source4/auth/gensec/pygensec.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2009
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published by
   7    the Free Software Foundation; either version 3 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 #include <Python.h>
  20 #include "includes.h"
  21 #include "param/pyparam.h"
  22 #include "auth/gensec/gensec.h"
  23 #include "auth/credentials/pycredentials.h"
  24 #include "libcli/util/pyerrors.h"
  25 #include "scripting/python/modules.h"
  26 #include <pytalloc.h>
  27 #include <tevent.h>
  28 #include "librpc/rpc/pyrpc_util.h"
  29
  30 static PyObject *py_get_name_by_authtype(PyObject *self, PyObject *args)
  31 {
  32         int type;
  33         const char *name;
  34         struct gensec_security *security;
  35
  36         if (!PyArg_ParseTuple(args, "i", &type))
  37                 return NULL;
  38
  39         security = pytalloc_get_type(self, struct gensec_security);
  40
  41         name = gensec_get_name_by_authtype(security, type);
  42         if (name == NULL)
  43                 Py_RETURN_NONE;
  44
  45         return PyString_FromString(name);
  46 }
  47
  48 static struct gensec_settings *settings_from_object(TALLOC_CTX *mem_ctx, PyObject *object)
  49 {
  50         struct gensec_settings *s;
  51         PyObject *py_hostname, *py_lp_ctx;
  52
  53         if (!PyDict_Check(object)) {
  54                 PyErr_SetString(PyExc_ValueError, "settings should be a dictionary");
  55                 return NULL;
  56         }
  57
  58         s = talloc_zero(mem_ctx, struct gensec_settings);
  59         if (!s) return NULL;
  60
  61         py_hostname = PyDict_GetItemString(object, "target_hostname");
  62         if (!py_hostname) {
  63                 PyErr_SetString(PyExc_ValueError, "settings.target_hostname not found");
  64                 return NULL;
  65         }
  66
  67         py_lp_ctx = PyDict_GetItemString(object, "lp_ctx");
  68         if (!py_lp_ctx) {
  69                 PyErr_SetString(PyExc_ValueError, "settings.lp_ctx not found");
  70                 return NULL;
  71         }
  72
  73         s->target_hostname = PyString_AsString(py_hostname);
  74         s->lp_ctx = lpcfg_from_py_object(s, py_lp_ctx);
  75         return s;
  76 }
  77
  78 static PyObject *py_gensec_start_client(PyTypeObject *type, PyObject *args, PyObject *kwargs)
  79 {
  80         NTSTATUS status;
  81         pytalloc_Object *self;
  82         struct gensec_settings *settings;
  83         const char *kwnames[] = { "settings", NULL };
  84         PyObject *py_settings;
  85         struct gensec_security *gensec;
  86
  87         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|O", discard_const_p(char *, kwnames), &py_settings))
  88                 return NULL;
  89
  90         self = (pytalloc_Object*)type->tp_alloc(type, 0);
  91         if (self == NULL) {
  92                 PyErr_NoMemory();
  93                 return NULL;
  94         }
  95         self->talloc_ctx = talloc_new(NULL);
  96         if (self->talloc_ctx == NULL) {
  97                 PyErr_NoMemory();
  98                 return NULL;
  99         }
 100
 101         if (py_settings != Py_None) {
 102                 settings = settings_from_object(self->talloc_ctx, py_settings);
 103                 if (settings == NULL) {
 104                         PyObject_DEL(self);
 105                         return NULL;
 106                 }
 107         } else {
 108                 settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
 109                 if (settings == NULL) {
 110                         PyObject_DEL(self);
 111                         return NULL;
 112                 }
 113
 114                 settings->lp_ctx = loadparm_init_global(true);
 115                 if (settings->lp_ctx == NULL) {
 116                         PyErr_NoMemory();
 117                         PyObject_DEL(self);
 118                         return NULL;
 119                 }
 120         }
