source3/lib/tldap_gensec_bind.c

   1 /*
   2  * Unix SMB/CIFS implementation.
   3  * Gensec based tldap auth
   4  * Copyright (C) Volker Lendecke 2015
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "tldap_gensec_bind.h"
  21 #include "tldap_util.h"
  22 #include "lib/util/tevent_unix.h"
  23 #include "lib/util/talloc_stack.h"
  24 #include "lib/util/samba_util.h"
  25 #include "lib/util/debug.h"
  26 #include "auth/gensec/gensec.h"
  27 #include "auth/gensec/gensec_internal.h" /* TODO: remove this */
  28 #include "lib/param/param.h"
  29 #include "source4/auth/gensec/gensec_tstream.h"
  30
  31 struct tldap_gensec_bind_state {
  32         struct tevent_context *ev;
  33         struct tldap_context *ctx;
  34         struct cli_credentials *creds;
  35         const char *target_service;
  36         const char *target_hostname;
  37         const char *target_principal;
  38         struct loadparm_context *lp_ctx;
  39         uint32_t gensec_features;
  40
  41         bool first;
  42         struct gensec_security *gensec;
  43         NTSTATUS gensec_status;
  44         DATA_BLOB gensec_output;
  45 };
  46
  47 static void tldap_gensec_bind_got_mechs(struct tevent_req *subreq);
  48 static void tldap_gensec_update_done(struct tldap_gensec_bind_state *state,
  49                                 struct tevent_req *subreq);
  50 static void tldap_gensec_bind_done(struct tevent_req *subreq);
  51
  52 static struct tevent_req *tldap_gensec_bind_send(
  53         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
  54         struct tldap_context *ctx, struct cli_credentials *creds,
  55         const char *target_service, const char *target_hostname,
  56         const char *target_principal, struct loadparm_context *lp_ctx,
  57         uint32_t gensec_features)
  58 {
  59         struct tevent_req *req, *subreq;
  60         struct tldap_gensec_bind_state *state;
  61
  62         const char *attrs[] = { "supportedSASLMechanisms" };
  63
  64         req = tevent_req_create(mem_ctx, &state,
  65                                 struct tldap_gensec_bind_state);
  66         if (req == NULL) {
  67                 return NULL;
  68         }
  69         state->ev = ev;
  70         state->ctx = ctx;
  71         state->creds = creds;
  72         state->target_service = target_service;
  73         state->target_hostname = target_hostname;
  74         state->target_principal = target_principal;
  75         state->lp_ctx = lp_ctx;
  76         state->gensec_features = gensec_features;
  77         state->first = true;
  78
  79         subreq = tldap_search_all_send(
  80                 state, state->ev, state->ctx, "", TLDAP_SCOPE_BASE,
  81                 "(objectclass=*)", attrs, ARRAY_SIZE(attrs),
  82                 false, NULL, 0, NULL, 0, 0, 1 /* sizelimit */, 0);
  83         if (tevent_req_nomem(subreq, req)) {
  84                 return tevent_req_post(req, ev);
  85         }
  86         tevent_req_set_callback(subreq, tldap_gensec_bind_got_mechs, req);
  87         return req;
  88 }
  89
  90 static void tldap_gensec_bind_got_mechs(struct tevent_req *subreq)
  91 {
  92         struct tevent_req *req = tevent_req_callback_data(
  93                 subreq, struct tevent_req);
  94         struct tldap_gensec_bind_state *state = tevent_req_data(
  95                 req, struct tldap_gensec_bind_state);
  96         struct tldap_message **msgs, *msg, *result;
  97         struct tldap_attribute *attribs, *attrib;
  98         int num_attribs;
  99         size_t num_msgs;
 100         TLDAPRC rc;
 101         int i;
 102         bool ok;
 103         const char **sasl_mechs;
 104         NTSTATUS status;
 105
 106         rc = tldap_search_all_recv(subreq, state, &msgs, &result);
 107         TALLOC_FREE(subreq);
 108         if (tevent_req_ldap_error(req, rc)) {
 109                 return;
 110         }
 111
 112         /*
 113          * TODO: Inspect "Result"
 114          */
 115
 116         num_msgs = talloc_array_length(msgs);
 117         if (num_msgs != 1) {
 118                 DBG_DEBUG("num_msgs = %zu\n", num_msgs);
 119                 tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
 120                 return;
 121         }
 122         msg = msgs[0];
 123
 124         ok = tldap_entry_attributes(msg, &attribs, &num_attribs);
 125         if (!ok) {
 126                 DBG_DEBUG("tldap_entry_attributes failed\n");
 127                 tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
 128                 return;
 129         }
 130
 131         if (num_attribs != 1) {
 132                 DBG_DEBUG("num_attribs = %d\n", num_attribs);
 133                 tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
 134                 return;
 135         }
