Correct "overriden" typos.
[nivanova/samba-autobuild/.git] / auth / gensec / gensec.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    Generic Authentication Interface
5
6    Copyright (C) Andrew Tridgell 2003
7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
8
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "system/network.h"
25 #define TEVENT_DEPRECATED 1
26 #include <tevent.h>
27 #include "lib/tsocket/tsocket.h"
28 #include "lib/util/tevent_ntstatus.h"
29 #include "auth/gensec/gensec.h"
30 #include "auth/gensec/gensec_internal.h"
31 #include "librpc/gen_ndr/dcerpc.h"
32
33 _PRIVATE_ NTSTATUS gensec_may_reset_crypto(struct gensec_security *gensec_security,
34                                            bool full_reset)
35 {
36         if (!gensec_security->ops->may_reset_crypto) {
37                 return NT_STATUS_OK;
38         }
39
40         return gensec_security->ops->may_reset_crypto(gensec_security, full_reset);
41 }
42
43 /*
44   wrappers for the gensec function pointers
45 */
46 _PUBLIC_ NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
47                               uint8_t *data, size_t length,
48                               const uint8_t *whole_pdu, size_t pdu_length,
49                               const DATA_BLOB *sig)
50 {
51         if (!gensec_security->ops->unseal_packet) {
52                 return NT_STATUS_NOT_IMPLEMENTED;
53         }
54         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
55                 return NT_STATUS_INVALID_PARAMETER;
56         }
57         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
58                 return NT_STATUS_INVALID_PARAMETER;
59         }
60         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE)) {
61                 return NT_STATUS_INVALID_PARAMETER;
62         }
63
64         return gensec_security->ops->unseal_packet(gensec_security,
65                                                    data, length,
66                                                    whole_pdu, pdu_length,
67                                                    sig);
68 }
69
70 _PUBLIC_ NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
71                              const uint8_t *data, size_t length,
72                              const uint8_t *whole_pdu, size_t pdu_length,
73                              const DATA_BLOB *sig)
74 {
75         if (!gensec_security->ops->check_packet) {
76                 return NT_STATUS_NOT_IMPLEMENTED;
77         }
78         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
79                 return NT_STATUS_INVALID_PARAMETER;
80         }
81
82         return gensec_security->ops->check_packet(gensec_security, data, length, whole_pdu, pdu_length, sig);
83 }
84
85 _PUBLIC_ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
86                             TALLOC_CTX *mem_ctx,
87                             uint8_t *data, size_t length,
88                             const uint8_t *whole_pdu, size_t pdu_length,
89                             DATA_BLOB *sig)
90 {
91         if (!gensec_security->ops->seal_packet) {
92                 return NT_STATUS_NOT_IMPLEMENTED;
93         }
94         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
95                 return NT_STATUS_INVALID_PARAMETER;
96         }
97         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
98                 return NT_STATUS_INVALID_PARAMETER;
99         }
100         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE)) {
101                 return NT_STATUS_INVALID_PARAMETER;
102         }
103
104         return gensec_security->ops->seal_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
105 }
106
107 _PUBLIC_ NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security,
108                             TALLOC_CTX *mem_ctx,
109                             const uint8_t *data, size_t length,
110                             const uint8_t *whole_pdu, size_t pdu_length,
111                             DATA_BLOB *sig)
112 {
113         if (!gensec_security->ops->sign_packet) {
114                 return NT_STATUS_NOT_IMPLEMENTED;
115         }
116         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
117                 return NT_STATUS_INVALID_PARAMETER;
