Generic Authentication Interface
Copyright (C) Andrew Tridgell 2003
- Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
+ Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "auth/auth.h"
#include "lib/events/events.h"
-#include "smb_build.h"
+#include "librpc/rpc/dcerpc.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
+#include "param/param.h"
/* the list of currently registered GENSEC backends */
-const static struct gensec_security_ops **generic_security_ops;
+static struct gensec_security_ops **generic_security_ops;
static int gensec_num_backends;
-const struct gensec_security_ops **gensec_security_all(void)
+/* Return all the registered mechs. Don't modify the return pointer,
+ * but you may talloc_reference it if convient */
+_PUBLIC_ struct gensec_security_ops **gensec_security_all(void)
{
return generic_security_ops;
}
+bool gensec_security_ops_enabled(struct gensec_security_ops *ops,
+ struct loadparm_context *lp_ctx)
+{
+ return lp_parm_bool(lp_ctx, NULL, "gensec", ops->name, ops->enabled);
+}
+
+/* Sometimes we want to force only kerberos, sometimes we want to
+ * force it's avoidance. The old list could be either
+ * gensec_security_all(), or from cli_credentials_gensec_list() (ie,
+ * an existing list we have trimmed down) */
+
+_PUBLIC_ struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx,
+ struct gensec_security_ops **old_gensec_list,
+ struct cli_credentials *creds)
+{
+ struct gensec_security_ops **new_gensec_list;
+ int i, j, num_mechs_in;
+ enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS;
+
+ if (creds) {
+ use_kerberos = cli_credentials_get_kerberos_state(creds);
+ }
+
+ if (use_kerberos == CRED_AUTO_USE_KERBEROS) {
+ if (!talloc_reference(mem_ctx, old_gensec_list)) {
+ return NULL;
+ }
+ return old_gensec_list;
+ }
+
+ for (num_mechs_in=0; old_gensec_list && old_gensec_list[num_mechs_in]; num_mechs_in++) {
+ /* noop */
+ }
+
+ new_gensec_list = talloc_array(mem_ctx, struct gensec_security_ops *, num_mechs_in + 1);
+ if (!new_gensec_list) {
+ return NULL;
+ }
+
+ j = 0;
+ for (i=0; old_gensec_list && old_gensec_list[i]; i++) {
+ int oid_idx;
+
+ for (oid_idx = 0; old_gensec_list[i]->oid && old_gensec_list[i]->oid[oid_idx]; oid_idx++) {
+ if (strcmp(old_gensec_list[i]->oid[oid_idx], GENSEC_OID_SPNEGO) == 0) {
+ new_gensec_list[j] = old_gensec_list[i];
+ j++;
+ break;
+ }
+ }
+ switch (use_kerberos) {
+ case CRED_DONT_USE_KERBEROS:
+ if (old_gensec_list[i]->kerberos == false) {
+ new_gensec_list[j] = old_gensec_list[i];
+ j++;
+ }
+ break;
+ case CRED_MUST_USE_KERBEROS:
+ if (old_gensec_list[i]->kerberos == true) {
+ new_gensec_list[j] = old_gensec_list[i];
+ j++;
+ }
+ break;
+ default:
+ /* Can't happen or invalid parameter */
+ return NULL;
+ }
+ }
+ new_gensec_list[j] = NULL;
+
+ return new_gensec_list;
+}
+
+struct gensec_security_ops **gensec_security_mechs(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx)
+{
+ struct gensec_security_ops **backends;
+ backends = gensec_security_all();
+ if (!gensec_security) {
+ if (!talloc_reference(mem_ctx, backends)) {
+ return NULL;
+ }
+ return backends;
+ } else {
+ struct cli_credentials *creds = gensec_get_credentials(gensec_security);
+ if (!creds) {
+ if (!talloc_reference(mem_ctx, backends)) {
+ return NULL;
+ }
+ return backends;
+ }
+ return gensec_use_kerberos_mechs(mem_ctx, backends, creds);
+ }
+}
+
static const struct gensec_security_ops *gensec_security_by_authtype(struct gensec_security *gensec_security,
uint8_t auth_type)
{
int i;
- const struct gensec_security_ops **backends;
