kerberosgss.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609
  1. /**
  2. * Copyright (c) 2006-2010 Apple Inc. All rights reserved.
  3. *
  4. * Licensed under the Apache License, Version 2.0 (the "License");
  5. * you may not use this file except in compliance with the License.
  6. * You may obtain a copy of the License at
  7. *
  8. * http://www.apache.org/licenses/LICENSE-2.0
  9. *
  10. * Unless required by applicable law or agreed to in writing, software
  11. * distributed under the License is distributed on an "AS IS" BASIS,
  12. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13. * See the License for the specific language governing permissions and
  14. * limitations under the License.
  15. **/
  16. #include <Python.h>
  17. #include "kerberosgss.h"
  18. #include "base64.h"
  19. #include <stdio.h>
  20. #include <stdlib.h>
  21. #include <string.h>
  22. #include <arpa/inet.h>
  23. static void set_gss_error(OM_uint32 err_maj, OM_uint32 err_min);
  24. extern PyObject *GssException_class;
  25. extern PyObject *KrbException_class;
  26. char* server_principal_details(const char* service, const char* hostname)
  27. {
  28. char match[1024];
  29. int match_len = 0;
  30. char* result = NULL;
  31. int code;
  32. krb5_context kcontext;
  33. krb5_keytab kt = NULL;
  34. krb5_kt_cursor cursor = NULL;
  35. krb5_keytab_entry entry;
  36. char* pname = NULL;
  37. // Generate the principal prefix we want to match
  38. snprintf(match, 1024, "%s/%s@", service, hostname);
  39. match_len = strlen(match);
  40. code = krb5_init_context(&kcontext);
  41. if (code)
  42. {
  43. PyErr_SetObject(KrbException_class, Py_BuildValue("((s:i))",
  44. "Cannot initialize Kerberos5 context", code));
  45. return NULL;
  46. }
  47. if ((code = krb5_kt_default(kcontext, &kt)))
  48. {
  49. PyErr_SetObject(KrbException_class, Py_BuildValue("((s:i))",
  50. "Cannot get default keytab", code));
  51. goto end;
  52. }
  53. if ((code = krb5_kt_start_seq_get(kcontext, kt, &cursor)))
  54. {
  55. PyErr_SetObject(KrbException_class, Py_BuildValue("((s:i))",
  56. "Cannot get sequence cursor from keytab", code));
  57. goto end;
  58. }
  59. while ((code = krb5_kt_next_entry(kcontext, kt, &entry, &cursor)) == 0)
  60. {
  61. if ((code = krb5_unparse_name(kcontext, entry.principal, &pname)))
  62. {
  63. PyErr_SetObject(KrbException_class, Py_BuildValue("((s:i))",
  64. "Cannot parse principal name from keytab", code));
  65. goto end;
  66. }
  67. if (strncmp(pname, match, match_len) == 0)
  68. {
  69. result = malloc(strlen(pname) + 1);
  70. strcpy(result, pname);
  71. krb5_free_unparsed_name(kcontext, pname);
  72. krb5_free_keytab_entry_contents(kcontext, &entry);
  73. break;
  74. }
  75. krb5_free_unparsed_name(kcontext, pname);
  76. krb5_free_keytab_entry_contents(kcontext, &entry);
  77. }
  78. if (result == NULL)
  79. {
  80. PyErr_SetObject(KrbException_class, Py_BuildValue("((s:i))",
  81. "Principal not found in keytab", -1));
  82. }
  83. end:
  84. if (cursor)
  85. krb5_kt_end_seq_get(kcontext, kt, &cursor);
  86. if (kt)
  87. krb5_kt_close(kcontext, kt);
  88. krb5_free_context(kcontext);
  89. return result;
  90. }
  91. int authenticate_gss_client_init(const char* service, long int gss_flags, gss_client_state* state)
  92. {
  93. OM_uint32 maj_stat;
  94. OM_uint32 min_stat;
  95. gss_buffer_desc name_token = GSS_C_EMPTY_BUFFER;
  96. int ret = AUTH_GSS_COMPLETE;