118         }
119
120         return gensec_security->ops->sign_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
121 }
122
123 _PUBLIC_ size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size)
124 {
125         if (!gensec_security->ops->sig_size) {
126                 return 0;
127         }
128         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
129                 return 0;
130         }
131         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
132                 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE)) {
133                         return 0;
134                 }
135         }
136
137         return gensec_security->ops->sig_size(gensec_security, data_size);
138 }
139
140 _PUBLIC_ size_t gensec_max_wrapped_size(struct gensec_security *gensec_security)
141 {
142         if (!gensec_security->ops->max_wrapped_size) {
143                 return (1 << 17);
144         }
145
146         return gensec_security->ops->max_wrapped_size(gensec_security);
147 }
148
149 _PUBLIC_ size_t gensec_max_input_size(struct gensec_security *gensec_security)
150 {
151         if (!gensec_security->ops->max_input_size) {
152                 return (1 << 17) - gensec_sig_size(gensec_security, 1 << 17);
153         }
154
155         return gensec_security->ops->max_input_size(gensec_security);
156 }
157
158 _PUBLIC_ NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
159                      TALLOC_CTX *mem_ctx,
160                      const DATA_BLOB *in,
161                      DATA_BLOB *out)
162 {
163         if (!gensec_security->ops->wrap) {
164                 return NT_STATUS_NOT_IMPLEMENTED;
165         }
166         return gensec_security->ops->wrap(gensec_security, mem_ctx, in, out);
167 }
168
169 _PUBLIC_ NTSTATUS gensec_unwrap(struct gensec_security *gensec_security,
170                        TALLOC_CTX *mem_ctx,
171                        const DATA_BLOB *in,
172                        DATA_BLOB *out)
173 {
174         if (!gensec_security->ops->unwrap) {
175                 return NT_STATUS_NOT_IMPLEMENTED;
176         }
177         return gensec_security->ops->unwrap(gensec_security, mem_ctx, in, out);
178 }
179
180 _PUBLIC_ NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
181                                      TALLOC_CTX *mem_ctx,
182                                      DATA_BLOB *session_key)
183 {
184         if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SESSION_KEY)) {
185                 return NT_STATUS_NO_USER_SESSION_KEY;
186         }
187
188         if (!gensec_security->ops->session_key) {
189                 return NT_STATUS_NOT_IMPLEMENTED;
190         }
191
192         return gensec_security->ops->session_key(gensec_security, mem_ctx, session_key);
193 }
194
195 /**
196  * Return the credentials of a logged on user, including session keys
197  * etc.
198  *
199  * Only valid after a successful authentication
200  *
201  * May only be called once per authentication.
202  *
203  */
204
205 _PUBLIC_ NTSTATUS gensec_session_info(struct gensec_security *gensec_security,
206                                       TALLOC_CTX *mem_ctx,
207                                       struct auth_session_info **session_info)
208 {
209         if (!gensec_security->ops->session_info) {
210                 return NT_STATUS_NOT_IMPLEMENTED;
211         }
212         return gensec_security->ops->session_info(gensec_security, mem_ctx, session_info);
213 }
214
215 _PUBLIC_ void gensec_set_max_update_size(struct gensec_security *gensec_security,
216                                 uint32_t max_update_size)
217 {
218         gensec_security->max_update_size = max_update_size;
219 }
220
221 _PUBLIC_ size_t gensec_max_update_size(struct gensec_security *gensec_security)
222 {
223         if (gensec_security->max_update_size == 0) {
224                 return UINT32_MAX;
225         }
226
227         return gensec_security->max_update_size;
228 }
229
230 static NTSTATUS gensec_verify_features(struct gensec_security *gensec_security)
231 {
232         /*
233          * gensec_want_feature(GENSEC_FEATURE_SIGN)
234          * and
235          * gensec_want_feature(GENSEC_FEATURE_SEAL)
236          * require these flags to be available.
