sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code
46a800fae3
samba-mirror/auth/gensec/gensec.h

279 lines
11 KiB
C
Raw Normal View History

gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
/*
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
Unix SMB/CIFS implementation.
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
Generic Authentication Interface
Copyright (C) Andrew Tridgell 2003
r6028: A MAJOR update to intergrate the new credentails system fully with GENSEC, and to pull SCHANNEL into GENSEC, by making it less 'special'. GENSEC now no longer has it's own handling of 'set username' etc, instead it uses cli_credentials calls. In order to link the credentails code right though Samba, a lot of interfaces have changed to remove 'username, domain, password' arguments, and these have been replaced with a single 'struct cli_credentials'. In the session setup code, a new parameter 'workgroup' contains the client/server current workgroup, which seems unrelated to the authentication exchange (it was being filled in from the auth info). This allows in particular kerberos to only call back for passwords when it actually needs to perform the kinit. The kerberos code has been modified not to use the SPNEGO provided 'principal name' (in the mechListMIC), but to instead use the name the host was connected to as. This better matches Microsoft behaviour, is more secure and allows better use of standard kerberos functions. To achieve this, I made changes to our socket code so that the hostname (before name resolution) is now recorded on the socket. In schannel, most of the code from librpc/rpc/dcerpc_schannel.c is now in libcli/auth/schannel.c, and it looks much more like a standard GENSEC module. The actual sign/seal code moved to libcli/auth/schannel_sign.c in a previous commit. The schannel credentails structure is now merged with the rest of the credentails, as many of the values (username, workstation, domain) where already present there. This makes handling this in a generic manner much easier, as there is no longer a custom entry-point. The auth_domain module continues to be developed, but is now just as functional as auth_winbind. The changes here are consequential to the schannel changes. The only removed function at this point is the RPC-LOGIN test (simulating the load of a WinXP login), which needs much more work to clean it up (it contains copies of too much code from all over the torture suite, and I havn't been able to penetrate its 'structure'). Andrew Bartlett (This used to be commit 2301a4b38a21aa60917973451687063d83d18d66)
2005-03-24 07:14:06 +03:00
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
r23792: convert Samba4 to GPLv3 There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-07-10 06:07:03 +04:00
the Free Software Foundation; either version 3 of the License, or
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
(at your option) any later version.
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
You should have received a copy of the GNU General Public License
r23792: convert Samba4 to GPLv3 There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-07-10 06:07:03 +04:00
along with this program. If not, see <http://www.gnu.org/licenses/>.
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
*/
r14363: Remove credentials.h from the global includes. (This used to be commit 98c4c3051391c6f89df5d133665f51bef66b1563)
2006-03-14 04:29:56 +03:00
#ifndef __GENSEC_H__
#define __GENSEC_H__
Add missing includes, required for use of gensec by 3rd-party applications.
2008-12-23 22:17:59 +03:00
#include "../lib/util/data_blob.h"
#include "libcli/util/ntstatus.h"
