2 Unix SMB/CIFS implementation.
4 Generic Authentication Interface
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/network.h"
25 #define TEVENT_DEPRECATED 1
27 #include "lib/tsocket/tsocket.h"
28 #include "lib/util/tevent_ntstatus.h"
29 #include "auth/gensec/gensec.h"
30 #include "auth/gensec/gensec_internal.h"
31 #include "librpc/gen_ndr/dcerpc.h"
32 #include "auth/common_auth.h"
34 _PRIVATE_ NTSTATUS gensec_may_reset_crypto(struct gensec_security *gensec_security,
37 if (!gensec_security->ops->may_reset_crypto) {
41 return gensec_security->ops->may_reset_crypto(gensec_security, full_reset);
45 wrappers for the gensec function pointers
47 _PUBLIC_ NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
48 uint8_t *data, size_t length,
49 const uint8_t *whole_pdu, size_t pdu_length,
52 if (!gensec_security->ops->unseal_packet) {
53 return NT_STATUS_NOT_IMPLEMENTED;
55 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
56 return NT_STATUS_INVALID_PARAMETER;
58 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
59 return NT_STATUS_INVALID_PARAMETER;
61 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE)) {
62 return NT_STATUS_INVALID_PARAMETER;
65 return gensec_security->ops->unseal_packet(gensec_security,
67 whole_pdu, pdu_length,
71 _PUBLIC_ NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
72 const uint8_t *data, size_t length,
73 const uint8_t *whole_pdu, size_t pdu_length,
76 if (!gensec_security->ops->check_packet) {
77 return NT_STATUS_NOT_IMPLEMENTED;
79 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
80 return NT_STATUS_INVALID_PARAMETER;
83 return gensec_security->ops->check_packet(gensec_security, data, length, whole_pdu, pdu_length, sig);
86 _PUBLIC_ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
88 uint8_t *data, size_t length,
89 const uint8_t *whole_pdu, size_t pdu_length,
92 if (!gensec_security->ops->seal_packet) {
93 return NT_STATUS_NOT_IMPLEMENTED;
95 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
96 return NT_STATUS_INVALID_PARAMETER;
98 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
99 return NT_STATUS_INVALID_PARAMETER;
101 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE)) {
102 return NT_STATUS_INVALID_PARAMETER;
105 return gensec_security->ops->seal_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
108 _PUBLIC_ NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security,
110 const uint8_t *data, size_t length,
111 const uint8_t *whole_pdu, size_t pdu_length,
114 if (!gensec_security->ops->sign_packet) {
115 return NT_STATUS_NOT_IMPLEMENTED;
117 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
118 return NT_STATUS_INVALID_PARAMETER;
121 return gensec_security->ops->sign_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
124 _PUBLIC_ size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size)
126 if (!gensec_security->ops->sig_size) {
129 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
132 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
133 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE)) {
138 return gensec_security->ops->sig_size(gensec_security, data_size);
141 _PUBLIC_ size_t gensec_max_wrapped_size(struct gensec_security *gensec_security)
143 if (!gensec_security->ops->max_wrapped_size) {
147 return gensec_security->ops->max_wrapped_size(gensec_security);
150 _PUBLIC_ size_t gensec_max_input_size(struct gensec_security *gensec_security)
152 if (!gensec_security->ops->max_input_size) {
153 return (1 << 17) - gensec_sig_size(gensec_security, 1 << 17);
156 return gensec_security->ops->max_input_size(gensec_security);
159 _PUBLIC_ NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
164 if (!gensec_security->ops->wrap) {
165 return NT_STATUS_NOT_IMPLEMENTED;
167 return gensec_security->ops->wrap(gensec_security, mem_ctx, in, out);
170 _PUBLIC_ NTSTATUS gensec_unwrap(struct gensec_security *gensec_security,
175 if (!gensec_security->ops->unwrap) {
176 return NT_STATUS_NOT_IMPLEMENTED;
178 return gensec_security->ops->unwrap(gensec_security, mem_ctx, in, out);
181 _PUBLIC_ NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
183 DATA_BLOB *session_key)
185 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SESSION_KEY)) {
186 return NT_STATUS_NO_USER_SESSION_KEY;
189 if (!gensec_security->ops->session_key) {
190 return NT_STATUS_NOT_IMPLEMENTED;
193 return gensec_security->ops->session_key(gensec_security, mem_ctx, session_key);
196 const char *gensec_final_auth_type(struct gensec_security *gensec_security)
198 if (!gensec_security->ops->final_auth_type) {
199 return gensec_security->ops->name;
202 return gensec_security->ops->final_auth_type(gensec_security);
206 * Log details of a successful GENSEC authorization to a service.