237          */
238         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
239                 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
240                         DEBUG(0,("Did not manage to negotiate mandatory feature "
241                                  "SIGN\n"));
242                         return NT_STATUS_ACCESS_DENIED;
243                 }
244         }
245         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
246                 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
247                         DEBUG(0,("Did not manage to negotiate mandatory feature "
248                                  "SEAL\n"));
249                         return NT_STATUS_ACCESS_DENIED;
250                 }
251                 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
252                         DEBUG(0,("Did not manage to negotiate mandatory feature "
253                                  "SIGN for SEAL\n"));
254                         return NT_STATUS_ACCESS_DENIED;
255                 }
256         }
257
258         return NT_STATUS_OK;
259 }
260
261 _PUBLIC_ NTSTATUS gensec_update_ev(struct gensec_security *gensec_security,
262                                    TALLOC_CTX *out_mem_ctx,
263                                    struct tevent_context *ev,
264                                    const DATA_BLOB in, DATA_BLOB *out)
265 {
266         NTSTATUS status;
267         const struct gensec_security_ops *ops = gensec_security->ops;
268         TALLOC_CTX *frame = NULL;
269         struct tevent_req *subreq = NULL;
270         bool ok;
271
272         if (ops->update_send == NULL) {
273
274                 if (ev == NULL) {
275                         frame = talloc_stackframe();
276
277                         ev = samba_tevent_context_init(frame);
278                         if (ev == NULL) {
279                                 status = NT_STATUS_NO_MEMORY;
280                                 goto fail;
281                         }
282
283                         /*
284                          * TODO: remove this hack once the backends
285                          * are fixed.
286                          */
287                         tevent_loop_allow_nesting(ev);
288                 }
289
290                 status = ops->update(gensec_security, out_mem_ctx,
291                                      ev, in, out);
292                 TALLOC_FREE(frame);
293                 if (!NT_STATUS_IS_OK(status)) {
294                         return status;
295                 }
296
297                 /*
298                  * Because callers using the
299                  * gensec_start_mech_by_auth_type() never call
300                  * gensec_want_feature(), it isn't sensible for them
301                  * to have to call gensec_have_feature() manually, and
302                  * these are not points of negotiation, but are
303                  * asserted by the client
304                  */
305                 status = gensec_verify_features(gensec_security);
306                 if (!NT_STATUS_IS_OK(status)) {
307                         return status;
308                 }
309
310                 return NT_STATUS_OK;
311         }
312
313         frame = talloc_stackframe();
314
315         if (ev == NULL) {
316                 ev = samba_tevent_context_init(frame);
317                 if (ev == NULL) {
318                         status = NT_STATUS_NO_MEMORY;
319                         goto fail;
320                 }
321
322                 /*
323                  * TODO: remove this hack once the backends
324                  * are fixed.
325                  */
326                 tevent_loop_allow_nesting(ev);
327         }
328
329         subreq = ops->update_send(frame, ev, gensec_security, in);
330         if (subreq == NULL) {
331                 status = NT_STATUS_NO_MEMORY;
332                 goto fail;
333         }
334         ok = tevent_req_poll_ntstatus(subreq, ev, &status);
335         if (!ok) {
336                 goto fail;
337         }
338         status = ops->update_recv(subreq, out_mem_ctx, out);
339  fail:
340         TALLOC_FREE(frame);
341         return status;
342 }
343
344 /**
345  * Next state function for the GENSEC state machine
346  *
347  * @param gensec_security GENSEC State
348  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
349  * @param in The request, as a DATA_BLOB
350  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
351  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
352  *                or NT_STATUS_OK if the user is authenticated.
353  */
354
355 _PUBLIC_ NTSTATUS gensec_update(struct gensec_security *gensec_security,
356                                 TALLOC_CTX *out_mem_ctx,
357                                 const DATA_BLOB in, DATA_BLOB *out)
358 {
359         return gensec_update_ev(gensec_security, out_mem_ctx, NULL, in, out);
360 }
361
362 struct gensec_update_state {
363         const struct gensec_security_ops *ops;
364         struct tevent_req *subreq;
365         struct gensec_security *gensec_security;
366         DATA_BLOB out;
367
368         /*
369          * only for sync backends, we should remove this
370          * once all backends are async.
