2 Unix SMB/CIFS implementation.
4 Generic Authentication Interface
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/network.h"
25 #define TEVENT_DEPRECATED 1
27 #include "lib/tsocket/tsocket.h"
28 #include "lib/util/tevent_ntstatus.h"
29 #include "auth/gensec/gensec.h"
30 #include "auth/gensec/gensec_internal.h"
31 #include "librpc/gen_ndr/dcerpc.h"
32 #include "auth/common_auth.h"
34 _PRIVATE_ NTSTATUS
gensec_may_reset_crypto(struct gensec_security
*gensec_security
,
37 if (!gensec_security
->ops
->may_reset_crypto
) {
41 return gensec_security
->ops
->may_reset_crypto(gensec_security
, full_reset
);
45 wrappers for the gensec function pointers
47 _PUBLIC_ NTSTATUS
gensec_unseal_packet(struct gensec_security
*gensec_security
,
48 uint8_t *data
, size_t length
,
49 const uint8_t *whole_pdu
, size_t pdu_length
,
52 if (!gensec_security
->ops
->unseal_packet
) {
53 return NT_STATUS_NOT_IMPLEMENTED
;
55 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
56 return NT_STATUS_INVALID_PARAMETER
;
58 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
59 return NT_STATUS_INVALID_PARAMETER
;
61 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_DCE_STYLE
)) {
62 return NT_STATUS_INVALID_PARAMETER
;
65 return gensec_security
->ops
->unseal_packet(gensec_security
,
67 whole_pdu
, pdu_length
,
71 _PUBLIC_ NTSTATUS
gensec_check_packet(struct gensec_security
*gensec_security
,
72 const uint8_t *data
, size_t length
,
73 const uint8_t *whole_pdu
, size_t pdu_length
,
76 if (!gensec_security
->ops
->check_packet
) {
77 return NT_STATUS_NOT_IMPLEMENTED
;
79 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
80 return NT_STATUS_INVALID_PARAMETER
;
83 return gensec_security
->ops
->check_packet(gensec_security
, data
, length
, whole_pdu
, pdu_length
, sig
);
86 _PUBLIC_ NTSTATUS
gensec_seal_packet(struct gensec_security
*gensec_security
,
88 uint8_t *data
, size_t length
,
89 const uint8_t *whole_pdu
, size_t pdu_length
,
92 if (!gensec_security
->ops
->seal_packet
) {
93 return NT_STATUS_NOT_IMPLEMENTED
;
95 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
96 return NT_STATUS_INVALID_PARAMETER
;
98 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
99 return NT_STATUS_INVALID_PARAMETER
;
101 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_DCE_STYLE
)) {
102 return NT_STATUS_INVALID_PARAMETER
;
105 return gensec_security
->ops
->seal_packet(gensec_security
, mem_ctx
, data
, length
, whole_pdu
, pdu_length
, sig
);
108 _PUBLIC_ NTSTATUS
gensec_sign_packet(struct gensec_security
*gensec_security
,
110 const uint8_t *data
, size_t length
,
111 const uint8_t *whole_pdu
, size_t pdu_length
,
114 if (!gensec_security
->ops
->sign_packet
) {
115 return NT_STATUS_NOT_IMPLEMENTED
;
117 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
118 return NT_STATUS_INVALID_PARAMETER
;
121 return gensec_security
->ops
->sign_packet(gensec_security
, mem_ctx
, data
, length
, whole_pdu
, pdu_length
, sig
);
124 _PUBLIC_
size_t gensec_sig_size(struct gensec_security
*gensec_security
, size_t data_size
)
126 if (!gensec_security
->ops
->sig_size
) {
129 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
132 if (gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
133 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_DCE_STYLE
)) {
138 return gensec_security
->ops
->sig_size(gensec_security
, data_size
);
141 _PUBLIC_
size_t gensec_max_wrapped_size(struct gensec_security
*gensec_security
)
143 if (!gensec_security
->ops
->max_wrapped_size
) {
147 return gensec_security
->ops
->max_wrapped_size(gensec_security
);
150 _PUBLIC_
size_t gensec_max_input_size(struct gensec_security
*gensec_security
)
152 if (!gensec_security
->ops
->max_input_size
) {
153 return (1 << 17) - gensec_sig_size(gensec_security
, 1 << 17);
156 return gensec_security
->ops
->max_input_size(gensec_security
);
159 _PUBLIC_ NTSTATUS
gensec_wrap(struct gensec_security
*gensec_security
,
164 if (!gensec_security