  97. state->server_name = GSS_C_NO_NAME;
  98. state->context = GSS_C_NO_CONTEXT;
  99. state->gss_flags = gss_flags;
  100. state->username = NULL;
  101. state->response = NULL;
  102. // Import server name first
  103. name_token.length = strlen(service);
  104. name_token.value = (char *)service;
  105. maj_stat = gss_import_name(&min_stat, &name_token, gss_krb5_nt_service_name, &state->server_name);
  106. if (GSS_ERROR(maj_stat))
  107. {
  108. set_gss_error(maj_stat, min_stat);
  109. ret = AUTH_GSS_ERROR;
  110. goto end;
  111. }
  112. end:
  113. return ret;
  114. }
  115. int authenticate_gss_client_clean(gss_client_state *state)
  116. {
  117. OM_uint32 maj_stat;
  118. OM_uint32 min_stat;
  119. int ret = AUTH_GSS_COMPLETE;
  120. if (state->context != GSS_C_NO_CONTEXT)
  121. maj_stat = gss_delete_sec_context(&min_stat, &state->context, GSS_C_NO_BUFFER);
  122. if (state->server_name != GSS_C_NO_NAME)
  123. maj_stat = gss_release_name(&min_stat, &state->server_name);
  124. if (state->username != NULL)
  125. {
  126. free(state->username);
  127. state->username = NULL;
  128. }
  129. if (state->response != NULL)
  130. {
  131. free(state->response);
  132. state->response = NULL;
  133. }
  134. return ret;
  135. }
  136. int authenticate_gss_client_step(gss_client_state* state, const char* challenge)
  137. {
  138. OM_uint32 maj_stat;
  139. OM_uint32 min_stat;
  140. gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
  141. gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
  142. int ret = AUTH_GSS_CONTINUE;
  143. // Always clear out the old response
  144. if (state->response != NULL)
  145. {
  146. free(state->response);
  147. state->response = NULL;
  148. }
  149. // If there is a challenge (data from the server) we need to give it to GSS
  150. if (challenge && *challenge)
  151. {
  152. int len;
  153. input_token.value = base64_decode(challenge, &len);
  154. input_token.length = len;
  155. }
  156. // Do GSSAPI step
  157. maj_stat = gss_init_sec_context(&min_stat,
  158. GSS_C_NO_CREDENTIAL,
  159. &state->context,
  160. state->server_name,
  161. GSS_C_NO_OID,
  162. (OM_uint32)state->gss_flags,
  163. 0,
  164. GSS_C_NO_CHANNEL_BINDINGS,
  165. &input_token,
  166. NULL,
  167. &output_token,
  168. NULL,
  169. NULL);
  170. if ((maj_stat != GSS_S_COMPLETE) && (maj_stat != GSS_S_CONTINUE_NEEDED))
  171. {
  172. set_gss_error(maj_stat, min_stat);
  173. ret = AUTH_GSS_ERROR;
  174. goto end;
  175. }
  176. ret = (maj_stat == GSS_S_COMPLETE) ? AUTH_GSS_COMPLETE : AUTH_GSS_CONTINUE;
  177. // Grab the client response to send back to the server
  178. if (output_token.length)
  179. {
  180. state->response = base64_encode((const unsigned char *)output_token.value, output_token.length);;
  181. maj_stat = gss_release_buffer(&min_stat, &output_token);
  182. }
  183. // Try to get the user name if we have completed all GSS operations
  184. if (ret == AUTH_GSS_COMPLETE)
  185. {
  186. gss_name_t gssuser = GSS_C_NO_NAME;
  187. maj_stat = gss_inquire_context(&min_stat, state->context, &gssuser, NULL, NULL, NULL, NULL, NULL, NULL);
  188. if (GSS_ERROR(maj_stat))
  189. {
  190. set_gss_error(maj_stat, min_stat);
  191. ret = AUTH_GSS_ERROR;
  192. goto end;
  193. }
  194. gss_buffer_desc name_token;
  195. name_token.length = 0;
  196. maj_stat = gss_display_name(&min_stat, gssuser, &name_token, NULL);
  197. if (GSS_ERROR(maj_stat))
  198. {
  199. if (name_token.value)
