oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

gss_accept_sec_context: support reassembling split tokens.

Browse Source 
Microsoft will sometimes split GSS tokens when they exceed a certain
size in some protocols.  This is specified in

	[MS-SPNG]: Simple and Protected GSS-API Negotiation
	Mechanism (SPNEGO) Extension

https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SPNG/%5bMS-SPNG%5d.pdf

sections 3.1.5.4 to 3.1.5.9.

We extend gss_accept_sec_context() to recognise partial tokens and
to accumulate the fragments until an entire token is available to
be processed.  If the entire token is not yet available,
GSS_S_CONTINUE_NEEDED is returned with a zero length output token.
This is specified in RFC2744 page 25-26 to indicate that no reply
need be sent.

We include updates to the test framework to test split tokens when
using SPNEGO.
This commit is contained in:
Roland C. Dowdeswell
2021-08-02 22:55:47 +01:00
committed by Luke Howard
parent 80f3194a76
commit 3a6229f64a
7 changed files with 543 additions and 213 deletions
Download Patch File Download Diff File Expand all files Collapse all files

111
lib/gssapi/mech/gss_export_sec_context.c
View File

@@ -33,40 +33,118 @@ gss_export_sec_context(OM_uint32 *minor_status,
gss_ctx_id_t *context_handle,
gss_buffer_t interprocess_token)
{
OM_uint32 major_status;
OM_uint32 major_status = GSS_S_FAILURE;
krb5_storage *sp;
krb5_data data;
krb5_error_code kret;
struct _gss_context *ctx;
gssapi_mech_interface m;
gss_buffer_desc buf;
unsigned char verflags;
*minor_status = 0;
if (interprocess_token)
_mg_buffer_zero(interprocess_token);
else
if (!interprocess_token)
return GSS_S_CALL_INACCESSIBLE_READ;
_mg_buffer_zero(interprocess_token);
if (context_handle == NULL)
return GSS_S_NO_CONTEXT;
ctx = (struct _gss_context *) *context_handle;
if (ctx == NULL || ctx->gc_ctx == NULL) {
*minor_status = 0;
if (ctx == NULL)
return GSS_S_NO_CONTEXT;
if (!ctx->gc_ctx && ctx->gc_target_len) {
free(ctx);
*context_handle = GSS_C_NO_CONTEXT;
return GSS_S_NO_CONTEXT;
}
sp = krb5_storage_emem();
if (sp == NULL) {
*minor_status = ENOMEM;
return GSS_S_FAILURE;
}
krb5_storage_set_byteorder(sp, KRB5_STORAGE_BYTEORDER_PACKED);
verflags = 0x00; /* Version 0 */
if (ctx->gc_target_len)
verflags |= EXPORT_CONTEXT_FLAG_ACCUMULATING;
if (ctx->gc_ctx)
verflags |= EXPORT_CONTEXT_FLAG_MECH_CTX;
kret = krb5_store_uint8(sp, verflags);
if (ctx->gc_target_len) {
_gss_mg_log(10, "gss-esc: exporting partial token %zu/%zu",
ctx->gc_input.length, ctx->gc_target_len);
kret = krb5_store_uint8(sp, ctx->gc_initial);
if (kret) {
*minor_status = kret;
goto failure;
}
kret = krb5_store_uint32(sp, ctx->gc_target_len);
if (kret) {
*minor_status = kret;
goto failure;
}
kret = krb5_store_datalen(sp, ctx->gc_input.value,
ctx->gc_input.length);
if (kret) {
*minor_status = kret;
goto failure;
}
}
if (!ctx->gc_ctx) {
free(ctx);
*context_handle = GSS_C_NO_CONTEXT;
return GSS_S_COMPLETE;
}
m = ctx->gc_mech;
major_status = m->gm_export_sec_context(minor_status,
&ctx->gc_ctx, &buf);
if (major_status == GSS_S_COMPLETE) {
unsigned char *p;
if (major_status != GSS_S_COMPLETE) {
_gss_mg_error(m, *minor_status);
goto failure;
}
free(ctx);
*context_handle = GSS_C_NO_CONTEXT;
interprocess_token->length = buf.length
+ 2 + m->gm_mech_oid.length;
interprocess_token->value = malloc(interprocess_token->length);
kret = krb5_store_datalen(sp, m->gm_mech_oid.elements,
m->gm_mech_oid.length);
if (kret) {
*minor_status = kret;
goto failure;
}
kret = krb5_store_datalen(sp, buf.value, buf.length);
if (kret) {
*minor_status = kret;
goto failure;
}
_gss_secure_release_buffer(minor_status, &buf);
kret = krb5_storage_to_data(sp, &data);
if (kret) {
*minor_status = kret;
goto failure;
}
interprocess_token->length = data.length;
interprocess_token->value = data.data;
_gss_mg_log(1, "gss-esc: token length %zu", data.length);
free(ctx);
*context_handle = GSS_C_NO_CONTEXT;
#if 0
if (!interprocess_token->value) {
/*
* We are in trouble here - the context is
@@ -84,10 +162,11 @@ gss_export_sec_context(OM_uint32 *minor_status,
p[1] = m->gm_mech_oid.length;
memcpy(p + 2, m->gm_mech_oid.elements, m->gm_mech_oid.length);
memcpy(p + 2 + m->gm_mech_oid.length, buf.value, buf.length);
_gss_secure_release_buffer(minor_status, &buf);
} else {
_gss_mg_error(m, *minor_status);
}
#endif
return (major_status);
failure:
krb5_storage_free(sp);
return major_status;
}