1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2005 Doug Rabson
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * $FreeBSD$
29 */
30
31 #include <gssapi/gssapi.h>
32 #include <stdlib.h>
33 #include <string.h>
34 #include <errno.h>
35
36 #include "mech_switch.h"
37 #include "context.h"
38 #include "cred.h"
39 #include "name.h"
40 #include "utils.h"
41
42 static OM_uint32
parse_header(const gss_buffer_t input_token,gss_OID mech_oid)43 parse_header(const gss_buffer_t input_token, gss_OID mech_oid)
44 {
45 unsigned char *p = input_token->value;
46 size_t len = input_token->length;
47 size_t a, b;
48
49 /*
50 * Token must start with [APPLICATION 0] SEQUENCE.
51 * But if it doesn't assume it is DCE-STYLE Kerberos!
52 */
53 if (len == 0)
54 return (GSS_S_DEFECTIVE_TOKEN);
55
56 p++;
57 len--;
58
59 /*
60 * Decode the length and make sure it agrees with the
61 * token length.
62 */
63 if (len == 0)
64 return (GSS_S_DEFECTIVE_TOKEN);
65 if ((*p & 0x80) == 0) {
66 a = *p;
67 p++;
68 len--;
69 } else {
70 b = *p & 0x7f;
71 p++;
72 len--;
73 if (len < b)
74 return (GSS_S_DEFECTIVE_TOKEN);
75 a = 0;
76 while (b) {
77 a = (a << 8) | *p;
78 p++;
79 len--;
80 b--;
81 }
82 }
83 if (a != len)
84 return (GSS_S_DEFECTIVE_TOKEN);
85
86 /*
87 * Decode the OID for the mechanism. Simplify life by
88 * assuming that the OID length is less than 128 bytes.
89 */
90 if (len < 2 || *p != 0x06)
91 return (GSS_S_DEFECTIVE_TOKEN);
92 if ((p[1] & 0x80) || p[1] > (len - 2))
93 return (GSS_S_DEFECTIVE_TOKEN);
94 mech_oid->length = p[1];
95 p += 2;
96 len -= 2;
97 mech_oid->elements = p;
98
99 return (GSS_S_COMPLETE);
100 }
101
102 static gss_OID_desc krb5_mechanism =
103 {9, __DECONST(void *, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02")};
104 static gss_OID_desc ntlm_mechanism =
105 {10, __DECONST(void *, "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a")};
106 static gss_OID_desc spnego_mechanism =
107 {6, __DECONST(void *, "\x2b\x06\x01\x05\x05\x02")};
108
109 static OM_uint32
choose_mech(const gss_buffer_t input,gss_OID mech_oid)110 choose_mech(const gss_buffer_t input, gss_OID mech_oid)
111 {
112 OM_uint32 status;
113
114 /*
115 * First try to parse the gssapi token header and see if it's a
116 * correct header, use that in the first hand.
117 */
118
119 status = parse_header(input, mech_oid);
120 if (status == GSS_S_COMPLETE)
121 return (GSS_S_COMPLETE);
122
123 /*
124 * Lets guess what mech is really is, callback function to mech ??
125 */
126
127 if (input->length > 8 &&
128 memcmp((const char *)input->value, "NTLMSSP\x00", 8) == 0)
129 {
130 *mech_oid = ntlm_mechanism;
131 return (GSS_S_COMPLETE);
132 } else if (input->length != 0 &&
133 ((const char *)input->value)[0] == 0x6E)
134 {
135 /* Could be a raw AP-REQ (check for APPLICATION tag) */
136 *mech_oid = krb5_mechanism;
137 return (GSS_S_COMPLETE);
138 } else if (input->length == 0) {
139 /*
140 * There is the a weird mode of SPNEGO (in CIFS and
141 * SASL GSS-SPENGO where the first token is zero
142 * length and the acceptor returns a mech_list, lets
143 * hope that is what is happening now.
144 */
145 *mech_oid = spnego_mechanism;
146 return (GSS_S_COMPLETE);
147 }
148 return (status);
149 }
150
gss_accept_sec_context(OM_uint32 * minor_status,gss_ctx_id_t * context_handle,const gss_cred_id_t acceptor_cred_handle,const gss_buffer_t input_token,const gss_channel_bindings_t input_chan_bindings,gss_name_t * src_name,gss_OID * mech_type,gss_buffer_t output_token,OM_uint32 * ret_flags,OM_uint32 * time_rec,gss_cred_id_t * delegated_cred_handle)151 OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
152 gss_ctx_id_t *context_handle,
153 const gss_cred_id_t acceptor_cred_handle,
154 const gss_buffer_t input_token,
155 const gss_channel_bindings_t input_chan_bindings,
156 gss_name_t *src_name,
157 gss_OID *mech_type,
158 gss_buffer_t output_token,
159 OM_uint32 *ret_flags,
160 OM_uint32 *time_rec,
161 gss_cred_id_t *delegated_cred_handle)
162 {
163 OM_uint32 major_status, mech_ret_flags;
164 struct _gss_mech_switch *m;
165 struct _gss_context *ctx = (struct _gss_context *) *context_handle;
166 struct _gss_cred *cred = (struct _gss_cred *) acceptor_cred_handle;
167 struct _gss_mechanism_cred *mc;
168 gss_cred_id_t acceptor_mc, delegated_mc;
169 gss_name_t src_mn;
170
171 *minor_status = 0;
172 if (src_name)
173 *src_name = GSS_C_NO_NAME;
174 if (mech_type)
175 *mech_type = GSS_C_NO_OID;
176 if (ret_flags)
177 *ret_flags = 0;
178 if (time_rec)
179 *time_rec = 0;
180 if (delegated_cred_handle)
181 *delegated_cred_handle = GSS_C_NO_CREDENTIAL;
182 _gss_buffer_zero(output_token);
183
184 /*
185 * If this is the first call (*context_handle is NULL), we must
186 * parse the input token to figure out the mechanism to use.
