source4/auth/gensec/pygensec.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2009
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published by
   7    the Free Software Foundation; either version 3 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 #include <Python.h>
  20 #include "includes.h"
  21 #include "param/pyparam.h"
  22 #include "auth/gensec/gensec.h"
  23 #include "auth/gensec/gensec_internal.h" /* TODO: remove this */
  24 #include "auth/credentials/pycredentials.h"
  25 #include "libcli/util/pyerrors.h"
  26 #include "python/modules.h"
  27 #include <pytalloc.h>
  28 #include <tevent.h>
  29 #include "librpc/rpc/pyrpc_util.h"
  30
  31 static PyObject *py_get_name_by_authtype(PyObject *self, PyObject *args)
  32 {
  33         int type;
  34         const char *name;
  35         struct gensec_security *security;
  36
  37         if (!PyArg_ParseTuple(args, "i", &type))
  38                 return NULL;
  39
  40         security = pytalloc_get_type(self, struct gensec_security);
  41
  42         name = gensec_get_name_by_authtype(security, type);
  43         if (name == NULL)
  44                 Py_RETURN_NONE;
  45
  46         return PyString_FromString(name);
  47 }
  48
  49 static struct gensec_settings *settings_from_object(TALLOC_CTX *mem_ctx, PyObject *object)
  50 {
  51         struct gensec_settings *s;
  52         PyObject *py_hostname, *py_lp_ctx;
  53
  54         if (!PyDict_Check(object)) {
  55                 PyErr_SetString(PyExc_ValueError, "settings should be a dictionary");
  56                 return NULL;
  57         }
  58
  59         s = talloc_zero(mem_ctx, struct gensec_settings);
  60         if (!s) return NULL;
  61
  62         py_hostname = PyDict_GetItemString(object, "target_hostname");
  63         if (!py_hostname) {
  64                 PyErr_SetString(PyExc_ValueError, "settings.target_hostname not found");
  65                 return NULL;
  66         }
  67
  68         py_lp_ctx = PyDict_GetItemString(object, "lp_ctx");
  69         if (!py_lp_ctx) {
  70                 PyErr_SetString(PyExc_ValueError, "settings.lp_ctx not found");
  71                 return NULL;
  72         }
  73
  74         s->target_hostname = PyString_AsString(py_hostname);
  75         s->lp_ctx = lpcfg_from_py_object(s, py_lp_ctx);
  76         return s;
  77 }
  78
  79 static PyObject *py_gensec_start_client(PyTypeObject *type, PyObject *args, PyObject *kwargs)
  80 {
  81         NTSTATUS status;
  82         pytalloc_Object *self;
  83         struct gensec_settings *settings;
  84         const char *kwnames[] = { "settings", NULL };
  85         PyObject *py_settings = Py_None;
  86         struct gensec_security *gensec;
  87
  88         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|O", discard_const_p(char *, kwnames), &py_settings))
  89                 return NULL;
  90
  91         self = (pytalloc_Object*)type->tp_alloc(type, 0);
  92         if (self == NULL) {
  93                 PyErr_NoMemory();
  94                 return NULL;
  95         }
  96         self->talloc_ctx = talloc_new(NULL);
  97         if (self->talloc_ctx == NULL) {
  98                 PyErr_NoMemory();
  99                 return NULL;
 100         }
 101
 102         if (py_settings != Py_None) {
 103                 settings = settings_from_object(self->talloc_ctx, py_settings);
 104                 if (settings == NULL) {
 105                         PyObject_DEL(self);
 106                         return NULL;
 107                 }
 108         } else {
 109                 settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
 110                 if (settings == NULL) {
 111                         PyObject_DEL(self);
 112                         return NULL;
 113                 }
 114
 115                 settings->lp_ctx = loadparm_init_global(true);
 116                 if (settings->lp_ctx == NULL) {
 117                         PyErr_NoMemory();
 118                         PyObject_DEL(self);
 119                         return NULL;
 120                 }
 121         }
 122
 123         status = gensec_init();
 124         if (!NT_STATUS_IS_OK(status)) {
 125                 PyErr_SetNTSTATUS(status);
 126                 PyObject_DEL(self);
 127                 return NULL;
 128         }
 129
 130         status = gensec_client_start(self->talloc_ctx, &gensec, settings);
 131         if (!NT_STATUS_IS_OK(status)) {
 132                 PyErr_SetNTSTATUS(status);
 133                 PyObject_DEL(self);
