sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code
966faef9c6
samba-mirror/libcli/auth/spnego_parse.c

417 lines
9.8 KiB
C
Raw Normal View History

spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
/*
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
Unix SMB/CIFS implementation.
RFC2478 Compliant SPNEGO implementation
Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
r23792: convert Samba4 to GPLv3 There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-07-10 06:07:03 +04:00
the Free Software Foundation; either version 3 of the License, or
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
(at your option) any later version.
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
You should have received a copy of the GNU General Public License
r23792: convert Samba4 to GPLv3 There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-07-10 06:07:03 +04:00
along with this program. If not, see <http://www.gnu.org/licenses/>.
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
*/
#include "includes.h"
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
#include "../libcli/auth/spnego.h"
Fix include paths to new location of libutil.
2008-10-11 23:31:42 +04:00
#include "../lib/util/asn1.h"
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
static bool read_negTokenInit(struct asn1_data *asn1, TALLOC_CTX *mem_ctx,
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
struct spnego_negTokenInit *token)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
ZERO_STRUCTP(token);
asn1_start_tag(asn1, ASN1_CONTEXT(0));
asn1_start_tag(asn1, ASN1_SEQUENCE(0));
while (!asn1->has_error && 0 < asn1_tag_remaining(asn1)) {
int i;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
uint8_t context;
if (!asn1_peek_uint8(asn1, &context)) {
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
asn1->has_error = true;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
break;
}
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
switch (context) {
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
/* Read mechTypes */
case ASN1_CONTEXT(0):
asn1_start_tag(asn1, ASN1_CONTEXT(0));
asn1_start_tag(asn1, ASN1_SEQUENCE(0));
r5037: got rid of all of the TALLOC_DEPRECATED stuff. My apologies for the large commit. I thought this was worthwhile to get done for consistency. (This used to be commit ec32b22ed5ec224f6324f5e069d15e92e38e15c0)
2005-01-27 10:08:20 +03:00
token->mechTypes = talloc(NULL, const char *);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
for (i = 0; !asn1->has_error &&
0 < asn1_tag_remaining(asn1); i++) {
s3/s4:auth SPNEGO - adaptions for the removed "const" from OIDs This is needed in order to suppress warnings.
2010-12-15 19:17:09 +03:00
char *oid;
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
token->mechTypes = talloc_realloc(NULL,
token->mechTypes,
r4591: - converted the other _p talloc functions to not need _p - added #if TALLOC_DEPRECATED around the _p functions - fixes the code that broke from the above while doing this I fixed quite a number of places that were incorrectly using the non type-safe talloc functions to use the type safe ones. Some were even doing multiplies for array allocation, which is potentially unsafe. (This used to be commit 6e7754abd0c225527fb38363996a6e241b87b37e)
2005-01-07 07:39:16 +03:00
const char *, i+2);
s3/s4:auth SPNEGO - adaptions for the removed "const" from OIDs This is needed in order to suppress warnings.
2010-12-15 19:17:09 +03:00
asn1_read_OID(asn1, token->mechTypes, &oid);
token->mechTypes[i] = oid;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
token->mechTypes[i] = NULL;
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_end_tag(asn1);
asn1_end_tag(asn1);
break;
/* Read reqFlags */
case ASN1_CONTEXT(1):
asn1_start_tag(asn1, ASN1_CONTEXT(1));
spnego: Support ASN.1 BIT STRING and use it in SPNEGO. Signed-off-by: Günther Deschner <gd@samba.org>
2009-08-13 10:12:01 +04:00
asn1_read_BitString(asn1, mem_ctx, &token->reqFlags,
&token->reqFlagsPadding);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_end_tag(asn1);
break;
/* Read mechToken */
case ASN1_CONTEXT(2):
asn1_start_tag(asn1, ASN1_CONTEXT(2));
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_read_OctetString(asn1, mem_ctx, &token->mechToken);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_end_tag(asn1);
break;
/* Read mecListMIC */
case ASN1_CONTEXT(3):
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
{
uint8_t type_peek;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_start_tag(asn1, ASN1_CONTEXT(3));
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
if (!asn1_peek_uint8(asn1, &type_peek)) {
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
asn1->has_error = true;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
break;
}
if (type_peek == ASN1_OCTET_STRING) {
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
asn1_read_OctetString(asn1, mem_ctx,
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
&token->mechListMIC);
} else {
/* RFC 2478 says we have an Octet String here,
but W2k sends something different... */
char *mechListMIC;
Fix what looks like a cut-and-paste error in our read_negTokenInit() function. We should never be calling asn1_push_XXX functions inside an asn1 reading function. Change asn1_push_tag() -> asn1_start_tag() and asn1_pop_tag() -> asn1_end_tag(). This allows us to connect to a NetApp filer at the Microsoft plugfest. Andrew PLEASE CHECK ! Jeremy.
