2 Unix SMB/CIFS implementation.
4 Generic Authentication Interface
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/network.h"
25 #define TEVENT_DEPRECATED 1
27 #include "lib/tsocket/tsocket.h"
28 #include "lib/util/tevent_ntstatus.h"
29 #include "auth/gensec/gensec.h"
30 #include "auth/gensec/gensec_internal.h"
31 #include "librpc/gen_ndr/dcerpc.h"
32 #include "auth/common_auth.h"
34 _PRIVATE_ NTSTATUS
gensec_may_reset_crypto(struct gensec_security
*gensec_security
,
37 if (!gensec_security
->ops
->may_reset_crypto
) {
41 return gensec_security
->ops
->may_reset_crypto(gensec_security
, full_reset
);
45 wrappers for the gensec function pointers
47 _PUBLIC_ NTSTATUS
gensec_unseal_packet(struct gensec_security
*gensec_security
,
48 uint8_t *data
, size_t length
,
49 const uint8_t *whole_pdu
, size_t pdu_length
,
52 if (!gensec_security
->ops
->unseal_packet
) {
53 return NT_STATUS_NOT_IMPLEMENTED
;
55 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
56 return NT_STATUS_INVALID_PARAMETER
;
58 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
59 return NT_STATUS_INVALID_PARAMETER
;
61 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_DCE_STYLE
)) {
62 return NT_STATUS_INVALID_PARAMETER
;
65 return gensec_security
->ops
->unseal_packet(gensec_security
,
67 whole_pdu
, pdu_length
,
71 _PUBLIC_ NTSTATUS
gensec_check_packet(struct gensec_security
*gensec_security
,
72 const uint8_t *data
, size_t length
,
73 const uint8_t *whole_pdu
, size_t pdu_length
,
76 if (!gensec_security
->ops
->check_packet
) {
77 return NT_STATUS_NOT_IMPLEMENTED
;
79 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
80 return NT_STATUS_INVALID_PARAMETER
;
83 return gensec_security
->ops
->check_packet(gensec_security
, data
, length
, whole_pdu
, pdu_length
, sig
);
86 _PUBLIC_ NTSTATUS
gensec_seal_packet(struct gensec_security
*gensec_security
,
88 uint8_t *data
, size_t length
,
89 const uint8_t *whole_pdu
, size_t pdu_length
,
92 if (!gensec_security
->ops
->seal_packet
) {
93 return NT_STATUS_NOT_IMPLEMENTED
;
95 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
96 return NT_STATUS_INVALID_PARAMETER
;
98 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
99 return NT_STATUS_INVALID_PARAMETER
;
101 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_DCE_STYLE
)) {
102 return NT_STATUS_INVALID_PARAMETER
;
105 return gensec_security
->ops
->seal_packet(gensec_security
, mem_ctx
, data
, length
, whole_pdu
, pdu_length
, sig
);
108 _PUBLIC_ NTSTATUS
gensec_sign_packet(struct gensec_security
*gensec_security
,
110 const uint8_t *data
, size_t length
,
111 const uint8_t *whole_pdu
, size_t pdu_length
,
114 if (!gensec_security
->ops
->sign_packet
) {
115 return NT_STATUS_NOT_IMPLEMENTED
;
117 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
118 return NT_STATUS_INVALID_PARAMETER
;
121 return gensec_security
->ops
->sign_packet(gensec_security
, mem_ctx
, data
, length
, whole_pdu
, pdu_length
, sig
);
124 _PUBLIC_
size_t gensec_sig_size(struct gensec_security
*gensec_security
, size_t data_size
)
126 if (!gensec_security
->ops
->sig_size
) {
129 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
132 if (gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
133 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_DCE_STYLE
)) {
138 return gensec_security
->ops
->sig_size(gensec_security
, data_size
);
141 _PUBLIC_
size_t gensec_max_wrapped_size(struct gensec_security
*gensec_security
)
143 if (!gensec_security
->ops
->max_wrapped_size
) {
147 return gensec_security
->ops
->max_wrapped_size(gensec_security
);
150 _PUBLIC_
size_t gensec_max_input_size(struct gensec_security
*gensec_security
)
152 if (!gensec_security
->ops
->max_input_size
) {
153 return (1 << 17) - gensec_sig_size(gensec_security
, 1 << 17);
156 return gensec_security
->ops
->max_input_size(gensec_security
);
159 _PUBLIC_ NTSTATUS
gensec_wrap(struct gensec_security
*gensec_security
,
164 if (!gensec_security