- if (!gensec_security) {
- backends = gensec_security_all();
- } else {
- backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ struct gensec_security_ops **backends;
+ const struct gensec_security_ops *backend;
+ TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
+ if (!mem_ctx) {
+ return NULL;
}
+ backends = gensec_security_mechs(gensec_security, mem_ctx);
for (i=0; backends && backends[i]; i++) {
+ if (!gensec_security_ops_enabled(backends[i],
+ gensec_security->settings->lp_ctx))
+ continue;
if (backends[i]->auth_type == auth_type) {
- return backends[i];
+ backend = backends[i];
+ talloc_free(mem_ctx);
+ return backend;
}
}
+ talloc_free(mem_ctx);
return NULL;
}
const char *oid_string)
{
int i, j;
- const struct gensec_security_ops **backends;
- if (!gensec_security) {
- backends = gensec_security_all();
- } else {
- backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ struct gensec_security_ops **backends;
+ const struct gensec_security_ops *backend;
+ TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
+ if (!mem_ctx) {
+ return NULL;
}
+ backends = gensec_security_mechs(gensec_security, mem_ctx);
for (i=0; backends && backends[i]; i++) {
+ if (gensec_security != NULL &&
+ !gensec_security_ops_enabled(backends[i],
+ gensec_security->settings->lp_ctx))
+ continue;
if (backends[i]->oid) {
for (j=0; backends[i]->oid[j]; j++) {
if (backends[i]->oid[j] &&
(strcmp(backends[i]->oid[j], oid_string) == 0)) {
- return backends[i];
+ backend = backends[i];
+ talloc_free(mem_ctx);
+ return backend;
}
}
}
}
+ talloc_free(mem_ctx);
return NULL;
}
-static const struct gensec_security_ops *gensec_security_by_sasl_name(struct gensec_security *gensec_security,
- const char *sasl_name)
+const struct gensec_security_ops *gensec_security_by_sasl_name(struct gensec_security *gensec_security,
+ const char *sasl_name)
{
int i;
- const struct gensec_security_ops **backends;
- if (!gensec_security) {
- backends = gensec_security_all();
- } else {
- backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ struct gensec_security_ops **backends;
+ const struct gensec_security_ops *backend;
+ TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
+ if (!mem_ctx) {
+ return NULL;
}
+ backends = gensec_security_mechs(gensec_security, mem_ctx);
for (i=0; backends && backends[i]; i++) {
+ if (!gensec_security_ops_enabled(backends[i], gensec_security->settings->lp_ctx))
+ continue;
if (backends[i]->sasl_name
&& (strcmp(backends[i]->sasl_name, sasl_name) == 0)) {
- return backends[i];
+ backend = backends[i];
+ talloc_free(mem_ctx);
+ return backend;
}
}
+ talloc_free(mem_ctx);
return NULL;
}
const char *name)
{
int i;
- const struct gensec_security_ops **backends;
- if (!gensec_security) {
- backends = gensec_security_all();
- } else {
- backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ struct gensec_security_ops **backends;
+ const struct gensec_security_ops *backend;
+ TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
+ if (!mem_ctx) {
+ return NULL;
}
+ backends = gensec_security_mechs(gensec_security, mem_ctx);
for (i=0; backends && backends[i]; i++) {
+ if (gensec_security != NULL &&
+ !gensec_security_ops_enabled(backends[i], gensec_security->settings->lp_ctx))
+ continue;
if (backends[i]->name
&& (strcmp(backends[i]->name, name) == 0)) {
- return backends[i];
+ backend = backends[i];
+ talloc_free(mem_ctx);
+ return backend;
}
}
-
+ talloc_free(mem_ctx);
return NULL;
}
* attached to the gensec_security, and return in our preferred order.