s4:gensec Put the "NTLM" string for NTLMSSP's SASL name in a header
2010-06-01 13:12:29 +04:00
#define GENSEC_SASL_NAME_NTLMSSP "NTLM"
r20258: add functions to read and write asn1 encoded OID strings without leading tag metze (This used to be commit 576d4c54cca844164b90e5d6ec71fe44b59607b7)
2006-12-19 22:25:49 +03:00
#define GENSEC_OID_NTLMSSP "1.3.6.1.4.1.311.2.2.10"
#define GENSEC_OID_SPNEGO "1.3.6.1.5.5.2"
#define GENSEC_OID_KERBEROS5 "1.2.840.113554.1.2.2"
#define GENSEC_OID_KERBEROS5_OLD "1.2.840.48018.1.2.2"
#define GENSEC_OID_KERBEROS5_USER2USER "1.2.840.113554.1.2.2.3"
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
r18257: Order the GENSEC modules, with unknown modules last. Andrew Bartlett (This used to be commit 8ae880b5019ab275fe0eca48120ab9e0fcca6293)
2006-09-08 10:21:02 +04:00
enum gensec_priority {
GENSEC_SPNEGO = 90,
GENSEC_GSSAPI = 80,
GENSEC_KRB5 = 70,
GENSEC_SCHANNEL = 60,
GENSEC_NTLMSSP = 50,
GENSEC_SASL = 20,
Add SASL/EXTERNAL gensec module Signed-off-by: Howard Chu <hyc@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2013-09-18 00:09:50 +04:00
GENSEC_OTHER = 10,
GENSEC_EXTERNAL = 0
r18250: Add an ordering of GENSEC modules, so we do preferred modules first. Andrew Bartlett (This used to be commit 0afb4d1992b3c93557dec1e1cdca467efc299853)
2006-09-08 08:37:56 +04:00
};
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
struct gensec_security;
r1440: GENSEC improvements: - Infrustructure for kerberos - Don't segfault on un-implemented backend functions - Add comments. Andrew Bartlett (This used to be commit 1c31aa42710421917428d6ba86328ea5179751bd)
2004-07-11 14:29:54 +04:00
struct gensec_target {
const char *principal;
const char *hostname;
r1475: More kerberos work - We can now connect to hosts that follow the SPNEGO RFC, and *do not* give us their principal name in the mechListMIC. - The client code now remembers the hostname it connects to - We now kinit for a user, if there is not valid ticket already - Re-introduce clock skew compensation TODO: - See if the username in the ccache matches the username specified - Use a private ccache, rather then the global one, for a 'new' kinit - Determine 'default' usernames. - The default for Krb5 is the one in the ccache, then $USER - For NTLMSSP, it's just $USER Andrew Bartlett (This used to be commit de5da669397db4ac87c6da08d3533ca3030da2b0)
2004-07-13 09:14:59 +04:00
const char *service;
gensec: Add gensec_{get,set}_target_service_description() This allows a free text description of what the server-side service is for logging purposes where the various services may be using the same Kerberos service or not use Kerberos. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-02-20 03:32:47 +03:00
const char *service_description;
r1440: GENSEC improvements: - Infrustructure for kerberos - Don't segfault on un-implemented backend functions - Add comments. Andrew Bartlett (This used to be commit 1c31aa42710421917428d6ba86328ea5179751bd)
2004-07-11 14:29:54 +04:00
};
r2041: Fix NTLMSSP RPC sealing, client -> win2k3 server. The bug (found by tridge) is that Win2k3 is being tighter about the NTLMSSP flags. If we don't negotiate sealing, we can't use it. We now have a way to indicate to the GENSEC implementation mechanisms what things we want for a connection. Andrew Bartlett (This used to be commit 86f61568ea44c5719f9b583beeeefb12e0c26f4c)
2004-08-25 06:25:20 +04:00
r4079: implement the gensec_have_feature() correctly by asking the backend what is actually in use metze (This used to be commit 6f3eb7bc03609108b9e0ea5676fca3d04140e737)
2004-12-06 18:44:17 +03:00
#define GENSEC_FEATURE_SESSION_KEY 0x00000001
#define GENSEC_FEATURE_SIGN 0x00000002
#define GENSEC_FEATURE_SEAL 0x00000004
