#include "includes.h"
#include "auth/auth.h"
+#include "lib/events/events.h"
+#include "smb_build.h"
/* the list of currently registered GENSEC backends */
const static struct gensec_security_ops **generic_security_ops;
static int gensec_num_backends;
-static const struct gensec_security_ops *gensec_security_by_authtype(uint8_t auth_type)
+const struct gensec_security_ops **gensec_security_all(void)
+{
+ return generic_security_ops;
+}
+
+static const struct gensec_security_ops *gensec_security_by_authtype(struct gensec_security *gensec_security,
+ uint8_t auth_type)
{
int i;
- for (i=0; i < gensec_num_backends; i++) {
- if (generic_security_ops[i]->auth_type == auth_type) {
- return generic_security_ops[i];
+ const struct gensec_security_ops **backends;
+ if (!gensec_security) {
+ backends = gensec_security_all();
+ } else {
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ }
+ for (i=0; backends && backends[i]; i++) {
+ if (backends[i]->auth_type == auth_type) {
+ return backends[i];
}
}
return NULL;
}
-static const struct gensec_security_ops *gensec_security_by_oid(const char *oid_string)
+const struct gensec_security_ops *gensec_security_by_oid(struct gensec_security *gensec_security,
+ const char *oid_string)
{
- int i;
- for (i=0; i < gensec_num_backends; i++) {
- if (generic_security_ops[i]->oid &&
- (strcmp(generic_security_ops[i]->oid, oid_string) == 0)) {
- return generic_security_ops[i];
+ int i, j;
+ const struct gensec_security_ops **backends;
+ if (!gensec_security) {
+ backends = gensec_security_all();
+ } else {
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ }
+ for (i=0; backends && backends[i]; i++) {
+ if (backends[i]->oid) {
+ for (j=0; backends[i]->oid[j]; j++) {
+ if (backends[i]->oid[j] &&
+ (strcmp(backends[i]->oid[j], oid_string) == 0)) {
+ return backends[i];
+ }
+ }
}
}
return NULL;
}
-static const struct gensec_security_ops *gensec_security_by_sasl_name(const char *sasl_name)
+static const struct gensec_security_ops *gensec_security_by_sasl_name(struct gensec_security *gensec_security,
+ const char *sasl_name)
{
int i;
- for (i=0; i < gensec_num_backends; i++) {
- if (generic_security_ops[i]->sasl_name
- && (strcmp(generic_security_ops[i]->sasl_name, sasl_name) == 0)) {
- return generic_security_ops[i];
+ const struct gensec_security_ops **backends;
+ if (!gensec_security) {
+ backends = gensec_security_all();
+ } else {
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ }
+ for (i=0; backends && backends[i]; i++) {
+ if (backends[i]->sasl_name
+ && (strcmp(backends[i]->sasl_name, sasl_name) == 0)) {
+ return backends[i];
}
}
return NULL;
}
-static const struct gensec_security_ops *gensec_security_by_name(const char *name)
+static const struct gensec_security_ops *gensec_security_by_name(struct gensec_security *gensec_security,
+ const char *name)
{
int i;
- for (i=0; i < gensec_num_backends; i++) {
- if (generic_security_ops[i]->name
- && (strcmp(generic_security_ops[i]->name, name) == 0)) {
- return generic_security_ops[i];
+ const struct gensec_security_ops **backends;
+ if (!gensec_security) {
+ backends = gensec_security_all();
+ } else {
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ }
+ for (i=0; backends && backends[i]; i++) {
+ if (backends[i]->name
+ && (strcmp(backends[i]->name, name) == 0)) {
+ return backends[i];
}
}
return NULL;
}
-const struct gensec_security_ops **gensec_security_all(int *num_backends_out)
+/**
+ * Return a unique list of security subsystems from those specified in
+ * the list of SASL names.
+ *
+ * Use the list of enabled GENSEC mechanisms from the credentials
+ * attached to the gensec_security, and return in our preferred order.
