source/auth/gensec/gensec_gsskrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    GSSAPI KRB5 backend for GENSEC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
   7    Copyright (C) Stefan Metzmacher <metze@samba.org> 2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "system/kerberos.h"
  26 #include "system/time.h"
  27 #include "auth/kerberos/kerberos.h"
  28 #include "auth/auth.h"
  29
  30 static const gss_OID_desc gensec_gss_krb5_mechanism_oid_desc =
  31                         {9, (void *)discard_const_p(char, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02")};
  32
  33 enum GENSEC_GSSKRB5_STATE {
  34         GENSEC_GSSKRB5_CLIENT_START,
  35         GENSEC_GSSKRB5_CLIENT_MUTUAL_AUTH,
  36         GENSEC_GSSKRB5_CLIENT_DCE_STYLE,
  37         GENSEC_GSSKRB5_DONE
  38 };
  39
  40 struct gensec_gsskrb5_state {
  41         enum GENSEC_GSSKRB5_STATE state_position;
  42         gss_ctx_id_t gssapi_context;
  43         struct gss_channel_bindings_struct *input_chan_bindings;
  44         gss_name_t server_name;
  45         gss_name_t client_name;
  46         OM_uint32 want_flags, got_flags;
  47 };
  48
  49 static int gensec_gsskrb5_destory(void *ptr)
  50 {
  51         struct gensec_gsskrb5_state *gensec_gsskrb5_state = ptr;
  52         OM_uint32 maj_stat, min_stat;
  53
  54         if (gensec_gsskrb5_state->gssapi_context != GSS_C_NO_CONTEXT) {
  55                 maj_stat = gss_delete_sec_context (&min_stat,
  56                                                    &gensec_gsskrb5_state->gssapi_context,
  57                                                    GSS_C_NO_BUFFER);
  58         }
  59
  60         if (gensec_gsskrb5_state->server_name != GSS_C_NO_NAME) {
  61                 maj_stat = gss_release_name(&min_stat, &gensec_gsskrb5_state->server_name);
  62         }
  63         if (gensec_gsskrb5_state->client_name != GSS_C_NO_NAME) {
  64                 maj_stat = gss_release_name(&min_stat, &gensec_gsskrb5_state->client_name);
  65         }
  66         return 0;
  67 }
  68
  69 static NTSTATUS gensec_gsskrb5_start(struct gensec_security *gensec_security)
  70 {
  71         struct gensec_gsskrb5_state *gensec_gsskrb5_state;
  72
  73         gensec_gsskrb5_state = talloc(gensec_security, struct gensec_gsskrb5_state);
  74         if (!gensec_gsskrb5_state) {
  75                 return NT_STATUS_NO_MEMORY;
  76         }
  77
  78         gensec_security->private_data = gensec_gsskrb5_state;
  79
  80         gensec_gsskrb5_state->gssapi_context = GSS_C_NO_CONTEXT;
  81         gensec_gsskrb5_state->server_name = GSS_C_NO_NAME;
  82         gensec_gsskrb5_state->client_name = GSS_C_NO_NAME;
  83
  84         talloc_set_destructor(gensec_gsskrb5_state, gensec_gsskrb5_destory);
  85
  86         /* TODO: Fill in channel bindings */
  87         gensec_gsskrb5_state->input_chan_bindings = GSS_C_NO_CHANNEL_BINDINGS;
  88
  89         gensec_gsskrb5_state->want_flags = GSS_C_MUTUAL_FLAG;
  90         gensec_gsskrb5_state->got_flags = 0;
  91
  92         if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
  93                 /* GSSAPI won't give us the session keys */
  94                 return NT_STATUS_INVALID_PARAMETER;
  95         }
  96         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
  97                 gensec_gsskrb5_state->want_flags |= GSS_C_INTEG_FLAG;
  98         }
  99         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
 100                 gensec_gsskrb5_state->want_flags |= GSS_C_CONF_FLAG;
 101         }
 102         if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
 103                 gensec_gsskrb5_state->want_flags |= GSS_C_DCE_STYLE;
 104         }
 105
 106         return NT_STATUS_OK;
 107 }
 108
 109 static NTSTATUS gensec_gsskrb5_client_start(struct gensec_security *gensec_security)
 110 {
 111         struct gensec_gsskrb5_state *gensec_gsskrb5_state;
 112         NTSTATUS nt_status;
 113         gss_buffer_desc name_token;
 114         OM_uint32 maj_stat, min_stat;
 115
 116         gss_OID_desc hostbased = {10,
 117                                   (void *)discard_const_p(char, "\x2a\x86\x48\x86\xf7\x12"
 118                                                           "\x01\x02\x01\x04")};
 119
