
1 files changed, 69 insertions, 67 deletions
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
index ec37073014..9f06dc3d8c 100644
--- a/source3/librpc/crypto/gse.c
+++ b/source3/librpc/crypto/gse.c
@@ -28,6 +28,7 @@
#include "auth/gensec/gensec.h"
#include "auth/credentials/credentials.h"
#include "../librpc/gen_ndr/dcerpc.h"
+#include "lib/util/asn1.h"
#if defined(HAVE_KRB5) && defined(HAVE_GSS_WRAP_IOV)
@@ -77,8 +78,6 @@ struct gse_context {
gss_cred_id_t delegated_cred_handle;
- gss_krb5_lucid_context_v1_t *lucid;
-
/* gensec_gse only */
krb5_context k5ctx;
krb5_ccache ccache;
@@ -149,11 +148,6 @@ static int gse_context_destructor(void *ptr)
&gse_ctx->delegated_cred_handle);
}
- if (gse_ctx->lucid) {
- gss_krb5_free_lucid_sec_context(&gss_min, gse_ctx->lucid);
- gse_ctx->lucid = NULL;
- }
-
/* MIT and Heimdal differ as to if you can call
* gss_release_oid() on this OID, generated by
* gss_{accept,init}_sec_context(). However, as long as the
@@ -628,42 +622,13 @@ done:
return errstr;
}
-static NTSTATUS gse_init_lucid(struct gse_context *gse_ctx)
-{
- OM_uint32 maj_stat, min_stat;
- void *ptr = NULL;
-
- if (gse_ctx->lucid) {
- return NT_STATUS_OK;
- }
-
- maj_stat = gss_krb5_export_lucid_sec_context(&min_stat,
- &gse_ctx->gssapi_context,
- 1, &ptr);
- if (maj_stat != GSS_S_COMPLETE) {
- DEBUG(0,("gse_init_lucid: %s\n",
- gse_errstr(talloc_tos(), maj_stat, min_stat)));
- return NT_STATUS_INTERNAL_ERROR;
- }
- gse_ctx->lucid = (gss_krb5_lucid_context_v1_t *)ptr;
-
- if (gse_ctx->lucid->version != 1) {
- DEBUG(0,("gse_init_lucid: lucid version[%d] != 1\n",
- gse_ctx->lucid->version));
- gss_krb5_free_lucid_sec_context(&min_stat, gse_ctx->lucid);
- gse_ctx->lucid = NULL;
- return NT_STATUS_INTERNAL_ERROR;
- }
-
- return NT_STATUS_OK;
-}
-
-static DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
- struct gse_context *gse_ctx)
+static NTSTATUS gse_get_session_key(TALLOC_CTX *mem_ctx,
+ struct gse_context *gse_ctx,
+ DATA_BLOB *session_key,
+ uint32_t *keytype)
{
OM_uint32 gss_min, gss_maj;
gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
- DATA_BLOB ret;
gss_maj = gss_inquire_sec_context_by_oid(
&gss_min, gse_ctx->gssapi_context,
@@ -671,7 +636,7 @@ static DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
if (gss_maj) {
DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
gse_errstr(talloc_tos(), gss_maj, gss_min)));
- return data_blob_null;
+ return NT_STATUS_NO_USER_SESSION_KEY;
}
if ((set == GSS_C_NO_BUFFER_SET) ||
@@ -686,26 +651,58 @@ static DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
&subkey);
if (gss_maj != 0) {
DEBUG(1, ("NO session key for this mech\n"));
- return data_blob_null;
+ return NT_STATUS_NO_USER_SESSION_KEY;
+ }
+ if (session_key) {
+ *session_key = data_blob_talloc(mem_ctx,
+ KRB5_KEY_DATA(subkey), KRB5_KEY_LENGTH(subkey));
+ }
+ if (keytype) {
+ *keytype = KRB5_KEY_TYPE(subkey);
}
- ret = data_blob_talloc(mem_ctx,
- KRB5_KEY_DATA(subkey), KRB5_KEY_LENGTH(subkey));
krb5_free_keyblock(NULL /* should be krb5_context */, subkey);
- return ret;
+ return NT_STATUS_OK;
#else
DEBUG(0, ("gss_inquire_sec_context_by_oid returned unknown "
"OID for data in results:\n"));
dump_data(1, (uint8_t *)set->elements[1].value,
set->elements[1].length);
- return data_blob_null;
+ return NT_STATUS_NO_USER_SESSION_KEY;
#endif
}
- ret = data_blob_talloc(mem_ctx, set->elements[0].value,
- set->elements[0].length);
+ if (session_key) {
+ *session_key = data_blob_talloc(mem_ctx, set->elements[0].value,
+ set->elements[0].length);
+ }
+ if (keytype) {
+ char *oid;
+ char *p, *q = NULL;
+ if (!ber_read_OID_String(talloc_tos(),
+ data_blob_const(set->elements[0].value,
+ set->elements[0].length), &oid)) {
+ TALLOC_FREE(oid);
+ gss_maj = gss_release_buffer_set(&gss_min, &set);
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ p = strrchr(oid, '.');
+ if (!p) {
+ TALLOC_FREE(oid);
+ gss_maj = gss_release_buffer_set(&gss_min, &set);
+ return NT_STATUS_INVALID_PARAMETER;
+ } else {
+ p++;
+ *keytype = strtoul(p, &q, 10);
+ if (q == NULL || *q != '\0') {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ }
+ TALLOC_FREE(oid);
+ }
+
gss_maj = gss_release_buffer_set(&gss_min, &set);
- return ret;
+ return NT_STATUS_OK;
}
static size_t gse_get_signature_length(struct gse_context *gse_ctx,
@@ -1178,21 +1175,33 @@ static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
}
if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
NTSTATUS status;
+ uint32_t keytype;
if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
return false;
}
- status = gse_init_lucid(gse_ctx);
- if (!NT_STATUS_IS_OK(status)) {
- return false;
- }
-
- if (gse_ctx->lucid->protocol == 1) {
- return true;
+ status = gse_get_session_key(talloc_tos(),
+ gse_ctx, NULL, &keytype);
+ /*
+ * We should do a proper sig on the mechListMic unless
+ * we know we have to be backwards compatible with
+ * earlier windows versions.
+ *
+ * Negotiating a non-krb5
+ * mech for example should be regarded as having
+ * NEW_SPNEGO
+ */
+ if (NT_STATUS_IS_OK(status)) {
+ switch (keytype) {
+ case ENCTYPE_DES_CBC_CRC:
+ case ENCTYPE_DES_CBC_MD5:
+ case ENCTYPE_ARCFOUR_HMAC:
+ case ENCTYPE_DES3_CBC_SHA1:
+ return false;
+ }
}
-
- return false;
+ return true;
}
/* We can always do async (rather than strict request/reply) packets. */
if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
@@ -1209,20 +1218,13 @@ static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
*/
static NTSTATUS gensec_gse_session_key(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
- DATA_BLOB *session_key_out)
+ DATA_BLOB *session_key)
{
struct gse_context *gse_ctx =
talloc_get_type_abort(gensec_security->private_data,
struct gse_context);
- DATA_BLOB session_key = gse_get_session_key(mem_ctx, gse_ctx);
- if (session_key.data == NULL) {
- return NT_STATUS_NO_USER_SESSION_KEY;
- }
-
- *session_key_out = session_key;
-
- return NT_STATUS_OK;
+ return gse_get_session_key(mem_ctx, gse_ctx, session_key, NULL);
}
/* Get some basic (and authorization) information about the user on