2 Unix SMB/CIFS implementation.
4 Generic Authentication Interface
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/network.h"
25 #define TEVENT_DEPRECATED 1
27 #include "lib/tsocket/tsocket.h"
28 #include "lib/util/tevent_ntstatus.h"
29 #include "auth/gensec/gensec.h"
30 #include "auth/gensec/gensec_internal.h"
31 #include "librpc/gen_ndr/dcerpc.h"
32 #include "auth/common_auth.h"
34 _PRIVATE_ NTSTATUS
gensec_may_reset_crypto(struct gensec_security
*gensec_security
,
37 if (!gensec_security
->ops
->may_reset_crypto
) {
41 return gensec_security
->ops
->may_reset_crypto(gensec_security
, full_reset
);
45 wrappers for the gensec function pointers
47 _PUBLIC_ NTSTATUS
gensec_unseal_packet(struct gensec_security
*gensec_security
,
48 uint8_t *data
, size_t length
,
49 const uint8_t *whole_pdu
, size_t pdu_length
,
52 if (!gensec_security
->ops
->unseal_packet
) {
53 return NT_STATUS_NOT_IMPLEMENTED
;
55 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
56 return NT_STATUS_INVALID_PARAMETER
;
58 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
59 return NT_STATUS_INVALID_PARAMETER
;
61 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_DCE_STYLE
)) {
62 return NT_STATUS_INVALID_PARAMETER
;
65 return gensec_security
->ops
->unseal_packet(gensec_security
,
67 whole_pdu
, pdu_length
,
71 _PUBLIC_ NTSTATUS
gensec_check_packet(struct gensec_security
*gensec_security
,
72 const uint8_t *data
, size_t length
,
73 const uint8_t *whole_pdu
, size_t pdu_length
,
76 if (!gensec_security
->ops
->check_packet
) {
77 return NT_STATUS_NOT_IMPLEMENTED
;
79 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
80 return NT_STATUS_INVALID_PARAMETER
;
83 return gensec_security
->ops
->check_packet(gensec_security
, data
, length
, whole_pdu
, pdu_length
, sig
);
86 _PUBLIC_ NTSTATUS
gensec_seal_packet(struct gensec_security
*gensec_security
,
88 uint8_t *data
, size_t length
,
89 const uint8_t *whole_pdu
, size_t pdu_length
,
92 if (!gensec_security
->ops
->seal_packet
) {
93 return NT_STATUS_NOT_IMPLEMENTED
;
95 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
96 return NT_STATUS_INVALID_PARAMETER
;
98 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
99 return NT_STATUS_INVALID_PARAMETER
;
101 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_DCE_STYLE
)) {
102 return NT_STATUS_INVALID_PARAMETER
;
105 return gensec_security
->ops
->seal_packet(gensec_security
, mem_ctx
, data
, length
, whole_pdu
, pdu_length
, sig
);
108 _PUBLIC_ NTSTATUS
gensec_sign_packet(struct gensec_security
*gensec_security
,
110 const uint8_t *data
, size_t length
,
111 const uint8_t *whole_pdu
, size_t pdu_length
,
114 if (!gensec_security
->ops
->sign_packet
) {
115 return NT_STATUS_NOT_IMPLEMENTED
;
117 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
118 return NT_STATUS_INVALID_PARAMETER
;
121 return gensec_security
->ops
->sign_packet(gensec_security
, mem_ctx
, data
, length
, whole_pdu
, pdu_length
, sig
);
124 _PUBLIC_
size_t gensec_sig_size(struct gensec_security
*gensec_security
, size_t data_size
)
126 if (!gensec_security
->ops
->sig_size
) {
129 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
132 if (gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
133 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_DCE_STYLE
)) {
138 return gensec_security
->ops
->sig_size(gensec_security
, data_size
);
141 _PUBLIC_
size_t gensec_max_wrapped_size(struct gensec_security
*gensec_security
)
143 if (!gensec_security
->ops
->max_wrapped_size
) {
147 return gensec_security
->ops
->max_wrapped_size(gensec_security
);
150 _PUBLIC_
size_t gensec_max_input_size(struct gensec_security
*gensec_security
)
152 if (!gensec_security
->ops
->max_input_size
) {
153 return (1 << 17) - gensec_sig_size(gensec_security
, 1 << 17);
156 return gensec_security
->ops
->max_input_size(gensec_security
);
159 _PUBLIC_ NTSTATUS
gensec_wrap(struct gensec_security
*gensec_security
,
164 if (!gensec_security
