#include "includes.h"
#include "auth/auth.h"
#include "lib/events/events.h"
+#include "smb_build.h"
/* the list of currently registered GENSEC backends */
const static struct gensec_security_ops **generic_security_ops;
static int gensec_num_backends;
-static const struct gensec_security_ops *gensec_security_by_authtype(uint8_t auth_type)
+const struct gensec_security_ops **gensec_security_all(void)
+{
+ return generic_security_ops;
+}
+
+static const struct gensec_security_ops *gensec_security_by_authtype(struct gensec_security *gensec_security,
+ uint8_t auth_type)
{
int i;
- for (i=0; i < gensec_num_backends; i++) {
- if (generic_security_ops[i]->auth_type == auth_type) {
- return generic_security_ops[i];
+ const struct gensec_security_ops **backends;
+ if (!gensec_security) {
+ backends = gensec_security_all();
+ } else {
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ }
+ for (i=0; backends && backends[i]; i++) {
+ if (backends[i]->auth_type == auth_type) {
+ return backends[i];
}
}
return NULL;
}
-static const struct gensec_security_ops *gensec_security_by_oid(const char *oid_string)
+const struct gensec_security_ops *gensec_security_by_oid(struct gensec_security *gensec_security,
+ const char *oid_string)
{
int i, j;
- for (i=0; i < gensec_num_backends; i++) {
- if (generic_security_ops[i]->oid) {
- for (j=0; generic_security_ops[i]->oid[j]; j++) {
- if (generic_security_ops[i]->oid[j] &&
- (strcmp(generic_security_ops[i]->oid[j], oid_string) == 0)) {
- return generic_security_ops[i];
+ const struct gensec_security_ops **backends;
+ if (!gensec_security) {
+ backends = gensec_security_all();
+ } else {
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ }
+ for (i=0; backends && backends[i]; i++) {
+ if (backends[i]->oid) {
+ for (j=0; backends[i]->oid[j]; j++) {
+ if (backends[i]->oid[j] &&
+ (strcmp(backends[i]->oid[j], oid_string) == 0)) {
+ return backends[i];
}
}
}
return NULL;
}
-static const struct gensec_security_ops *gensec_security_by_sasl_name(const char *sasl_name)
+static const struct gensec_security_ops *gensec_security_by_sasl_name(struct gensec_security *gensec_security,
+ const char *sasl_name)
{
int i;
- for (i=0; i < gensec_num_backends; i++) {
- if (generic_security_ops[i]->sasl_name
- && (strcmp(generic_security_ops[i]->sasl_name, sasl_name) == 0)) {
- return generic_security_ops[i];
+ const struct gensec_security_ops **backends;
+ if (!gensec_security) {
+ backends = gensec_security_all();
+ } else {
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ }
+ for (i=0; backends && backends[i]; i++) {
+ if (backends[i]->sasl_name
+ && (strcmp(backends[i]->sasl_name, sasl_name) == 0)) {
+ return backends[i];
}
}
return NULL;
}
-static const struct gensec_security_ops *gensec_security_by_name(const char *name)
+static const struct gensec_security_ops *gensec_security_by_name(struct gensec_security *gensec_security,
+ const char *name)
{
int i;
- for (i=0; i < gensec_num_backends; i++) {
- if (generic_security_ops[i]->name
- && (strcmp(generic_security_ops[i]->name, name) == 0)) {
- return generic_security_ops[i];
+ const struct gensec_security_ops **backends;
+ if (!gensec_security) {
+ backends = gensec_security_all();
+ } else {
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ }
+ for (i=0; backends && backends[i]; i++) {
+ if (backends[i]->name
+ && (strcmp(backends[i]->name, name) == 0)) {
+ return backends[i];
}
}
return NULL;
}
-const struct gensec_security_ops **gensec_security_all(int *num_backends_out)
+/**
+ * Return a unique list of security subsystems from those specified in
+ * the list of SASL names.
+ *
+ * Use the list of enabled GENSEC mechanisms from the credentials
+ * attached to the gensec_security, and return in our preferred order.
