2 Unix SMB/CIFS implementation.
4 Generic Authentication Interface
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/network.h"
26 #include "lib/tsocket/tsocket.h"
27 #include "lib/util/tevent_ntstatus.h"
28 #include "auth/gensec/gensec.h"
29 #include "librpc/rpc/dcerpc.h"
32 wrappers for the gensec function pointers
34 _PUBLIC_ NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
35 uint8_t *data, size_t length,
36 const uint8_t *whole_pdu, size_t pdu_length,
39 if (!gensec_security->ops->unseal_packet) {
40 return NT_STATUS_NOT_IMPLEMENTED;
42 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
43 return NT_STATUS_INVALID_PARAMETER;
46 return gensec_security->ops->unseal_packet(gensec_security,
48 whole_pdu, pdu_length,
52 _PUBLIC_ NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
53 const uint8_t *data, size_t length,
54 const uint8_t *whole_pdu, size_t pdu_length,
57 if (!gensec_security->ops->check_packet) {
58 return NT_STATUS_NOT_IMPLEMENTED;
60 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
61 return NT_STATUS_INVALID_PARAMETER;
64 return gensec_security->ops->check_packet(gensec_security, data, length, whole_pdu, pdu_length, sig);
67 _PUBLIC_ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
69 uint8_t *data, size_t length,
70 const uint8_t *whole_pdu, size_t pdu_length,
73 if (!gensec_security->ops->seal_packet) {
74 return NT_STATUS_NOT_IMPLEMENTED;
76 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
77 return NT_STATUS_INVALID_PARAMETER;
79 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
80 return NT_STATUS_INVALID_PARAMETER;
83 return gensec_security->ops->seal_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
86 _PUBLIC_ NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security,
88 const uint8_t *data, size_t length,
89 const uint8_t *whole_pdu, size_t pdu_length,
92 if (!gensec_security->ops->sign_packet) {
93 return NT_STATUS_NOT_IMPLEMENTED;
95 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
96 return NT_STATUS_INVALID_PARAMETER;
99 return gensec_security->ops->sign_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
102 _PUBLIC_ size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size)
104 if (!gensec_security->ops->sig_size) {
107 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
111 return gensec_security->ops->sig_size(gensec_security, data_size);
114 size_t gensec_max_wrapped_size(struct gensec_security *gensec_security)
116 if (!gensec_security->ops->max_wrapped_size) {
120 return gensec_security->ops->max_wrapped_size(gensec_security);
123 size_t gensec_max_input_size(struct gensec_security *gensec_security)
125 if (!gensec_security->ops->max_input_size) {
126 return (1 << 17) - gensec_sig_size(gensec_security, 1 << 17);
129 return gensec_security->ops->max_input_size(gensec_security);
132 _PUBLIC_ NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
137 if (!gensec_security->ops->wrap) {
138 return NT_STATUS_NOT_IMPLEMENTED;
140 return gensec_security->ops->wrap(gensec_security, mem_ctx, in, out);
143 _PUBLIC_ NTSTATUS gensec_unwrap(struct gensec_security *gensec_security,
148 if (!gensec_security->ops->unwrap) {
149 return NT_STATUS_NOT_IMPLEMENTED;
151 return gensec_security->ops->unwrap(gensec_security, mem_ctx, in, out);
154 _PUBLIC_ NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
156 DATA_BLOB *session_key)
158 if (!gensec_security->ops->session_key) {
159 return NT_STATUS_NOT_IMPLEMENTED;
161 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SESSION_KEY)) {
162 return NT_STATUS_NO_USER_SESSION_KEY;
165 return gensec_security->ops->session_key(gensec_security, mem_ctx, session_key);
169 * Return the credentials of a logged on user, including session keys
172 * Only valid after a successful authentication
174 * May only be called once per authentication.
178 _PUBLIC_ NTSTATUS gensec_session_info(struct gensec_security *gensec_security,
180 struct auth_session_info **session_info)
182 if (!gensec_security->ops->session_info) {
183 return NT_STATUS_NOT_IMPLEMENTED;
185 return gensec_security->ops->session_info(gensec_security, mem_ctx, session_info);
189 * Next state function for the GENSEC state machine
191 * @param gensec_security GENSEC State
192 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
193 * @param in The request, as a DATA_BLOB
194 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
195 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
196 * or NT_STATUS_OK if the user is authenticated.
