5fe370313823d79cd66e0edbd2dc10aec6bd87c6
[samba.git] / source4 / auth / gensec / pygensec.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2009
4    
5    This program is free software; you can redistribute it and/or modify
6    it under the terms of the GNU General Public License as published by
7    the Free Software Foundation; either version 3 of the License, or
8    (at your option) any later version.
9    
10    This program is distributed in the hope that it will be useful,
11    but WITHOUT ANY WARRANTY; without even the implied warranty of
12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13    GNU General Public License for more details.
14    
15    You should have received a copy of the GNU General Public License
16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
17 */
18
19 #include <Python.h>
20 #include "includes.h"
21 #include "param/pyparam.h"
22 #include "auth/gensec/gensec.h"
23 #include "auth/credentials/pycredentials.h"
24 #include "libcli/util/pyerrors.h"
25 #include "scripting/python/modules.h"
26 #include "lib/talloc/pytalloc.h"
27 #include <tevent.h>
28 #include "librpc/rpc/pyrpc_util.h"
29
30 static PyObject *py_get_name_by_authtype(PyObject *self, PyObject *args)
31 {
32         int type;
33         const char *name;
34         struct gensec_security *security;
35
36         if (!PyArg_ParseTuple(args, "i", &type))
37                 return NULL;
38
39         security = py_talloc_get_type(self, struct gensec_security);
40
41         name = gensec_get_name_by_authtype(security, type);
42         if (name == NULL)
43                 Py_RETURN_NONE;
44
45         return PyString_FromString(name);
46 }
47
48 static struct gensec_settings *settings_from_object(TALLOC_CTX *mem_ctx, PyObject *object)
49 {
50         struct gensec_settings *s;
51         PyObject *py_hostname, *py_lp_ctx;
52
53         if (!PyDict_Check(object)) {
54                 PyErr_SetString(PyExc_ValueError, "settings should be a dictionary");
55                 return NULL;
56         }
57
58         s = talloc_zero(mem_ctx, struct gensec_settings);
59         if (!s) return NULL;
60
61         py_hostname = PyDict_GetItemString(object, "target_hostname");
62         if (!py_hostname) {
63                 PyErr_SetString(PyExc_ValueError, "settings.target_hostname not found");
64                 return NULL;
65         }
66
67         py_lp_ctx = PyDict_GetItemString(object, "lp_ctx");
68         if (!py_lp_ctx) {
69                 PyErr_SetString(PyExc_ValueError, "settings.lp_ctx not found");
70                 return NULL;
71         }
72
73         s->target_hostname = PyString_AsString(py_hostname);
74         s->lp_ctx = lpcfg_from_py_object(s, py_lp_ctx);
75         return s;
76 }
77
78 static PyObject *py_gensec_start_client(PyTypeObject *type, PyObject *args, PyObject *kwargs)
79 {
80         NTSTATUS status;
81         py_talloc_Object *self;
82         struct gensec_settings *settings;
83         const char *kwnames[] = { "settings", NULL };
84         PyObject *py_settings;
85         struct tevent_context *ev;
86         struct gensec_security *gensec;
87
88         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|O", discard_const_p(char *, kwnames), &py_settings))
89                 return NULL;
90
91         self = (py_talloc_Object*)type->tp_alloc(type, 0);
92         if (self == NULL) {
93                 PyErr_NoMemory();
94                 return NULL;
95         }
96         self->talloc_ctx = talloc_new(NULL);
97         if (self->talloc_ctx == NULL) {
98                 PyErr_NoMemory();
99                 return NULL;
100         }
101
102         if (py_settings != Py_None) {
103                 settings = settings_from_object(self->talloc_ctx, py_settings);
104                 if (settings == NULL) {
105                         PyObject_DEL(self);
106                         return NULL;
107                 }
108         } else {
109                 settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
110                 if (settings == NULL) {
