static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
struct gse_context {
+ gss_ctx_id_t gssapi_context;
+ gss_name_t server_name;
+ gss_name_t client_name;
+ OM_uint32 gss_want_flags, gss_got_flags;
+
+ gss_cred_id_t delegated_cred_handle;
+
+ gss_krb5_lucid_context_v1_t *lucid;
+
+ /* gensec_gse only */
krb5_context k5ctx;
krb5_ccache ccache;
krb5_keytab keytab;
- gss_ctx_id_t gssapi_context;
-
gss_OID_desc gss_mech;
- OM_uint32 gss_c_flags;
gss_cred_id_t creds;
- gss_name_t server_name;
gss_OID ret_mech;
- OM_uint32 ret_flags;
- gss_cred_id_t delegated_cred_handle;
- gss_name_t client_name;
-
- bool more_processing;
- bool authenticated;
};
#ifndef HAVE_GSS_OID_EQUAL
memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
- gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG |
+ gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
GSS_C_DELEG_FLAG |
GSS_C_DELEG_POLICY_FLAG |
GSS_C_REPLAY_FLAG |
GSS_C_SEQUENCE_FLAG;
if (do_sign) {
- gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG;
+ gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
}
if (do_seal) {
- gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG;
+ gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
+ gse_ctx->gss_want_flags |= GSS_C_CONF_FLAG;
}
- gse_ctx->gss_c_flags |= add_gss_c_flags;
+ gse_ctx->gss_want_flags |= add_gss_c_flags;
/* Initialize Kerberos Context */
initialize_krb5_error_table();
&gse_ctx->gssapi_context,
gse_ctx->server_name,
&gse_ctx->gss_mech,
- gse_ctx->gss_c_flags,
+ gse_ctx->gss_want_flags,
0, GSS_C_NO_CHANNEL_BINDINGS,
&in_data, NULL, &out_data,
- &gse_ctx->ret_flags, NULL);
+ &gse_ctx->gss_got_flags, NULL);
switch (gss_maj) {
case GSS_S_COMPLETE:
/* we are done with it */
- gse_ctx->more_processing = false;
status = NT_STATUS_OK;
break;
case GSS_S_CONTINUE_NEEDED:
/* we will need a third leg */
- gse_ctx->more_processing = true;
- /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
- status = NT_STATUS_OK;
+ status = NT_STATUS_MORE_PROCESSING_REQUIRED;
break;
default:
DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
goto done;
}
- blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
- if (!blob.data) {
- status = NT_STATUS_NO_MEMORY;
- }
+ /* we may be told to return nothing */
+ if (out_data.length) {
+ blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
+ if (!blob.data) {
+ status = NT_STATUS_NO_MEMORY;
+ }
- gss_maj = gss_release_buffer(&gss_min, &out_data);
+ gss_maj = gss_release_buffer(&gss_min, &out_data);
+ }
done:
*token_out = blob;
&gse_ctx->client_name,
&gse_ctx->ret_mech,
&out_data,
- &gse_ctx->ret_flags, NULL,
+ &gse_ctx->gss_got_flags, NULL,
&gse_ctx->delegated_cred_handle);
switch (gss_maj) {
case GSS_S_COMPLETE:
/* we are done with it */
- gse_ctx->more_processing = false;
- gse_ctx->authenticated = true;
status = NT_STATUS_OK;
break;
case GSS_S_CONTINUE_NEEDED:
/* we will need a third leg */
- gse_ctx->more_processing = true;
- /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
- status = NT_STATUS_OK;
+ status = NT_STATUS_MORE_PROCESSING_REQUIRED;
break;
default:
DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
static NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
{
- if (!gse_ctx->authenticated) {
- return NT_STATUS_INVALID_HANDLE;
- }
-
if (memcmp(gse_ctx->ret_mech,
gss_mech_krb5, sizeof(gss_OID_desc)) != 0) {
return NT_STATUS_ACCESS_DENIED;
}
/* GSS_C_MUTUAL_FLAG */
