Class: GSSAPI::Simple
- Inherits:
-
Object
- Object
- GSSAPI::Simple
- Defined in:
- lib/gssapi/simple.rb
Overview
This class is a simple wrapper around the most common usage of GSSAPI. If you are looking at doing
something a bit more advanced you may want to check out the LibGSSAPI module.
Instance Attribute Summary collapse
-
#context ⇒ Object
readonly
Returns the value of attribute context.
Instance Method Summary collapse
-
#accept_context(in_token) ⇒ String, true
Accept a security context that was initiated by a remote peer.
-
#acquire_credentials(princ = @int_svc_name, opts = {:usage => :accept}) ⇒ true
Acquire security credentials.
-
#display_name ⇒ String
Get textual representation of internal GSS name.
- #get_mic(token) ⇒ Object
-
#import_name(str) ⇒ Object
Convert a String to a GSSAPI usable buffer (gss_buffer_desc).
-
#init_context(in_token = nil, opts = {}) ⇒ String, true
Initialize the GSS security context (client initiator).
-
#initialize(host_name, service_name = nil, keytab = nil) ⇒ Simple
constructor
Initialize a new GSSAPI::Simple object.
-
#set_keytab(keytab) ⇒ Object
Add a path to a custom keytab file.
-
#unwrap_message(msg, encrypted = true) ⇒ Object
Unwrap a message previously wrapped with gss_wrap.
-
#wrap_message(msg, encrypt = true) ⇒ String
Wrap a message using gss_wrap.
Constructor Details
#initialize(host_name, service_name = nil, keytab = nil) ⇒ Simple
Initialize a new GSSAPI::Simple object
22 23 24 25 26 27 28 29 |
# File 'lib/gssapi/simple.rb', line 22 def initialize(host_name, service_name=nil, keytab=nil) @host = host_name @service = service_name.nil? ? "host@#{@host}" : (service_name.include?('@') ? service_name : "#{service_name}@#{@host}") @int_svc_name = import_name(@service) @context = nil # the security context @scred = nil # the service credentials. really only used for the server-side via acquire_credentials set_keytab(keytab) unless keytab.nil? end |
Instance Attribute Details
#context ⇒ Object (readonly)
Returns the value of attribute context.
12 13 14 |
# File 'lib/gssapi/simple.rb', line 12 def context @context end |
Instance Method Details
#accept_context(in_token) ⇒ String, true
Accept a security context that was initiated by a remote peer.
104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 |
# File 'lib/gssapi/simple.rb', line 104 def accept_context(in_token) raise GssApiError, "No credentials yet acquired. Call #{self.class.name}#acquire_credentials first" if @scred.nil? min_stat = FFI::MemoryPointer.new :OM_uint32 ctx = (@context.nil? ? LibGSSAPI::GssCtxIdT.gss_c_no_context.address_of : @context.address_of) no_chn_bind = LibGSSAPI::GSS_C_NO_CHANNEL_BINDINGS @client = FFI::MemoryPointer.new :pointer # Will hold the initiating client name after the call mech = FFI::MemoryPointer.new :pointer # Will hold the mech being used after the call in_tok = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new in_tok.value = in_token out_tok = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new ret_flags = FFI::MemoryPointer.new :OM_uint32 maj_stat = LibGSSAPI.gss_accept_sec_context(min_stat, ctx, @scred, in_tok.pointer, no_chn_bind, @client, mech, out_tok.pointer, ret_flags, nil, nil) raise GssApiError.new(maj_stat, min_stat), "gss_accept_sec_context did not return GSS_S_COMPLETE" if maj_stat > 1 @context = LibGSSAPI::GssCtxIdT.new(ctx.get_pointer(0)) out_tok.length > 0 ? out_tok.value : true end |
#acquire_credentials(princ = @int_svc_name, opts = {:usage => :accept}) ⇒ true
Acquire security credentials. This does not log you in. It grabs the credentials from a cred cache or keytab.