->ops
->wrap
) {
165 return NT_STATUS_NOT_IMPLEMENTED
;
167 return gensec_security
->ops
->wrap(gensec_security
, mem_ctx
, in
, out
);
170 _PUBLIC_ NTSTATUS
gensec_unwrap(struct gensec_security
*gensec_security
,
175 if (!gensec_security
->ops
->unwrap
) {
176 return NT_STATUS_NOT_IMPLEMENTED
;
178 return gensec_security
->ops
->unwrap(gensec_security
, mem_ctx
, in
, out
);
181 _PUBLIC_ NTSTATUS
gensec_session_key(struct gensec_security
*gensec_security
,
183 DATA_BLOB
*session_key
)
185 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SESSION_KEY
)) {
186 return NT_STATUS_NO_USER_SESSION_KEY
;
189 if (!gensec_security
->ops
->session_key
) {
190 return NT_STATUS_NOT_IMPLEMENTED
;
193 return gensec_security
->ops
->session_key(gensec_security
, mem_ctx
, session_key
);
196 const char *gensec_final_auth_type(struct gensec_security
*gensec_security
)
198 if (!gensec_security
->ops
->final_auth_type
) {
199 return gensec_security
->ops
->name
;
202 return gensec_security
->ops
->final_auth_type(gensec_security
);
206 * Log details of a successful GENSEC authorization to a service.
208 * Only successful authorizations are logged, as only these call gensec_session_info()
210 * The service may later refuse authorization due to an ACL.
213 static void log_successful_gensec_authz_event(struct gensec_security
*gensec_security
,
214 struct auth_session_info
*session_info
)
216 const struct tsocket_address
*remote
217 = gensec_get_remote_address(gensec_security
);
218 const struct tsocket_address
*local
219 = gensec_get_local_address(gensec_security
);
220 const char *service_description
221 = gensec_get_target_service_description(gensec_security
);
222 const char *final_auth_type
223 = gensec_final_auth_type(gensec_security
);
224 const char *transport_protection
= NULL
;
225 if (gensec_security
->want_features
& GENSEC_FEATURE_SMB_TRANSPORT
) {
226 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SMB
;
227 } else if (gensec_security
->want_features
& GENSEC_FEATURE_LDAPS_TRANSPORT
) {
228 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_TLS
;
229 } else if (gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
230 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SEAL
;
231 } else if (gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
232 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_SIGN
;
234 transport_protection
= AUTHZ_TRANSPORT_PROTECTION_NONE
;
236 log_successful_authz_event(gensec_security
->auth_context
->msg_ctx
,
237 gensec_security
->auth_context
->lp_ctx
,
241 transport_protection
,
247 * Return the credentials of a logged on user, including session keys
250 * Only valid after a successful authentication
252 * May only be called once per authentication. This will also make an
253 * authorization log entry, as it is already called by all the
258 _PUBLIC_ NTSTATUS
gensec_session_info(struct gensec_security
*gensec_security
,
260 struct auth_session_info
**session_info
)
263 if (!gensec_security
->ops
->session_info
) {
264 return NT_STATUS_NOT_IMPLEMENTED
;
266 status
= gensec_security
->ops
->session_info(gensec_security
, mem_ctx
, session_info
);
268 if (NT_STATUS_IS_OK(status
) && !gensec_security
->subcontext
269 && (gensec_security
->want_features
& GENSEC_FEATURE_NO_AUTHZ_LOG
) == 0) {
270 log_successful_gensec_authz_event(gensec_security
, *session_info
);
276 _PUBLIC_
void gensec_set_max_update_size(struct gensec_security
*gensec_security
,
277 uint32_t max_update_size
)
279 gensec_security
->max_update_size
= max_update_size
;
282 _PUBLIC_
size_t gensec_max_update_size(struct gensec_security
*gensec_security
)
284 if (gensec_security
->max_update_size
== 0) {
288 return gensec_security
->max_update_size
;
291 static NTSTATUS
gensec_verify_features(struct gensec_security
*gensec_security
)
294 * gensec_want_feature(GENSEC_FEATURE_SIGN)
296 * gensec_want_feature(GENSEC_FEATURE_SEAL)
297 * require these flags to be available.
299 if (gensec_security
->want_features
& GENSEC_FEATURE_SIGN
) {
300 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
301 DEBUG(0,("Did not manage to negotiate mandatory feature "
303 return NT_STATUS_ACCESS_DENIED
;
306 if (gensec_security
->want_features
& GENSEC_FEATURE_SEAL
) {
307 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SEAL
)) {
308 DEBUG(0,("Did not manage to negotiate mandatory feature "
310 return NT_STATUS_ACCESS_DENIED
;
312 if (!gensec_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
313 DEBUG(0,("Did not manage to negotiate mandatory feature "
315 return NT_STATUS_ACCESS_DENIED
;
322 _PUBLIC_ NTSTATUS
gensec_update_ev(struct gensec_security
*gensec_security
,
323 TALLOC_CTX
*out_mem_ctx
,
324 struct tevent_context
*ev
,
325 const DATA_BLOB in
, DATA_BLOB
*out
)
328 const struct gensec_security_ops
*ops
= gensec_security
->ops
;
329 TALLOC_CTX
*frame
= NULL
;
330 struct tevent_req
*subreq
= NULL
;
333 if (gensec_security
->child_security
!= NULL
) {
334 return NT_STATUS_INVALID_PARAMETER
;
337 frame
= talloc_stackframe();
340 ev
= samba_tevent_context_init(frame
);
342 status
= NT_STATUS_NO_MEMORY
;
347 * TODO: remove this hack once the backends
350 tevent_loop_allow_nesting(ev
);
353 subreq
= ops
->update_send(frame
, ev
, gensec_security
, in
);
354 if (subreq
== NULL
) {
355 status
= NT_STATUS_NO_MEMORY
;
358 ok
= tevent_req_poll_ntstatus(subreq
, ev
, &status
);
362 status
= ops
->update_recv(subreq
, out_mem_ctx
, out
);
363 if (!NT_STATUS_IS_OK(status
)) {
368 * Because callers using the
369 * gensec_start_mech_by_auth_type() never call
370 * gensec_want_feature(), it isn't sensible for them
371 * to have to call gensec_have_feature() manually, and
372 * these are not points of negotiation, but are
373 * asserted by the client
375 status
= gensec_verify_features(gensec_security
);
382 * Next state function for the GENSEC state machine
384 * @param gensec_security GENSEC State
385 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
386 * @param in The request, as a DATA_BLOB
387 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
388 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
389 * or NT_STATUS_OK if the user is authenticated.
392 _PUBLIC_ NTSTATUS
gensec_update(struct gensec_security
*gensec_security
,
393 TALLOC_CTX
*out_mem_ctx
,
394 const DATA_BLOB in
, DATA_BLOB
*out
)
396 return gensec_update_ev(gensec_security
, out_mem_ctx
, NULL
, in
, out
);
399 struct gensec_update_state
{
400 const struct gensec_security_ops
*ops
;
401 struct gensec_security
*gensec_security
;
406 static void gensec_update_done(struct tevent_req
*subreq
);
409 * Next state function for the GENSEC state machine async version
411 * @param mem_ctx The memory context for the request
412 * @param ev The event context for the request
413 * @param gensec_security GENSEC State
414 * @param in The request, as a DATA_BLOB
416 * @return The request handle or NULL on no memory failure
419 _PUBLIC_
struct tevent_req
*gensec_update_send(TALLOC_CTX
*mem_ctx
,
420 struct tevent_context
*ev
,
421 struct gensec_security
*gensec_security
,
424 struct tevent_req
*req
= NULL
;
425 struct gensec_update_state
*state
= NULL
;
426 struct tevent_req
*subreq
= NULL
;
428 req
= tevent_req_create(mem_ctx
, &state
,
429 struct gensec_update_state
);
434 state
->ops
= gensec_security
->ops
;
435 state
->gensec_security
= gensec_security
;
437 if (gensec_security
->child_security
!= NULL
) {
438 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
439 return tevent_req_post(req
, ev
);
442 subreq
= state
->ops
->update_send(state
, ev
, gensec_security
, in
);
443 if (tevent_req_nomem(subreq
, req
)) {
444 return tevent_req_post(req
, ev
);
446 tevent_req_set_callback(subreq
, gensec_update_done
, req
);
451 static void gensec_update_done(struct tevent_req
*subreq
)
453 struct tevent_req
*req
=
454 tevent_req_callback_data(subreq
,
456 struct gensec_update_state
*state
=
458 struct gensec_update_state
);
461 status
= state
->ops
->update_recv(subreq
, state
, &state
->out
);
463 state
->status
= status
;
464 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
465 tevent_req_done(req
);
468 if (tevent_req_nterror(req
, status
)) {
473 * Because callers using the
474 * gensec_start_mech_by_authtype() never call
475 * gensec_want_feature(), it isn't sensible for them
476 * to have to call gensec_have_feature() manually, and
477 * these are not points of negotiation, but are
478 * asserted by the client
480 status
= gensec_verify_features(state
->gensec_security
);
481 if (tevent_req_nterror(req
, status
)) {
485 tevent_req_done(req
);
489 * Next state function for the GENSEC state machine
491 * @param req request state
492 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
493 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
494 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
495 * or NT_STATUS_OK if the user is authenticated.
