Kerberos backend for GENSEC
- Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
- Copyright (C) Stefan Metzmacher <metze@samba.org> 2005
+ Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
+ Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
#include "includes.h"
#include "system/kerberos.h"
+#include "system/network.h"
#include "auth/kerberos/kerberos.h"
#include "librpc/gen_ndr/ndr_krb5pac.h"
#include "auth/auth.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
-static const gss_OID_desc gensec_gss_krb5_mechanism_oid_desc =
- {9, (void *)discard_const_p(char, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02")};
-
-static const gss_OID_desc gensec_gss_spnego_mechanism_oid_desc =
- {6, (void *)discard_const_p(char, "\x2b\x06\x01\x05\x05\x02")};
-
struct gensec_gssapi_state {
gss_ctx_id_t gssapi_context;
struct gss_channel_bindings_struct *input_chan_bindings;
DATA_BLOB session_key;
DATA_BLOB pac;
+
+ struct smb_krb5_context *smb_krb5_context;
+ krb5_ccache ccache;
+ const char *ccache_name;
+ krb5_keytab keytab;
+
+ gss_cred_id_t cred;
};
+
+static char *gssapi_error_string(TALLOC_CTX *mem_ctx,
+ OM_uint32 maj_stat, OM_uint32 min_stat)
+{
+ OM_uint32 disp_min_stat, disp_maj_stat;
+ gss_buffer_desc maj_error_message;
+ gss_buffer_desc min_error_message;
+ OM_uint32 msg_ctx = 0;
+
+ char *ret;
+
+ maj_error_message.value = NULL;
+ min_error_message.value = NULL;
+
+ disp_maj_stat = gss_display_status(&disp_min_stat, maj_stat, GSS_C_GSS_CODE,
+ GSS_C_NULL_OID, &msg_ctx, &maj_error_message);
+ disp_maj_stat = gss_display_status(&disp_min_stat, min_stat, GSS_C_MECH_CODE,
+ GSS_C_NULL_OID, &msg_ctx, &min_error_message);
+ ret = talloc_asprintf(mem_ctx, "%s: %s", (char *)maj_error_message.value, (char *)min_error_message.value);
+
+ gss_release_buffer(&disp_min_stat, &maj_error_message);
+ gss_release_buffer(&disp_min_stat, &min_error_message);
+
+ return ret;
+}
+
+
static int gensec_gssapi_destory(void *ptr)
{
struct gensec_gssapi_state *gensec_gssapi_state = ptr;
OM_uint32 maj_stat, min_stat;
+
+ if (gensec_gssapi_state->cred != GSS_C_NO_CREDENTIAL) {
+ maj_stat = gss_release_cred(&min_stat,
+ &gensec_gssapi_state->cred);
+ }
if (gensec_gssapi_state->gssapi_context != GSS_C_NO_CONTEXT) {
maj_stat = gss_delete_sec_context (&min_stat,
static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security)
{
struct gensec_gssapi_state *gensec_gssapi_state;
-
+ krb5_error_code ret;
+
gensec_gssapi_state = talloc(gensec_security, struct gensec_gssapi_state);
if (!gensec_gssapi_state) {
return NT_STATUS_NO_MEMORY;
gensec_gssapi_state->server_name = GSS_C_NO_NAME;
gensec_gssapi_state->client_name = GSS_C_NO_NAME;
- talloc_set_destructor(gensec_gssapi_state, gensec_gssapi_destory);
-
/* TODO: Fill in channel bindings */
gensec_gssapi_state->input_chan_bindings = GSS_C_NO_CHANNEL_BINDINGS;
gensec_gssapi_state->session_key = data_blob(NULL, 0);
gensec_gssapi_state->pac = data_blob(NULL, 0);
+ gensec_gssapi_state->cred = GSS_C_NO_CREDENTIAL;
+
+ talloc_set_destructor(gensec_gssapi_state, gensec_gssapi_destory);
+
if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
#ifndef HAVE_GSSKRB5_GET_INITIATOR_SUBKEY
- /* GSSAPI won't give us the session keys, without the right hook */
+ /* GSSAPI won't give us the session keys, without the
+ * right hooks. This is critical when requested, so
+ * fail outright. */
return NT_STATUS_INVALID_PARAMETER;
#endif
}
gensec_gssapi_state->want_flags |= GSS_C_CONF_FLAG;
}