*/
-const struct gensec_security_ops **gensec_security_by_sasl(struct gensec_security *gensec_security,
- TALLOC_CTX *mem_ctx,
- const char **sasl_names)
+const struct gensec_security_ops **gensec_security_by_sasl_list(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ const char **sasl_names)
{
const struct gensec_security_ops **backends_out;
- const struct gensec_security_ops **backends;
+ struct gensec_security_ops **backends;
int i, k, sasl_idx;
int num_backends_out = 0;
return NULL;
}
- backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ backends = gensec_security_mechs(gensec_security, mem_ctx);
backends_out = talloc_array(mem_ctx, const struct gensec_security_ops *, 1);
if (!backends_out) {
/* Find backends in our preferred order, by walking our list,
* then looking in the supplied list */
for (i=0; backends && backends[i]; i++) {
+ if (gensec_security != NULL &&
+ !gensec_security_ops_enabled(backends[i], gensec_security->settings->lp_ctx))
+ continue;
for (sasl_idx = 0; sasl_names[sasl_idx]; sasl_idx++) {
if (!backends[i]->sasl_name ||
!(strcmp(backends[i]->sasl_name,
const char *skip)
{
struct gensec_security_ops_wrapper *backends_out;
- const struct gensec_security_ops **backends;
+ struct gensec_security_ops **backends;
int i, j, k, oid_idx;
int num_backends_out = 0;
return NULL;
}
- backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ backends = gensec_security_mechs(gensec_security, gensec_security);
backends_out = talloc_array(mem_ctx, struct gensec_security_ops_wrapper, 1);
if (!backends_out) {
/* Find backends in our preferred order, by walking our list,
* then looking in the supplied list */
for (i=0; backends && backends[i]; i++) {
+ if (gensec_security != NULL &&
+ !gensec_security_ops_enabled(backends[i], gensec_security->settings->lp_ctx))
+ continue;
if (!backends[i]->oid) {
continue;
}
* Return OIDS from the security subsystems listed
*/
-const char **gensec_security_oids_from_ops(TALLOC_CTX *mem_ctx,
- const struct gensec_security_ops **ops,
+const char **gensec_security_oids_from_ops(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ struct gensec_security_ops **ops,
const char *skip)
{
int i;
}
for (i=0; ops && ops[i]; i++) {
+ if (gensec_security != NULL &&
+ !gensec_security_ops_enabled(ops[i], gensec_security->settings->lp_ctx)) {
+ continue;
+ }
if (!ops[i]->oid) {
continue;
}
/**
* Return all the security subsystems currently enabled on a GENSEC context.
*
- * This is taken from a list attached to the cli_credentails, and
+ * This is taken from a list attached to the cli_credentials, and
* skips the OID in 'skip'. (Typically the SPNEGO OID)
*
*/
TALLOC_CTX *mem_ctx,
const char *skip)
{
- const struct gensec_security_ops **ops
- = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
- return gensec_security_oids_from_ops(mem_ctx, ops, skip);
+ struct gensec_security_ops **ops
+ = gensec_security_mechs(gensec_security, mem_ctx);
+ return gensec_security_oids_from_ops(gensec_security, mem_ctx, ops, skip);
}
@note The mem_ctx is only a parent and may be NULL.
