auth/gensec/gensec.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Generic Authentication Interface
   5
   6    Copyright (C) Andrew Tridgell 2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/network.h"
  25 #define TEVENT_DEPRECATED 1
  26 #include <tevent.h>
  27 #include "lib/tsocket/tsocket.h"
  28 #include "lib/util/tevent_ntstatus.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "auth/gensec/gensec_internal.h"
  31 #include "librpc/gen_ndr/dcerpc.h"
  32 #include "auth/common_auth.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_AUTH
  36
  37 _PRIVATE_ NTSTATUS gensec_may_reset_crypto(struct gensec_security *gensec_security,
  38                                            bool full_reset)
  39 {
  40         if (!gensec_security->ops->may_reset_crypto) {
  41                 return NT_STATUS_OK;
  42         }
  43
  44         return gensec_security->ops->may_reset_crypto(gensec_security, full_reset);
  45 }
  46
  47 /*
  48   wrappers for the gensec function pointers
  49 */
  50 _PUBLIC_ NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
  51                               uint8_t *data, size_t length,
  52                               const uint8_t *whole_pdu, size_t pdu_length,
  53                               const DATA_BLOB *sig)
  54 {
  55         if (!gensec_security->ops->unseal_packet) {
  56                 return NT_STATUS_NOT_IMPLEMENTED;
  57         }
  58         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
  59                 return NT_STATUS_INVALID_PARAMETER;
  60         }
  61         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
  62                 return NT_STATUS_INVALID_PARAMETER;
  63         }
  64         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE)) {
  65                 return NT_STATUS_INVALID_PARAMETER;
  66         }
  67
  68         return gensec_security->ops->unseal_packet(gensec_security,
  69                                                    data, length,
  70                                                    whole_pdu, pdu_length,
  71                                                    sig);
  72 }
  73
  74 _PUBLIC_ NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
  75                              const uint8_t *data, size_t length,
  76                              const uint8_t *whole_pdu, size_t pdu_length,
  77                              const DATA_BLOB *sig)
  78 {
  79         if (!gensec_security->ops->check_packet) {
  80                 return NT_STATUS_NOT_IMPLEMENTED;
  81         }
  82         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
  83                 return NT_STATUS_INVALID_PARAMETER;
  84         }
  85
  86         return gensec_security->ops->check_packet(gensec_security, data, length, whole_pdu, pdu_length, sig);
  87 }
  88
  89 _PUBLIC_ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
  90                             TALLOC_CTX *mem_ctx,
  91                             uint8_t *data, size_t length,
  92                             const uint8_t *whole_pdu, size_t pdu_length,
  93                             DATA_BLOB *sig)
  94 {
  95         if (!gensec_security->ops->seal_packet) {
  96                 return NT_STATUS_NOT_IMPLEMENTED;
  97         }
  98         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
  99                 return NT_STATUS_INVALID_PARAMETER;
 100         }
 101         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 102                 return NT_STATUS_INVALID_PARAMETER;
 103         }
 104         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE)) {
 105                 return NT_STATUS_INVALID_PARAMETER;
 106         }
 107
 108         return gensec_security->ops->seal_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
 109 }
 110
 111 _PUBLIC_ NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security,
 112                             TALLOC_CTX *mem_ctx,
 113                             const uint8_t *data, size_t length,
 114                             const uint8_t *whole_pdu, size_t pdu_length,
 115                             DATA_BLOB *sig)
 116 {
 117         if (!gensec_security->ops->sign_packet) {
 118                 return NT_STATUS_NOT_IMPLEMENTED;
 119         }
 120         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 121                 return NT_STATUS_INVALID_PARAMETER;
 122         }
 123
 124         return gensec_security->ops->sign_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
 125 }
 126
 127 _PUBLIC_ size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size)
 128 {
 129         if (!gensec_security->ops->sig_size) {
 130                 return 0;
 131         }
 132         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 133                 return 0;
 134         }
 135         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 136                 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE)) {
