Line data Source code
1 : /*
2 : * Unix SMB/CIFS implementation.
3 : * Gensec based tldap auth
4 : * Copyright (C) Volker Lendecke 2015
5 : *
6 : * This program is free software; you can redistribute it and/or modify
7 : * it under the terms of the GNU General Public License as published by
8 : * the Free Software Foundation; either version 3 of the License, or
9 : * (at your option) any later version.
10 : *
11 : * This program is distributed in the hope that it will be useful,
12 : * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 : * GNU General Public License for more details.
15 : *
16 : * You should have received a copy of the GNU General Public License
17 : * along with this program. If not, see <http://www.gnu.org/licenses/>.
18 : */
19 :
20 : #include "tldap_gensec_bind.h"
21 : #include "tldap_util.h"
22 : #include "lib/util/tevent_unix.h"
23 : #include "lib/util/talloc_stack.h"
24 : #include "lib/util/samba_util.h"
25 : #include "lib/util/debug.h"
26 : #include "auth/gensec/gensec.h"
27 : #include "auth/gensec/gensec_internal.h" /* TODO: remove this */
28 : #include "lib/param/param.h"
29 : #include "source4/auth/gensec/gensec_tstream.h"
30 :
31 : struct tldap_gensec_bind_state {
32 : struct tevent_context *ev;
33 : struct tldap_context *ctx;
34 : struct cli_credentials *creds;
35 : const char *target_service;
36 : const char *target_hostname;
37 : const char *target_principal;
38 : struct loadparm_context *lp_ctx;
39 : uint32_t gensec_features;
40 :
41 : bool first;
42 : struct gensec_security *gensec;
43 : NTSTATUS gensec_status;
44 : DATA_BLOB gensec_output;
45 : };
46 :
47 : static void tldap_gensec_bind_got_mechs(struct tevent_req *subreq);
48 : static void tldap_gensec_update_done(struct tldap_gensec_bind_state *state,
49 : struct tevent_req *subreq);
50 : static void tldap_gensec_bind_done(struct tevent_req *subreq);
51 :
52 0 : static struct tevent_req *tldap_gensec_bind_send(
53 : TALLOC_CTX *mem_ctx, struct tevent_context *ev,
54 : struct tldap_context *ctx, struct cli_credentials *creds,
55 : const char *target_service, const char *target_hostname,
56 : const char *target_principal, struct loadparm_context *lp_ctx,
57 : uint32_t gensec_features)
58 : {
59 : struct tevent_req *req, *subreq;
60 : struct tldap_gensec_bind_state *state;
61 :
62 0 : const char *attrs[] = { "supportedSASLMechanisms" };
63 :
64 0 : req = tevent_req_create(mem_ctx, &state,
65 : struct tldap_gensec_bind_state);
66 0 : if (req == NULL) {
67 0 : return NULL;
68 : }
69 0 : state->ev = ev;
70 0 : state->ctx = ctx;
71 0 : state->creds = creds;
72 0 : state->target_service = target_service;
73 0 : state->target_hostname = target_hostname;
74 0 : state->target_principal = target_principal;
75 0 : state->lp_ctx = lp_ctx;
76 0 : state->gensec_features = gensec_features;
77 0 : state->first = true;
78 :
79 0 : subreq = tldap_search_all_send(
80 0 : state, state->ev, state->ctx, "", TLDAP_SCOPE_BASE,
81 : "(objectclass=*)", attrs, ARRAY_SIZE(attrs),
82 : false, NULL, 0, NULL, 0, 0, 1 /* sizelimit */, 0);
83 0 : if (tevent_req_nomem(subreq, req)) {
84 0 : return tevent_req_post(req, ev);
85 : }
86 0 : tevent_req_set_callback(subreq, tldap_gensec_bind_got_mechs, req);
87 0 : return req;
88 : }
89 :
90 0 : static void tldap_gensec_bind_got_mechs(struct tevent_req *subreq)
91 : {
92 0 : struct tevent_req *req = tevent_req_callback_data(
93 : subreq, struct tevent_req);
94 0 : struct tldap_gensec_bind_state *state = tevent_req_data(
95 : req, struct tldap_gensec_bind_state);
96 : struct tldap_message **msgs, *msg, *result;
97 : struct tldap_attribute *attribs, *attrib;
98 : int num_attribs;
99 : size_t num_msgs;
100 : TLDAPRC rc;
101 : int i;
102 : bool ok;
103 : const char **sasl_mechs;
104 : NTSTATUS status;
105 :
106 0 : rc = tldap_search_all_recv(subreq, state, &msgs, &result);
107 0 : TALLOC_FREE(subreq);
108 0 : if (tevent_req_ldap_error(req, rc)) {
109 0 : return;
110 : }
111 :
112 : /*
113 : * TODO: Inspect "Result"
114 : */