+ */
+
+const struct gensec_security_ops **gensec_security_by_sasl(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ const char **sasl_names)
{
- *num_backends_out = gensec_num_backends;
- return generic_security_ops;
+ const struct gensec_security_ops **backends_out;
+ const struct gensec_security_ops **backends;
+ int i, k, sasl_idx;
+ int num_backends_out = 0;
+
+ if (!sasl_names) {
+ return NULL;
+ }
+
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+
+ backends_out = talloc_array(mem_ctx, const struct gensec_security_ops *, 1);
+ if (!backends_out) {
+ return NULL;
+ }
+ backends_out[0] = NULL;
+
+ /* Find backends in our preferred order, by walking our list,
+ * then looking in the supplied list */
+ for (i=0; backends && backends[i]; i++) {
+ for (sasl_idx = 0; sasl_names[sasl_idx]; sasl_idx++) {
+ if (!backends[i]->sasl_name ||
+ !(strcmp(backends[i]->sasl_name,
+ sasl_names[sasl_idx]) == 0)) {
+ continue;
+ }
+
+ for (k=0; backends_out[k]; k++) {
+ if (backends_out[k] == backends[i]) {
+ break;
+ }
+ }
+
+ if (k < num_backends_out) {
+ /* already in there */
+ continue;
+ }
+
+ backends_out = talloc_realloc(mem_ctx, backends_out,
+ const struct gensec_security_ops *,
+ num_backends_out + 2);
+ if (!backends_out) {
+ return NULL;
+ }
+
+ backends_out[num_backends_out] = backends[i];
+ num_backends_out++;
+ backends_out[num_backends_out] = NULL;
+ }
+ }
+ return backends_out;
+}
+
+/**
+ * Return a unique list of security subsystems from those specified in
+ * the OID list. That is, where two OIDs refer to the same module,
+ * return that module only once.
+ *
+ * Use the list of enabled GENSEC mechanisms from the credentials
+ * attached to the gensec_security, and return in our preferred order.
+ */
+
+const struct gensec_security_ops_wrapper *gensec_security_by_oid_list(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ const char **oid_strings,
+ const char *skip)
+{
+ struct gensec_security_ops_wrapper *backends_out;
+ const struct gensec_security_ops **backends;
+ int i, j, k, oid_idx;
+ int num_backends_out = 0;
+
+ if (!oid_strings) {
+ return NULL;
+ }
+
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+
+ backends_out = talloc_array(mem_ctx, struct gensec_security_ops_wrapper, 1);
+ if (!backends_out) {
+ return NULL;
+ }
+ backends_out[0].op = NULL;
+ backends_out[0].oid = NULL;
+
+ /* Find backends in our preferred order, by walking our list,
+ * then looking in the supplied list */
+ for (i=0; backends && backends[i]; i++) {
+ if (!backends[i]->oid) {
+ continue;
+ }
+ for (oid_idx = 0; oid_strings[oid_idx]; oid_idx++) {
+ if (strcmp(oid_strings[oid_idx], skip) == 0) {
+ continue;
+ }
+
+ for (j=0; backends[i]->oid[j]; j++) {
+ if (!backends[i]->oid[j] ||
+ !(strcmp(backends[i]->oid[j],
+ oid_strings[oid_idx]) == 0)) {
+ continue;
+ }
+
+ for (k=0; backends_out[k].op; k++) {
+ if (backends_out[k].op == backends[i]) {
+ break;
+ }
+ }
+
+ if (k < num_backends_out) {
+ /* already in there */
+ continue;
+ }
+
+ backends_out = talloc_realloc(mem_ctx, backends_out,
+ struct gensec_security_ops_wrapper,
+ num_backends_out + 2);
+ if (!backends_out) {
+ return NULL;
+ }
+
+ backends_out[num_backends_out].op = backends[i];
+ backends_out[num_backends_out].oid = backends[i]->oid[j];
+ num_backends_out++;
+ backends_out[num_backends_out].op = NULL;
+ backends_out[num_backends_out].oid = NULL;
+ }
+ }
+ }
+ return backends_out;
}
-const char **gensec_security_oids(TALLOC_CTX *mem_ctx, const char *skip)
+/**
+ * Return OIDS from the security subsystems listed
+ */
+
+const char **gensec_security_oids_from_ops(TALLOC_CTX *mem_ctx,