 137                         return 0;
 138                 }
 139         }
 140
 141         return gensec_security->ops->sig_size(gensec_security, data_size);
 142 }
 143
 144 _PUBLIC_ size_t gensec_max_wrapped_size(struct gensec_security *gensec_security)
 145 {
 146         if (!gensec_security->ops->max_wrapped_size) {
 147                 return (1 << 17);
 148         }
 149
 150         return gensec_security->ops->max_wrapped_size(gensec_security);
 151 }
 152
 153 _PUBLIC_ size_t gensec_max_input_size(struct gensec_security *gensec_security)
 154 {
 155         if (!gensec_security->ops->max_input_size) {
 156                 return (1 << 17) - gensec_sig_size(gensec_security, 1 << 17);
 157         }
 158
 159         return gensec_security->ops->max_input_size(gensec_security);
 160 }
 161
 162 _PUBLIC_ NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
 163                      TALLOC_CTX *mem_ctx,
 164                      const DATA_BLOB *in,
 165                      DATA_BLOB *out)
 166 {
 167         if (!gensec_security->ops->wrap) {
 168                 return NT_STATUS_NOT_IMPLEMENTED;
 169         }
 170         return gensec_security->ops->wrap(gensec_security, mem_ctx, in, out);
 171 }
 172
 173 _PUBLIC_ NTSTATUS gensec_unwrap(struct gensec_security *gensec_security,
 174                        TALLOC_CTX *mem_ctx,
 175                        const DATA_BLOB *in,
 176                        DATA_BLOB *out)
 177 {
 178         if (!gensec_security->ops->unwrap) {
 179                 return NT_STATUS_NOT_IMPLEMENTED;
 180         }
 181         return gensec_security->ops->unwrap(gensec_security, mem_ctx, in, out);
 182 }
 183
 184 _PUBLIC_ NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
 185                                      TALLOC_CTX *mem_ctx,
 186                                      DATA_BLOB *session_key)
 187 {
 188         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SESSION_KEY)) {
 189                 return NT_STATUS_NO_USER_SESSION_KEY;
 190         }
 191
 192         if (!gensec_security->ops->session_key) {
 193                 return NT_STATUS_NOT_IMPLEMENTED;
 194         }
 195
 196         return gensec_security->ops->session_key(gensec_security, mem_ctx, session_key);
 197 }
 198
 199 const char *gensec_final_auth_type(struct gensec_security *gensec_security)
 200 {
 201         if (!gensec_security->ops->final_auth_type) {
 202                 return gensec_security->ops->name;
 203         }
 204
 205         return gensec_security->ops->final_auth_type(gensec_security);
 206 }
 207
 208 /*
 209  * Log details of a successful GENSEC authorization to a service.
 210  *
 211  * Only successful authorizations are logged, as only these call gensec_session_info()
 212  *
 213  * The service may later refuse authorization due to an ACL.
 214  *
 215  */
 216 static void log_successful_gensec_authz_event(struct gensec_security *gensec_security,
 217                                               struct auth_session_info *session_info)
 218 {
 219         const struct tsocket_address *remote
 220                 = gensec_get_remote_address(gensec_security);
 221         const struct tsocket_address *local
 222                 = gensec_get_local_address(gensec_security);
 223         const char *service_description
 224                 = gensec_get_target_service_description(gensec_security);
 225         const char *final_auth_type
 226                 = gensec_final_auth_type(gensec_security);
 227         const char *transport_protection = NULL;
 228         if (gensec_security->want_features & GENSEC_FEATURE_SMB_TRANSPORT) {
 229                 transport_protection = AUTHZ_TRANSPORT_PROTECTION_SMB;
 230         } else if (gensec_security->want_features & GENSEC_FEATURE_LDAPS_TRANSPORT) {
 231                 transport_protection = AUTHZ_TRANSPORT_PROTECTION_TLS;
 232         } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 233                 transport_protection = AUTHZ_TRANSPORT_PROTECTION_SEAL;
 234         } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 235                 transport_protection = AUTHZ_TRANSPORT_PROTECTION_SIGN;
 236         } else {
 237                 transport_protection = AUTHZ_TRANSPORT_PROTECTION_NONE;
 238         }
 239         log_successful_authz_event(gensec_security->auth_context->msg_ctx,
 240                                    gensec_security->auth_context->lp_ctx,
 241                                    remote, local,
 242                                    service_description,
 243                                    final_auth_type,
 244                                    transport_protection,
 245                                    session_info);
 246 }
 247
 248
 249 /**
 250  * Return the credentials of a logged on user, including session keys
 251  * etc.