208 * Only successful authorizations are logged, as only these call gensec_session_info()
210 * The service may later refuse authorization due to an ACL.
213 static void log_successful_gensec_authz_event(struct gensec_security *gensec_security,
214 struct auth_session_info *session_info)
216 const struct tsocket_address *remote
217 = gensec_get_remote_address(gensec_security);
218 const struct tsocket_address *local
219 = gensec_get_local_address(gensec_security);
220 const char *service_description
221 = gensec_get_target_service_description(gensec_security);
222 const char *final_auth_type
223 = gensec_final_auth_type(gensec_security);
224 const char *transport_protection = NULL;
225 if (gensec_security->want_features & GENSEC_FEATURE_SMB_TRANSPORT) {
226 transport_protection = AUTHZ_TRANSPORT_PROTECTION_SMB;
227 } else if (gensec_security->want_features & GENSEC_FEATURE_LDAPS_TRANSPORT) {
228 transport_protection = AUTHZ_TRANSPORT_PROTECTION_TLS;
229 } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
230 transport_protection = AUTHZ_TRANSPORT_PROTECTION_SEAL;
231 } else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
232 transport_protection = AUTHZ_TRANSPORT_PROTECTION_SIGN;
234 transport_protection = AUTHZ_TRANSPORT_PROTECTION_NONE;
236 log_successful_authz_event(gensec_security->auth_context->msg_ctx,
237 gensec_security->auth_context->lp_ctx,
241 transport_protection,
247 * Return the credentials of a logged on user, including session keys
250 * Only valid after a successful authentication
252 * May only be called once per authentication. This will also make an
253 * authorization log entry, as it is already called by all the
258 _PUBLIC_ NTSTATUS gensec_session_info(struct gensec_security *gensec_security,
260 struct auth_session_info **session_info)
263 if (!gensec_security->ops->session_info) {
264 return NT_STATUS_NOT_IMPLEMENTED;
266 status = gensec_security->ops->session_info(gensec_security, mem_ctx, session_info);
268 if (NT_STATUS_IS_OK(status) && !gensec_security->subcontext
269 && (gensec_security->want_features & GENSEC_FEATURE_NO_AUTHZ_LOG) == 0) {
270 log_successful_gensec_authz_event(gensec_security, *session_info);
276 _PUBLIC_ void gensec_set_max_update_size(struct gensec_security *gensec_security,
277 uint32_t max_update_size)
279 gensec_security->max_update_size = max_update_size;
282 _PUBLIC_ size_t gensec_max_update_size(struct gensec_security *gensec_security)
284 if (gensec_security->max_update_size == 0) {
288 return gensec_security->max_update_size;
291 static NTSTATUS gensec_verify_features(struct gensec_security *gensec_security)
294 * gensec_want_feature(GENSEC_FEATURE_SIGN)
296 * gensec_want_feature(GENSEC_FEATURE_SEAL)
297 * require these flags to be available.