*/
static NTSTATUS gensec_start(TALLOC_CTX *mem_ctx,
- struct gensec_security **gensec_security,
- struct event_context *ev)
+ struct tevent_context *ev,
+ struct gensec_settings *settings,
+ struct messaging_context *msg,
+ struct gensec_security **gensec_security)
{
+ if (ev == NULL) {
+ DEBUG(0, ("No event context available!\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
(*gensec_security) = talloc(mem_ctx, struct gensec_security);
NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
(*gensec_security)->ops = NULL;
+ (*gensec_security)->private_data = NULL;
ZERO_STRUCT((*gensec_security)->target);
ZERO_STRUCT((*gensec_security)->peer_addr);
ZERO_STRUCT((*gensec_security)->my_addr);
- (*gensec_security)->subcontext = False;
+ (*gensec_security)->subcontext = false;
(*gensec_security)->want_features = 0;
-
- if (ev == NULL) {
- ev = event_context_init(*gensec_security);
- if (ev == NULL) {
- talloc_free(*gensec_security);
- return NT_STATUS_NO_MEMORY;
- }
- }
(*gensec_security)->event_ctx = ev;
+ (*gensec_security)->msg_ctx = msg;
+ SMB_ASSERT(settings->lp_ctx != NULL);
+ (*gensec_security)->settings = talloc_reference(*gensec_security, settings);
return NT_STATUS_OK;
}
* @note Used by SPNEGO in particular, for the actual implementation mechanism
*/
-NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx,
+_PUBLIC_ NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx,
struct gensec_security *parent,
struct gensec_security **gensec_security)
{
(*gensec_security)->ops = NULL;
(*gensec_security)->private_data = NULL;
- (*gensec_security)->subcontext = True;
+ (*gensec_security)->subcontext = true;
+ (*gensec_security)->want_features = parent->want_features;
(*gensec_security)->event_ctx = parent->event_ctx;
+ (*gensec_security)->msg_ctx = parent->msg_ctx;
+ (*gensec_security)->settings = talloc_reference(*gensec_security, parent->settings);
return NT_STATUS_OK;
}
@param gensec_security Returned GENSEC context pointer.
@note The mem_ctx is only a parent and may be NULL.
*/
-NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx,
+_PUBLIC_ NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx,
struct gensec_security **gensec_security,
- struct event_context *ev)
+ struct tevent_context *ev,
+ struct gensec_settings *settings)
{
NTSTATUS status;
- status = gensec_start(mem_ctx, gensec_security, ev);
+
+ if (settings == NULL) {
+ DEBUG(0,("gensec_client_start: no settings given!\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ status = gensec_start(mem_ctx, ev, settings, NULL, gensec_security);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
@param gensec_security Returned GENSEC context pointer.
@note The mem_ctx is only a parent and may be NULL.
*/
-NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx,
- struct gensec_security **gensec_security,
- struct event_context *ev)
+_PUBLIC_ NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct gensec_settings *settings,
+ struct messaging_context *msg,
+ struct gensec_security **gensec_security)
{
NTSTATUS status;
- status = gensec_start(mem_ctx, gensec_security, ev);
+
+ if (!ev) {
+ DEBUG(0,("gensec_server_start: no event context given!\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ if (!msg) {
+ DEBUG(0,("gensec_server_start: no messaging context given!\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ if (!settings) {
+ DEBUG(0,("gensec_server_start: no settings given!\n"));
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+
+ status = gensec_start(mem_ctx, ev, settings, msg, gensec_security);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
}
return status;
}
+ break;
case GENSEC_SERVER:
if (gensec_security->ops->server_start) {
status = gensec_security->ops->server_start(gensec_security);
}
return status;
}
+ break;
}
return NT_STATUS_INVALID_PARAMETER;
}
* @param auth_level DCERPC auth level
*/
-NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
uint8_t auth_type, uint8_t auth_level)
{
gensec_security->ops = gensec_security_by_authtype(gensec_security, auth_type);
return gensec_start_mech(gensec_security);
}
-const char *gensec_get_name_by_authtype(uint8_t authtype)
+_PUBLIC_ const char *gensec_get_name_by_authtype(struct gensec_security *gensec_security, uint8_t authtype)
{
const struct gensec_security_ops *ops;
- ops = gensec_security_by_authtype(NULL, authtype);
+ ops = gensec_security_by_authtype(gensec_security, authtype);
if (ops) {
return ops->name;
}
}
-const char *gensec_get_name_by_oid(const char *oid_string)
+_PUBLIC_ const char *gensec_get_name_by_oid(struct gensec_security *gensec_security,
+ const char *oid_string)
{
const struct gensec_security_ops *ops;
- ops = gensec_security_by_oid(NULL, oid_string);
+ ops = gensec_security_by_oid(gensec_security, oid_string);
if (ops) {
return ops->name;
}
* well-known #define to hook it in.