497 _PUBLIC_ NTSTATUS
gensec_update_recv(struct tevent_req
*req
,
498 TALLOC_CTX
*out_mem_ctx
,
501 struct gensec_update_state
*state
=
502 tevent_req_data(req
, struct gensec_update_state
);
505 *out
= data_blob_null
;
507 if (tevent_req_is_nterror(req
, &status
)) {
508 tevent_req_received(req
);
513 talloc_steal(out_mem_ctx
, out
->data
);
514 status
= state
->status
;
515 tevent_req_received(req
);
520 * Set the requirement for a certain feature on the connection
524 _PUBLIC_
void gensec_want_feature(struct gensec_security
*gensec_security
,
527 if (!gensec_security
->ops
|| !gensec_security
->ops
->want_feature
) {
528 gensec_security
->want_features
|= feature
;
531 gensec_security
->ops
->want_feature(gensec_security
, feature
);
535 * Check the requirement for a certain feature on the connection
539 _PUBLIC_
bool gensec_have_feature(struct gensec_security
*gensec_security
,
542 if (!gensec_security
->ops
|| !gensec_security
->ops
->have_feature
) {
546 /* We might 'have' features that we don't 'want', because the
547 * other end demanded them, or we can't neotiate them off */
548 return gensec_security
->ops
->have_feature(gensec_security
, feature
);
551 _PUBLIC_ NTTIME
gensec_expire_time(struct gensec_security
*gensec_security
)
553 if (!gensec_security
->ops
->expire_time
) {
554 return GENSEC_EXPIRE_TIME_INFINITY
;
557 return gensec_security
->ops
->expire_time(gensec_security
);
560 * Return the credentials structure associated with a GENSEC context
564 _PUBLIC_
struct cli_credentials
*gensec_get_credentials(struct gensec_security
*gensec_security
)
566 if (!gensec_security
) {
569 return gensec_security
->credentials
;
573 * Set the target service (such as 'http' or 'host') on a GENSEC context - ensures it is talloc()ed
575 * This is used for Kerberos service principal name resolution.
578 _PUBLIC_ NTSTATUS
gensec_set_target_service(struct gensec_security
*gensec_security
, const char *service
)
580 gensec_security
->target
.service
= talloc_strdup(gensec_security
, service
);
581 if (!gensec_security
->target
.service
) {
582 return NT_STATUS_NO_MEMORY
;
587 _PUBLIC_
const char *gensec_get_target_service(struct gensec_security
*gensec_security
)
589 if (gensec_security
->target
.service
) {
590 return gensec_security
->target
.service
;
597 * Set the target service (such as 'samr') on an GENSEC context - ensures it is talloc()ed.