299 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
300 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
301 DEBUG(0,("Did not manage to negotiate mandatory feature "
303 return NT_STATUS_ACCESS_DENIED;
306 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
307 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
308 DEBUG(0,("Did not manage to negotiate mandatory feature "
310 return NT_STATUS_ACCESS_DENIED;
312 if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
313 DEBUG(0,("Did not manage to negotiate mandatory feature "
315 return NT_STATUS_ACCESS_DENIED;
322 _PUBLIC_ NTSTATUS gensec_update_ev(struct gensec_security *gensec_security,
323 TALLOC_CTX *out_mem_ctx,
324 struct tevent_context *ev,
325 const DATA_BLOB in, DATA_BLOB *out)
328 const struct gensec_security_ops *ops = gensec_security->ops;
329 TALLOC_CTX *frame = NULL;
330 struct tevent_req *subreq = NULL;
333 if (gensec_security->child_security != NULL) {
334 return NT_STATUS_INVALID_PARAMETER;
337 frame = talloc_stackframe();
340 ev = samba_tevent_context_init(frame);
342 status = NT_STATUS_NO_MEMORY;
347 * TODO: remove this hack once the backends
350 tevent_loop_allow_nesting(ev);
353 subreq = ops->update_send(frame, ev, gensec_security, in);
354 if (subreq == NULL) {
355 status = NT_STATUS_NO_MEMORY;
358 ok = tevent_req_poll_ntstatus(subreq, ev, &status);
362 status = ops->update_recv(subreq, out_mem_ctx, out);
363 if (!NT_STATUS_IS_OK(status)) {
368 * Because callers using the
369 * gensec_start_mech_by_auth_type() never call
370 * gensec_want_feature(), it isn't sensible for them
371 * to have to call gensec_have_feature() manually, and
372 * these are not points of negotiation, but are
373 * asserted by the client
375 status = gensec_verify_features(gensec_security);
382 * Next state function for the GENSEC state machine
384 * @param gensec_security GENSEC State
385 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
386 * @param in The request, as a DATA_BLOB
387 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
388 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
389 * or NT_STATUS_OK if the user is authenticated.
392 _PUBLIC_ NTSTATUS gensec_update(struct gensec_security *gensec_security,
393 TALLOC_CTX *out_mem_ctx,
394 const DATA_BLOB in, DATA_BLOB *out)
396 return gensec_update_ev(gensec_security, out_mem_ctx, NULL, in, out);
399 struct gensec_update_state {
400 const struct gensec_security_ops *ops;
401 struct gensec_security *gensec_security;
406 static void gensec_update_cleanup(struct tevent_req *req,
407 enum tevent_req_state req_state);
408 static void gensec_update_done(struct tevent_req *subreq);
411 * Next state function for the GENSEC state machine async version
413 * @param mem_ctx The memory context for the request
414 * @param ev The event context for the request
415 * @param gensec_security GENSEC State
416 * @param in The request, as a DATA_BLOB
418 * @return The request handle or NULL on no memory failure
421 _PUBLIC_ struct tevent_req *gensec_update_send(TALLOC_CTX *mem_ctx,
422 struct tevent_context *ev,
423 struct gensec_security *gensec_security,
426 struct tevent_req *req = NULL;
427 struct gensec_update_state *state = NULL;
428 struct tevent_req *subreq = NULL;
430 req = tevent_req_create(mem_ctx, &state,
431 struct gensec_update_state);
435 state->ops = gensec_security->ops;
436 state->gensec_security = gensec_security;
438 if (gensec_security->update_busy_ptr != NULL) {
439 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
440 return tevent_req_post(req, ev);
443 if (gensec_security->child_security != NULL) {
444 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
445 return tevent_req_post(req, ev);
448 gensec_security->update_busy_ptr = &state->gensec_security;
449 tevent_req_set_cleanup_fn(req, gensec_update_cleanup);
451 subreq = state->ops->update_send(state, ev, gensec_security, in);
452 if (tevent_req_nomem(subreq, req)) {
453 return tevent_req_post(req, ev);
455 tevent_req_set_callback(subreq, gensec_update_done, req);
457 DBG_DEBUG("%s[%p]: subreq: %p\n", state->ops->name,
458 state->gensec_security, subreq);
463 static void gensec_update_cleanup(struct tevent_req *req,
464 enum tevent_req_state req_state)
466 struct gensec_update_state *state =
468 struct gensec_update_state);
470 if (state->gensec_security == NULL) {
474 if (state->gensec_security->update_busy_ptr == &state->gensec_security) {
475 state->gensec_security->update_busy_ptr = NULL;
478 state->gensec_security = NULL;
481 static void gensec_update_done(struct tevent_req *subreq)
483 struct tevent_req *req =
484 tevent_req_callback_data(subreq,
486 struct gensec_update_state *state =
488 struct gensec_update_state);
490 const char *debug_subreq = NULL;
492 if (CHECK_DEBUGLVL(DBGLVL_DEBUG)) {
494 * We need to call tevent_req_print()
495 * before calling the _recv function,
496 * before tevent_req_received() was called.