371          */
372         struct tevent_immediate *im;
373         DATA_BLOB in;
374 };
375
376 static void gensec_update_async_trigger(struct tevent_context *ctx,
377                                         struct tevent_immediate *im,
378                                         void *private_data);
379 static void gensec_update_subreq_done(struct tevent_req *subreq);
380
381 /**
382  * Next state function for the GENSEC state machine async version
383  *
384  * @param mem_ctx The memory context for the request
385  * @param ev The event context for the request
386  * @param gensec_security GENSEC State
387  * @param in The request, as a DATA_BLOB
388  *
389  * @return The request handle or NULL on no memory failure
390  */
391
392 _PUBLIC_ struct tevent_req *gensec_update_send(TALLOC_CTX *mem_ctx,
393                                                struct tevent_context *ev,
394                                                struct gensec_security *gensec_security,
395                                                const DATA_BLOB in)
396 {
397         struct tevent_req *req;
398         struct gensec_update_state *state = NULL;
399
400         req = tevent_req_create(mem_ctx, &state,
401                                 struct gensec_update_state);
402         if (req == NULL) {
403                 return NULL;
404         }
405
406         state->ops = gensec_security->ops;
407         state->gensec_security = gensec_security;
408
409         if (state->ops->update_send == NULL) {
410                 state->in = in;
411                 state->im = tevent_create_immediate(state);
412                 if (tevent_req_nomem(state->im, req)) {
413                         return tevent_req_post(req, ev);
414                 }
415
416                 tevent_schedule_immediate(state->im, ev,
417                                           gensec_update_async_trigger,
418                                           req);
419
420                 return req;
421         }
422
423         state->subreq = state->ops->update_send(state, ev, gensec_security, in);
424         if (tevent_req_nomem(state->subreq, req)) {
425                 return tevent_req_post(req, ev);
426         }
427
428         tevent_req_set_callback(state->subreq,
429                                 gensec_update_subreq_done,
430                                 req);
431
432         return req;
433 }
434
435 static void gensec_update_async_trigger(struct tevent_context *ctx,
436                                         struct tevent_immediate *im,
437                                         void *private_data)
438 {
439         struct tevent_req *req =
440                 talloc_get_type_abort(private_data, struct tevent_req);
441         struct gensec_update_state *state =
442                 tevent_req_data(req, struct gensec_update_state);
443         NTSTATUS status;
444
445         status = state->ops->update(state->gensec_security, state, ctx,
446                                     state->in, &state->out);
447         if (tevent_req_nterror(req, status)) {
448                 return;
449         }
450
451         tevent_req_done(req);
452 }
453
454 static void gensec_update_subreq_done(struct tevent_req *subreq)
455 {
456         struct tevent_req *req =
457                 tevent_req_callback_data(subreq,
458                 struct tevent_req);
459         struct gensec_update_state *state =
460                 tevent_req_data(req,
461                 struct gensec_update_state);
462         NTSTATUS status;
463
464         state->subreq = NULL;
465
466         status = state->ops->update_recv(subreq, state, &state->out);
467         TALLOC_FREE(subreq);
468         if (tevent_req_nterror(req, status)) {
469                 return;
470         }
471
472         /*
473          * Because callers using the
474          * gensec_start_mech_by_authtype() never call
475          * gensec_want_feature(), it isn't sensible for them
476          * to have to call gensec_have_feature() manually, and
477          * these are not points of negotiation, but are
478          * asserted by the client
479          */
480         status = gensec_verify_features(state->gensec_security);
481         if (tevent_req_nterror(req, status)) {
482                 return;
483         }
484
485         tevent_req_done(req);
486 }
487
488 /**
489  * Next state function for the GENSEC state machine
490  *
491  * @param req request state
492  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
493  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
494  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
495  *                or NT_STATUS_OK if the user is authenticated.
