-
Notifications
You must be signed in to change notification settings - Fork 45
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Implement partial support for GSSAPI extension GGF
GGF provides extended credential and security context inquiry that allows application to retrieve more information about the client's credentials and security context. One common use case is to use gss_inquire_sec_context_by_oid to retrieve the "session" key that is required by the SMB protocol for signing and encrypting a message. These calls are provided as a part of the raw interface and are not exposed in the high-level interface. Thanks to @vm86 for his work on the gss_inquire_sec_context_by_oid. Draft IETF document for these extensions can be found at https://tools.ietf.org/html/draft-engert-ggf-gss-extensions-00
- Loading branch information
1 parent
beb69c9
commit a14d750
Showing
4 changed files
with
223 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,129 @@ | ||
""" | ||
GGF Extensions | ||
GGF provides extended credential and security context inquiry that allows | ||
application to retrieve more information about the client's credentials and | ||
security context. One common use case is to use | ||
:meth:`inquire_sec_context_by_oid` to retrieve the "session" key that is | ||
required by the SMB protocol for signing and encrypting a message. | ||
Draft IETF document for these extensions can be found at | ||
https://tools.ietf.org/html/draft-engert-ggf-gss-extensions-00 | ||
""" | ||
GSSAPI="BASE" # This ensures that a full module is generated by Cython | ||
|
||
from gssapi.raw.cython_types cimport * | ||
from gssapi.raw.ext_buffer_sets cimport * | ||
from gssapi.raw.cython_converters cimport c_get_mech_oid_set | ||
from gssapi.raw.misc import GSSError | ||
from gssapi.raw.oids cimport OID | ||
from gssapi.raw.creds cimport Creds | ||
from gssapi.raw.sec_contexts cimport SecurityContext | ||
|
||
cdef extern from "python_gssapi_ext.h": | ||
|
||
OM_uint32 gss_inquire_cred_by_oid(OM_uint32 *minor_status, | ||
const gss_cred_id_t cred_handle, | ||
const gss_OID desired_object, | ||
gss_buffer_set_t *data_set) nogil | ||
|
||
OM_uint32 gss_inquire_sec_context_by_oid(OM_uint32 *minor_status, | ||
const gss_ctx_id_t context_handle, | ||
const gss_OID desired_object, | ||
gss_buffer_set_t *data_set) nogil | ||
|
||
|
||
def inquire_cred_by_oid(Creds cred_handle not None, | ||
OID desired_aspect not None): | ||
""" | ||
inquire_cred_by_oid(cred_handle, desired_aspect) | ||
This method inspects a :class:`Creds` object for information | ||
specific to a particular desired aspect as an OID. | ||
Args: | ||
cred_handle (Creds): the Credentials to query | ||
desired_aspect (OID): the desired aspect of the Credentials to inquire | ||
about. | ||
Returns: | ||
list: A list of zero or more pieces of data (as bytes objects) | ||
Raises: | ||
GSS_ERROR | ||
""" | ||
|
||
cdef gss_buffer_set_t *data_set_ptr = NULL | ||
cdef gss_buffer_set_t data_set = GSS_C_NO_BUFFER_SET | ||
cdef OM_uint32 maj_stat, min_stat | ||
|
||
data_set_ptr = &data_set | ||
|
||
with nogil: | ||
maj_stat = gss_inquire_cred_by_oid(&min_stat, cred_handle.raw_creds, | ||
&desired_aspect.raw_oid, | ||
data_set_ptr) | ||
|
||
if maj_stat == GSS_S_COMPLETE: | ||
py_tokens = [] | ||
|
||
if data_set != GSS_C_NO_BUFFER_SET: | ||
for i in range(data_set.count): | ||
token = data_set.elements[i] | ||
py_tokens.append(token.value[:token.length]) | ||
|
||
gss_release_buffer_set(&min_stat, &data_set) | ||
|
||
return py_tokens | ||
else: | ||
raise GSSError(maj_stat, min_stat) | ||
|
||
|
||
def inquire_sec_context_by_oid(SecurityContext context not None, | ||
OID desired_aspect not None): | ||
""" | ||
inquire_sec_context_by_oid(context, desired_aspect) | ||
This method inspects a :class:`SecurityContext` object for information | ||
specific to a particular desired aspect as an OID. | ||
This method can be used with the GSS_KRB5_INQ_SSPI_SESSION_KEY_OID OID to | ||
retrieve the required key that is used to derive the SMB/SAMBA signing and | ||
encryption keys. | ||
Args: | ||
context (SecurityContext): the Security Context to query | ||
desired_aspect (OID): the desired aspected of the Security Context to | ||
inquire about. | ||
Returns: | ||
list: A list of zero or more pieces of data (as bytes objects) | ||
Raises: | ||
GSS_ERROR | ||
""" | ||
|
||
cdef gss_buffer_set_t *data_set_ptr = NULL | ||
cdef gss_buffer_set_t data_set = GSS_C_NO_BUFFER_SET | ||
cdef OM_uint32 maj_stat, min_stat | ||
|
||
data_set_ptr = &data_set | ||
|
||
with nogil: | ||
maj_stat = gss_inquire_sec_context_by_oid(&min_stat, context.raw_ctx, | ||
&desired_aspect.raw_oid, | ||
data_set_ptr) | ||
|
||
if maj_stat == GSS_S_COMPLETE: | ||
py_tokens = [] | ||
|
||
if data_set != GSS_C_NO_BUFFER_SET: | ||
for i in range(data_set.count): | ||
token = data_set.elements[i] | ||
py_tokens.append(token.value[:token.length]) | ||
|
||
gss_release_buffer_set(&min_stat, &data_set) | ||
|
||
return py_tokens | ||
else: | ||
raise GSSError(maj_stat, min_stat) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters