1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356
|
GSSAPI="BASE" # This ensures that a full module is generated by Cython
from libc.stdlib cimport malloc, calloc, free
from libc.string cimport memcpy
from gssapi.raw.cython_types cimport *
from gssapi.raw.sec_contexts cimport SecurityContext
from gssapi.raw.misc import GSSError
from gssapi.raw import types as gssapi_types
from gssapi.raw.named_tuples import IOVUnwrapResult
from collections import namedtuple
from collections.abc import Sequence
from enum import IntEnum
from gssapi.raw._enum_extensions import ExtendableEnum
# Kept for backwards compatibility - functions used to be declared here
try:
from gssapi.raw.ext_dce_aead import wrap_aead, unwrap_aead
except ImportError:
pass
cdef extern from "python_gssapi_ext.h":
"""
#ifdef OSX_HAS_GSS_FRAMEWORK
#define gss_wrap_iov __ApplePrivate_gss_wrap_iov
#define gss_unwrap_iov __ApplePrivate_gss_unwrap_iov
#define gss_wrap_iov_length __ApplePrivate_gss_wrap_iov_length
#define gss_release_iov_buffer __ApplePrivate_gss_release_iov_buffer
#endif
"""
# NB(directxman12): this wiki page has a different argument order
# than the header file, and uses size_t instead of int
# (this file matches the header file)
OM_uint32 gss_wrap_iov(OM_uint32 *min_stat, gss_ctx_id_t ctx_handle,
int conf_req_flag, gss_qop_t qop_req, int *conf_ret,
gss_iov_buffer_desc *iov, int iov_count) nogil
OM_uint32 gss_unwrap_iov(OM_uint32 *min_stat, gss_ctx_id_t ctx_handle,
int* conf_ret, gss_qop_t *qop_ret,
gss_iov_buffer_desc *iov, int iov_count) nogil
OM_uint32 gss_wrap_iov_length(OM_uint32 *min_stat, gss_ctx_id_t ctx_handle,
int conf_req, gss_qop_t qop_req,
int *conf_ret, gss_iov_buffer_desc *iov,
int iov_count) nogil
OM_uint32 gss_release_iov_buffer(OM_uint32 *min_stat,
gss_iov_buffer_desc *iov,
int iov_count) nogil
gss_iov_buffer_t GSS_C_NO_IOV_BUFFER
OM_uint32 GSS_IOV_BUFFER_TYPE_EMPTY
OM_uint32 GSS_IOV_BUFFER_TYPE_DATA
OM_uint32 GSS_IOV_BUFFER_TYPE_HEADER
OM_uint32 GSS_IOV_BUFFER_TYPE_MECH_PARAMS
OM_uint32 GSS_IOV_BUFFER_TYPE_TRAILER
OM_uint32 GSS_IOV_BUFFER_TYPE_PADDING
OM_uint32 GSS_IOV_BUFFER_TYPE_STREAM
OM_uint32 GSS_IOV_BUFFER_TYPE_SIGN_ONLY
OM_uint32 GSS_IOV_BUFFER_FLAG_MASK
OM_uint32 GSS_IOV_BUFFER_FLAG_ALLOCATE
OM_uint32 GSS_IOV_BUFFER_FLAG_ALLOCATED
# a few more are in the enum extension file
class IOVBufferType(IntEnum, metaclass=ExtendableEnum):
empty = GSS_IOV_BUFFER_TYPE_EMPTY
data = GSS_IOV_BUFFER_TYPE_DATA
header = GSS_IOV_BUFFER_TYPE_HEADER
mech_params = GSS_IOV_BUFFER_TYPE_MECH_PARAMS
trailer = GSS_IOV_BUFFER_TYPE_TRAILER
padding = GSS_IOV_BUFFER_TYPE_PADDING
stream = GSS_IOV_BUFFER_TYPE_STREAM
sign_only = GSS_IOV_BUFFER_TYPE_SIGN_ONLY
IOVBuffer = namedtuple('IOVBuffer', ['type', 'allocate', 'value'])
cdef class IOV:
# defined in ext_dce.pxd
# cdef int iov_len
# cdef bint c_changed
# cdef gss_iov_buffer_desc *_iov
# cdef bint _unprocessed
# cdef list _buffs
AUTO_ALLOC_BUFFERS = set([IOVBufferType.header, IOVBufferType.padding,
IOVBufferType.trailer])
def __init__(IOV self, *args, std_layout=True, auto_alloc=True):