 136         attrib = &attribs[0];
 137
 138         sasl_mechs = talloc_array(state, const char *, attrib->num_values+1);
 139         if (tevent_req_nomem(sasl_mechs, req)) {
 140                 return;
 141         }
 142
 143         for (i=0; i<attrib->num_values; i++) {
 144                 DATA_BLOB *v = &attrib->values[i];
 145                 size_t len;
 146
 147                 ok = convert_string_talloc(sasl_mechs, CH_UTF8, CH_UNIX,
 148                                            v->data, v->length,
 149                                            &sasl_mechs[i], &len);
 150                 if (!ok) {
 151                         DBG_DEBUG("convert_string_talloc failed\n");
 152                         tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
 153                         return;
 154                 }
 155         }
 156         sasl_mechs[attrib->num_values] = NULL;
 157
 158         gensec_init();
 159
 160         status = gensec_client_start(
 161                 state, &state->gensec,
 162                 lpcfg_gensec_settings(state, state->lp_ctx));
 163         if (!NT_STATUS_IS_OK(status)) {
 164                 DBG_DEBUG("gensec_client_start failed: %s\n",
 165                           nt_errstr(status));
 166                 tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
 167                 return;
 168         }
 169
 170         status = gensec_set_credentials(state->gensec, state->creds);
 171         if (!NT_STATUS_IS_OK(status)) {
 172                 DBG_DEBUG("gensec_set_credentials failed: %s\n",
 173                           nt_errstr(status));
 174                 tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
 175                 return;
 176         }
 177
 178         status = gensec_set_target_service(state->gensec,
 179                                            state->target_service);
 180         if (!NT_STATUS_IS_OK(status)) {
 181                 DBG_DEBUG("gensec_set_target_service failed: %s\n",
 182                           nt_errstr(status));
 183                 tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
 184                 return;
 185         }
 186
 187         if (state->target_hostname != NULL) {
 188                 status = gensec_set_target_hostname(state->gensec,
 189                                                     state->target_hostname);
 190                 if (!NT_STATUS_IS_OK(status)) {
 191                         DBG_DEBUG("gensec_set_target_hostname failed: %s\n",
 192                                   nt_errstr(status));
 193                         tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
 194                         return;
 195                 }
 196         }
 197
 198         if (state->target_principal != NULL) {
 199                 status = gensec_set_target_principal(state->gensec,
 200                                                      state->target_principal);
 201                 if (!NT_STATUS_IS_OK(status)) {
 202                         DBG_DEBUG("gensec_set_target_principal failed: %s\n",
 203                                   nt_errstr(status));
 204                         tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
 205                         return;
 206                 }
 207         }
 208
 209         gensec_want_feature(state->gensec, state->gensec_features);
 210
 211         status = gensec_start_mech_by_sasl_list(state->gensec, sasl_mechs);
 212         if (!NT_STATUS_IS_OK(status)) {
 213                 DBG_DEBUG("gensec_start_mech_by_sasl_list failed: %s\n",
 214                           nt_errstr(status));
 215                 tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
 216                 return;
 217         }
 218
 219         state->gensec_status = gensec_update(state->gensec, state,
 220                                                 data_blob_null,
 221                                                 &state->gensec_output);
 222         tldap_gensec_update_done(state, req);
 223 }
 224
 225 static void tldap_gensec_update_done(struct tldap_gensec_bind_state *state,
 226                                         struct tevent_req *req)
 227 {
 228         struct tevent_req *subreq;
 229
 230         if (!NT_STATUS_IS_OK(state->gensec_status) &&
 231             !NT_STATUS_EQUAL(state->gensec_status,
 232                              NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 233                 DBG_DEBUG("gensec_update failed: %s\n",
 234                           nt_errstr(state->gensec_status));
 235                 tevent_req_ldap_error(req, TLDAP_INVALID_CREDENTIALS);
 236                 return;
 237         }
 238
 239         if (NT_STATUS_IS_OK(state->gensec_status) &&
 240             (state->gensec_output.length == 0)) {