  200. gss_release_buffer(&min_stat, &name_token);
  201. gss_release_name(&min_stat, &gssuser);
  202. set_gss_error(maj_stat, min_stat);
  203. ret = AUTH_GSS_ERROR;
  204. goto end;
  205. }
  206. else
  207. {
  208. state->username = (char *)malloc(name_token.length + 1);
  209. strncpy(state->username, (char*) name_token.value, name_token.length);
  210. state->username[name_token.length] = 0;
  211. gss_release_buffer(&min_stat, &name_token);
  212. gss_release_name(&min_stat, &gssuser);
  213. }
  214. }
  215. end:
  216. if (output_token.value)
  217. gss_release_buffer(&min_stat, &output_token);
  218. if (input_token.value)
  219. free(input_token.value);
  220. return ret;
  221. }
  222. int authenticate_gss_client_unwrap(gss_client_state *state, const char *challenge)
  223. {
  224. OM_uint32 maj_stat;
  225. OM_uint32 min_stat;
  226. gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
  227. gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
  228. int ret = AUTH_GSS_CONTINUE;
  229. // Always clear out the old response
  230. if (state->response != NULL)
  231. {
  232. free(state->response);
  233. state->response = NULL;
  234. }
  235. // If there is a challenge (data from the server) we need to give it to GSS
  236. if (challenge && *challenge)
  237. {
  238. int len;
  239. input_token.value = base64_decode(challenge, &len);
  240. input_token.length = len;
  241. }
  242. // Do GSSAPI step
  243. maj_stat = gss_unwrap(&min_stat,
  244. state->context,
  245. &input_token,
  246. &output_token,
  247. NULL,
  248. NULL);
  249. if (maj_stat != GSS_S_COMPLETE)
  250. {
  251. set_gss_error(maj_stat, min_stat);
  252. ret = AUTH_GSS_ERROR;
  253. goto end;
  254. }
  255. else
  256. ret = AUTH_GSS_COMPLETE;
  257. // Grab the client response
  258. if (output_token.length)
  259. {
  260. state->response = base64_encode((const unsigned char *)output_token.value, output_token.length);
  261. maj_stat = gss_release_buffer(&min_stat, &output_token);
  262. }
  263. end:
  264. if (output_token.value)
  265. gss_release_buffer(&min_stat, &output_token);
  266. if (input_token.value)
  267. free(input_token.value);
  268. return ret;
  269. }
  270. int authenticate_gss_client_wrap(gss_client_state* state, const char* challenge, const char* user)
  271. {
  272. OM_uint32 maj_stat;
  273. OM_uint32 min_stat;
  274. gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
  275. gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
  276. int ret = AUTH_GSS_CONTINUE;
  277. char buf[4096], server_conf_flags;
  278. unsigned long buf_size;
  279. // Always clear out the old response
  280. if (state->response != NULL)
  281. {
  282. free(state->response);
  283. state->response = NULL;
  284. }
  285. if (challenge && *challenge)
  286. {
  287. int len;
  288. input_token.value = base64_decode(challenge, &len);
  289. input_token.length = len;
  290. }
  291. if (user) {
  292. // get bufsize
  293. server_conf_flags = ((char*) input_token.value)[0];
  294. ((char*) input_token.value)[0] = 0;
  295. buf_size = ntohl(*((long *) input_token.value));
  296. free(input_token.value);
  297. #ifdef PRINTFS
  298. printf("User: %s, %c%c%c\n", user,
  299. server_conf_flags & GSS_AUTH_P_NONE ? 'N' : '-',
  300. server_conf_flags & GSS_AUTH_P_INTEGRITY ? 'I' : '-',
  301. server_conf_flags & GSS_AUTH_P_PRIVACY ? 'P' : '-');
  302. printf("Maximum GSS token size is %ld\n", buf_size);
  303. #endif
  304. // agree to terms (hack!)