if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
+#ifndef GSS_C_DCE_STYLE
+ /* GSSAPI DCE_STYLE is critical when requested, so
+ * fail outright */
+ return NT_STATUS_INVALID_PARAMETER;
+#else
gensec_gssapi_state->want_flags |= GSS_C_DCE_STYLE;
+#endif
}
- if ((strcmp(gensec_security->ops->oid, GENSEC_OID_KERBEROS5) == 0)
- || (strcmp(gensec_security->ops->oid, GENSEC_OID_KERBEROS5_OLD) == 0)) {
- gensec_gssapi_state->gss_oid = &gensec_gss_krb5_mechanism_oid_desc;
- } else if (strcmp(gensec_security->ops->oid, GENSEC_OID_SPNEGO) == 0) {
- gensec_gssapi_state->gss_oid = &gensec_gss_spnego_mechanism_oid_desc;
- } else {
- DEBUG(1, ("gensec_gssapi incorrectly configured - cannot determine gss OID from %s\n",
- gensec_security->ops->oid));
- return NT_STATUS_INVALID_PARAMETER;
+ gensec_gssapi_state->gss_oid = gss_mech_krb5;
+
+ ret = smb_krb5_init_context(gensec_gssapi_state,
+ &gensec_gssapi_state->smb_krb5_context);
+ if (ret) {
+ DEBUG(1,("gensec_krb5_start: krb5_init_context failed (%s)\n",
+ error_message(ret)));
+ return NT_STATUS_INTERNAL_ERROR;
}
-
return NT_STATUS_OK;
}
static NTSTATUS gensec_gssapi_server_start(struct gensec_security *gensec_security)
{
NTSTATUS nt_status;
+ OM_uint32 maj_stat, min_stat;
struct gensec_gssapi_state *gensec_gssapi_state;
+ struct cli_credentials *machine_account;
nt_status = gensec_gssapi_start(gensec_security);
if (!NT_STATUS_IS_OK(nt_status)) {
gensec_gssapi_state = gensec_security->private_data;
+ machine_account = cli_credentials_init(gensec_gssapi_state);
+ cli_credentials_set_conf(machine_account);
+ nt_status = cli_credentials_set_machine_account(machine_account);
+
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ DEBUG(3, ("Could not obtain machine account credentials from the local database\n"));
+ talloc_free(machine_account);
+ return nt_status;
+ } else {
+ nt_status = create_memory_keytab(gensec_gssapi_state,
+ machine_account,
+ gensec_gssapi_state->smb_krb5_context,
+ &gensec_gssapi_state->keytab);
+ talloc_free(machine_account);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ DEBUG(3, ("Could not create memory keytab!\n"));
+ talloc_free(machine_account);
+ return nt_status;
+ }
+ }
+
+ maj_stat = gsskrb5_acquire_cred(&min_stat,
+ gensec_gssapi_state->keytab, NULL,
+ NULL,
+ GSS_C_INDEFINITE,
+ GSS_C_NULL_OID_SET,
+ GSS_C_ACCEPT,
+ &gensec_gssapi_state->cred,
+ NULL,
+ NULL);
+ if (maj_stat) {
+ DEBUG(1, ("Aquiring acceptor credentails failed: %s\n",
+ gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat)));
+ return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+ }
+
return NT_STATUS_OK;
+
}
static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_security)
{
struct gensec_gssapi_state *gensec_gssapi_state;
+ struct cli_credentials *creds = gensec_get_credentials(gensec_security);
NTSTATUS nt_status;
gss_buffer_desc name_token;
OM_uint32 maj_stat, min_stat;
+ const char *hostname = gensec_get_target_hostname(gensec_security);
- gss_OID_desc hostbased = {10,
- (void *)discard_const_p(char, "\x2a\x86\x48\x86\xf7\x12"
- "\x01\x02\x01\x04")};
+ if (!hostname) {
+ DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ if (is_ipaddress(hostname)) {
+ DEBUG(2, ("Cannot do GSSAPI to a IP address"));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
nt_status = gensec_gssapi_start(gensec_security);
if (!NT_STATUS_IS_OK(nt_status)) {
gensec_gssapi_state = gensec_security->private_data;
- name_token.value = talloc_asprintf(gensec_gssapi_state, "%s@%s", gensec_get_target_service(gensec_security),
