s3-gse: align common elements between gse_context and gensec_gssapi_state

[metze/samba/wip.git] / source3 / librpc / crypto / gse.c

diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
index 9f8b3f770ea9e10e83f3877e0adaebdaec31aad3..7cf116522d316ad9f98875a2739cec4402feed98 100644 (file)
--- a/source3/librpc/crypto/gse.c
+++ b/source3/librpc/crypto/gse.c
@@ -70,24 +70,22 @@ gss_OID_desc gse_authz_data_oid = {
 static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
 
 struct gse_context {
+       gss_ctx_id_t gssapi_context;
+       gss_name_t server_name;
+       gss_name_t client_name;
+       OM_uint32 gss_want_flags, gss_got_flags;
+
+       gss_cred_id_t delegated_cred_handle;
+
+       /* gensec_gse only */
        krb5_context k5ctx;
        krb5_ccache ccache;
        krb5_keytab keytab;
 
-       gss_ctx_id_t gss_ctx;
-
        gss_OID_desc gss_mech;
-       OM_uint32 gss_c_flags;
        gss_cred_id_t creds;
-       gss_name_t server_name;
 
        gss_OID ret_mech;
-       OM_uint32 ret_flags;
-       gss_cred_id_t delegated_cred_handle;
-       gss_name_t client_name;
-
-       bool more_processing;
-       bool authenticated;
 };
 
 #ifndef HAVE_GSS_OID_EQUAL
@@ -127,9 +125,9 @@ static int gse_context_destructor(void *ptr)
                krb5_free_context(gse_ctx->k5ctx);
                gse_ctx->k5ctx = NULL;
        }
-       if (gse_ctx->gss_ctx != GSS_C_NO_CONTEXT) {
+       if (gse_ctx->gssapi_context != GSS_C_NO_CONTEXT) {
                gss_maj = gss_delete_sec_context(&gss_min,
-                                                &gse_ctx->gss_ctx,
+                                                &gse_ctx->gssapi_context,
                                                 GSS_C_NO_BUFFER);
        }
        if (gse_ctx->server_name) {
@@ -182,19 +180,19 @@ static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
 
        memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
 
-       gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG |
+       gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
                                GSS_C_DELEG_FLAG |
                                GSS_C_DELEG_POLICY_FLAG |
                                GSS_C_REPLAY_FLAG |
                                GSS_C_SEQUENCE_FLAG;
        if (do_sign) {
-               gse_ctx->gss_c_flags |= GSS_C_INTEG_FLAG;
+               gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
        }
        if (do_seal) {
-               gse_ctx->gss_c_flags |= GSS_C_CONF_FLAG;
+               gse_ctx->gss_want_flags |= GSS_C_CONF_FLAG;
        }
 
-       gse_ctx->gss_c_flags |= add_gss_c_flags;
+       gse_ctx->gss_want_flags |= add_gss_c_flags;
 
        /* Initialize Kerberos Context */
        initialize_krb5_error_table();
@@ -330,24 +328,21 @@ static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
 
        gss_maj = gss_init_sec_context(&gss_min,
                                        gse_ctx->creds,
-                                       &gse_ctx->gss_ctx,
+                                       &gse_ctx->gssapi_context,
                                        gse_ctx->server_name,
                                        &gse_ctx->gss_mech,
-                                       gse_ctx->gss_c_flags,
+                                       gse_ctx->gss_want_flags,
                                        0, GSS_C_NO_CHANNEL_BINDINGS,
                                        &in_data, NULL, &out_data,
-                                       &gse_ctx->ret_flags, NULL);
+                                       &gse_ctx->gss_got_flags, NULL);
        switch (gss_maj) {
        case GSS_S_COMPLETE:
                /* we are done with it */
-               gse_ctx->more_processing = false;
                status = NT_STATUS_OK;
                break;
        case GSS_S_CONTINUE_NEEDED:
                /* we will need a third leg */
-               gse_ctx->more_processing = true;
-               /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
-               status = NT_STATUS_OK;
+               status = NT_STATUS_MORE_PROCESSING_REQUIRED;
                break;
        default:
                DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
@@ -356,12 +351,15 @@ static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
                goto done;
        }
 
-       blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
-       if (!blob.data) {
-               status = NT_STATUS_NO_MEMORY;
-       }
+       /* we may be told to return nothing */
+       if (out_data.length) {
+               blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
+               if (!blob.data) {
+                       status = NT_STATUS_NO_MEMORY;
+               }
 
-       gss_maj = gss_release_buffer(&gss_min, &out_data);
+               gss_maj = gss_release_buffer(&gss_min, &out_data);
+       }
 
 done:
        *token_out = blob;
@@ -478,35 +476,31 @@ static NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
        in_data.length = token_in->length;
 
        gss_maj = gss_accept_sec_context(&gss_min,
-                                        &gse_ctx->gss_ctx,
+                                        &gse_ctx->gssapi_context,
                                         gse_ctx->creds,
                                         &in_data,
                                         GSS_C_NO_CHANNEL_BINDINGS,
                                         &gse_ctx->client_name,
                                         &gse_ctx->ret_mech,
                                         &out_data,
-                                        &gse_ctx->ret_flags, NULL,
+                                        &gse_ctx->gss_got_flags, NULL,
                                         &gse_ctx->delegated_cred_handle);
        switch (gss_maj) {
        case GSS_S_COMPLETE:
                /* we are done with it */
-               gse_ctx->more_processing = false;
-               gse_ctx->authenticated = true;
                status = NT_STATUS_OK;
                break;
        case GSS_S_CONTINUE_NEEDED:
                /* we will need a third leg */
-               gse_ctx->more_processing = true;
-               /* status = NT_STATUS_MORE_PROCESSING_REQUIRED; */
-               status = NT_STATUS_OK;
+               status = NT_STATUS_MORE_PROCESSING_REQUIRED;
                break;
        default:
                DEBUG(0, ("gss_init_sec_context failed with [%s]\n",
                          gse_errstr(talloc_tos(), gss_maj, gss_min)));
 
-               if (gse_ctx->gss_ctx) {
+               if (gse_ctx->gssapi_context) {
                        gss_delete_sec_context(&gss_min,
-                                               &gse_ctx->gss_ctx,
+                                               &gse_ctx->gssapi_context,
                                                GSS_C_NO_BUFFER);
                }
 
@@ -531,37 +525,38 @@ done:
 
 static NTSTATUS gse_verify_server_auth_flags(struct gse_context *gse_ctx)
 {
-       if (!gse_ctx->authenticated) {
-               return NT_STATUS_INVALID_HANDLE;
-       }
-
        if (memcmp(gse_ctx->ret_mech,
                   gss_mech_krb5, sizeof(gss_OID_desc)) != 0) {
                return NT_STATUS_ACCESS_DENIED;
        }
 
        /* GSS_C_MUTUAL_FLAG */
-       if (gse_ctx->gss_c_flags & GSS_C_MUTUAL_FLAG) {
-               if (!(gse_ctx->ret_flags & GSS_C_MUTUAL_FLAG)) {
-                       return NT_STATUS_ACCESS_DENIED;
-               }
-       }
-
        /* GSS_C_DELEG_FLAG */
        /* GSS_C_DELEG_POLICY_FLAG */
        /* GSS_C_REPLAY_FLAG */
        /* GSS_C_SEQUENCE_FLAG */
 
        /* GSS_C_INTEG_FLAG */
-       if (gse_ctx->gss_c_flags & GSS_C_INTEG_FLAG) {
-               if (!(gse_ctx->ret_flags & GSS_C_INTEG_FLAG)) {
+       if (gse_ctx->gss_want_flags & GSS_C_INTEG_FLAG) {
+               if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
                        return NT_STATUS_ACCESS_DENIED;
                }
        }
 
        /* GSS_C_CONF_FLAG */
-       if (gse_ctx->gss_c_flags & GSS_C_CONF_FLAG) {
-               if (!(gse_ctx->ret_flags & GSS_C_CONF_FLAG)) {
+       if (gse_ctx->gss_want_flags & GSS_C_CONF_FLAG) {
+               if (!(gse_ctx->gss_got_flags & GSS_C_CONF_FLAG)) {
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+       }
+
+       /* GSS_C_DCE_STYLE */
+       if (gse_ctx->gss_want_flags & GSS_C_DCE_STYLE) {
+               if (!(gse_ctx->gss_got_flags & GSS_C_DCE_STYLE)) {
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+               /* GSS_C_DCE_STYLE implies GSS_C_MUTUAL_FLAG */
+               if (!(gse_ctx->gss_got_flags & GSS_C_MUTUAL_FLAG)) {
                        return NT_STATUS_ACCESS_DENIED;
                }
        }
@@ -628,7 +623,7 @@ static DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
        DATA_BLOB ret;
 
        gss_maj = gss_inquire_sec_context_by_oid(
-                               &gss_min, gse_ctx->gss_ctx,
+                               &gss_min, gse_ctx->gssapi_context,
                                &gse_sesskey_inq_oid, &set);
        if (gss_maj) {
                DEBUG(0, ("gss_inquire_sec_context_by_oid failed [%s]\n",
@@ -644,7 +639,7 @@ static DATA_BLOB gse_get_session_key(TALLOC_CTX *mem_ctx,
 #ifdef HAVE_GSSKRB5_GET_SUBKEY
                krb5_keyblock *subkey;
                gss_maj = gsskrb5_get_subkey(&gss_min,
-                                            gse_ctx->gss_ctx,
+                                            gse_ctx->gssapi_context,
                                             &subkey);
                if (gss_maj != 0) {
                        DEBUG(1, ("NO session key for this mech\n"));
@@ -687,7 +682,7 @@ static size_t gse_get_signature_length(struct gse_context *gse_ctx,
        iov[1].buffer.value = NULL;
        iov[1].buffer.length = payload_size;
 
