libcli/cldap: make use of samba_tevent_context_init()
[Samba/gebeck_regimport.git] / auth / gensec / gensec.h
blobefbbabe171582e5df3df40d78e9a6e60b72c71b2
1 /*
2 Unix SMB/CIFS implementation.
4 Generic Authentication Interface
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #ifndef __GENSEC_H__
24 #define __GENSEC_H__
26 #include "../lib/util/data_blob.h"
27 #include "libcli/util/ntstatus.h"
29 #define GENSEC_SASL_NAME_NTLMSSP "NTLM"
31 #define GENSEC_OID_NTLMSSP "1.3.6.1.4.1.311.2.2.10"
32 #define GENSEC_OID_SPNEGO "1.3.6.1.5.5.2"
33 #define GENSEC_OID_KERBEROS5 "1.2.840.113554.1.2.2"
34 #define GENSEC_OID_KERBEROS5_OLD "1.2.840.48018.1.2.2"
35 #define GENSEC_OID_KERBEROS5_USER2USER "1.2.840.113554.1.2.2.3"
37 enum gensec_priority {
38 GENSEC_SPNEGO = 90,
39 GENSEC_GSSAPI = 80,
40 GENSEC_KRB5 = 70,
41 GENSEC_SCHANNEL = 60,
42 GENSEC_NTLMSSP = 50,
43 GENSEC_SASL = 20,
44 GENSEC_OTHER = 0
47 struct gensec_security;
48 struct gensec_target {
49 const char *principal;
50 const char *hostname;
51 const char *service;
54 #define GENSEC_FEATURE_SESSION_KEY 0x00000001
55 #define GENSEC_FEATURE_SIGN 0x00000002
56 #define GENSEC_FEATURE_SEAL 0x00000004
57 #define GENSEC_FEATURE_DCE_STYLE 0x00000008
58 #define GENSEC_FEATURE_ASYNC_REPLIES 0x00000010
59 #define GENSEC_FEATURE_DATAGRAM_MODE 0x00000020
60 #define GENSEC_FEATURE_SIGN_PKT_HEADER 0x00000040
61 #define GENSEC_FEATURE_NEW_SPNEGO 0x00000080
62 #define GENSEC_FEATURE_UNIX_TOKEN 0x00000100
64 #define GENSEC_EXPIRE_TIME_INFINITY (NTTIME)0x8000000000000000LL
66 /* GENSEC mode */
67 enum gensec_role
69 GENSEC_SERVER,
70 GENSEC_CLIENT
73 struct auth_session_info;
74 struct cli_credentials;
75 struct gensec_settings;
76 struct tevent_context;
77 struct tevent_req;
78 struct smb_krb5_context;
80 struct gensec_settings {
81 struct loadparm_context *lp_ctx;
82 const char *target_hostname;
84 /* this allows callers to specify a specific set of ops that
85 * should be used, rather than those loaded by the plugin
86 * mechanism */
87 struct gensec_security_ops **backends;
89 /* To fill in our own name in the NTLMSSP server */
90 const char *server_dns_domain;
91 const char *server_dns_name;
92 const char *server_netbios_domain;
93 const char *server_netbios_name;
96 struct gensec_security_ops {
97 const char *name;
98 const char *sasl_name;
99 uint8_t auth_type; /* 0 if not offered on DCE-RPC */
100 const char **oid; /* NULL if not offered by SPNEGO */
101 NTSTATUS (*client_start)(struct gensec_security *gensec_security);
102 NTSTATUS (*server_start)(struct gensec_security *gensec_security);
104 Determine if a packet has the right 'magic' for this mechanism
106 NTSTATUS (*magic)(struct gensec_security *gensec_security,
107 const DATA_BLOB *first_packet);
108 NTSTATUS (*update)(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
109 struct tevent_context *ev,
110 const DATA_BLOB in, DATA_BLOB *out);
111 NTSTATUS (*seal_packet)(struct gensec_security *gensec_security, TALLOC_CTX *sig_mem_ctx,
112 uint8_t *data, size_t length,
113 const uint8_t *whole_pdu, size_t pdu_length,
114 DATA_BLOB *sig);
115 NTSTATUS (*sign_packet)(struct gensec_security *gensec_security, TALLOC_CTX *sig_mem_ctx,
116 const uint8_t *data, size_t length,
117 const uint8_t *whole_pdu, size_t pdu_length,
118 DATA_BLOB *sig);
119 size_t (*sig_size)(struct gensec_security *gensec_security, size_t data_size);
120 size_t (*max_input_size)(struct gensec_security *gensec_security);
121 size_t (*max_wrapped_size)(struct gensec_security *gensec_security);
122 NTSTATUS (*check_packet)(struct gensec_security *gensec_security,
123 const uint8_t *data, size_t length,
124 const uint8_t *whole_pdu, size_t pdu_length,
125 const DATA_BLOB *sig);
126 NTSTATUS (*unseal_packet)(struct gensec_security *gensec_security,
127 uint8_t *data, size_t length,
128 const uint8_t *whole_pdu, size_t pdu_length,
129 const DATA_BLOB *sig);
130 NTSTATUS (*wrap)(struct gensec_security *gensec_security,
131 TALLOC_CTX *mem_ctx,
132 const DATA_BLOB *in,
133 DATA_BLOB *out);
134 NTSTATUS (*unwrap)(struct gensec_security *gensec_security,
135 TALLOC_CTX *mem_ctx,
136 const DATA_BLOB *in,
137 DATA_BLOB *out);
138 NTSTATUS (*wrap_packets)(struct gensec_security *gensec_security,
139 TALLOC_CTX *mem_ctx,
140 const DATA_BLOB *in,
141 DATA_BLOB *out,
142 size_t *len_processed);
143 NTSTATUS (*unwrap_packets)(struct gensec_security *gensec_security,
144 TALLOC_CTX *mem_ctx,
145 const DATA_BLOB *in,
146 DATA_BLOB *out,
147 size_t *len_processed);
148 NTSTATUS (*packet_full_request)(struct gensec_security *gensec_security,
149 DATA_BLOB blob, size_t *size);