2010-05-21 01:30:44 +04:00
asn1_start_tag(asn1, ASN1_SEQUENCE(0));
asn1_start_tag(asn1, ASN1_CONTEXT(0));
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_read_GeneralString(asn1, mem_ctx, &mechListMIC);
Fix what looks like a cut-and-paste error in our read_negTokenInit() function. We should never be calling asn1_push_XXX functions inside an asn1 reading function. Change asn1_push_tag() -> asn1_start_tag() and asn1_pop_tag() -> asn1_end_tag(). This allows us to connect to a NetApp filer at the Microsoft plugfest. Andrew PLEASE CHECK ! Jeremy.
2010-05-21 01:30:44 +04:00
asn1_end_tag(asn1);
asn1_end_tag(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
r1438: Record the principal name we are sent in the SPENGO mechListMIC in a seperate char *, not a DATA_BLOB. This allows us to tell if we were sent a string here, or a real MIC. (This used to be commit 06b997c826e3ec00e0528da800e3eae0e3497a54)
2004-07-11 14:20:42 +04:00
token->targetPrincipal = mechListMIC;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
asn1_end_tag(asn1);
break;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
}
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
default:
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
asn1->has_error = true;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
}
}
asn1_end_tag(asn1);
asn1_end_tag(asn1);
return !asn1->has_error;
}
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
static bool write_negTokenInit(struct asn1_data *asn1, struct spnego_negTokenInit *token)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
asn1_push_tag(asn1, ASN1_CONTEXT(0));
asn1_push_tag(asn1, ASN1_SEQUENCE(0));
/* Write mechTypes */
if (token->mechTypes && *token->mechTypes) {
int i;
asn1_push_tag(asn1, ASN1_CONTEXT(0));
asn1_push_tag(asn1, ASN1_SEQUENCE(0));
for (i = 0; token->mechTypes[i]; i++) {
asn1_write_OID(asn1, token->mechTypes[i]);
}
asn1_pop_tag(asn1);
asn1_pop_tag(asn1);
}
/* write reqFlags */
spnego: Support ASN.1 BIT STRING and use it in SPNEGO. Signed-off-by: Günther Deschner <gd@samba.org>
2009-08-13 10:12:01 +04:00
if (token->reqFlags.length > 0) {
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_push_tag(asn1, ASN1_CONTEXT(1));
spnego: Support ASN.1 BIT STRING and use it in SPNEGO. Signed-off-by: Günther Deschner <gd@samba.org>
2009-08-13 10:12:01 +04:00
asn1_write_BitString(asn1, token->reqFlags.data,
token->reqFlags.length,
token->reqFlagsPadding);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_pop_tag(asn1);
}
/* write mechToken */
if (token->mechToken.data) {
asn1_push_tag(asn1, ASN1_CONTEXT(2));
asn1_write_OctetString(asn1, token->mechToken.data,
token->mechToken.length);
asn1_pop_tag(asn1);
}
/* write mechListMIC */
if (token->mechListMIC.data) {
asn1_push_tag(asn1, ASN1_CONTEXT(3));
#if 0
/* This is what RFC 2478 says ... */
asn1_write_OctetString(asn1, token->mechListMIC.data,
token->mechListMIC.length);
#else
/* ... but unfortunately this is what Windows
sends/expects */
asn1_push_tag(asn1, ASN1_SEQUENCE(0));
asn1_push_tag(asn1, ASN1_CONTEXT(0));
asn1_push_tag(asn1, ASN1_GENERAL_STRING);
asn1_write(asn1, token->mechListMIC.data,
token->mechListMIC.length);
asn1_pop_tag(asn1);
asn1_pop_tag(asn1);
asn1_pop_tag(asn1);
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
#endif
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_pop_tag(asn1);
}
asn1_pop_tag(asn1);
asn1_pop_tag(asn1);
return !asn1->has_error;
}
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
static bool read_negTokenTarg(struct asn1_data *asn1, TALLOC_CTX *mem_ctx,
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
struct spnego_negTokenTarg *token)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
ZERO_STRUCTP(token);
asn1_start_tag(asn1, ASN1_CONTEXT(1));
asn1_start_tag(asn1, ASN1_SEQUENCE(0));
while (!asn1->has_error && 0 < asn1_tag_remaining(asn1)) {
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
uint8_t context;
s3/s4:auth SPNEGO - adaptions for the removed "const" from OIDs This is needed in order to suppress warnings.