 121
 122         status = gensec_init();
 123         if (!NT_STATUS_IS_OK(status)) {
 124                 PyErr_SetNTSTATUS(status);
 125                 PyObject_DEL(self);
 126                 return NULL;
 127         }
 128
 129         status = gensec_client_start(self->talloc_ctx, &gensec, settings);
 130         if (!NT_STATUS_IS_OK(status)) {
 131                 PyErr_SetNTSTATUS(status);
 132                 PyObject_DEL(self);
 133                 return NULL;
 134         }
 135
 136         self->ptr = gensec;
 137
 138         return (PyObject *)self;
 139 }
 140
 141 static PyObject *py_gensec_start_server(PyTypeObject *type, PyObject *args, PyObject *kwargs)
 142 {
 143         NTSTATUS status;
 144         pytalloc_Object *self;
 145         struct gensec_settings *settings = NULL;
 146         const char *kwnames[] = { "settings", "auth_context", NULL };
 147         PyObject *py_settings = Py_None;
 148         PyObject *py_auth_context = Py_None;
 149         struct gensec_security *gensec;
 150         struct auth4_context *auth_context = NULL;
 151
 152         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OO", discard_const_p(char *, kwnames), &py_settings, &py_auth_context))
 153                 return NULL;
 154
 155         self = (pytalloc_Object*)type->tp_alloc(type, 0);
 156         if (self == NULL) {
 157                 PyErr_NoMemory();
 158                 return NULL;
 159         }
 160         self->talloc_ctx = talloc_new(NULL);
 161         if (self->talloc_ctx == NULL) {
 162                 PyErr_NoMemory();
 163                 return NULL;
 164         }
 165
 166         if (py_settings != Py_None) {
 167                 settings = settings_from_object(self->talloc_ctx, py_settings);
 168                 if (settings == NULL) {
 169                         PyObject_DEL(self);
 170                         return NULL;
 171                 }
 172         } else {
 173                 settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
 174                 if (settings == NULL) {
 175                         PyObject_DEL(self);
 176                         return NULL;
 177                 }
 178
 179                 settings->lp_ctx = loadparm_init_global(true);
 180                 if (settings->lp_ctx == NULL) {
 181                         PyErr_NoMemory();
 182                         PyObject_DEL(self);
 183                         return NULL;
 184                 }
 185         }
 186
 187         if (py_auth_context != Py_None) {
 188                 auth_context = pytalloc_get_type(py_auth_context, struct auth4_context);
 189                 if (!auth_context) {
 190                         PyErr_Format(PyExc_TypeError,
 191                                      "Expected auth.AuthContext for auth_context argument, got %s",
 192                                      talloc_get_name(pytalloc_get_ptr(py_auth_context)));
 193                         return NULL;
 194                 }
 195         }
 196
 197         status = gensec_init();
 198         if (!NT_STATUS_IS_OK(status)) {
 199                 PyErr_SetNTSTATUS(status);
 200                 PyObject_DEL(self);
 201                 return NULL;
 202         }
 203
 204         status = gensec_server_start(self->talloc_ctx, settings, auth_context, &gensec);
 205         if (!NT_STATUS_IS_OK(status)) {
 206                 PyErr_SetNTSTATUS(status);
 207                 PyObject_DEL(self);
 208                 return NULL;
 209         }
 210
 211         self->ptr = gensec;
 212
 213         return (PyObject *)self;
 214 }
 215
 216 static PyObject *py_gensec_set_credentials(PyObject *self, PyObject *args)
 217 {
 218         PyObject *py_creds = Py_None;
 219         struct cli_credentials *creds;
 220         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 221         NTSTATUS status;
 222
 223         if (!PyArg_ParseTuple(args, "O", &py_creds))
 224                 return NULL;
 225
 226         creds = PyCredentials_AsCliCredentials(py_creds);
 227         if (!creds) {
 228                 PyErr_Format(PyExc_TypeError,
 229                              "Expected samba.credentaials for credentials argument got  %s",
 230                              talloc_get_name(pytalloc_get_ptr(py_creds)));
 231         }
 232
 233         status = gensec_set_credentials(security, creds);
 234         if (!NT_STATUS_IS_OK(status)) {
 235                 PyErr_SetNTSTATUS(status);
 236                 return NULL;
 237         }
 238
 239         Py_RETURN_NONE;
 240 }
 241
 242 static PyObject *py_gensec_session_info(PyObject *self)
 243 {
 244         TALLOC_CTX *mem_ctx;
 245         NTSTATUS status;
 246         PyObject *py_session_info;
 247         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 248         struct auth_session_info *info;
 249         if (security->ops == NULL) {
 250                 PyErr_SetString(PyExc_RuntimeError, "no mechanism selected");
 251                 return NULL;
 252         }
 253         mem_ctx = talloc_new(NULL);
 254
 255         status = gensec_session_info(security, mem_ctx, &info);
 256         if (NT_STATUS_IS_ERR(status)) {
 257                 PyErr_SetNTSTATUS(status);
 258                 return NULL;
 259         }
 260
 261         py_session_info = py_return_ndr_struct("samba.dcerpc.auth", "session_info",
 262                                                  info, info);
 263         talloc_free(mem_ctx);
 264         return py_session_info;
 265 }
 266
 267 static PyObject *py_gensec_start_mech_by_name(PyObject *self, PyObject *args)
 268 {
 269         char *name;
 270         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 271         NTSTATUS status;
 272
 273         if (!PyArg_ParseTuple(args, "s", &name))
 274                 return NULL;
 275
 276         status = gensec_start_mech_by_name(security, name);
 277         if (!NT_STATUS_IS_OK(status)) {
 278                 PyErr_SetNTSTATUS(status);
 279                 return NULL;
 280         }
 281
 282         Py_RETURN_NONE;
 283 }
 284
 285 static PyObject *py_gensec_start_mech_by_sasl_name(PyObject *self, PyObject *args)
 286 {
 287         char *sasl_name;
 288         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 289         NTSTATUS status;
 290
 291         if (!PyArg_ParseTuple(args, "s", &sasl_name))
 292                 return NULL;
 293
 294         status = gensec_start_mech_by_sasl_name(security, sasl_name);
 295         if (!NT_STATUS_IS_OK(status)) {
 296                 PyErr_SetNTSTATUS(status);
 297                 return NULL;
 298         }
 299
 300         Py_RETURN_NONE;
 301 }
 302
 303 static PyObject *py_gensec_start_mech_by_authtype(PyObject *self, PyObject *args)
 304 {
 305         int authtype, level;
 306         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 307         NTSTATUS status;
 308         if (!PyArg_ParseTuple(args, "ii", &authtype, &level))
 309                 return NULL;
 310
 311         status = gensec_start_mech_by_authtype(security, authtype, level);
 312         if (!NT_STATUS_IS_OK(status)) {
 313                 PyErr_SetNTSTATUS(status);
 314                 return NULL;
 315         }
 316
 317         Py_RETURN_NONE;
 318 }
 319
 320 static PyObject *py_gensec_want_feature(PyObject *self, PyObject *args)
 321 {
 322         int feature;
 323         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 324         /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
 325         if (!PyArg_ParseTuple(args, "i", &feature))
 326                 return NULL;
 327
 328         gensec_want_feature(security, feature);
 329
 330         Py_RETURN_NONE;
 331 }
 332
 333 static PyObject *py_gensec_have_feature(PyObject *self, PyObject *args)
 334 {
 335         int feature;
 336         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 337         /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
 338         if (!PyArg_ParseTuple(args, "i", &feature))
 339                 return NULL;
 340