 252  *
 253  * Only valid after a successful authentication
 254  *
 255  * May only be called once per authentication.  This will also make an
 256  * authorization log entry, as it is already called by all the
 257  * callers.
 258  *
 259  */
 260
 261 _PUBLIC_ NTSTATUS gensec_session_info(struct gensec_security *gensec_security,
 262                                       TALLOC_CTX *mem_ctx,
 263                                       struct auth_session_info **session_info)
 264 {
 265         NTSTATUS status;
 266         if (!gensec_security->ops->session_info) {
 267                 return NT_STATUS_NOT_IMPLEMENTED;
 268         }
 269         status = gensec_security->ops->session_info(gensec_security, mem_ctx, session_info);
 270
 271         if (NT_STATUS_IS_OK(status) && !gensec_security->subcontext
 272             && (gensec_security->want_features & GENSEC_FEATURE_NO_AUTHZ_LOG) == 0) {
 273                 log_successful_gensec_authz_event(gensec_security, *session_info);
 274         }
 275
 276         return status;
 277 }
 278
 279 _PUBLIC_ void gensec_set_max_update_size(struct gensec_security *gensec_security,
 280                                 uint32_t max_update_size)
 281 {
 282         gensec_security->max_update_size = max_update_size;
 283 }
 284
 285 _PUBLIC_ size_t gensec_max_update_size(struct gensec_security *gensec_security)
 286 {
 287         if (gensec_security->max_update_size == 0) {
 288                 return UINT32_MAX;
 289         }
 290
 291         return gensec_security->max_update_size;
 292 }
 293
 294 static NTSTATUS gensec_verify_features(struct gensec_security *gensec_security)
 295 {
 296         bool ok;
 297
 298         /*
 299          * gensec_want_feature(GENSEC_FEATURE_SIGN)
 300          * and
 301          * gensec_want_feature(GENSEC_FEATURE_SEAL)
 302          * require these flags to be available.
 303          */
 304         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
 305                 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 306                         DEBUG(0,("Did not manage to negotiate mandatory feature "
 307                                  "SIGN\n"));
 308                         return NT_STATUS_ACCESS_DENIED;
 309                 }
 310         }
 311         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
 312                 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 313                         DEBUG(0,("Did not manage to negotiate mandatory feature "
 314                                  "SEAL\n"));
 315                         return NT_STATUS_ACCESS_DENIED;
 316                 }
 317                 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
 318                         DEBUG(0,("Did not manage to negotiate mandatory feature "
 319                                  "SIGN for SEAL\n"));
 320                         return NT_STATUS_ACCESS_DENIED;
 321                 }
 322         }
 323
 324         if (gensec_security->dcerpc_auth_level < DCERPC_AUTH_LEVEL_PACKET) {
 325                 return NT_STATUS_OK;
 326         }
 327
 328         ok = gensec_have_feature(gensec_security,
 329                                  GENSEC_FEATURE_SIGN_PKT_HEADER);
 330         if (!ok) {
 331                 DBG_ERR("backend [%s] does not support header signing! "
 332                         "auth_level[0x%x]\n",
 333                         gensec_security->ops->name,
 334                         gensec_security->dcerpc_auth_level);
 335                 return NT_STATUS_INTERNAL_ERROR;
 336         }
 337
 338         return NT_STATUS_OK;
 339 }
 340
 341 /**
 342  * Next state function for the GENSEC state machine
 343  *
 344  * @param gensec_security GENSEC State
 345  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
 346  * @param in The request, as a DATA_BLOB
 347  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 348  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 349  *                or NT_STATUS_OK if the user is authenticated.