175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 |
# File 'lib/gssapi/simple.rb', line 175 def acquire_credentials(princ = @int_svc_name, opts = {:usage => :accept}) min_stat = FFI::MemoryPointer.new :OM_uint32 scred = FFI::MemoryPointer.new :pointer case opts[:usage] when :accept usage = LibGSSAPI::GSS_C_ACCEPT when :initiate usage = LibGSSAPI::GSS_C_INITIATE when :both usage = LibGSSAPI::GSS_C_BOTH else raise GssApiError, "Bad option passed to #{self.class.name}#acquire_credentials" end maj_stat = LibGSSAPI.gss_acquire_cred(min_stat, princ, 0, LibGSSAPI::GSS_C_NO_OID_SET, usage, scred, nil, nil) raise GssApiError.new(maj_stat, min_stat), "gss_acquire_cred did not return GSS_S_COMPLETE" if maj_stat != 0 @scred = LibGSSAPI::GssCredIdT.new(scred.get_pointer(0)) true end |
#display_name ⇒ String
Get textual representation of internal GSS name
150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 |
# File 'lib/gssapi/simple.rb', line 150 def display_name raise GssApiError.new(), "No context accepted yet. Call #{self.class.name}#accept_context(in_token) first" if @client.nil? output_name = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new min_stat = FFI::MemoryPointer.new :OM_uint32 maj_stat = LibGSSAPI.gss_display_name(min_stat, @client.get_pointer(0), output_name.pointer, nil) if maj_stat != GSSAPI::LibGSSAPI::GSS_S_COMPLETE raise GssApiError.new(maj_stat, min_stat), "gss_display_name did not return GSS_S_COMPLETE but #{ maj_stat }" end output_name.value end |
#get_mic(token) ⇒ Object
135 136 137 138 139 140 141 142 143 144 145 |
# File 'lib/gssapi/simple.rb', line 135 def get_mic(token) min_stat = FFI::MemoryPointer.new :OM_uint32 qop_req = GSSAPI::LibGSSAPI::GSS_C_QOP_DEFAULT in_buff = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new in_buff.value = token out_buff = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new maj_stat = GSSAPI::LibGSSAPI.gss_get_mic(min_stat, @context, qop_req, in_buff.pointer, out_buff.pointer) raise GssApiError.new(maj_stat, min_stat), "Failed to gss_get_mic" if maj_stat != 0 out_buff.value end |
#import_name(str) ⇒ Object
Convert a String to a GSSAPI usable buffer (gss_buffer_desc)
34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 |
# File 'lib/gssapi/simple.rb', line 34 def import_name(str) buff_str = LibGSSAPI::UnManagedGssBufferDesc.new buff_str.value = str # Choose the appropriate mechanism based on the string passed. if (str =~ /[A-Za-z0-9]+\/[^@]+@.+$/) mech = LibGSSAPI::GssOID.gss_c_no_oid else mech = LibGSSAPI::GSS_C_NT_HOSTBASED_SERVICE end name = FFI::MemoryPointer.new :pointer # gss_name_t min_stat = FFI::MemoryPointer.new :OM_uint32 maj_stat = LibGSSAPI.gss_import_name(min_stat, buff_str.pointer, mech, name) raise GssApiError.new(maj_stat, min_stat), "gss_import_name did not return GSS_S_COMPLETE" if maj_stat != 0 LibGSSAPI::GssNameT.new(name.get_pointer(0)) end |
#init_context(in_token = nil, opts = {}) ⇒ String, true
Initialize the GSS security context (client initiator). If there was a previous call that issued a
continue you can pass the continuation token in via the token param.