r4325: add the GENSEC_FEATURE_DCE_STYLE flag this will be used by krb5 dcerpc auth metze (This used to be commit 04dc7fb9b24a1e38f31559ec6032701a176209ae)
2004-12-21 15:39:39 +03:00
#define GENSEC_FEATURE_DCE_STYLE 0x00000008
r6705: let the gensec module decide if messages can be signed and sealed in a different order than a strict request - reply sequence Note: we should also fix the client code... metze (This used to be commit 0a61d1f65150546f7a7582512ca010d156f963bf)
2005-05-10 15:04:04 +04:00
#define GENSEC_FEATURE_ASYNC_REPLIES 0x00000010
r9411: Ensure we don't send a challenge without first getting a negotiate in NTLMSSP, unless we are in datagram mode (not fully implemented yet). Andrew Bartlett (This used to be commit 727f5109421e9414a335e42e3ad3dd3ff19776bd)
2005-08-20 08:42:19 +04:00
#define GENSEC_FEATURE_DATAGRAM_MODE 0x00000020
gensec: add GENSEC_FEATURE_SIGN_PKT_HEADER flag metze (This used to be commit d7dfdbaf34843cb6783d8e686e659c53c5ac27ef)
2008-08-06 23:26:20 +04:00
#define GENSEC_FEATURE_SIGN_PKT_HEADER 0x00000040
gensec: add support for new style spnego and correctly handle mechListMIC metze (This used to be commit 05a3403967d3cf64bca8b06536dc1b20cf835396)
2008-08-12 16:26:21 +04:00
#define GENSEC_FEATURE_NEW_SPNEGO 0x00000080
gensec: Add a way to request a unix token from GENSEC Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 09:39:27 +04:00
#define GENSEC_FEATURE_UNIX_TOKEN 0x00000100
auth/gensec: add GENSEC_FEATURE_NTLM_CCACHE define Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2015-11-27 15:42:30 +03:00
#define GENSEC_FEATURE_NTLM_CCACHE 0x00000200
auth/gensec: add GENSEC_FEATURE_LDAP_STYLE define This will be used for LDAP connections and may trigger backend specific behaviour. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2015-12-09 16:48:14 +03:00
#define GENSEC_FEATURE_LDAP_STYLE 0x00000400
auth: Add logging of service authorization In ntlm_auth.c and authdata.c, the session info will be incomplete Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-03-01 02:18:49 +03:00
#define GENSEC_FEATURE_NO_AUTHZ_LOG 0x00000800
r1440: GENSEC improvements: - Infrustructure for kerberos - Don't segfault on un-implemented backend functions - Add comments. Andrew Bartlett (This used to be commit 1c31aa42710421917428d6ba86328ea5179751bd)
2004-07-11 14:29:54 +04:00
auth/gensec: add gensec_expire_time() metze
2012-03-03 07:32:45 +04:00
#define GENSEC_EXPIRE_TIME_INFINITY (NTTIME)0x8000000000000000LL
r1200: Add 'gensec', our generic security layer. This layer is used for DCERPC security, as well as ntlm_auth at this time. It expect things like SASL and the CIFS layer to use it as well. The particular purpose of this layer is to introduce SPENGO, which needs generic access to the actual implementation mechanisms. Schannel, due to it's 'interesting' setup properties is in GENSEC, but is only in the RPC code. Andrew Bartlett (This used to be commit 902af49006fb8cfecaadd3cc0c10e2e542083fb1)
2004-06-20 04:58:09 +04:00
/* GENSEC mode */
enum gensec_role
{
GENSEC_SERVER,
GENSEC_CLIENT
};
r1497: add forward declaration for struct auth_session_info (fix compiler warning) metze (This used to be commit 65147f5aa2a56220a387876d990a546beb93a2d7)
2004-07-14 15:28:34 +04:00
struct auth_session_info;
r25428: forward declarations of enums are not portable, so pass struct cli_credentials *cred instead of enum credentials_use_kerberos use_kerberos. metze (This used to be commit b945aaa9dadc4c0595340d35725b49bac8e5778e)
2007-09-29 19:16:38 +04:00
struct cli_credentials;
Add gensec_settings structure. This wraps loadparm_context for now, but should in the future only contain some settings required for gensec.