 350  */
 351 _PUBLIC_ NTSTATUS gensec_update(struct gensec_security *gensec_security,
 352                                 TALLOC_CTX *out_mem_ctx,
 353                                 const DATA_BLOB in, DATA_BLOB *out)
 354 {
 355         NTSTATUS status;
 356         TALLOC_CTX *frame = NULL;
 357         struct tevent_context *ev = NULL;
 358         struct tevent_req *subreq = NULL;
 359         bool ok;
 360
 361         if (gensec_security->subcontext) {
 362                 /*
 363                  * gensec modules are not allowed to call the sync version.
 364                  */
 365                 return NT_STATUS_INTERNAL_ERROR;
 366         }
 367
 368         frame = talloc_stackframe();
 369
 370         ev = samba_tevent_context_init(frame);
 371         if (ev == NULL) {
 372                 status = NT_STATUS_NO_MEMORY;
 373                 goto fail;
 374         }
 375
 376         /*
 377          * TODO: remove this hack once the backends
 378          * are fixed.
 379          */
 380         tevent_loop_allow_nesting(ev);
 381
 382         subreq = gensec_update_send(frame, ev, gensec_security, in);
 383         if (subreq == NULL) {
 384                 status = NT_STATUS_NO_MEMORY;
 385                 goto fail;
 386         }
 387         ok = tevent_req_poll_ntstatus(subreq, ev, &status);
 388         if (!ok) {
 389                 goto fail;
 390         }
 391         status = gensec_update_recv(subreq, out_mem_ctx, out);
 392  fail:
 393         TALLOC_FREE(frame);
 394         return status;
 395 }
 396
 397 struct gensec_update_state {
 398         const struct gensec_security_ops *ops;
 399         struct gensec_security *gensec_security;
 400         NTSTATUS status;
 401         DATA_BLOB out;
 402 };
 403
 404 static void gensec_update_cleanup(struct tevent_req *req,
 405                                   enum tevent_req_state req_state);
 406 static void gensec_update_done(struct tevent_req *subreq);
 407
 408 /**
 409  * Next state function for the GENSEC state machine async version
 410  *
 411  * @param mem_ctx The memory context for the request
 412  * @param ev The event context for the request
 413  * @param gensec_security GENSEC State
 414  * @param in The request, as a DATA_BLOB
 415  *
 416  * @return The request handle or NULL on no memory failure
 417  */
 418
 419 _PUBLIC_ struct tevent_req *gensec_update_send(TALLOC_CTX *mem_ctx,
 420                                                struct tevent_context *ev,
 421                                                struct gensec_security *gensec_security,
 422                                                const DATA_BLOB in)
 423 {
 424         struct tevent_req *req = NULL;
 425         struct gensec_update_state *state = NULL;
 426         struct tevent_req *subreq = NULL;
 427
 428         req = tevent_req_create(mem_ctx, &state,
 429                                 struct gensec_update_state);
 430         if (req == NULL) {
 431                 return NULL;
 432         }
 433         state->ops = gensec_security->ops;
 434         state->gensec_security = gensec_security;
 435
 436         if (gensec_security->update_busy_ptr != NULL) {
 437                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 438                 return tevent_req_post(req, ev);
 439         }
 440
 441         if (gensec_security->child_security != NULL) {
 442                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 443                 return tevent_req_post(req, ev);
 444         }
 445
 446         gensec_security->update_busy_ptr = &state->gensec_security;
 447         tevent_req_set_cleanup_fn(req, gensec_update_cleanup);
 448
 449         subreq = state->ops->update_send(state, ev, gensec_security, in);
 450         if (tevent_req_nomem(subreq, req)) {
 451                 return tevent_req_post(req, ev);
 452         }
 453         tevent_req_set_callback(subreq, gensec_update_done, req);
 454
 455         DBG_DEBUG("%s[%p]: subreq: %p\n", state->ops->name,
 456                   state->gensec_security, subreq);
 457
 458         return req;
 459 }
 460
 461 static void gensec_update_cleanup(struct tevent_req *req,
 462                                   enum tevent_req_state req_state)
 463 {
 464         struct gensec_update_state *state =
 465                 tevent_req_data(req,
 466                 struct gensec_update_state);
 467
 468         if (state->gensec_security == NULL) {
 469                 return;
 470         }
 471
 472         if (state->gensec_security->update_busy_ptr == &state->gensec_security) {
 473                 state->gensec_security->update_busy_ptr = NULL;
 474         }
 475
 476         state->gensec_security = NULL;
 477 }
 478
 479 static void gensec_update_done(struct tevent_req *subreq)
 480 {
 481         struct tevent_req *req =
 482                 tevent_req_callback_data(subreq,
 483                 struct tevent_req);
 484         struct gensec_update_state *state =
 485                 tevent_req_data(req,
 486                 struct gensec_update_state);
 487         NTSTATUS status;
 488         const char *debug_subreq = NULL;
 489
 490         if (CHECK_DEBUGLVL(DBGLVL_DEBUG)) {
 491                 /*
 492                  * We need to call tevent_req_print()
 493                  * before calling the _recv function,
 494                  * before tevent_req_received() was called.
