sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-30 13:18:05 +03:00
Code
ceed07fe89
samba-mirror/libcli/auth/spnego_parse.c

447 lines
12 KiB
C
Raw Normal View History

spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
/*
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
Unix SMB/CIFS implementation.
RFC2478 Compliant SPNEGO implementation
Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
r23792: convert Samba4 to GPLv3 There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-07-10 06:07:03 +04:00
the Free Software Foundation; either version 3 of the License, or
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
(at your option) any later version.
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
You should have received a copy of the GNU General Public License
r23792: convert Samba4 to GPLv3 There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-07-10 06:07:03 +04:00
along with this program. If not, see <http://www.gnu.org/licenses/>.
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
*/
#include "includes.h"
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
#include "../libcli/auth/spnego.h"
Fix include paths to new location of libutil.
2008-10-11 23:31:42 +04:00
#include "../lib/util/asn1.h"
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
static bool read_negTokenInit(struct asn1_data *asn1, TALLOC_CTX *mem_ctx,
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
struct spnego_negTokenInit *token)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
ZERO_STRUCTP(token);
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_CONTEXT(0))) return false;
if (!asn1_start_tag(asn1, ASN1_SEQUENCE(0))) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
spnego: Some simplifications asn1_tag_remaining already checks for has_error and only returns positive if there is error-free space left Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2016-01-11 23:58:25 +03:00
while (asn1_tag_remaining(asn1) > 0) {
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
int i;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
uint8_t context;
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
if (!asn1_peek_uint8(asn1, &context)) {
lib: Use asn1_set_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-04 23:51:07 +03:00
asn1_set_error(asn1);
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
break;
}
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
switch (context) {
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
/* Read mechTypes */
libcli/auth: add more const to spnego_negTokenInit->mechTypes Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Aug 10 11:11:54 CEST 2013 on sn-devel-104
2013-08-05 12:46:47 +04:00
case ASN1_CONTEXT(0): {
const char **mechTypes;
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_CONTEXT(0))) return false;
if (!asn1_start_tag(asn1, ASN1_SEQUENCE(0))) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
libcli/auth: add more const to spnego_negTokenInit->mechTypes Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Aug 10 11:11:54 CEST 2013 on sn-devel-104
2013-08-05 12:46:47 +04:00
mechTypes = talloc(mem_ctx, const char *);
if (mechTypes == NULL) {
lib: Use asn1_set_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-04 23:51:07 +03:00
asn1_set_error(asn1);
libcli/auth: avoid possible mem leak in read_negTokenInit() Also add error checks. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 12:43:38 +04:00
return false;
}
spnego: Some simplifications asn1_tag_remaining already checks for has_error and only returns positive if there is error-free space left Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2016-01-11 23:58:25 +03:00
for (i = 0; asn1_tag_remaining(asn1) > 0; i++) {
s3/s4:auth SPNEGO - adaptions for the removed "const" from OIDs This is needed in order to suppress warnings.
2010-12-15 19:17:09 +03:00
char *oid;
libcli/auth: avoid possible mem leak in read_negTokenInit() Also add error checks. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 12:43:38 +04:00
const char **p;
p = talloc_realloc(mem_ctx,
libcli/auth: add more const to spnego_negTokenInit->mechTypes Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Aug 10 11:11:54 CEST 2013 on sn-devel-104
2013-08-05 12:46:47 +04:00
mechTypes,
libcli/auth: avoid possible mem leak in read_negTokenInit() Also add error checks. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 12:43:38 +04:00
const char *, i+2);
if (p == NULL) {
libcli/auth: add more const to spnego_negTokenInit->mechTypes Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Aug 10 11:11:54 CEST 2013 on sn-devel-104
2013-08-05 12:46:47 +04:00
talloc_free(mechTypes);
lib: Use asn1_set_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-04 23:51:07 +03:00
asn1_set_error(asn1);
libcli/auth: avoid possible mem leak in read_negTokenInit() Also add error checks. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 12:43:38 +04:00
return false;
}
libcli/auth: add more const to spnego_negTokenInit->mechTypes Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Aug 10 11:11:54 CEST 2013 on sn-devel-104
2013-08-05 12:46:47 +04:00
mechTypes = p;
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_read_OID(asn1, mechTypes, &oid)) return false;