+ */
+
+const struct gensec_security_ops **gensec_security_by_sasl(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ const char **sasl_names)
{
- *num_backends_out = gensec_num_backends;
- return generic_security_ops;
+ const struct gensec_security_ops **backends_out;
+ const struct gensec_security_ops **backends;
+ int i, k, sasl_idx;
+ int num_backends_out = 0;
+
+ if (!sasl_names) {
+ return NULL;
+ }
+
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+
+ backends_out = talloc_array(mem_ctx, const struct gensec_security_ops *, 1);
+ if (!backends_out) {
+ return NULL;
+ }
+ backends_out[0] = NULL;
+
+ /* Find backends in our preferred order, by walking our list,
+ * then looking in the supplied list */
+ for (i=0; backends && backends[i]; i++) {
+ for (sasl_idx = 0; sasl_names[sasl_idx]; sasl_idx++) {
+ if (!backends[i]->sasl_name ||
+ !(strcmp(backends[i]->sasl_name,
+ sasl_names[sasl_idx]) == 0)) {
+ continue;
+ }
+
+ for (k=0; backends_out[k]; k++) {
+ if (backends_out[k] == backends[i]) {
+ break;
+ }
+ }
+
+ if (k < num_backends_out) {
+ /* already in there */
+ continue;
+ }
+
+ backends_out = talloc_realloc(mem_ctx, backends_out,
+ const struct gensec_security_ops *,
+ num_backends_out + 2);
+ if (!backends_out) {
+ return NULL;
+ }
+
+ backends_out[num_backends_out] = backends[i];
+ num_backends_out++;
+ backends_out[num_backends_out] = NULL;
+ }
+ }
+ return backends_out;
}
/**
* Return a unique list of security subsystems from those specified in
* the OID list. That is, where two OIDs refer to the same module,
- * return that module only once
+ * return that module only once.
*
- * The list is in the exact order of the OIDs asked for, where available.
+ * Use the list of enabled GENSEC mechanisms from the credentials
+ * attached to the gensec_security, and return in our preferred order.
*/
-const struct gensec_security_ops_wrapper *gensec_security_by_oid_list(TALLOC_CTX *mem_ctx,
+const struct gensec_security_ops_wrapper *gensec_security_by_oid_list(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
const char **oid_strings,
const char *skip)
{
const struct gensec_security_ops **backends;
int i, j, k, oid_idx;
int num_backends_out = 0;
- int num_backends;
if (!oid_strings) {
return NULL;
}
- backends = gensec_security_all(&num_backends);
+ backends = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
backends_out = talloc_array(mem_ctx, struct gensec_security_ops_wrapper, 1);
if (!backends_out) {
backends_out[0].op = NULL;
backends_out[0].oid = NULL;
- for (oid_idx = 0; oid_strings[oid_idx]; oid_idx++) {
- if (strcmp(oid_strings[oid_idx], skip) == 0) {
+ /* Find backends in our preferred order, by walking our list,
+ * then looking in the supplied list */
+ for (i=0; backends && backends[i]; i++) {
+ if (!backends[i]->oid) {
continue;
}
-
- for (i=0; i < num_backends; i++) {
- if (!backends[i]->oid) {
+ for (oid_idx = 0; oid_strings[oid_idx]; oid_idx++) {
+ if (strcmp(oid_strings[oid_idx], skip) == 0) {
continue;
}
+
for (j=0; backends[i]->oid[j]; j++) {
if (!backends[i]->oid[j] ||
!(strcmp(backends[i]->oid[j],
const char **gensec_security_oids_from_ops(TALLOC_CTX *mem_ctx,
const struct gensec_security_ops **ops,
- int num_backends,
const char *skip)
{
int i;
return NULL;
}
- for (i=0; i<num_backends; i++) {
+ for (i=0; ops && ops[i]; i++) {
if (!ops[i]->oid) {
continue;
}
/**
- * Return all the security subsystems currently enabled in GENSEC
+ * Return OIDS from the security subsystems listed
+ */
+
+const char **gensec_security_oids_from_ops_wrapped(TALLOC_CTX *mem_ctx,
+ const struct gensec_security_ops_wrapper *wops)
+{
+ int i;
+ int j = 0;
+ int k;
+ const char **oid_list;
+ if (!wops) {
+ return NULL;
+ }
+ oid_list = talloc_array(mem_ctx, const char *, 1);
+ if (!oid_list) {
+ return NULL;
+ }
+
+ for (i=0; wops[i].op; i++) {
+ if (!wops[i].op->oid) {
+ continue;
+ }
+
+ for (k = 0; wops[i].op->oid[k]; k++) {
+ oid_list = talloc_realloc(mem_ctx, oid_list, const char *, j + 2);
+ if (!oid_list) {
+ return NULL;
+ }
+ oid_list[j] = wops[i].op->oid[k];
+ j++;
+ }
+ }
+ oid_list[j] = NULL;
+ return oid_list;
+}
+
+
+/**
+ * Return all the security subsystems currently enabled on a GENSEC context.