 495                  * in order to print the pointer value of
 496                  * the subreq state.
 497                  */
 498                 debug_subreq = tevent_req_print(state, subreq);
 499         }
 500
 501         status = state->ops->update_recv(subreq, state, &state->out);
 502         TALLOC_FREE(subreq);
 503         state->status = status;
 504         if (GENSEC_UPDATE_IS_NTERROR(status)) {
 505                 DBG_INFO("%s[%p]: %s%s%s\n", state->ops->name,
 506                          state->gensec_security, nt_errstr(status),
 507                          debug_subreq ? " " : "",
 508                          debug_subreq ? debug_subreq : "");
 509                 tevent_req_nterror(req, status);
 510                 return;
 511         }
 512         DBG_DEBUG("%s[%p]: %s %s\n", state->ops->name,
 513                   state->gensec_security, nt_errstr(status),
 514                   debug_subreq);
 515         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 516                 tevent_req_done(req);
 517                 return;
 518         }
 519
 520         /*
 521          * Because callers using the
 522          * gensec_start_mech_by_authtype() never call
 523          * gensec_want_feature(), it isn't sensible for them
 524          * to have to call gensec_have_feature() manually, and
 525          * these are not points of negotiation, but are
 526          * asserted by the client
 527          */
 528         status = gensec_verify_features(state->gensec_security);
 529         if (tevent_req_nterror(req, status)) {
 530                 return;
 531         }
 532
 533         tevent_req_done(req);
 534 }
 535
 536 /**
 537  * Next state function for the GENSEC state machine
 538  *
 539  * @param req request state
 540  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
 541  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 542  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 543  *                or NT_STATUS_OK if the user is authenticated.
 544  */
 545 _PUBLIC_ NTSTATUS gensec_update_recv(struct tevent_req *req,
 546                                      TALLOC_CTX *out_mem_ctx,
 547                                      DATA_BLOB *out)
 548 {
 549         struct gensec_update_state *state =
 550                 tevent_req_data(req, struct gensec_update_state);
 551         NTSTATUS status;
 552
 553         *out = data_blob_null;
 554
 555         if (tevent_req_is_nterror(req, &status)) {
 556                 tevent_req_received(req);
 557                 return status;
 558         }
 559
 560         *out = state->out;
 561         talloc_steal(out_mem_ctx, out->data);
 562         status = state->status;
 563         tevent_req_received(req);
 564         return status;
 565 }
 566
 567 /**
 568  * Set the requirement for a certain feature on the connection
 569  *
 570  */
 571
 572 _PUBLIC_ void gensec_want_feature(struct gensec_security *gensec_security,
 573                          uint32_t feature)
 574 {
 575         if (!gensec_security->ops || !gensec_security->ops->want_feature) {
 576                 gensec_security->want_features |= feature;
 577                 return;
 578         }
 579         gensec_security->ops->want_feature(gensec_security, feature);
 580 }
 581
 582 /**
 583  * Check the requirement for a certain feature on the connection
 584  *
 585  */
 586
 587 _PUBLIC_ bool gensec_have_feature(struct gensec_security *gensec_security,
 588                          uint32_t feature)
 589 {
 590         if (!gensec_security->ops || !gensec_security->ops->have_feature) {
 591                 return false;
 592         }
 593
 594         /* We might 'have' features that we don't 'want', because the
 595          * other end demanded them, or we can't neotiate them off */
 596         return gensec_security->ops->have_feature(gensec_security, feature);
 597 }
 598
 599 _PUBLIC_ NTTIME gensec_expire_time(struct gensec_security *gensec_security)