->ops
->wrap
) {
165 return NT_STATUS_NOT_IMPLEMENTED
;
167 return gensec_security
->ops
->wrap(gensec_security
, mem_ctx
, in
, out
);
170 _PUBLIC_ NTSTATUS
gensec_unwrap(struct gensec_security
*gensec_security
,
175 if (!gensec_security
->ops
->unwrap
) {
176 return NT_STATUS_NOT_IMPLEMENTED
;
178 return gensec_security
->ops
->unwrap(gensec_security
, mem_ctx
, in
, out
);
181 _PUBLIC_ NTSTATUS
gensec_session_key(struct gensec_security
*gensec_security
,
183 DATA_BLOB
*session_key
)
185 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SESSION_KEY
)) {
186 return NT_STATUS_NO_USER_SESSION_KEY
;
189 if (!gensec_security
->ops
->session_key
) {
190 return NT_STATUS_NOT_IMPLEMENTED
;
193 return gensec_security
->ops
->session_key(gensec_security
, mem_ctx
, session_key
);
196 const char *gensec_final_auth_type(struct gensec_security
*gensec_security
)
198 if (!gensec_security
->ops
->final_auth_type
) {
199 return gensec_security
->ops
->name
;
202 return gensec_security
->ops
->final_auth_type(gensec_security
);
206 * Log details of a successful GENSEC authorization to a service.
208 * Only successful authorizations are logged, as only these call gensec_session_info()
210 * The service may later refuse authorization due to an ACL.
213 static void log_successful_gensec_authz_event(struct gensec_security
*gensec_security
,
214 struct auth_session_info
*session_info
)
216 const struct tsocket_address
*remote
217 = gensec_get_remote_address(gensec_security
);
218 const struct tsocket_address
*local
219 = gensec_get_local_address(gensec_security
);
220 const char *service_description
221 = gensec_get_target_service_description(gensec_security
);
222 const char *final_auth_type
223 = gensec_final_auth_type(gensec_security
);
224 const char *transport_protection
= NULL
;
225 if (gensec_security
->want_features
& GENSEC_FEATURE_SMB_TRANSPORT
) {
226 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SMB
;
227 } else if (gensec_security
->want_features
& GENSEC_FEATURE_LDAPS_TRANSPORT
) {
228 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_TLS
;
229 } else if (gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
230 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SEAL
;
231 } else if (gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
232 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SIGN
;
234 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_NONE
;
236 log_successful_authz_event(gensec_security
->auth_context
->msg_ctx
,
237 gensec_security
->auth_context
->lp_ctx
,
241 transport_protection
,
247 * Return the credentials of a logged on user, including session keys
250 * Only valid after a successful authentication
252 * May only be called once per authentication. This will also make an
253 * authorization log entry, as it is already called by all the
258 _PUBLIC_ NTSTATUS
gensec_session_info(struct gensec_security
*gensec_security
,
260 struct auth_session_info
**session_info
)
263 if (!gensec_security
->ops
->session_info
) {
264 return NT_STATUS_NOT_IMPLEMENTED
;
266 status
= gensec_security
->ops
->session_info(gensec_security
, mem_ctx
, session_info
);
268 if (NT_STATUS_IS_OK(status
) && !gensec_security
->subcontext
269 && (gensec_security
->want_features
& GENSEC_FEATURE_NO_AUTHZ_LOG
) == 0) {
270 log_successful_gensec_authz_event(gensec_security
, *session_info
);
276 _PUBLIC_
void gensec_set_max_update_size(struct gensec_security
*gensec_security
,
277 uint32_t max_update_size
)
279 gensec_security
->max_update_size
= max_update_size
;
282 _PUBLIC_
size_t gensec_max_update_size(struct gensec_security
*gensec_security
)
284 if (gensec_security
->max_update_size
== 0) {
288 return gensec_security
->max_update_size
;
291 static NTSTATUS
gensec_verify_features(struct gensec_security
*gensec_security
)
294 * gensec_want_feature(GENSEC_FEATURE_SIGN)
296 * gensec_want_feature(GENSEC_FEATURE_SEAL)
297 * require these flags to be available.