111                         PyObject_DEL(self);
112                         return NULL;
113                 }
114
115                 settings->lp_ctx = loadparm_init_global(true);
116                 if (settings->lp_ctx == NULL) {
117                         PyErr_NoMemory();
118                         PyObject_DEL(self);
119                         return NULL;
120                 }
121         }
122
123         ev = tevent_context_init(self->talloc_ctx);
124         if (ev == NULL) {
125                 PyErr_NoMemory();
126                 PyObject_Del(self);
127                 return NULL;
128         }
129
130         status = gensec_init(settings->lp_ctx);
131         if (!NT_STATUS_IS_OK(status)) {
132                 PyErr_SetNTSTATUS(status);
133                 PyObject_DEL(self);
134                 return NULL;
135         }
136
137         status = gensec_client_start(self->talloc_ctx, &gensec, ev, settings);
138         if (!NT_STATUS_IS_OK(status)) {
139                 PyErr_SetNTSTATUS(status);
140                 PyObject_DEL(self);
141                 return NULL;
142         }
143
144         self->ptr = gensec;
145
146         return (PyObject *)self;
147 }
148
149 static PyObject *py_gensec_start_server(PyTypeObject *type, PyObject *args, PyObject *kwargs)
150 {
151         NTSTATUS status;
152         py_talloc_Object *self;
153         struct gensec_settings *settings = NULL;
154         const char *kwnames[] = { "settings", "auth_context", NULL };
155         PyObject *py_settings = Py_None;
156         PyObject *py_auth_context = Py_None;
157         struct tevent_context *ev;
158         struct gensec_security *gensec;
159         struct auth_context *auth_context = NULL;
160
161         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OO", discard_const_p(char *, kwnames), &py_settings, &py_auth_context))
162                 return NULL;
163
164         self = (py_talloc_Object*)type->tp_alloc(type, 0);
165         if (self == NULL) {
166                 PyErr_NoMemory();
167                 return NULL;
168         }
169         self->talloc_ctx = talloc_new(NULL);
170         if (self->talloc_ctx == NULL) {
171                 PyErr_NoMemory();
172                 return NULL;
173         }
174
175         if (py_settings != Py_None) {
176                 settings = settings_from_object(self->talloc_ctx, py_settings);
177                 if (settings == NULL) {
178                         PyObject_DEL(self);
179                         return NULL;
180                 }
181         } else {
182                 settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
183                 if (settings == NULL) {
184                         PyObject_DEL(self);
185                         return NULL;
186                 }
187
188                 settings->lp_ctx = loadparm_init_global(true);
189                 if (settings->lp_ctx == NULL) {
190                         PyErr_NoMemory();
191                         PyObject_DEL(self);
192                         return NULL;
193                 }
194         }
195
196         ev = tevent_context_init(self->talloc_ctx);
197         if (ev == NULL) {
198                 PyErr_NoMemory();
199                 PyObject_Del(self);
200                 return NULL;
201         }
202
203         if (py_auth_context != Py_None) {
204                 auth_context = py_talloc_get_type(py_auth_context, struct auth_context);
205                 if (!auth_context) {
206                         PyErr_Format(PyExc_TypeError,
207                                      "Expected auth.AuthContext for auth_context argument, got %s",
208                                      talloc_get_name(py_talloc_get_ptr(py_auth_context)));
209                         return NULL;
210                 }
211         }
212
213         status = gensec_init(settings->lp_ctx);
214         if (!NT_STATUS_IS_OK(status)) {
215                 PyErr_SetNTSTATUS(status);
216                 PyObject_DEL(self);
217                 return NULL;
218         }
219