-       gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gss_ctx,
+       gss_maj = gss_wrap_iov_length(&gss_min, gse_ctx->gssapi_context,
                                        seal, GSS_C_QOP_DEFAULT,
                                        &sealed, iov, 2);
        if (gss_maj) {
@@ -726,7 +721,7 @@ static NTSTATUS gse_seal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
        iov[1].buffer.value = data->data;
        iov[1].buffer.length = data->length;
 
-       gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gss_ctx,
+       gss_maj = gss_wrap_iov(&gss_min, gse_ctx->gssapi_context,
                                req_seal, GSS_C_QOP_DEFAULT,
                                &sealed, iov, 2);
        if (gss_maj) {
@@ -768,7 +763,7 @@ static NTSTATUS gse_unseal(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
        iov[1].buffer.value = data->data;
        iov[1].buffer.length = data->length;
 
-       gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gss_ctx,
+       gss_maj = gss_unwrap_iov(&gss_min, gse_ctx->gssapi_context,
                                 &sealed, NULL, iov, 2);
        if (gss_maj) {
                DEBUG(0, ("gss_unwrap_iov failed with [%s]\n",
@@ -803,7 +798,7 @@ static NTSTATUS gse_sign(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
        in_data.value = data->data;
        in_data.length = data->length;
 
-       gss_maj = gss_get_mic(&gss_min, gse_ctx->gss_ctx,
+       gss_maj = gss_get_mic(&gss_min, gse_ctx->gssapi_context,
                              GSS_C_QOP_DEFAULT,
                              &in_data, &out_data);
        if (gss_maj) {
@@ -842,7 +837,7 @@ static NTSTATUS gse_sigcheck(TALLOC_CTX *mem_ctx, struct gse_context *gse_ctx,
        in_token.value = signature->data;
        in_token.length = signature->length;
 
-       gss_maj = gss_verify_mic(&gss_min, gse_ctx->gss_ctx,
+       gss_maj = gss_verify_mic(&gss_min, gse_ctx->gssapi_context,
                                 &in_data, &in_token, NULL);
        if (gss_maj) {
                DEBUG(0, ("gss_verify_mic failed with [%s]\n",
@@ -983,9 +978,6 @@ static NTSTATUS gensec_gse_update(struct gensec_security *gensec_security,
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
-       if (gse_ctx->more_processing) {
-               return NT_STATUS_MORE_PROCESSING_REQUIRED;
-       }
 
        if (gensec_security->gensec_role == GENSEC_SERVER) {
                return gse_verify_server_auth_flags(gse_ctx);
@@ -1009,7 +1001,7 @@ static NTSTATUS gensec_gse_wrap(struct gensec_security *gensec_security,
        input_token.value = in->data;
 
        maj_stat = gss_wrap(&min_stat,
-                           gse_ctx->gss_ctx,
+                           gse_ctx->gssapi_context,
                            gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
                            GSS_C_QOP_DEFAULT,
                            &input_token,
@@ -1047,7 +1039,7 @@ static NTSTATUS gensec_gse_unwrap(struct gensec_security *gensec_security,
        input_token.value = in->data;
 
        maj_stat = gss_unwrap(&min_stat,
-                             gse_ctx->gss_ctx,
+                             gse_ctx->gssapi_context,
                              &input_token,
                              &output_token,
                              &conf_state,
@@ -1127,10 +1119,10 @@ static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
                struct gse_context);
 
        if (feature & GENSEC_FEATURE_SIGN) {
-               return gse_ctx->ret_flags & GSS_C_INTEG_FLAG;
+               return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
        }
        if (feature & GENSEC_FEATURE_SEAL) {
-               return gse_ctx->ret_flags & GSS_C_CONF_FLAG;
+               return gse_ctx->gss_got_flags & GSS_C_CONF_FLAG;
        }
        if (feature & GENSEC_FEATURE_SESSION_KEY) {
                /* Only for GSE/Krb5 */
@@ -1139,7 +1131,7 @@ static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
                }
        }
        if (feature & GENSEC_FEATURE_DCE_STYLE) {
-               return gse_ctx->ret_flags & GSS_C_DCE_STYLE;
+               return gse_ctx->gss_got_flags & GSS_C_DCE_STYLE;
        }
        /* We can always do async (rather than strict request/reply) packets.  */
        if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
@@ -1216,7 +1208,7 @@ static NTSTATUS gensec_gse_session_info(struct gensec_security *gensec_security,
                return NT_STATUS_NO_MEMORY;
        }
 
-       nt_status = gssapi_obtain_pac_blob(tmp_ctx,  gse_ctx->gss_ctx,
+       nt_status = gssapi_obtain_pac_blob(tmp_ctx,  gse_ctx->gssapi_context,
                                           gse_ctx->client_name,
                                           &pac_blob);