2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2007
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #ifdef HAVE_LDAP_SASL_WRAPPING
25 static int ads_saslwrap_setup(Sockbuf_IO_Desc *sbiod, void *arg)
27 ADS_STRUCT *ads = (ADS_STRUCT *)arg;
29 ads->ldap.sbiod = sbiod;
31 sbiod->sbiod_pvt = ads;
36 static int ads_saslwrap_remove(Sockbuf_IO_Desc *sbiod)
41 static ber_slen_t ads_saslwrap_prepare_inbuf(ADS_STRUCT *ads)
44 ads->ldap.in.needed = 0;
45 ads->ldap.in.left = 0;
46 ads->ldap.in.size = 4 + ads->ldap.in.min_wrapped;
47 ads->ldap.in.buf = talloc_array(ads->ldap.mem_ctx,
48 uint8_t, ads->ldap.in.size);
49 if (!ads->ldap.in.buf) {
56 static ber_slen_t ads_saslwrap_grow_inbuf(ADS_STRUCT *ads)
58 if (ads->ldap.in.size == (4 + ads->ldap.in.needed)) {
62 ads->ldap.in.size = 4 + ads->ldap.in.needed;
63 ads->ldap.in.buf = talloc_realloc(ads->ldap.mem_ctx,
65 uint8_t, ads->ldap.in.size);
66 if (!ads->ldap.in.buf) {
73 static void ads_saslwrap_shrink_inbuf(ADS_STRUCT *ads)
75 talloc_free(ads->ldap.in.buf);
77 ads->ldap.in.buf = NULL;
78 ads->ldap.in.size = 0;
80 ads->ldap.in.needed = 0;
81 ads->ldap.in.left = 0;
84 static ber_slen_t ads_saslwrap_read(Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
86 ADS_STRUCT *ads = (ADS_STRUCT *)sbiod->sbiod_pvt;
89 /* If ofs < 4 it means we don't have read the length header yet */
90 if (ads->ldap.in.ofs < 4) {
91 ret = ads_saslwrap_prepare_inbuf(ads);
92 if (ret < 0) return ret;
94 ret = LBER_SBIOD_READ_NEXT(sbiod,
95 ads->ldap.in.buf + ads->ldap.in.ofs,
96 4 - ads->ldap.in.ofs);
97 if (ret <= 0) return ret;
98 ads->ldap.in.ofs += ret;
100 if (ads->ldap.in.ofs < 4) goto eagain;
102 ads->ldap.in.needed = RIVAL(ads->ldap.in.buf, 0);
103 if (ads->ldap.in.needed > ads->ldap.in.max_wrapped) {
107 if (ads->ldap.in.needed < ads->ldap.in.min_wrapped) {
112 ret = ads_saslwrap_grow_inbuf(ads);
113 if (ret < 0) return ret;
117 * if there's more data needed from the remote end,
118 * we need to read more
120 if (ads->ldap.in.needed > 0) {
121 ret = LBER_SBIOD_READ_NEXT(sbiod,
122 ads->ldap.in.buf + ads->ldap.in.ofs,
123 ads->ldap.in.needed);
124 if (ret <= 0) return ret;
125 ads->ldap.in.ofs += ret;
126 ads->ldap.in.needed -= ret;
128 if (ads->ldap.in.needed > 0) goto eagain;
132 * if we have a complete packet and have not yet unwrapped it
133 * we need to call the mech specific unwrap() hook
135 if (ads->ldap.in.needed == 0 && ads->ldap.in.left == 0) {
137 status = ads->ldap.wrap_ops->unwrap(ads);
138 if (!ADS_ERR_OK(status)) {
145 * if we have unwrapped data give it to the caller
147 if (ads->ldap.in.left > 0) {
148 ret = MIN(ads->ldap.in.left, len);
149 memcpy(buf, ads->ldap.in.buf + ads->ldap.in.ofs, ret);
150 ads->ldap.in.ofs += ret;
151 ads->ldap.in.left -= ret;
154 * if no more is left shrink the inbuf,
155 * this will trigger reading a new SASL packet
156 * from the remote stream in the next call
