Add context extension to reset crypto statecrypto_reset

This is need to account for the special handling described in MS-SPNG 3.3.5.1
It instructs sthat the NTLMSSP crypto state needs to be reset if MIC is
performed in the SPNEGO layer.

Optionally reset sequence numbers too.

Signed-off-by: Simo Sorce <simo@redhat.com>

1 files changed, 43 insertions, 0 deletions

diff --git a/src/gss_sec_ctx.c b/src/gss_sec_ctx.c
index 2598389..d5b0bb0 100644
--- a/src/gss_sec_ctx.c
+++ b/src/gss_sec_ctx.c
@@ -1114,6 +1114,47 @@ uint32_t gssntlm_set_seq_num(uint32_t *minor_status,
     return GSSERRS(0, GSS_S_COMPLETE);
 }
 
+gss_OID_desc reset_crypto_oid = {
+    GSS_NTLMSSP_RESET_CRYPTO_OID_LENGTH,
+    discard_const(GSS_NTLMSSP_RESET_CRYPTO_OID_STRING)
+};
+
+uint32_t gssntlm_reset_crypto(uint32_t *minor_status,
+                              struct gssntlm_ctx *ctx,
+                              const gss_buffer_t value)
+{
+    uint32_t retmin;
+    uint32_t retmaj;
+
+    if (value->length != 4) {
+        return GSSERRS(ERR_BADARG, GSS_S_FAILURE);
+    }
+
+    /* reset crypto state */
+    if (ctx->neg_flags & (NTLMSSP_NEGOTIATE_SIGN |
+                            NTLMSSP_NEGOTIATE_SEAL)) {
+        uint32_t val;
+
+        RC4_FREE(&ctx->crypto_state.send.seal_handle);
+        RC4_FREE(&ctx->crypto_state.recv.seal_handle);
+
+        retmin = ntlm_signseal_keys(ctx->neg_flags, false,
+                                    &ctx->exported_session_key,
+                                    &ctx->crypto_state);
+        if (retmin) {
+            return GSSERRS(retmin, GSS_S_FAILURE);
+        }
+
+        memcpy(&val, value->value, value->length);
+        if (val != 0) {
+            ctx->crypto_state.send.seq_num = 0;
+            ctx->crypto_state.recv.seq_num = 0;
+        }
+    }
+
+    return GSSERRS(0, GSS_S_COMPLETE);
+}
+
 uint32_t gssntlm_set_sec_context_option(uint32_t *minor_status,
                                         gss_ctx_id_t *context_handle,
                                         const gss_OID desired_object,
@@ -1135,6 +1176,8 @@ uint32_t gssntlm_set_sec_context_option(uint32_t *minor_status,
     /* set seq num */
     if (gss_oid_equal(desired_object, &set_seq_num_oid)) {
         return gssntlm_set_seq_num(minor_status, ctx, value);
+    } else if (gss_oid_equal(desired_object, &reset_crypto_oid)) {
+        return gssntlm_reset_crypto(minor_status, ctx, value);
     }
 
     return GSSERRS(ERR_BADARG, GSS_S_UNAVAILABLE);