 120         nt_status = gensec_gsskrb5_start(gensec_security);
 121         if (!NT_STATUS_IS_OK(nt_status)) {
 122                 return nt_status;
 123         }
 124
 125         gensec_gsskrb5_state = gensec_security->private_data;
 126
 127         gensec_gsskrb5_state->state_position = GENSEC_GSSKRB5_CLIENT_START;
 128
 129         name_token.value = talloc_asprintf(gensec_gsskrb5_state, "%s@%s", gensec_get_target_service(gensec_security),
 130                                            gensec_get_target_hostname(gensec_security));
 131         DEBUG(0, ("name: %s\n", (char *)name_token.value));
 132         name_token.length = strlen(name_token.value);
 133
 134         maj_stat = gss_import_name (&min_stat,
 135                                     &name_token,
 136                                     &hostbased,
 137                                     &gensec_gsskrb5_state->server_name);
 138         if (maj_stat) {
 139                 return NT_STATUS_UNSUCCESSFUL;
 140         }
 141
 142         return NT_STATUS_OK;
 143 }
 144
 145 /**
 146  * Next state function for the GSSKRB5 GENSEC mechanism
 147  *
 148  * @param gensec_gsskrb5_state GSSAPI State
 149  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
 150  * @param in The request, as a DATA_BLOB
 151  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 152  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 153  *                or NT_STATUS_OK if the user is authenticated.
 154  */
 155
 156 static NTSTATUS gensec_gsskrb5_update(struct gensec_security *gensec_security,
 157                                    TALLOC_CTX *out_mem_ctx,
 158                                    const DATA_BLOB in, DATA_BLOB *out)
 159 {
 160         struct gensec_gsskrb5_state *gensec_gsskrb5_state = gensec_security->private_data;
 161         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 162         OM_uint32 maj_stat, min_stat;
 163         OM_uint32 min_stat2;
 164         gss_buffer_desc input_token, output_token;
 165
 166         *out = data_blob(NULL, 0);
 167
 168         input_token.length = in.length;
 169         input_token.value = in.data;
 170
 171         switch (gensec_gsskrb5_state->state_position) {
 172         case GENSEC_GSSKRB5_CLIENT_START:
 173         {
 174                 maj_stat = gss_init_sec_context(&min_stat,
 175                                                 GSS_C_NO_CREDENTIAL,
 176                                                 &gensec_gsskrb5_state->gssapi_context,
 177                                                 gensec_gsskrb5_state->server_name,
 178                                                 discard_const_p(gss_OID_desc, &gensec_gss_krb5_mechanism_oid_desc),
 179                                                 gensec_gsskrb5_state->want_flags,
 180                                                 0,
 181                                                 gensec_gsskrb5_state->input_chan_bindings,
 182                                                 &input_token,
 183                                                 NULL,
 184                                                 &output_token,
 185                                                 &gensec_gsskrb5_state->got_flags, /* ret flags */
 186                                                 NULL);
 187                 *out = data_blob_talloc(out_mem_ctx, output_token.value, output_token.length);
 188                 if (out->length != output_token.length) {
 189                         gss_release_buffer(&min_stat2, &output_token);
 190                         return NT_STATUS_NO_MEMORY;
 191                 }
 192                 gss_release_buffer(&min_stat2, &output_token);
 193
 194                 if (maj_stat == GSS_S_COMPLETE) {
 195                         gensec_gsskrb5_state->state_position = GENSEC_GSSKRB5_DONE;
 196                         return NT_STATUS_OK;
 197                 } else if (maj_stat == GSS_S_CONTINUE_NEEDED) {
 198                         gensec_gsskrb5_state->state_position = GENSEC_GSSKRB5_CLIENT_MUTUAL_AUTH;
 199                         return NT_STATUS_MORE_PROCESSING_REQUIRED;
 200                 } else {
 201                         gss_buffer_desc msg1, msg2;
 202                         OM_uint32 msg_ctx = 0;
