#include "auth/gensec/gensec.h"
#include "auth/gensec/gensec_internal.h"
#include "librpc/gen_ndr/dcerpc.h"
+#include "auth/common_auth.h"
_PRIVATE_ NTSTATUS gensec_may_reset_crypto(struct gensec_security *gensec_security,
bool full_reset)
return gensec_security->ops->session_key(gensec_security, mem_ctx, session_key);
}
+const char *gensec_final_auth_type(struct gensec_security *gensec_security)
+{
+ if (!gensec_security->ops->final_auth_type) {
+ return gensec_security->ops->name;
+ }
+
+ return gensec_security->ops->final_auth_type(gensec_security);
+}
+
+/*
+ * Log details of a successful GENSEC authorization to a service.
+ *
+ * Only successful authorizations are logged, as only these call gensec_session_info()
+ *
+ * The service may later refuse authorization due to an ACL.
+ *
+ */
+static void log_successful_gensec_authz_event(struct gensec_security *gensec_security,
+ struct auth_session_info *session_info)
+{
+ const struct tsocket_address *remote
+ = gensec_get_remote_address(gensec_security);
+ const struct tsocket_address *local
+ = gensec_get_local_address(gensec_security);
+ const char *service_description
+ = gensec_get_target_service_description(gensec_security);
+ const char *final_auth_type
+ = gensec_final_auth_type(gensec_security);
+ const char *transport_protection = NULL;
+ if (gensec_security->want_features & GENSEC_FEATURE_SMB_TRANSPORT) {
+ transport_protection = AUTHZ_TRANSPORT_PROTECTION_SMB;
+ } else if (gensec_security->want_features & GENSEC_FEATURE_LDAPS_TRANSPORT) {
+ transport_protection = AUTHZ_TRANSPORT_PROTECTION_TLS;
+ } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
+ transport_protection = AUTHZ_TRANSPORT_PROTECTION_SEAL;
+ } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
+ transport_protection = AUTHZ_TRANSPORT_PROTECTION_SIGN;
+ } else {
+ transport_protection = AUTHZ_TRANSPORT_PROTECTION_NONE;
+ }
+ log_successful_authz_event(gensec_security->auth_context->msg_ctx,
+ gensec_security->auth_context->lp_ctx,
+ remote, local,
+ service_description,
+ final_auth_type,
+ transport_protection,
+ session_info);
+}
+
+
/**
* Return the credentials of a logged on user, including session keys
* etc.
*
* Only valid after a successful authentication
*
- * May only be called once per authentication.
+ * May only be called once per authentication. This will also make an
+ * authorization log entry, as it is already called by all the
+ * callers.
*
*/
TALLOC_CTX *mem_ctx,
struct auth_session_info **session_info)
{
+ NTSTATUS status;
if (!gensec_security->ops->session_info) {
return NT_STATUS_NOT_IMPLEMENTED;
}
- return gensec_security->ops->session_info(gensec_security, mem_ctx, session_info);
+ status = gensec_security->ops->session_info(gensec_security, mem_ctx, session_info);
+
+ if (NT_STATUS_IS_OK(status) && !gensec_security->subcontext
+ && (gensec_security->want_features & GENSEC_FEATURE_NO_AUTHZ_LOG) == 0) {
+ log_successful_gensec_authz_event(gensec_security, *session_info);
+ }
+
+ return status;
}
_PUBLIC_ void gensec_set_max_update_size(struct gensec_security *gensec_security,
const DATA_BLOB in, DATA_BLOB *out)
{
NTSTATUS status;
- const struct gensec_security_ops *ops = gensec_security->ops;
TALLOC_CTX *frame = NULL;
struct tevent_req *subreq = NULL;
bool ok;
- if (ops->update_send == NULL) {
-
- if (ev == NULL) {
- frame = talloc_stackframe();
-
- ev = samba_tevent_context_init(frame);
- if (ev == NULL) {
- status = NT_STATUS_NO_MEMORY;
- goto fail;
- }
-
- /*
- * TODO: remove this hack once the backends
- * are fixed.
- */
- tevent_loop_allow_nesting(ev);
- }
-
- status = ops->update(gensec_security, out_mem_ctx,
- ev, in, out);
- TALLOC_FREE(frame);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
-
+ if (gensec_security->subcontext) {
/*
- * Because callers using the
- * gensec_start_mech_by_auth_type() never call
- * gensec_want_feature(), it isn't sensible for them
- * to have to call gensec_have_feature() manually, and
- * these are not points of negotiation, but are
- * asserted by the client
+ * gensec modules are not allowed to call the sync version.
*/
- status = gensec_verify_features(gensec_security);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
-
- return NT_STATUS_OK;
+ return NT_STATUS_INTERNAL_ERROR;
}
frame = talloc_stackframe();
tevent_loop_allow_nesting(ev);
}
- subreq = ops->update_send(frame, ev, gensec_security, in);
+ subreq = gensec_update_send(frame, ev, gensec_security, in);
if (subreq == NULL) {
status = NT_STATUS_NO_MEMORY;
goto fail;
if (!ok) {
goto fail;
}
- status = ops->update_recv(subreq, out_mem_ctx, out);
+ status = gensec_update_recv(subreq, out_mem_ctx, out);
fail:
TALLOC_FREE(frame);
return status;
struct gensec_update_state {
const struct gensec_security_ops *ops;
- struct tevent_req *subreq;
struct gensec_security *gensec_security;
+ NTSTATUS status;
DATA_BLOB out;
-
- /*
- * only for sync backends, we should remove this
- * once all backends are async.
