#include "../lib/util/asn1.h"
#include "../lib/tsocket/tsocket.h"
#include "../lib/util/tevent_unix.h"
+#include "../libcli/util/ntstatus.h"
+#include "../source4/lib/tls/tls.h"
static TLDAPRC tldap_simple_recv(struct tevent_req *req);
static bool tldap_msg_set_pending(struct tevent_req *req);
struct tldap_context {
int ld_version;
struct tstream_context *plain;
+ bool starttls_needed;
+ struct tstream_context *tls;
struct tstream_context *gensec;
struct tstream_context *active;
int msgid;
return ld->plain;
}
+void tldap_set_starttls_needed(struct tldap_context *ld, bool needed)
+{
+ if (ld == NULL) {
+ return;
+ }
+
+ ld->starttls_needed = needed;
+}
+
+bool tldap_get_starttls_needed(struct tldap_context *ld)
+{
+ if (ld == NULL) {
+ return false;
+ }
+
+ return ld->starttls_needed;
+}
+
+bool tldap_has_tls_tstream(struct tldap_context *ld)
+{
+ return ld->tls != NULL && ld->active == ld->tls;
+}
+
+const DATA_BLOB *tldap_tls_channel_bindings(struct tldap_context *ld)
+{
+ return tstream_tls_channel_bindings(ld->tls);
+}
+
+void tldap_set_tls_tstream(struct tldap_context *ld,
+ struct tstream_context **stream)
+{
+ TALLOC_FREE(ld->tls);
+ if (stream != NULL) {
+ ld->tls = talloc_move(ld, stream);
+ }
+ if (ld->tls != NULL) {
+ ld->active = ld->tls;
+ } else {
+ ld->active = ld->plain;
+ }
+}
+
bool tldap_has_gensec_tstream(struct tldap_context *ld)
{
return ld->gensec != NULL && ld->active == ld->gensec;
TALLOC_FREE(ld->read_req);
ld->active = NULL;
TALLOC_FREE(ld->gensec);
+ TALLOC_FREE(ld->tls);
TALLOC_FREE(ld->plain);
while (talloc_array_length(ld->pending) > 0) {
{
struct tevent_req *req = NULL;
struct tldap_gensec_bind_state *state = NULL;
+ const DATA_BLOB *tls_cb = NULL;
NTSTATUS status;
req = tevent_req_create(mem_ctx, &state,
}
}
+ if (tldap_has_tls_tstream(state->ctx)) {
+ if (gensec_features & (GENSEC_FEATURE_SIGN|GENSEC_FEATURE_SEAL)) {
+ DBG_WARNING("sign or seal not allowed over tls\n");
+ tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
+ return tevent_req_post(req, ev);
+ }
+
+ tls_cb = tldap_tls_channel_bindings(state->ctx);
+ }
+
+ if (tls_cb != NULL) {
+ uint32_t initiator_addrtype = 0;
+ const DATA_BLOB *initiator_address = NULL;
+ uint32_t acceptor_addrtype = 0;
+ const DATA_BLOB *acceptor_address = NULL;
+ const DATA_BLOB *application_data = tls_cb;
+
+ status = gensec_set_channel_bindings(state->gensec,
+ initiator_addrtype,
+ initiator_address,
+ acceptor_addrtype,
+ acceptor_address,
+ application_data);
+ if (!NT_STATUS_IS_OK(status)) {
+ DBG_DEBUG("gensec_set_channel_bindings: %s\n",
+ nt_errstr(status));
+ tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
+ return tevent_req_post(req, ev);
+ }
+ }
+
gensec_want_feature(state->gensec, state->gensec_features);
status = gensec_start_mech_by_sasl_name(state->gensec, "GSS-SPNEGO");
--- /dev/null
+/*
+ * Unix SMB/CIFS implementation.