->ops
->wrap
) {
165 return NT_STATUS_NOT_IMPLEMENTED
;
167 return gensec_security
->ops
->wrap(gensec_security
, mem_ctx
, in
, out
);
170 _PUBLIC_ NTSTATUS
gensec_unwrap(struct gensec_security
*gensec_security
,
175 if (!gensec_security
->ops
->unwrap
) {
176 return NT_STATUS_NOT_IMPLEMENTED
;
178 return gensec_security
->ops
->unwrap(gensec_security
, mem_ctx
, in
, out
);
181 _PUBLIC_ NTSTATUS
gensec_session_key(struct gensec_security
*gensec_security
,
183 DATA_BLOB
*session_key
)
185 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SESSION_KEY
)) {
186 return NT_STATUS_NO_USER_SESSION_KEY
;
189 if (!gensec_security
->ops
->session_key
) {
190 return NT_STATUS_NOT_IMPLEMENTED
;
193 return gensec_security
->ops
->session_key(gensec_security
, mem_ctx
, session_key
);
196 const char *gensec_final_auth_type(struct gensec_security
*gensec_security
)
198 if (!gensec_security
->ops
->final_auth_type
) {
199 return gensec_security
->ops
->name
;
202 return gensec_security
->ops
->final_auth_type(gensec_security
);
206 * Log details of a successful GENSEC authorization to a service.
208 * Only successful authorizations are logged, as only these call gensec_session_info()
210 * The service may later refuse authorization due to an ACL.
213 static void log_successful_gensec_authz_event(struct gensec_security
*gensec_security
,
214 struct auth_session_info
*session_info
)
216 const struct tsocket_address
*remote
217 = gensec_get_remote_address(gensec_security
);
218 const struct tsocket_address
*local
219 = gensec_get_local_address(gensec_security
);
220 const char *service_description
221 = gensec_get_target_service_description(gensec_security
);
222 const char *final_auth_type
223 = gensec_final_auth_type(gensec_security
);
224 const char *transport_protection
= NULL
;
225 if (gensec_security
->want_features
& GENSEC_FEATURE_SMB_TRANSPORT
) {
226 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SMB
;
227 } else if (gensec_security
->want_features
& GENSEC_FEATURE_LDAPS_TRANSPORT
) {
228 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_TLS
;
229 } else if (gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
230 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SEAL
;
231 } else if (gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
232 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SIGN
;
234 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_NONE
;
236 log_successful_authz_event(gensec_security
->auth_context
->msg_ctx
,
237 gensec_security
->auth_context
->lp_ctx
,
241 transport_protection
,
247 * Return the credentials of a logged on user, including session keys
250 * Only valid after a successful authentication
252 * May only be called once per authentication. This will also make an
253 * authorization log entry, as it is already called by all the
258 _PUBLIC_ NTSTATUS
gensec_session_info(struct gensec_security
*gensec_security
,
260 struct auth_session_info
**session_info
)
263 if (!gensec_security
->ops
->session_info
) {
264 return NT_STATUS_NOT_IMPLEMENTED
;
266 status
= gensec_security
->ops
->session_info(gensec_security
, mem_ctx
, session_info
);
268 if (NT_STATUS_IS_OK(status
) && !gensec_security
->subcontext
269 && (gensec_security
->want_features
& GENSEC_FEATURE_NO_AUTHZ_LOG
) == 0) {
270 log_successful_gensec_authz_event(gensec_security
, *session_info
);
276 _PUBLIC_
void gensec_set_max_update_size(struct gensec_security
*gensec_security
,
277 uint32_t max_update_size
)
279 gensec_security
->max_update_size
= max_update_size
;
282 _PUBLIC_
size_t gensec_max_update_size(struct gensec_security
*gensec_security
)
284 if (gensec_security
->max_update_size
== 0) {
288 return gensec_security
->max_update_size
;
291 static NTSTATUS
gensec_verify_features(struct gensec_security
*gensec_security
)
294 * gensec_want_feature(GENSEC_FEATURE_SIGN)
296 * gensec_want_feature(GENSEC_FEATURE_SEAL)
297 * require these flags to be available.