 203
 204                         msg1.value = NULL;
 205                         msg2.value = NULL;
 206                         gss_display_status(&min_stat2, maj_stat, GSS_C_GSS_CODE,
 207                                            GSS_C_NULL_OID, &msg_ctx, &msg1);
 208                         gss_display_status(&min_stat2, min_stat, GSS_C_MECH_CODE,
 209                                            GSS_C_NULL_OID, &msg_ctx, &msg2);
 210                         DEBUG(1, ("gensec_gsskrb5_update: %s : %s\n", (char *)msg1.value, (char *)msg2.value));
 211                         gss_release_buffer(&min_stat2, &msg1);
 212                         gss_release_buffer(&min_stat2, &msg2);
 213
 214                         return nt_status;
 215                 }
 216                 break;
 217         }
 218         case GENSEC_GSSKRB5_CLIENT_MUTUAL_AUTH:
 219         {
 220                 maj_stat = gss_init_sec_context(&min_stat,
 221                                                 GSS_C_NO_CREDENTIAL,
 222                                                 &gensec_gsskrb5_state->gssapi_context,
 223                                                 gensec_gsskrb5_state->server_name,
 224                                                 discard_const_p(gss_OID_desc, &gensec_gss_krb5_mechanism_oid_desc),
 225                                                 gensec_gsskrb5_state->want_flags,
 226                                                 0,
 227                                                 gensec_gsskrb5_state->input_chan_bindings,
 228                                                 &input_token,
 229                                                 NULL,
 230                                                 &output_token,
 231                                                 &gensec_gsskrb5_state->got_flags, /* ret flags */
 232                                                 NULL);
 233                 *out = data_blob_talloc(out_mem_ctx, output_token.value, output_token.length);
 234                 if (out->length != output_token.length) {
 235                         gss_release_buffer(&min_stat2, &output_token);
 236                         return NT_STATUS_NO_MEMORY;
 237                 }
 238                 gss_release_buffer(&min_stat2, &output_token);
 239
 240                 if (maj_stat == GSS_S_COMPLETE) {
 241                         if (gensec_gsskrb5_state->got_flags & GSS_C_DCE_STYLE) {
 242                                 gensec_gsskrb5_state->state_position = GENSEC_GSSKRB5_CLIENT_DCE_STYLE;
 243                                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
 244                         }
 245                         gensec_gsskrb5_state->state_position = GENSEC_GSSKRB5_DONE;
 246                         return NT_STATUS_OK;
 247                 } else if (maj_stat == GSS_S_CONTINUE_NEEDED) {
 248                         gensec_gsskrb5_state->state_position = GENSEC_GSSKRB5_CLIENT_DCE_STYLE;
 249                         return NT_STATUS_MORE_PROCESSING_REQUIRED;
 250                 } else {
 251                         gss_buffer_desc msg1, msg2;
 252                         OM_uint32 msg_ctx = 0;
 253
 254                         msg1.value = NULL;
 255                         msg2.value = NULL;
 256                         gss_display_status(&min_stat2, maj_stat, GSS_C_GSS_CODE,
 257                                            GSS_C_NULL_OID, &msg_ctx, &msg1);
 258                         gss_display_status(&min_stat2, min_stat, GSS_C_MECH_CODE,
 259                                            GSS_C_NULL_OID, &msg_ctx, &msg2);
 260                         DEBUG(1, ("gensec_gsskrb5_update: %s : %s\n", (char *)msg1.value, (char *)msg2.value));
 261                         gss_release_buffer(&min_stat2, &msg1);
 262                         gss_release_buffer(&min_stat2, &msg2);
 263
 264                         return nt_status;
 265                 }
 266                 break;
 267         }
 268         case GENSEC_GSSKRB5_CLIENT_DCE_STYLE:
 269         {
 270                 gensec_gsskrb5_state->state_position = GENSEC_GSSKRB5_DONE;
 271                 return NT_STATUS_OK;
 272         }
 273         case GENSEC_GSSKRB5_DONE:
 274         {
 275                 return NT_STATUS_OK;
