s3-libads Default to NOT using the server-supplied principal from SPNEGO

[metze/samba/wip.git] / source3 / libads / sasl.c

diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
index 04b9a71d76e2498be12fd4636631fed448469ce5..2ba347486a6f6366d6e2cad50c9d7c2068486471 100644 (file)
--- a/source3/libads/sasl.c
+++ b/source3/libads/sasl.c
@@ -20,6 +20,8 @@
 #include "includes.h"
 #include "../libcli/auth/spnego.h"
 #include "../libcli/auth/ntlmssp.h"
+#include "ads.h"
+#include "smb_krb5.h"
 
 #ifdef HAVE_LDAP
 
@@ -106,7 +108,7 @@ static void ads_sasl_ntlmssp_disconnect(ADS_STRUCT *ads)
        struct ntlmssp_state *ntlmssp_state =
                (struct ntlmssp_state *)ads->ldap.wrap_private_data;
 
-       ntlmssp_end(&ntlmssp_state);
+       TALLOC_FREE(ntlmssp_state);
 
        ads->ldap.wrap_ops = NULL;
        ads->ldap.wrap_private_data = NULL;
@@ -190,11 +192,13 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
                     || NT_STATUS_IS_OK(nt_status))
                    && blob_out.length) {
                        if (turn == 1) {
+                               const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
                                /* and wrap it in a SPNEGO wrapper */
-                               msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
+                               msg1 = spnego_gen_negTokenInit(talloc_tos(),
+                                               OIDs_ntlm, &blob_out, NULL);
                        } else {
                                /* wrap it in SPNEGO */
-                               msg1 = spnego_gen_auth(blob_out);
+                               msg1 = spnego_gen_auth(talloc_tos(), blob_out);
                        }
 
                        data_blob_free(&blob_out);
@@ -209,7 +213,7 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
                                        ber_bvfree(scred);
                                }
 
-                               ntlmssp_end(&ntlmssp_state);
+                               TALLOC_FREE(ntlmssp_state);
                                return ADS_ERROR(rc);
                        }
                        if (scred) {
@@ -221,7 +225,7 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
 
                } else {
 
-                       ntlmssp_end(&ntlmssp_state);
+                       TALLOC_FREE(ntlmssp_state);
                        data_blob_free(&blob_out);
                        return ADS_ERROR_NT(nt_status);
                }
@@ -230,20 +234,20 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
                    (rc == LDAP_SASL_BIND_IN_PROGRESS)) {
                        DATA_BLOB tmp_blob = data_blob_null;
                        /* the server might give us back two challenges */
-                       if (!spnego_parse_challenge(blob, &blob_in, 
+                       if (!spnego_parse_challenge(talloc_tos(), blob, &blob_in, 
                                                    &tmp_blob)) {
 
-                               ntlmssp_end(&ntlmssp_state);
+                               TALLOC_FREE(ntlmssp_state);
                                data_blob_free(&blob);
                                DEBUG(3,("Failed to parse challenges\n"));
                                return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
                        }
                        data_blob_free(&tmp_blob);
                } else if (rc == LDAP_SASL_BIND_IN_PROGRESS) {
-                       if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP, 
+                       if (!spnego_parse_auth_response(talloc_tos(), blob, nt_status, OID_NTLMSSP, 
                                                        &blob_in)) {
 
-                               ntlmssp_end(&ntlmssp_state);
+                               TALLOC_FREE(ntlmssp_state);
                                data_blob_free(&blob);
                                DEBUG(3,("Failed to parse auth response\n"));
                                return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
@@ -266,11 +270,11 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
                if (!ADS_ERR_OK(status)) {
                        DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n",
                                ads_errstr(status)));
-                       ntlmssp_end(&ntlmssp_state);
+                       TALLOC_FREE(ntlmssp_state);
                        return status;
                }
        } else {
-               ntlmssp_end(&ntlmssp_state);
+               TALLOC_FREE(ntlmssp_state);
        }
 
        return ADS_ERROR(rc);
@@ -507,7 +511,8 @@ static ADS_STATUS ads_sasl_spnego_gsskrb5_bind(ADS_STRUCT *ads, const gss_name_t
 
