The branch, v3-2-test has been updated via 3ed2c65bde0c2e5ad10cf777dae8a2d3e626a42c (commit) via 59a2bcf30fef14ecc826271862b645dd3a61cb48 (commit) via fd168e7b5065ba15b1cf56522b6810b8e6fdd7d5 (commit) from 04cd914a1f12691d27ddc67887a757cd813848a7 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-2-test - Log ----------------------------------------------------------------- commit 3ed2c65bde0c2e5ad10cf777dae8a2d3e626a42c Author: James Peach <[EMAIL PROTECTED]> Date: Mon Apr 7 15:28:10 2008 -0700 Remove unused variable. commit 59a2bcf30fef14ecc826271862b645dd3a61cb48 Author: Bill Ricker <[EMAIL PROTECTED]> Date: Mon Apr 7 15:02:56 2008 -0700 Fix Kerberos interop with Mac OS X 10.5 clients. Ignore optional req_flags. Use the Kerberos mechanism OID negotiated with the client rather than hardcoding OID_KERBEROS5_OLD. commit fd168e7b5065ba15b1cf56522b6810b8e6fdd7d5 Author: James Peach <[EMAIL PROTECTED]> Date: Mon Apr 7 15:00:41 2008 -0700 Use bool for BOOL and true/false for True/False. We need lowercase bool to get the declarations picked up by the prototype parser. ----------------------------------------------------------------------- Summary of changes: source/libsmb/asn1.c | 139 ++++++++++++++++++++++++-------------------- source/libsmb/clispnego.c | 12 ++++ source/smbd/seal.c | 8 ++- source/smbd/sesssetup.c | 49 +++++++++------- 4 files changed, 121 insertions(+), 87 deletions(-) Changeset truncated at 500 lines: diff --git a/source/libsmb/asn1.c b/source/libsmb/asn1.c index 99c5b0b..bdbe49b 100644 --- a/source/libsmb/asn1.c +++ b/source/libsmb/asn1.c @@ -36,19 +36,19 @@ void asn1_free(ASN1_DATA *data) /* write to the ASN1 buffer, advancing the buffer pointer */ bool asn1_write(ASN1_DATA *data, const void *p, int len) { - if (data->has_error) return False; + if (data->has_error) return false; if (data->length < data->ofs+len) { data->data = SMB_REALLOC_ARRAY(data->data, unsigned char, data->ofs+len); if (!data->data) { - data->has_error = True; - return False; + data->has_error = true; + return false; } data->length = data->ofs+len; } memcpy(data->data + data->ofs, p, len); data->ofs += len; - return True; + return true; } /* useful fn for writing a uint8 */ @@ -65,8 +65,8 @@ bool asn1_push_tag(ASN1_DATA *data, uint8 tag) asn1_write_uint8(data, tag); nesting = SMB_MALLOC_P(struct nesting); if (!nesting) { - data->has_error = True; - return False; + data->has_error = true; + return false; } nesting->start = data->ofs; @@ -82,14 +82,14 @@ bool asn1_pop_tag(ASN1_DATA *data) size_t len; if (data->has_error) { - return False; + return false; } nesting = data->nesting; if (!nesting) { - data->has_error = True; - return False; + data->has_error = true; + return false; } len = data->ofs - (nesting->start+1); /* yes, this is ugly. We don't know in advance how many bytes the length @@ -97,23 +97,23 @@ bool asn1_pop_tag(ASN1_DATA *data) need to correct our mistake */ if (len > 0xFFFF) { data->data[nesting->start] = 0x83; - if (!asn1_write_uint8(data, 0)) return False; - if (!asn1_write_uint8(data, 0)) return False; - if (!asn1_write_uint8(data, 0)) return False; + if (!asn1_write_uint8(data, 0)) return false; + if (!asn1_write_uint8(data, 0)) return false; + if (!asn1_write_uint8(data, 0)) return false; memmove(data->data+nesting->start+4, data->data+nesting->start+1, len); data->data[nesting->start+1] = (len>>16) & 0xFF; data->data[nesting->start+2] = (len>>8) & 0xFF; data->data[nesting->start+3] = len&0xff; } else if (len > 255) { data->data[nesting->start] = 0x82; - if (!asn1_write_uint8(data, 0)) return False; - if (!asn1_write_uint8(data, 0)) return False; + if (!asn1_write_uint8(data, 