gssapi_server.cpp 7.01 KB
Newer Older
1
/*
2
    Copyright (c) 2007-2016 Contributors as noted in the AUTHORS file
3

4
    This file is part of libzmq, the ZeroMQ core engine in C++.
5

6 7 8
    libzmq is free software; you can redistribute it and/or modify it under
    the terms of the GNU Lesser General Public License (LGPL) as published
    by the Free Software Foundation; either version 3 of the License, or
9 10
    (at your option) any later version.

11 12 13 14 15 16 17 18 19 20 21 22 23 24
    As a special exception, the Contributors give you permission to link
    this library with independent modules to produce an executable,
    regardless of the license terms of these independent modules, and to
    copy and distribute the resulting executable under terms of your choice,
    provided that you also meet, for each linked independent module, the
    terms and conditions of the license of that module. An independent
    module is a module which is not derived from or based on this library.
    If you modify this library, you must extend this exception to your
    version of the library.

    libzmq is distributed in the hope that it will be useful, but WITHOUT
    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
    License for more details.
25 26 27 28 29

    You should have received a copy of the GNU Lesser General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

30
#include "precompiled.hpp"
Chris Laws's avatar
Chris Laws committed
31 32 33

#ifdef HAVE_LIBGSSAPI_KRB5

34 35 36 37 38 39
#include <string.h>
#include <string>

#include "msg.hpp"
#include "session_base.hpp"
#include "err.hpp"
40
#include "gssapi_server.hpp"
41 42
#include "wire.hpp"

43 44
#include <gssapi/gssapi.h>

45
zmq::gssapi_server_t::gssapi_server_t (session_base_t *session_,
46 47
                                       const std::string &peer_address_,
                                       const options_t &options_) :
48
    mechanism_base_t (session_, options_),
49
    gssapi_mechanism_base_t (session_, options_),
50
    zap_client_t (session_, peer_address_, options_),
51 52
    session (session_),
    peer_address (peer_address_),
53 54
    state (recv_next_token),
    security_context_established (false)
55
{
Chris Busbey's avatar
Chris Busbey committed
56
    maj_stat = GSS_S_CONTINUE_NEEDED;
57 58 59 60 61 62 63
    if (!options_.gss_principal.empty ()) {
        const std::string::size_type principal_size =
          options_.gss_principal.size ();
        principal_name = static_cast<char *> (malloc (principal_size + 1));
        assert (principal_name);
        memcpy (principal_name, options_.gss_principal.c_str (),
                principal_size + 1);
64 65
        gss_OID name_type = convert_nametype (options_.gss_principal_nt);
        if (acquire_credentials (principal_name, &cred, name_type) != 0)
Chris Busbey's avatar
Chris Busbey committed
66 67
            maj_stat = GSS_S_FAILURE;
    }
68 69
}

70
zmq::gssapi_server_t::~gssapi_server_t ()
71
{
72 73
    if (cred)
        gss_release_cred (&min_stat, &cred);
Chris Busbey's avatar
Chris Busbey committed
74

75 76
    if (target_name)
        gss_release_name (&min_stat, &target_name);
77 78
}

79
int zmq::gssapi_server_t::next_handshake_command (msg_t *msg_)
80
{
81
    if (state == send_ready) {
82
        int rc = produce_ready (msg_);
83 84 85 86 87 88
        if (rc == 0)
            state = recv_ready;

        return rc;
    }

89 90 91 92 93 94 95 96 97 98 99 100 101
    if (state != send_next_token) {
        errno = EAGAIN;
        return -1;
    }

    if (produce_next_token (msg_) < 0)
        return -1;

    if (maj_stat != GSS_S_CONTINUE_NEEDED && maj_stat != GSS_S_COMPLETE)
        return -1;

    if (maj_stat == GSS_S_COMPLETE) {
        security_context_established = true;
102
    }
103

104 105
    state = recv_next_token;

106
    return 0;
107 108
}

109
int zmq::gssapi_server_t::process_handshake_command (msg_t *msg_)
110
{
111
    if (state == recv_ready) {
112
        int rc = process_ready (msg_);
Chris Laws's avatar
Chris Laws committed
113
        if (rc == 0)
114 115 116 117 118
            state = connected;

        return rc;
    }

119
    if (state != recv_next_token) {
120
        session->get_socket ()->event_handshake_failed_protocol (
121
          session->get_endpoint (), ZMQ_PROTOCOL_ERROR_ZMTP_UNEXPECTED_COMMAND);
122 123
        errno = EPROTO;
        return -1;
124
    }
125

