usr/src/lib/libsmbfs/smb/ssp.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21
  22 /*
  23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  */
  26
  27 /*
  28  * Security Provider glue
  29  *
  30  * Modeled after SSPI for now, only because we're currently
  31  * using the Microsoft sample spnego code.
  32  *
  33  * ToDo: Port all of this to GSS-API plugins.
  34  */
  35
  36 #include <errno.h>
  37 #include <stdio.h>
  38 #include <stdlib.h>
  39 #include <unistd.h>
  40 #include <strings.h>
  41 #include <netdb.h>
  42 #include <libintl.h>
  43 #include <xti.h>
  44 #include <assert.h>
  45
  46 #include <sys/types.h>
  47 #include <sys/time.h>
  48 #include <sys/byteorder.h>
  49 #include <sys/socket.h>
  50 #include <sys/fcntl.h>
  51
  52 #include <netinet/in.h>
  53 #include <netinet/tcp.h>
  54 #include <arpa/inet.h>
  55
  56 #include <netsmb/smb_lib.h>
  57 #include <netsmb/mchain.h>
  58
  59 #include "private.h"
  60 #include "charsets.h"
  61 #include "spnego.h"
  62 #include "derparse.h"
  63 #include "ssp.h"
  64
  65
  66 /*
  67  * ssp_ctx_create_client
  68  *
  69  * This is the first function called for SMB "extended security".
  70  * Here we select a security support provider (SSP), or mechanism,
  71  * and build the security context used throughout authentication.
  72  *
  73  * Note that we receive a "hint" in the SMB Negotiate response
  74  * that contains the list of mechanisms supported by the server.
  75  * We use this to help us select a mechanism.
  76  *
  77  * With SSPI this would call:
  78  *      ssp->InitSecurityInterface()
  79  *      ssp->AcquireCredentialsHandle()
  80  *      ssp->InitializeSecurityContext()
  81  * With GSS-API this will become:
  82  *      gss_import_name(... service_principal_name)
  83  *      gss_init_sec_context(), etc.
  84  */
  85 int
  86 ssp_ctx_create_client(struct smb_ctx *ctx, struct mbdata *hint_mb)
  87 {
  88         struct ssp_ctx *sp;
  89         mbuf_t *m;
  90         SPNEGO_MECH_OID oid;
  91         int indx, rc;
  92         int err = ENOTSUP; /* in case nothing matches */
  93
  94         sp = malloc(sizeof (*sp));
  95         if (sp == NULL)
  96                 return (ENOMEM);
  97         bzero(sp, sizeof (*sp));
  98         ctx->ct_ssp_ctx = sp;
  99         sp->smb_ctx = ctx;
 100
 101         /*
 102          * Parse the SPNEGO "hint" to get the server's list of
 103          * supported mechanisms.  If the "hint" is empty,
 104          * assume NTLMSSP.  (Or could use "raw NTLMSSP")
 105          */
 106         m = hint_mb->mb_top;
 107         if (m == NULL)
 108                 goto use_ntlm;
 109         rc = spnegoInitFromBinary((uchar_t *)m->m_data, m->m_len,
 110             &sp->sp_hint);
 111         if (rc) {
 112                 DPRINT("parse hint, rc %d", rc);
 113                 goto use_ntlm;
 114         }
 115
 116         /*
 117          * Did the server offer Kerberos?
 118          * Either spec. OID or legacy is OK,
 119          * but have to remember what we got.
 120          */
 121         oid = spnego_mech_oid_NotUsed;
 122         if (0 == spnegoIsMechTypeAvailable(sp->sp_hint,
 123             spnego_mech_oid_Kerberos_V5, &indx))
 124                 oid = spnego_mech_oid_Kerberos_V5;
 125         else if (0 == spnegoIsMechTypeAvailable(sp->sp_hint,
 126             spnego_mech_oid_Kerberos_V5_Legacy, &indx))
 127                 oid = spnego_mech_oid_Kerberos_V5_Legacy;
 128         if (oid != spnego_mech_oid_NotUsed) {
 129                 /*
 130                  * Yes! Server offers Kerberos.
 131                  * Try to init our krb5 mechanism.
 132                  * It will fail if the calling user
 133                  * does not have krb5 credentials.
 134                  */
 135                 sp->sp_mech = oid;
 136                 err = krb5ssp_init_client(sp);
 137                 if (err == 0) {
 138                         DPRINT("using Kerberos");
 139                         return (0);
 140                 }
 141                 /* else fall back to NTLMSSP */
 142         }
 143
 144         /*
 145          * Did the server offer NTLMSSP?