 341         if (gensec_have_feature(security, feature)) {
 342                 return Py_True;
 343         }
 344         return Py_False;
 345 }
 346
 347 static PyObject *py_gensec_update(PyObject *self, PyObject *args)
 348 {
 349         NTSTATUS status;
 350         TALLOC_CTX *mem_ctx;
 351         DATA_BLOB in, out;
 352         PyObject *ret, *py_in;
 353         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 354         PyObject *finished_processing;
 355         struct tevent_context *ev;
 356
 357         if (!PyArg_ParseTuple(args, "O", &py_in))
 358                 return NULL;
 359
 360         mem_ctx = talloc_new(NULL);
 361
 362         if (!PyString_Check(py_in)) {
 363                 PyErr_Format(PyExc_TypeError, "expected a string");
 364                 return NULL;
 365         }
 366
 367         in.data = (uint8_t *)PyString_AsString(py_in);
 368         in.length = PyString_Size(py_in);
 369
 370         ev = tevent_context_init(mem_ctx);
 371         if (ev == NULL) {
 372                 PyErr_NoMemory();
 373                 PyObject_Del(self);
 374                 return NULL;
 375         }
 376
 377         status = gensec_update(security, mem_ctx, ev, in, &out);
 378
 379         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)
 380             && !NT_STATUS_IS_OK(status)) {
 381                 PyErr_SetNTSTATUS(status);
 382                 talloc_free(mem_ctx);
 383                 return NULL;
 384         }
 385         ret = PyString_FromStringAndSize((const char *)out.data, out.length);
 386         talloc_free(mem_ctx);
 387
 388         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 389                 finished_processing = Py_False;
 390         } else {
 391                 finished_processing = Py_True;
 392         }
 393
 394         return PyTuple_Pack(2, finished_processing, ret);
 395 }
 396
 397 static PyObject *py_gensec_wrap(PyObject *self, PyObject *args)
 398 {
 399         NTSTATUS status;
 400
 401         TALLOC_CTX *mem_ctx;
 402         DATA_BLOB in, out;
 403         PyObject *ret, *py_in;
 404         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 405
 406         if (!PyArg_ParseTuple(args, "O", &py_in))
 407                 return NULL;
 408
 409         mem_ctx = talloc_new(NULL);
 410
 411         if (!PyString_Check(py_in)) {
 412                 PyErr_Format(PyExc_TypeError, "expected a string");
 413                 return NULL;
 414         }
 415         in.data = (uint8_t *)PyString_AsString(py_in);
 416         in.length = PyString_Size(py_in);
 417
 418         status = gensec_wrap(security, mem_ctx, &in, &out);
 419
 420         if (!NT_STATUS_IS_OK(status)) {
 421                 PyErr_SetNTSTATUS(status);
 422                 talloc_free(mem_ctx);
 423                 return NULL;
 424         }
 425
 426         ret = PyString_FromStringAndSize((const char *)out.data, out.length);
 427         talloc_free(mem_ctx);
 428         return ret;
 429 }
 430
 431 static PyObject *py_gensec_unwrap(PyObject *self, PyObject *args)
 432 {
 433         NTSTATUS status;
 434
 435         TALLOC_CTX *mem_ctx;
 436         DATA_BLOB in, out;
 437         PyObject *ret, *py_in;
 438         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 439
 440         if (!PyArg_ParseTuple(args, "O", &py_in))
 441                 return NULL;
 442
 443         mem_ctx = talloc_new(NULL);
 444
 445         if (!PyString_Check(py_in)) {
 446                 PyErr_Format(PyExc_TypeError, "expected a string");
 447                 return NULL;
 448         }
 449
 450         in.data = (uint8_t *)PyString_AsString(py_in);
 451         in.length = PyString_Size(py_in);
 452
 453         status = gensec_unwrap(security, mem_ctx, &in, &out);
 454
 455         if (!NT_STATUS_IS_OK(status)) {
 456                 PyErr_SetNTSTATUS(status);
 457                 talloc_free(mem_ctx);
 458                 return NULL;
 459         }
 460
 461         ret = PyString_FromStringAndSize((const char *)out.data, out.length);