115 :
116 0 : num_msgs = talloc_array_length(msgs);
117 0 : if (num_msgs != 1) {
118 0 : DBG_DEBUG("num_msgs = %zu\n", num_msgs);
119 0 : tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
120 0 : return;
121 : }
122 0 : msg = msgs[0];
123 :
124 0 : ok = tldap_entry_attributes(msg, &attribs, &num_attribs);
125 0 : if (!ok) {
126 0 : DBG_DEBUG("tldap_entry_attributes failed\n");
127 0 : tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
128 0 : return;
129 : }
130 :
131 0 : if (num_attribs != 1) {
132 0 : DBG_DEBUG("num_attribs = %d\n", num_attribs);
133 0 : tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
134 0 : return;
135 : }
136 0 : attrib = &attribs[0];
137 :
138 0 : sasl_mechs = talloc_array(state, const char *, attrib->num_values+1);
139 0 : if (tevent_req_nomem(sasl_mechs, req)) {
140 0 : return;
141 : }
142 :
143 0 : for (i=0; i<attrib->num_values; i++) {
144 0 : DATA_BLOB *v = &attrib->values[i];
145 : size_t len;
146 :
147 0 : ok = convert_string_talloc(sasl_mechs, CH_UTF8, CH_UNIX,
148 0 : v->data, v->length,
149 0 : &sasl_mechs[i], &len);
150 0 : if (!ok) {
151 0 : DBG_DEBUG("convert_string_talloc failed\n");
152 0 : tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
153 0 : return;
154 : }
155 : }
156 0 : sasl_mechs[attrib->num_values] = NULL;
157 :
158 0 : gensec_init();
159 :
160 0 : status = gensec_client_start(
161 : state, &state->gensec,
162 : lpcfg_gensec_settings(state, state->lp_ctx));
163 0 : if (!NT_STATUS_IS_OK(status)) {
164 0 : DBG_DEBUG("gensec_client_start failed: %s\n",
165 : nt_errstr(status));
166 0 : tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
167 0 : return;
168 : }
169 :
170 0 : status = gensec_set_credentials(state->gensec, state->creds);
171 0 : if (!NT_STATUS_IS_OK(status)) {
172 0 : DBG_DEBUG("gensec_set_credentials failed: %s\n",
173 : nt_errstr(status));
174 0 : tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
175 0 : return;
176 : }
177 :
178 0 : status = gensec_set_target_service(state->gensec,
179 : state->target_service);
180 0 : if (!NT_STATUS_IS_OK(status)) {
181 0 : DBG_DEBUG("gensec_set_target_service failed: %s\n",
182 : nt_errstr(status));
183 0 : tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
184 0 : return;
185 : }
186 :
187 0 : if (state->target_hostname != NULL) {
188 0 : status = gensec_set_target_hostname(state->gensec,
189 : state->target_hostname);
190 0 : if (!NT_STATUS_IS_OK(status)) {
191 0 : DBG_DEBUG("gensec_set_target_hostname failed: %s\n",
192 : nt_errstr(status));
193 0 : tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
194 0 : return;
195 : }
196 : }
197 :
198 0 : if (state->target_principal != NULL) {
199 0 : status = gensec_set_target_principal(state->gensec,
200 : state->target_principal);
201 0 : if (!NT_STATUS_IS_OK(status)) {
202 0 : DBG_DEBUG("gensec_set_target_principal failed: %s\n",
203 : nt_errstr(status));
204 0 : tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
205 0 : return;
206 : }
207 : }
208 :
209 0 : gensec_want_feature(state->gensec, state->gensec_features);
210 :
211 0 : status = gensec_start_mech_by_sasl_list(state->gensec, sasl_mechs);
212 0 : if (!NT_STATUS_IS_OK(status)) {
213 0 : DBG_DEBUG("gensec_start_mech_by_sasl_list failed: %s\n",
214 : nt_errstr(status));
215 0 : tevent_req_ldap_error(req, TLDAP_OPERATIONS_ERROR);
216 0 : return;
217 : }
218 :
219 0 : state->gensec_status = gensec_update(state->gensec, state,
220 : data_blob_null,
221 : &state->gensec_output);
222 0 : tldap_gensec_update_done(state, req);
223 : }
224 :
225 0 : static void tldap_gensec_update_done(struct tldap_gensec_bind_state *state,
226 : struct tevent_req *req)
227 : {
228 : struct tevent_req *subreq;
229 :
230 0 : if (!NT_STATUS_IS_OK(state->gensec_status) &&
231 0 : !NT_STATUS_EQUAL(state->gensec_status,
232 : NT_STATUS_MORE_PROCESSING_REQUIRED)) {
233 0 : DBG_DEBUG("gensec_update failed: %s\n",
234 : nt_errstr(state->gensec_status));
235 0 : tevent_req_ldap_error(req, TLDAP_INVALID_CREDENTIALS);