 146          */
 147         if (0 == spnegoIsMechTypeAvailable(sp->sp_hint,
 148             spnego_mech_oid_NTLMSSP, &indx)) {
 149                 /*
 150                  * OK, we'll use NTLMSSP
 151                  */
 152         use_ntlm:
 153                 sp->sp_mech = spnego_mech_oid_NTLMSSP;
 154                 err = ntlmssp_init_client(sp);
 155                 if (err == 0) {
 156                         DPRINT("using NTLMSSP");
 157                         return (0);
 158                 }
 159         }
 160
 161         /* No supported mechanisms! */
 162         return (err);
 163 }
 164
 165
 166 /*
 167  * ssp_ctx_destroy
 168  *
 169  * Dispatch to the mechanism-specific destroy.
 170  */
 171 void
 172 ssp_ctx_destroy(struct smb_ctx *ctx)
 173 {
 174         ssp_ctx_t *sp;
 175
 176         sp = ctx->ct_ssp_ctx;
 177         ctx->ct_ssp_ctx = NULL;
 178
 179         if (sp == NULL)
 180                 return;
 181
 182         if (sp->sp_destroy != NULL)
 183                 (sp->sp_destroy)(sp);
 184
 185         if (sp->sp_hint != NULL)
 186                 spnegoFreeData(sp->sp_hint);
 187
 188         free(sp);
 189 }
 190
 191
 192 /*
 193  * ssp_ctx_next_token
 194  *
 195  * This is the function called to generate the next token to send,
 196  * given a token just received, using the selected back-end method.
 197  * The back-end method is called a security service provider (SSP).
 198  *
 199  * This is also called to generate the first token to send
 200  * (when called with caller_in == NULL) and to handle the last
 201  * token received (when called with caller_out == NULL).
 202  * See caller: smb_ssnsetup_spnego
 203  *
 204  * Note that if the back-end SSP "next token" function ever
 205  * returns an error, the conversation ends, and there are
 206  * no further calls to this function for this context.
 207  *
 208  * General outline of this funcion:
 209  *      if (caller_in)
 210  *              Unwrap caller_in spnego blob,
 211  *              store payload in body_in
 212  *      Call back-end SSP "next token" method (body_in, body_out)
 213  *      if (caller_out)
 214  *              Wrap returned body_out in spnego,
 215  *              store in caller_out
 216  *
 217  * With SSPI this would call:
 218  *      ssp->InitializeSecurityContext()
 219  * With GSS-API this will become:
 220  *      gss_init_sec_context()
 221  */
 222 int
 223 ssp_ctx_next_token(struct smb_ctx *ctx,
 224         struct mbdata *caller_in,
 225         struct mbdata *caller_out)
 226 {
 227         struct mbdata body_in, body_out;
 228         SPNEGO_TOKEN_HANDLE stok_in, stok_out;
 229         SPNEGO_NEGRESULT result;
 230         ssp_ctx_t *sp;
 231         struct mbuf *m;
 232         ulong_t toklen;
 233         int err, rc;
 234
 235         bzero(&body_in, sizeof (body_in));
 236         bzero(&body_out, sizeof (body_out));
 237         stok_out = stok_in = NULL;
 238         sp = ctx->ct_ssp_ctx;
 239
 240         /*
 241          * If we have an spnego input token, parse it,
 242          * extract the payload for the back-end SSP.
 243          */
 244         if (caller_in != NULL) {
 245
 246                 /*
 247                  * Let the spnego code parse it.
 248                  */
 249                 m = caller_in->mb_top;
 250                 rc = spnegoInitFromBinary((uchar_t *)m->m_data,
 251                     m->m_len, &stok_in);
 252                 if (rc) {
 253                         DPRINT("parse reply, rc %d", rc);
 254                         err = EBADRPC;
 255                         goto out;
 256                 }
 257                 /* Note: Allocated stok_in  */
 258
 259                 /*
 260                  * Now get the payload.  Two calls:
 261                  * first gets the size, 2nd the data.
 262                  *
 263                  * Expect SPNEGO_E_BUFFER_TOO_SMALL here,
 264                  * but if the payload is missing, we'll
 265                  * get SPNEGO_E_ELEMENT_UNAVAILABLE.