497 * in order to print the pointer value of
500 debug_subreq = tevent_req_print(state, subreq);
503 status = state->ops->update_recv(subreq, state, &state->out);
505 state->status = status;
506 if (GENSEC_UPDATE_IS_NTERROR(status)) {
507 DBG_INFO("%s[%p]: %s%s%s\n", state->ops->name,
508 state->gensec_security, nt_errstr(status),
509 debug_subreq ? " " : "",
510 debug_subreq ? debug_subreq : "");
511 tevent_req_nterror(req, status);
514 DBG_DEBUG("%s[%p]: %s %s\n", state->ops->name,
515 state->gensec_security, nt_errstr(status),
517 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
518 tevent_req_done(req);
523 * Because callers using the
524 * gensec_start_mech_by_authtype() never call
525 * gensec_want_feature(), it isn't sensible for them
526 * to have to call gensec_have_feature() manually, and
527 * these are not points of negotiation, but are
528 * asserted by the client
530 status = gensec_verify_features(state->gensec_security);
531 if (tevent_req_nterror(req, status)) {
535 tevent_req_done(req);
539 * Next state function for the GENSEC state machine
541 * @param req request state
542 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
543 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
544 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
545 * or NT_STATUS_OK if the user is authenticated.
547 _PUBLIC_ NTSTATUS gensec_update_recv(struct tevent_req *req,
548 TALLOC_CTX *out_mem_ctx,
551 struct gensec_update_state *state =
552 tevent_req_data(req, struct gensec_update_state);
555 *out = data_blob_null;
557 if (tevent_req_is_nterror(req, &status)) {
558 tevent_req_received(req);
563 talloc_steal(out_mem_ctx, out->data);
564 status = state->status;
565 tevent_req_received(req);
570 * Set the requirement for a certain feature on the connection
574 _PUBLIC_ void gensec_want_feature(struct gensec_security *gensec_security,
577 if (!gensec_security->ops || !gensec_security->ops->want_feature) {
578 gensec_security->want_features |= feature;
581 gensec_security->ops->want_feature(gensec_security, feature);
585 * Check the requirement for a certain feature on the connection
589 _PUBLIC_ bool gensec_have_feature(struct gensec_security *gensec_security,
592 if (!gensec_security->ops || !gensec_security->ops->have_feature) {
596 /* We might 'have' features that we don't 'want', because the
597 * other end demanded them, or we can't neotiate them off */
598 return gensec_security->ops->have_feature(gensec_security, feature);
601 _PUBLIC_ NTTIME gensec_expire_time(struct gensec_security *gensec_security)
603 if (!gensec_security->ops->expire_time) {
604 return GENSEC_EXPIRE_TIME_INFINITY;
607 return gensec_security->ops->expire_time(gensec_security);
610 * Return the credentials structure associated with a GENSEC context
614 _PUBLIC_ struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security)
616 if (!gensec_security) {
619 return gensec_security->credentials;
623 * Set the target service (such as 'http' or 'host') on a GENSEC context - ensures it is talloc()ed
625 * This is used for Kerberos service principal name resolution.
628 _PUBLIC_ NTSTATUS gensec_set_target_service(struct gensec_security *gensec_security, const char *service)
630 gensec_security->target.service = talloc_strdup(gensec_security, service);
631 if (!gensec_security->target.service) {
632 return NT_STATUS_NO_MEMORY;
637 _PUBLIC_ const char *gensec_get_target_service(struct gensec_security *gensec_security)
639 if (gensec_security->target.service) {
640 return gensec_security->target.service;
647 * Set the target service (such as 'samr') on an GENSEC context - ensures it is talloc()ed.