2008-11-02 04:05:48 +03:00
struct gensec_settings;
s4:lib/tevent: rename structs list="" list="$list event_context:tevent_context" list="$list fd_event:tevent_fd" list="$list timed_event:tevent_timer" for s in $list; do o=`echo $s | cut -d ':' -f1` n=`echo $s | cut -d ':' -f2` r=`git grep "struct $o" |cut -d ':' -f1 |sort -u` files=`echo "$r" | grep -v source3 | grep -v nsswitch | grep -v packaging4` for f in $files; do cat $f | sed -e "s/struct $o/struct $n/g" > $f.tmp mv $f.tmp $f done done metze
2008-12-29 22:24:57 +03:00
struct tevent_context;
s4:gensec: change gensec_update_send/recv to tevent_req metze
2009-12-22 18:24:44 +03:00
struct tevent_req;
s4-gensec: Move parsing of the PAC blob and creating the session_info into auth This uses a single callback to handle the PAC from the DATA_BLOB format until it becomes a struct auth_session_info. This allows a seperation between the GSS acceptor code and the PAC interpretation code based on the supplied auth context. Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Thu Dec 29 01:10:59 CET 2011 on sn-devel-104
2011-12-28 10:48:45 +04:00
struct smb_krb5_context;
auth/gensec: introduce gensec_internal.h We should treat most gensec related structures private. It's a long way, but this is a start. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 09:12:01 +04:00
struct tsocket_address;
r17344: move the gensec_update_request structure into the header file and add a private_data for the backends. metze (This used to be commit 015a65e00187e684b3e4d1f4ca07edb9f022f61b)
2006-07-31 19:52:26 +04:00
Add gensec_settings structure. This wraps loadparm_context for now, but should in the future only contain some settings required for gensec.
2008-11-02 04:05:48 +03:00
struct gensec_settings {
struct loadparm_context *lp_ctx;
const char *target_hostname;
gensec: Allow an alternate set of modules to be specified This will allow s3 to specify modules to use as a list, rather than needing to start the individual module with gensec_start_mech_by_ops() Andrew Bartlett
2011-12-26 03:53:56 +04:00
/* this allows callers to specify a specific set of ops that
* should be used, rather than those loaded by the plugin
* mechanism */
auth/gensec: treat struct gensec_security_ops as const if possible. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 13:20:21 +04:00
const struct gensec_security_ops * const *backends;
auth: Provide a way to specify the NTLMSSP server name to GENSEC This avoids us needing to assume lp_netbios_name().lp_dnsdomain() if the caller knows better. This will allow preservation of current s3 behaviour. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-31 09:17:04 +04:00
/* To fill in our own name in the NTLMSSP server */
const char *server_dns_domain;
const char *server_dns_name;
auth: Allow the netbios name and domain to be set from winbindd in ntlm_auth3 Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Fri Feb 17 12:18:51 CET 2012 on sn-devel-104
2012-02-06 11:02:11 +04:00
const char *server_netbios_domain;
const char *server_netbios_name;
Add gensec_settings structure. This wraps loadparm_context for now, but should in the future only contain some settings required for gensec.
2008-11-02 04:05:48 +03:00
};
auth/gensec: introduce gensec_internal.h We should treat most gensec related structures private. It's a long way, but this is a start. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 09:12:01 +04:00
struct gensec_security_ops;
struct gensec_security_ops_wrapper;
r6800: A big GENSEC update: Finally remove the distinction between 'krb5' and 'ms_krb5'. We now don't do kerberos stuff twice on failure. The solution to this is slightly more general than perhaps was really required (as this is a special case), but it works, and I'm happy with the cleanup I achived in the process. All modules have been updated to supply a NULL-terminated list of OIDs. In that process, SPNEGO code has been generalised, as I realised that two of the functions should have been identical in behaviour. Over in the actual modules, I have worked to remove the 'kinit' code from gensec_krb5, and placed it in kerberos/kerberos_util.c. The GSSAPI module has been extended to use this, so no longer requires a manual kinit at the command line. It will soon loose the requirement for a on-disk keytab too. The general kerberos code has also been updated to move from error_message() to our routine which gets the Heimdal error string (which may be much more useful) when available. Andrew Bartlett (This used to be commit 0101728d8e2ed9419eb31fe95047944a718ba135)
2005-05-16 03:42:11 +04:00