 600 {
 601         if (!gensec_security->ops->expire_time) {
 602                 return GENSEC_EXPIRE_TIME_INFINITY;
 603         }
 604
 605         return gensec_security->ops->expire_time(gensec_security);
 606 }
 607 /**
 608  * Return the credentials structure associated with a GENSEC context
 609  *
 610  */
 611
 612 _PUBLIC_ struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security)
 613 {
 614         if (!gensec_security) {
 615                 return NULL;
 616         }
 617         return gensec_security->credentials;
 618 }
 619
 620 /**
 621  * Set the target service (such as 'http' or 'host') on a GENSEC context - ensures it is talloc()ed
 622  *
 623  * This is used for Kerberos service principal name resolution.
 624  */
 625
 626 _PUBLIC_ NTSTATUS gensec_set_target_service(struct gensec_security *gensec_security, const char *service)
 627 {
 628         gensec_security->target.service = talloc_strdup(gensec_security, service);
 629         if (!gensec_security->target.service) {
 630                 return NT_STATUS_NO_MEMORY;
 631         }
 632         return NT_STATUS_OK;
 633 }
 634
 635 _PUBLIC_ const char *gensec_get_target_service(struct gensec_security *gensec_security)
 636 {
 637         if (gensec_security->target.service) {
 638                 return gensec_security->target.service;
 639         }
 640
 641         return "host";
 642 }
 643
 644 /**
 645  * Set the target service (such as 'samr') on an GENSEC context - ensures it is talloc()ed.
 646  *
 647  * This is not the Kerberos service principal, instead this is a
 648  * constant value that can be logged as part of authentication and
 649  * authorization logging
 650  */
 651 _PUBLIC_ NTSTATUS gensec_set_target_service_description(struct gensec_security *gensec_security,
 652                                                         const char *service)
 653 {
 654         gensec_security->target.service_description = talloc_strdup(gensec_security, service);
 655         if (!gensec_security->target.service_description) {
 656                 return NT_STATUS_NO_MEMORY;
 657         }
 658         return NT_STATUS_OK;
 659 }
 660
 661 _PUBLIC_ const char *gensec_get_target_service_description(struct gensec_security *gensec_security)
 662 {
 663         if (gensec_security->target.service_description) {
 664                 return gensec_security->target.service_description;
 665         } else if (gensec_security->target.service) {
 666                 return gensec_security->target.service;
 667         }
 668
 669         return NULL;
 670 }
 671
 672 /**
 673  * Set the target hostname (suitable for kerberos resolutation) on a GENSEC context - ensures it is talloc()ed
 674  *
 675  */
 676
 677 _PUBLIC_ NTSTATUS gensec_set_target_hostname(struct gensec_security *gensec_security, const char *hostname)
 678 {
 679         gensec_security->target.hostname = talloc_strdup(gensec_security, hostname);
 680         if (hostname && !gensec_security->target.hostname) {
 681                 return NT_STATUS_NO_MEMORY;
 682         }
 683         return NT_STATUS_OK;
 684 }
 685
 686 _PUBLIC_ const char *gensec_get_target_hostname(struct gensec_security *gensec_security)
 687 {
 688         /* We allow the target hostname to be overridden for testing purposes */
 689         if (gensec_security->settings->target_hostname) {
 690                 return gensec_security->settings->target_hostname;
 691         }
 692
 693         if (gensec_security->target.hostname) {
 694                 return gensec_security->target.hostname;
 695         }
 696
 697         /* We could add use the 'set sockaddr' call, and do a reverse
 698          * lookup, but this would be both insecure (compromising the
 699          * way kerberos works) and add DNS timeouts */
 700         return NULL;
 701 }
 702
 703 /**
 704  * Set (and copy) local and peer socket addresses onto a socket
 705  * context on the GENSEC context.