150 NTSTATUS (*session_key)(struct gensec_security *gensec_security, TALLOC_CTX *mem_ctx,
151 DATA_BLOB *session_key);
152 NTSTATUS (*session_info)(struct gensec_security *gensec_security, TALLOC_CTX *mem_ctx,
153 struct auth_session_info **session_info);
154 void (*want_feature)(struct gensec_security *gensec_security,
155 uint32_t feature);
156 bool (*have_feature)(struct gensec_security *gensec_security,
157 uint32_t feature);
158 NTTIME (*expire_time)(struct gensec_security *gensec_security);
159 bool enabled;
160 bool kerberos;
161 enum gensec_priority priority;
164 struct gensec_security_ops_wrapper {
165 const struct gensec_security_ops *op;
166 const char *oid;
169 #define GENSEC_INTERFACE_VERSION 0
171 struct gensec_security {
172 const struct gensec_security_ops *ops;
173 void *private_data;
174 struct cli_credentials *credentials;
175 struct gensec_target target;
176 enum gensec_role gensec_role;
177 bool subcontext;
178 uint32_t want_features;
179 uint32_t max_update_size;
180 uint8_t dcerpc_auth_level;
181 struct tsocket_address *local_addr, *remote_addr;
182 struct gensec_settings *settings;
184 /* When we are a server, this may be filled in to provide an
185 * NTLM authentication backend, and user lookup (such as if no
186 * PAC is found) */
187 struct auth4_context *auth_context;
190 /* this structure is used by backends to determine the size of some critical types */
191 struct gensec_critical_sizes {
192 int interface_version;
193 int sizeof_gensec_security_ops;
194 int sizeof_gensec_security;
197 /* Socket wrapper */
199 struct gensec_security;
200 struct socket_context;
201 struct auth4_context;
202 struct auth_user_info_dc;
204 /* These functions are for use here only (public because SPNEGO must
205 * use them for recursion) */
206 NTSTATUS gensec_wrap_packets(struct gensec_security *gensec_security,
207 TALLOC_CTX *mem_ctx,
208 const DATA_BLOB *in,
209 DATA_BLOB *out,
210 size_t *len_processed);
211 /* These functions are for use here only (public because SPNEGO must
212 * use them for recursion) */
213 NTSTATUS gensec_unwrap_packets(struct gensec_security *gensec_security,
214 TALLOC_CTX *mem_ctx,
215 const DATA_BLOB *in,
216 DATA_BLOB *out,
217 size_t *len_processed);
219 /* These functions are for use here only (public because SPNEGO must
220 * use them for recursion) */
221 NTSTATUS gensec_packet_full_request(struct gensec_security *gensec_security,
222 DATA_BLOB blob, size_t *size);
224 struct loadparm_context;
226 NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx,
227 struct gensec_security *parent,
228 struct gensec_security **gensec_security);
229 NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx,
230 struct gensec_security **gensec_security,
231 struct gensec_settings *settings);
232 NTSTATUS gensec_start_mech_by_ops(struct gensec_security *gensec_security,
233 const struct gensec_security_ops *ops);
234 NTSTATUS gensec_start_mech_by_sasl_list(struct gensec_security *gensec_security,
235 const char **sasl_names);
236 void gensec_set_max_update_size(struct gensec_security *gensec_security,
237 uint32_t max_update_size);
238 size_t gensec_max_update_size(struct gensec_security *gensec_security);
239 NTSTATUS gensec_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
240 struct tevent_context *ev,
241 const DATA_BLOB in, DATA_BLOB *out);
242 struct tevent_req *gensec_update_send(TALLOC_CTX *mem_ctx,
243 struct tevent_context *ev,
244 struct gensec_security *gensec_security,
245 const DATA_BLOB in);
246 NTSTATUS gensec_update_recv(struct tevent_req *req, TALLOC_CTX *out_mem_ctx, DATA_BLOB *out);
247 void gensec_want_feature(struct gensec_security *gensec_security,
248 uint32_t feature);
249 bool gensec_have_feature(struct gensec_security *gensec_security,
250 uint32_t feature);
251 NTTIME gensec_expire_time(struct gensec_security *gensec_security);
252 NTSTATUS gensec_set_credentials(struct gensec_security *gensec_security, struct cli_credentials *credentials);
253 NTSTATUS gensec_set_target_service(struct gensec_security *gensec_security, const char *service);
254 const char *gensec_get_target_service(struct gensec_security *gensec_security);
255 NTSTATUS gensec_set_target_hostname(struct gensec_security *gensec_security, const char *hostname);
256 const char *gensec_get_target_hostname(struct gensec_security *gensec_security);
257 NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
258 TALLOC_CTX *mem_ctx,
259 DATA_BLOB *session_key);
260 NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security,
261 const char *mech_oid);