+ *
+ * This is taken from a list attached to the cli_credentails, and
+ * skips the OID in 'skip'. (Typically the SPNEGO OID)
+ *
*/
-const char **gensec_security_oids(TALLOC_CTX *mem_ctx, const char *skip)
+const char **gensec_security_oids(struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ const char *skip)
{
- int num_backends;
- const struct gensec_security_ops **ops = gensec_security_all(&num_backends);
- return gensec_security_oids_from_ops(mem_ctx, ops,
- num_backends, skip);
+ const struct gensec_security_ops **ops
+ = cli_credentials_gensec_list(gensec_get_credentials(gensec_security));
+ return gensec_security_oids_from_ops(mem_ctx, ops, skip);
}
NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
uint8_t auth_type, uint8_t auth_level)
{
- gensec_security->ops = gensec_security_by_authtype(auth_type);
+ gensec_security->ops = gensec_security_by_authtype(gensec_security, auth_type);
if (!gensec_security->ops) {
DEBUG(3, ("Could not find GENSEC backend for auth_type=%d\n", (int)auth_type));
return NT_STATUS_INVALID_PARAMETER;
}
gensec_want_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE);
+ gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
} else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
const char *gensec_get_name_by_authtype(uint8_t authtype)
{
const struct gensec_security_ops *ops;
- ops = gensec_security_by_authtype(authtype);
+ ops = gensec_security_by_authtype(NULL, authtype);
if (ops) {
return ops->name;
}
const char *gensec_get_name_by_oid(const char *oid_string)
{
const struct gensec_security_ops *ops;
- ops = gensec_security_by_oid(oid_string);
+ ops = gensec_security_by_oid(NULL, oid_string);
if (ops) {
return ops->name;
}
- return NULL;
+ return oid_string;
}
NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security,
const char *mech_oid)
{
- gensec_security->ops = gensec_security_by_oid(mech_oid);
+ gensec_security->ops = gensec_security_by_oid(gensec_security, mech_oid);
if (!gensec_security->ops) {
DEBUG(3, ("Could not find GENSEC backend for oid=%s\n", mech_oid));
return NT_STATUS_INVALID_PARAMETER;
NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
const char *sasl_name)
{
- gensec_security->ops = gensec_security_by_sasl_name(sasl_name);
+ gensec_security->ops = gensec_security_by_sasl_name(gensec_security, sasl_name);
if (!gensec_security->ops) {
DEBUG(3, ("Could not find GENSEC backend for sasl_name=%s\n", sasl_name));
return NT_STATUS_INVALID_PARAMETER;
return gensec_start_mech(gensec_security);
}
+/**
+ * Start a GENSEC sub-mechanism by an internal name
+ *
+ */
+
+NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
+ const char *name)
+{
+ gensec_security->ops = gensec_security_by_name(gensec_security, name);
+ if (!gensec_security->ops) {
+ DEBUG(3, ("Could not find GENSEC backend for name=%s\n", name));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ return gensec_start_mech(gensec_security);
+}
+
/*
wrappers for the gensec function pointers
*/
return NT_STATUS_NOT_IMPLEMENTED;
}
if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
- if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
- return gensec_check_packet(gensec_security, mem_ctx,
- data, length,
- whole_pdu, pdu_length,
- sig);
- }
return NT_STATUS_INVALID_PARAMETER;
}
-
+
return gensec_security->ops->unseal_packet(gensec_security, mem_ctx,
data, length,
whole_pdu, pdu_length,
return NT_STATUS_NOT_IMPLEMENTED;
}
if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
- if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