*/
-NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security,
const char *mech_oid)
{
+ SMB_ASSERT(gensec_security != NULL);
+
gensec_security->ops = gensec_security_by_oid(gensec_security, mech_oid);
if (!gensec_security->ops) {
DEBUG(3, ("Could not find GENSEC backend for oid=%s\n", mech_oid));
*
*/
-NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
const char *sasl_name)
{
gensec_security->ops = gensec_security_by_sasl_name(gensec_security, sasl_name);
return gensec_start_mech(gensec_security);
}
+/**
+ * Start a GENSEC sub-mechanism with the preferred option from a SASL name list
+ *
+ */
+
+_PUBLIC_ NTSTATUS gensec_start_mech_by_sasl_list(struct gensec_security *gensec_security,
+ const char **sasl_names)
+{
+ NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
+ TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
+ const struct gensec_security_ops **ops;
+ int i;
+ if (!mem_ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ ops = gensec_security_by_sasl_list(gensec_security, mem_ctx, sasl_names);
+ if (!ops || !*ops) {
+ DEBUG(3, ("Could not find GENSEC backend for any of sasl_name = %s\n",
+ str_list_join(mem_ctx,
+ sasl_names, ' ')));
+ talloc_free(mem_ctx);
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ for (i=0; ops[i]; i++) {
+ nt_status = gensec_start_mech_by_ops(gensec_security, ops[i]);
+ if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
+ break;
+ }
+ }
+ talloc_free(mem_ctx);
+ return nt_status;
+}
+
/**
* Start a GENSEC sub-mechanism by an internal name
*
*/
-NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
const char *name)
{
gensec_security->ops = gensec_security_by_name(gensec_security, name);
/*
wrappers for the gensec function pointers
*/
-NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
uint8_t *data, size_t length,
const uint8_t *whole_pdu, size_t pdu_length,
sig);
}
-NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
const uint8_t *data, size_t length,
const uint8_t *whole_pdu, size_t pdu_length,
return gensec_security->ops->check_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
}
-NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
uint8_t *data, size_t length,
const uint8_t *whole_pdu, size_t pdu_length,
return gensec_security->ops->seal_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
}
-NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
const uint8_t *data, size_t length,
const uint8_t *whole_pdu, size_t pdu_length,
return gensec_security->ops->sign_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
}
-size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size)
+_PUBLIC_ size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size)
{
if (!gensec_security->ops->sig_size) {
return 0;
return gensec_security->ops->sig_size(gensec_security, data_size);
}
-NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
+size_t gensec_max_wrapped_size(struct gensec_security *gensec_security)
+{
+ if (!gensec_security->ops->max_wrapped_size) {
+ return (1 << 17);
+ }
+
+ return gensec_security->ops->max_wrapped_size(gensec_security);
+}
+
+size_t gensec_max_input_size(struct gensec_security *gensec_security)
+{
+ if (!gensec_security->ops->max_input_size) {
+ return (1 << 17) - gensec_sig_size(gensec_security, 1 << 17);
+ }
+
+ return gensec_security->ops->max_input_size(gensec_security);
+}
+
+_PUBLIC_ NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
const DATA_BLOB *in,
DATA_BLOB *out)
return gensec_security->ops->wrap(gensec_security, mem_ctx, in, out);
}
-NTSTATUS gensec_unwrap(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_unwrap(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
const DATA_BLOB *in,
DATA_BLOB *out)
return gensec_security->ops->unwrap(gensec_security, mem_ctx, in, out);
}
-NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
DATA_BLOB *session_key)
{
if (!gensec_security->ops->session_key) {
*
*/
-NTSTATUS gensec_session_info(struct gensec_security *gensec_security,
+_PUBLIC_ NTSTATUS gensec_session_info(struct gensec_security *gensec_security,
struct auth_session_info **session_info)
{
if (!gensec_security->ops->session_info) {
* or NT_STATUS_OK if the user is authenticated.