  305. buf_size = htonl(buf_size); // not relevant without integrity/privacy
  306. memcpy(buf, &buf_size, 4);
  307. buf[0] = GSS_AUTH_P_NONE;
  308. // server decides if principal can log in as user
  309. strncpy(buf + 4, user, sizeof(buf) - 4);
  310. input_token.value = buf;
  311. input_token.length = 4 + strlen(user);
  312. }
  313. // Do GSSAPI wrap
  314. maj_stat = gss_wrap(&min_stat,
  315. state->context,
  316. 0,
  317. GSS_C_QOP_DEFAULT,
  318. &input_token,
  319. NULL,
  320. &output_token);
  321. if (maj_stat != GSS_S_COMPLETE)
  322. {
  323. set_gss_error(maj_stat, min_stat);
  324. ret = AUTH_GSS_ERROR;
  325. goto end;
  326. }
  327. else
  328. ret = AUTH_GSS_COMPLETE;
  329. // Grab the client response to send back to the server
  330. if (output_token.length)
  331. {
  332. state->response = base64_encode((const unsigned char *)output_token.value, output_token.length);;
  333. maj_stat = gss_release_buffer(&min_stat, &output_token);
  334. }
  335. end:
  336. if (output_token.value)
  337. gss_release_buffer(&min_stat, &output_token);
  338. return ret;
  339. }
  340. int authenticate_gss_server_init(const char *service, gss_server_state *state)
  341. {
  342. OM_uint32 maj_stat;
  343. OM_uint32 min_stat;
  344. gss_buffer_desc name_token = GSS_C_EMPTY_BUFFER;
  345. int ret = AUTH_GSS_COMPLETE;
  346. state->context = GSS_C_NO_CONTEXT;
  347. state->server_name = GSS_C_NO_NAME;
  348. state->client_name = GSS_C_NO_NAME;
  349. state->server_creds = GSS_C_NO_CREDENTIAL;
  350. state->client_creds = GSS_C_NO_CREDENTIAL;
  351. state->username = NULL;
  352. state->targetname = NULL;
  353. state->response = NULL;
  354. // Server name may be empty which means we aren't going to create our own creds
  355. size_t service_len = strlen(service);
  356. if (service_len != 0)
  357. {
  358. // Import server name first
  359. name_token.length = strlen(service);
  360. name_token.value = (char *)service;
  361. maj_stat = gss_import_name(&min_stat, &name_token, GSS_C_NT_HOSTBASED_SERVICE, &state->server_name);
  362. if (GSS_ERROR(maj_stat))
  363. {
  364. set_gss_error(maj_stat, min_stat);
  365. ret = AUTH_GSS_ERROR;
  366. goto end;
  367. }
  368. // Get credentials
  369. maj_stat = gss_acquire_cred(&min_stat, state->server_name, GSS_C_INDEFINITE,
  370. GSS_C_NO_OID_SET, GSS_C_ACCEPT, &state->server_creds, NULL, NULL);
  371. if (GSS_ERROR(maj_stat))
  372. {
  373. set_gss_error(maj_stat, min_stat);
  374. ret = AUTH_GSS_ERROR;
  375. goto end;
  376. }
  377. }
  378. end:
  379. return ret;
  380. }
  381. int authenticate_gss_server_clean(gss_server_state *state)
  382. {
  383. OM_uint32 maj_stat;
  384. OM_uint32 min_stat;
  385. int ret = AUTH_GSS_COMPLETE;
  386. if (state->context != GSS_C_NO_CONTEXT)
  387. maj_stat = gss_delete_sec_context(&min_stat, &state->context, GSS_C_NO_BUFFER);
  388. if (state->server_name != GSS_C_NO_NAME)
  389. maj_stat = gss_release_name(&min_stat, &state->server_name);
  390. if (state->client_name != GSS_C_NO_NAME)
  391. maj_stat = gss_release_name(&min_stat, &state->client_name);
  392. if (state->server_creds != GSS_C_NO_CREDENTIAL)
  393. maj_stat = gss_release_cred(&min_stat, &state->server_creds);
  394. if (state->client_creds != GSS_C_NO_CREDENTIAL)
  395. maj_stat = gss_release_cred(&min_stat, &state->client_creds);
  396. if (state->username != NULL)
  397. {
  398. free(state->username);
  399. state->username = NULL;
  400. }
  401. if (state->targetname != NULL)
  402. {
  403. free(state->targetname);
  404. state->targetname = NULL;
  405. }
  406. if (state->response != NULL)
  407. {
  408. free(state->response);
  409. state->response = NULL;
  410. }
  411. return ret;
  412. }
  413. int authenticate_gss_server_step(gss_server_state *state, const char *challenge)
  414. {
  415. OM_uint32 maj_stat;
  416. OM_uint32 min_stat;
  417. gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