- gensec_get_target_hostname(gensec_security));
- DEBUG(0, ("name: %s\n", (char *)name_token.value));
+ name_token.value = talloc_asprintf(gensec_gssapi_state, "%s@%s",
+ gensec_get_target_service(gensec_security),
+ hostname);
name_token.length = strlen(name_token.value);
maj_stat = gss_import_name (&min_stat,
&name_token,
- &hostbased,
+ GSS_C_NT_HOSTBASED_SERVICE,
&gensec_gssapi_state->server_name);
+ if (maj_stat) {
+ DEBUG(1, ("GSS Import name of %s failed: %s\n",
+ (char *)name_token.value,
+ gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+ name_token.value = cli_credentials_get_principal(creds,
+ gensec_gssapi_state);
+ name_token.length = strlen(name_token.value);
+ maj_stat = gss_import_name (&min_stat,
+ &name_token,
+ GSS_C_NT_USER_NAME,
+ &gensec_gssapi_state->client_name);
if (maj_stat) {
+ DEBUG(1, ("GSS Import name of %s failed: %s\n",
+ (char *)name_token.value,
+ gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat)));
return NT_STATUS_UNSUCCESSFUL;
}
+
+ nt_status = kinit_to_ccache(gensec_gssapi_state,
+ creds,
+ gensec_gssapi_state->smb_krb5_context,
+ &gensec_gssapi_state->ccache, &gensec_gssapi_state->ccache_name);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+
+ maj_stat = gsskrb5_acquire_cred(&min_stat,
+ NULL, gensec_gssapi_state->ccache,
+ gensec_gssapi_state->client_name,
+ GSS_C_INDEFINITE,
+ GSS_C_NULL_OID_SET,
+ GSS_C_INITIATE,
+ &gensec_gssapi_state->cred,
+ NULL,
+ NULL);
+ if (maj_stat) {
+ DEBUG(1, ("Aquiring initiator credentails failed: %s\n",
+ gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
return NT_STATUS_OK;
}
+/**
+ * Check if the packet is one for this mechansim
+ *
+ * @param gensec_security GENSEC state
+ * @param in The request, as a DATA_BLOB
+ * @return Error, INVALID_PARAMETER if it's not a packet for us
+ * or NT_STATUS_OK if the packet is ok.
+ */
+
+static NTSTATUS gensec_gssapi_magic(struct gensec_security *gensec_security,
+ const DATA_BLOB *in)
+{
+ if (gensec_gssapi_check_oid(in, GENSEC_OID_KERBEROS5)) {
+ return NT_STATUS_OK;
+ } else {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+}
+
/**
* Next state function for the GSSAPI GENSEC mechanism
case GENSEC_CLIENT:
{
maj_stat = gss_init_sec_context(&min_stat,
- GSS_C_NO_CREDENTIAL,
+ gensec_gssapi_state->cred,
&gensec_gssapi_state->gssapi_context,
gensec_gssapi_state->server_name,
discard_const_p(gss_OID_desc, gensec_gssapi_state->gss_oid),
{
maj_stat = gss_accept_sec_context(&min_stat,
&gensec_gssapi_state->gssapi_context,
- GSS_C_NO_CREDENTIAL,
+ gensec_gssapi_state->cred,
&input_token,
gensec_gssapi_state->input_chan_bindings,
&gensec_gssapi_state->client_name,
} else if (maj_stat == GSS_S_CONTINUE_NEEDED) {
return NT_STATUS_MORE_PROCESSING_REQUIRED;
} else {
- gss_buffer_desc msg1, msg2;
- OM_uint32 msg_ctx = 0;
-
- msg1.value = NULL;
- msg2.value = NULL;
- gss_display_status(&min_stat2, maj_stat, GSS_C_GSS_CODE,
- GSS_C_NULL_OID, &msg_ctx, &msg1);
- gss_display_status(&min_stat2, min_stat, GSS_C_MECH_CODE,
- GSS_C_NULL_OID, &msg_ctx, &msg2);
- DEBUG(1, ("gensec_gssapi_update: %s : %s\n", (char *)msg1.value, (char *)msg2.value));
- gss_release_buffer(&min_stat2, &msg1);
- gss_release_buffer(&min_stat2, &msg2);
-
+ if (maj_stat == GSS_S_FAILURE
+ && (min_stat == KRB5KRB_AP_ERR_BADVERSION || min_stat == KRB5KRB_AP_ERR_MSG_TYPE)) {
+ /* garbage input, possibly from the auto-mech detection */
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ DEBUG(1, ("GSS Update failed: %s\n",
+ gssapi_error_string(out_mem_ctx, maj_stat, min_stat)));
return nt_status;
}
-
}
static NTSTATUS gensec_gssapi_wrap(struct gensec_security *gensec_security,
&conf_state,
&output_token);
if (GSS_ERROR(maj_stat)) {
+ DEBUG(1, ("GSS Wrap failed: %s\n",
+ gssapi_error_string(mem_ctx, maj_stat, min_stat)));
return NT_STATUS_ACCESS_DENIED;
}
*out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
&conf_state,
&qop_state);
if (GSS_ERROR(maj_stat)) {
+ DEBUG(1, ("GSS UnWrap failed: %s\n",
+ gssapi_error_string(mem_ctx, maj_stat, min_stat)));
return NT_STATUS_ACCESS_DENIED;
}
*out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
&conf_state,
&output_token);
if (GSS_ERROR(maj_stat)) {
+ DEBUG(1, ("GSS Wrap failed: %s\n",
+ gssapi_error_string(mem_ctx, maj_stat, min_stat)));
return NT_STATUS_ACCESS_DENIED;
}
memcpy(data, ((uint8_t *)output_token.value) + sig_length, length);
*sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, sig_length);
-DEBUG(0,("gensec_gssapi_seal_packet: siglen: %d inlen: %d, wrap_len: %d\n", sig->length, length, output_token.length - sig_length));
-dump_data(0,sig->data, sig->length);
-dump_data(0,data, length);
-dump_data(0,((uint8_t *)output_token.value) + sig_length, output_token.length - sig_length);
+ dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
+ dump_data_pw("gensec_gssapi_seal_packet: clear\n", data, length);
+ dump_data_pw("gensec_gssapi_seal_packet: sealed\n", ((uint8_t *)output_token.value) + sig_length, output_token.length - sig_length);
gss_release_buffer(&min_stat, &output_token);
gss_qop_t qop_state;
DATA_BLOB in;
-DEBUG(0,("gensec_gssapi_unseal_packet: siglen: %d\n", sig->length));
-dump_data(0,sig->data, sig->length);
+ dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
&conf_state,
&qop_state);
if (GSS_ERROR(maj_stat)) {
+ DEBUG(1, ("GSS UnWrap failed: %s\n",
+ gssapi_error_string(mem_ctx, maj_stat, min_stat)));
return NT_STATUS_ACCESS_DENIED;
}
&conf_state,
&output_token);
if (GSS_ERROR(maj_stat)) {
+ DEBUG(1, ("GSS Wrap failed: %s\n",
+ gssapi_error_string(mem_ctx, maj_stat, min_stat)));
return NT_STATUS_ACCESS_DENIED;
}
/*memcpy(data, ((uint8_t *)output_token.value) + sig_length, length);*/
*sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, sig_length);
-DEBUG(0,("gensec_gssapi_sign_packet: siglen: %d\n", sig->length));
-dump_data(0,sig->data, sig->length);
+ dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
gss_release_buffer(&min_stat, &output_token);
gss_qop_t qop_state;
DATA_BLOB in;
-DEBUG(0,("gensec_gssapi_check_packet: siglen: %d\n", sig->length));
-dump_data(0,sig->data, sig->length);
+ dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
&conf_state,
&qop_state);
if (GSS_ERROR(maj_stat)) {
+ DEBUG(1, ("GSS UnWrap failed: %s\n",
+ gssapi_error_string(mem_ctx, maj_stat, min_stat)));
return NT_STATUS_ACCESS_DENIED;
}
return NT_STATUS_INTERNAL_ERROR;
}
- /*memcpy(data, output_token.value, length);*/
-
gss_release_buffer(&min_stat, &output_token);
return NT_STATUS_OK;
}
if (feature & GENSEC_FEATURE_SESSION_KEY) {
#ifdef HAVE_GSSKRB5_GET_INITIATOR_SUBKEY
- if ((gensec_gssapi_state->gss_oid->length == gensec_gss_krb5_mechanism_oid_desc.length)
- && (memcmp(gensec_gssapi_state->gss_oid->elements, gensec_gss_krb5_mechanism_oid_desc.elements, gensec_gssapi_state->gss_oid->length) == 0)) {
+ if ((gensec_gssapi_state->gss_oid->length == gss_mech_krb5->length)
+ && (memcmp(gensec_gssapi_state->gss_oid->elements, gss_mech_krb5->elements, gensec_gssapi_state->gss_oid->length) == 0)) {