299 if (gensec_security
->want_features
& GENSEC_FEATURE_SIGN
) {
300 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
301 DEBUG(0,("Did not manage to negotiate mandatory feature "
303 return NT_STATUS_ACCESS_DENIED
;
306 if (gensec_security
->want_features
& GENSEC_FEATURE_SEAL
) {
307 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
308 DEBUG(0,("Did not manage to negotiate mandatory feature "
310 return NT_STATUS_ACCESS_DENIED
;
312 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
313 DEBUG(0,("Did not manage to negotiate mandatory feature "
315 return NT_STATUS_ACCESS_DENIED
;
322 _PUBLIC_ NTSTATUS
gensec_update_ev(struct gensec_security
*gensec_security
,
323 TALLOC_CTX
*out_mem_ctx
,
324 struct tevent_context
*ev
,
325 const DATA_BLOB in
, DATA_BLOB
*out
)
328 const struct gensec_security_ops
*ops
= gensec_security
->ops
;
329 TALLOC_CTX
*frame
= NULL
;
330 struct tevent_req
*subreq
= NULL
;
333 if (ops
->update_send
== NULL
) {
336 frame
= talloc_stackframe();
338 ev
= samba_tevent_context_init(frame
);
340 status
= NT_STATUS_NO_MEMORY
;
345 * TODO: remove this hack once the backends
348 tevent_loop_allow_nesting(ev
);
351 status
= ops
->update(gensec_security
, out_mem_ctx
,
354 if (!NT_STATUS_IS_OK(status
)) {
359 * Because callers using the
360 * gensec_start_mech_by_auth_type() never call
361 * gensec_want_feature(), it isn't sensible for them
362 * to have to call gensec_have_feature() manually, and
363 * these are not points of negotiation, but are
364 * asserted by the client
366 status
= gensec_verify_features(gensec_security
);
367 if (!NT_STATUS_IS_OK(status
)) {
374 frame
= talloc_stackframe();
377 ev
= samba_tevent_context_init(frame
);
379 status
= NT_STATUS_NO_MEMORY
;
384 * TODO: remove this hack once the backends
387 tevent_loop_allow_nesting(ev
);
390 subreq
= ops
->update_send(frame
, ev
, gensec_security
, in
);
391 if (subreq
== NULL
) {
392 status
= NT_STATUS_NO_MEMORY
;
395 ok
= tevent_req_poll_ntstatus(subreq
, ev
, &status
);
399 status
= ops
->update_recv(subreq
, out_mem_ctx
, out
);
406 * Next state function for the GENSEC state machine
408 * @param gensec_security GENSEC State
409 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
410 * @param in The request, as a DATA_BLOB
411 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
412 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
413 * or NT_STATUS_OK if the user is authenticated.
416 _PUBLIC_ NTSTATUS
gensec_update(struct gensec_security
*gensec_security
,
417 TALLOC_CTX
*out_mem_ctx
,
418 const DATA_BLOB in
, DATA_BLOB
*out
)
420 return gensec_update_ev(gensec_security
, out_mem_ctx
, NULL
, in
, out
);
423 struct gensec_update_state
{
424 const struct gensec_security_ops
*ops
;
425 struct tevent_req
*subreq
;
426 struct gensec_security
*gensec_security
;
430 * only for sync backends, we should remove this
431 * once all backends are async.
433 struct tevent_immediate
*im
;
437 static void gensec_update_async_trigger(struct tevent_context
*ctx
,
438 struct tevent_immediate
*im
,
440 static void gensec_update_subreq_done(struct tevent_req
*subreq
);
443 * Next state function for the GENSEC state machine async version
445 * @param mem_ctx The memory context for the request
446 * @param ev The event context for the request
447 * @param gensec_security GENSEC State
448 * @param in The request, as a DATA_BLOB
450 * @return The request handle or NULL on no memory failure
453 _PUBLIC_
struct tevent_req
*gensec_update_send(TALLOC_CTX
*mem_ctx
,
454 struct tevent_context
*ev
,
455 struct gensec_security
*gensec_security
,
458 struct tevent_req
*req
;
459 struct gensec_update_state
*state
= NULL
;
461 req
= tevent_req_create(mem_ctx
, &state
,
462 struct gensec_update_state
);
467 state
->ops
= gensec_security
->ops
;
468 state
->gensec_security
= gensec_security
;
470 if (state
->ops
->update_send
== NULL
) {
472 state
->im
= tevent_create_immediate(state
);
473 if (tevent_req_nomem(state
->im
, req
)) {
474 return tevent_req_post(req
, ev
);
477 tevent_schedule_immediate(state
->im
, ev
,
478 gensec_update_async_trigger
,
484 state
->subreq
= state
->ops
->update_send(state
, ev