 276         }
 277         default:
 278                 return NT_STATUS_INVALID_PARAMETER;
 279         }
 280
 281         return NT_STATUS_INVALID_PARAMETER;
 282 }
 283
 284 static NTSTATUS gensec_gsskrb5_wrap(struct gensec_security *gensec_security,
 285                                    TALLOC_CTX *mem_ctx,
 286                                    const DATA_BLOB *in,
 287                                    DATA_BLOB *out)
 288 {
 289         struct gensec_gsskrb5_state *gensec_gsskrb5_state = gensec_security->private_data;
 290         OM_uint32 maj_stat, min_stat;
 291         gss_buffer_desc input_token, output_token;
 292         int conf_state;
 293         input_token.length = in->length;
 294         input_token.value = in->data;
 295
 296         maj_stat = gss_wrap(&min_stat,
 297                             gensec_gsskrb5_state->gssapi_context,
 298                             gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
 299                             GSS_C_QOP_DEFAULT,
 300                             &input_token,
 301                             &conf_state,
 302                             &output_token);
 303         if (GSS_ERROR(maj_stat)) {
 304                 return NT_STATUS_ACCESS_DENIED;
 305         }
 306         *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
 307
 308         gss_release_buffer(&min_stat, &output_token);
 309
 310         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 311             && !conf_state) {
 312                 return NT_STATUS_ACCESS_DENIED;
 313         }
 314         return NT_STATUS_OK;
 315 }
 316
 317 static NTSTATUS gensec_gsskrb5_unwrap(struct gensec_security *gensec_security,
 318                                      TALLOC_CTX *mem_ctx,
 319                                      const DATA_BLOB *in,
 320                                      DATA_BLOB *out)
 321 {
 322         struct gensec_gsskrb5_state *gensec_gsskrb5_state = gensec_security->private_data;
 323         OM_uint32 maj_stat, min_stat;
 324         gss_buffer_desc input_token, output_token;
 325         int conf_state;
 326         gss_qop_t qop_state;
 327         input_token.length = in->length;
 328         input_token.value = in->data;
 329
 330         maj_stat = gss_unwrap(&min_stat,
 331                               gensec_gsskrb5_state->gssapi_context,
 332                               &input_token,
 333                               &output_token,
 334                               &conf_state,
 335                               &qop_state);
 336         if (GSS_ERROR(maj_stat)) {
 337                 return NT_STATUS_ACCESS_DENIED;
 338         }
 339         *out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
 340
 341         gss_release_buffer(&min_stat, &output_token);
 342
 343         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 344             && !conf_state) {
 345                 return NT_STATUS_ACCESS_DENIED;
 346         }
 347         return NT_STATUS_OK;
 348 }
 349
 350 static size_t gensec_gsskrb5_sig_size(struct gensec_security *gensec_security)
 351 {
 352         /* not const but work for DCERPC packets and arcfour */
 353         return 45;
 354 }
 355
 356 static NTSTATUS gensec_gsskrb5_seal_packet(struct gensec_security *gensec_security,
 357                                           TALLOC_CTX *mem_ctx,
 358                                           uint8_t *data, size_t length,
 359                                           const uint8_t *whole_pdu, size_t pdu_length,
 360                                           DATA_BLOB *sig)
 361 {
 362         struct gensec_gsskrb5_state *gensec_gsskrb5_state = gensec_security->private_data;
 363         OM_uint32 maj_stat, min_stat;
 364         gss_buffer_desc input_token, output_token;
 365         int conf_state;
 366         ssize_t sig_length = 0;
 367
 368         input_token.length = length;
 369         input_token.value = data;
 370
 371         maj_stat = gss_wrap(&min_stat,
 372                             gensec_gsskrb5_state->gssapi_context,
 373                             gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
 374                             GSS_C_QOP_DEFAULT,
 375                             &input_token,