self._unprocessed = True
self.c_changed = False
self._buffs = []
if std_layout:
self._buffs.append(IOVBuffer(IOVBufferType.header,
auto_alloc, None))
cdef char *val_copy
for buff_desc in args:
if isinstance(buff_desc, tuple):
if len(buff_desc) > 3 or len(buff_desc) < 2:
raise ValueError("Buffer description tuples must be "
"length 2 or 3")
buff_type = buff_desc[0]
if len(buff_desc) == 2:
if buff_type in self.AUTO_ALLOC_BUFFERS:
alloc = buff_desc[1]
data = None
else:
data = buff_desc[1]
alloc = False
else:
(buff_type, alloc, data) = buff_desc
self._buffs.append(IOVBuffer(buff_type, alloc, data))
elif isinstance(buff_desc, bytes): # assume type data
val = buff_desc
self._buffs.append(IOVBuffer(IOVBufferType.data, False, val))
else:
alloc = False
if buff_desc in self.AUTO_ALLOC_BUFFERS:
alloc = auto_alloc
self._buffs.append(IOVBuffer(buff_desc, alloc, None))
if std_layout:
self._buffs.append(IOVBuffer(IOVBufferType.padding, auto_alloc,
None))
self._buffs.append(IOVBuffer(IOVBufferType.trailer, auto_alloc,
None))
cdef gss_iov_buffer_desc* __cvalue__(IOV self) except NULL:
cdef OM_uint32 tmp_min_stat
cdef int i
if self._unprocessed:
if self._iov is not NULL:
gss_release_iov_buffer(&tmp_min_stat, self._iov, self.iov_len)
free(self._iov)
self.iov_len = len(self._buffs)
self._iov = <gss_iov_buffer_desc *>calloc(
self.iov_len, sizeof(gss_iov_buffer_desc))
if self._iov is NULL:
raise MemoryError("Cannot calloc for IOV buffer array")
for i in range(self.iov_len):
buff = self._buffs[i]
self._iov[i].type = buff.type
if buff.allocate:
self._iov[i].type |= GSS_IOV_BUFFER_FLAG_ALLOCATE
elif buff.allocate is None:
self._iov[i].type |= GSS_IOV_BUFFER_FLAG_ALLOCATED
if buff.value is None:
self._iov[i].buffer.length = 0
self._iov[i].buffer.value = NULL
else:
self._iov[i].buffer.length = len(buff.value)
self._iov[i].buffer.value = <char *>malloc(
self._iov[i].buffer.length)
if self._iov[i].buffer.value is NULL:
raise MemoryError("Cannot malloc for buffer value")
memcpy(self._iov[i].buffer.value, <char *>buff.value,
self._iov[i].buffer.length)
return self._iov
cdef _recreate_python_values(IOV self):
cdef i
cdef bint val_change = False
cdef size_t new_len
for i in range(self.iov_len):
old_type = self._buffs[i].type
if self._iov[i].buffer.value is NULL:
if self._iov[i].buffer.length == 0:
new_val = None
else:
new_len = self._iov[i].buffer.length
new_val = b'\x00' * new_len
else:
new_len = self._iov[i].buffer.length
new_val = (<char*>self._iov[i].buffer.value)[:new_len]
alloc = False
if self._iov[i].type & GSS_IOV_BUFFER_FLAG_ALLOCATE:
alloc = True
# NB(directxman12): GSSAPI (at least in MIT krb5) doesn't
# unset the allocate flag (because it's an "input flag",
# so this needs to come second and be separate
if self._iov[i].type & GSS_IOV_BUFFER_FLAG_ALLOCATED:
alloc = None
self._buffs[i] = IOVBuffer(old_type, alloc, new_val)
self.c_changed = False
def __getitem__(IOV self, ind):
if self.c_changed:
self._recreate_python_values()
return self._buffs[ind]
def __len__(IOV self):
if self.c_changed:
self._recreate_python_values()