r1294: A nice, large, commit... This implements gensec for Samba's server side, and brings gensec up to the standards of a full subsystem. This means that use of the subsystem is by gensec_* functions, not function pointers in structures (this is internal). This causes changes in all the existing gensec users. Our RPC server no longer contains it's own generalised security scheme, and now calls gensec directly. Gensec has also taken over the role of auth/auth_ntlmssp.c An important part of gensec, is the output of the 'session_info' struct. This is now reference counted, so that we can correctly free it when a pipe is closed, no matter if it was inherited, or created by per-pipe authentication. The schannel code is reworked, to be in the same file for client and server. ntlm_auth is reworked to use gensec. The major problem with this code is the way it relies on subsystem auto-initialisation. The primary reason for this commit now.is to allow these problems to be looked at, and fixed. There are problems with the new code: - I've tested it with smbtorture, but currently don't have VMware and valgrind working (this I'll fix soon). - The SPNEGO code is client-only at this point. - We still do not do kerberos. Andrew Bartlett (This used to be commit 07fd885fd488fd1051eacc905a2d4962f8a018ec)
2004-06-29 13:40:10 +04:00
#define GENSEC_INTERFACE_VERSION 0
/* this structure is used by backends to determine the size of some critical types */
auth/gensec: introduce gensec_internal.h We should treat most gensec related structures private. It's a long way, but this is a start. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 09:12:01 +04:00
struct gensec_critical_sizes;
gensec: Make gensec_interface_version public Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2013-05-11 12:35:33 +04:00
const struct gensec_critical_sizes *gensec_interface_version(void);
r1294: A nice, large, commit... This implements gensec for Samba's server side, and brings gensec up to the standards of a full subsystem. This means that use of the subsystem is by gensec_* functions, not function pointers in structures (this is internal). This causes changes in all the existing gensec users. Our RPC server no longer contains it's own generalised security scheme, and now calls gensec directly. Gensec has also taken over the role of auth/auth_ntlmssp.c An important part of gensec, is the output of the 'session_info' struct. This is now reference counted, so that we can correctly free it when a pipe is closed, no matter if it was inherited, or created by per-pipe authentication. The schannel code is reworked, to be in the same file for client and server. ntlm_auth is reworked to use gensec. The major problem with this code is the way it relies on subsystem auto-initialisation. The primary reason for this commit now.is to allow these problems to be looked at, and fixed. There are problems with the new code: - I've tested it with smbtorture, but currently don't have VMware and valgrind working (this I'll fix soon). - The SPNEGO code is client-only at this point. - We still do not do kerberos. Andrew Bartlett (This used to be commit 07fd885fd488fd1051eacc905a2d4962f8a018ec)
2004-06-29 13:40:10 +04:00
r26385: Integrate gensec-socket into gensec. (This used to be commit 78bb444b4b73df9a84f8702814f9b30b32ffd885)
2007-12-10 20:42:07 +03:00
/* Socket wrapper */
struct gensec_security;
s4-auth Rename auth -> auth4 to avoid conflict with s3 auth
2011-05-07 10:14:06 +04:00
struct auth4_context;
s4-auth Rework auth subsystem to remove struct auth_serversupplied_info This changes auth_serversupplied_info into the IDL-defined struct auth_user_info_dc. This then in turn contains a struct auth_user_info, which is the only part of the structure that is mainted into the struct session_info. The idea here is to avoid keeping the incomplete results of the authentication (such as session keys, lists of SID memberships etc) in a namespace where it may be confused for the finalised results. Andrew Barltett
2011-02-08 08:53:13 +03:00
struct auth_user_info_dc;
r26385: Integrate gensec-socket into gensec. (This used to be commit 78bb444b4b73df9a84f8702814f9b30b32ffd885)
2007-12-10 20:42:07 +03:00
r26226: Avoid more uses of global_loadparm. (This used to be commit 6cbce47a3eaef76a89db7cd0ab0d4f6441fc720d)
2007-12-02 19:09:43 +03:00
struct loadparm_context;
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx,
struct gensec_security *parent,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
struct gensec_security **gensec_security);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
struct gensec_security **gensec_security,
Add gensec_settings structure. This wraps loadparm_context for now, but should in the future only contain some settings required for gensec.