 376                             &conf_state,
 377                             &output_token);
 378         if (GSS_ERROR(maj_stat)) {
 379                 return NT_STATUS_ACCESS_DENIED;
 380         }
 381
 382         if (output_token.length < length) {
 383                 return NT_STATUS_INTERNAL_ERROR;
 384         }
 385
 386         sig_length = 45;
 387
 388         memcpy(data, ((uint8_t *)output_token.value) + sig_length, length);
 389         *sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, sig_length);
 390
 391 DEBUG(0,("gensec_gsskrb5_seal_packet: siglen: %d inlen: %d, wrap_len: %d\n", sig->length, length, output_token.length - sig_length));
 392 dump_data(0,sig->data, sig->length);
 393 dump_data(0,data, length);
 394 dump_data(0,((uint8_t *)output_token.value) + sig_length, output_token.length - sig_length);
 395
 396         gss_release_buffer(&min_stat, &output_token);
 397
 398         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 399             && !conf_state) {
 400                 return NT_STATUS_ACCESS_DENIED;
 401         }
 402         return NT_STATUS_OK;
 403 }
 404
 405 static NTSTATUS gensec_gsskrb5_unseal_packet(struct gensec_security *gensec_security,
 406                                             TALLOC_CTX *mem_ctx,
 407                                             uint8_t *data, size_t length,
 408                                             const uint8_t *whole_pdu, size_t pdu_length,
 409                                             const DATA_BLOB *sig)
 410 {
 411         struct gensec_gsskrb5_state *gensec_gsskrb5_state = gensec_security->private_data;
 412         OM_uint32 maj_stat, min_stat;
 413         gss_buffer_desc input_token, output_token;
 414         int conf_state;
 415         gss_qop_t qop_state;
 416         DATA_BLOB in;
 417
 418 DEBUG(0,("gensec_gsskrb5_unseal_packet: siglen: %d\n", sig->length));
 419 dump_data(0,sig->data, sig->length);
 420
 421         in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
 422
 423         memcpy(in.data, sig->data, sig->length);
 424         memcpy(in.data + sig->length, data, length);
 425
 426         input_token.length = in.length;
 427         input_token.value = in.data;
 428
 429         maj_stat = gss_unwrap(&min_stat,
 430                               gensec_gsskrb5_state->gssapi_context,
 431                               &input_token,
 432                               &output_token,
 433                               &conf_state,
 434                               &qop_state);
 435         if (GSS_ERROR(maj_stat)) {
 436                 return NT_STATUS_ACCESS_DENIED;
 437         }
 438
 439         if (output_token.length != length) {
 440                 return NT_STATUS_INTERNAL_ERROR;
 441         }
 442
 443         memcpy(data, output_token.value, length);
 444
 445         gss_release_buffer(&min_stat, &output_token);
 446
 447         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
 448             && !conf_state) {
 449                 return NT_STATUS_ACCESS_DENIED;
 450         }
 451         return NT_STATUS_OK;
 452 }
 453
 454 static NTSTATUS gensec_gsskrb5_sign_packet(struct gensec_security *gensec_security,
 455                                           TALLOC_CTX *mem_ctx,
 456                                           const uint8_t *data, size_t length,
 457                                           const uint8_t *whole_pdu, size_t pdu_length,
 458                                           DATA_BLOB *sig)
 459 {
 460         struct gensec_gsskrb5_state *gensec_gsskrb5_state = gensec_security->private_data;
 461         OM_uint32 maj_stat, min_stat;
 462         gss_buffer_desc input_token, output_token;
 463         int conf_state;
 464         ssize_t sig_length = 0;
 465
 466         input_token.length = length;
 467         input_token.value = data;
 468
 469         maj_stat = gss_wrap(&min_stat,
 470                             gensec_gsskrb5_state->gssapi_context,
 471                             0,
 472                             GSS_C_QOP_DEFAULT,
 473                             &input_token,
 474                             &conf_state,
 475                             &output_token);
 476         if (GSS_ERROR(maj_stat)) {