236 0 : return;
237 : }
238 :
239 0 : if (NT_STATUS_IS_OK(state->gensec_status) &&
240 0 : (state->gensec_output.length == 0)) {
241 :
242 0 : if (state->first) {
243 0 : tevent_req_ldap_error(req, TLDAP_INVALID_CREDENTIALS);
244 : } else {
245 0 : tevent_req_done(req);
246 : }
247 0 : return;
248 : }
249 :
250 0 : state->first = false;
251 :
252 0 : subreq = tldap_sasl_bind_send(
253 : state, state->ev, state->ctx, "",
254 0 : state->gensec->ops->sasl_name, &state->gensec_output,
255 : NULL, 0, NULL, 0);
256 0 : if (tevent_req_nomem(subreq, req)) {
257 0 : return;
258 : }
259 0 : tevent_req_set_callback(subreq, tldap_gensec_bind_done, req);
260 : }
261 :
262 0 : static void tldap_gensec_bind_done(struct tevent_req *subreq)
263 : {
264 0 : struct tevent_req *req = tevent_req_callback_data(
265 : subreq, struct tevent_req);
266 0 : struct tldap_gensec_bind_state *state = tevent_req_data(
267 : req, struct tldap_gensec_bind_state);
268 : DATA_BLOB input;
269 : TLDAPRC rc;
270 :
271 0 : rc = tldap_sasl_bind_recv(subreq, state, &input);
272 0 : TALLOC_FREE(subreq);
273 0 : if (!TLDAP_RC_IS_SUCCESS(rc) &&
274 0 : !TLDAP_RC_EQUAL(rc, TLDAP_SASL_BIND_IN_PROGRESS)) {
275 0 : tevent_req_ldap_error(req, rc);
276 0 : return;
277 : }
278 :
279 0 : if (TLDAP_RC_IS_SUCCESS(rc) && NT_STATUS_IS_OK(state->gensec_status)) {
280 0 : tevent_req_done(req);
281 0 : return;
282 : }
283 :
284 0 : state->gensec_status = gensec_update(state->gensec, state,
285 : input,
286 : &state->gensec_output);
287 0 : tldap_gensec_update_done(state, req);
288 : }
289 :
290 0 : static TLDAPRC tldap_gensec_bind_recv(struct tevent_req *req)
291 : {
292 0 : struct tldap_gensec_bind_state *state = tevent_req_data(
293 : req, struct tldap_gensec_bind_state);
294 : struct tstream_context *plain, *sec;
295 : NTSTATUS status;
296 : TLDAPRC rc;
297 :
298 0 : if (tevent_req_is_ldap_error(req, &rc)) {
299 0 : return rc;
300 : }
301 :
302 0 : if ((state->gensec_features & GENSEC_FEATURE_SIGN) &&
303 0 : !gensec_have_feature(state->gensec, GENSEC_FEATURE_SIGN)) {
304 0 : return TLDAP_OPERATIONS_ERROR;
305 : }
306 0 : if ((state->gensec_features & GENSEC_FEATURE_SEAL) &&
307 0 : !gensec_have_feature(state->gensec, GENSEC_FEATURE_SEAL)) {
308 0 : return TLDAP_OPERATIONS_ERROR;
309 : }
310 :
311 0 : if (!gensec_have_feature(state->gensec, GENSEC_FEATURE_SIGN) &&
312 0 : !gensec_have_feature(state->gensec, GENSEC_FEATURE_SEAL)) {
313 0 : return TLDAP_SUCCESS;
314 : }
315 :
316 : /*
317 : * The gensec ctx needs to survive as long as the ldap context
318 : * lives
319 : */
320 0 : talloc_steal(state->ctx, state->gensec);
321 :
322 0 : plain = tldap_get_tstream(state->ctx);
323 :
324 0 : status = gensec_create_tstream(state->ctx, state->gensec,
325 : plain, &sec);
326 0 : if (!NT_STATUS_IS_OK(status)) {
327 0 : DBG_DEBUG("gensec_create_tstream failed: %s\n",
328 : nt_errstr(status));
329 0 : return TLDAP_OPERATIONS_ERROR;
330 : }
331 :
332 0 : tldap_set_tstream(state->ctx, sec);
333 :
334 0 : return TLDAP_SUCCESS;
335 : }
336 :
337 0 : TLDAPRC tldap_gensec_bind(
338 : struct tldap_context *ctx, struct cli_credentials *creds,
339 : const char *target_service, const char *target_hostname,
340 : const char *target_principal, struct loadparm_context *lp_ctx,
341 : uint32_t gensec_features)
342 : {
343 0 : TALLOC_CTX *frame = talloc_stackframe();
344 : struct tevent_context *ev;
345 : struct tevent_req *req;
346 0 : TLDAPRC rc = TLDAP_NO_MEMORY;
347 :
348 0 : ev = samba_tevent_context_init(frame);
349 0 : if (ev == NULL) {
350 0 : goto fail;
351 : }
352 0 : req = tldap_gensec_bind_send(frame, ev, ctx, creds, target_service,
353 : target_hostname, target_principal, lp_ctx,
354 : gensec_features);
355 0 : if (req == NULL) {
356 0 : goto fail;
357 : }
358 0 : if (!tevent_req_poll(req, ev)) {
359 0 : rc = TLDAP_OPERATIONS_ERROR;
360 0 : goto fail;
361 : }
362 0 : rc = tldap_gensec_bind_recv(req);
363 0 : fail:
364 0 : TALLOC_FREE(frame);
365 0 : return rc;
366 : }
|