199 _PUBLIC_ NTSTATUS gensec_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
200 struct tevent_context *ev,
201 const DATA_BLOB in, DATA_BLOB *out)
205 status = gensec_security->ops->update(gensec_security, out_mem_ctx,
207 if (!NT_STATUS_IS_OK(status)) {
212 * Because callers using the
213 * gensec_start_mech_by_auth_type() never call
214 * gensec_want_feature(), it isn't sensible for them
215 * to have to call gensec_have_feature() manually, and
216 * these are not points of negotiation, but are
217 * asserted by the client
219 switch (gensec_security->dcerpc_auth_level) {
220 case DCERPC_AUTH_LEVEL_INTEGRITY:
221 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
222 DEBUG(0,("Did not manage to negotiate mandetory feature "
223 "SIGN for dcerpc auth_level %u\n",
224 gensec_security->dcerpc_auth_level));
225 return NT_STATUS_ACCESS_DENIED;
228 case DCERPC_AUTH_LEVEL_PRIVACY:
229 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
230 DEBUG(0,("Did not manage to negotiate mandetory feature "
231 "SIGN for dcerpc auth_level %u\n",
232 gensec_security->dcerpc_auth_level));
233 return NT_STATUS_ACCESS_DENIED;
235 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
236 DEBUG(0,("Did not manage to negotiate mandetory feature "
237 "SEAL for dcerpc auth_level %u\n",
238 gensec_security->dcerpc_auth_level));
239 return NT_STATUS_ACCESS_DENIED;
249 struct gensec_update_state {
250 struct tevent_immediate *im;
251 struct gensec_security *gensec_security;
256 static void gensec_update_async_trigger(struct tevent_context *ctx,
257 struct tevent_immediate *im,
260 * Next state function for the GENSEC state machine async version
262 * @param mem_ctx The memory context for the request
263 * @param ev The event context for the request
264 * @param gensec_security GENSEC State
265 * @param in The request, as a DATA_BLOB
267 * @return The request handle or NULL on no memory failure
270 _PUBLIC_ struct tevent_req *gensec_update_send(TALLOC_CTX *mem_ctx,
271 struct tevent_context *ev,
272 struct gensec_security *gensec_security,
275 struct tevent_req *req;
276 struct gensec_update_state *state = NULL;
278 req = tevent_req_create(mem_ctx, &state,
279 struct gensec_update_state);
284 state->gensec_security = gensec_security;
286 state->out = data_blob(NULL, 0);
287 state->im = tevent_create_immediate(state);
288 if (tevent_req_nomem(state->im, req)) {
289 return tevent_req_post(req, ev);
292 tevent_schedule_immediate(state->im, ev,
293 gensec_update_async_trigger,
299 static void gensec_update_async_trigger(struct tevent_context *ctx,
300 struct tevent_immediate *im,
303 struct tevent_req *req =
304 talloc_get_type_abort(private_data, struct tevent_req);
305 struct gensec_update_state *state =
306 tevent_req_data(req, struct gensec_update_state);
309 status = gensec_update(state->gensec_security, state, ctx,
310 state->in, &state->out);
311 if (tevent_req_nterror(req, status)) {
315 tevent_req_done(req);
319 * Next state function for the GENSEC state machine
321 * @param req request state
322 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
323 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
324 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
325 * or NT_STATUS_OK if the user is authenticated.
