/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright (c) 2008, 2012, Oracle and/or its affiliates. All rights reserved.
*/
/*
* Security Provider glue
*
* Modeled after SSPI for now, only because we're currently
* using the Microsoft sample spnego code.
*
* ToDo: Port all of this to GSS-API plugins.
*/
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <strings.h>
#include <netdb.h>
#include <libintl.h>
#include <xti.h>
#include <assert.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/byteorder.h>
#include <sys/socket.h>
#include <sys/fcntl.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include "smbfs_lib.h"
#include <netsmb/mchain.h>
#include <smb/spnego.h>
#include <smb/ntstatus.h>
#include "smbfs_private.h"
#include "smbfs_charsets.h"
#include "smbfs_derparse.h"
#include "smbfs_ssp.h"
/*
* smbfs_ssp_ctx_create_client
*
* This is the first function called for SMB "extended security".
* Here we select a security support provider (SSP), or mechanism,
* and build the security context used throughout authentication.
*
* Note that we receive a "hint" in the SMB Negotiate response
* that contains the list of mechanisms supported by the server.
* We use this to help us select a mechanism.
*
* With SSPI this would call:
* ssp->InitSecurityInterface()
* ssp->AcquireCredentialsHandle()
* ssp->InitializeSecurityContext()
* With GSS-API this will become:
* gss_import_name(... service_principal_name)
* gss_init_sec_context(), etc.
*/
static int
smbfs_ssp_ctx_create_client(struct smb_ctx *ctx, struct mbdata *hint_mb)
{
struct ssp_ctx *sp;
mbuf_t *m;
int indx, rc;
int err = ENOTSUP; /* in case nothing matches */
sp = malloc(sizeof (*sp));
if (sp == NULL)
return (ENOMEM);
bzero(sp, sizeof (*sp));
ctx->ct_ssp_ctx = sp;
sp->smb_ctx = ctx;
/*
* Parse the SPNEGO "hint" to get the server's list of
* supported mechanisms. If the "hint" is empty,
* assume NTLMSSP. (Or could use "raw NTLMSSP")
*/
m = hint_mb->mb_top;
if (m == NULL)
goto use_ntlm;
rc = smbfs_spnegoInitFromBinary((uchar_t *)m->m_data, m->m_len,
&sp->sp_hint);
if (rc) {
DPRINT("parse hint, rc %d", rc);
goto use_ntlm;
}
/*
* Did the server offer NTLMSSP?
*/
if (0 == smbfs_spnegoIsMechTypeAvailable(sp->sp_hint,
spnego_mech_oid_NTLMSSP, &indx)) {
/*
* OK, we'll use NTLMSSP
*/
use_ntlm:
sp->sp_mech = spnego_mech_oid_NTLMSSP;
err = smbfs_ntlmssp_init_client(sp);
if (err == 0) {
DPRINT("using NTLMSSP");
return (0);
}
}
/* No supported mechanisms! */
return (err);
}
/*
* smbfs_ssp_ctx_destroy
*
* Dispatch to the mechanism-specific destroy.
*/
static void
smbfs_ssp_ctx_destroy(struct smb_ctx *ctx)
{
ssp_ctx_t *sp;
sp = ctx->ct_ssp_ctx;
ctx->ct_ssp_ctx = NULL;
if (sp == NULL)
return;
if (sp->sp_destroy != NULL)
(sp->sp_destroy)(sp);
if (sp->sp_hint != NULL)
smbfs_spnegoFreeData(sp->sp_hint);
free(sp);
}
/*
* smbfs_ssp_ctx_next_token
*
* This is the function called to generate the next token to send,
* given a token just received, using the selected back-end method.
* The back-end method is called a security service provider (SSP).
*
* This is also called to generate the first token to send
* (when called with caller_in == NULL) and to handle the last
* token received (when called with caller_out == NULL).
* See caller: smb_ssnsetup_spnego
*
* Note that if the back-end SSP "next token" function ever
* returns an error, the conversation ends, and there are
* no further calls to this function for this context.
*
* General outline of this funcion:
* if (caller_in)
* Unwrap caller_in spnego blob,
* store payload in body_in
* Call back-end SSP "next token" method (body_in, body_out)
* if (caller_out)
* Wrap returned body_out in spnego,
* store in caller_out
*
* With SSPI this would call:
* ssp->InitializeSecurityContext()
* With GSS-API this will become:
* gss_init_sec_context()
*/
static int
smbfs_ssp_ctx_next_token(struct smb_ctx *ctx,
struct mbdata *caller_in,
struct mbdata *caller_out)
{
struct mbdata body_in, body_out;
SPNEGO_TOKEN_HANDLE stok_in, stok_out;
SPNEGO_NEGRESULT result;
ssp_ctx_t *sp;
struct mbuf *m;
ulong_t toklen;
int err, rc;
bzero(&body_in, sizeof (body_in));
bzero(&body_out, sizeof (body_out));
stok_out = stok_in = NULL;
sp = ctx->ct_ssp_ctx;
/*
* If we have an spnego input token, parse it,
* extract the payload for the back-end SSP.
*/
if (caller_in != NULL) {
/*
* Let the spnego code parse it.
*/
m = caller_in->mb_top;
rc = smbfs_spnegoInitFromBinary((uchar_t *)m->m_data,
m->m_len, &stok_in);
if (rc) {
DPRINT("parse reply, rc %d", rc);
err = EBADRPC;
goto out;
}
/* Note: Allocated stok_in */
/*
* Now get the payload. Two calls:
* first gets the size, 2nd the data.