 266                  */
 267                 rc = spnegoGetMechToken(stok_in, NULL, &toklen);
 268                 switch (rc) {
 269                 case SPNEGO_E_ELEMENT_UNAVAILABLE:
 270                         toklen = 0;
 271                         break;
 272                 case SPNEGO_E_BUFFER_TOO_SMALL:
 273                         /* have toklen */
 274                         break;
 275                 default:
 276                         DPRINT("GetMechTok1, rc %d", rc);
 277                         err = EBADRPC;
 278                         goto out;
 279                 }
 280                 err = mb_init_sz(&body_in, (size_t)toklen);
 281                 if (err)
 282                         goto out;
 283                 m = body_in.mb_top;
 284                 if (toklen > 0) {
 285                         rc = spnegoGetMechToken(stok_in,
 286                             (uchar_t *)m->m_data, &toklen);
 287                         if (rc) {
 288                                 DPRINT("GetMechTok2, rc %d", rc);
 289                                 err = EBADRPC;
 290                                 goto out;
 291                         }
 292                         body_in.mb_count = m->m_len = (size_t)toklen;
 293                 }
 294         }
 295
 296         /*
 297          * Call the back-end security provider (SSP) to
 298          * handle the received token (if present) and
 299          * generate an output token (if requested).
 300          */
 301         err = sp->sp_nexttok(sp,
 302             caller_in ? &body_in : NULL,
 303             caller_out ? &body_out : NULL);
 304         if (err)
 305                 goto out;
 306
 307         /*
 308          * Wrap the outgoing body if requested,
 309          * either negTokenInit on first call, or
 310          * negTokenTarg on subsequent calls.
 311          */
 312         if (caller_out != NULL) {
 313                 m = body_out.mb_top;
 314
 315                 if (caller_in == NULL) {
 316                         /*
 317                          * This is the first call, so create a
 318                          * negTokenInit.
 319                          */
 320                         rc = spnegoCreateNegTokenInit(
 321                             sp->sp_mech, 0,
 322                             (uchar_t *)m->m_data, m->m_len,
 323                             NULL, 0, &stok_out);
 324                         /* Note: allocated stok_out */
 325                 } else {
 326                         /*
 327                          * Note: must pass spnego_mech_oid_NotUsed,
 328                          * instead of sp->sp_mech so that the spnego
 329                          * code will not marshal a mech OID list.
 330                          * The mechanism is determined at this point,
 331                          * and some servers won't parse an unexpected
 332                          * mech. OID list in a negTokenTarg
 333                          */
 334                         rc = spnegoCreateNegTokenTarg(
 335                             spnego_mech_oid_NotUsed,
 336                             spnego_negresult_NotUsed,
 337                             (uchar_t *)m->m_data, m->m_len,
 338                             NULL, 0, &stok_out);
 339                         /* Note: allocated stok_out */
 340                 }
 341                 if (rc) {
 342                         DPRINT("CreateNegTokenX, rc 0x%x", rc);
 343                         err = EBADRPC;
 344                         goto out;
 345                 }
 346
 347                 /*
 348                  * Copy binary from stok_out to caller_out
 349                  * Two calls: get the size, get the data.
 350                  */
 351                 rc = spnegoTokenGetBinary(stok_out, NULL, &toklen);
 352                 if (rc != SPNEGO_E_BUFFER_TOO_SMALL) {
 353                         DPRINT("GetBinary1, rc 0x%x", rc);
 354                         err = EBADRPC;
 355                         goto out;
 356                 }
 357                 err = mb_init_sz(caller_out, (size_t)toklen);
 358                 if (err)
 359                         goto out;
 360                 m = caller_out->mb_top;
 361                 rc = spnegoTokenGetBinary(stok_out,
 362                     (uchar_t *)m->m_data, &toklen);
 363                 if (rc) {
 364                         DPRINT("GetBinary2, rc 0x%x", rc);
 365                         err = EBADRPC;
 366                         goto out;
 367                 }
 368                 caller_out->mb_count = m->m_len = (size_t)toklen;
 369         } else {
 370                 /*
 371                  * caller_out == NULL, so this is the "final" call.
 372                  * Get final SPNEGO result from the INPUT token.
 373                  */
 374                 rc = spnegoGetNegotiationResult(stok_in, &result);
 375                 if (rc) {
 376                         DPRINT("rc 0x%x", rc);
 377                         err = EBADRPC;
 378                         goto out;
 379                 }
 380                 DPRINT("spnego result: 0x%x", result);
 381                 if (result != spnego_negresult_success) {
 382                         err = EAUTH;
 383                         goto out;
 384                 }
 385         }
 386         err = 0;
 387
 388 out:
 389         mb_done(&body_in);
 390         mb_done(&body_out);
 391         spnegoFreeData(stok_in);
 392         spnegoFreeData(stok_out);
 393
 394         return (err);
 395 }