496  */
497 _PUBLIC_ NTSTATUS gensec_update_recv(struct tevent_req *req,
498                                      TALLOC_CTX *out_mem_ctx,
499                                      DATA_BLOB *out)
500 {
501         struct gensec_update_state *state =
502                 tevent_req_data(req, struct gensec_update_state);
503         NTSTATUS status;
504
505         if (tevent_req_is_nterror(req, &status)) {
506                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
507                         tevent_req_received(req);
508                         return status;
509                 }
510         } else {
511                 status = NT_STATUS_OK;
512         }
513
514         *out = state->out;
515         talloc_steal(out_mem_ctx, out->data);
516
517         tevent_req_received(req);
518         return status;
519 }
520
521 /**
522  * Set the requirement for a certain feature on the connection
523  *
524  */
525
526 _PUBLIC_ void gensec_want_feature(struct gensec_security *gensec_security,
527                          uint32_t feature)
528 {
529         if (!gensec_security->ops || !gensec_security->ops->want_feature) {
530                 gensec_security->want_features |= feature;
531                 return;
532         }
533         gensec_security->ops->want_feature(gensec_security, feature);
534 }
535
536 /**
537  * Check the requirement for a certain feature on the connection
538  *
539  */
540
541 _PUBLIC_ bool gensec_have_feature(struct gensec_security *gensec_security,
542                          uint32_t feature)
543 {
544         if (!gensec_security->ops || !gensec_security->ops->have_feature) {
545                 return false;
546         }
547
548         /* We might 'have' features that we don't 'want', because the
549          * other end demanded them, or we can't neotiate them off */
550         return gensec_security->ops->have_feature(gensec_security, feature);
551 }
552
553 _PUBLIC_ NTTIME gensec_expire_time(struct gensec_security *gensec_security)
554 {
555         if (!gensec_security->ops->expire_time) {
556                 return GENSEC_EXPIRE_TIME_INFINITY;
557         }
558
559         return gensec_security->ops->expire_time(gensec_security);
560 }
561 /**
562  * Return the credentials structure associated with a GENSEC context
563  *
564  */
565
566 _PUBLIC_ struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security)
567 {
568         if (!gensec_security) {
569                 return NULL;
570         }
571         return gensec_security->credentials;
572 }
573
574 /**
575  * Set the target service (such as 'http' or 'host') on a GENSEC context - ensures it is talloc()ed
576  *
577  */
578
579 _PUBLIC_ NTSTATUS gensec_set_target_service(struct gensec_security *gensec_security, const char *service)
580 {
581         gensec_security->target.service = talloc_strdup(gensec_security, service);
582         if (!gensec_security->target.service) {
583                 return NT_STATUS_NO_MEMORY;
584         }
585         return NT_STATUS_OK;
586 }
587
588 _PUBLIC_ const char *gensec_get_target_service(struct gensec_security *gensec_security)
589 {
590         if (gensec_security->target.service) {
591                 return gensec_security->target.service;
592         }
593
594         return "host";
595 }
596
597 /**
598  * Set the target hostname (suitable for kerberos resolutation) on a GENSEC context - ensures it is talloc()ed
599  *
600  */
601
602 _PUBLIC_ NTSTATUS gensec_set_target_hostname(struct gensec_security *gensec_security, const char *hostname)
603 {
604         gensec_security->target.hostname = talloc_strdup(gensec_security, hostname);
605         if (hostname && !gensec_security->target.hostname) {
606                 return NT_STATUS_NO_MEMORY;
607         }
608         return NT_STATUS_OK;
609 }
610
611 _PUBLIC_ const char *gensec_get_target_hostname(struct gensec_security *gensec_security)
612 {
613         /* We allow the target hostname to be overridden for testing purposes */
614         if (gensec_security->settings->target_hostname) {
615                 return gensec_security->settings->target_hostname;
616         }
617
618         if (gensec_security->target.hostname) {
619                 return gensec_security->target.hostname;
620         }
621
622         /* We could add use the 'set sockaddr' call, and do a reverse
623          * lookup, but this would be both insecure (compromising the
624          * way kerberos works) and add DNS timeouts */
625         return NULL;
626 }
627
628 /**
629  * Set (and copy) local and peer socket addresses onto a socket
630  * context on the GENSEC context.