599 * This is not the Kerberos service principal, instead this is a
600 * constant value that can be logged as part of authentication and
601 * authorization logging
603 _PUBLIC_ NTSTATUS
gensec_set_target_service_description(struct gensec_security
*gensec_security
,
606 gensec_security
->target
.service_description
= talloc_strdup(gensec_security
, service
);
607 if (!gensec_security
->target
.service_description
) {
608 return NT_STATUS_NO_MEMORY
;
613 _PUBLIC_
const char *gensec_get_target_service_description(struct gensec_security
*gensec_security
)
615 if (gensec_security
->target
.service_description
) {
616 return gensec_security
->target
.service_description
;
617 } else if (gensec_security
->target
.service
) {
618 return gensec_security
->target
.service
;
625 * Set the target hostname (suitable for kerberos resolutation) on a GENSEC context - ensures it is talloc()ed
629 _PUBLIC_ NTSTATUS
gensec_set_target_hostname(struct gensec_security
*gensec_security
, const char *hostname
)
631 gensec_security
->target
.hostname
= talloc_strdup(gensec_security
, hostname
);
632 if (hostname
&& !gensec_security
->target
.hostname
) {
633 return NT_STATUS_NO_MEMORY
;
638 _PUBLIC_
const char *gensec_get_target_hostname(struct gensec_security
*gensec_security
)
640 /* We allow the target hostname to be overridden for testing purposes */
641 if (gensec_security
->settings
->target_hostname
) {
642 return gensec_security
->settings
->target_hostname
;
645 if (gensec_security
->target
.hostname
) {
646 return gensec_security
->target
.hostname
;
649 /* We could add use the 'set sockaddr' call, and do a reverse
650 * lookup, but this would be both insecure (compromising the
651 * way kerberos works) and add DNS timeouts */
656 * Set (and copy) local and peer socket addresses onto a socket
657 * context on the GENSEC context.
659 * This is so that kerberos can include these addresses in
660 * cryptographic tokens, to avoid certain attacks.
664 * @brief Set the local gensec address.
666 * @param gensec_security The gensec security context to use.
668 * @param remote The local address to set.
670 * @return On success NT_STATUS_OK is returned or an NT_STATUS
673 _PUBLIC_ NTSTATUS
gensec_set_local_address(struct gensec_security
*gensec_security
,
674 const struct tsocket_address
*local
)
676 TALLOC_FREE(gensec_security
->local_addr
);
682 gensec_security
->local_addr
= tsocket_address_copy(local
, gensec_security
);
683 if (gensec_security
->local_addr
== NULL
) {
684 return NT_STATUS_NO_MEMORY
;
691 * @brief Set the remote gensec address.
693 * @param gensec_security The gensec security context to use.
695 * @param remote The remote address to set.
697 * @return On success NT_STATUS_OK is returned or an NT_STATUS
700 _PUBLIC_ NTSTATUS
gensec_set_remote_address(struct gensec_security
*gensec_security
,
701 const struct tsocket_address
*remote
)
703 TALLOC_FREE(gensec_security
->remote_addr
);
705 if (remote
== NULL
) {
709 gensec_security
->remote_addr
= tsocket_address_copy(remote
, gensec_security
);
710 if (gensec_security
->remote_addr
== NULL
) {
711 return NT_STATUS_NO_MEMORY
;
718 * @brief Get the local address from a gensec security context.
720 * @param gensec_security The security context to get the address from.
722 * @return The address as tsocket_address which could be NULL if
725 _PUBLIC_
const struct tsocket_address
*gensec_get_local_address(struct gensec_security
*gensec_security
)
727 if (gensec_security
== NULL
) {
730 return gensec_security
->local_addr
;
734 * @brief Get the remote address from a gensec security context.
736 * @param gensec_security The security context to get the address from.
738 * @return The address as tsocket_address which could be NULL if
741 _PUBLIC_
const struct tsocket_address
*gensec_get_remote_address(struct gensec_security
*gensec_security
)
743 if (gensec_security
== NULL
) {
746 return gensec_security
->remote_addr
;
750 * Set the target principal (assuming it it known, say from the SPNEGO reply)
751 * - ensures it is talloc()ed
755 _PUBLIC_ NTSTATUS
gensec_set_target_principal(struct gensec_security
*gensec_security
, const char *principal
)
757 gensec_security
->target
.principal
= talloc_strdup(gensec_security
, principal
);
758 if (!gensec_security
->target
.principal
) {
759 return NT_STATUS_NO_MEMORY
;
764 _PUBLIC_
const char *gensec_get_target_principal(struct gensec_security
*gensec_security
)
766 if (gensec_security
->target
.principal
) {
767 return gensec_security
->target
.principal
;