*
* Expect SPNEGO_E_BUFFER_TOO_SMALL here,
* but if the payload is missing, we'll
* get SPNEGO_E_ELEMENT_UNAVAILABLE.
*/
rc = smbfs_spnegoGetMechToken(stok_in, NULL, &toklen);
switch (rc) {
case SPNEGO_E_ELEMENT_UNAVAILABLE:
toklen = 0;
break;
case SPNEGO_E_BUFFER_TOO_SMALL:
/* have toklen */
break;
default:
DPRINT("GetMechTok1, rc %d", rc);
err = EBADRPC;
goto out;
}
err = smbfs_mb_init_sz(&body_in, (size_t)toklen);
if (err)
goto out;
m = body_in.mb_top;
if (toklen > 0) {
rc = smbfs_spnegoGetMechToken(stok_in,
(uchar_t *)m->m_data, &toklen);
if (rc) {
DPRINT("GetMechTok2, rc %d", rc);
err = EBADRPC;
goto out;
}
body_in.mb_count = m->m_len = (size_t)toklen;
}
}
/*
* Call the back-end security provider (SSP) to
* handle the received token (if present) and
* generate an output token (if requested).
*/
err = sp->sp_nexttok(sp,
caller_in ? &body_in : NULL,
caller_out ? &body_out : NULL);
if (err)
goto out;
/*
* Wrap the outgoing body if requested,
* either negTokenInit on first call, or
* negTokenTarg on subsequent calls.
*/
if (caller_out != NULL) {
m = body_out.mb_top;
if (caller_in == NULL) {
/*
* This is the first call, so create a
* negTokenInit.
*/
rc = smbfs_spnegoCreateNegTokenInit(
sp->sp_mech, 0,
(uchar_t *)m->m_data, m->m_len,
NULL, 0, &stok_out);
/* Note: allocated stok_out */
} else {
/*
* Note: must pass spnego_mech_oid_NotUsed,
* instead of sp->sp_mech so that the spnego
* code will not marshal a mech OID list.
* The mechanism is determined at this point,
* and some servers won't parse an unexpected
* mech. OID list in a negTokenTarg
*/
rc = smbfs_spnegoCreateNegTokenTarg(
spnego_mech_oid_NotUsed,
spnego_negresult_NotUsed,
(uchar_t *)m->m_data, m->m_len,
NULL, 0, &stok_out);
/* Note: allocated stok_out */
}
if (rc) {
DPRINT("CreateNegTokenX, rc 0x%x", rc);
err = EBADRPC;
goto out;
}
/*
* Copy binary from stok_out to caller_out
* Two calls: get the size, get the data.
*/
rc = smbfs_spnegoTokenGetBinary(stok_out, NULL, &toklen);
if (rc != SPNEGO_E_BUFFER_TOO_SMALL) {
DPRINT("GetBinary1, rc 0x%x", rc);
err = EBADRPC;
goto out;
}
err = smbfs_mb_init_sz(caller_out, (size_t)toklen);
if (err)
goto out;
m = caller_out->mb_top;
rc = smbfs_spnegoTokenGetBinary(stok_out,
(uchar_t *)m->m_data, &toklen);
if (rc) {
DPRINT("GetBinary2, rc 0x%x", rc);
err = EBADRPC;
goto out;
}
caller_out->mb_count = m->m_len = (size_t)toklen;
} else {
/*
* caller_out == NULL, so this is the "final" call.
* Get final SPNEGO result from the INPUT token.
*/
rc = smbfs_spnegoGetNegotiationResult(stok_in, &result);
if (rc) {
DPRINT("rc 0x%x", rc);
err = EBADRPC;
goto out;
}
DPRINT("spnego result: 0x%x", result);
if (result != spnego_negresult_success) {
err = EAUTH;
goto out;
}
}
err = 0;
out:
smbfs_mb_done(&body_in);
smbfs_mb_done(&body_out);
smbfs_spnegoFreeData(stok_in);
smbfs_spnegoFreeData(stok_out);
return (err);
}
/*
* smbfs_ssp_init_sec
*
* Establishes security context using security provider glue, roughly modeled
* on Microsoft SSPI. It will negotiate NTLMSSP authentication mechanism.
*/
int
smbfs_ssp_init_sec(struct smb_ctx *ctx, struct mbdata *hint_mb)
{
struct mbdata send_mb, recv_mb;
int err;
uint32_t ntstatus;
uint16_t action = 0;
err = smbfs_ssp_ctx_create_client(ctx, hint_mb);
if (err)
goto out;
bzero(&send_mb, sizeof (send_mb));
bzero(&recv_mb, sizeof (recv_mb));
/* NULL input indicates first call. */
err = smbfs_ssp_ctx_next_token(ctx, NULL, &send_mb);
if (err)
goto out;
for (;;) {
err = smbfs_ssnsetup(ctx, &send_mb, &recv_mb,
&ntstatus, &action);
if (err)
goto out;
ctx->ct_ntstatus = ntstatus;
if (ntstatus == 0)
break;
if (ntstatus != NT_STATUS_MORE_PROCESSING_REQUIRED) {
err = EAUTH;
goto out;
}
/* middle calls get both in, out */
err = smbfs_ssp_ctx_next_token(ctx, &recv_mb, &send_mb);
if (err)
goto out;
}
DPRINT("status 0x%x action 0x%x", ntstatus, (int)action);
/* NULL output indicates last call. */
(void) smbfs_ssp_ctx_next_token(ctx, &recv_mb, NULL);
out:
smbfs_ssp_ctx_destroy(ctx);
return (err);
}