187 */
188 if (*context_handle == GSS_C_NO_CONTEXT) {
189 gss_OID_desc mech_oid;
190
191 major_status = choose_mech(input_token, &mech_oid);
192 if (major_status != GSS_S_COMPLETE)
193 return (major_status);
194
195 /*
196 * Now that we have a mechanism, we can find the
197 * implementation.
198 */
199 ctx = malloc(sizeof(struct _gss_context));
200 if (!ctx) {
201 *minor_status = ENOMEM;
202 return (GSS_S_DEFECTIVE_TOKEN);
203 }
204 memset(ctx, 0, sizeof(struct _gss_context));
205 m = ctx->gc_mech = _gss_find_mech_switch(&mech_oid);
206 if (!m) {
207 free(ctx);
208 return (GSS_S_BAD_MECH);
209 }
210 } else
211 m = ctx->gc_mech;
212
213 if (cred) {
214 SLIST_FOREACH(mc, &cred->gc_mc, gmc_link)
215 if (mc->gmc_mech == m)
216 break;
217 if (!mc)
218 return (GSS_S_BAD_MECH);
219 acceptor_mc = mc->gmc_cred;
220 } else {
221 acceptor_mc = GSS_C_NO_CREDENTIAL;
222 }
223 delegated_mc = GSS_C_NO_CREDENTIAL;
224
225 mech_ret_flags = 0;
226 major_status = m->gm_accept_sec_context(minor_status,
227 &ctx->gc_ctx,
228 acceptor_mc,
229 input_token,
230 input_chan_bindings,
231 &src_mn,
232 mech_type,
233 output_token,
234 &mech_ret_flags,
235 time_rec,
236 &delegated_mc);
237 if (major_status != GSS_S_COMPLETE &&
238 major_status != GSS_S_CONTINUE_NEEDED) {
239 _gss_mg_error(m, major_status, *minor_status);
240 return (major_status);
241 }
242
243 if (src_name && src_mn) {
244 /*
245 * Make a new name and mark it as an MN.
246 */
247 struct _gss_name *name = _gss_make_name(m, src_mn);
248
249 if (!name) {
250 m->gm_release_name(minor_status, &src_mn);
251 return (GSS_S_FAILURE);
252 }
253 *src_name = (gss_name_t) name;
254 } else if (src_mn) {
255 m->gm_release_name(minor_status, &src_mn);
256 }
257
258 if (delegated_mc == GSS_C_NO_CREDENTIAL)
259 mech_ret_flags &= ~GSS_C_DELEG_FLAG;
260
261 if (mech_ret_flags & GSS_C_DELEG_FLAG) {
262 if (!delegated_cred_handle) {
263 m->gm_release_cred(minor_status, &delegated_mc);
264 mech_ret_flags &= ~GSS_C_DELEG_FLAG;
265 } else {
266 struct _gss_cred *dcred;
267 struct _gss_mechanism_cred *dmc;
268
269 dcred = malloc(sizeof(struct _gss_cred));
270 if (!dcred) {
271 *minor_status = ENOMEM;
272 return (GSS_S_FAILURE);
273 }
274 SLIST_INIT(&dcred->gc_mc);
275 dmc = malloc(sizeof(struct _gss_mechanism_cred));
276 if (!dmc) {
277 free(dcred);
278 *minor_status = ENOMEM;
279 return (GSS_S_FAILURE);
280 }
281 dmc->gmc_mech = m;
282 dmc->gmc_mech_oid = &m->gm_mech_oid;
283 dmc->gmc_cred = delegated_mc;
284 SLIST_INSERT_HEAD(&dcred->gc_mc, dmc, gmc_link);
285
286 *delegated_cred_handle = (gss_cred_id_t) dcred;
287 }
288 }
289
290 if (ret_flags)
291 *ret_flags = mech_ret_flags;
292 *context_handle = (gss_ctx_id_t) ctx;
293 return (major_status);
294 }
295