- if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) {
- if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) {
- return NT_STATUS_ACCESS_DENIED;
- }
- }
-
/* GSS_C_DELEG_FLAG */
/* GSS_C_DELEG_POLICY_FLAG */
/* GSS_C_REPLAY_FLAG */
/* GSS_C_SEQUENCE_FLAG */
/* GSS_C_INTEG_FLAG */
- if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) {
- if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) {
+ if (gse_ctx->gss_want_flags & GSS_C_INTEG_FLAG) {
+ if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
return NT_STATUS_ACCESS_DENIED;
}
}
/* GSS_C_CONF_FLAG */
- if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) {
- if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) {
+ if (gse_ctx->gss_want_flags & GSS_C_CONF_FLAG) {
+ if (!(gse_ctx->gss_got_flags & GSS_C_CONF_FLAG)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ /* GSS_C_CONF_FLAG implies GSS_C_INTEG_FLAG */
+ if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ }
+
+ /* GSS_C_DCE_STYLE */
+ if (gse_ctx->gss_want_flags & GSS_C_DCE_STYLE) {
+ if (!(gse_ctx->gss_got_flags & GSS_C_DCE_STYLE)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ /* GSS_C_DCE_STYLE implies GSS_C_MUTUAL_FLAG */
+ if (!(gse_ctx->gss_got_flags & GSS_C_MUTUAL_FLAG)) {
return NT_STATUS_ACCESS_DENIED;
}
}
return errstr;
}
+static NTSTATUS gse_init_lucid(struct gse_context *gse_ctx)
+{
+ OM_uint32 maj_stat, min_stat;
+ void *ptr = NULL;
+
+ if (gse_ctx->lucid) {
+ return NT_STATUS_OK;
+ }
+
+ maj_stat = gss_krb5_export_lucid_sec_context(&min_stat,
+ &gse_ctx->gssapi_context,
+ 1, &ptr);
+ if (maj_stat != GSS_S_COMPLETE) {
+ DEBUG(0,("gse_init_lucid: %s\n",
+ gse_errstr(talloc_tos(), maj_stat, min_stat)));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+ gse_ctx->lucid = (gss_krb5_lucid_context_v1_t *)ptr;
+
+ if (gse_ctx->lucid->version != 1) {
+ DEBUG(0,("gse_init_lucid: lucid version[%d] != 1\n",
+ gse_ctx->lucid->version));
+ gss_krb5_free_lucid_sec_context(&min_stat, gse_ctx->lucid);
+ gse_ctx->lucid = NULL;
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ return NT_STATUS_OK;
+}
+
static DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
struct gse_context *gse_ctx)
{
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- if (gse_ctx->more_processing) {
- return NT_STATUS_MORE_PROCESSING_REQUIRED;
- }
if (gensec_security->gensec_role == GENSEC_SERVER) {
return gse_verify_server_auth_flags(gse_ctx);
struct gse_context);
if (feature & GENSEC_FEATURE_SIGN) {
- return gse_ctx->ret_flags & GSS_C_INTEG_FLAG;
+ return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
}
if (feature & GENSEC_FEATURE_SEAL) {
- return gse_ctx->ret_flags & GSS_C_CONF_FLAG;
+ return gse_ctx->gss_got_flags & GSS_C_CONF_FLAG;
}
if (feature & GENSEC_FEATURE_SESSION_KEY) {
/* Only for GSE/Krb5 */
}
}
if (feature & GENSEC_FEATURE_DCE_STYLE) {
- return gse_ctx->ret_flags & GSS_C_DCE_STYLE;
+ return gse_ctx->gss_got_flags & GSS_C_DCE_STYLE;
+ }
+ if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
+ NTSTATUS status;
+
+ if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
+ return false;
+ }
+
+ status = gse_init_lucid(gse_ctx);
+ if (!NT_STATUS_IS_OK(status)) {
+ return false;
+ }
+
+ if (gse_ctx->lucid->protocol == 1) {
+ return true;
+ }
+
+ return false;
}
/* We can always do async (rather than strict request/reply) packets. */
if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
git.samba.org / metze / samba / wip.git / blobdiff