src/core/sip-sec.h

   1 /**
   2  * @file sip-sec.h
   3  *
   4  * pidgin-sipe
   5  *
   6  * Copyright (C) 2010-11 SIPE Project <http://sipe.sourceforge.net/>
   7  * Copyright (C) 2009 pier11 <pier11@operamail.com>
   8  *
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License as published by
  12  * the Free Software Foundation; either version 2 of the License, or
  13  * (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  23  */
  24
  25 /* Opaque type definition for security context */
  26 typedef struct sip_sec_context *SipSecContext;
  27
  28 #define AUTH_TYPE_UNSET     0
  29 #define AUTH_TYPE_NTLM      1
  30 #define AUTH_TYPE_KERBEROS  2
  31 #define AUTH_TYPE_NEGOTIATE 3
  32 #define AUTH_TYPE_TLS_DSK   4
  33
  34 /*** Sipe convenience methods ***/
  35
  36 /**
  37  * Initializes Sipe security context.
  38  * Obtains cashed initial credentials (TGT for Kerberos) or requests new ones if required.
  39  * In former case domain/username/password information is unnecessary.
  40  *
  41  * @param type (in) authentication type
  42  * @param sso (in) use Single Sign-On
  43  * @param is_connection_based (in) context is used for a connection
  44  * @param domain (in) NTLM Domain/Kerberos Realm.
  45  * @param username (in) user name (can be NULL)
  46  * @param password (in) password (can be NULL)
  47  *
  48  * @return context security context to store and pass between security method invocations
  49  */
  50 SipSecContext
  51 sip_sec_create_context(guint type,
  52                        const int  sso,
  53                        int is_connection_based,
  54                        const char *domain,
  55                        const char *username,
  56                        const char *password);
  57
  58 /**
  59  * Obtains Service ticket (for Kerberos), base64 encodes it and provide as output.
  60  *
  61  * @param context (in) security context to pass between security method invocations
  62  * @param target (in) security target. Service principal name on case of Kerberos.
  63  * @param input_toked_base64 (in) base64 encoded input security token. This is Type2 NTLM message or NULL.
  64  * @param output_toked_base64 (out) base64 encoded output token to send to server.
  65  * @param expires (out) security context expiration time in seconds.
  66  *
  67  * @return SIP_SEC_* value signifying success of the operation.
  68  *
  69  */
  70 unsigned long
  71 sip_sec_init_context_step(SipSecContext context,
  72                           const char *target,
  73                           const char *input_toked_base64,
  74                           char **output_toked_base64,
  75                           int *expires);
  76
  77 /**
  78  * A convenience method for sipe. Combines execution on sip_sec_create_context()
  79  * and sip_sec_init_context_step(). Suitable for connectionless NTLM (as in SIP).
  80  * Unsuitable for connection-based (TCP, TLS) Web authentication.
  81  *
  82  * Initializes security context.
  83  * Obtains cashed initial credentials (TGT for Kerberos) or requests new ones if required. In former case domain/username/password information is unnecessary.
  84  * Then obtains Service ticket (for Kerberos) , base64 encodes it and provide as output.
  85  *
  86  * @param context (in,out) security context to store and pass between security method invocations
  87  * @param mech (in) security mechanism - NTLM or Kerberos
  88  * @param domain (in) NTLM Domain/Kerberos Realm.
  89  * @param target (in) security target. Service principal name on case of Kerberos.
  90  * @param input_toked_base64 (in) base64 encoded input security token. This is Type2 NTLM message or NULL for Kerberos.
  91  * @param expires (out) security context expiration time in seconds.
  92  *
  93  * @return base64 encoded output token to send to server.
  94  */
  95 char *sip_sec_init_context(SipSecContext *context,
  96                            int *expires,
  97                            guint type,
  98                            const int  sso,
  99                            const char *domain,
 100                            const char *username,
 101                            const char *password,
 102                            const char *target,
 103                            const char *input_toked_base64);
 104
 105 /**
 106  * Check if the authentication of a security context is completed and it is
 107  * ready to be used for message signing and signature verification
 108  *
 109  * @param context (in) security context. May be @c NULL.
 110  *
 111  * @return @TRUE if authentication is completed
 112  */
 113 gboolean sip_sec_context_is_ready(SipSecContext context);
 114
 115 /**
 116  * A convenience method for sipe.
 117  * Destroys security context.
 118  *
 119  * @param context (in,out) security context to destroy
 120  */
 121 void sip_sec_destroy_context(SipSecContext context);
 122
 123 /**
 124  * A convenience method for sipe.
 125  * Signs incoming message.
 126  *
 127  * @param context (in) security context
 128  * @param message (in) a message to sign.
 129  *
 130  * @return signature for the message. Converted to Hex null terminated string;
 131  */
 132 char *sip_sec_make_signature(SipSecContext context,
 133                              const char *message);
 134
 135 /**
 136  * A convenience method for sipe.
 137  * Verifies signature for the message.
 138  *
 139  * @param context (in) security context
 140  * @param message (in) which signature to verify. Null terminated string.
 141  * @param signature_hex (in) signature to test in Hex representation. Null terminated string. Example: "602306092A864886F71201020201011100FFFFFFFF1A306ACB7BE311827BBF7208D80D15E3"
 142  *
 143  * @return FALSE on error
 144  */
 145 int sip_sec_verify_signature(SipSecContext context,
 146                              const char *message,
 147                              const char *signature_hex);
 148
 149 /**
 150  * Initialize & destroy functions for sip-sec.
 151  * Should be called on loading and unloading of the core.
 152  */
 153 void sip_sec_init(void);
 154 void sip_sec_destroy(void);