If no flags are set the default flags are LibGSSAPI::GSS_C_MUTUAL_FLAG | LibGSSAPI::GSS_C_SEQUENCE_FLAG
62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 |
# File 'lib/gssapi/simple.rb', line 62 def init_context(in_token = nil, opts = {}) min_stat = FFI::MemoryPointer.new :OM_uint32 ctx = (@context.nil? ? LibGSSAPI::GssCtxIdT.gss_c_no_context.address_of : @context.address_of) mech = LibGSSAPI::GssOID.gss_c_no_oid if(opts[:flags]) flags = opts[:flags] else flags = (LibGSSAPI::GSS_C_MUTUAL_FLAG | LibGSSAPI::GSS_C_SEQUENCE_FLAG | LibGSSAPI::GSS_C_CONF_FLAG | LibGSSAPI::GSS_C_INTEG_FLAG) flags |= LibGSSAPI::GSS_C_DELEG_FLAG if opts[:delegate] flags |= LibGSSAPI::GSS_C_DELEG_POLICY_FLAG if opts[:delegate] end in_tok = LibGSSAPI::UnManagedGssBufferDesc.new in_tok.value = in_token out_tok = LibGSSAPI::ManagedGssBufferDesc.new ret_flags = FFI::MemoryPointer.new :OM_uint32 maj_stat = LibGSSAPI.gss_init_sec_context(min_stat, nil, ctx, @int_svc_name, mech, flags, 0, nil, in_tok.pointer, nil, out_tok.pointer, ret_flags, nil) raise GssApiError.new(maj_stat, min_stat), "gss_init_sec_context did not return GSS_S_COMPLETE" if maj_stat > 1 @context = LibGSSAPI::GssCtxIdT.new(ctx.get_pointer(0)) maj_stat == 1 ? out_tok.value : true end |
#set_keytab(keytab) ⇒ Object
Add a path to a custom keytab file
233 234 235 236 237 |
# File 'lib/gssapi/simple.rb', line 233 def set_keytab(keytab) maj_stat = LibGSSAPI.krb5_gss_register_acceptor_identity(keytab) raise GssApiError.new(maj_stat, min_stat), "krb5_gss_register_acceptor_identity did not return GSS_S_COMPLETE" if maj_stat != 0 true end |
#unwrap_message(msg, encrypted = true) ⇒ Object
Unwrap a message previously wrapped with gss_wrap.
217 218 219 220 221 222 223 224 225 226 227 228 229 |
# File 'lib/gssapi/simple.rb', line 217 def (msg, encrypted = true) min_stat = FFI::MemoryPointer.new :OM_uint32 in_buff = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new in_buff.value = msg out_buff = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new conf_state = FFI::MemoryPointer.new :int conf_state.write_int((encrypted ? 1 : 0)) q_op = FFI::MemoryPointer.new :OM_uint32 q_op.write_int(0) maj_stat = GSSAPI::LibGSSAPI.gss_unwrap(min_stat, @context, in_buff.pointer, out_buff.pointer, conf_state, q_op) raise GssApiError.new(maj_stat, min_stat), "Failed to gss_unwrap message" if maj_stat != 0 out_buff.value end |
#wrap_message(msg, encrypt = true) ⇒ String
Wrap a message using gss_wrap. It can either encrypt the message (confidentiality) or simply sign it (integrity).
201 202 203 204 205 206 207 208 209 210 211 212 |
# File 'lib/gssapi/simple.rb', line 201 def (msg, encrypt = true) min_stat = FFI::MemoryPointer.new :OM_uint32 conf_req = (encrypt ? 1 : 0) qop_req = GSSAPI::LibGSSAPI::GSS_C_QOP_DEFAULT in_buff = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new in_buff.value = msg conf_state = FFI::MemoryPointer.new :OM_uint32 out_buff = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new maj_stat = GSSAPI::LibGSSAPI.gss_wrap(min_stat, @context, conf_req, qop_req, in_buff.pointer, conf_state, out_buff.pointer) raise GssApiError.new(maj_stat, min_stat), "Failed to gss_wrap message" if maj_stat != 0 out_buff.value end |