327 _PUBLIC_ NTSTATUS gensec_update_recv(struct tevent_req *req,
328 TALLOC_CTX *out_mem_ctx,
331 struct gensec_update_state *state =
332 tevent_req_data(req, struct gensec_update_state);
335 if (tevent_req_is_nterror(req, &status)) {
336 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
337 tevent_req_received(req);
341 status = NT_STATUS_OK;
345 talloc_steal(out_mem_ctx, out->data);
347 tevent_req_received(req);
352 * Set the requirement for a certain feature on the connection
356 _PUBLIC_ void gensec_want_feature(struct gensec_security *gensec_security,
359 if (!gensec_security->ops || !gensec_security->ops->want_feature) {
360 gensec_security->want_features |= feature;
363 gensec_security->ops->want_feature(gensec_security, feature);
367 * Check the requirement for a certain feature on the connection
371 _PUBLIC_ bool gensec_have_feature(struct gensec_security *gensec_security,
374 if (!gensec_security->ops->have_feature) {
378 /* We might 'have' features that we don't 'want', because the
379 * other end demanded them, or we can't neotiate them off */
380 return gensec_security->ops->have_feature(gensec_security, feature);
384 * Return the credentials structure associated with a GENSEC context
388 _PUBLIC_ struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security)
390 if (!gensec_security) {
393 return gensec_security->credentials;
397 * Set the target service (such as 'http' or 'host') on a GENSEC context - ensures it is talloc()ed
401 _PUBLIC_ NTSTATUS gensec_set_target_service(struct gensec_security *gensec_security, const char *service)
403 gensec_security->target.service = talloc_strdup(gensec_security, service);
404 if (!gensec_security->target.service) {
405 return NT_STATUS_NO_MEMORY;
410 _PUBLIC_ const char *gensec_get_target_service(struct gensec_security *gensec_security)
412 if (gensec_security->target.service) {
413 return gensec_security->target.service;
420 * Set the target hostname (suitable for kerberos resolutation) on a GENSEC context - ensures it is talloc()ed
424 _PUBLIC_ NTSTATUS gensec_set_target_hostname(struct gensec_security *gensec_security, const char *hostname)
426 gensec_security->target.hostname = talloc_strdup(gensec_security, hostname);
427 if (hostname && !gensec_security->target.hostname) {
428 return NT_STATUS_NO_MEMORY;
433 _PUBLIC_ const char *gensec_get_target_hostname(struct gensec_security *gensec_security)
435 /* We allow the target hostname to be overriden for testing purposes */
436 if (gensec_security->settings->target_hostname) {
437 return gensec_security->settings->target_hostname;
440 if (gensec_security->target.hostname) {
441 return gensec_security->target.hostname;
444 /* We could add use the 'set sockaddr' call, and do a reverse
445 * lookup, but this would be both insecure (compromising the
446 * way kerberos works) and add DNS timeouts */
451 * Set (and copy) local and peer socket addresses onto a socket
452 * context on the GENSEC context.
454 * This is so that kerberos can include these addresses in
455 * cryptographic tokens, to avoid certain attacks.
459 * @brief Set the local gensec address.
461 * @param gensec_security The gensec security context to use.
463 * @param remote The local address to set.
465 * @return On success NT_STATUS_OK is returned or an NT_STATUS
468 _PUBLIC_ NTSTATUS gensec_set_local_address(struct gensec_security *gensec_security,
469 const struct tsocket_address *local)
471 TALLOC_FREE(gensec_security->local_addr);
477 gensec_security->local_addr = tsocket_address_copy(local, gensec_security);
478 if (gensec_security->local_addr == NULL) {
479 return NT_STATUS_NO_MEMORY;
486 * @brief Set the remote gensec address.
488 * @param gensec_security The gensec security context to use.
490 * @param remote The remote address to set.
492 * @return On success NT_STATUS_OK is returned or an NT_STATUS
495 _PUBLIC_ NTSTATUS gensec_set_remote_address(struct gensec_security *gensec_security,
496 const struct tsocket_address *remote)
498 TALLOC_FREE(gensec_security->remote_addr);
500 if (remote == NULL) {
504 gensec_security->remote_addr = tsocket_address_copy(remote, gensec_security);
505 if (gensec_security->remote_addr == NULL) {
506 return NT_STATUS_NO_MEMORY;
513 * @brief Get the local address from a gensec security context.
515 * @param gensec_security The security context to get the address from.
517 * @return The address as tsocket_address which could be NULL if
520 _PUBLIC_ const struct tsocket_address *gensec_get_local_address(struct gensec_security *gensec_security)
522 if (gensec_security == NULL) {
525 return gensec_security->local_addr;
529 * @brief Get the remote address from a gensec security context.
531 * @param gensec_security The security context to get the address from.
533 * @return The address as tsocket_address which could be NULL if
536 _PUBLIC_ const struct tsocket_address *gensec_get_remote_address(struct gensec_security *gensec_security)
538 if (gensec_security == NULL) {
541 return gensec_security->remote_addr;
545 * Set the target principal (assuming it it known, say from the SPNEGO reply)
546 * - ensures it is talloc()ed
550 _PUBLIC_ NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal)
552 gensec_security->target.principal = talloc_strdup(gensec_security, principal);
553 if (!gensec_security->target.principal) {
554 return NT_STATUS_NO_MEMORY;
559 const char *gensec_get_target_principal(struct gensec_security *gensec_security)
561 if (gensec_security->target.principal) {
562 return gensec_security->target.principal;