auth/gensec/gensec_start.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Generic Authentication Interface
   5
   6    Copyright (C) Andrew Tridgell 2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/network.h"
  25 #include "tevent.h"
  26 #include "../lib/util/tevent_ntstatus.h"
  27 #include "librpc/rpc/dcerpc.h"
  28 #include "auth/credentials/credentials.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "lib/param/param.h"
  31 #include "lib/util/tsort.h"
  32 #include "lib/util/samba_modules.h"
  33
  34 /* the list of currently registered GENSEC backends */
  35 static struct gensec_security_ops **generic_security_ops;
  36 static int gensec_num_backends;
  37
  38 /* Return all the registered mechs.  Don't modify the return pointer,
  39  * but you may talloc_reference it if convient */
  40 _PUBLIC_ struct gensec_security_ops **gensec_security_all(void)
  41 {
  42         return generic_security_ops;
  43 }
  44
  45 bool gensec_security_ops_enabled(struct gensec_security_ops *ops, struct gensec_security *security)
  46 {
  47         return lpcfg_parm_bool(security->settings->lp_ctx, NULL, "gensec", ops->name, ops->enabled);
  48 }
  49
  50 /* Sometimes we want to force only kerberos, sometimes we want to
  51  * force it's avoidance.  The old list could be either
  52  * gensec_security_all(), or from cli_credentials_gensec_list() (ie,
  53  * an existing list we have trimmed down) */
  54
  55 _PUBLIC_ struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx,
  56                                                        struct gensec_security_ops **old_gensec_list,
  57                                                        struct cli_credentials *creds)
  58 {
  59         struct gensec_security_ops **new_gensec_list;
  60         int i, j, num_mechs_in;
  61         enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS;
  62
  63         if (creds) {
  64                 use_kerberos = cli_credentials_get_kerberos_state(creds);
  65         }
  66
  67         if (use_kerberos == CRED_AUTO_USE_KERBEROS) {
  68                 if (!talloc_reference(mem_ctx, old_gensec_list)) {
  69                         return NULL;
  70                 }
  71                 return old_gensec_list;
  72         }
  73
  74         for (num_mechs_in=0; old_gensec_list && old_gensec_list[num_mechs_in]; num_mechs_in++) {
  75                 /* noop */
  76         }
  77
  78         new_gensec_list = talloc_array(mem_ctx, struct gensec_security_ops *, num_mechs_in + 1);
  79         if (!new_gensec_list) {
  80                 return NULL;
  81         }
  82
  83         j = 0;
  84         for (i=0; old_gensec_list && old_gensec_list[i]; i++) {
  85                 int oid_idx;
  86
  87                 for (oid_idx = 0; old_gensec_list[i]->oid && old_gensec_list[i]->oid[oid_idx]; oid_idx++) {
  88                         if (strcmp(old_gensec_list[i]->oid[oid_idx], GENSEC_OID_SPNEGO) == 0) {
  89                                 new_gensec_list[j] = old_gensec_list[i];
  90                                 j++;
  91                                 break;
  92                         }
  93                 }
  94                 switch (use_kerberos) {
  95                 case CRED_DONT_USE_KERBEROS:
  96                         if (old_gensec_list[i]->kerberos == false) {
  97                                 new_gensec_list[j] = old_gensec_list[i];
  98                                 j++;
  99                         }
 100                         break;
 101                 case CRED_MUST_USE_KERBEROS:
 102                         if (old_gensec_list[i]->kerberos == true) {
 103                                 new_gensec_list[j] = old_gensec_list[i];
 104                                 j++;
 105                         }
 106                         break;
 107                 default:
 108                         /* Can't happen or invalid parameter */
 109                         return NULL;
 110                 }
 111         }
 112         new_gensec_list[j] = NULL;
 113
 114         return new_gensec_list;
 115 }
 116
 117 struct gensec_security_ops **gensec_security_mechs(struct gensec_security *gensec_security,
 118                                                    TALLOC_CTX *mem_ctx)
 119 {
 120         struct gensec_security_ops **backends;
 121         backends = gensec_security_all();
 122         if (!gensec_security) {
 123                 if (!talloc_reference(mem_ctx, backends)) {
 124                         return NULL;
 125                 }
 126                 return backends;
 127         } else {
 128                 struct cli_credentials *creds = gensec_get_credentials(gensec_security);
 129                 if (!creds) {
 130                         if (!talloc_reference(mem_ctx, backends)) {
 131                                 return NULL;
 132                         }
 133                         return backends;
 134                 }
 135                 return gensec_use_kerberos_mechs(mem_ctx, backends, creds);