299 if (gensec_security
->want_features
& GENSEC_FEATURE_SIGN
) {
300 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
301 DEBUG(0,("Did not manage to negotiate mandatory feature "
303 return NT_STATUS_ACCESS_DENIED
;
306 if (gensec_security
->want_features
& GENSEC_FEATURE_SEAL
) {
307 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
308 DEBUG(0,("Did not manage to negotiate mandatory feature "
310 return NT_STATUS_ACCESS_DENIED
;
312 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
313 DEBUG(0,("Did not manage to negotiate mandatory feature "
315 return NT_STATUS_ACCESS_DENIED
;
323 * Next state function for the GENSEC state machine
325 * @param gensec_security GENSEC State
326 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
327 * @param in The request, as a DATA_BLOB
328 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
329 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
330 * or NT_STATUS_OK if the user is authenticated.
332 _PUBLIC_ NTSTATUS
gensec_update(struct gensec_security
*gensec_security
,
333 TALLOC_CTX
*out_mem_ctx
,
334 const DATA_BLOB in
, DATA_BLOB
*out
)
337 TALLOC_CTX
*frame
= NULL
;
338 struct tevent_context
*ev
= NULL
;
339 struct tevent_req
*subreq
= NULL
;
342 if (gensec_security
->subcontext
) {
344 * gensec modules are not allowed to call the sync version.
346 return NT_STATUS_INTERNAL_ERROR
;
349 frame
= talloc_stackframe();
351 ev
= samba_tevent_context_init(frame
);
353 status
= NT_STATUS_NO_MEMORY
;
358 * TODO: remove this hack once the backends
361 tevent_loop_allow_nesting(ev
);
363 subreq
= gensec_update_send(frame
, ev
, gensec_security
, in
);
364 if (subreq
== NULL
) {
365 status
= NT_STATUS_NO_MEMORY
;
368 ok
= tevent_req_poll_ntstatus(subreq
, ev
, &status
);
372 status
= gensec_update_recv(subreq
, out_mem_ctx
, out
);
378 struct gensec_update_state
{
379 const struct gensec_security_ops
*ops
;
380 struct gensec_security
*gensec_security
;
385 static void gensec_update_cleanup(struct tevent_req
*req
,
386 enum tevent_req_state req_state
);
387 static void gensec_update_done(struct tevent_req
*subreq
);
390 * Next state function for the GENSEC state machine async version
392 * @param mem_ctx The memory context for the request
393 * @param ev The event context for the request
394 * @param gensec_security GENSEC State
395 * @param in The request, as a DATA_BLOB
397 * @return The request handle or NULL on no memory failure
400 _PUBLIC_
struct tevent_req
*gensec_update_send(TALLOC_CTX
*mem_ctx
,
401 struct tevent_context
*ev
,
402 struct gensec_security
*gensec_security
,
405 struct tevent_req
*req
= NULL
;
406 struct gensec_update_state
*state
= NULL
;
407 struct tevent_req
*subreq
= NULL
;
409 req
= tevent_req_create(mem_ctx
, &state
,
410 struct gensec_update_state
);
414 state
->ops
= gensec_security
->ops
;
415 state
->gensec_security
= gensec_security
;
417 if (gensec_security
->update_busy_ptr
!= NULL
) {
418 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
419 return tevent_req_post(req
, ev
);
422 if (gensec_security
->child_security
!= NULL
) {
423 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
424 return tevent_req_post(req
, ev
);
427 gensec_security
->update_busy_ptr
= &state
->gensec_security
;
428 tevent_req_set_cleanup_fn(req
, gensec_update_cleanup
);
430 subreq
= state
->ops
->update_send(state
, ev
, gensec_security
, in
);
431 if (tevent_req_nomem(subreq
, req
)) {
432 return tevent_req_post(req
, ev
);
434 tevent_req_set_callback(subreq
, gensec_update_done
, req
);
436 DBG_DEBUG("%s[%p]: subreq: %p\n", state
->ops
->name
,
437 state
->gensec_security
, subreq
);
442 static void gensec_update_cleanup(struct tevent_req
*req
,
443 enum tevent_req_state req_state
)
445 struct gensec_update_state
*state
=
447 struct gensec_update_state
);
449 if (state
->gensec_security
== NULL
) {
453 if (state
->gensec_security
->update_busy_ptr
== &state
->gensec_security
) {
454 state
->gensec_security
->update_busy_ptr
= NULL
;
457 state
->gensec_security
= NULL
;
460 static void gensec_update_done(struct tevent_req
*subreq
)
462 struct tevent_req
*req
=
463 tevent_req_callback_data(subreq
,
465 struct gensec_update_state
*state
=
467 struct gensec_update_state
);
469 const char *debug_subreq
= NULL
;
471 if (CHECK_DEBUGLVL(DBGLVL_DEBUG
)) {
473 * We need to call tevent_req_print()
474 * before calling the _recv function,
475 * before tevent_req_received() was called.