+ const struct gensec_security_ops **ops,
+ const char *skip)
{
- int i, j = 0;
+ int i;
+ int j = 0;
+ int k;
const char **oid_list;
- int num_backends;
- const struct gensec_security_ops **ops = gensec_security_all(&num_backends);
if (!ops) {
return NULL;
}
- oid_list = talloc_array(mem_ctx, const char *, num_backends + 1);
+ oid_list = talloc_array(mem_ctx, const char *, 1);
if (!oid_list) {
return NULL;
}
- for (i=0; i<num_backends; i++) {
+ for (i=0; ops && ops[i]; i++) {
if (!ops[i]->oid) {
continue;
}
- if (skip && strcmp(skip, ops[i]->oid)==0) {
- continue;
+ for (k = 0; ops[i]->oid[k]; k++) {
+ if (skip && strcmp(skip, ops[i]->oid[k])==0) {
+ } else {
+ oid_list = talloc_realloc(mem_ctx, oid_list, const char *, j + 2);
+ if (!oid_list) {
+ return NULL;
+ }
+ oid_list[j] = ops[i]->oid[k];
+ j++;
+ }
}
+ }
+ oid_list[j] = NULL;
+ return oid_list;
+}
+
+
+/**
+ * Return OIDS from the security subsystems listed
+ */
- oid_list[j] = ops[i]->oid;
- j++;
+const char **gensec_security_oids_from_ops_wrapped(TALLOC_CTX *mem_ctx,
+ const struct gensec_security_ops_wrapper *wops)
+{
+ int i;
+ int j = 0;
+ int k;
+ const char **oid_list;
+ if (!wops) {
+ return NULL;
+ }
+ oid_list = talloc_array(mem_ctx, const char *, 1);
+ if (!oid_list) {
+ return NULL;
+ }
+
+ for (i=0; wops[i].op; i++) {
+ if (!wops[i].op->oid) {
+ continue;
+ }
+
+ for (k = 0; wops[i].op->oid[k]; k++) {
+ oid_list = talloc_realloc(mem_ctx, oid_list, const char *, j + 2);
+ if (!oid_list) {
+ return NULL;
+ }
+ oid_list[j] = wops[i].op->oid[k];
+ j++;
+ }
}
oid_list[j] = NULL;
return oid_list;
}
+
+/**
+ * Return all the security subsystems currently enabled on a GENSEC context.
+ *
+ * This is taken from a list attached to the cli_credentails, and
+ * skips the OID in 'skip'. (Typically the SPNEGO OID)
+ *
+ */
+
+const char **gensec_security_oids(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ const char *skip)
+{
+ const struct gensec_security_ops **ops
+ = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ return gensec_security_oids_from_ops(mem_ctx, ops, skip);
+}
+
+
+
/**
Start the GENSEC system, returning a context pointer.
@param mem_ctx The parent TALLOC memory context.
@param gensec_security Returned GENSEC context pointer.
@note The mem_ctx is only a parent and may be NULL.
*/
-static NTSTATUS gensec_start(TALLOC_CTX *mem_ctx, struct gensec_security **gensec_security)
+static NTSTATUS gensec_start(TALLOC_CTX *mem_ctx,
+ struct gensec_security **gensec_security,
+ struct event_context *ev)
{
(*gensec_security) = talloc(mem_ctx, struct gensec_security);
- if (!(*gensec_security)) {
- return NT_STATUS_NO_MEMORY;
- }
+ NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
(*gensec_security)->ops = NULL;
(*gensec_security)->subcontext = False;
(*gensec_security)->want_features = 0;
+
+ if (ev == NULL) {
+ ev = event_context_init(*gensec_security);
+ if (ev == NULL) {
+ talloc_free(*gensec_security);
+ return NT_STATUS_NO_MEMORY;
+ }
+ }
+
+ (*gensec_security)->event_ctx = ev;
+
return NT_STATUS_OK;
}
struct gensec_security **gensec_security)
{
(*gensec_security) = talloc(mem_ctx, struct gensec_security);
- if (!(*gensec_security)) {
- return NT_STATUS_NO_MEMORY;
- }
+ NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
(**gensec_security) = *parent;
(*gensec_security)->ops = NULL;
(*gensec_security)->private_data = NULL;
(*gensec_security)->subcontext = True;
+ (*gensec_security)->event_ctx = parent->event_ctx;
return NT_STATUS_OK;
}
@param gensec_security Returned GENSEC context pointer.
@note The mem_ctx is only a parent and may be NULL.