2010-12-15 19:17:09 +03:00
char *oid;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
if (!asn1_peek_uint8(asn1, &context)) {
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
asn1->has_error = true;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
break;
}
switch (context) {
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
case ASN1_CONTEXT(0):
asn1_start_tag(asn1, ASN1_CONTEXT(0));
asn1_start_tag(asn1, ASN1_ENUMERATED);
asn1_read_uint8(asn1, &token->negResult);
asn1_end_tag(asn1);
asn1_end_tag(asn1);
break;
case ASN1_CONTEXT(1):
asn1_start_tag(asn1, ASN1_CONTEXT(1));
s3/s4:auth SPNEGO - adaptions for the removed "const" from OIDs This is needed in order to suppress warnings.
2010-12-15 19:17:09 +03:00
asn1_read_OID(asn1, mem_ctx, &oid);
token->supportedMech = oid;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_end_tag(asn1);
break;
case ASN1_CONTEXT(2):
asn1_start_tag(asn1, ASN1_CONTEXT(2));
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_read_OctetString(asn1, mem_ctx, &token->responseToken);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_end_tag(asn1);
break;
case ASN1_CONTEXT(3):
asn1_start_tag(asn1, ASN1_CONTEXT(3));
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_read_OctetString(asn1, mem_ctx, &token->mechListMIC);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_end_tag(asn1);
break;
default:
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
asn1->has_error = true;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
}
}
asn1_end_tag(asn1);
asn1_end_tag(asn1);
return !asn1->has_error;
}
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
static bool write_negTokenTarg(struct asn1_data *asn1, struct spnego_negTokenTarg *token)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
asn1_push_tag(asn1, ASN1_CONTEXT(1));
asn1_push_tag(asn1, ASN1_SEQUENCE(0));
r3289: Mr. L. and Mr. B.! can we decide to not break WinXP clients:-) metze (This used to be commit 5eb0ff78d5e68f488a439545fdaec90c28ef877a)
2004-10-27 16:59:41 +04:00
if (token->negResult != SPNEGO_NONE_RESULT) {
asn1_push_tag(asn1, ASN1_CONTEXT(0));
asn1_write_enumerated(asn1, token->negResult);
asn1_pop_tag(asn1);
}
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
if (token->supportedMech) {
asn1_push_tag(asn1, ASN1_CONTEXT(1));
asn1_write_OID(asn1, token->supportedMech);
asn1_pop_tag(asn1);
}
if (token->responseToken.data) {
asn1_push_tag(asn1, ASN1_CONTEXT(2));
asn1_write_OctetString(asn1, token->responseToken.data,
token->responseToken.length);
asn1_pop_tag(asn1);
}
if (token->mechListMIC.data) {
asn1_push_tag(asn1, ASN1_CONTEXT(3));
asn1_write_OctetString(asn1, token->mechListMIC.data,
token->mechListMIC.length);
asn1_pop_tag(asn1);
}
asn1_pop_tag(asn1);
asn1_pop_tag(asn1);
return !asn1->has_error;
}
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
ssize_t spnego_read_data(TALLOC_CTX *mem_ctx, DATA_BLOB data, struct spnego_data *token)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
r23036: error checking on asn1_init() failure (This used to be commit 26cf8494084c0106ef0e1c9b6ef40eeadf945ef2)
2007-05-21 16:47:18 +04:00
struct asn1_data *asn1;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
ssize_t ret = -1;
r1426: Fix some of my silly compile errors... Andrew Bartlett (This used to be commit c283837556109b9392a8cdcd867e5ae0dac1509b)
2004-07-10 03:38:13 +04:00
uint8_t context;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
ZERO_STRUCTP(token);
r1349: don't segfault with empty data_blob metze (This used to be commit a826accd55e90cb0628f198886ba1ae6c845e68b)
2004-07-06 05:01:39 +04:00
if (data.length == 0) {
return ret;
}
r23036: error checking on asn1_init() failure (This used to be commit 26cf8494084c0106ef0e1c9b6ef40eeadf945ef2)
2007-05-21 16:47:18 +04:00
asn1 = asn1_init(mem_ctx);
if (asn1 == NULL) {
return -1;
}
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_load(asn1, data);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
if (!asn1_peek_uint8(asn1, &context)) {
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
asn1->has_error = true;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
} else {
switch (context) {
case ASN1_APPLICATION(0):
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_start_tag(asn1, ASN1_APPLICATION(0));
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
asn1_check_OID(asn1, OID_SPNEGO);
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
if (read_negTokenInit(asn1, mem_ctx, &token->negTokenInit)) {
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
token->type = SPNEGO_NEG_TOKEN_INIT;
}
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_end_tag(asn1);
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
break;
case ASN1_CONTEXT(1):
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
if (read_negTokenTarg(asn1, mem_ctx, &token->negTokenTarg)) {
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
token->type = SPNEGO_NEG_TOKEN_TARG;
}
break;