, gensec_security
, in
);
485 if (tevent_req_nomem(state
->subreq
, req
)) {
486 return tevent_req_post(req
, ev
);
489 tevent_req_set_callback(state
->subreq
,
490 gensec_update_subreq_done
,
496 static void gensec_update_async_trigger(struct tevent_context
*ctx
,
497 struct tevent_immediate
*im
,
500 struct tevent_req
*req
=
501 talloc_get_type_abort(private_data
, struct tevent_req
);
502 struct gensec_update_state
*state
=
503 tevent_req_data(req
, struct gensec_update_state
);
506 status
= state
->ops
->update(state
->gensec_security
, state
, ctx
,
507 state
->in
, &state
->out
);
508 if (tevent_req_nterror(req
, status
)) {
512 tevent_req_done(req
);
515 static void gensec_update_subreq_done(struct tevent_req
*subreq
)
517 struct tevent_req
*req
=
518 tevent_req_callback_data(subreq
,
520 struct gensec_update_state
*state
=
522 struct gensec_update_state
);
525 state
->subreq
= NULL
;
527 status
= state
->ops
->update_recv(subreq
, state
, &state
->out
);
529 if (tevent_req_nterror(req
, status
)) {
534 * Because callers using the
535 * gensec_start_mech_by_authtype() never call
536 * gensec_want_feature(), it isn't sensible for them
537 * to have to call gensec_have_feature() manually, and
538 * these are not points of negotiation, but are
539 * asserted by the client
541 status
= gensec_verify_features(state
->gensec_security
);
542 if (tevent_req_nterror(req
, status
)) {
546 tevent_req_done(req
);
550 * Next state function for the GENSEC state machine
552 * @param req request state
553 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
554 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
555 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
556 * or NT_STATUS_OK if the user is authenticated.
558 _PUBLIC_ NTSTATUS
gensec_update_recv(struct tevent_req
*req
,
559 TALLOC_CTX
*out_mem_ctx
,
562 struct gensec_update_state
*state
=
563 tevent_req_data(req
, struct gensec_update_state
);
566 if (tevent_req_is_nterror(req
, &status
)) {
567 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
568 tevent_req_received(req
);
572 status
= NT_STATUS_OK
;
576 talloc_steal(out_mem_ctx
, out
->data
);
578 tevent_req_received(req
);
583 * Set the requirement for a certain feature on the connection
587 _PUBLIC_
void gensec_want_feature(struct gensec_security
*gensec_security
,
590 if (!gensec_security
->ops
|| !gensec_security
->ops
->want_feature
) {
591 gensec_security
->want_features
|= feature
;
594 gensec_security
->ops
->want_feature(gensec_security
, feature
);
598 * Check the requirement for a certain feature on the connection
602 _PUBLIC_
bool gensec_have_feature(struct gensec_security
*gensec_security
,
605 if (!gensec_security
->ops
|| !gensec_security
->ops
->have_feature
) {
609 /* We might 'have' features that we don't 'want', because the
610 * other end demanded them, or we can't neotiate them off */
611 return gensec_security
->ops
->have_feature(gensec_security
, feature
);
614 _PUBLIC_ NTTIME
gensec_expire_time(struct gensec_security
*gensec_security
)
616 if (!gensec_security
->ops
->expire_time
) {
617 return GENSEC_EXPIRE_TIME_INFINITY
;
620 return gensec_security
->ops
->expire_time(gensec_security
);
623 * Return the credentials structure associated with a GENSEC context
627 _PUBLIC_
struct cli_credentials
*gensec_get_credentials(struct gensec_security
*gensec_security
)
629 if (!gensec_security
) {
632 return gensec_security
->credentials
;
636 * Set the target service (such as 'http' or 'host') on a GENSEC context - ensures it is talloc()ed
638 * This is used for Kerberos service principal name resolution.
641 _PUBLIC_ NTSTATUS
gensec_set_target_service(struct gensec_security
*gensec_security
, const char *service
)
643 gensec_security
->target
.service
= talloc_strdup(gensec_security
, service
);
644 if (!gensec_security
->target
.service
) {
645 return NT_STATUS_NO_MEMORY
;
650 _PUBLIC_
const char *gensec_get_target_service(struct gensec_security
*gensec_security
)
652 if (gensec_security
->target
.service
) {
653 return gensec_security
->target
.service
;
660 * Set the target service (such as 'samr') on an GENSEC context - ensures it is talloc()ed.