476 * in order to print the pointer value of
479 debug_subreq
= tevent_req_print(state
, subreq
);
482 status
= state
->ops
->update_recv(subreq
, state
, &state
->out
);
484 state
->status
= status
;
485 if (GENSEC_UPDATE_IS_NTERROR(status
)) {
486 DBG_INFO("%s[%p]: %s%s%s\n", state
->ops
->name
,
487 state
->gensec_security
, nt_errstr(status
),
488 debug_subreq
? " " : "",
489 debug_subreq
? debug_subreq
: "");
490 tevent_req_nterror(req
, status
);
493 DBG_DEBUG("%s[%p]: %s %s\n", state
->ops
->name
,
494 state
->gensec_security
, nt_errstr(status
),
496 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
497 tevent_req_done(req
);
502 * Because callers using the
503 * gensec_start_mech_by_authtype() never call
504 * gensec_want_feature(), it isn't sensible for them
505 * to have to call gensec_have_feature() manually, and
506 * these are not points of negotiation, but are
507 * asserted by the client
509 status
= gensec_verify_features(state
->gensec_security
);
510 if (tevent_req_nterror(req
, status
)) {
514 tevent_req_done(req
);
518 * Next state function for the GENSEC state machine
520 * @param req request state
521 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
522 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
523 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
524 * or NT_STATUS_OK if the user is authenticated.
526 _PUBLIC_ NTSTATUS
gensec_update_recv(struct tevent_req
*req
,
527 TALLOC_CTX
*out_mem_ctx
,
530 struct gensec_update_state
*state
=
531 tevent_req_data(req
, struct gensec_update_state
);
534 *out
= data_blob_null
;
536 if (tevent_req_is_nterror(req
, &status
)) {
537 tevent_req_received(req
);
542 talloc_steal(out_mem_ctx
, out
->data
);
543 status
= state
->status
;
544 tevent_req_received(req
);
549 * Set the requirement for a certain feature on the connection
553 _PUBLIC_
void gensec_want_feature(struct gensec_security
*gensec_security
,
556 if (!gensec_security
->ops
|| !gensec_security
->ops
->want_feature
) {
557 gensec_security
->want_features
|= feature
;
560 gensec_security
->ops
->want_feature(gensec_security
, feature
);
564 * Check the requirement for a certain feature on the connection
568 _PUBLIC_
bool gensec_have_feature(struct gensec_security
*gensec_security
,
571 if (!gensec_security
->ops
|| !gensec_security
->ops
->have_feature
) {
575 /* We might 'have' features that we don't 'want', because the
576 * other end demanded them, or we can't neotiate them off */
577 return gensec_security
->ops
->have_feature(gensec_security
, feature
);
580 _PUBLIC_ NTTIME
gensec_expire_time(struct gensec_security
*gensec_security
)
582 if (!gensec_security
->ops
->expire_time
) {
583 return GENSEC_EXPIRE_TIME_INFINITY
;
586 return gensec_security
->ops
->expire_time(gensec_security
);
589 * Return the credentials structure associated with a GENSEC context
593 _PUBLIC_
struct cli_credentials
*gensec_get_credentials(struct gensec_security
*gensec_security
)
595 if (!gensec_security
) {
598 return gensec_security
->credentials
;
602 * Set the target service (such as 'http' or 'host') on a GENSEC context - ensures it is talloc()ed
604 * This is used for Kerberos service principal name resolution.
607 _PUBLIC_ NTSTATUS
gensec_set_target_service(struct gensec_security
*gensec_security
, const char *service
)
609 gensec_security
->target
.service
= talloc_strdup(gensec_security
, service
);
610 if (!gensec_security
->target
.service
) {
611 return NT_STATUS_NO_MEMORY
;
616 _PUBLIC_
const char *gensec_get_target_service(struct gensec_security
*gensec_security
)
618 if (gensec_security
->target
.service
) {
619 return gensec_security
->target
.service
;
626 * Set the target service (such as 'samr') on an GENSEC context - ensures it is talloc()ed.