0)) return false; + if (!asn1_write_uint8(data, 0)) return false; memmove(data->data+nesting->start+3, data->data+nesting->start+1, len); data->data[nesting->start+1] = len>>8; data->data[nesting->start+2] = len&0xff; } else if (len > 127) { data->data[nesting->start] = 0x81; - if (!asn1_write_uint8(data, 0)) return False; + if (!asn1_write_uint8(data, 0)) return false; memmove(data->data+nesting->start+2, data->data+nesting->start+1, len); data->data[nesting->start+1] = len; } else { @@ -122,14 +122,14 @@ bool asn1_pop_tag(ASN1_DATA *data) data->nesting = nesting->next; free(nesting); - return True; + return true; } /* write an integer */ bool asn1_write_Integer(ASN1_DATA *data, int i) { - if (!asn1_push_tag(data, ASN1_INTEGER)) return False; + if (!asn1_push_tag(data, ASN1_INTEGER)) return false; do { asn1_write_uint8(data, i); i = i >> 8; @@ -145,13 +145,13 @@ bool asn1_write_OID(ASN1_DATA *data, const char *OID) char *newp; if (!asn1_push_tag(data, ASN1_OID)) - return False; + return false; v = strtol(p, &newp, 10); p = newp; v2 = strtol(p, &newp, 10); p = newp; if (!asn1_write_uint8(data, 40*v + v2)) - return False; + return false; while (*p) { v = strtol(p, &newp, 10); @@ -161,7 +161,7 @@ bool asn1_write_OID(ASN1_DATA *data, const char *OID) if (v >= (1<<14)) asn1_write_uint8(data, 0x80 | ((v>>14)&0xff)); if (v >= (1<<7)) asn1_write_uint8(data, 0x80 | ((v>>7)&0xff)); if (!asn1_write_uint8(data, v&0x7f)) - return False; + return false; } return asn1_pop_tag(data); } @@ -209,13 +209,13 @@ bool asn1_check_BOOLEAN(ASN1_DATA *data, bool v) asn1_read_uint8(data, &b); if (b != ASN1_BOOLEAN) { - data->has_error = True; - return False; + data->has_error = true; + return false; } asn1_read_uint8(data, &b); if (b != v) { - data->has_error = True; - return False; + data->has_error = true; + return false; } return !data->has_error; } @@ -227,31 +227,31 @@ bool asn1_load(ASN1_DATA *data, DATA_BLOB blob) ZERO_STRUCTP(data); data->data = (unsigned char *)memdup(blob.data, blob.length); if (!data->data) { - data->has_error = True; - return False; + data->has_error = true; + return false; } data->length = blob.length; - return True; + return true; } /* read from a ASN1 buffer, advancing the buffer pointer */ bool asn1_read(ASN1_DATA *data, void *p, int len) { if (data->has_error) - return False; + return false; if (len < 0 || data->ofs + len < data->ofs || data->ofs + len < len) { - data->has_error = True; - return False; + data->has_error = true; + return false; } if (data->ofs + len > data->length) { - data->has_error = True; - return False; + data->has_error = true; + return false; } memcpy(p, data->data + data->ofs, len); data->ofs += len; - return True; + return true; } /* read a uint8 from a ASN1 buffer */ @@ -260,6 +260,19 @@ bool asn1_read_uint8(ASN1_DATA *data, uint8 *v) return asn1_read(data, v, 1); } +/* + * Check thta the value of the ASN1 buffer at the current offset equals tag. + */ +bool asn1_check_tag(ASN1_DATA *data, uint8 tag) +{ + if (data->has_error || data->ofs >= data->length || data->ofs < 0) { + data->has_error = true; + return false; + } + + return (tag == data->data[data->ofs]); +} + /* start reading a nested asn1 structure */ bool asn1_start_tag(ASN1_DATA *data, uint8 tag) { @@ -267,34 +280,34 @@ bool asn1_start_tag(ASN1_DATA *data, uint8 tag) struct nesting *nesting; if (!asn1_read_uint8(data, &b)) - return False; + return false; if (b != tag) { - data->has_error = True; - return False; + data->has_error = true; + return false; } nesting = SMB_MALLOC_P(struct nesting); if (!nesting) { - data->has_error = True; - return False; + data->has_error = true; + return false; } if (!asn1_read_uint8(data, &b)) { SAFE_FREE(nesting); - return False; + return false; } if (b & 0x80) { int n = b & 0x7f; if (!asn1_read_uint8(data, &b)) { SAFE_FREE(nesting); - return False; + return false; } nesting->taglen = b; while (n > 1) { if (!asn1_read_uint8(data, &b)) { SAFE_FREE(nesting); - return False; + return false; } nesting->taglen = (nesting->taglen << 8) | b; n--; @@ -316,20 +329,20 @@ bool asn1_end_tag(ASN1_DATA *data) /* make sure we read it all */ if (asn1_tag_remaining(data) != 0) { - data->has_error = True; - return False; + data->has_error = true; + return false; } nesting = data->nesting; if (!nesting) { - data->has_error = True; - return False; + data->has_error = true; + return false; } data->nesting = nesting->next; free(nesting); - return True; + return true; } /* work out how many bytes are left in this nested tag */ @@ -339,7 +352,7 @@ int asn1_tag_remaining(ASN1_DATA *data) return 0; if (!data->nesting) { - data->has_error = True; + data->has_error = true; return -1; } return data->nesting->taglen - (data->ofs - data->nesting->start); @@ -407,15 +420,15 @@ bool asn1_check_OID(ASN1_DATA *data, const char *OID) char *id; if (!asn1_read_OID(data, &id)) { - return False; + return false; } if (strcmp(id, OID) != 0) { - data->has_error = True; - return False; + data->has_error = true; + return false; } free(id); - return True; + return true; } /* read a GeneralString from a ASN1 buffer */ @@ -427,17 +440,17 @@ bool asn1_read_GeneralString(ASN1_DATA *data, char **s) *s = NULL; if (!asn1_start_tag(data, ASN1_GENERAL_STRING)) { - return False; + return false; } len = asn1_tag_remaining(data); if (len < 0) { - data->has_error = True; - return False; + data->has_error = true; + return false; } str = SMB_MALLOC_ARRAY(char, len+1); if (!str) { - data->has_error = True; - return False; + data->has_error = true; + return false; } asn1_read(data, str, len); str[len] = 0; @@ -454,11 +467,11 @@ bool asn1_read_OctetString(ASN1_DATA *data, DATA_BLOB *blob) { int len; ZERO_STRUCTP(blob); - if (!asn1_start_tag(data, ASN1_OCTET_STRING)) return False; + if (!asn1_start_tag(data, ASN1_OCTET_STRING)) return false; len = asn1_tag_remaining(data); if (len < 0) { - data->has_error = True; - return False; + data->has_error = true; + return false; } *blob = data_blob(NULL, len); asn1_read(data, blob->data, len); @@ -472,7 +485,7 @@ bool asn1_read_Integer(ASN1_DATA *data, int *i) uint8 b; *i = 0; - if (!asn1_start_tag(data, ASN1_INTEGER)) return False; + if (!asn1_start_tag(data, ASN1_INTEGER)) return false; while (asn1_tag_remaining(data)>0) { asn1_read_uint8(data, &b); *i = (*i << 8) + b; @@ -485,12 +498,12 @@ bool asn1_read_Integer(ASN1_DATA *data, int *i) bool asn1_check_enumerated(ASN1_DATA *data, int v) { uint8 b; - if (!asn1_start_tag(data, ASN1_ENUMERATED)) return False; + if (!asn1_start_tag(data, ASN1_ENUMERATED)) return false; asn1_read_uint8(data, &b); asn1_end_tag(data); if (v != b) - data->has_error = False; + data->has_error = false; return !data->has_error; } @@ -498,7 +511,7 @@ bool asn1_check_enumerated(ASN1_DATA *data, int v) /* write an enumarted value to the stream */ bool asn1_write_enumerated(ASN1_DATA *data, uint8 v) { - if (!asn1_push_tag(data, ASN1_ENUMERATED)) return False; + if (!asn1_push_tag(data, ASN1_ENUMERATED)) return false; asn1_write_uint8(data, v); asn1_pop_tag(data); return !data->has_error; diff --git a/source/libsmb/clispnego.c b/source/libsmb/clispnego.c index a75032a..fa9dba0 100644 --- a/source/libsmb/clispnego.c +++ b/source/libsmb/clispnego.c @@ -246,6 +246,18 @@ bool parse_negTokenTarg(DATA_BLOB blob, char *OIDs[ASN1_MAX_OIDS], DATA_BLOB *se asn1_end_tag(&data); asn1_end_tag(&data); + /* Skip any optional req_flags that are sent per RFC 4178 */ + if (asn1_check_tag(&data, ASN1_CONTEXT(1))) { + uint8 flags; + + asn1_start_tag(&data, ASN1_CONTEXT(1)); + asn1_start_tag(&data, ASN1_BITFIELD); + while (asn1_tag_remaining(&data) > 0) + asn1_read_uint8(&data, &flags); + asn1_end_tag(&data); + asn1_end_tag(&data); + } + asn1_start_tag(&data, ASN1_CONTEXT(2)); asn1_read_OctetString(&data,secblob); asn1_end_tag(&data); diff --git a/source/smbd/seal.c b/source/smbd/seal.c index d4394e5..e9dc46a 100644 --- a/source/smbd/seal.c +++ b/source/smbd/seal.c @@ -483,11 +483,11 @@ static NTSTATUS srv_enc_spnego_negotiate(connection_struct *conn, NTSTATUS status; DATA_BLOB blob = data_blob_null; DATA_BLOB secblob = data_blob_null; - bool got_kerberos_mechanism = false; + char *kerb_mech = NULL; blob = data_blob_const(*ppdata, *p_data_size); - status = parse_spnego_mechanisms(blob, &secblob, &got_kerberos_mechanism); + status = parse_spnego_mechanisms(blob, &secblob, &kerb_mech); if (!NT_STATUS_IS_OK(status)) { return nt_status_squash(status); } @@ -496,7 +496,9 @@ static NTSTATUS srv_enc_spnego_negotiate(connection_struct *conn, srv_free_encryption_context(&partial_srv_trans_enc_ctx); - if (got_kerberos_mechanism) { + if (kerb_mech) { + SAFE_FREE(kerb_mech); + #if defined(HAVE_GSSAPI) && defined(HAVE_KRB5) status = srv_enc_spnego_gss_negotiate(ppdata, p_data_size, secblob); #else diff --git a/source/smbd/sesssetup.c b/source/smbd/sesssetup.c index e0739ef..33a54dd 100644 --- a/source/smbd/sesssetup.c +++ b/source/smbd/sesssetup.c @@ -248,6 +248,7 @@ static bool make_krb5_skew_error(DATA_BLOB *pblob_out) static void reply_spnego_kerberos(struct smb_request *req, DATA_BLOB *secblob, + const char *mechOID, uint16 vuid, bool *p_invalidate_vuid) { @@ -598,7 +599,7 @@ static void reply_spnego_kerberos(struct smb_request *req, ap_rep_wrapped = data_blob_null; } response = spnego_gen_auth_response(&ap_rep_wrapped, ret, - OID_KERBEROS5_OLD); + mechOID); reply_sesssetup_blob(req, response, ret); data_blob_free(&ap_rep); @@ -709,13 +710,15 @@ static void reply_spnego_ntlmssp(struct smb_request *req, Is this a krb5 mechanism ? ****************************************************************************/ -NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in, DATA_BLOB *pblob_out, - bool *p_is_krb5) +NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in, + DATA_BLOB *pblob_out, + char **kerb_mechOID) { char *OIDs[ASN1_MAX_OIDS]; int i; + NTSTATUS ret = NT_STATUS_OK; - *p_is_krb5 = False; + *kerb_mechOID = NULL; /* parse out the OIDs and the first sec blob */ if (!parse_negTokenTarg(blob_in, OIDs, pblob_out)) { @@ -735,7 +738,10 @@ NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in, DATA_BLOB *pblob_out, #ifdef HAVE_KRB5 if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) { - *p_is_krb5 = True; + *kerb_mechOID = SMB_STRDUP(OIDs[0]); + if (*kerb_mechOID == NULL) { + ret = NT_STATUS_NO_MEMORY; + } } #endif @@ -743,7 +749,7 @@ NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in, DATA_BLOB *pblob_out, DEBUG(5,("parse_spnego_mechanisms: Got OID %s\n", OIDs[i])); free(OIDs[i]); } - return NT_STATUS_OK; + return ret; } /**************************************************************************** @@ -779,11 +785,10 @@ static void reply_spnego_negotiate(struct smb_request *req, { DATA_BLOB secblob; DATA_BLOB chal; - bool got_kerberos_mechanism = False; + char *kerb_mech = NULL; NTSTATUS status; - status = parse_spnego_mechanisms(blob1, &secblob, - &got_kerberos_mechanism); -- Samba Shared Repository