*/
-NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx, struct gensec_security **gensec_security)
+NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx,
+ struct gensec_security **gensec_security,
+ struct event_context *ev)
{
NTSTATUS status;
- status = gensec_start(mem_ctx, gensec_security);
+ status = gensec_start(mem_ctx, gensec_security, ev);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
(*gensec_security)->gensec_role = GENSEC_CLIENT;
- (*gensec_security)->password_callback = NULL;
return status;
}
@param gensec_security Returned GENSEC context pointer.
@note The mem_ctx is only a parent and may be NULL.
*/
-NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx, struct gensec_security **gensec_security)
+NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx,
+ struct gensec_security **gensec_security,
+ struct event_context *ev)
{
NTSTATUS status;
- status = gensec_start(mem_ctx, gensec_security);
+ status = gensec_start(mem_ctx, gensec_security, ev);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
if (gensec_security->ops->client_start) {
status = gensec_security->ops->client_start(gensec_security);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to start GENSEC client mech %s: %s\n",
+ DEBUG(2, ("Failed to start GENSEC client mech %s: %s\n",
gensec_security->ops->name, nt_errstr(status)));
}
return status;
NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
uint8_t auth_type, uint8_t auth_level)
{
- gensec_security->ops = gensec_security_by_authtype(auth_type);
+ gensec_security->ops = gensec_security_by_authtype(gensec_security, auth_type);
if (!gensec_security->ops) {
DEBUG(3, ("Could not find GENSEC backend for auth_type=%d\n", (int)auth_type));
return NT_STATUS_INVALID_PARAMETER;
}
gensec_want_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE);
+ gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
} else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
const char *gensec_get_name_by_authtype(uint8_t authtype)
{
const struct gensec_security_ops *ops;
- ops = gensec_security_by_authtype(authtype);
+ ops = gensec_security_by_authtype(NULL, authtype);
if (ops) {
return ops->name;
}
const char *gensec_get_name_by_oid(const char *oid_string)
{
const struct gensec_security_ops *ops;
- ops = gensec_security_by_oid(oid_string);
+ ops = gensec_security_by_oid(NULL, oid_string);
if (ops) {
return ops->name;
}
- return NULL;
+ return oid_string;
}
+/**
+ * Start a GENSEC sub-mechanism with a specifed mechansim structure, used in SPNEGO
+ *
+ */
+
+NTSTATUS gensec_start_mech_by_ops(struct gensec_security *gensec_security,
+ const struct gensec_security_ops *ops)
+{
+ gensec_security->ops = ops;
+ return gensec_start_mech(gensec_security);
+}
+
/**
* Start a GENSEC sub-mechanism by OID, used in SPNEGO
*
NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security,
const char *mech_oid)
{
- gensec_security->ops = gensec_security_by_oid(mech_oid);
+ gensec_security->ops = gensec_security_by_oid(gensec_security, mech_oid);
if (!gensec_security->ops) {
DEBUG(3, ("Could not find GENSEC backend for oid=%s\n", mech_oid));
return NT_STATUS_INVALID_PARAMETER;
NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
const char *sasl_name)
{
- gensec_security->ops = gensec_security_by_sasl_name(sasl_name);
+ gensec_security->ops = gensec_security_by_sasl_name(gensec_security, sasl_name);
if (!gensec_security->ops) {
DEBUG(3, ("Could not find GENSEC backend for sasl_name=%s\n", sasl_name));
return NT_STATUS_INVALID_PARAMETER;
return gensec_start_mech(gensec_security);
}
+/**
+ * Start a GENSEC sub-mechanism by an internal name
+ *
+ */
+
+NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
+ const char *name)
+{
+ gensec_security->ops = gensec_security_by_name(gensec_security, name);
+ if (!gensec_security->ops) {
+ DEBUG(3, ("Could not find GENSEC backend for name=%s\n", name));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ return gensec_start_mech(gensec_security);
+}
+
/*
wrappers for the gensec function pointers
*/
TALLOC_CTX *mem_ctx,
uint8_t *data, size_t length,
const uint8_t *whole_pdu, size_t pdu_length,
- DATA_BLOB *sig)
+ const DATA_BLOB *sig)
{
if (!gensec_security->ops->unseal_packet) {