- return gensec_sign_packet(gensec_security, mem_ctx,
- data, length,
- whole_pdu, pdu_length,
- sig);
- }
return NT_STATUS_INVALID_PARAMETER;
}
-
+
return gensec_security->ops->seal_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
}
return gensec_security->ops->sign_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
}
-size_t gensec_sig_size(struct gensec_security *gensec_security)
+size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size)
{
if (!gensec_security->ops->sig_size) {
return 0;
return 0;
}
- return gensec_security->ops->sig_size(gensec_security);
+ return gensec_security->ops->sig_size(gensec_security, data_size);
}
NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
if (!gensec_security->ops->session_key) {
return NT_STATUS_NOT_IMPLEMENTED;
}
+ if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SESSION_KEY)) {
+ return NT_STATUS_NO_USER_SESSION_KEY;
+ }
+
return gensec_security->ops->session_key(gensec_security, session_key);
}
if (!gensec_security->ops->have_feature) {
return False;
}
- return gensec_security->ops->have_feature(gensec_security, feature);
+
+ /* Can only 'have' a feature if you already 'want'ed it */
+ if (gensec_security->want_features & feature) {
+ return gensec_security->ops->have_feature(gensec_security, feature);
+ }
+ return False;
}
/**
struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security)
{
+ if (!gensec_security) {
+ return NULL;
+ }
return gensec_security->credentials;
}
return NT_STATUS_OK;
}
+const char *gensec_get_target_service(struct gensec_security *gensec_security)
+{
+ if (gensec_security->target.service) {
+ return gensec_security->target.service;
+ }
+
+ return "host";
+}
+
/**
* Set the target hostname (suitable for kerberos resolutation) on a GENSEC context - ensures it is talloc()ed
*
return NULL;
}
-const char *gensec_get_target_service(struct gensec_security *gensec_security)
+/**
+ * Set the target principal (assuming it it known, say from the SPNEGO reply)
+ * - ensures it is talloc()ed
+ *
+ */
+
+NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal)
{
- if (gensec_security->target.service) {
- return gensec_security->target.service;
+ gensec_security->target.principal = talloc_strdup(gensec_security, principal);
+ if (!gensec_security->target.principal) {
+ return NT_STATUS_NO_MEMORY;
}
+ return NT_STATUS_OK;
+}
- return "host";
+const char *gensec_get_target_principal(struct gensec_security *gensec_security)
+{
+ if (gensec_security->target.principal) {
+ return gensec_security->target.principal;
+ }
+
+ return NULL;
}
/*
return NT_STATUS_OK;
}
- if (gensec_security_by_name(ops->name) != NULL) {
+ if (gensec_security_by_name(NULL, ops->name) != NULL) {
/* its already registered! */
DEBUG(0,("GENSEC backend '%s' already registered\n",
ops->name));
generic_security_ops = realloc_p(generic_security_ops,
const struct gensec_security_ops *,
- gensec_num_backends+1);
+ gensec_num_backends+2);
if (!generic_security_ops) {
smb_panic("out of memory in gensec_register");
}
generic_security_ops[gensec_num_backends] = ops;
-
gensec_num_backends++;
+ generic_security_ops[gensec_num_backends] = NULL;
DEBUG(3,("GENSEC backend '%s' registered\n",
ops->name));
*/
NTSTATUS gensec_init(void)
{
+ static BOOL initialized = False;
+
+ init_module_fn static_init[] = STATIC_GENSEC_MODULES;
+ init_module_fn *shared_init = load_samba_modules(NULL, "gensec");
+
+ if (initialized) return NT_STATUS_OK;
+ initialized = True;
+
+ run_init_functions(static_init);
+ run_init_functions(shared_init);
+
+ talloc_free(shared_init);
+
return NT_STATUS_OK;
}