126
    if (security_context_established) {
127
        //  Use ZAP protocol (RFC 27) to authenticate the user.
128 129
        //  Note that rc will be -1 only if ZAP is not set up, but if it was
        //  requested and it does not work properly the program will abort.
130
        bool expecting_zap_reply = false;
131
        int rc = session->zap_connect ();
132
        if (rc == 0) {
133
            send_zap_request ();
134 135
            rc = receive_and_process_zap_reply ();
            if (rc != 0) {
136
                if (rc == -1)
137 138 139 140
                    return -1;
                expecting_zap_reply = true;
            }
        }
141
        state = expecting_zap_reply ? expect_zap_reply : send_ready;
142 143 144
        return 0;
    }

145 146 147 148 149 150 151 152 153 154
    if (process_next_token (msg_) < 0)
        return -1;

    accept_context ();
    state = send_next_token;

    errno_assert (msg_->close () == 0);
    errno_assert (msg_->init () == 0);

    return 0;
155 156
}

157
void zmq::gssapi_server_t::send_zap_request ()
158
{
Chris Busbey's avatar
Chris Busbey committed
159
    gss_buffer_desc principal;
160
    gss_display_name (&min_stat, target_name, &principal, NULL);
161 162 163
    zap_client_t::send_zap_request (
      "GSSAPI", 6, reinterpret_cast<const uint8_t *> (principal.value),
      principal.length);
164

165
    gss_release_buffer (&min_stat, &principal);
166 167
}

168 169
int zmq::gssapi_server_t::encode (msg_t *msg_)
{
170
    zmq_assert (state == connected);
171 172

    if (do_encryption)
173
        return encode_message (msg_);
174 175

    return 0;
176 177 178 179
}

int zmq::gssapi_server_t::decode (msg_t *msg_)
{
180
    zmq_assert (state == connected);
181 182

    if (do_encryption)
183
        return decode_message (msg_);
184 185

    return 0;
186 187
}

188
int zmq::gssapi_server_t::zap_msg_available ()
189
{
190 191 192 193 194 195 196
    if (state != expect_zap_reply) {
        errno = EFSM;
        return -1;
    }
    const int rc = receive_and_process_zap_reply ();
    if (rc == 0)
        state = send_ready;
197
    return rc == -1 ? -1 : 0;
198 199
}

Martin Hurton's avatar
Martin Hurton committed
200
zmq::mechanism_t::status_t zmq::gssapi_server_t::status () const
201
{
202
    return state == connected ? mechanism_t::ready : mechanism_t::handshaking;
203 204
}

205
int zmq::gssapi_server_t::produce_next_token (msg_t *msg_)
206
{
207
    if (send_tok.length != 0) { // Client expects another token
208
        if (produce_initiate (msg_, send_tok.value, send_tok.length) < 0)
209
            return -1;
210
        gss_release_buffer (&min_stat, &send_tok);
211
    }
212

213
    if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
214
        gss_release_name (&min_stat, &target_name);
215
        if (context != GSS_C_NO_CONTEXT)
216
            gss_delete_sec_context (&min_stat, &context, GSS_C_NO_BUFFER);
217 218 219 220 221 222
        return -1;
    }

    return 0;
}

223
int zmq::gssapi_server_t::process_next_token (msg_t *msg_)
224
{
225
    if (maj_stat == GSS_S_CONTINUE_NEEDED) {
226
        if (process_initiate (msg_, &recv_tok.value, recv_tok.length) < 0) {
227
            if (target_name != GSS_C_NO_NAME)
228
                gss_release_name (&min_stat, &target_name);
229
            return -1;
230 231
        }
    }
232 233 234 235 236 237

    return 0;
}

void zmq::gssapi_server_t::accept_context ()
{
238 239 240
    maj_stat = gss_accept_sec_context (
      &init_sec_min_stat, &context, cred, &recv_tok, GSS_C_NO_CHANNEL_BINDINGS,
      &target_name, &doid, &send_tok, &ret_flags, NULL, NULL);
241

242 243 244
    if (recv_tok.value) {
        free (recv_tok.value);
        recv_tok.value = NULL;
245 246
    }
}
247

Chris Laws's avatar
Chris Laws committed
248
#endif