*/
-NTSTATUS gensec_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
+_PUBLIC_ NTSTATUS gensec_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
const DATA_BLOB in, DATA_BLOB *out)
{
return gensec_security->ops->update(gensec_security, out_mem_ctx, in, out);
}
+static void gensec_update_async_timed_handler(struct tevent_context *ev, struct tevent_timer *te,
+ struct timeval t, void *ptr)
+{
+ struct gensec_update_request *req = talloc_get_type(ptr, struct gensec_update_request);
+ req->status = req->gensec_security->ops->update(req->gensec_security, req, req->in, &req->out);
+ req->callback.fn(req, req->callback.private_data);
+}
+
+/**
+ * Next state function for the GENSEC state machine async version
+ *
+ * @param gensec_security GENSEC State
+ * @param in The request, as a DATA_BLOB
+ * @param callback The function that will be called when the operation is
+ * finished, it should return gensec_update_recv() to get output
+ * @param private_data A private pointer that will be passed to the callback function
+ */
+
+_PUBLIC_ void gensec_update_send(struct gensec_security *gensec_security, const DATA_BLOB in,
+ void (*callback)(struct gensec_update_request *req, void *private_data),
+ void *private_data)
+{
+ struct gensec_update_request *req = NULL;
+ struct tevent_timer *te = NULL;
+
+ req = talloc(gensec_security, struct gensec_update_request);
+ if (!req) goto failed;
+ req->gensec_security = gensec_security;
+ req->in = in;
+ req->out = data_blob(NULL, 0);
+ req->callback.fn = callback;
+ req->callback.private_data = private_data;
+
+ te = event_add_timed(gensec_security->event_ctx, req,
+ timeval_zero(),
+ gensec_update_async_timed_handler, req);
+ if (!te) goto failed;
+
+ return;
+
+failed:
+ talloc_free(req);
+ callback(NULL, private_data);
+}
+
+/**
+ * Next state function for the GENSEC state machine
+ *
+ * @param req GENSEC update request state
+ * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
+ * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
+ * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
+ * or NT_STATUS_OK if the user is authenticated.
+ */
+_PUBLIC_ NTSTATUS gensec_update_recv(struct gensec_update_request *req, TALLOC_CTX *out_mem_ctx, DATA_BLOB *out)
+{
+ NTSTATUS status;
+
+ NT_STATUS_HAVE_NO_MEMORY(req);
+
+ *out = req->out;
+ talloc_steal(out_mem_ctx, out->data);
+ status = req->status;
+
+ talloc_free(req);
+ return status;
+}
+
/**
* Set the requirement for a certain feature on the connection
*
*/
-void gensec_want_feature(struct gensec_security *gensec_security,
+_PUBLIC_ void gensec_want_feature(struct gensec_security *gensec_security,
uint32_t feature)
{
- gensec_security->want_features |= feature;
+ if (!gensec_security->ops || !gensec_security->ops->want_feature) {
+ gensec_security->want_features |= feature;
+ return;
+ }
+ gensec_security->ops->want_feature(gensec_security, feature);
}
/**
*
*/
-BOOL gensec_have_feature(struct gensec_security *gensec_security,
+_PUBLIC_ bool gensec_have_feature(struct gensec_security *gensec_security,
uint32_t feature)
{
if (!gensec_security->ops->have_feature) {
- return False;
+ return false;
}
- /* Can only 'have' a feature if you already 'want'ed it */
- if (gensec_security->want_features & feature) {
- return gensec_security->ops->have_feature(gensec_security, feature);
- }
- return False;
+ /* We might 'have' features that we don't 'want', because the
+ * other end demanded them, or we can't neotiate them off */
+ return gensec_security->ops->have_feature(gensec_security, feature);
}
/**
*
*/
-NTSTATUS gensec_set_credentials(struct gensec_security *gensec_security, struct cli_credentials *credentials)
+_PUBLIC_ NTSTATUS gensec_set_credentials(struct gensec_security *gensec_security, struct cli_credentials *credentials)
{
gensec_security->credentials = talloc_reference(gensec_security, credentials);
+ NT_STATUS_HAVE_NO_MEMORY(gensec_security->credentials);
+ gensec_want_feature(gensec_security, cli_credentials_get_gensec_features(gensec_security->credentials));
return NT_STATUS_OK;
}
*
*/
-struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security)
+_PUBLIC_ struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security)
{
if (!gensec_security) {
return NULL;
*
*/
-NTSTATUS gensec_set_target_service(struct gensec_security *gensec_security, const char *service)
+_PUBLIC_ NTSTATUS gensec_set_target_service(struct gensec_security *gensec_security, const char *service)
{
gensec_security->target.service = talloc_strdup(gensec_security, service);
if (!gensec_security->target.service) {
return NT_STATUS_OK;
}
-const char *gensec_get_target_service(struct gensec_security *gensec_security)
+_PUBLIC_ const char *gensec_get_target_service(struct gensec_security *gensec_security)
{
if (gensec_security->target.service) {
return gensec_security->target.service;
*
*/
-NTSTATUS gensec_set_target_hostname(struct gensec_security *gensec_security, const char *hostname)
+_PUBLIC_ NTSTATUS gensec_set_target_hostname(struct gensec_security *gensec_security, const char *hostname)
{
gensec_security->target.hostname = talloc_strdup(gensec_security, hostname);
- if (!gensec_security->target.hostname) {
+ if (hostname && !gensec_security->target.hostname) {
return NT_STATUS_NO_MEMORY;
}
return NT_STATUS_OK;
}
-const char *gensec_get_target_hostname(struct gensec_security *gensec_security)
+_PUBLIC_ const char *gensec_get_target_hostname(struct gensec_security *gensec_security)
{
+ /* We allow the target hostname to be overriden for testing purposes */
+ if (gensec_security->settings->target_hostname) {
+ return gensec_security->settings->target_hostname;
+ }
+
if (gensec_security->target.hostname) {
return gensec_security->target.hostname;
}
}
/**
- * Set local and peer socket addresses onto a socket context on the GENSEC context
+ * Set (and talloc_reference) local and peer socket addresses onto a socket context on the GENSEC context
*
* This is so that kerberos can include these addresses in
* cryptographic tokens, to avoid certain attacks.
*/
-NTSTATUS gensec_set_my_addr(struct gensec_security *gensec_security, const char *my_addr, int port)
+_PUBLIC_ NTSTATUS gensec_set_my_addr(struct gensec_security *gensec_security, struct socket_address *my_addr)
{
- gensec_security->my_addr.addr = talloc_strdup(gensec_security, my_addr);
- if (my_addr && !gensec_security->my_addr.addr) {
+ gensec_security->my_addr = my_addr;
+ if (my_addr && !talloc_reference(gensec_security, my_addr)) {
return NT_STATUS_NO_MEMORY;
}
- gensec_security->my_addr.port = port;
return NT_STATUS_OK;
}
-NTSTATUS gensec_set_peer_addr(struct gensec_security *gensec_security, const char *peer_addr, int port)
+_PUBLIC_ NTSTATUS gensec_set_peer_addr(struct gensec_security *gensec_security, struct socket_address *peer_addr)
{
- gensec_security->peer_addr.addr = talloc_strdup(gensec_security, peer_addr);
- if (peer_addr && !gensec_security->peer_addr.addr) {
+ gensec_security->peer_addr = peer_addr;
+ if (peer_addr && !talloc_reference(gensec_security, peer_addr)) {
return NT_STATUS_NO_MEMORY;
}
- gensec_security->peer_addr.port = port;
return NT_STATUS_OK;
}
-const char *gensec_get_my_addr(struct gensec_security *gensec_security, int *port)
+struct socket_address *gensec_get_my_addr(struct gensec_security *gensec_security)
{
- if (gensec_security->my_addr.addr) {
- if (port) {
- *port = gensec_security->my_addr.port;
- }
- return gensec_security->my_addr.addr;
+ if (gensec_security->my_addr) {
+ return gensec_security->my_addr;
}
/* We could add a 'set sockaddr' call, and do a lookup. This
return NULL;
}
-const char *gensec_get_peer_addr(struct gensec_security *gensec_security, int *port)
+_PUBLIC_ struct socket_address *gensec_get_peer_addr(struct gensec_security *gensec_security)
{
- if (gensec_security->peer_addr.addr) {
- if (port) {
- *port = gensec_security->peer_addr.port;
- }
- return gensec_security->peer_addr.addr;
+ if (gensec_security->peer_addr) {
+ return gensec_security->peer_addr;
}
/* We could add a 'set sockaddr' call, and do a lookup. This
The 'name' can be later used by other backends to find the operations
structure for this backend.