262 const char *gensec_get_name_by_oid(struct gensec_security *gensec_security, const char *oid_string);
263 struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security);
264 NTSTATUS gensec_init(void);
265 NTSTATUS gensec_register(const struct gensec_security_ops *ops);
266 const struct gensec_security_ops *gensec_security_by_oid(struct gensec_security *gensec_security,
267 const char *oid_string);
268 const struct gensec_security_ops *gensec_security_by_sasl_name(struct gensec_security *gensec_security,
269 const char *sasl_name);
270 struct gensec_security_ops **gensec_security_mechs(struct gensec_security *gensec_security,
271 TALLOC_CTX *mem_ctx);
272 const struct gensec_security_ops_wrapper *gensec_security_by_oid_list(
273 struct gensec_security *gensec_security,
274 TALLOC_CTX *mem_ctx,
275 const char **oid_strings,
276 const char *skip);
277 const char **gensec_security_oids(struct gensec_security *gensec_security,
278 TALLOC_CTX *mem_ctx,
279 const char *skip);
280 const char **gensec_security_oids_from_ops_wrapped(TALLOC_CTX *mem_ctx,
281 const struct gensec_security_ops_wrapper *wops);
282 size_t gensec_max_input_size(struct gensec_security *gensec_security);
283 size_t gensec_max_wrapped_size(struct gensec_security *gensec_security);
284 NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
285 uint8_t *data, size_t length,
286 const uint8_t *whole_pdu, size_t pdu_length,
287 const DATA_BLOB *sig);
288 NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
289 const uint8_t *data, size_t length,
290 const uint8_t *whole_pdu, size_t pdu_length,
291 const DATA_BLOB *sig);
292 size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size);
293 NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
294 TALLOC_CTX *mem_ctx,
295 uint8_t *data, size_t length,
296 const uint8_t *whole_pdu, size_t pdu_length,
297 DATA_BLOB *sig);
298 NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security,
299 TALLOC_CTX *mem_ctx,
300 const uint8_t *data, size_t length,
301 const uint8_t *whole_pdu, size_t pdu_length,
302 DATA_BLOB *sig);
303 NTSTATUS gensec_start_mech(struct gensec_security *gensec_security);
304 NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
305 uint8_t auth_type, uint8_t auth_level);
306 const char *gensec_get_name_by_authtype(struct gensec_security *gensec_security, uint8_t authtype);
307 NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx,
308 struct gensec_settings *settings,
309 struct auth4_context *auth_context,
310 struct gensec_security **gensec_security);
311 NTSTATUS gensec_session_info(struct gensec_security *gensec_security,
312 TALLOC_CTX *mem_ctx,
313 struct auth_session_info **session_info);
315 NTSTATUS gensec_set_local_address(struct gensec_security *gensec_security,
316 const struct tsocket_address *local);
317 NTSTATUS gensec_set_remote_address(struct gensec_security *gensec_security,
318 const struct tsocket_address *remote);
319 const struct tsocket_address *gensec_get_local_address(struct gensec_security *gensec_security);
320 const struct tsocket_address *gensec_get_remote_address(struct gensec_security *gensec_security);
322 NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
323 const char *name);
325 NTSTATUS gensec_unwrap(struct gensec_security *gensec_security,
326 TALLOC_CTX *mem_ctx,
327 const DATA_BLOB *in,
328 DATA_BLOB *out);
329 NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
330 TALLOC_CTX *mem_ctx,
331 const DATA_BLOB *in,
332 DATA_BLOB *out);
334 struct gensec_security_ops **gensec_security_all(void);
335 bool gensec_security_ops_enabled(struct gensec_security_ops *ops, struct gensec_security *security);
336 struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx,
337 struct gensec_security_ops **old_gensec_list,
338 struct cli_credentials *creds);
340 NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
341 const char *sasl_name);
343 int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value);
344 bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value);
346 NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal);
347 const char *gensec_get_target_principal(struct gensec_security *gensec_security);
349 NTSTATUS gensec_generate_session_info_pac(TALLOC_CTX *mem_ctx,
350 struct gensec_security *gensec_security,
351 struct smb_krb5_context *smb_krb5_context,
352 DATA_BLOB *pac_blob,
353 const char *principal_string,
354 const struct tsocket_address *remote_address,
355 struct auth_session_info **session_info);
357 NTSTATUS gensec_magic_check_krb5_oid(struct gensec_security *unused,
358 const DATA_BLOB *blob);
360 #endif /* __GENSEC_H__ */