 706  *
 707  * This is so that kerberos can include these addresses in
 708  * cryptographic tokens, to avoid certain attacks.
 709  */
 710
 711 /**
 712  * @brief Set the local gensec address.
 713  *
 714  * @param  gensec_security   The gensec security context to use.
 715  *
 716  * @param  remote       The local address to set.
 717  *
 718  * @return              On success NT_STATUS_OK is returned or an NT_STATUS
 719  *                      error.
 720  */
 721 _PUBLIC_ NTSTATUS gensec_set_local_address(struct gensec_security *gensec_security,
 722                 const struct tsocket_address *local)
 723 {
 724         TALLOC_FREE(gensec_security->local_addr);
 725
 726         if (local == NULL) {
 727                 return NT_STATUS_OK;
 728         }
 729
 730         gensec_security->local_addr = tsocket_address_copy(local, gensec_security);
 731         if (gensec_security->local_addr == NULL) {
 732                 return NT_STATUS_NO_MEMORY;
 733         }
 734
 735         return NT_STATUS_OK;
 736 }
 737
 738 /**
 739  * @brief Set the remote gensec address.
 740  *
 741  * @param  gensec_security   The gensec security context to use.
 742  *
 743  * @param  remote       The remote address to set.
 744  *
 745  * @return              On success NT_STATUS_OK is returned or an NT_STATUS
 746  *                      error.
 747  */
 748 _PUBLIC_ NTSTATUS gensec_set_remote_address(struct gensec_security *gensec_security,
 749                 const struct tsocket_address *remote)
 750 {
 751         TALLOC_FREE(gensec_security->remote_addr);
 752
 753         if (remote == NULL) {
 754                 return NT_STATUS_OK;
 755         }
 756
 757         gensec_security->remote_addr = tsocket_address_copy(remote, gensec_security);
 758         if (gensec_security->remote_addr == NULL) {
 759                 return NT_STATUS_NO_MEMORY;
 760         }
 761
 762         return NT_STATUS_OK;
 763 }
 764
 765 /**
 766  * @brief Get the local address from a gensec security context.
 767  *
 768  * @param  gensec_security   The security context to get the address from.
 769  *
 770  * @return              The address as tsocket_address which could be NULL if
 771  *                      no address is set.
 772  */
 773 _PUBLIC_ const struct tsocket_address *gensec_get_local_address(struct gensec_security *gensec_security)
 774 {
 775         if (gensec_security == NULL) {
 776                 return NULL;
 777         }
 778         return gensec_security->local_addr;
 779 }
 780
 781 /**
 782  * @brief Get the remote address from a gensec security context.
 783  *
 784  * @param  gensec_security   The security context to get the address from.
 785  *
 786  * @return              The address as tsocket_address which could be NULL if
 787  *                      no address is set.
 788  */
 789 _PUBLIC_ const struct tsocket_address *gensec_get_remote_address(struct gensec_security *gensec_security)
 790 {
 791         if (gensec_security == NULL) {
 792                 return NULL;
 793         }
 794         return gensec_security->remote_addr;
 795 }
 796
 797 /**
 798  * Set the target principal (assuming it it known, say from the SPNEGO reply)
 799  *  - ensures it is talloc()ed
 800  *
 801  */
 802
 803 _PUBLIC_ NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal)
 804 {
 805         gensec_security->target.principal = talloc_strdup(gensec_security, principal);
 806         if (!gensec_security->target.principal) {
 807                 return NT_STATUS_NO_MEMORY;
 808         }
 809         return NT_STATUS_OK;
 810 }
 811
 812 _PUBLIC_ const char *gensec_get_target_principal(struct gensec_security *gensec_security)
 813 {
 814         if (gensec_security->target.principal) {
 815                 return gensec_security->target.principal;
 816         }
 817
 818         return NULL;
 819 }