generic-library/libzmq
1
0
Fork 0
mirror of https://github.com/zeromq/libzmq.git synced 2025-10-26 02:18:06 +01:00
Code Issues Projects Releases Wiki Activity

GSSAPI mechanism now fully working with encryption

Browse Source
This commit is contained in:
Mike Gatny
2013-10-08 00:12:50 -05:00
committed by Chris Busbey
parent eb2862525b
commit 3c414c4aac
7 changed files with 300 additions and 277 deletions
Download Patch File Download Diff File Expand all files Collapse all files

127
src/gssapi_server.cpp
View File

@@ -41,16 +41,12 @@ zmq::gssapi_server_t::gssapi_server_t (session_base_t *session_,
state (recv_next_token),
security_context_established (false)
{
service_name = (char *) "host"; /// FIXME add service_name to options
int rc = acquire_credentials (service_name, &cred); /// FIXME add creds to options too?
if (rc == 0) {
fprintf(stderr, "%s:%d: acquire creds successful\n", __FILE__, __LINE__); /// FIXME remove
service_name = (char *) "host"; // TODO: add service_name to options
int rc = acquire_credentials (service_name, &cred); // TODO: add creds to options too?
if (rc == 0)
maj_stat = GSS_S_CONTINUE_NEEDED;
}
else {
fprintf(stderr, "%s:%d: acquire creds failed\n", __FILE__, __LINE__); /// FIXME remove
else
maj_stat = GSS_S_FAILURE;
}
}
zmq::gssapi_server_t::~gssapi_server_t ()
@@ -61,64 +57,58 @@ zmq::gssapi_server_t::~gssapi_server_t ()
int zmq::gssapi_server_t::next_handshake_command (msg_t *msg_)
{
int rc = 0;
switch (state) {
case send_next_token:
rc = produce_next_token (msg_);
if (rc == 0)
state = security_context_established? almost_ready: recv_next_token;
break;
case almost_ready:
state = ready;
break;
default:
errno = EPROTO;
rc = -1;
break;
if (state != send_next_token) {
errno = EAGAIN;
return -1;
}
return rc;
if (produce_next_token (msg_) < 0)
return -1;
if (maj_stat != GSS_S_CONTINUE_NEEDED && maj_stat != GSS_S_COMPLETE)
return -1;
if (maj_stat == GSS_S_COMPLETE) {
gss_release_name(&min_stat, &target_name);
security_context_established = true;
state = connected;
}
else {
state = recv_next_token;
}
return 0;
}
int zmq::gssapi_server_t::process_handshake_command (msg_t *msg_)
{
int rc = 0;
if (state != recv_next_token) {
errno = EPROTO;
return -1;
}
switch (state) {
case recv_next_token:
rc = process_next_token (msg_);
if (rc == 0)
state = send_next_token;
break;
case almost_ready:
state = ready;
break;
default:
errno = EAGAIN;
rc = -1;
break;
}
if (rc == 0) {
rc = msg_->close ();
errno_assert (rc == 0);
rc = msg_->init ();
errno_assert (rc == 0);
}
return rc;
if (process_next_token (msg_) < 0)
return -1;
accept_context ();
state = send_next_token;
errno_assert (msg_->close () == 0);
errno_assert (msg_->init () == 0);
return 0;
}
int zmq::gssapi_server_t::encode (msg_t *msg_)
{
int rc = 0;
zmq_assert (state == ready);
return rc;
zmq_assert (state == connected);
return encode_message (msg_);
}
int zmq::gssapi_server_t::decode (msg_t *msg_)
{
int rc = 0;
zmq_assert (state == ready);
return rc;
zmq_assert (state == connected);
return decode_message (msg_);
}
int zmq::gssapi_server_t::zap_msg_available ()
@@ -128,53 +118,42 @@ int zmq::gssapi_server_t::zap_msg_available ()
bool zmq::gssapi_server_t::is_handshake_complete () const
{
fprintf(stderr, "%s:%d: is_handshake_complete=%d\n", __FILE__, __LINE__, (state==ready)); /// FIXME remove
return state == ready;
return state == connected;
}
int zmq::gssapi_server_t::produce_next_token (msg_t *msg_)
{
if (send_tok.length != 0) { // client expects another token
fprintf(stderr, "%s:%d: producing token\n", __FILE__, __LINE__); /// FIXME die("creating context", maj_stat, init_sec_min_stat); /// FIXME die("creating context", maj_stat, init_sec_min_stat);
if (produce_token(msg_, TOKEN_CONTEXT, send_tok.value, send_tok.length) < 0) {
fprintf(stderr, "%s:%d: failed to produce token!\n", __FILE__, __LINE__); /// FIXME die("creating context", maj_stat, init_sec_min_stat); /// FIXME die("creating context", maj_stat, init_sec_min_stat);
if (send_tok.length != 0) { // Client expects another token
if (produce_initiate(msg_, send_tok.value, send_tok.length) < 0)
return -1;
}
gss_release_buffer(&min_stat, &send_tok);
}
else
fprintf(stderr, "%s:%d: skip producing token\n", __FILE__, __LINE__); /// FIXME die("creating context", maj_stat, init_sec_min_stat); /// FIXME die("creating context", maj_stat, init_sec_min_stat);
if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
fprintf(stderr, "%s:%d: failed to create GSSAPI security context\n", __FILE__, __LINE__); /// FIXME die("creating context", maj_stat, init_sec_min_stat); /// FIXME die("creating context", maj_stat, init_sec_min_stat);
gss_release_name(&min_stat, &target_name);
if (context != GSS_C_NO_CONTEXT)
gss_delete_sec_context(&min_stat, &context, GSS_C_NO_BUFFER);
return -1;
}
if (maj_stat == GSS_S_COMPLETE) {
gss_release_name(&min_stat, &target_name);
security_context_established = true;
}
return 0;
}
int zmq::gssapi_server_t::process_next_token (msg_t *msg_)
{
if (maj_stat == GSS_S_CONTINUE_NEEDED) {
fprintf(stderr, "%s:%d: processing token\n", __FILE__, __LINE__); /// FIXME die("creating context", maj_stat, init_sec_min_stat); /// FIXME die("creating context", maj_stat, init_sec_min_stat);
if (process_token(msg_, token_flags, &recv_tok.value, recv_tok.length) < 0) {
if (process_initiate(msg_, &recv_tok.value, recv_tok.length) < 0) {
if (target_name != GSS_C_NO_NAME)
gss_release_name(&min_stat, &target_name);
fprintf(stderr, "%s:%d: failed to process token!\n", __FILE__, __LINE__); /// FIXME die("creating context", maj_stat, init_sec_min_stat); /// FIXME die("creating context", maj_stat, init_sec_min_stat);
return -1;
}
}
else
fprintf(stderr, "%s:%d: skip processing token\n", __FILE__, __LINE__); /// FIXME die("creating context", maj_stat, init_sec_min_stat); /// FIXME die("creating context", maj_stat, init_sec_min_stat);
return 0;
}
void zmq::gssapi_server_t::accept_context ()
{
maj_stat = gss_accept_sec_context(&init_sec_min_stat, &context, cred,
&recv_tok, GSS_C_NO_CHANNEL_BINDINGS,
&target_name, &doid, &send_tok,
@@ -184,7 +163,5 @@ int zmq::gssapi_server_t::process_next_token (msg_t *msg_)
free (recv_tok.value);
recv_tok.value = NULL;
}
return 0;
}