 136         }
 137 }
 138
 139 static const struct gensec_security_ops *gensec_security_by_authtype(struct gensec_security *gensec_security,
 140                                                                      uint8_t auth_type)
 141 {
 142         int i;
 143         struct gensec_security_ops **backends;
 144         const struct gensec_security_ops *backend;
 145         TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
 146         if (!mem_ctx) {
 147                 return NULL;
 148         }
 149         backends = gensec_security_mechs(gensec_security, mem_ctx);
 150         for (i=0; backends && backends[i]; i++) {
 151                 if (!gensec_security_ops_enabled(backends[i], gensec_security))
 152                                 continue;
 153                 if (backends[i]->auth_type == auth_type) {
 154                         backend = backends[i];
 155                         talloc_free(mem_ctx);
 156                         return backend;
 157                 }
 158         }
 159         talloc_free(mem_ctx);
 160
 161         return NULL;
 162 }
 163
 164 const struct gensec_security_ops *gensec_security_by_oid(struct gensec_security *gensec_security,
 165                                                          const char *oid_string)
 166 {
 167         int i, j;
 168         struct gensec_security_ops **backends;
 169         const struct gensec_security_ops *backend;
 170         TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
 171         if (!mem_ctx) {
 172                 return NULL;
 173         }
 174         backends = gensec_security_mechs(gensec_security, mem_ctx);
 175         for (i=0; backends && backends[i]; i++) {
 176                 if (gensec_security != NULL &&
 177                                 !gensec_security_ops_enabled(backends[i],
 178                                                                                          gensec_security))
 179                     continue;
 180                 if (backends[i]->oid) {
 181                         for (j=0; backends[i]->oid[j]; j++) {
 182                                 if (backends[i]->oid[j] &&
 183                                     (strcmp(backends[i]->oid[j], oid_string) == 0)) {
 184                                         backend = backends[i];
 185                                         talloc_free(mem_ctx);
 186                                         return backend;
 187                                 }
 188                         }
 189                 }
 190         }
 191         talloc_free(mem_ctx);
 192
 193         return NULL;
 194 }
 195
 196 const struct gensec_security_ops *gensec_security_by_sasl_name(struct gensec_security *gensec_security,
 197                                                                const char *sasl_name)
 198 {
 199         int i;
 200         struct gensec_security_ops **backends;
 201         const struct gensec_security_ops *backend;
 202         TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
 203         if (!mem_ctx) {
 204                 return NULL;
 205         }
 206         backends = gensec_security_mechs(gensec_security, mem_ctx);
 207         for (i=0; backends && backends[i]; i++) {
 208                 if (!gensec_security_ops_enabled(backends[i], gensec_security))
 209                     continue;
 210                 if (backends[i]->sasl_name
 211                     && (strcmp(backends[i]->sasl_name, sasl_name) == 0)) {
 212                         backend = backends[i];
 213                         talloc_free(mem_ctx);
 214                         return backend;
 215                 }
 216         }
 217         talloc_free(mem_ctx);
 218
 219         return NULL;
 220 }
 221
 222 static const struct gensec_security_ops *gensec_security_by_name(struct gensec_security *gensec_security,
 223                                                                  const char *name)
 224 {
 225         int i;
 226         struct gensec_security_ops **backends;
 227         const struct gensec_security_ops *backend;
 228         TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
 229         if (!mem_ctx) {
 230                 return NULL;
 231         }
 232         backends = gensec_security_mechs(gensec_security, mem_ctx);
 233         for (i=0; backends && backends[i]; i++) {
 234                 if (gensec_security != NULL &&
 235                                 !gensec_security_ops_enabled(backends[i], gensec_security))
 236                     continue;
 237                 if (backends[i]->name
 238                     && (strcmp(backends[i]->name, name) == 0)) {
 239                         backend = backends[i];
 240                         talloc_free(mem_ctx);
 241                         return backend;
 242                 }
 243         }
 244         talloc_free(mem_ctx);
 245         return NULL;
 246 }
 247
 248 /**
 249  * Return a unique list of security subsystems from those specified in
 250  * the list of SASL names.
 251  *
 252  * Use the list of enabled GENSEC mechanisms from the credentials
 253  * attached to the gensec_security, and return in our preferred order.
 254  */
 255
 256 const struct gensec_security_ops **gensec_security_by_sasl_list(struct gensec_security *gensec_security,
 257                                                                 TALLOC_CTX *mem_ctx,
 258                                                                 const char **sasl_names)
 259 {
 260         const struct gensec_security_ops **backends_out;
 261         struct gensec_security_ops **backends;
 262         int i, k, sasl_idx;
 263         int num_backends_out = 0;
 264
 265         if (!sasl_names) {
 266                 return NULL;
 267         }
 268
 269         backends = gensec_security_mechs(gensec_security, mem_ctx);
 270
 271         backends_out = talloc_array(mem_ctx, const struct gensec_security_ops *, 1);
 272         if (!backends_out) {
 273                 return NULL;
 274         }
 275         backends_out[0] = NULL;
 276
 277         /* Find backends in our preferred order, by walking our list,
 278          * then looking in the supplied list */
 279         for (i=0; backends && backends[i]; i++) {
 280                 if (gensec_security != NULL &&
 281                                 !gensec_security_ops_enabled(backends[i], gensec_security))
 282                     continue;
 283                 for (sasl_idx = 0; sasl_names[sasl_idx]; sasl_idx++) {
 284                         if (!backends[i]->sasl_name ||
 285                             !(strcmp(backends[i]->sasl_name,
 286                                      sasl_names[sasl_idx]) == 0)) {
 287                                 continue;
 288                         }
 289
 290                         for (k=0; backends_out[k]; k++) {
 291                                 if (backends_out[k] == backends[i]) {
 292                                         break;
 293                                 }
 294                         }
 295
 296                         if (k < num_backends_out) {
 297                                 /* already in there */
 298                                 continue;
 299                         }
 300
 301                         backends_out = talloc_realloc(mem_ctx, backends_out,
 302                                                       const struct gensec_security_ops *,
 303                                                       num_backends_out + 2);
 304                         if (!backends_out) {
 305                                 return NULL;
 306                         }
 307
 308                         backends_out[num_backends_out] = backends[i];
 309                         num_backends_out++;
 310                         backends_out[num_backends_out] = NULL;
 311                 }
 312         }
 313         return backends_out;
 314 }
 315
 316 /**
 317  * Return a unique list of security subsystems from those specified in
 318  * the OID list.  That is, where two OIDs refer to the same module,
 319  * return that module only once.
 320  *
 321  * Use the list of enabled GENSEC mechanisms from the credentials
 322  * attached to the gensec_security, and return in our preferred order.
 323  */
 324
 325 const struct gensec_security_ops_wrapper *gensec_security_by_oid_list(struct gensec_security *gensec_security,
 326                                                                       TALLOC_CTX *mem_ctx,
 327                                                                       const char **oid_strings,
 328                                                                       const char *skip)
 329 {
 330         struct gensec_security_ops_wrapper *backends_out;
 331         struct gensec_security_ops **backends;
 332         int i, j, k, oid_idx;
 333         int num_backends_out = 0;
 334
 335         if (!oid_strings) {
 336                 return NULL;
 337         }
 338
 339         backends = gensec_security_mechs(gensec_security, gensec_security);
 340
 341         backends_out = talloc_array(mem_ctx, struct gensec_security_ops_wrapper, 1);
 342         if (!backends_out) {
 343                 return NULL;
 344         }
 345         backends_out[0].op = NULL;
 346         backends_out[0].oid = NULL;
 347
 348         /* Find backends in our preferred order, by walking our list,
 349          * then looking in the supplied list */
 350         for (i=0; backends && backends[i]; i++) {
 351                 if (gensec_security != NULL &&
 352                                 !gensec_security_ops_enabled(backends[i], gensec_security))
 353                     continue;
 354                 if (!backends[i]->oid) {
 355                         continue;
 356                 }
 357                 for (oid_idx = 0; oid_strings[oid_idx]; oid_idx++) {
 358                         if (strcmp(oid_strings[oid_idx], skip) == 0) {
 359                                 continue;
 360                         }
 361
 362                         for (j=0; backends[i]->oid[j]; j++) {
 363                                 if (!backends[i]->oid[j] ||
 364                                     !(strcmp(backends[i]->oid[j],
 365                                             oid_strings[oid_idx]) == 0)) {
 366                                         continue;
 367                                 }
 368
 369                                 for (k=0; backends_out[k].op; k++) {
 370                                         if (backends_out[k].op == backends[i]) {
 371                                                 break;
 372                                         }
 373                                 }
 374
 375                                 if (k < num_backends_out) {
 376                                         /* already in there */
 377                                         continue;
 378                                 }
 379
 380                                 backends_out = talloc_realloc(mem_ctx, backends_out,
 381                                                               struct gensec_security_ops_wrapper,
 382                                                               num_backends_out + 2);
 383                                 if (!backends_out) {
 384                                         return NULL;
 385                                 }
 386
 387                                 backends_out[num_backends_out].op = backends[i];
 388                                 backends_out[num_backends_out].oid = backends[i]->oid[j];
 389                                 num_backends_out++;
 390                                 backends_out[num_backends_out].op = NULL;
 391                                 backends_out[num_backends_out].oid = NULL;
 392                         }
 393                 }
 394         }
 395         return backends_out;
 396 }
 397
 398 /**
 399  * Return OIDS from the security subsystems listed
 400  */
 401
 402 const char **gensec_security_oids_from_ops(struct gensec_security *gensec_security,
 403                                                                                    TALLOC_CTX *mem_ctx,
 404                                            struct gensec_security_ops **ops,
 405                                            const char *skip)
 406 {
 407         int i;
 408         int j = 0;
 409         int k;
 410         const char **oid_list;
 411         if (!ops) {
 412                 return NULL;
 413         }
 414         oid_list = talloc_array(mem_ctx, const char *, 1);
 415         if (!oid_list) {
 416                 return NULL;
 417         }
 418
 419         for (i=0; ops && ops[i]; i++) {
 420                 if (gensec_security != NULL &&
 421                         !gensec_security_ops_enabled(ops[i], gensec_security)) {
 422                         continue;
 423                 }
 424                 if (!ops[i]->oid) {
 425                         continue;
 426                 }
 427
 428                 for (k = 0; ops[i]->oid[k]; k++) {
 429                         if (skip && strcmp(skip, ops[i]->oid[k])==0) {
 430                         } else {
 431                                 oid_list = talloc_realloc(mem_ctx, oid_list, const char *, j + 2);
 432                                 if (!oid_list) {
 433                                         return NULL;
 434                                 }
 435                                 oid_list[j] = ops[i]->oid[k];
 436                                 j++;
 437                         }
 438                 }
 439         }
 440         oid_list[j] = NULL;
 441         return oid_list;
 442 }
 443
 444
 445 /**
 446  * Return OIDS from the security subsystems listed
 447  */
 448
 449 const char **gensec_security_oids_from_ops_wrapped(TALLOC_CTX *mem_ctx,
 450                                                    const struct gensec_security_ops_wrapper *wops)
 451 {
 452         int i;
 453         int j = 0;
 454         int k;
 455         const char **oid_list;
 456         if (!wops) {
 457                 return NULL;
 458         }
 459         oid_list = talloc_array(mem_ctx, const char *, 1);
 460         if (!oid_list) {
 461                 return NULL;
 462         }
 463
 464         for (i=0; wops[i].op; i++) {
 465                 if (!wops[i].op->oid) {
 466                         continue;
 467                 }
 468
 469                 for (k = 0; wops[i].op->oid[k]; k++) {
 470                         oid_list = talloc_realloc(mem_ctx, oid_list, const char *, j + 2);
 471                         if (!oid_list) {
 472                                 return NULL;
 473                         }
 474                         oid_list[j] = wops[i].op->oid[k];
 475                         j++;
 476                 }
 477         }
 478         oid_list[j] = NULL;
 479         return oid_list;
 480 }
 481
 482
 483 /**
 484  * Return all the security subsystems currently enabled on a GENSEC context.
 485  *
 486  * This is taken from a list attached to the cli_credentials, and
 487  * skips the OID in 'skip'.  (Typically the SPNEGO OID)
 488  *
 489  */
 490
 491 const char **gensec_security_oids(struct gensec_security *gensec_security,
 492                                   TALLOC_CTX *mem_ctx,
 493                                   const char *skip)
 494 {
 495         struct gensec_security_ops **ops
 496                 = gensec_security_mechs(gensec_security, mem_ctx);
 497         return gensec_security_oids_from_ops(gensec_security, mem_ctx, ops, skip);
 498 }
 499
 500 /**
 501   Start the GENSEC system, returning a context pointer.
 502   @param mem_ctx The parent TALLOC memory context.
 503   @param gensec_security Returned GENSEC context pointer.
 504   @note  The mem_ctx is only a parent and may be NULL.
 505   @note, the auth context is moved to be a referenced pointer of the
 506   @ gensec_security return
 507 */
 508 static NTSTATUS gensec_start(TALLOC_CTX *mem_ctx,
 509                              struct tevent_context *ev,
 510                              struct gensec_settings *settings,
 511                              struct auth4_context *auth_context,
 512                              struct gensec_security **gensec_security)
 513 {
 514         (*gensec_security) = talloc_zero(mem_ctx, struct gensec_security);
 515         NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
 516
 517         (*gensec_security)->event_ctx = ev;
 518         SMB_ASSERT(settings->lp_ctx != NULL);
 519         (*gensec_security)->settings = talloc_reference(*gensec_security, settings);
 520
 521         /* We need to reference this, not steal, as the caller may be
 522          * python, which won't like it if we steal it's object away
 523          * from it */
 524         (*gensec_security)->auth_context = talloc_reference(*gensec_security, auth_context);
 525
 526         return NT_STATUS_OK;
 527 }
 528
 529 /**
 530  * Start a GENSEC subcontext, with a copy of the properties of the parent
 531  * @param mem_ctx The parent TALLOC memory context.
 532  * @param parent The parent GENSEC context
 533  * @param gensec_security Returned GENSEC context pointer.
 534  * @note Used by SPNEGO in particular, for the actual implementation mechanism
 535  */
 536
 537 _PUBLIC_ NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx,
 538                                  struct gensec_security *parent,
 539                                  struct gensec_security **gensec_security)
 540 {
 541         (*gensec_security) = talloc_zero(mem_ctx, struct gensec_security);
 542         NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
 543
 544         (**gensec_security) = *parent;
 545         (*gensec_security)->ops = NULL;
 546         (*gensec_security)->private_data = NULL;
 547
 548         (*gensec_security)->subcontext = true;
 549         (*gensec_security)->want_features = parent->want_features;
 550         (*gensec_security)->dcerpc_auth_level = parent->dcerpc_auth_level;
 551         (*gensec_security)->event_ctx = parent->event_ctx;
 552         (*gensec_security)->auth_context = talloc_reference(*gensec_security, parent->auth_context);
 553         (*gensec_security)->settings = talloc_reference(*gensec_security, parent->settings);
 554         (*gensec_security)->auth_context = talloc_reference(*gensec_security, parent->auth_context);
 555
 556         return NT_STATUS_OK;
 557 }
 558
 559 /**
 560   Start the GENSEC system, in client mode, returning a context pointer.
 561   @param mem_ctx The parent TALLOC memory context.
 562   @param gensec_security Returned GENSEC context pointer.
 563   @note  The mem_ctx is only a parent and may be NULL.
 564 */
 565 _PUBLIC_ NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx,
 566                              struct gensec_security **gensec_security,
 567                              struct tevent_context *ev,
 568                              struct gensec_settings *settings)
 569 {
 570         NTSTATUS status;
 571
 572         if (settings == NULL) {
 573                 DEBUG(0,("gensec_client_start: no settings given!\n"));
 574                 return NT_STATUS_INTERNAL_ERROR;
 575         }
 576
 577         status = gensec_start(mem_ctx, ev, settings, NULL, gensec_security);
 578         if (!NT_STATUS_IS_OK(status)) {
 579                 return status;
 580         }
 581         (*gensec_security)->gensec_role = GENSEC_CLIENT;
 582
 583         return status;
 584 }
 585
 586
 587
 588 /**
 589   Start the GENSEC system, in server mode, returning a context pointer.
 590   @param mem_ctx The parent TALLOC memory context.
 591   @param gensec_security Returned GENSEC context pointer.
 592   @note  The mem_ctx is only a parent and may be NULL.
 593 */
 594 _PUBLIC_ NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx,
 595                                       struct tevent_context *ev,
 596                                       struct gensec_settings *settings,
 597                                       struct auth4_context *auth_context,
 598                                       struct gensec_security **gensec_security)
 599 {
 600         NTSTATUS status;
 601
 602         if (!settings) {
 603                 DEBUG(0,("gensec_server_start: no settings given!\n"));
 604                 return NT_STATUS_INTERNAL_ERROR;
 605         }
 606
 607         status = gensec_start(mem_ctx, ev, settings, auth_context, gensec_security);
 608         if (!NT_STATUS_IS_OK(status)) {
 609                 return status;
 610         }
 611         (*gensec_security)->gensec_role = GENSEC_SERVER;
 612
 613         return status;
 614 }
 615
 616 NTSTATUS gensec_start_mech(struct gensec_security *gensec_security)
 617 {
 618         NTSTATUS status;
 619         DEBUG(5, ("Starting GENSEC %smechanism %s\n",
 620                   gensec_security->subcontext ? "sub" : "",
 621                   gensec_security->ops->name));
 622         switch (gensec_security->gensec_role) {
 623         case GENSEC_CLIENT:
 624                 if (gensec_security->ops->client_start) {
 625                         status = gensec_security->ops->client_start(gensec_security);
 626                         if (!NT_STATUS_IS_OK(status)) {
 627                                 DEBUG(gensec_security->subcontext?4:2, ("Failed to start GENSEC client mech %s: %s\n",
 628                                           gensec_security->ops->name, nt_errstr(status)));
 629                         }
 630                         return status;
 631                 }
 632                 break;
 633         case GENSEC_SERVER:
 634                 if (gensec_security->ops->server_start) {
 635                         status = gensec_security->ops->server_start(gensec_security);
 636                         if (!NT_STATUS_IS_OK(status)) {
 637                                 DEBUG(1, ("Failed to start GENSEC server mech %s: %s\n",
 638                                           gensec_security->ops->name, nt_errstr(status)));
 639                         }
 640                         return status;
 641                 }
 642                 break;
 643         }
 644         return NT_STATUS_INVALID_PARAMETER;
 645 }
 646
 647 /**
 648  * Start a GENSEC sub-mechanism with a specified mechansim structure, used in SPNEGO
 649  *
 650  */
 651
 652 NTSTATUS gensec_start_mech_by_ops(struct gensec_security *gensec_security,
 653                                   const struct gensec_security_ops *ops)
 654 {
 655         gensec_security->ops = ops;
 656         return gensec_start_mech(gensec_security);
 657 }
 658
 659
 660 /**
 661  * Start a GENSEC sub-mechanism by DCERPC allocated 'auth type' number
 662  * @param gensec_security GENSEC context pointer.
 663  * @param auth_type DCERPC auth type
 664  * @param auth_level DCERPC auth level
 665  */
 666
 667 _PUBLIC_ NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
 668                                        uint8_t auth_type, uint8_t auth_level)
 669 {
 670         gensec_security->ops = gensec_security_by_authtype(gensec_security, auth_type);
 671         if (!gensec_security->ops) {
 672                 DEBUG(3, ("Could not find GENSEC backend for auth_type=%d\n", (int)auth_type));
 673                 return NT_STATUS_INVALID_PARAMETER;
 674         }
 675         gensec_security->dcerpc_auth_level = auth_level;
 676         gensec_want_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE);
 677         gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
 678         if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 679                 gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
 680         } else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 681                 gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
 682                 gensec_want_feature(gensec_security, GENSEC_FEATURE_SEAL);
 683         } else if (auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
 684                 /* Default features */
 685         } else {
 686                 DEBUG(2,("auth_level %d not supported in DCE/RPC authentication\n",
 687                          auth_level));
 688                 return NT_STATUS_INVALID_PARAMETER;
 689         }
 690
 691         return gensec_start_mech(gensec_security);
 692 }
 693
 694 _PUBLIC_ const char *gensec_get_name_by_authtype(struct gensec_security *gensec_security, uint8_t authtype)
 695 {
 696         const struct gensec_security_ops *ops;
 697         ops = gensec_security_by_authtype(gensec_security, authtype);
 698         if (ops) {
 699                 return ops->name;
 700         }
 701         return NULL;
 702 }
 703
 704
 705 _PUBLIC_ const char *gensec_get_name_by_oid(struct gensec_security *gensec_security,
 706                                                                                         const char *oid_string)
 707 {
 708         const struct gensec_security_ops *ops;
 709         ops = gensec_security_by_oid(gensec_security, oid_string);
 710         if (ops) {
 711                 return ops->name;
 712         }
 713         return oid_string;
 714 }
 715
 716 /**
 717  * Start a GENSEC sub-mechanism by OID, used in SPNEGO
 718  *
 719  * @note This should also be used when you wish to just start NLTMSSP (for example), as it uses a
 720  *       well-known #define to hook it in.
 721  */
 722
 723 _PUBLIC_ NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security,
 724                                   const char *mech_oid)
 725 {
 726         SMB_ASSERT(gensec_security != NULL);
 727
 728         gensec_security->ops = gensec_security_by_oid(gensec_security, mech_oid);
 729         if (!gensec_security->ops) {
 730                 DEBUG(3, ("Could not find GENSEC backend for oid=%s\n", mech_oid));
 731                 return NT_STATUS_INVALID_PARAMETER;
 732         }
 733         return gensec_start_mech(gensec_security);
 734 }
 735
 736 /**
 737  * Start a GENSEC sub-mechanism by a well know SASL name
 738  *
 739  */
 740
 741 _PUBLIC_ NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
 742                                         const char *sasl_name)
 743 {
 744         gensec_security->ops = gensec_security_by_sasl_name(gensec_security, sasl_name);
 745         if (!gensec_security->ops) {
 746                 DEBUG(3, ("Could not find GENSEC backend for sasl_name=%s\n", sasl_name));
 747                 return NT_STATUS_INVALID_PARAMETER;
 748         }
 749         return gensec_start_mech(gensec_security);
 750 }
 751
 752 /**
 753  * Start a GENSEC sub-mechanism with the preferred option from a SASL name list
 754  *
 755  */
 756
 757 _PUBLIC_ NTSTATUS gensec_start_mech_by_sasl_list(struct gensec_security *gensec_security,
 758                                                  const char **sasl_names)
 759 {
 760         NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
 761         TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
 762         const struct gensec_security_ops **ops;
 763         int i;
 764         if (!mem_ctx) {
 765                 return NT_STATUS_NO_MEMORY;
 766         }
 767         ops = gensec_security_by_sasl_list(gensec_security, mem_ctx, sasl_names);
 768         if (!ops || !*ops) {
 769                 DEBUG(3, ("Could not find GENSEC backend for any of sasl_name = %s\n",
 770                           str_list_join(mem_ctx,
 771                                         sasl_names, ' ')));
 772                 talloc_free(mem_ctx);
 773                 return NT_STATUS_INVALID_PARAMETER;
 774         }
 775         for (i=0; ops[i]; i++) {
 776                 nt_status = gensec_start_mech_by_ops(gensec_security, ops[i]);
 777                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
 778                         break;
 779                 }
 780         }
 781         talloc_free(mem_ctx);
 782         return nt_status;
 783 }
 784
 785 /**
 786  * Start a GENSEC sub-mechanism by an internal name
 787  *
 788  */
 789
 790 _PUBLIC_ NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
 791                                         const char *name)
 792 {
 793         gensec_security->ops = gensec_security_by_name(gensec_security, name);
 794         if (!gensec_security->ops) {
 795                 DEBUG(3, ("Could not find GENSEC backend for name=%s\n", name));
 796                 return NT_STATUS_INVALID_PARAMETER;
 797         }
 798         return gensec_start_mech(gensec_security);
 799 }
 800
 801 /**
 802  * Associate a credentials structure with a GENSEC context - talloc_reference()s it to the context
 803  *
 804  */
 805
 806 _PUBLIC_ NTSTATUS gensec_set_credentials(struct gensec_security *gensec_security, struct cli_credentials *credentials)
 807 {
 808         gensec_security->credentials = talloc_reference(gensec_security, credentials);
 809         NT_STATUS_HAVE_NO_MEMORY(gensec_security->credentials);
 810         gensec_want_feature(gensec_security, cli_credentials_get_gensec_features(gensec_security->credentials));
 811         return NT_STATUS_OK;
 812 }
 813
 814 /*
 815   register a GENSEC backend.
 816
 817   The 'name' can be later used by other backends to find the operations
 818   structure for this backend.
 819 */
 820 NTSTATUS gensec_register(const struct gensec_security_ops *ops)
 821 {
 822         if (gensec_security_by_name(NULL, ops->name) != NULL) {
 823                 /* its already registered! */
 824                 DEBUG(0,("GENSEC backend '%s' already registered\n",
 825                          ops->name));
 826                 return NT_STATUS_OBJECT_NAME_COLLISION;
 827         }
 828
 829         generic_security_ops = talloc_realloc(talloc_autofree_context(),
 830                                               generic_security_ops,
 831                                               struct gensec_security_ops *,
 832                                               gensec_num_backends+2);
 833         if (!generic_security_ops) {
 834                 return NT_STATUS_NO_MEMORY;
 835         }
 836
 837         generic_security_ops[gensec_num_backends] = discard_const_p(struct gensec_security_ops, ops);
 838         gensec_num_backends++;
 839         generic_security_ops[gensec_num_backends] = NULL;
 840
 841         DEBUG(3,("GENSEC backend '%s' registered\n",
 842                  ops->name));
 843
 844         return NT_STATUS_OK;
 845 }
 846
 847 /*
 848   return the GENSEC interface version, and the size of some critical types
 849   This can be used by backends to either detect compilation errors, or provide
 850   multiple implementations for different smbd compilation options in one module
 851 */
 852 const struct gensec_critical_sizes *gensec_interface_version(void)
 853 {
 854         static const struct gensec_critical_sizes critical_sizes = {
 855                 GENSEC_INTERFACE_VERSION,
 856                 sizeof(struct gensec_security_ops),
 857                 sizeof(struct gensec_security),
 858         };
 859
 860         return &critical_sizes;
 861 }
 862
 863 static int sort_gensec(struct gensec_security_ops **gs1, struct gensec_security_ops **gs2) {
 864         return (*gs2)->priority - (*gs1)->priority;
 865 }
 866
 867 int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value)
 868 {
 869         return lpcfg_parm_int(settings->lp_ctx, NULL, mechanism, name, default_value);
 870 }
 871
 872 bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value)
 873 {
 874         return lpcfg_parm_bool(settings->lp_ctx, NULL, mechanism, name, default_value);
 875 }
 876
 877 /*
 878   initialise the GENSEC subsystem
 879 */
 880 _PUBLIC_ NTSTATUS gensec_init(void)
 881 {
 882         static bool initialized = false;
 883 #define _MODULE_PROTO(init) extern NTSTATUS init(void);
 884 #if _SAMBA_BUILD_ == 4
 885         STATIC_gensec_MODULES_PROTO;
 886         init_module_fn static_init[] = { STATIC_gensec_MODULES };
 887 #else
 888         init_module_fn *static_init = NULL;
 889 #endif
 890         init_module_fn *shared_init;
 891
 892         if (initialized) return NT_STATUS_OK;
 893         initialized = true;
 894
 895         shared_init = load_samba_modules(NULL, "gensec");
 896
 897         run_init_functions(static_init);
 898         run_init_functions(shared_init);
 899
 900         talloc_free(shared_init);
 901
 902         TYPESAFE_QSORT(generic_security_ops, gensec_num_backends, sort_gensec);
 903
 904         return NT_STATUS_OK;
 905 }