631  *
632  * This is so that kerberos can include these addresses in
633  * cryptographic tokens, to avoid certain attacks.
634  */
635
636 /**
637  * @brief Set the local gensec address.
638  *
639  * @param  gensec_security   The gensec security context to use.
640  *
641  * @param  remote       The local address to set.
642  *
643  * @return              On success NT_STATUS_OK is returned or an NT_STATUS
644  *                      error.
645  */
646 _PUBLIC_ NTSTATUS gensec_set_local_address(struct gensec_security *gensec_security,
647                 const struct tsocket_address *local)
648 {
649         TALLOC_FREE(gensec_security->local_addr);
650
651         if (local == NULL) {
652                 return NT_STATUS_OK;
653         }
654
655         gensec_security->local_addr = tsocket_address_copy(local, gensec_security);
656         if (gensec_security->local_addr == NULL) {
657                 return NT_STATUS_NO_MEMORY;
658         }
659
660         return NT_STATUS_OK;
661 }
662
663 /**
664  * @brief Set the remote gensec address.
665  *
666  * @param  gensec_security   The gensec security context to use.
667  *
668  * @param  remote       The remote address to set.
669  *
670  * @return              On success NT_STATUS_OK is returned or an NT_STATUS
671  *                      error.
672  */
673 _PUBLIC_ NTSTATUS gensec_set_remote_address(struct gensec_security *gensec_security,
674                 const struct tsocket_address *remote)
675 {
676         TALLOC_FREE(gensec_security->remote_addr);
677
678         if (remote == NULL) {
679                 return NT_STATUS_OK;
680         }
681
682         gensec_security->remote_addr = tsocket_address_copy(remote, gensec_security);
683         if (gensec_security->remote_addr == NULL) {
684                 return NT_STATUS_NO_MEMORY;
685         }
686
687         return NT_STATUS_OK;
688 }
689
690 /**
691  * @brief Get the local address from a gensec security context.
692  *
693  * @param  gensec_security   The security context to get the address from.
694  *
695  * @return              The address as tsocket_address which could be NULL if
696  *                      no address is set.
697  */
698 _PUBLIC_ const struct tsocket_address *gensec_get_local_address(struct gensec_security *gensec_security)
699 {
700         if (gensec_security == NULL) {
701                 return NULL;
702         }
703         return gensec_security->local_addr;
704 }
705
706 /**
707  * @brief Get the remote address from a gensec security context.
708  *
709  * @param  gensec_security   The security context to get the address from.
710  *
711  * @return              The address as tsocket_address which could be NULL if
712  *                      no address is set.
713  */
714 _PUBLIC_ const struct tsocket_address *gensec_get_remote_address(struct gensec_security *gensec_security)
715 {
716         if (gensec_security == NULL) {
717                 return NULL;
718         }
719         return gensec_security->remote_addr;
720 }
721
722 /**
723  * Set the target principal (assuming it it known, say from the SPNEGO reply)
724  *  - ensures it is talloc()ed
725  *
726  */
727
728 _PUBLIC_ NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal)
729 {
730         gensec_security->target.principal = talloc_strdup(gensec_security, principal);
731         if (!gensec_security->target.principal) {
732                 return NT_STATUS_NO_MEMORY;
733         }
734         return NT_STATUS_OK;
735 }
736
737 _PUBLIC_ const char *gensec_get_target_principal(struct gensec_security *gensec_security)
738 {
739         if (gensec_security->target.principal) {
740                 return gensec_security->target.principal;
741         }
742
743         return NULL;
744 }