return True;
}
- }
#endif
+ }
return False;
}
}
#ifdef HAVE_GSSKRB5_GET_INITIATOR_SUBKEY
- if ((gensec_gssapi_state->gss_oid->length == gensec_gss_krb5_mechanism_oid_desc.length)
- && (memcmp(gensec_gssapi_state->gss_oid->elements, gensec_gss_krb5_mechanism_oid_desc.elements, gensec_gssapi_state->gss_oid->length) == 0)) {
+ /* Ensure we only call this for GSSAPI/krb5, otherwise things could get very ugly */
+ if ((gensec_gssapi_state->gss_oid->length == gss_mech_krb5->length)
+ && (memcmp(gensec_gssapi_state->gss_oid->elements, gss_mech_krb5->elements,
+ gensec_gssapi_state->gss_oid->length) == 0)) {
OM_uint32 maj_stat, min_stat;
gss_buffer_desc skey;
&skey);
if (maj_stat == 0) {
- DEBUG(10, ("Got KRB5 session key of length %d\n", skey.length));
+ DEBUG(10, ("Got KRB5 session key of length %d\n",
+ (int)skey.length));
gensec_gssapi_state->session_key = data_blob_talloc(gensec_gssapi_state,
skey.value, skey.length);
*session_key = gensec_gssapi_state->session_key;
struct auth_session_info **_session_info)
{
NTSTATUS nt_status;
+ TALLOC_CTX *mem_ctx;
struct gensec_gssapi_state *gensec_gssapi_state = gensec_security->private_data;
struct auth_serversupplied_info *server_info = NULL;
struct auth_session_info *session_info = NULL;
+ struct PAC_LOGON_INFO *logon_info;
char *p;
char *principal;
const char *account_name;
const char *realm;
OM_uint32 maj_stat, min_stat;
gss_buffer_desc name_token;
+ gss_buffer_desc pac;
+ krb5_keyblock *keyblock;
+ mem_ctx = talloc_named(gensec_gssapi_state, 0, "gensec_gssapi_session_info context");
+ NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
+
maj_stat = gss_display_name (&min_stat,
gensec_gssapi_state->client_name,
&name_token,
return NT_STATUS_FOOBAR;
}
- principal = talloc_strndup(gensec_gssapi_state, name_token.value, name_token.length);
+ principal = talloc_strndup(mem_ctx, name_token.value, name_token.length);
gss_release_buffer(&min_stat, &name_token);
- NT_STATUS_HAVE_NO_MEMORY(principal);
+ if (!principal) {
+ talloc_free(mem_ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
p = strchr(principal, '@');
if (p) {
realm = lp_realm();
}
account_name = principal;
+
+ maj_stat = gss_krb5_copy_service_keyblock(&min_stat,
+ gensec_gssapi_state->gssapi_context,
+ &keyblock);
+
+ maj_stat = gsskrb5_extract_authz_data_from_sec_context(&min_stat,
+ gensec_gssapi_state->gssapi_context,
+ KRB5_AUTHDATA_IF_RELEVANT,
+ &pac);
+
+ if (maj_stat == 0) {
+ DATA_BLOB pac_blob = data_blob_talloc(mem_ctx, pac.value, pac.length);
+ pac_blob = unwrap_pac(mem_ctx, &pac_blob);
+ gss_release_buffer(&min_stat, &pac);
+
+ /* decode and verify the pac */
+ nt_status = kerberos_decode_pac(mem_ctx, &logon_info, pac_blob,
+ gensec_gssapi_state->smb_krb5_context,
+ NULL, keyblock);
+
+ if (NT_STATUS_IS_OK(nt_status)) {
+ union netr_Validation validation;
+ validation.sam3 = &logon_info->info3;
+ nt_status = make_server_info_netlogon_validation(gensec_gssapi_state,
+ account_name,
+ 3, &validation,
+ &server_info);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(mem_ctx);
+ return nt_status;
+ }
+ } else {
+ maj_stat = 1;
+ }
+ }
+
+ if (maj_stat) {
+ /* IF we have the PAC - otherwise we need to get this
+ * data from elsewere - local ldb, or (TODO) lookup of some
+ * kind...
+ *
+ * when heimdal can generate the PAC, we should fail if there's
+ * no PAC present
+ */
- /* IF we have the PAC - otherwise we need to get this
- * data from elsewere - local ldb, or (TODO) lookup of some
- * kind...
