Changeset 740 for vendor/current/source3/libads/sasl.c
- Timestamp:
- Nov 14, 2012, 12:59:34 PM (12 years ago)
- File:
-
- 1 edited
-
vendor/current/source3/libads/sasl.c (modified) (21 diffs)
Legend:
- Unmodified
- Added
- Removed
-
TabularUnified vendor/current/source3/libads/sasl.c ¶
r597 r740 20 20 #include "includes.h" 21 21 #include "../libcli/auth/spnego.h" 22 #include "../libcli/auth/ntlmssp.h" 23 #include "ads.h" 24 #include "smb_krb5.h" 22 25 23 26 #ifdef HAVE_LDAP … … 30 33 NTSTATUS nt_status; 31 34 DATA_BLOB sig; 35 TALLOC_CTX *frame; 32 36 uint8 *dptr = ads->ldap.out.buf + (4 + NTLMSSP_SIG_SIZE); 33 37 38 frame = talloc_stackframe(); 34 39 /* copy the data to the right location */ 35 40 memcpy(dptr, buf, len); … … 38 43 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) { 39 44 nt_status = ntlmssp_seal_packet(ntlmssp_state, 45 frame, 40 46 dptr, len, 41 47 dptr, len, … … 43 49 } else { 44 50 nt_status = ntlmssp_sign_packet(ntlmssp_state, 51 frame, 45 52 dptr, len, 46 53 dptr, len, … … 54 61 sig.data, NTLMSSP_SIG_SIZE); 55 62 56 data_blob_free(&sig);63 TALLOC_FREE(frame); 57 64 58 65 /* set how many bytes must be written to the underlying socket */ … … 102 109 (struct ntlmssp_state *)ads->ldap.wrap_private_data; 103 110 104 ntlmssp_end(&ntlmssp_state);111 TALLOC_FREE(ntlmssp_state); 105 112 106 113 ads->ldap.wrap_ops = NULL; … … 134 141 struct ntlmssp_state *ntlmssp_state; 135 142 136 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) { 143 nt_status = ntlmssp_client_start(NULL, 144 global_myname(), 145 lp_workgroup(), 146 lp_client_ntlmv2_auth(), 147 &ntlmssp_state); 148 if (!NT_STATUS_IS_OK(nt_status)) { 137 149 return ADS_ERROR_NT(nt_status); 138 150 } … … 181 193 && blob_out.length) { 182 194 if (turn == 1) { 195 const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL}; 183 196 /* and wrap it in a SPNEGO wrapper */ 184 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out); 197 msg1 = spnego_gen_negTokenInit(talloc_tos(), 198 OIDs_ntlm, &blob_out, NULL); 185 199 } else { 186 200 /* wrap it in SPNEGO */ 187 msg1 = spnego_gen_auth( blob_out);201 msg1 = spnego_gen_auth(talloc_tos(), blob_out); 188 202 } 189 203 … … 200 214 } 201 215 202 ntlmssp_end(&ntlmssp_state);216 TALLOC_FREE(ntlmssp_state); 203 217 return ADS_ERROR(rc); 204 218 } … … 212 226 } else { 213 227 214 ntlmssp_end(&ntlmssp_state);228 TALLOC_FREE(ntlmssp_state); 215 229 data_blob_free(&blob_out); 216 230 return ADS_ERROR_NT(nt_status); … … 221 235 DATA_BLOB tmp_blob = data_blob_null; 222 236 /* the server might give us back two challenges */ 223 if (!spnego_parse_challenge( blob, &blob_in,237 if (!spnego_parse_challenge(talloc_tos(), blob, &blob_in, 224 238 &tmp_blob)) { 225 239 226 ntlmssp_end(&ntlmssp_state);240 TALLOC_FREE(ntlmssp_state); 227 241 data_blob_free(&blob); 228 242 DEBUG(3,("Failed to parse challenges\n")); … … 231 245 data_blob_free(&tmp_blob); 232 246 } else if (rc == LDAP_SASL_BIND_IN_PROGRESS) { 233 if (!spnego_parse_auth_response( blob, nt_status, OID_NTLMSSP,247 if (!spnego_parse_auth_response(talloc_tos(), blob, nt_status, OID_NTLMSSP, 234 248 &blob_in)) { 235 249 236 ntlmssp_end(&ntlmssp_state);250 TALLOC_FREE(ntlmssp_state); 237 251 data_blob_free(&blob); 238 252 DEBUG(3,("Failed to parse auth response\n")); … … 257 271 DEBUG(0, ("ads_setup_sasl_wrapping() failed: %s\n", 258 272 ads_errstr(status))); 259 ntlmssp_end(&ntlmssp_state);273 TALLOC_FREE(ntlmssp_state); 260 274 return status; 261 275 } 262 276 } else { 263 ntlmssp_end(&ntlmssp_state);277 TALLOC_FREE(ntlmssp_state); 264 278 } 265 279 … … 498 512 /* and wrap that in a shiny SPNEGO wrapper */ 499 513 unwrapped = data_blob_const(output_token.value, output_token.length); 500 wrapped = gen_negTokenTarg(spnego_mechs, unwrapped); 514 wrapped = spnego_gen_negTokenInit(talloc_tos(), 515 spnego_mechs, &unwrapped, NULL); 501 516 gss_release_buffer(&minor_status, &output_token); 502 517 if (unwrapped.length > wrapped.length) { … … 522 537 } 523 538 524 ok = spnego_parse_auth_response( wrapped, NT_STATUS_OK,539 ok = spnego_parse_auth_response(talloc_tos(), wrapped, NT_STATUS_OK, 525 540 OID_KERBEROS5_OLD, 526 541 &unwrapped); … … 630 645 } 631 646 647 648 static ADS_STATUS ads_guess_service_principal(ADS_STRUCT *ads, 649 char **returned_principal) 650 { 651 char *princ = NULL; 652 653 if (ads->server.realm && ads->server.ldap_server) { 654 char *server, *server_realm; 655 656 server = SMB_STRDUP(ads->server.ldap_server); 657 server_realm = SMB_STRDUP(ads->server.realm); 658 659 if (!server || !server_realm) { 660 SAFE_FREE(server); 661 SAFE_FREE(server_realm); 662 return ADS_ERROR(LDAP_NO_MEMORY); 663 } 664 665 strlower_m(server); 666 strupper_m(server_realm); 667 if (asprintf(&princ, "ldap/%s@%s", server, server_realm) == -1) { 668 SAFE_FREE(server); 669 SAFE_FREE(server_realm); 670 return ADS_ERROR(LDAP_NO_MEMORY); 671 } 672 673 SAFE_FREE(server); 674 SAFE_FREE(server_realm); 675 676 if (!princ) { 677 return ADS_ERROR(LDAP_NO_MEMORY); 678 } 679 } else if (ads->config.realm && ads->config.ldap_server_name) { 680 char *server, *server_realm; 681 682 server = SMB_STRDUP(ads->config.ldap_server_name); 683 server_realm = SMB_STRDUP(ads->config.realm); 684 685 if (!server || !server_realm) { 686 SAFE_FREE(server); 687 SAFE_FREE(server_realm); 688 return ADS_ERROR(LDAP_NO_MEMORY); 689 } 690 691 strlower_m(server); 692 strupper_m(server_realm); 693 if (asprintf(&princ, "ldap/%s@%s", server, server_realm) == -1) { 694 SAFE_FREE(server); 695 SAFE_FREE(server_realm); 696 return ADS_ERROR(LDAP_NO_MEMORY); 697 } 698 699 SAFE_FREE(server); 700 SAFE_FREE(server_realm); 701 702 if (!princ) { 703 return ADS_ERROR(LDAP_NO_MEMORY); 704 } 705 } 706 707 if (!princ) { 708 return ADS_ERROR(LDAP_PARAM_ERROR); 709 } 710 711 *returned_principal = princ; 712 713 return ADS_SUCCESS; 714 } 715 632 716 static ADS_STATUS ads_generate_service_principal(ADS_STRUCT *ads, 633 717 const char *given_principal, … … 697 781 } 698 782 699 rc = spnego_gen_negTokenTarg(principal, ads->auth.time_offset, &blob, &session_key, 0, 783 rc = spnego_gen_krb5_negTokenInit(talloc_tos(), principal, 784 ads->auth.time_offset, &blob, &session_key, 0, 700 785 &ads->auth.tgs_expire); 701 786 … … 772 857 /* the server sent us the first part of the SPNEGO exchange in the negprot 773 858 reply */ 774 if (!spnego_parse_negTokenInit( blob, OIDs, &given_principal) ||859 if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &given_principal, NULL) || 775 860 OIDs[0] == NULL) { 776 861 data_blob_free(&blob); … … 975 1060 output_token.length = 4; 976 1061 output_token.value = SMB_MALLOC(output_token.length); 1062 if (!output_token.value) { 1063 output_token.length = 0; 1064 status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); 1065 goto failed; 1066 } 977 1067 p = (uint8 *)output_token.value; 978 1068 … … 990 1080 991 1081 gss_rc = gss_wrap(&minor_status, context_handle,0,GSS_C_QOP_DEFAULT, 992 &output_token, &conf_state, 993 &input_token); 1082 &output_token, /* used as *input* here. */ 1083 &conf_state, 1084 &input_token); /* Used as *output* here. */ 994 1085 if (gss_rc) { 995 1086 status = ADS_ERROR_GSS(gss_rc, minor_status); 996 goto failed; 997 } 998 999 free(output_token.value); 1087 output_token.length = 0; 1088 SAFE_FREE(output_token.value); 1089 goto failed; 1090 } 1091 1092 /* We've finished with output_token. */ 1093 SAFE_FREE(output_token.value); 1094 output_token.length = 0; 1000 1095 1001 1096 cred.bv_val = (char *)input_token.value; … … 1115 1210 if (strcmp(values[j], sasl_mechanisms[i].name) == 0) { 1116 1211 DEBUG(4,("Found SASL mechanism %s\n", values[j])); 1212 retry: 1117 1213 status = sasl_mechanisms[i].fn(ads); 1214 if (status.error_type == ENUM_ADS_ERROR_LDAP && 1215 status.err.rc == LDAP_STRONG_AUTH_REQUIRED && 1216 ads->ldap.wrap_type == ADS_SASLWRAP_TYPE_PLAIN) 1217 { 1218 DEBUG(3,("SASL bin got LDAP_STRONG_AUTH_REQUIRED " 1219 "retrying with signing enabled\n")); 1220 ads->ldap.wrap_type = ADS_SASLWRAP_TYPE_SIGN; 1221 goto retry; 1222 } 1118 1223 ldap_value_free(values); 1119 1224 ldap_msgfree(res);
Note:
See TracChangeset
for help on using the changeset viewer.