220         status = gensec_server_start(self->talloc_ctx, ev, settings, auth_context, &gensec);
221         if (!NT_STATUS_IS_OK(status)) {
222                 PyErr_SetNTSTATUS(status);
223                 PyObject_DEL(self);
224                 return NULL;
225         }
226
227         self->ptr = gensec;
228
229         return (PyObject *)self;
230 }
231
232 static PyObject *py_gensec_set_credentials(PyObject *self, PyObject *args)
233 {
234         PyObject *py_creds = Py_None;
235         struct cli_credentials *creds;
236         struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
237         NTSTATUS status;
238
239         if (!PyArg_ParseTuple(args, "O", &py_creds))
240                 return NULL;
241
242         creds = PyCredentials_AsCliCredentials(py_creds);
243         if (!creds) {
244                 PyErr_Format(PyExc_TypeError,
245                              "Expected samba.credentaials for credentials argument got  %s",
246                              talloc_get_name(py_talloc_get_ptr(py_creds)));
247         }
248
249         status = gensec_set_credentials(security, creds);
250         if (!NT_STATUS_IS_OK(status)) {
251                 PyErr_SetNTSTATUS(status);
252                 return NULL;
253         }
254
255         Py_RETURN_NONE;
256 }
257
258 static PyObject *py_gensec_session_info(PyObject *self)
259 {
260         NTSTATUS status;
261         PyObject *py_session_info;
262         struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
263         struct auth_session_info *info;
264         if (security->ops == NULL) {
265                 PyErr_SetString(PyExc_RuntimeError, "no mechanism selected");
266                 return NULL;
267         }
268         status = gensec_session_info(security, &info);
269         if (NT_STATUS_IS_ERR(status)) {
270                 PyErr_SetNTSTATUS(status);
271                 return NULL;
272         }
273
274         py_session_info = py_return_ndr_struct("samba.auth", "AuthSession",
275                                                  info, info);
276         return py_session_info;
277 }
278
279 static PyObject *py_gensec_start_mech_by_name(PyObject *self, PyObject *args)
280 {
281         char *name;
282         struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
283         NTSTATUS status;
284
285         if (!PyArg_ParseTuple(args, "s", &name))
286                 return NULL;
287
288         status = gensec_start_mech_by_name(security, name);
289         if (!NT_STATUS_IS_OK(status)) {
290                 PyErr_SetNTSTATUS(status);
291                 return NULL;
292         }
293
294         Py_RETURN_NONE;
295 }
296
297 static PyObject *py_gensec_start_mech_by_sasl_name(PyObject *self, PyObject *args)
298 {
299         char *sasl_name;
300         struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
301         NTSTATUS status;
302
303         if (!PyArg_ParseTuple(args, "s", &sasl_name))
304                 return NULL;
305
306         status = gensec_start_mech_by_sasl_name(security, sasl_name);
307         if (!NT_STATUS_IS_OK(status)) {
308                 PyErr_SetNTSTATUS(status);
309                 return NULL;
310         }
311
312         Py_RETURN_NONE;
313 }
314
315 static PyObject *py_gensec_start_mech_by_authtype(PyObject *self, PyObject *args)
316 {
317         int authtype, level;
318         struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
319         NTSTATUS status;
320         if (!PyArg_ParseTuple(args, "ii", &authtype, &level))
321                 return NULL;
322
323         status = gensec_start_mech_by_authtype(security, authtype, level);
324         if (!NT_STATUS_IS_OK(status)) {
325                 PyErr_SetNTSTATUS(status);
326                 return NULL;
327         }
328
329         Py_RETURN_NONE;
330 }
331
332 static PyObject *py_gensec_want_feature(PyObject *self, PyObject *args)
333 {
334         int feature;
335         struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
336         /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
337         if (!PyArg_ParseTuple(args, "i", &feature))