return len(self._buffs)
def __iter__(IOV self):
if self.c_changed:
self._recreate_python_values()
for val in self._buffs:
yield val
def __contains__(IOV self, item):
if self.c_changed:
self._recreate_python_values()
return item in self._buffs
def __reversed__(IOV self):
if self.c_changed:
self._recreate_python_values()
for val in reversed(self._buffs):
yield val
def index(IOV self, value):
for i, v in enumerate(self):
if v == value:
return i
raise ValueError
def count(IOV self, value):
return sum(1 for v in self if v == value)
def __repr__(IOV self):
if self.c_changed:
self._recreate_python_values()
return "<{module}.{name} {buffs}>".format(
module=type(self).__module__, name=type(self).__name__,
buffs=repr(self._buffs))
def __str__(IOV self):
buff_strs = []
for buff in self:
type_val = str(buff.type).split('.')[1].upper()
if buff.value is None:
auto_alloc = buff.allocate
if auto_alloc:
buff_strs.append(type_val + "(allocate)")
else:
buff_strs.append(type_val + "(empty)")
else:
if buff.allocate is None:
alloc_str = ", allocated"
else:
alloc_str = ""
buff_strs.append("{0}({1!r}{2})".format(type_val,
buff.value, alloc_str))
return "<IOV {0}>".format(' | '.join(buff_strs))
def __dealloc__(IOV self):
cdef OM_uint32 tmp_min_stat
cdef int i
if self._iov is not NULL:
gss_release_iov_buffer(&tmp_min_stat, self._iov, self.iov_len)
for i in range(self.iov_len):
if self._iov[i].buffer.value is not NULL:
free(self._iov[i].buffer.value)
free(self._iov)
def wrap_iov(SecurityContext context not None, IOV message not None,
confidential=True, qop=None):
cdef int conf_req = confidential
cdef gss_qop_t qop_req = qop if qop is not None else GSS_C_QOP_DEFAULT
cdef int conf_used
cdef gss_iov_buffer_desc *res_arr = message.__cvalue__()
cdef OM_uint32 maj_stat, min_stat
with nogil:
maj_stat = gss_wrap_iov(&min_stat, context.raw_ctx, conf_req, qop_req,
&conf_used, res_arr, message.iov_len)
if maj_stat == GSS_S_COMPLETE:
message.c_changed = True
return <bint>conf_used
else:
raise GSSError(maj_stat, min_stat)
def unwrap_iov(SecurityContext context not None, IOV message not None):
cdef int conf_used
cdef gss_qop_t qop_used
cdef gss_iov_buffer_desc *res_arr = message.__cvalue__()
cdef OM_uint32 maj_stat, min_stat
with nogil:
maj_stat = gss_unwrap_iov(&min_stat, context.raw_ctx, &conf_used,
&qop_used, res_arr, message.iov_len)
if maj_stat == GSS_S_COMPLETE:
message.c_changed = True
return IOVUnwrapResult(<bint>conf_used, qop_used)
else:
raise GSSError(maj_stat, min_stat)
def wrap_iov_length(SecurityContext context not None, IOV message not None,
confidential=True, qop=None):
cdef int conf_req = confidential
cdef gss_qop_t qop_req = qop if qop is not None else GSS_C_QOP_DEFAULT
cdef int conf_used
cdef gss_iov_buffer_desc *res_arr = message.__cvalue__()
cdef OM_uint32 maj_stat, min_stat
with nogil:
maj_stat = gss_wrap_iov_length(&min_stat, context.raw_ctx,
conf_req, qop_req,
&conf_used, res_arr, message.iov_len)
if maj_stat == GSS_S_COMPLETE:
message.c_changed = True
return <bint>conf_used
else:
raise GSSError(maj_stat, min_stat)
|