 134                 return NULL;
 135         }
 136
 137         self->ptr = gensec;
 138
 139         return (PyObject *)self;
 140 }
 141
 142 static PyObject *py_gensec_start_server(PyTypeObject *type, PyObject *args, PyObject *kwargs)
 143 {
 144         NTSTATUS status;
 145         pytalloc_Object *self;
 146         struct gensec_settings *settings = NULL;
 147         const char *kwnames[] = { "settings", "auth_context", NULL };
 148         PyObject *py_settings = Py_None;
 149         PyObject *py_auth_context = Py_None;
 150         struct gensec_security *gensec;
 151         struct auth4_context *auth_context = NULL;
 152
 153         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OO", discard_const_p(char *, kwnames), &py_settings, &py_auth_context))
 154                 return NULL;
 155
 156         self = (pytalloc_Object*)type->tp_alloc(type, 0);
 157         if (self == NULL) {
 158                 PyErr_NoMemory();
 159                 return NULL;
 160         }
 161         self->talloc_ctx = talloc_new(NULL);
 162         if (self->talloc_ctx == NULL) {
 163                 PyErr_NoMemory();
 164                 return NULL;
 165         }
 166
 167         if (py_settings != Py_None) {
 168                 settings = settings_from_object(self->talloc_ctx, py_settings);
 169                 if (settings == NULL) {
 170                         PyObject_DEL(self);
 171                         return NULL;
 172                 }
 173         } else {
 174                 settings = talloc_zero(self->talloc_ctx, struct gensec_settings);
 175                 if (settings == NULL) {
 176                         PyObject_DEL(self);
 177                         return NULL;
 178                 }
 179
 180                 settings->lp_ctx = loadparm_init_global(true);
 181                 if (settings->lp_ctx == NULL) {
 182                         PyErr_NoMemory();
 183                         PyObject_DEL(self);
 184                         return NULL;
 185                 }
 186         }
 187
 188         if (py_auth_context != Py_None) {
 189                 auth_context = pytalloc_get_type(py_auth_context, struct auth4_context);
 190                 if (!auth_context) {
 191                         PyErr_Format(PyExc_TypeError,
 192                                      "Expected auth.AuthContext for auth_context argument, got %s",
 193                                      talloc_get_name(pytalloc_get_ptr(py_auth_context)));
 194                         return NULL;
 195                 }
 196         }
 197
 198         status = gensec_init();
 199         if (!NT_STATUS_IS_OK(status)) {
 200                 PyErr_SetNTSTATUS(status);
 201                 PyObject_DEL(self);
 202                 return NULL;
 203         }
 204
 205         status = gensec_server_start(self->talloc_ctx, settings, auth_context, &gensec);
 206         if (!NT_STATUS_IS_OK(status)) {
 207                 PyErr_SetNTSTATUS(status);
 208                 PyObject_DEL(self);
 209                 return NULL;
 210         }
 211
 212         self->ptr = gensec;
 213
 214         return (PyObject *)self;
 215 }
 216
 217 static PyObject *py_gensec_set_credentials(PyObject *self, PyObject *args)
 218 {
 219         PyObject *py_creds = Py_None;
 220         struct cli_credentials *creds;
 221         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 222         NTSTATUS status;
 223
 224         if (!PyArg_ParseTuple(args, "O", &py_creds))
 225                 return NULL;
 226
 227         creds = PyCredentials_AsCliCredentials(py_creds);
 228         if (!creds) {
 229                 PyErr_Format(PyExc_TypeError,
 230                              "Expected samba.credentaials for credentials argument got  %s",
 231                              talloc_get_name(pytalloc_get_ptr(py_creds)));
 232         }
 233
 234         status = gensec_set_credentials(security, creds);
 235         if (!NT_STATUS_IS_OK(status)) {
 236                 PyErr_SetNTSTATUS(status);
 237                 return NULL;
 238         }
 239
 240         Py_RETURN_NONE;
 241 }
 242
 243 static PyObject *py_gensec_session_info(PyObject *self)
 244 {
 245         TALLOC_CTX *mem_ctx;
 246         NTSTATUS status;
 247         PyObject *py_session_info;
 248         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 249         struct auth_session_info *info;
 250         if (security->ops == NULL) {
 251                 PyErr_SetString(PyExc_RuntimeError, "no mechanism selected");