662 * This is not the Kerberos service principal, instead this is a
663 * constant value that can be logged as part of authentication and
664 * authorization logging
666 _PUBLIC_ NTSTATUS
gensec_set_target_service_description(struct gensec_security
*gensec_security
,
669 gensec_security
->target
.service_description
= talloc_strdup(gensec_security
, service
);
670 if (!gensec_security
->target
.service_description
) {
671 return NT_STATUS_NO_MEMORY
;
676 _PUBLIC_
const char *gensec_get_target_service_description(struct gensec_security
*gensec_security
)
678 if (gensec_security
->target
.service_description
) {
679 return gensec_security
->target
.service_description
;
680 } else if (gensec_security
->target
.service
) {
681 return gensec_security
->target
.service
;
688 * Set the target hostname (suitable for kerberos resolutation) on a GENSEC context - ensures it is talloc()ed
692 _PUBLIC_ NTSTATUS
gensec_set_target_hostname(struct gensec_security
*gensec_security
, const char *hostname
)
694 gensec_security
->target
.hostname
= talloc_strdup(gensec_security
, hostname
);
695 if (hostname
&& !gensec_security
->target
.hostname
) {
696 return NT_STATUS_NO_MEMORY
;
701 _PUBLIC_
const char *gensec_get_target_hostname(struct gensec_security
*gensec_security
)
703 /* We allow the target hostname to be overridden for testing purposes */
704 if (gensec_security
->settings
->target_hostname
) {
705 return gensec_security
->settings
->target_hostname
;
708 if (gensec_security
->target
.hostname
) {
709 return gensec_security
->target
.hostname
;
712 /* We could add use the 'set sockaddr' call, and do a reverse
713 * lookup, but this would be both insecure (compromising the
714 * way kerberos works) and add DNS timeouts */
719 * Set (and copy) local and peer socket addresses onto a socket
720 * context on the GENSEC context.
722 * This is so that kerberos can include these addresses in
723 * cryptographic tokens, to avoid certain attacks.
727 * @brief Set the local gensec address.
729 * @param gensec_security The gensec security context to use.
731 * @param remote The local address to set.
733 * @return On success NT_STATUS_OK is returned or an NT_STATUS
736 _PUBLIC_ NTSTATUS
gensec_set_local_address(struct gensec_security
*gensec_security
,
737 const struct tsocket_address
*local
)
739 TALLOC_FREE(gensec_security
->local_addr
);
745 gensec_security
->local_addr
= tsocket_address_copy(local
, gensec_security
);
746 if (gensec_security
->local_addr
== NULL
) {
747 return NT_STATUS_NO_MEMORY
;
754 * @brief Set the remote gensec address.
756 * @param gensec_security The gensec security context to use.
758 * @param remote The remote address to set.
760 * @return On success NT_STATUS_OK is returned or an NT_STATUS
763 _PUBLIC_ NTSTATUS
gensec_set_remote_address(struct gensec_security
*gensec_security
,
764 const struct tsocket_address
*remote
)
766 TALLOC_FREE(gensec_security
->remote_addr
);
768 if (remote
== NULL
) {
772 gensec_security
->remote_addr
= tsocket_address_copy(remote
, gensec_security
);
773 if (gensec_security
->remote_addr
== NULL
) {
774 return NT_STATUS_NO_MEMORY
;
781 * @brief Get the local address from a gensec security context.
783 * @param gensec_security The security context to get the address from.
785 * @return The address as tsocket_address which could be NULL if
788 _PUBLIC_
const struct tsocket_address
*gensec_get_local_address(struct gensec_security
*gensec_security
)
790 if (gensec_security
== NULL
) {
793 return gensec_security
->local_addr
;
797 * @brief Get the remote address from a gensec security context.
799 * @param gensec_security The security context to get the address from.
801 * @return The address as tsocket_address which could be NULL if
804 _PUBLIC_
const struct tsocket_address
*gensec_get_remote_address(struct gensec_security
*gensec_security
)
806 if (gensec_security
== NULL
) {
809 return gensec_security
->remote_addr
;
813 * Set the target principal (assuming it it known, say from the SPNEGO reply)
814 * - ensures it is talloc()ed
818 _PUBLIC_ NTSTATUS
gensec_set_target_principal(struct gensec_security
*gensec_security
, const char *principal
)
820 gensec_security
->target
.principal
= talloc_strdup(gensec_security
, principal
);
821 if (!gensec_security
->target
.principal
) {
822 return NT_STATUS_NO_MEMORY
;
827 _PUBLIC_
const char *gensec_get_target_principal(struct gensec_security
*gensec_security
)
829 if (gensec_security
->target
.principal
) {
830 return gensec_security
->target
.principal
;