  418. gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
  419. int ret = AUTH_GSS_CONTINUE;
  420. // Always clear out the old response
  421. if (state->response != NULL)
  422. {
  423. free(state->response);
  424. state->response = NULL;
  425. }
  426. // If there is a challenge (data from the server) we need to give it to GSS
  427. if (challenge && *challenge)
  428. {
  429. int len;
  430. input_token.value = base64_decode(challenge, &len);
  431. input_token.length = len;
  432. }
  433. else
  434. {
  435. PyErr_SetString(KrbException_class, "No challenge parameter in request from client");
  436. ret = AUTH_GSS_ERROR;
  437. goto end;
  438. }
  439. maj_stat = gss_accept_sec_context(&min_stat,
  440. &state->context,
  441. state->server_creds,
  442. &input_token,
  443. GSS_C_NO_CHANNEL_BINDINGS,
  444. &state->client_name,
  445. NULL,
  446. &output_token,
  447. NULL,
  448. NULL,
  449. &state->client_creds);
  450. if (GSS_ERROR(maj_stat))
  451. {
  452. set_gss_error(maj_stat, min_stat);
  453. ret = AUTH_GSS_ERROR;
  454. goto end;
  455. }
  456. // Grab the server response to send back to the client
  457. if (output_token.length)
  458. {
  459. state->response = base64_encode((const unsigned char *)output_token.value, output_token.length);;
  460. maj_stat = gss_release_buffer(&min_stat, &output_token);
  461. }
  462. // Get the user name
  463. maj_stat = gss_display_name(&min_stat, state->client_name, &output_token, NULL);
  464. if (GSS_ERROR(maj_stat))
  465. {
  466. set_gss_error(maj_stat, min_stat);
  467. ret = AUTH_GSS_ERROR;
  468. goto end;
  469. }
  470. state->username = (char *)malloc(output_token.length + 1);
  471. strncpy(state->username, (char*) output_token.value, output_token.length);
  472. state->username[output_token.length] = 0;
  473. // Get the target name if no server creds were supplied
  474. if (state->server_creds == GSS_C_NO_CREDENTIAL)
  475. {
  476. gss_name_t target_name = GSS_C_NO_NAME;
  477. maj_stat = gss_inquire_context(&min_stat, state->context, NULL, &target_name, NULL, NULL, NULL, NULL, NULL);
  478. if (GSS_ERROR(maj_stat))
  479. {
  480. set_gss_error(maj_stat, min_stat);
  481. ret = AUTH_GSS_ERROR;
  482. goto end;
  483. }
  484. maj_stat = gss_display_name(&min_stat, target_name, &output_token, NULL);
  485. if (GSS_ERROR(maj_stat))
  486. {
  487. set_gss_error(maj_stat, min_stat);
  488. ret = AUTH_GSS_ERROR;
  489. goto end;
  490. }
  491. state->targetname = (char *)malloc(output_token.length + 1);
  492. strncpy(state->targetname, (char*) output_token.value, output_token.length);
  493. state->targetname[output_token.length] = 0;
  494. }
  495. ret = AUTH_GSS_COMPLETE;
  496. end:
  497. if (output_token.length)
  498. gss_release_buffer(&min_stat, &output_token);
  499. if (input_token.value)
  500. free(input_token.value);
  501. return ret;
  502. }
  503. static void set_gss_error(OM_uint32 err_maj, OM_uint32 err_min)
  504. {
  505. OM_uint32 maj_stat, min_stat;
  506. OM_uint32 msg_ctx = 0;
  507. gss_buffer_desc status_string;
  508. char buf_maj[512];
  509. char buf_min[512];
  510. do
  511. {
  512. maj_stat = gss_display_status (&min_stat,
  513. err_maj,
  514. GSS_C_GSS_CODE,
  515. GSS_C_NO_OID,
  516. &msg_ctx,
  517. &status_string);
  518. if (GSS_ERROR(maj_stat))
  519. break;
  520. strncpy(buf_maj, (char*) status_string.value, sizeof(buf_maj));
  521. gss_release_buffer(&min_stat, &status_string);
  522. maj_stat = gss_display_status (&min_stat,
  523. err_min,
  524. GSS_C_MECH_CODE,
  525. GSS_C_NULL_OID,
  526. &msg_ctx,
  527. &status_string);
  528. if (!GSS_ERROR(maj_stat))
  529. {
  530. strncpy(buf_min, (char*) status_string.value, sizeof(buf_min));
  531. gss_release_buffer(&min_stat, &status_string);
  532. }
  533. } while (!GSS_ERROR(maj_stat) && msg_ctx != 0);
  534. PyErr_SetObject(GssException_class, Py_BuildValue("((s:i)(s:i))", buf_maj, err_maj, buf_min, err_min));
  535. }