 252                 return NULL;
 253         }
 254         mem_ctx = talloc_new(NULL);
 255
 256         status = gensec_session_info(security, mem_ctx, &info);
 257         if (NT_STATUS_IS_ERR(status)) {
 258                 PyErr_SetNTSTATUS(status);
 259                 return NULL;
 260         }
 261
 262         py_session_info = py_return_ndr_struct("samba.dcerpc.auth", "session_info",
 263                                                  info, info);
 264         talloc_free(mem_ctx);
 265         return py_session_info;
 266 }
 267
 268 static PyObject *py_gensec_session_key(PyObject *self)
 269 {
 270         TALLOC_CTX *mem_ctx;
 271         NTSTATUS status;
 272         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 273         DATA_BLOB session_key = data_blob_null;
 274         static PyObject *session_key_obj = NULL;
 275
 276         if (security->ops == NULL) {
 277                 PyErr_SetString(PyExc_RuntimeError, "no mechanism selected");
 278                 return NULL;
 279         }
 280         mem_ctx = talloc_new(NULL);
 281
 282         status = gensec_session_key(security, mem_ctx, &session_key);
 283         if (!NT_STATUS_IS_OK(status)) {
 284                 talloc_free(mem_ctx);
 285                 PyErr_SetNTSTATUS(status);
 286                 return NULL;
 287         }
 288
 289         session_key_obj = PyString_FromStringAndSize((const char *)session_key.data,
 290                                                      session_key.length);
 291         talloc_free(mem_ctx);
 292         return session_key_obj;
 293 }
 294
 295 static PyObject *py_gensec_start_mech_by_name(PyObject *self, PyObject *args)
 296 {
 297         char *name;
 298         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 299         NTSTATUS status;
 300
 301         if (!PyArg_ParseTuple(args, "s", &name))
 302                 return NULL;
 303
 304         status = gensec_start_mech_by_name(security, name);
 305         if (!NT_STATUS_IS_OK(status)) {
 306                 PyErr_SetNTSTATUS(status);
 307                 return NULL;
 308         }
 309
 310         Py_RETURN_NONE;
 311 }
 312
 313 static PyObject *py_gensec_start_mech_by_sasl_name(PyObject *self, PyObject *args)
 314 {
 315         char *sasl_name;
 316         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 317         NTSTATUS status;
 318
 319         if (!PyArg_ParseTuple(args, "s", &sasl_name))
 320                 return NULL;
 321
 322         status = gensec_start_mech_by_sasl_name(security, sasl_name);
 323         if (!NT_STATUS_IS_OK(status)) {
 324                 PyErr_SetNTSTATUS(status);
 325                 return NULL;
 326         }
 327
 328         Py_RETURN_NONE;
 329 }
 330
 331 static PyObject *py_gensec_start_mech_by_authtype(PyObject *self, PyObject *args)
 332 {
 333         int authtype, level;
 334         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 335         NTSTATUS status;
 336         if (!PyArg_ParseTuple(args, "ii", &authtype, &level))
 337                 return NULL;
 338
 339         status = gensec_start_mech_by_authtype(security, authtype, level);
 340         if (!NT_STATUS_IS_OK(status)) {
 341                 PyErr_SetNTSTATUS(status);
 342                 return NULL;
 343         }
 344
 345         Py_RETURN_NONE;
 346 }
 347
 348 static PyObject *py_gensec_want_feature(PyObject *self, PyObject *args)
 349 {
 350         int feature;
 351         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 352         /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
 353         if (!PyArg_ParseTuple(args, "i", &feature))
 354                 return NULL;
 355
 356         gensec_want_feature(security, feature);
 357
 358         Py_RETURN_NONE;
 359 }
 360
 361 static PyObject *py_gensec_have_feature(PyObject *self, PyObject *args)
 362 {
 363         int feature;
 364         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 365         /* This is i (and declared as an int above) by design, as they are handled as an integer in python */
 366         if (!PyArg_ParseTuple(args, "i", &feature))
 367                 return NULL;
 368
 369         if (gensec_have_feature(security, feature)) {
 370                 return Py_True;
 371         }
 372         return Py_False;
 373 }
 374
 375 static PyObject *py_gensec_set_max_update_size(PyObject *self, PyObject *args)
 376 {
 377         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 378         unsigned int max_update_size = 0;