338                 return NULL;
339
340         gensec_want_feature(security, feature);
341
342         Py_RETURN_NONE;
343 }
344
345 static PyObject *py_gensec_have_feature(PyObject *self, PyObject *args)
346 {
347         int feature;
348         struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
349         /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
350         if (!PyArg_ParseTuple(args, "i", &feature))
351                 return NULL;
352
353         if (gensec_have_feature(security, feature)) {
354                 return Py_True;
355         } 
356         return Py_False;
357 }
358
359 static PyObject *py_gensec_update(PyObject *self, PyObject *args)
360 {
361         NTSTATUS status;
362         TALLOC_CTX *mem_ctx;
363         DATA_BLOB in, out;
364         PyObject *ret, *py_in;
365         struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
366         PyObject *finished_processing;
367
368         if (!PyArg_ParseTuple(args, "O", &py_in))
369                 return NULL;
370
371         mem_ctx = talloc_new(NULL);
372
373         if (!PyString_Check(py_in)) {
374                 PyErr_Format(PyExc_TypeError, "expected a string");
375                 return NULL;
376         }
377
378         in.data = (uint8_t *)PyString_AsString(py_in);
379         in.length = PyString_Size(py_in);
380
381         status = gensec_update(security, mem_ctx, in, &out);
382
383         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)
384             && !NT_STATUS_IS_OK(status)) {
385                 PyErr_SetNTSTATUS(status);
386                 talloc_free(mem_ctx);
387                 return NULL;
388         }
389         ret = PyString_FromStringAndSize((const char *)out.data, out.length);
390         talloc_free(mem_ctx);
391
392         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
393                 finished_processing = Py_False;
394         } else {
395                 finished_processing = Py_True;
396         }
397
398         return PyTuple_Pack(2, finished_processing, ret);
399 }
400
401 static PyObject *py_gensec_wrap(PyObject *self, PyObject *args)
402 {
403         NTSTATUS status;
404
405         TALLOC_CTX *mem_ctx;
406         DATA_BLOB in, out;
407         PyObject *ret, *py_in;
408         struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
409
410         if (!PyArg_ParseTuple(args, "O", &py_in))
411                 return NULL;
412
413         mem_ctx = talloc_new(NULL);
414
415         if (!PyString_Check(py_in)) {
416                 PyErr_Format(PyExc_TypeError, "expected a string");
417                 return NULL;
418         }
419         in.data = (uint8_t *)PyString_AsString(py_in);
420         in.length = PyString_Size(py_in);
421
422         status = gensec_wrap(security, mem_ctx, &in, &out);
423
424         if (!NT_STATUS_IS_OK(status)) {
425                 PyErr_SetNTSTATUS(status);
426                 talloc_free(mem_ctx);
427                 return NULL;
428         }
429
430         ret = PyString_FromStringAndSize((const char *)out.data, out.length);
431         talloc_free(mem_ctx);
432         return ret;
433 }
434
435 static PyObject *py_gensec_unwrap(PyObject *self, PyObject *args)
436 {
437         NTSTATUS status;
438
439         TALLOC_CTX *mem_ctx;
440         DATA_BLOB in, out;
441         PyObject *ret, *py_in;
442         struct gensec_security *security = py_talloc_get_type(self, struct gensec_security);
443
444         if (!PyArg_ParseTuple(args, "O", &py_in))
445                 return NULL;
446
447         mem_ctx = talloc_new(NULL);
448
449         if (!PyString_Check(py_in)) {
450                 PyErr_Format(PyExc_TypeError, "expected a string");
451                 return NULL;
452         }
453
454         in.data = (uint8_t *)PyString_AsString(py_in);
455         in.length = PyString_Size(py_in);
456
457         status = gensec_unwrap(security, mem_ctx, &in, &out);
458
459         if (!NT_STATUS_IS_OK(status)) {
460                 PyErr_SetNTSTATUS(status);
461                 talloc_free(mem_ctx);
462                 return NULL;
