12b65585e720714b31036daaa2b30eb76014048eGordon Ross * This file and its contents are supplied under the terms of the
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Common Development and Distribution License ("CDDL"), version 1.0.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * You may only use this file in accordance with the terms of version
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * 1.0 of the CDDL.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * A full copy of the text of the CDDL should have accompanied this
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * source. A copy of the CDDL is also available via the Internet at
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * SPNEGO back-end for Kerberos. See [MS-KILE]
12b65585e720714b31036daaa2b30eb76014048eGordon Ross/* From krb5/krb/pac.c (should have been exported) */
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Initialize this context for Kerberos, if possible.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Should not get here unless libsmb smb_config_get_negtok
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * includes the Kerberos5 Mech OIDs in our spnego hint.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Todo: allocate ctx->ctx_backend
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * See: krb5_gss_accept_sec_context()
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Todo: free ctx->ctx_backend
12b65585e720714b31036daaa2b30eb76014048eGordon Ross krb5_free_data_contents(be->be_kctx, &be->be_pac);
12b65585e720714b31036daaa2b30eb76014048eGordon Ross (void) gss_release_buffer(NULL, &be->be_authz_pac);
12b65585e720714b31036daaa2b30eb76014048eGordon Ross (void) gss_delete_sec_context(&minor, &be->be_gssctx,
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Handle a Kerberos auth message.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * State across messages is in ctx->ctx_backend
12b65585e720714b31036daaa2b30eb76014048eGordon Ross /* Do this early, for error message support. */
12b65585e720714b31036daaa2b30eb76014048eGordon Ross major = gss_accept_sec_context(&minor, &be->be_gssctx,
12b65585e720714b31036daaa2b30eb76014048eGordon Ross GSS_C_NO_CHANNEL_BINDINGS, &gname, &mech_type, &outtok,
12b65585e720714b31036daaa2b30eb76014048eGordon Ross (void) memcpy(ctx->ctx_obodybuf, outtok.value, outtok.length);
12b65585e720714b31036daaa2b30eb76014048eGordon Ross "mech=0x%x, major=0x%x, minor=0x%x",
12b65585e720714b31036daaa2b30eb76014048eGordon Ross /* becomes NT_STATUS_MORE_PROCESSING_REQUIRED */
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * OK, we got GSS_S_COMPLETE. Get the name so we can use it
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * in log messages if we get failures decoding the PAC etc.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Then get the PAC, decode it, build the logon token.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross gss_display_name(&minor, gname, &namebuf, &name_type)) {
12b65585e720714b31036daaa2b30eb76014048eGordon Ross /* Save the user name. */
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Extract the KRB5_AUTHDATA_WIN2K_PAC data.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross kerr = krb5_pac_parse(be->be_kctx, be->be_authz_pac.value,
12b65585e720714b31036daaa2b30eb76014048eGordon Ross kerr = krb5_pac_get_buffer(be->be_kctx, be->be_kpac,
12b65585e720714b31036daaa2b30eb76014048eGordon Ross ctx->ctx_token = calloc(1, sizeof (smb_token_t));
12b65585e720714b31036daaa2b30eb76014048eGordon Ross status = smb_decode_krb5_pac(ctx->ctx_token, be->be_pac.data,
12b65585e720714b31036daaa2b30eb76014048eGordon Ross /* Success! */
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * See: GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_OID
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * and: KRB5_AUTHDATA_WIN2K_PAC
12b65585e720714b31036daaa2b30eb76014048eGordon Ross 13, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a\x81\x00" };
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * See: krb5_gss_inquire_sec_context_by_oid()
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * and krb5_gss_inquire_sec_context_by_oid_ops[],
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * gss_krb5int_extract_authz_data_from_sec_context()
12b65585e720714b31036daaa2b30eb76014048eGordon Ross gss_buffer_set_t data_set = GSS_C_NO_BUFFER_SET;
12b65585e720714b31036daaa2b30eb76014048eGordon Ross if ((data_set == GSS_C_NO_BUFFER_SET) || (data_set->count == 0)) {
12b65585e720714b31036daaa2b30eb76014048eGordon Ross /* Only need the first element? */
12b65585e720714b31036daaa2b30eb76014048eGordon Ross bcopy(data_set->elements[0].value, ad_data->value, ad_data->length);
12b65585e720714b31036daaa2b30eb76014048eGordon Ross (void) gss_release_buffer_set(&minor, &data_set);
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Get the session key, and save it in the token.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * See: krb5_gss_inquire_sec_context_by_oid(),
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * krb5_gss_inquire_sec_context_by_oid_ops[], and
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * gss_krb5int_inq_session_key
12b65585e720714b31036daaa2b30eb76014048eGordon Ross gss_buffer_set_t data_set = GSS_C_NO_BUFFER_SET;
12b65585e720714b31036daaa2b30eb76014048eGordon Ross be->be_gssctx, GSS_C_INQ_SSPI_SESSION_KEY, &data_set);
12b65585e720714b31036daaa2b30eb76014048eGordon Ross smbd_report("krb5ssp, failed to get session key, "
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * The key is in the first element
12b65585e720714b31036daaa2b30eb76014048eGordon Ross if ((keylen = data_set->elements[0].length) < SMBAUTH_HASH_SZ) {
12b65585e720714b31036daaa2b30eb76014048eGordon Ross smbd_report("krb5ssp: Session key too short (%d)",
12b65585e720714b31036daaa2b30eb76014048eGordon Ross ctx->ctx_token->tkn_ssnkey.val = malloc(keylen);