 379
 380         if (!PyArg_ParseTuple(args, "I", &max_update_size))
 381                 return NULL;
 382
 383         gensec_set_max_update_size(security, max_update_size);
 384
 385         Py_RETURN_NONE;
 386 }
 387
 388 static PyObject *py_gensec_max_update_size(PyObject *self)
 389 {
 390         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 391         unsigned int max_update_size = gensec_max_update_size(security);
 392
 393         return PyInt_FromLong(max_update_size);
 394 }
 395
 396 static PyObject *py_gensec_update(PyObject *self, PyObject *args)
 397 {
 398         NTSTATUS status;
 399         TALLOC_CTX *mem_ctx;
 400         DATA_BLOB in, out;
 401         PyObject *ret, *py_in;
 402         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 403         PyObject *finished_processing;
 404         struct tevent_context *ev;
 405
 406         if (!PyArg_ParseTuple(args, "O", &py_in))
 407                 return NULL;
 408
 409         mem_ctx = talloc_new(NULL);
 410
 411         if (!PyString_Check(py_in)) {
 412                 PyErr_Format(PyExc_TypeError, "expected a string");
 413                 return NULL;
 414         }
 415
 416         in.data = (uint8_t *)PyString_AsString(py_in);
 417         in.length = PyString_Size(py_in);
 418
 419         ev = samba_tevent_context_init(mem_ctx);
 420         if (ev == NULL) {
 421                 PyErr_NoMemory();
 422                 PyObject_Del(self);
 423                 return NULL;
 424         }
 425
 426         status = gensec_update(security, mem_ctx, ev, in, &out);
 427
 428         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)
 429             && !NT_STATUS_IS_OK(status)) {
 430                 PyErr_SetNTSTATUS(status);
 431                 talloc_free(mem_ctx);
 432                 return NULL;
 433         }
 434         ret = PyString_FromStringAndSize((const char *)out.data, out.length);
 435         talloc_free(mem_ctx);
 436
 437         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 438                 finished_processing = Py_False;
 439         } else {
 440                 finished_processing = Py_True;
 441         }
 442
 443         return PyTuple_Pack(2, finished_processing, ret);
 444 }
 445
 446 static PyObject *py_gensec_wrap(PyObject *self, PyObject *args)
 447 {
 448         NTSTATUS status;
 449
 450         TALLOC_CTX *mem_ctx;
 451         DATA_BLOB in, out;
 452         PyObject *ret, *py_in;
 453         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 454
 455         if (!PyArg_ParseTuple(args, "O", &py_in))
 456                 return NULL;
 457
 458         mem_ctx = talloc_new(NULL);
 459
 460         if (!PyString_Check(py_in)) {
 461                 PyErr_Format(PyExc_TypeError, "expected a string");
 462                 return NULL;
 463         }
 464         in.data = (uint8_t *)PyString_AsString(py_in);
 465         in.length = PyString_Size(py_in);
 466
 467         status = gensec_wrap(security, mem_ctx, &in, &out);
 468
 469         if (!NT_STATUS_IS_OK(status)) {
 470                 PyErr_SetNTSTATUS(status);
 471                 talloc_free(mem_ctx);
 472                 return NULL;
 473         }
 474
 475         ret = PyString_FromStringAndSize((const char *)out.data, out.length);
 476         talloc_free(mem_ctx);
 477         return ret;
 478 }
 479
 480 static PyObject *py_gensec_unwrap(PyObject *self, PyObject *args)
 481 {
 482         NTSTATUS status;
 483
 484         TALLOC_CTX *mem_ctx;
 485         DATA_BLOB in, out;
 486         PyObject *ret, *py_in;
 487         struct gensec_security *security = pytalloc_get_type(self, struct gensec_security);
 488
 489         if (!PyArg_ParseTuple(args, "O", &py_in))
 490                 return NULL;
 491
 492         mem_ctx = talloc_new(NULL);
 493
 494         if (!PyString_Check(py_in)) {
 495                 PyErr_Format(PyExc_TypeError, "expected a string");
 496                 return NULL;
 497         }
 498
 499         in.data = (uint8_t *)PyString_AsString(py_in);
 500         in.length = PyString_Size(py_in);
 501
 502         status = gensec_unwrap(security, mem_ctx, &in, &out);
 503
 504         if (!NT_STATUS_IS_OK(status)) {
 505                 PyErr_SetNTSTATUS(status);
 506                 talloc_free(mem_ctx);
 507                 return NULL;
 508         }
 509
 510         ret = PyString_FromStringAndSize((const char *)out.data, out.length);
 511         talloc_free(mem_ctx);
 512         return ret;
 513 }
 514