+ * tls based tldap connect
+ * Copyright (C) Stefan Metzmacher 2024
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "replace.h"
+#include "tldap.h"
+#include "tldap_tls_connect.h"
+#include "lib/util/samba_util.h"
+#include "lib/util/debug.h"
+#include "lib/param/param.h"
+#include "../libcli/util/ntstatus.h"
+#include "../source4/lib/tls/tls.h"
+
+struct tldap_tls_connect_state {
+ struct tevent_context *ev;
+ struct tldap_context *ctx;
+ struct loadparm_context *lp_ctx;
+ const char *peer_name;
+};
+
+static void tldap_tls_connect_starttls_done(struct tevent_req *subreq);
+static void tldap_tls_connect_crypto_start(struct tevent_req *req);
+static void tldap_tls_connect_crypto_done(struct tevent_req *subreq);
+
+struct tevent_req *tldap_tls_connect_send(
+ TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct tldap_context *ctx,
+ struct loadparm_context *lp_ctx,
+ const char *peer_name)
+{
+ struct tevent_req *req = NULL;
+ struct tldap_tls_connect_state *state = NULL;
+
+ req = tevent_req_create(mem_ctx, &state,
+ struct tldap_tls_connect_state);
+ if (req == NULL) {
+ return NULL;
+ }
+ state->ev = ev;
+ state->ctx = ctx;
+ state->lp_ctx = lp_ctx;
+ state->peer_name = peer_name;
+
+ if (!tldap_connection_ok(ctx)) {
+ DBG_ERR("tldap_connection_ok() => false\n");
+ tevent_req_ldap_error(req, TLDAP_CONNECT_ERROR);
+ return tevent_req_post(req, ev);
+ }
+
+ if (tldap_has_gensec_tstream(ctx)) {
+ DBG_ERR("tldap_has_gensec_tstream() => true\n");
+ tevent_req_ldap_error(req, TLDAP_LOCAL_ERROR);
+ return tevent_req_post(req, ev);
+ }
+
+ if (tldap_get_starttls_needed(ctx)) {
+ struct tevent_req *subreq = NULL;
+ static const char *start_tls_oid = "1.3.6.1.4.1.1466.20037";
+
+ subreq = tldap_extended_send(state,
+ state->ev,
+ state->ctx,
+ start_tls_oid,
+ NULL, /* in_blob */
+ NULL, /* sctrls */
+ 0, /* num_sctrls */
+ NULL, /* cctrls */
+ 0); /* num_cctrls */
+ if (tevent_req_nomem(subreq, req)) {
+ return tevent_req_post(req, ev);
+ }
+ tevent_req_set_callback(subreq,
+ tldap_tls_connect_starttls_done,
+ req);
+
+ return req;
+ }
+
+ tldap_tls_connect_crypto_start(req);
+ if (!tevent_req_is_in_progress(req)) {
+ return tevent_req_post(req, ev);
+ }
+
+ return req;
+}
+
+static void tldap_tls_connect_starttls_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(
+ subreq, struct tevent_req);
+ struct tldap_tls_connect_state *state = tevent_req_data(
+ req, struct tldap_tls_connect_state);
+ TLDAPRC rc;
+
+ rc = tldap_extended_recv(subreq, state, NULL, NULL);
+ TALLOC_FREE(subreq);
+ if (!TLDAP_RC_IS_SUCCESS(rc)) {
+ DBG_ERR("tldap_extended_recv(STARTTLS, %s): %s\n",
+ state->peer_name, tldap_rc2string(rc));
+ tevent_req_ldap_error(req, rc);
+ return;
+ }
+
+ tldap_set_starttls_needed(state->ctx, false);
+
+ tldap_tls_connect_crypto_start(req);
+}
+
+static void tldap_tls_connect_crypto_start(struct tevent_req *req)
+{
+ struct tldap_tls_connect_state *state = tevent_req_data(
+ req, struct tldap_tls_connect_state);
+ struct tstream_context *plain_stream = NULL;
+ struct tstream_tls_params *tls_params = NULL;
+ struct tevent_req *subreq = NULL;
+ NTSTATUS status;
+
+ plain_stream = tldap_get_plain_tstream(state->ctx);
+ if (plain_stream == NULL) {
+ DBG_ERR("tldap_get_plain_tstream() = NULL\n");
+ tevent_req_ldap_error(req, TLDAP_LOCAL_ERROR);
+ return;
+ }
+
+ status = tstream_tls_params_client_lpcfg(state,
+ state->lp_ctx,
+ state->peer_name,
+ &tls_params);
+ if (!NT_STATUS_IS_OK(status)) {
+ DBG_ERR("tstream_tls_params_client_lpcfg(%s): %s\n",
+ state->peer_name, nt_errstr(status));
+ tevent_req_ldap_error(req, TLDAP_LOCAL_ERROR);
+ return;
+ }
+
+ subreq = tstream_tls_connect_send(state,
+ state->ev,
+ plain_stream,
+ tls_params);
+ if (tevent_req_nomem(subreq, req)) {
+ return;
+ }
+ tevent_req_set_callback(subreq,
+ tldap_tls_connect_crypto_done,
+ req);
+}
+
+static void tldap_tls_connect_crypto_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(
+ subreq, struct tevent_req);
+ struct tldap_tls_connect_state *state = tevent_req_data(
+ req, struct tldap_tls_connect_state);
+ struct tstream_context *tls_stream = NULL;
+ int ret;
+ int error;
+
+ ret = tstream_tls_connect_recv(subreq, &error, state, &tls_stream);
+ TALLOC_FREE(subreq);
+ if (ret != 0) {
+ DBG_ERR("tstream_tls_connect_recv(%s): %d %d\n",
+ state->peer_name, ret, error);
+ tevent_req_ldap_error(req, TLDAP_CONNECT_ERROR);
+ return;
+ }
+
+ tldap_set_tls_tstream(state->ctx, &tls_stream);
+
+ tevent_req_done(req);
+}
+
+TLDAPRC tldap_tls_connect_recv(struct tevent_req *req)
+{
+ TLDAPRC rc;
+
+ if (tevent_req_is_ldap_error(req, &rc)) {
+ return rc;
+ }
+
+ return TLDAP_SUCCESS;
+}
+
+TLDAPRC tldap_tls_connect(
+ struct tldap_context *ctx,
+ struct loadparm_context *lp_ctx,
+ const char *peer_name)
+{
+ TALLOC_CTX *frame = talloc_stackframe();
+ struct tevent_context *ev;
+ struct tevent_req *req;
+ TLDAPRC rc = TLDAP_NO_MEMORY;
+
+ ev = samba_tevent_context_init(frame);
+ if (ev == NULL) {
+ goto fail;
+ }
+ req = tldap_tls_connect_send(frame,
+ ev,
+ ctx,
+ lp_ctx,
+ peer_name);
+ if (req == NULL) {
+ goto fail;
+ }
+ if (!tevent_req_poll(req, ev)) {
+ rc = TLDAP_OPERATIONS_ERROR;
+ goto fail;
+ }
+ rc = tldap_tls_connect_recv(req);
+ fail:
+ TALLOC_FREE(frame);
+ return rc;
+}
--- /dev/null
+/*
+ * Unix SMB/CIFS implementation.
+ * tls based tldap connect
+ * Copyright (C) Stefan Metzmacher 2024
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __TLDAP_TLS_CONNECT_H__
+#define __TLDAP_TLS_CONNECT_H__
+
+struct tevent_context;
+struct tldap_context;
+struct loadparm_context;
+
+struct tevent_req *tldap_tls_connect_send(
+ TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct tldap_context *ctx,
+ struct loadparm_context *lp_ctx,
+ const char *peer_name);
+TLDAPRC tldap_tls_connect_recv(struct tevent_req *req);
+TLDAPRC tldap_tls_connect(
+ struct tldap_context *ctx,
+ struct loadparm_context *lp_ctx,
+ const char *peer_name);
+
+#endif
git.samba.org / samba.git / commitdiff