return NT_STATUS_NOT_IMPLEMENTED;
}
if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
- if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
- return gensec_check_packet(gensec_security, mem_ctx,
- data, length,
- whole_pdu, pdu_length,
- sig);
- }
return NT_STATUS_INVALID_PARAMETER;
}
-
+
return gensec_security->ops->unseal_packet(gensec_security, mem_ctx,
data, length,
whole_pdu, pdu_length,
return NT_STATUS_NOT_IMPLEMENTED;
}
if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
- if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
- return gensec_sign_packet(gensec_security, mem_ctx,
- data, length,
- whole_pdu, pdu_length,
- sig);
- }
return NT_STATUS_INVALID_PARAMETER;
}
-
+
return gensec_security->ops->seal_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
}
return gensec_security->ops->sign_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
}
-size_t gensec_sig_size(struct gensec_security *gensec_security)
+size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size)
{
if (!gensec_security->ops->sig_size) {
return 0;
return 0;
}
- return gensec_security->ops->sig_size(gensec_security);
+ return gensec_security->ops->sig_size(gensec_security, data_size);
}
NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
if (!gensec_security->ops->session_key) {
return NT_STATUS_NOT_IMPLEMENTED;
}
+ if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SESSION_KEY)) {
+ return NT_STATUS_NO_USER_SESSION_KEY;
+ }
+
return gensec_security->ops->session_key(gensec_security, session_key);
}
if (!gensec_security->ops->have_feature) {
return False;
}
- return gensec_security->ops->have_feature(gensec_security, feature);
+
+ /* Can only 'have' a feature if you already 'want'ed it */
+ if (gensec_security->want_features & feature) {
+ return gensec_security->ops->have_feature(gensec_security, feature);
+ }
+ return False;
}
/**
struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security)
{
+ if (!gensec_security) {
+ return NULL;
+ }
return gensec_security->credentials;
}
return NT_STATUS_OK;
}
+const char *gensec_get_target_service(struct gensec_security *gensec_security)
+{
+ if (gensec_security->target.service) {
+ return gensec_security->target.service;
+ }
+
+ return "host";
+}
+
/**
* Set the target hostname (suitable for kerberos resolutation) on a GENSEC context - ensures it is talloc()ed
*
return NULL;
}
-const char *gensec_get_target_service(struct gensec_security *gensec_security)
+/**
+ * Set the target principal (assuming it it known, say from the SPNEGO reply)
+ * - ensures it is talloc()ed
+ *
+ */
+
+NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal)
{
- if (gensec_security->target.service) {
- return gensec_security->target.service;
+ gensec_security->target.principal = talloc_strdup(gensec_security, principal);
+ if (!gensec_security->target.principal) {
+ return NT_STATUS_NO_MEMORY;
}
+ return NT_STATUS_OK;
+}
- return "host";
+const char *gensec_get_target_principal(struct gensec_security *gensec_security)
+{
+ if (gensec_security->target.principal) {
+ return gensec_security->target.principal;
+ }
+
+ return NULL;
}
/*
return NT_STATUS_OK;
}
- if (gensec_security_by_name(ops->name) != NULL) {
+ if (gensec_security_by_name(NULL, ops->name) != NULL) {
/* its already registered! */
DEBUG(0,("GENSEC backend '%s' already registered\n",
ops->name));
generic_security_ops = realloc_p(generic_security_ops,
const struct gensec_security_ops *,
- gensec_num_backends+1);
+ gensec_num_backends+2);
if (!generic_security_ops) {
smb_panic("out of memory in gensec_register");
}
generic_security_ops[gensec_num_backends] = ops;
-
gensec_num_backends++;
+ generic_security_ops[gensec_num_backends] = NULL;
DEBUG(3,("GENSEC backend '%s' registered\n",
ops->name));
*/
NTSTATUS gensec_init(void)
{
+ static BOOL initialized = False;
+
+ init_module_fn static_init[] = STATIC_GENSEC_MODULES;
+ init_module_fn *shared_init = load_samba_modules(NULL, "gensec");
+
+ if (initialized) return NT_STATUS_OK;
+ initialized = True;
+
+ run_init_functions(static_init);
+ run_init_functions(shared_init);
+
+ talloc_free(shared_init);
+
return NT_STATUS_OK;
}
git.samba.org / samba.git / blobdiff