- *
- * when heimdal can generate the PAC, we should fail if there's
- * no PAC present
- */
-
- {
DATA_BLOB user_sess_key = data_blob(NULL, 0);
DATA_BLOB lm_sess_key = data_blob(NULL, 0);
/* TODO: should we pass the krb5 session key in here? */
- nt_status = sam_get_server_info(gensec_gssapi_state, account_name, realm,
+ nt_status = sam_get_server_info(mem_ctx, account_name, realm,
user_sess_key, lm_sess_key,
&server_info);
- talloc_free(principal);
- NT_STATUS_NOT_OK_RETURN(nt_status);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(mem_ctx);
+ return nt_status;
+ }
}
/* references the server_info into the session_info */
return NT_STATUS_OK;
}
-/* As a server, this could in theory accept any GSSAPI mech */
-static const struct gensec_security_ops gensec_gssapi_krb5_security_ops = {
- .name = "gssapi_krb5",
- .sasl_name = "GSSAPI",
- .oid = GENSEC_OID_KERBEROS5,
- .client_start = gensec_gssapi_client_start,
- .server_start = gensec_gssapi_server_start,
- .update = gensec_gssapi_update,
- .session_key = gensec_gssapi_session_key,
- .session_info = gensec_gssapi_session_info,
- .sig_size = gensec_gssapi_sig_size,
- .sign_packet = gensec_gssapi_sign_packet,
- .check_packet = gensec_gssapi_check_packet,
- .seal_packet = gensec_gssapi_seal_packet,
- .unseal_packet = gensec_gssapi_unseal_packet,
- .wrap = gensec_gssapi_wrap,
- .unwrap = gensec_gssapi_unwrap,
- .have_feature = gensec_gssapi_have_feature,
- .enabled = False
-
+static const char *gensec_krb5_oids[] = {
+ GENSEC_OID_KERBEROS5,
+ GENSEC_OID_KERBEROS5_OLD,
+ NULL
};
/* As a server, this could in theory accept any GSSAPI mech */
-static const struct gensec_security_ops gensec_gssapi_ms_krb5_security_ops = {
- .name = "gssapi_ms_krb5",
- .oid = GENSEC_OID_KERBEROS5_OLD,
+static const struct gensec_security_ops gensec_gssapi_krb5_security_ops = {
+ .name = "gssapi_krb5",
+ .oid = gensec_krb5_oids,
.client_start = gensec_gssapi_client_start,
.server_start = gensec_gssapi_server_start,
+ .magic = gensec_gssapi_magic,
.update = gensec_gssapi_update,
.session_key = gensec_gssapi_session_key,
.session_info = gensec_gssapi_session_info,
.unwrap = gensec_gssapi_unwrap,
.have_feature = gensec_gssapi_have_feature,
.enabled = False
-
-};
-
-static const struct gensec_security_ops gensec_gssapi_spnego_security_ops = {
- .name = "gssapi_spnego",
- .sasl_name = "GSS-SPNEGO",
- .oid = GENSEC_OID_SPNEGO,
- .client_start = gensec_gssapi_client_start,
- .server_start = gensec_gssapi_server_start,
- .update = gensec_gssapi_update,
- .session_key = gensec_gssapi_session_key,
- .sig_size = gensec_gssapi_sig_size,
- .sign_packet = gensec_gssapi_sign_packet,
- .check_packet = gensec_gssapi_check_packet,
- .seal_packet = gensec_gssapi_seal_packet,
- .unseal_packet = gensec_gssapi_unseal_packet,
- .wrap = gensec_gssapi_wrap,
- .unwrap = gensec_gssapi_unwrap,
- .have_feature = gensec_gssapi_have_feature,
- .enabled = False
};
NTSTATUS gensec_gssapi_init(void)
return ret;
}
-
- ret = gensec_register(&gensec_gssapi_ms_krb5_security_ops);
- if (!NT_STATUS_IS_OK(ret)) {
- DEBUG(0,("Failed to register '%s' gensec backend!\n",
- gensec_gssapi_ms_krb5_security_ops.name));
- return ret;
- }
-
- ret = gensec_register(&gensec_gssapi_spnego_security_ops);
- if (!NT_STATUS_IS_OK(ret)) {
- DEBUG(0,("Failed to register '%s' gensec backend!\n",
- gensec_gssapi_spnego_security_ops.name));
- return ret;
- }
-
return ret;
}
git.samba.org / ab / samba.git / .git / blobdiff