 477                 return NT_STATUS_ACCESS_DENIED;
 478         }
 479
 480         if (output_token.length < length) {
 481                 return NT_STATUS_INTERNAL_ERROR;
 482         }
 483
 484         sig_length = 45;
 485
 486         /*memcpy(data, ((uint8_t *)output_token.value) + sig_length, length);*/
 487         *sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, sig_length);
 488
 489 DEBUG(0,("gensec_gsskrb5_sign_packet: siglen: %d\n", sig->length));
 490 dump_data(0,sig->data, sig->length);
 491
 492         gss_release_buffer(&min_stat, &output_token);
 493
 494         return NT_STATUS_OK;
 495 }
 496
 497 static NTSTATUS gensec_gsskrb5_check_packet(struct gensec_security *gensec_security,
 498                                            TALLOC_CTX *mem_ctx,
 499                                            const uint8_t *data, size_t length,
 500                                            const uint8_t *whole_pdu, size_t pdu_length,
 501                                            const DATA_BLOB *sig)
 502 {
 503         struct gensec_gsskrb5_state *gensec_gsskrb5_state = gensec_security->private_data;
 504         OM_uint32 maj_stat, min_stat;
 505         gss_buffer_desc input_token, output_token;
 506         int conf_state;
 507         gss_qop_t qop_state;
 508         DATA_BLOB in;
 509
 510 DEBUG(0,("gensec_gsskrb5_check_packet: siglen: %d\n", sig->length));
 511 dump_data(0,sig->data, sig->length);
 512
 513         in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
 514
 515         memcpy(in.data, sig->data, sig->length);
 516         memcpy(in.data + sig->length, data, length);
 517
 518         input_token.length = in.length;
 519         input_token.value = in.data;
 520
 521         maj_stat = gss_unwrap(&min_stat,
 522                               gensec_gsskrb5_state->gssapi_context,
 523                               &input_token,
 524                               &output_token,
 525                               &conf_state,
 526                               &qop_state);
 527         if (GSS_ERROR(maj_stat)) {
 528                 return NT_STATUS_ACCESS_DENIED;
 529         }
 530
 531         if (output_token.length != length) {
 532                 return NT_STATUS_INTERNAL_ERROR;
 533         }
 534
 535         /*memcpy(data, output_token.value, length);*/
 536
 537         gss_release_buffer(&min_stat, &output_token);
 538
 539         return NT_STATUS_OK;
 540 }
 541
 542 static BOOL gensec_gsskrb5_have_feature(struct gensec_security *gensec_security,
 543                                        uint32_t feature)
 544 {
 545         struct gensec_gsskrb5_state *gensec_gsskrb5_state = gensec_security->private_data;
 546         if (feature & GENSEC_FEATURE_SIGN) {
 547                 return gensec_gsskrb5_state->got_flags & GSS_C_INTEG_FLAG;
 548         }
 549         if (feature & GENSEC_FEATURE_SEAL) {
 550                 return gensec_gsskrb5_state->got_flags & GSS_C_CONF_FLAG;
 551         }
 552         return False;
 553 }
 554
 555 static const struct gensec_security_ops gensec_gsskrb5_security_ops = {
 556         .name           = "gsskrb5",
 557         .auth_type      = DCERPC_AUTH_TYPE_KRB5,
 558         .oid            = GENSEC_OID_KERBEROS5,
 559         .client_start   = gensec_gsskrb5_client_start,
 560         .update         = gensec_gsskrb5_update,
 561         .sig_size       = gensec_gsskrb5_sig_size,
 562         .sign_packet    = gensec_gsskrb5_sign_packet,
 563         .check_packet   = gensec_gsskrb5_check_packet,
 564         .seal_packet    = gensec_gsskrb5_seal_packet,
 565         .unseal_packet  = gensec_gsskrb5_unseal_packet,
 566         .wrap           = gensec_gsskrb5_wrap,
 567         .unwrap         = gensec_gsskrb5_unwrap,
 568         .have_feature   = gensec_gsskrb5_have_feature,
 569         .enabled        = False
 570 };
 571
 572 NTSTATUS gensec_gsskrb5_init(void)
 573 {
 574         NTSTATUS ret;
 575
 576         ret = gensec_register(&gensec_gsskrb5_security_ops);
 577         if (!NT_STATUS_IS_OK(ret)) {
 578                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
 579                         gensec_gsskrb5_security_ops.name));
 580                 return ret;
 581         }
 582
 583         return ret;
 584 }