- */
- struct tevent_immediate *im;
- DATA_BLOB in;
};
-static void gensec_update_async_trigger(struct tevent_context *ctx,
- struct tevent_immediate *im,
- void *private_data);
-static void gensec_update_subreq_done(struct tevent_req *subreq);
+static void gensec_update_cleanup(struct tevent_req *req,
+ enum tevent_req_state req_state);
+static void gensec_update_done(struct tevent_req *subreq);
/**
* Next state function for the GENSEC state machine async version
struct gensec_security *gensec_security,
const DATA_BLOB in)
{
- struct tevent_req *req;
+ struct tevent_req *req = NULL;
struct gensec_update_state *state = NULL;
+ struct tevent_req *subreq = NULL;
req = tevent_req_create(mem_ctx, &state,
struct gensec_update_state);
if (req == NULL) {
return NULL;
}
-
state->ops = gensec_security->ops;
state->gensec_security = gensec_security;
- if (state->ops->update_send == NULL) {
- state->in = in;
- state->im = tevent_create_immediate(state);
- if (tevent_req_nomem(state->im, req)) {
- return tevent_req_post(req, ev);
- }
-
- tevent_schedule_immediate(state->im, ev,
- gensec_update_async_trigger,
- req);
+ if (gensec_security->update_busy_ptr != NULL) {
+ tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+ return tevent_req_post(req, ev);
+ }
- return req;
+ if (gensec_security->child_security != NULL) {
+ tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+ return tevent_req_post(req, ev);
}
- state->subreq = state->ops->update_send(state, ev, gensec_security, in);
- if (tevent_req_nomem(state->subreq, req)) {
+ gensec_security->update_busy_ptr = &state->gensec_security;
+ tevent_req_set_cleanup_fn(req, gensec_update_cleanup);
+
+ subreq = state->ops->update_send(state, ev, gensec_security, in);
+ if (tevent_req_nomem(subreq, req)) {
return tevent_req_post(req, ev);
}
+ tevent_req_set_callback(subreq, gensec_update_done, req);
- tevent_req_set_callback(state->subreq,
- gensec_update_subreq_done,
- req);
+ DBG_DEBUG("%s[%p]: subreq: %p\n", state->ops->name,
+ state->gensec_security, subreq);
return req;
}
-static void gensec_update_async_trigger(struct tevent_context *ctx,
- struct tevent_immediate *im,
- void *private_data)
+static void gensec_update_cleanup(struct tevent_req *req,
+ enum tevent_req_state req_state)
{
- struct tevent_req *req =
- talloc_get_type_abort(private_data, struct tevent_req);
struct gensec_update_state *state =
- tevent_req_data(req, struct gensec_update_state);
- NTSTATUS status;
+ tevent_req_data(req,
+ struct gensec_update_state);
- status = state->ops->update(state->gensec_security, state, ctx,
- state->in, &state->out);
- if (tevent_req_nterror(req, status)) {
+ if (state->gensec_security == NULL) {
return;
}
- tevent_req_done(req);
+ if (state->gensec_security->update_busy_ptr == &state->gensec_security) {
+ state->gensec_security->update_busy_ptr = NULL;
+ }
+
+ state->gensec_security = NULL;
}
-static void gensec_update_subreq_done(struct tevent_req *subreq)
+static void gensec_update_done(struct tevent_req *subreq)
{
struct tevent_req *req =
tevent_req_callback_data(subreq,
tevent_req_data(req,
struct gensec_update_state);
NTSTATUS status;
+ const char *debug_subreq = NULL;
- state->subreq = NULL;
+ if (CHECK_DEBUGLVL(DBGLVL_DEBUG)) {
+ /*
+ * We need to call tevent_req_print()
+ * before calling the _recv function,
+ * before tevent_req_received() was called.
+ * in order to print the pointer value of
+ * the subreq state.
+ */
+ debug_subreq = tevent_req_print(state, subreq);
+ }
status = state->ops->update_recv(subreq, state, &state->out);
TALLOC_FREE(subreq);
- if (tevent_req_nterror(req, status)) {
+ state->status = status;
+ if (GENSEC_UPDATE_IS_NTERROR(status)) {
+ DBG_INFO("%s[%p]: %s%s%s\n", state->ops->name,
+ state->gensec_security, nt_errstr(status),
+ debug_subreq ? " " : "",
+ debug_subreq ? debug_subreq : "");
+ tevent_req_nterror(req, status);
+ return;
+ }
+ DBG_DEBUG("%s[%p]: %s %s\n", state->ops->name,
+ state->gensec_security, nt_errstr(status),
+ debug_subreq);
+ if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ tevent_req_done(req);
return;
}
tevent_req_data(req, struct gensec_update_state);
NTSTATUS status;
+ *out = data_blob_null;
+
if (tevent_req_is_nterror(req, &status)) {
- if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
- tevent_req_received(req);
- return status;
- }
- } else {
- status = NT_STATUS_OK;
+ tevent_req_received(req);
+ return status;
}
*out = state->out;
talloc_steal(out_mem_ctx, out->data);
-
+ status = state->status;
tevent_req_received(req);
return status;
}
git.samba.org / vlendec / samba-autobuild / .git / blobdiff