 241
 242                 if (state->first) {
 243                         tevent_req_ldap_error(req, TLDAP_INVALID_CREDENTIALS);
 244                 } else {
 245                         tevent_req_done(req);
 246                 }
 247                 return;
 248         }
 249
 250         state->first = false;
 251
 252         subreq = tldap_sasl_bind_send(
 253                 state, state->ev, state->ctx, "",
 254                 state->gensec->ops->sasl_name, &state->gensec_output,
 255                 NULL, 0, NULL, 0);
 256         if (tevent_req_nomem(subreq, req)) {
 257                 return;
 258         }
 259         tevent_req_set_callback(subreq, tldap_gensec_bind_done, req);
 260 }
 261
 262 static void tldap_gensec_bind_done(struct tevent_req *subreq)
 263 {
 264         struct tevent_req *req = tevent_req_callback_data(
 265                 subreq, struct tevent_req);
 266         struct tldap_gensec_bind_state *state = tevent_req_data(
 267                 req, struct tldap_gensec_bind_state);
 268         DATA_BLOB input;
 269         TLDAPRC rc;
 270
 271         rc = tldap_sasl_bind_recv(subreq, state, &input);
 272         TALLOC_FREE(subreq);
 273         if (!TLDAP_RC_IS_SUCCESS(rc) &&
 274             !TLDAP_RC_EQUAL(rc, TLDAP_SASL_BIND_IN_PROGRESS)) {
 275                 tevent_req_ldap_error(req, rc);
 276                 return;
 277         }
 278
 279         if (TLDAP_RC_IS_SUCCESS(rc) && NT_STATUS_IS_OK(state->gensec_status)) {
 280                 tevent_req_done(req);
 281                 return;
 282         }
 283
 284         state->gensec_status = gensec_update(state->gensec, state,
 285                                                 input,
 286                                                 &state->gensec_output);
 287         tldap_gensec_update_done(state, req);
 288 }
 289
 290 static TLDAPRC tldap_gensec_bind_recv(struct tevent_req *req)
 291 {
 292         struct tldap_gensec_bind_state *state = tevent_req_data(
 293                 req, struct tldap_gensec_bind_state);
 294         struct tstream_context *plain, *sec;
 295         NTSTATUS status;
 296         TLDAPRC rc;
 297
 298         if (tevent_req_is_ldap_error(req, &rc)) {
 299                 return rc;
 300         }
 301
 302         if ((state->gensec_features & GENSEC_FEATURE_SIGN) &&
 303             !gensec_have_feature(state->gensec, GENSEC_FEATURE_SIGN)) {
 304                 return TLDAP_OPERATIONS_ERROR;
 305         }
 306         if ((state->gensec_features & GENSEC_FEATURE_SEAL) &&
 307             !gensec_have_feature(state->gensec, GENSEC_FEATURE_SEAL)) {
 308                 return TLDAP_OPERATIONS_ERROR;
 309         }
 310
 311         if (!gensec_have_feature(state->gensec, GENSEC_FEATURE_SIGN) &&
 312             !gensec_have_feature(state->gensec, GENSEC_FEATURE_SEAL)) {
 313                 return TLDAP_SUCCESS;
 314         }
 315
 316         /*
 317          * The gensec ctx needs to survive as long as the ldap context
 318          * lives
 319          */
 320         talloc_steal(state->ctx, state->gensec);
 321
 322         plain = tldap_get_tstream(state->ctx);
 323
 324         status = gensec_create_tstream(state->ctx, state->gensec,
 325                                        plain, &sec);
 326         if (!NT_STATUS_IS_OK(status)) {
 327                 DBG_DEBUG("gensec_create_tstream failed: %s\n",
 328                           nt_errstr(status));
 329                 return TLDAP_OPERATIONS_ERROR;
 330         }
 331
 332         tldap_set_tstream(state->ctx, sec);
 333
 334         return TLDAP_SUCCESS;
 335 }
 336
 337 TLDAPRC tldap_gensec_bind(
 338         struct tldap_context *ctx, struct cli_credentials *creds,
 339         const char *target_service, const char *target_hostname,
 340         const char *target_principal, struct loadparm_context *lp_ctx,
 341         uint32_t gensec_features)
 342 {
 343         TALLOC_CTX *frame = talloc_stackframe();
 344         struct tevent_context *ev;
 345         struct tevent_req *req;
 346         TLDAPRC rc = TLDAP_NO_MEMORY;
 347
 348         ev = samba_tevent_context_init(frame);
 349         if (ev == NULL) {
 350                 goto fail;
 351         }
 352         req = tldap_gensec_bind_send(frame, ev, ctx, creds, target_service,
 353                                      target_hostname, target_principal, lp_ctx,
 354                                      gensec_features);
 355         if (req == NULL) {
 356                 goto fail;
 357         }
 358         if (!tevent_req_poll(req, ev)) {
 359                 rc = TLDAP_OPERATIONS_ERROR;
 360                 goto fail;
 361         }
 362         rc = tldap_gensec_bind_recv(req);
 363  fail:
 364         TALLOC_FREE(frame);
 365         return rc;
 366 }