649 * This is not the Kerberos service principal, instead this is a
650 * constant value that can be logged as part of authentication and
651 * authorization logging
653 _PUBLIC_ NTSTATUS gensec_set_target_service_description(struct gensec_security *gensec_security,
656 gensec_security->target.service_description = talloc_strdup(gensec_security, service);
657 if (!gensec_security->target.service_description) {
658 return NT_STATUS_NO_MEMORY;
663 _PUBLIC_ const char *gensec_get_target_service_description(struct gensec_security *gensec_security)
665 if (gensec_security->target.service_description) {
666 return gensec_security->target.service_description;
667 } else if (gensec_security->target.service) {
668 return gensec_security->target.service;
675 * Set the target hostname (suitable for kerberos resolutation) on a GENSEC context - ensures it is talloc()ed
679 _PUBLIC_ NTSTATUS gensec_set_target_hostname(struct gensec_security *gensec_security, const char *hostname)
681 gensec_security->target.hostname = talloc_strdup(gensec_security, hostname);
682 if (hostname && !gensec_security->target.hostname) {
683 return NT_STATUS_NO_MEMORY;
688 _PUBLIC_ const char *gensec_get_target_hostname(struct gensec_security *gensec_security)
690 /* We allow the target hostname to be overridden for testing purposes */
691 if (gensec_security->settings->target_hostname) {
692 return gensec_security->settings->target_hostname;
695 if (gensec_security->target.hostname) {
696 return gensec_security->target.hostname;
699 /* We could add use the 'set sockaddr' call, and do a reverse
700 * lookup, but this would be both insecure (compromising the
701 * way kerberos works) and add DNS timeouts */
706 * Set (and copy) local and peer socket addresses onto a socket
707 * context on the GENSEC context.
709 * This is so that kerberos can include these addresses in
710 * cryptographic tokens, to avoid certain attacks.
714 * @brief Set the local gensec address.
716 * @param gensec_security The gensec security context to use.
718 * @param remote The local address to set.
720 * @return On success NT_STATUS_OK is returned or an NT_STATUS
723 _PUBLIC_ NTSTATUS gensec_set_local_address(struct gensec_security *gensec_security,
724 const struct tsocket_address *local)
726 TALLOC_FREE(gensec_security->local_addr);
732 gensec_security->local_addr = tsocket_address_copy(local, gensec_security);
733 if (gensec_security->local_addr == NULL) {
734 return NT_STATUS_NO_MEMORY;
741 * @brief Set the remote gensec address.
743 * @param gensec_security The gensec security context to use.
745 * @param remote The remote address to set.
747 * @return On success NT_STATUS_OK is returned or an NT_STATUS
750 _PUBLIC_ NTSTATUS gensec_set_remote_address(struct gensec_security *gensec_security,
751 const struct tsocket_address *remote)
753 TALLOC_FREE(gensec_security->remote_addr);
755 if (remote == NULL) {
759 gensec_security->remote_addr = tsocket_address_copy(remote, gensec_security);
760 if (gensec_security->remote_addr == NULL) {
761 return NT_STATUS_NO_MEMORY;
768 * @brief Get the local address from a gensec security context.
770 * @param gensec_security The security context to get the address from.
772 * @return The address as tsocket_address which could be NULL if
775 _PUBLIC_ const struct tsocket_address *gensec_get_local_address(struct gensec_security *gensec_security)
777 if (gensec_security == NULL) {
780 return gensec_security->local_addr;
784 * @brief Get the remote address from a gensec security context.
786 * @param gensec_security The security context to get the address from.
788 * @return The address as tsocket_address which could be NULL if
791 _PUBLIC_ const struct tsocket_address *gensec_get_remote_address(struct gensec_security *gensec_security)
793 if (gensec_security == NULL) {
796 return gensec_security->remote_addr;
800 * Set the target principal (assuming it it known, say from the SPNEGO reply)
801 * - ensures it is talloc()ed
805 _PUBLIC_ NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal)
807 gensec_security->target.principal = talloc_strdup(gensec_security, principal);
808 if (!gensec_security->target.principal) {
809 return NT_STATUS_NO_MEMORY;
814 _PUBLIC_ const char *gensec_get_target_principal(struct gensec_security *gensec_security)
816 if (gensec_security->target.principal) {
817 return gensec_security->target.principal;