*/
-NTSTATUS gensec_register(const void *_ops)
+NTSTATUS gensec_register(const struct gensec_security_ops *ops)
{
- const struct gensec_security_ops *ops = _ops;
-
- if (!lp_parm_bool(-1, "gensec", ops->name, ops->enabled)) {
- DEBUG(2,("gensec subsystem %s is disabled\n", ops->name));
- return NT_STATUS_OK;
- }
-
if (gensec_security_by_name(NULL, ops->name) != NULL) {
/* its already registered! */
DEBUG(0,("GENSEC backend '%s' already registered\n",
return NT_STATUS_OBJECT_NAME_COLLISION;
}
- generic_security_ops = realloc_p(generic_security_ops,
- const struct gensec_security_ops *,
- gensec_num_backends+2);
+ generic_security_ops = talloc_realloc(talloc_autofree_context(),
+ generic_security_ops,
+ struct gensec_security_ops *,
+ gensec_num_backends+2);
if (!generic_security_ops) {
- smb_panic("out of memory in gensec_register");
+ return NT_STATUS_NO_MEMORY;
}
- generic_security_ops[gensec_num_backends] = ops;
+ generic_security_ops[gensec_num_backends] = discard_const_p(struct gensec_security_ops, ops);
gensec_num_backends++;
generic_security_ops[gensec_num_backends] = NULL;
return &critical_sizes;
}
+static int sort_gensec(struct gensec_security_ops **gs1, struct gensec_security_ops **gs2) {
+ return (*gs2)->priority - (*gs1)->priority;
+}
+
+int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value)
+{
+ return lp_parm_int(settings->lp_ctx, NULL, mechanism, name, default_value);
+}
+
+bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value)
+{
+ return lp_parm_bool(settings->lp_ctx, NULL, mechanism, name, default_value);
+}
+
/*
initialise the GENSEC subsystem
*/
-NTSTATUS gensec_init(void)
+_PUBLIC_ NTSTATUS gensec_init(struct loadparm_context *lp_ctx)
{
- static BOOL initialized = False;
+ static bool initialized = false;
+ extern NTSTATUS gensec_sasl_init(void);
+ extern NTSTATUS gensec_krb5_init(void);
+ extern NTSTATUS gensec_schannel_init(void);
+ extern NTSTATUS gensec_spnego_init(void);
+ extern NTSTATUS gensec_gssapi_init(void);
+ extern NTSTATUS gensec_ntlmssp_init(void);
- init_module_fn static_init[] = STATIC_GENSEC_MODULES;
- init_module_fn *shared_init = load_samba_modules(NULL, "gensec");
+ init_module_fn static_init[] = { STATIC_gensec_MODULES };
+ init_module_fn *shared_init;
if (initialized) return NT_STATUS_OK;
- initialized = True;
+ initialized = true;
+
+ shared_init = load_samba_modules(NULL, lp_ctx, "gensec");
run_init_functions(static_init);
run_init_functions(shared_init);
talloc_free(shared_init);
+
+ qsort(generic_security_ops, gensec_num_backends, sizeof(*generic_security_ops), QSORT_CAST sort_gensec);
return NT_STATUS_OK;
}
git.samba.org / kamenim / samba.git / blobdiff