        /* and wrap that in a shiny SPNEGO wrapper */
        unwrapped = data_blob_const(output_token.value, output_token.length);
-       wrapped = gen_negTokenTarg(spnego_mechs, unwrapped);
+       wrapped = spnego_gen_negTokenInit(talloc_tos(),
+                       spnego_mechs, &unwrapped, NULL);
        gss_release_buffer(&minor_status, &output_token);
        if (unwrapped.length > wrapped.length) {
                status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
@@ -531,7 +536,7 @@ static ADS_STATUS ads_sasl_spnego_gsskrb5_bind(ADS_STRUCT *ads, const gss_name_t
                wrapped = data_blob_null;
        }
 
-       ok = spnego_parse_auth_response(wrapped, NT_STATUS_OK,
+       ok = spnego_parse_auth_response(talloc_tos(), wrapped, NT_STATUS_OK,
                                        OID_KERBEROS5_OLD,
                                        &unwrapped);
        if (scred) ber_bvfree(scred);
@@ -659,10 +664,12 @@ static ADS_STATUS ads_generate_service_principal(ADS_STRUCT *ads,
           the principal name back in the first round of
           the SASL bind reply.  So we guess based on server
           name and realm.  --jerry  */
-       /* Also try best guess when we get the w2k8 ignore
-          principal back - gd */
+       /* Also try best guess when we get the w2k8 ignore principal
+          back, or when we are configured to ignore it - gd,
+          abartlet */
 
-       if (!given_principal ||
+       if (!lp_client_use_spnego_principal() ||
+           !given_principal ||
            strequal(given_principal, ADS_IGNORE_PRINCIPAL)) {
 
                status = ads_guess_service_principal(ads, &p->string);
@@ -704,7 +711,8 @@ static ADS_STATUS ads_sasl_spnego_rawkrb5_bind(ADS_STRUCT *ads, const char *prin
                return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
        }
 
-       rc = spnego_gen_negTokenTarg(principal, ads->auth.time_offset, &blob, &session_key, 0,
+       rc = spnego_gen_krb5_negTokenInit(talloc_tos(), principal,
+                                    ads->auth.time_offset, &blob, &session_key, 0,
                                     &ads->auth.tgs_expire);
 
        if (rc) {
@@ -779,7 +787,8 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
 
        /* the server sent us the first part of the SPNEGO exchange in the negprot 
           reply */
-       if (!spnego_parse_negTokenInit(blob, OIDs, &given_principal)) {
+       if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &given_principal, NULL) ||
+                       OIDs[0] == NULL) {
                data_blob_free(&blob);
                status = ADS_ERROR(LDAP_OPERATIONS_ERROR);
                goto failed;
@@ -981,6 +990,11 @@ static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv
 
        output_token.length = 4;
        output_token.value = SMB_MALLOC(output_token.length);
+       if (!output_token.value) {
+               output_token.length = 0;
+               status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+               goto failed;
+       }
        p = (uint8 *)output_token.value;
 
        RSIVAL(p,0,max_msg_size);
@@ -996,14 +1010,19 @@ static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv
         */
 
        gss_rc = gss_wrap(&minor_status, context_handle,0,GSS_C_QOP_DEFAULT,
-                         &output_token, &conf_state,
-                         &input_token);
+                       &output_token, /* used as *input* here. */
+                       &conf_state,
+                       &input_token); /* Used as *output* here. */
        if (gss_rc) {
                status = ADS_ERROR_GSS(gss_rc, minor_status);
+               output_token.length = 0;
+               SAFE_FREE(output_token.value);
                goto failed;
        }
 
-       free(output_token.value);
+       /* We've finished with output_token. */
+       SAFE_FREE(output_token.value);
+       output_token.length = 0;
 
        cred.bv_val = (char *)input_token.value;
        cred.bv_len = input_token.length;