libcli/auth: add more const to spnego_negTokenInit->mechTypes Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Aug 10 11:11:54 CEST 2013 on sn-devel-104
2013-08-05 12:46:47 +04:00
mechTypes[i] = oid;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
libcli/auth: add more const to spnego_negTokenInit->mechTypes Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Aug 10 11:11:54 CEST 2013 on sn-devel-104
2013-08-05 12:46:47 +04:00
mechTypes[i] = NULL;
token->mechTypes = mechTypes;
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
asn1_end_tag(asn1);
asn1_end_tag(asn1);
break;
libcli/auth: add more const to spnego_negTokenInit->mechTypes Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Aug 10 11:11:54 CEST 2013 on sn-devel-104
2013-08-05 12:46:47 +04:00
}
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
/* Read reqFlags */
case ASN1_CONTEXT(1):
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_CONTEXT(1))) return false;
if (!asn1_read_BitString(asn1, mem_ctx, &token->reqFlags,
&token->reqFlagsPadding)) return false;
if (!asn1_end_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
/* Read mechToken */
case ASN1_CONTEXT(2):
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_CONTEXT(2))) return false;
if (!asn1_read_OctetString(asn1, mem_ctx, &token->mechToken)) return false;
if (!asn1_end_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
/* Read mecListMIC */
case ASN1_CONTEXT(3):
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
{
uint8_t type_peek;
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_CONTEXT(3))) return false;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
if (!asn1_peek_uint8(asn1, &type_peek)) {
lib: Use asn1_set_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-04 23:51:07 +03:00
asn1_set_error(asn1);
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
break;
}
if (type_peek == ASN1_OCTET_STRING) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_read_OctetString(asn1, mem_ctx,
&token->mechListMIC)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
} else {
/* RFC 2478 says we have an Octet String here,
but W2k sends something different... */
char *mechListMIC;
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_SEQUENCE(0))) return false;
if (!asn1_start_tag(asn1, ASN1_CONTEXT(0))) return false;
if (!asn1_read_GeneralString(asn1, mem_ctx, &mechListMIC)) return false;
if (!asn1_end_tag(asn1)) return false;
if (!asn1_end_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
r1438: Record the principal name we are sent in the SPENGO mechListMIC in a seperate char *, not a DATA_BLOB. This allows us to tell if we were sent a string here, or a real MIC. (This used to be commit 06b997c826e3ec00e0528da800e3eae0e3497a54)
2004-07-11 14:20:42 +04:00
token->targetPrincipal = mechListMIC;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_end_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
}
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
default:
lib: Use asn1_set_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-04 23:51:07 +03:00
asn1_set_error(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
}
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_end_tag(asn1)) return false;
if (!asn1_end_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
lib: Use asn1_has_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-02 20:11:00 +03:00
return !asn1_has_error(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
static bool write_negTokenInit(struct asn1_data *asn1, struct spnego_negTokenInit *token)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_CONTEXT(0))) return false;
if (!asn1_push_tag(asn1, ASN1_SEQUENCE(0))) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
/* Write mechTypes */
if (token->mechTypes && *token->mechTypes) {
int i;
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_CONTEXT(0))) return false;
if (!asn1_push_tag(asn1, ASN1_SEQUENCE(0))) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
for (i = 0; token->mechTypes[i]; i++) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_write_OID(asn1, token->mechTypes[i])) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_pop_tag(asn1)) return false;
if (!asn1_pop_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
/* write reqFlags */
spnego: Support ASN.1 BIT STRING and use it in SPNEGO. Signed-off-by: Günther Deschner <gd@samba.org>
2009-08-13 10:12:01 +04:00
if (token->reqFlags.length > 0) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_CONTEXT(1))) return false;
if (!asn1_write_BitString(asn1, token->reqFlags.data,
spnego: Support ASN.1 BIT STRING and use it in SPNEGO. Signed-off-by: Günther Deschner <gd@samba.org>
2009-08-13 10:12:01 +04:00
token->reqFlags.length,
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
token->reqFlagsPadding)) return false;
if (!asn1_pop_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
/* write mechToken */
if (token->mechToken.data) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_CONTEXT(2))) return false;
if (!asn1_write_OctetString(asn1, token->mechToken.data,
token->mechToken.length)) return false;
if (!asn1_pop_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
/* write mechListMIC */
if (token->mechListMIC.data) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_CONTEXT(3))) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