463         }
464
465         ret = PyString_FromStringAndSize((const char *)out.data, out.length);
466         talloc_free(mem_ctx);
467         return ret;
468 }
469
470 static PyMethodDef py_gensec_security_methods[] = {
471         { "start_client", (PyCFunction)py_gensec_start_client, METH_VARARGS|METH_KEYWORDS|METH_CLASS, 
472                 "S.start_client(settings) -> gensec" },
473         { "start_server", (PyCFunction)py_gensec_start_server, METH_VARARGS|METH_KEYWORDS|METH_CLASS,
474                 "S.start_server(auth_ctx, settings) -> gensec" },
475         { "set_credentials", (PyCFunction)py_gensec_set_credentials, METH_VARARGS, 
476                 "S.start_client(credentials)" },
477         { "session_info", (PyCFunction)py_gensec_session_info, METH_NOARGS,
478                 "S.session_info() -> info" },
479         { "start_mech_by_name", (PyCFunction)py_gensec_start_mech_by_name, METH_VARARGS,
480         "S.start_mech_by_name(name)" },
481         { "start_mech_by_sasl_name", (PyCFunction)py_gensec_start_mech_by_sasl_name, METH_VARARGS,
482         "S.start_mech_by_sasl_name(name)" },
483         { "start_mech_by_authtype", (PyCFunction)py_gensec_start_mech_by_authtype, METH_VARARGS, "S.start_mech_by_authtype(authtype, level)" },
484         { "get_name_by_authtype", (PyCFunction)py_get_name_by_authtype, METH_VARARGS,
485                 "S.get_name_by_authtype(authtype) -> name\nLookup an auth type." },
486         { "want_feature", (PyCFunction)py_gensec_want_feature, METH_VARARGS,
487           "S.want_feature(feature)\n Request that GENSEC negotiate a particular feature." },
488         { "have_feature", (PyCFunction)py_gensec_have_feature, METH_VARARGS,
489           "S.have_feature()\n Return True if GENSEC negotiated a particular feature." },
490         { "update",  (PyCFunction)py_gensec_update, METH_VARARGS,
491                 "S.update(blob_in) -> (finished, blob_out)\nPerform one step in a GENSEC dance.  Repeat with new packets until finished is true or exception." },
492         { "wrap",  (PyCFunction)py_gensec_wrap, METH_VARARGS,
493                 "S.wrap(blob_in) -> blob_out\nPackage one clear packet into a wrapped GENSEC packet." },
494         { "unwrap",  (PyCFunction)py_gensec_unwrap, METH_VARARGS,
495                 "S.unwrap(blob_in) -> blob_out\nPerform one wrapped GENSEC packet into a clear packet." },
496
497         { NULL }
498 };
499
500 static PyTypeObject Py_Security = {
501         .tp_name = "Security",
502         .tp_flags = Py_TPFLAGS_DEFAULT,
503         .tp_methods = py_gensec_security_methods,
504         .tp_basicsize = sizeof(py_talloc_Object),
505 };
506
507 void initgensec(void);
508 void initgensec(void)
509 {
510         PyObject *m;
511
512         Py_Security.tp_base = PyTalloc_GetObjectType();
513         if (Py_Security.tp_base == NULL)
514                 return;
515
516         if (PyType_Ready(&Py_Security) < 0)
517                 return;
518
519         m = Py_InitModule3("gensec", NULL, "Generic Security Interface.");
520         if (m == NULL)
521                 return;
522
523         PyModule_AddObject(m, "FEATURE_SESSION_KEY",     PyInt_FromLong(GENSEC_FEATURE_SESSION_KEY));
524         PyModule_AddObject(m, "FEATURE_SIGN",            PyInt_FromLong(GENSEC_FEATURE_SIGN));
525         PyModule_AddObject(m, "FEATURE_SEAL",            PyInt_FromLong(GENSEC_FEATURE_SEAL));
526         PyModule_AddObject(m, "FEATURE_DCE_STYLE",       PyInt_FromLong(GENSEC_FEATURE_DCE_STYLE));
527         PyModule_AddObject(m, "FEATURE_ASYNC_REPLIES",   PyInt_FromLong(GENSEC_FEATURE_ASYNC_REPLIES));
528         PyModule_AddObject(m, "FEATURE_DATAGRAM_MODE",   PyInt_FromLong(GENSEC_FEATURE_DATAGRAM_MODE));
529         PyModule_AddObject(m, "FEATURE_SIGN_PKT_HEADER", PyInt_FromLong(GENSEC_FEATURE_SIGN_PKT_HEADER));
530         PyModule_AddObject(m, "FEATURE_NEW_SPNEGO",      PyInt_FromLong(GENSEC_FEATURE_NEW_SPNEGO));
531
532         Py_INCREF(&Py_Security);
533         PyModule_AddObject(m, "Security", (PyObject *)&Py_Security);
534 }