2008-11-02 04:05:48 +03:00
struct gensec_settings *settings);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_start_mech_by_ops(struct gensec_security *gensec_security,
const struct gensec_security_ops *ops);
NTSTATUS gensec_start_mech_by_sasl_list(struct gensec_security *gensec_security,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
const char **sasl_names);
auth/gensec: add gensec_*max_update_size() This is only a hint for the backend, which may want to fragment update tokens. metze
2011-12-24 04:14:26 +04:00
void gensec_set_max_update_size(struct gensec_security *gensec_security,
uint32_t max_update_size);
size_t gensec_max_update_size(struct gensec_security *gensec_security);
auth/gensec: remove tevent_context argument from gensec_update() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-12-13 22:56:13 +04:00
NTSTATUS gensec_update(struct gensec_security *gensec_security,
TALLOC_CTX *out_mem_ctx,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
const DATA_BLOB in, DATA_BLOB *out);
auth/gensec: add a gensec_update_ev() function This is the current gensec_update() which takes an optional tevent_context structure and allows semi-async code. This is just a temporary solution on the way to kill the semi-async code completely, by using gensec_update_send/recv. By providing a gensec_update_ev(), we can remove the explicit tevent_context from gensec_update() and fix all the sane callers. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-12-13 22:18:48 +04:00
NTSTATUS gensec_update_ev(struct gensec_security *gensec_security,
TALLOC_CTX *out_mem_ctx,
struct tevent_context *ev,
const DATA_BLOB in, DATA_BLOB *out);
s4:gensec: change gensec_update_send/recv to tevent_req metze
2009-12-22 18:24:44 +03:00
struct tevent_req *gensec_update_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct gensec_security *gensec_security,
const DATA_BLOB in);
NTSTATUS gensec_update_recv(struct tevent_req *req, TALLOC_CTX *out_mem_ctx, DATA_BLOB *out);
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
void gensec_want_feature(struct gensec_security *gensec_security,
uint32_t feature);
bool gensec_have_feature(struct gensec_security *gensec_security,
uint32_t feature);
auth/gensec: add gensec_expire_time() metze
2012-03-03 07:32:45 +04:00
NTTIME gensec_expire_time(struct gensec_security *gensec_security);
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
NTSTATUS gensec_set_credentials(struct gensec_security *gensec_security, struct cli_credentials *credentials);
gensec: Add gensec_{get,set}_target_service_description() This allows a free text description of what the server-side service is for logging purposes where the various services may be using the same Kerberos service or not use Kerberos. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-02-20 03:32:47 +03:00
/**
* Set the target service (such as 'http' or 'host') on a GENSEC context - ensures it is talloc()ed
*
* This is used for Kerberos service principal name resolution.
*/
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
NTSTATUS gensec_set_target_service(struct gensec_security *gensec_security, const char *service);
const char *gensec_get_target_service(struct gensec_security *gensec_security);
NTSTATUS gensec_set_target_hostname(struct gensec_security *gensec_security, const char *hostname);
const char *gensec_get_target_hostname(struct gensec_security *gensec_security);
gensec: Add gensec_{get,set}_target_service_description() This allows a free text description of what the server-side service is for logging purposes where the various services may be using the same Kerberos service or not use Kerberos. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-02-20 03:32:47 +03:00
/**
* Set the target service (such as 'samr') on an GENSEC context - ensures it is talloc()ed.
*
* This is not the Kerberos service principal, instead this is a
* constant value that can be logged as part of authentication and
* authorization logging
*/
const char *gensec_get_target_service_description(struct gensec_security *gensec_security);
NTSTATUS gensec_set_target_service_description(struct gensec_security *gensec_security,
const char *service);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
gensec: clarify memory ownership for gensec_session_info() and gensec_session_key() This is slightly less efficient, because we no longer keep a cache on the gensec structures, but much clearer in terms of memory ownership. Both gensec_session_info() and gensec_session_key() now take a mem_ctx and put the result only on that context. Some duplication of memory in the callers (who were rightly uncertain about who was the rightful owner of the returned memory) has been removed to compensate for the internal copy. Andrew Bartlett
2011-08-01 09:39:01 +04:00
TALLOC_CTX *mem_ctx,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
DATA_BLOB *session_key);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
const char *mech_oid);
Fix the build.