#if 0
/* This is what RFC 2478 says ... */
asn1_write_OctetString(asn1, token->mechListMIC.data,
token->mechListMIC.length);
#else
/* ... but unfortunately this is what Windows
sends/expects */
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_SEQUENCE(0))) return false;
if (!asn1_push_tag(asn1, ASN1_CONTEXT(0))) return false;
if (!asn1_push_tag(asn1, ASN1_GENERAL_STRING)) return false;
if (!asn1_write(asn1, token->mechListMIC.data,
token->mechListMIC.length)) return false;
if (!asn1_pop_tag(asn1)) return false;
if (!asn1_pop_tag(asn1)) return false;
if (!asn1_pop_tag(asn1)) return false;
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
#endif
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_pop_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_pop_tag(asn1)) return false;
if (!asn1_pop_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
lib: Use asn1_has_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-02 20:11:00 +03:00
return !asn1_has_error(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
spnego: share spnego_parse. Guenther
2009-09-17 02:21:01 +04:00
static bool read_negTokenTarg(struct asn1_data *asn1, TALLOC_CTX *mem_ctx,
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
struct spnego_negTokenTarg *token)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
ZERO_STRUCTP(token);
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_CONTEXT(1))) return false;
if (!asn1_start_tag(asn1, ASN1_SEQUENCE(0))) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
spnego: Some simplifications asn1_tag_remaining already checks for has_error and only returns positive if there is error-free space left Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2016-01-11 23:58:25 +03:00
while (asn1_tag_remaining(asn1) > 0) {
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
uint8_t context;
CVE-2016-2110: libcli/auth: use enum spnego_negResult instead of uint8_t BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2013-12-17 15:42:06 +04:00
uint8_t neg_result;
s3/s4:auth SPNEGO - adaptions for the removed "const" from OIDs This is needed in order to suppress warnings.
2010-12-15 19:17:09 +03:00
char *oid;
CVE-2016-2110: libcli/auth: use enum spnego_negResult instead of uint8_t BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2013-12-17 15:42:06 +04:00
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
if (!asn1_peek_uint8(asn1, &context)) {
lib: Use asn1_set_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-04 23:51:07 +03:00
asn1_set_error(asn1);
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
break;
}
switch (context) {
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
case ASN1_CONTEXT(0):
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_CONTEXT(0))) return false;
if (!asn1_start_tag(asn1, ASN1_ENUMERATED)) return false;
CVE-2016-2110: libcli/auth: use enum spnego_negResult instead of uint8_t BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2013-12-17 15:42:06 +04:00
if (!asn1_read_uint8(asn1, &neg_result)) return false;
token->negResult = neg_result;
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_end_tag(asn1)) return false;
if (!asn1_end_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
case ASN1_CONTEXT(1):
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_CONTEXT(1))) return false;
if (!asn1_read_OID(asn1, mem_ctx, &oid)) return false;
s3/s4:auth SPNEGO - adaptions for the removed "const" from OIDs This is needed in order to suppress warnings.
2010-12-15 19:17:09 +03:00
token->supportedMech = oid;
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_end_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
case ASN1_CONTEXT(2):
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_CONTEXT(2))) return false;
if (!asn1_read_OctetString(asn1, mem_ctx, &token->responseToken)) return false;
if (!asn1_end_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
case ASN1_CONTEXT(3):
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_CONTEXT(3))) return false;
if (!asn1_read_OctetString(asn1, mem_ctx, &token->mechListMIC)) return false;
if (!asn1_end_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
default:
lib: Use asn1_set_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-04 23:51:07 +03:00
asn1_set_error(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
}
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_end_tag(asn1)) return false;
if (!asn1_end_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
lib: Use asn1_has_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-02 20:11:00 +03:00
return !asn1_has_error(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
static bool write_negTokenTarg(struct asn1_data *asn1, struct spnego_negTokenTarg *token)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_CONTEXT(1))) return false;
if (!asn1_push_tag(asn1, ASN1_SEQUENCE(0))) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
r3289: Mr. L. and Mr. B.! can we decide to not break WinXP clients:-) metze (This used to be commit 5eb0ff78d5e68f488a439545fdaec90c28ef877a)
2004-10-27 16:59:41 +04:00
if (token->negResult != SPNEGO_NONE_RESULT) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_CONTEXT(0))) return false;