 462         talloc_free(mem_ctx);
 463         return ret;
 464 }
 465
 466 static PyMethodDef py_gensec_security_methods[] = {
 467         { "start_client", (PyCFunction)py_gensec_start_client, METH_VARARGS|METH_KEYWORDS|METH_CLASS,
 468                 "S.start_client(settings) -> gensec" },
 469         { "start_server", (PyCFunction)py_gensec_start_server, METH_VARARGS|METH_KEYWORDS|METH_CLASS,
 470                 "S.start_server(auth_ctx, settings) -> gensec" },
 471         { "set_credentials", (PyCFunction)py_gensec_set_credentials, METH_VARARGS,
 472                 "S.start_client(credentials)" },
 473         { "session_info", (PyCFunction)py_gensec_session_info, METH_NOARGS,
 474                 "S.session_info() -> info" },
 475         { "start_mech_by_name", (PyCFunction)py_gensec_start_mech_by_name, METH_VARARGS,
 476         "S.start_mech_by_name(name)" },
 477         { "start_mech_by_sasl_name", (PyCFunction)py_gensec_start_mech_by_sasl_name, METH_VARARGS,
 478         "S.start_mech_by_sasl_name(name)" },
 479         { "start_mech_by_authtype", (PyCFunction)py_gensec_start_mech_by_authtype, METH_VARARGS, "S.start_mech_by_authtype(authtype, level)" },
 480         { "get_name_by_authtype", (PyCFunction)py_get_name_by_authtype, METH_VARARGS,
 481                 "S.get_name_by_authtype(authtype) -> name\nLookup an auth type." },
 482         { "want_feature", (PyCFunction)py_gensec_want_feature, METH_VARARGS,
 483           "S.want_feature(feature)\n Request that GENSEC negotiate a particular feature." },
 484         { "have_feature", (PyCFunction)py_gensec_have_feature, METH_VARARGS,
 485           "S.have_feature()\n Return True if GENSEC negotiated a particular feature." },
 486         { "update",  (PyCFunction)py_gensec_update, METH_VARARGS,
 487                 "S.update(blob_in) -> (finished, blob_out)\nPerform one step in a GENSEC dance.  Repeat with new packets until finished is true or exception." },
 488         { "wrap",  (PyCFunction)py_gensec_wrap, METH_VARARGS,
 489                 "S.wrap(blob_in) -> blob_out\nPackage one clear packet into a wrapped GENSEC packet." },
 490         { "unwrap",  (PyCFunction)py_gensec_unwrap, METH_VARARGS,
 491                 "S.unwrap(blob_in) -> blob_out\nPerform one wrapped GENSEC packet into a clear packet." },
 492
 493         { NULL }
 494 };
 495
 496 static PyTypeObject Py_Security = {
 497         .tp_name = "gensec.Security",
 498         .tp_flags = Py_TPFLAGS_DEFAULT,
 499         .tp_methods = py_gensec_security_methods,
 500         .tp_basicsize = sizeof(pytalloc_Object),
 501 };
 502
 503 void initgensec(void);
 504 void initgensec(void)
 505 {
 506         PyObject *m;
 507
 508         Py_Security.tp_base = pytalloc_GetObjectType();
 509         if (Py_Security.tp_base == NULL)
 510                 return;
 511
 512         if (PyType_Ready(&Py_Security) < 0)
 513                 return;
 514
 515         m = Py_InitModule3("gensec", NULL, "Generic Security Interface.");
 516         if (m == NULL)
 517                 return;
 518
 519         PyModule_AddObject(m, "FEATURE_SESSION_KEY",     PyInt_FromLong(GENSEC_FEATURE_SESSION_KEY));
 520         PyModule_AddObject(m, "FEATURE_SIGN",            PyInt_FromLong(GENSEC_FEATURE_SIGN));
 521         PyModule_AddObject(m, "FEATURE_SEAL",            PyInt_FromLong(GENSEC_FEATURE_SEAL));
 522         PyModule_AddObject(m, "FEATURE_DCE_STYLE",       PyInt_FromLong(GENSEC_FEATURE_DCE_STYLE));
 523         PyModule_AddObject(m, "FEATURE_ASYNC_REPLIES",   PyInt_FromLong(GENSEC_FEATURE_ASYNC_REPLIES));
 524         PyModule_AddObject(m, "FEATURE_DATAGRAM_MODE",   PyInt_FromLong(GENSEC_FEATURE_DATAGRAM_MODE));
 525         PyModule_AddObject(m, "FEATURE_SIGN_PKT_HEADER", PyInt_FromLong(GENSEC_FEATURE_SIGN_PKT_HEADER));
 526         PyModule_AddObject(m, "FEATURE_NEW_SPNEGO",      PyInt_FromLong(GENSEC_FEATURE_NEW_SPNEGO));
 527
 528         Py_INCREF(&Py_Security);
 529         PyModule_AddObject(m, "Security", (PyObject *)&Py_Security);
 530 }