628 * This is not the Kerberos service principal, instead this is a
629 * constant value that can be logged as part of authentication and
630 * authorization logging
632 _PUBLIC_ NTSTATUS
gensec_set_target_service_description(struct gensec_security
*gensec_security
,
635 gensec_security
->target
.service_description
= talloc_strdup(gensec_security
, service
);
636 if (!gensec_security
->target
.service_description
) {
637 return NT_STATUS_NO_MEMORY
;
642 _PUBLIC_
const char *gensec_get_target_service_description(struct gensec_security
*gensec_security
)
644 if (gensec_security
->target
.service_description
) {
645 return gensec_security
->target
.service_description
;
646 } else if (gensec_security
->target
.service
) {
647 return gensec_security
->target
.service
;
654 * Set the target hostname (suitable for kerberos resolutation) on a GENSEC context - ensures it is talloc()ed
658 _PUBLIC_ NTSTATUS
gensec_set_target_hostname(struct gensec_security
*gensec_security
, const char *hostname
)
660 gensec_security
->target
.hostname
= talloc_strdup(gensec_security
, hostname
);
661 if (hostname
&& !gensec_security
->target
.hostname
) {
662 return NT_STATUS_NO_MEMORY
;
667 _PUBLIC_
const char *gensec_get_target_hostname(struct gensec_security
*gensec_security
)
669 /* We allow the target hostname to be overridden for testing purposes */
670 if (gensec_security
->settings
->target_hostname
) {
671 return gensec_security
->settings
->target_hostname
;
674 if (gensec_security
->target
.hostname
) {
675 return gensec_security
->target
.hostname
;
678 /* We could add use the 'set sockaddr' call, and do a reverse
679 * lookup, but this would be both insecure (compromising the
680 * way kerberos works) and add DNS timeouts */
685 * Set (and copy) local and peer socket addresses onto a socket
686 * context on the GENSEC context.
688 * This is so that kerberos can include these addresses in
689 * cryptographic tokens, to avoid certain attacks.
693 * @brief Set the local gensec address.
695 * @param gensec_security The gensec security context to use.
697 * @param remote The local address to set.
699 * @return On success NT_STATUS_OK is returned or an NT_STATUS
702 _PUBLIC_ NTSTATUS
gensec_set_local_address(struct gensec_security
*gensec_security
,
703 const struct tsocket_address
*local
)
705 TALLOC_FREE(gensec_security
->local_addr
);
711 gensec_security
->local_addr
= tsocket_address_copy(local
, gensec_security
);
712 if (gensec_security
->local_addr
== NULL
) {
713 return NT_STATUS_NO_MEMORY
;
720 * @brief Set the remote gensec address.
722 * @param gensec_security The gensec security context to use.
724 * @param remote The remote address to set.
726 * @return On success NT_STATUS_OK is returned or an NT_STATUS
729 _PUBLIC_ NTSTATUS
gensec_set_remote_address(struct gensec_security
*gensec_security
,
730 const struct tsocket_address
*remote
)
732 TALLOC_FREE(gensec_security
->remote_addr
);
734 if (remote
== NULL
) {
738 gensec_security
->remote_addr
= tsocket_address_copy(remote
, gensec_security
);
739 if (gensec_security
->remote_addr
== NULL
) {
740 return NT_STATUS_NO_MEMORY
;
747 * @brief Get the local address from a gensec security context.
749 * @param gensec_security The security context to get the address from.
751 * @return The address as tsocket_address which could be NULL if
754 _PUBLIC_
const struct tsocket_address
*gensec_get_local_address(struct gensec_security
*gensec_security
)
756 if (gensec_security
== NULL
) {
759 return gensec_security
->local_addr
;
763 * @brief Get the remote address from a gensec security context.
765 * @param gensec_security The security context to get the address from.
767 * @return The address as tsocket_address which could be NULL if
770 _PUBLIC_
const struct tsocket_address
*gensec_get_remote_address(struct gensec_security
*gensec_security
)
772 if (gensec_security
== NULL
) {
775 return gensec_security
->remote_addr
;
779 * Set the target principal (assuming it it known, say from the SPNEGO reply)
780 * - ensures it is talloc()ed
784 _PUBLIC_ NTSTATUS
gensec_set_target_principal(struct gensec_security
*gensec_security
, const char *principal
)
786 gensec_security
->target
.principal
= talloc_strdup(gensec_security
, principal
);
787 if (!gensec_security
->target
.principal
) {
788 return NT_STATUS_NO_MEMORY
;
793 _PUBLIC_
const char *gensec_get_target_principal(struct gensec_security
*gensec_security
)
795 if (gensec_security
->target
.principal
) {
796 return gensec_security
->target
.principal
;