if (!asn1_write_enumerated(asn1, token->negResult)) return false;
if (!asn1_pop_tag(asn1)) return false;
r3289: Mr. L. and Mr. B.! can we decide to not break WinXP clients:-) metze (This used to be commit 5eb0ff78d5e68f488a439545fdaec90c28ef877a)
2004-10-27 16:59:41 +04:00
}
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
if (token->supportedMech) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_CONTEXT(1))) return false;
if (!asn1_write_OID(asn1, token->supportedMech)) return false;
if (!asn1_pop_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
if (token->responseToken.data) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_CONTEXT(2))) return false;
if (!asn1_write_OctetString(asn1, token->responseToken.data,
token->responseToken.length)) return false;
if (!asn1_pop_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
if (token->mechListMIC.data) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_CONTEXT(3))) return false;
if (!asn1_write_OctetString(asn1, token->mechListMIC.data,
token->mechListMIC.length)) return false;
if (!asn1_pop_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_pop_tag(asn1)) return false;
if (!asn1_pop_tag(asn1)) return false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
lib: Use asn1_has_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-02 20:11:00 +03:00
return !asn1_has_error(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
ssize_t spnego_read_data(TALLOC_CTX *mem_ctx, DATA_BLOB data, struct spnego_data *token)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
r23036: error checking on asn1_init() failure (This used to be commit 26cf8494084c0106ef0e1c9b6ef40eeadf945ef2)
2007-05-21 16:47:18 +04:00
struct asn1_data *asn1;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
ssize_t ret = -1;
r1426: Fix some of my silly compile errors... Andrew Bartlett (This used to be commit c283837556109b9392a8cdcd867e5ae0dac1509b)
2004-07-10 03:38:13 +04:00
uint8_t context;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
ZERO_STRUCTP(token);
r1349: don't segfault with empty data_blob metze (This used to be commit a826accd55e90cb0628f198886ba1ae6c845e68b)
2004-07-06 05:01:39 +04:00
if (data.length == 0) {
return ret;
}
r23036: error checking on asn1_init() failure (This used to be commit 26cf8494084c0106ef0e1c9b6ef40eeadf945ef2)
2007-05-21 16:47:18 +04:00
asn1 = asn1_init(mem_ctx);
if (asn1 == NULL) {
return -1;
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_load(asn1, data)) goto err;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
if (!asn1_peek_uint8(asn1, &context)) {
lib: Use asn1_set_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-04 23:51:07 +03:00
asn1_set_error(asn1);
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
} else {
switch (context) {
case ASN1_APPLICATION(0):
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_start_tag(asn1, ASN1_APPLICATION(0))) goto err;
if (!asn1_check_OID(asn1, OID_SPNEGO)) goto err;
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
if (read_negTokenInit(asn1, mem_ctx, &token->negTokenInit)) {
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
token->type = SPNEGO_NEG_TOKEN_INIT;
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_end_tag(asn1)) goto err;
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
break;
case ASN1_CONTEXT(1):
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
if (read_negTokenTarg(asn1, mem_ctx, &token->negTokenTarg)) {
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
token->type = SPNEGO_NEG_TOKEN_TARG;
}
break;
default:
lib: Use asn1_set_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-04 23:51:07 +03:00
asn1_set_error(asn1);
r1352: Add a 'peek' function to our ASN1 code, so we can safely perform the various switches without looking one byte past te end of the buffer. (This used to be commit 5bce188d429b4166f3d0314922ae40204de182a7)
2004-07-06 05:28:12 +04:00
break;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
}
lib: Use asn1_current_ofs() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-05 12:55:44 +03:00
if (!asn1_has_error(asn1)) {
ret = asn1_current_ofs(asn1);
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
err:
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_free(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
return ret;
}
r1229: the name of the protocol should be in first place of a function name rename <read|write|free>_spnego_data() into spnego_<read|write|free>_data metze (This used to be commit 3f57c8f596eb6ad31a024acaf60fefcfd28d8387)
2004-06-23 19:32:44 +04:00
ssize_t spnego_write_data(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, struct spnego_data *spnego)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
struct asn1_data *asn1 = asn1_init(mem_ctx);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
ssize_t ret = -1;
r23036: error checking on asn1_init() failure (This used to be commit 26cf8494084c0106ef0e1c9b6ef40eeadf945ef2)
2007-05-21 16:47:18 +04:00
if (asn1 == NULL) {
return -1;
}
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
switch (spnego->type) {
case SPNEGO_NEG_TOKEN_INIT:
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_APPLICATION(0))) goto err;
if (!asn1_write_OID(asn1, OID_SPNEGO)) goto err;