2008-11-03 01:58:49 +03:00
const char *gensec_get_name_by_oid(struct gensec_security *gensec_security, const char *oid_string);
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security);
s4-modules Remove lp_ctx from init functions that no longer need it Now that we don't allow the smb.conf to change the modules dir, many functions that simply load modules or initialise a subsytem that may load modules no longer need an lp_ctx. Andrew Bartlett
2011-06-06 08:58:28 +04:00
NTSTATUS gensec_init(void);
auth/gensec: add some more functions from gensec_start.c to gensec.h metze
2012-01-12 19:18:38 +04:00
NTSTATUS gensec_register(const struct gensec_security_ops *ops);
const struct gensec_security_ops *gensec_security_by_oid(struct gensec_security *gensec_security,
const char *oid_string);
const struct gensec_security_ops *gensec_security_by_sasl_name(struct gensec_security *gensec_security,
const char *sasl_name);
auth/gensec: add gensec_security_by_auth_type() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-03 13:43:58 +04:00
const struct gensec_security_ops *gensec_security_by_auth_type(
struct gensec_security *gensec_security,
uint32_t auth_type);
auth/gensec: make gensec_security_by_name() public Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2015-11-26 13:43:02 +03:00
const struct gensec_security_ops *gensec_security_by_name(struct gensec_security *gensec_security,
const char *name);
auth/gensec: treat struct gensec_security_ops as const if possible. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 13:20:21 +04:00
const struct gensec_security_ops **gensec_security_mechs(struct gensec_security *gensec_security,
auth/gensec: add some more functions from gensec_start.c to gensec.h metze
2012-01-12 19:18:38 +04:00
TALLOC_CTX *mem_ctx);
const struct gensec_security_ops_wrapper *gensec_security_by_oid_list(
struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
auth/gensec: use 'const char * const *' for function parameters Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 13:10:55 +04:00
const char * const *oid_strings,
auth/gensec: add some more functions from gensec_start.c to gensec.h metze
2012-01-12 19:18:38 +04:00
const char *skip);
const char **gensec_security_oids(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
const char *skip);
const char **gensec_security_oids_from_ops_wrapped(TALLOC_CTX *mem_ctx,
const struct gensec_security_ops_wrapper *wops);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
size_t gensec_max_input_size(struct gensec_security *gensec_security);
auth/gensec: make sure functions from gensec.c are in gensec.h metze
2012-01-12 19:18:38 +04:00
size_t gensec_max_wrapped_size(struct gensec_security *gensec_security);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
uint8_t *data, size_t length,
const uint8_t *whole_pdu, size_t pdu_length,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
const DATA_BLOB *sig);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
const uint8_t *data, size_t length,
const uint8_t *whole_pdu, size_t pdu_length,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
const DATA_BLOB *sig);
size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
uint8_t *data, size_t length,
const uint8_t *whole_pdu, size_t pdu_length,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
DATA_BLOB *sig);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
const uint8_t *data, size_t length,
const uint8_t *whole_pdu, size_t pdu_length,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
DATA_BLOB *sig);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_start_mech(struct gensec_security *gensec_security);
NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
uint8_t auth_type, uint8_t auth_level);
Fix the build.
2008-11-03 01:58:49 +03:00
const char *gensec_get_name_by_authtype(struct gensec_security *gensec_security, uint8_t authtype);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx,
Add gensec_settings structure. This wraps loadparm_context for now, but should in the future only contain some settings required for gensec.
2008-11-02 04:05:48 +03:00
struct gensec_settings *settings,
s4-auth Rename auth -> auth4 to avoid conflict with s3 auth
2011-05-07 10:14:06 +04:00
struct auth4_context *auth_context,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
struct gensec_security **gensec_security);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_session_info(struct gensec_security *gensec_security,
gensec: clarify memory ownership for gensec_session_info() and gensec_session_key() This is slightly less efficient, because we no longer keep a cache on the gensec structures, but much clearer in terms of memory ownership. Both gensec_session_info() and gensec_session_key() now take a mem_ctx and put the result only on that context. Some duplication of memory in the callers (who were rightly uncertain about who was the rightful owner of the returned memory) has been removed to compensate for the internal copy. Andrew Bartlett
2011-08-01 09:39:01 +04:00
TALLOC_CTX *mem_ctx,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
struct auth_session_info **session_info);
s4-gensec: Added remote and local setter/getter using tsocket.