 515 static PyMethodDef py_gensec_security_methods[] = {
 516         { "start_client", (PyCFunction)py_gensec_start_client, METH_VARARGS|METH_KEYWORDS|METH_CLASS,
 517                 "S.start_client(settings) -> gensec" },
 518         { "start_server", (PyCFunction)py_gensec_start_server, METH_VARARGS|METH_KEYWORDS|METH_CLASS,
 519                 "S.start_server(auth_ctx, settings) -> gensec" },
 520         { "set_credentials", (PyCFunction)py_gensec_set_credentials, METH_VARARGS,
 521                 "S.start_client(credentials)" },
 522         { "session_info", (PyCFunction)py_gensec_session_info, METH_NOARGS,
 523                 "S.session_info() -> info" },
 524         { "session_key", (PyCFunction)py_gensec_session_key, METH_NOARGS,
 525                 "S.session_key() -> key" },
 526         { "start_mech_by_name", (PyCFunction)py_gensec_start_mech_by_name, METH_VARARGS,
 527                 "S.start_mech_by_name(name)" },
 528         { "start_mech_by_sasl_name", (PyCFunction)py_gensec_start_mech_by_sasl_name, METH_VARARGS,
 529                 "S.start_mech_by_sasl_name(name)" },
 530         { "start_mech_by_authtype", (PyCFunction)py_gensec_start_mech_by_authtype, METH_VARARGS,
 531                 "S.start_mech_by_authtype(authtype, level)" },
 532         { "get_name_by_authtype", (PyCFunction)py_get_name_by_authtype, METH_VARARGS,
 533                 "S.get_name_by_authtype(authtype) -> name\nLookup an auth type." },
 534         { "want_feature", (PyCFunction)py_gensec_want_feature, METH_VARARGS,
 535                 "S.want_feature(feature)\n Request that GENSEC negotiate a particular feature." },
 536         { "have_feature", (PyCFunction)py_gensec_have_feature, METH_VARARGS,
 537                 "S.have_feature()\n Return True if GENSEC negotiated a particular feature." },
 538         { "set_max_update_size",  (PyCFunction)py_gensec_set_max_update_size, METH_VARARGS,
 539                 "S.set_max_update_size(max_size) \n Some mechs can fragment update packets, needs to be use before the mech is started." },
 540         { "max_update_size",  (PyCFunction)py_gensec_max_update_size, 0,
 541                 "S.max_update_size() \n Return the current max_update_size." },
 542         { "update",  (PyCFunction)py_gensec_update, METH_VARARGS,
 543                 "S.update(blob_in) -> (finished, blob_out)\nPerform one step in a GENSEC dance.  Repeat with new packets until finished is true or exception." },
 544         { "wrap",  (PyCFunction)py_gensec_wrap, METH_VARARGS,
 545                 "S.wrap(blob_in) -> blob_out\nPackage one clear packet into a wrapped GENSEC packet." },
 546         { "unwrap",  (PyCFunction)py_gensec_unwrap, METH_VARARGS,
 547                 "S.unwrap(blob_in) -> blob_out\nPerform one wrapped GENSEC packet into a clear packet." },
 548         { NULL }
 549 };
 550
 551 static PyTypeObject Py_Security = {
 552         .tp_name = "gensec.Security",
 553         .tp_flags = Py_TPFLAGS_DEFAULT,
 554         .tp_methods = py_gensec_security_methods,
 555         .tp_basicsize = sizeof(pytalloc_Object),
 556 };
 557
 558 void initgensec(void);
 559 void initgensec(void)
 560 {
 561         PyObject *m;
 562
 563         Py_Security.tp_base = pytalloc_GetObjectType();
 564         if (Py_Security.tp_base == NULL)
 565                 return;
 566
 567         if (PyType_Ready(&Py_Security) < 0)
 568                 return;
 569
 570         m = Py_InitModule3("gensec", NULL, "Generic Security Interface.");
 571         if (m == NULL)
 572                 return;
 573
 574         PyModule_AddObject(m, "FEATURE_SESSION_KEY",     PyInt_FromLong(GENSEC_FEATURE_SESSION_KEY));
 575         PyModule_AddObject(m, "FEATURE_SIGN",            PyInt_FromLong(GENSEC_FEATURE_SIGN));
 576         PyModule_AddObject(m, "FEATURE_SEAL",            PyInt_FromLong(GENSEC_FEATURE_SEAL));
 577         PyModule_AddObject(m, "FEATURE_DCE_STYLE",       PyInt_FromLong(GENSEC_FEATURE_DCE_STYLE));
 578         PyModule_AddObject(m, "FEATURE_ASYNC_REPLIES",   PyInt_FromLong(GENSEC_FEATURE_ASYNC_REPLIES));
 579         PyModule_AddObject(m, "FEATURE_DATAGRAM_MODE",   PyInt_FromLong(GENSEC_FEATURE_DATAGRAM_MODE));
 580         PyModule_AddObject(m, "FEATURE_SIGN_PKT_HEADER", PyInt_FromLong(GENSEC_FEATURE_SIGN_PKT_HEADER));
 581         PyModule_AddObject(m, "FEATURE_NEW_SPNEGO",      PyInt_FromLong(GENSEC_FEATURE_NEW_SPNEGO));
 582
 583         Py_INCREF(&Py_Security);
 584         PyModule_AddObject(m, "Security", (PyObject *)&Py_Security);
 585 }