default:
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
asn1->has_error = true;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
break;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
}
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
if (!asn1->has_error) ret = asn1->ofs;
asn1_free(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
return ret;
}
r1229: the name of the protocol should be in first place of a function name rename <read|write|free>_spnego_data() into spnego_<read|write|free>_data metze (This used to be commit 3f57c8f596eb6ad31a024acaf60fefcfd28d8387)
2004-06-23 19:32:44 +04:00
ssize_t spnego_write_data(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, struct spnego_data *spnego)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
struct asn1_data *asn1 = asn1_init(mem_ctx);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
ssize_t ret = -1;
r23036: error checking on asn1_init() failure (This used to be commit 26cf8494084c0106ef0e1c9b6ef40eeadf945ef2)
2007-05-21 16:47:18 +04:00
if (asn1 == NULL) {
return -1;
}
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
switch (spnego->type) {
case SPNEGO_NEG_TOKEN_INIT:
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_push_tag(asn1, ASN1_APPLICATION(0));
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
asn1_write_OID(asn1, OID_SPNEGO);
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
write_negTokenInit(asn1, &spnego->negTokenInit);
asn1_pop_tag(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
case SPNEGO_NEG_TOKEN_TARG:
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
write_negTokenTarg(asn1, &spnego->negTokenTarg);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
default:
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
asn1->has_error = true;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
}
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
if (!asn1->has_error) {
*blob = data_blob_talloc(mem_ctx, asn1->data, asn1->length);
ret = asn1->ofs;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_free(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
return ret;
}
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
bool spnego_free_data(struct spnego_data *spnego)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
bool ret = true;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
if (!spnego) goto out;
switch(spnego->type) {
case SPNEGO_NEG_TOKEN_INIT:
if (spnego->negTokenInit.mechTypes) {
r2036: switched the spnego code to use talloc now that talloc_free() doesn't need to take a context ptr, there is no reason we can't use talloc everywhere that we currently use malloc(). (This used to be commit a2ad77fb3ac9638c5ef52494bf62083ec594b9f5)
2004-08-25 06:04:35 +04:00
talloc_free(spnego->negTokenInit.mechTypes);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
spnego: Support ASN.1 BIT STRING and use it in SPNEGO. Signed-off-by: Günther Deschner <gd@samba.org>
2009-08-13 10:12:01 +04:00
data_blob_free(&spnego->negTokenInit.reqFlags);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
data_blob_free(&spnego->negTokenInit.mechToken);
data_blob_free(&spnego->negTokenInit.mechListMIC);
r2042: missed a couple of places that should be talloc_free() (This used to be commit e1575a72a10252fdb88778f14bf3c44a65d72c5e)
2004-08-25 06:25:48 +04:00
talloc_free(spnego->negTokenInit.targetPrincipal);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
case SPNEGO_NEG_TOKEN_TARG:
if (spnego->negTokenTarg.supportedMech) {
r3476: fixed some const warnings (This used to be commit 7dc58dc01e19b342df76dcc14ee28ff37a8f9ace)
2004-11-02 14:17:06 +03:00
talloc_free(discard_const(spnego->negTokenTarg.supportedMech));
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
data_blob_free(&spnego->negTokenTarg.responseToken);
data_blob_free(&spnego->negTokenTarg.mechListMIC);
break;
default:
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
ret = false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
}
ZERO_STRUCTP(spnego);
out:
return ret;
}
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
bool spnego_write_mech_types(TALLOC_CTX *mem_ctx,
const char **mech_types,
DATA_BLOB *blob)
{
struct asn1_data *asn1 = asn1_init(mem_ctx);
libcli/auth: let spnego_write_mech_types() check the asn1_load() return metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Dec 7 18:23:41 CET 2010 on sn-devel-104
2010-12-02 02:40:01 +03:00
if (asn1 == NULL) {
return false;
}
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
/* Write mechTypes */
if (mech_types && *mech_types) {
int i;
asn1_push_tag(asn1, ASN1_SEQUENCE(0));
for (i = 0; mech_types[i]; i++) {
asn1_write_OID(asn1, mech_types[i]);
}
asn1_pop_tag(asn1);
}
if (asn1->has_error) {
asn1_free(asn1);
return false;
}
*blob = data_blob_talloc(mem_ctx, asn1->data, asn1->length);
if (blob->length != asn1->length) {
asn1_free(asn1);
return false;
}
asn1_free(asn1);
return true;
}
Copy Permalink