if (!write_negTokenInit(asn1, &spnego->negTokenInit)) goto err;
if (!asn1_pop_tag(asn1)) goto err;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
case SPNEGO_NEG_TOKEN_TARG:
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
write_negTokenTarg(asn1, &spnego->negTokenTarg);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
default:
lib: Use asn1_set_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-04 23:51:07 +03:00
asn1_set_error(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
}
lib: Use asn1_extract_blob() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-02 22:10:53 +03:00
if (!asn1_extract_blob(asn1, mem_ctx, blob)) {
goto err;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
lib: Use asn1_current_ofs() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-05 12:55:44 +03:00
ret = asn1_current_ofs(asn1);
lib: Use asn1_extract_blob() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-02 22:10:53 +03:00
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
err:
r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)
2007-05-21 10:12:06 +04:00
asn1_free(asn1);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
return ret;
}
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
bool spnego_free_data(struct spnego_data *spnego)
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
{
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
bool ret = true;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
if (!spnego) goto out;
switch(spnego->type) {
case SPNEGO_NEG_TOKEN_INIT:
if (spnego->negTokenInit.mechTypes) {
libcli/auth: add more const to spnego_negTokenInit->mechTypes Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Aug 10 11:11:54 CEST 2013 on sn-devel-104
2013-08-05 12:46:47 +04:00
talloc_free(discard_const(spnego->negTokenInit.mechTypes));
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
spnego: Support ASN.1 BIT STRING and use it in SPNEGO. Signed-off-by: Günther Deschner <gd@samba.org>
2009-08-13 10:12:01 +04:00
data_blob_free(&spnego->negTokenInit.reqFlags);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
data_blob_free(&spnego->negTokenInit.mechToken);
data_blob_free(&spnego->negTokenInit.mechListMIC);
r2042: missed a couple of places that should be talloc_free() (This used to be commit e1575a72a10252fdb88778f14bf3c44a65d72c5e)
2004-08-25 06:25:48 +04:00
talloc_free(spnego->negTokenInit.targetPrincipal);
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
case SPNEGO_NEG_TOKEN_TARG:
if (spnego->negTokenTarg.supportedMech) {
r3476: fixed some const warnings (This used to be commit 7dc58dc01e19b342df76dcc14ee28ff37a8f9ace)
2004-11-02 14:17:06 +03:00
talloc_free(discard_const(spnego->negTokenTarg.supportedMech));
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
}
data_blob_free(&spnego->negTokenTarg.responseToken);
data_blob_free(&spnego->negTokenTarg.mechListMIC);
break;
default:
r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-07 02:16:19 +04:00
ret = false;
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
break;
}
ZERO_STRUCTP(spnego);
out:
return ret;
}
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
bool spnego_write_mech_types(TALLOC_CTX *mem_ctx,
libcli/auth: add more const to spnego_negTokenInit->mechTypes Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Aug 10 11:11:54 CEST 2013 on sn-devel-104
2013-08-05 12:46:47 +04:00
const char * const *mech_types,
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
DATA_BLOB *blob)
{
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
bool ret = false;
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
struct asn1_data *asn1 = asn1_init(mem_ctx);
libcli/auth: let spnego_write_mech_types() check the asn1_load() return metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Dec 7 18:23:41 CET 2010 on sn-devel-104
2010-12-02 02:40:01 +03:00
if (asn1 == NULL) {
return false;
}
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
/* Write mechTypes */
if (mech_types && *mech_types) {
int i;
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_push_tag(asn1, ASN1_SEQUENCE(0))) goto err;
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
for (i = 0; mech_types[i]; i++) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_write_OID(asn1, mech_types[i])) goto err;
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
if (!asn1_pop_tag(asn1)) goto err;
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
}
lib: Use asn1_has_error() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-02 20:11:00 +03:00
if (asn1_has_error(asn1)) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
goto err;
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
}
lib: Use asn1_extract_blob() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-02 22:10:53 +03:00
if (!asn1_extract_blob(asn1, mem_ctx, blob)) {
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
goto err;
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
}
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
ret = true;
err:
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
asn1_free(asn1);
libcli: auth: Ensure all asn1_XX returns are checked. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2014-09-20 00:42:39 +04:00
return ret;
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
}
Copy Permalink