158 if (ads->ldap.in.left == 0) {
159 ads_saslwrap_shrink_inbuf(ads);
166 * if we don't have anything for the caller yet,
167 * tell him to ask again
174 static ber_slen_t ads_saslwrap_prepare_outbuf(ADS_STRUCT *ads, uint32_t len)
176 ads->ldap.out.ofs = 0;
177 ads->ldap.out.left = 0;
178 ads->ldap.out.size = 4 + ads->ldap.out.sig_size + len;
179 ads->ldap.out.buf = talloc_array(ads->ldap.mem_ctx,
180 uint8_t, ads->ldap.out.size);
181 if (!ads->ldap.out.buf) {
188 static void ads_saslwrap_shrink_outbuf(ADS_STRUCT *ads)
190 talloc_free(ads->ldap.out.buf);
192 ads->ldap.out.buf = NULL;
193 ads->ldap.out.size = 0;
194 ads->ldap.out.ofs = 0;
195 ads->ldap.out.left = 0;
198 static ber_slen_t ads_saslwrap_write(Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
200 ADS_STRUCT *ads = (ADS_STRUCT *)sbiod->sbiod_pvt;
201 ber_slen_t ret, rlen;
203 /* if the buffer is empty, we need to wrap in incoming buffer */
204 if (ads->ldap.out.left == 0) {
212 rlen = MIN(len, ads->ldap.out.max_unwrapped);
214 ret = ads_saslwrap_prepare_outbuf(ads, rlen);
215 if (ret < 0) return ret;
217 status = ads->ldap.wrap_ops->wrap(ads, (uint8_t *)buf, rlen);
218 if (!ADS_ERR_OK(status)) {
223 RSIVAL(ads->ldap.out.buf, 0, ads->ldap.out.left - 4);
228 ret = LBER_SBIOD_WRITE_NEXT(sbiod,
229 ads->ldap.out.buf + ads->ldap.out.ofs,
231 if (ret <= 0) return ret;
232 ads->ldap.out.ofs += ret;
233 ads->ldap.out.left -= ret;
235 if (ads->ldap.out.left == 0) {
236 ads_saslwrap_shrink_outbuf(ads);
239 if (rlen > 0) return rlen;
245 static int ads_saslwrap_ctrl(Sockbuf_IO_Desc *sbiod, int opt, void *arg)
247 ADS_STRUCT *ads = (ADS_STRUCT *)sbiod->sbiod_pvt;
251 case LBER_SB_OPT_DATA_READY:
252 if (ads->ldap.in.left > 0) {
255 ret = LBER_SBIOD_CTRL_NEXT(sbiod, opt, arg);
258 ret = LBER_SBIOD_CTRL_NEXT(sbiod, opt, arg);
265 static int ads_saslwrap_close(Sockbuf_IO_Desc *sbiod)
270 static const Sockbuf_IO ads_saslwrap_sockbuf_io = {
271 ads_saslwrap_setup, /* sbi_setup */
272 ads_saslwrap_remove, /* sbi_remove */
273 ads_saslwrap_ctrl, /* sbi_ctrl */
274 ads_saslwrap_read, /* sbi_read */
275 ads_saslwrap_write, /* sbi_write */
276 ads_saslwrap_close /* sbi_close */
279 ADS_STATUS ads_setup_sasl_wrapping(ADS_STRUCT *ads,
280 const struct ads_saslwrap_ops *ops,
285 Sockbuf_IO *io = discard_const_p(Sockbuf_IO, &ads_saslwrap_sockbuf_io);
288 rc = ldap_get_option(ads->ldap.ld, LDAP_OPT_SOCKBUF, &sb);
289 status = ADS_ERROR_LDAP(rc);
290 if (!ADS_ERR_OK(status)) {
294 /* setup the real wrapping callbacks */
295 rc = ber_sockbuf_add_io(sb, io, LBER_SBIOD_LEVEL_TRANSPORT, ads);
296 status = ADS_ERROR_LDAP(rc);
297 if (!ADS_ERR_OK(status)) {
301 ads->ldap.wrap_ops = ops;
302 ads->ldap.wrap_private_data = private_data;
307 ADS_STATUS ads_setup_sasl_wrapping(ADS_STRUCT *ads,
308 const struct ads_saslwrap_ops *ops,
311 return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
313 #endif /* HAVE_LDAP_SASL_WRAPPING */