2009-12-16 15:27:20 +03:00
NTSTATUS gensec_set_local_address(struct gensec_security *gensec_security,
const struct tsocket_address *local);
NTSTATUS gensec_set_remote_address(struct gensec_security *gensec_security,
const struct tsocket_address *remote);
const struct tsocket_address *gensec_get_local_address(struct gensec_security *gensec_security);
const struct tsocket_address *gensec_get_remote_address(struct gensec_security *gensec_security);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
const char *name);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_unwrap(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
const DATA_BLOB *in,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
DATA_BLOB *out);
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
TALLOC_CTX *mem_ctx,
const DATA_BLOB *in,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
DATA_BLOB *out);
auth/gensec: treat struct gensec_security_ops as const if possible. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-05 13:20:21 +04:00
const struct gensec_security_ops * const *gensec_security_all(void);
bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct gensec_security *security);
const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx,
const struct gensec_security_ops * const *old_gensec_list,
struct cli_credentials *creds);
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
gensec: split GENSEC into mechanism-dependent and runtime functions The startup and runtime functions that have no dependencies are moved into the top level. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-21 07:20:26 +04:00
NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
Install public header files again and include required prototypes. (This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2008-04-02 06:53:27 +04:00
const char *sasl_name);
Add gensec_settings structure. This wraps loadparm_context for now, but should in the future only contain some settings required for gensec.
2008-11-02 04:05:48 +03:00
int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value);
bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value);
r14363: Remove credentials.h from the global includes. (This used to be commit 98c4c3051391c6f89df5d133665f51bef66b1563)
2006-03-14 04:29:56 +03:00
s4:gensec expose gensec_set_target_principal for use outside GENSEC This allows for the rare case where the caller knows the target principal. The check for lp_client_use_spnego_principal() is moved to the spengo code to make this work. Andrew Bartlett
2010-05-13 01:59:41 +04:00
NTSTATUS gensec_set_target_principal(struct gensec_security *gensec_security, const char *principal);
auth/gensec: make sure functions from gensec.c are in gensec.h metze
2012-01-12 19:18:38 +04:00
const char *gensec_get_target_principal(struct gensec_security *gensec_security);
s4:gensec expose gensec_set_target_principal for use outside GENSEC This allows for the rare case where the caller knows the target principal. The check for lp_client_use_spnego_principal() is moved to the spengo code to make this work. Andrew Bartlett
2010-05-13 01:59:41 +04:00
gensec: move gensec_util.c to the top level To do this some defines need to move to common_auth.h Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-12-31 15:24:44 +04:00
NTSTATUS gensec_generate_session_info_pac(TALLOC_CTX *mem_ctx,
struct gensec_security *gensec_security,
struct smb_krb5_context *smb_krb5_context,
DATA_BLOB *pac_blob,
const char *principal_string,
const struct tsocket_address *remote_address,
struct auth_session_info **session_info);
auth-krb: Nove oid packet check to gensec_util. This is clearly a utiliy function generic to gensec. Also the 3 callers had identical implementations. Provide a generic implementation for all of them and avoid duplicating the code everywhere. Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-01 05:37:56 +04:00
NTSTATUS gensec_magic_check_krb5_oid(struct gensec_security *unused,
const DATA_BLOB *blob);
gensec: move gensec_util.c to the top level To do this some defines need to move to common_auth.h Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-12-31 15:24:44 +04:00
r14363: Remove credentials.h from the global includes. (This used to be commit 98c4c3051391c6f89df5d133665f51bef66b1563)
2006-03-14 04:29:56 +03:00
#endif /* __GENSEC_H__ */
Copy Permalink