Class: GSSAPI::Simple
- Inherits:
-
Object
- Object
- GSSAPI::Simple
- Defined in:
- lib/gssapi/simple.rb
Overview
This class is a simple wrapper around the most common usage of GSSAPI. If you are looking at doing
something a bit more advanced you may want to check out the LibGSSAPI module.
Instance Attribute Summary collapse
-
#context ⇒ Object
readonly
Returns the value of attribute context.
-
#delegated_credentials ⇒ Object
readonly
Returns the value of attribute delegated_credentials.
Instance Method Summary collapse
-
#accept_context(in_token) ⇒ String, true
Accept a security context that was initiated by a remote peer.
-
#acquire_credentials(princ = @int_svc_name, opts = {:usage => :accept}) ⇒ true
Acquire security credentials.
-
#display_name ⇒ String
Get textual representation of internal GSS name.
- #get_mic(token) ⇒ Object
-
#import_name(str) ⇒ Object
Convert a String to a GSSAPI usable buffer (gss_buffer_desc).
-
#init_context(in_token = nil, opts = {}) ⇒ String, true
Initialize the GSS security context (client initiator).
-
#initialize(host_name, service_name = nil, keytab = nil) ⇒ Simple
constructor
Initialize a new GSSAPI::Simple object.
-
#set_keytab(keytab) ⇒ Object
Add a path to a custom keytab file.
-
#unwrap_message(msg, encrypted = true) ⇒ Object
Unwrap a message previously wrapped with gss_wrap.
-
#wrap_message(msg, encrypt = true) ⇒ String
Wrap a message using gss_wrap.
Constructor Details
#initialize(host_name, service_name = nil, keytab = nil) ⇒ Simple
Initialize a new GSSAPI::Simple object
23 24 25 26 27 28 29 30 31 |
# File 'lib/gssapi/simple.rb', line 23 def initialize(host_name, service_name=nil, keytab=nil) @host = host_name @service = service_name.nil? ? "host@#{@host}" : (service_name.include?('@') ? service_name : "#{service_name}@#{@host}") @int_svc_name = import_name(@service) @context = nil # the security context @scred = nil # the service credentials. really only used for the server-side via acquire_credentials set_keytab(keytab) unless keytab.nil? @delegated_credentials = nil end |
Instance Attribute Details
#context ⇒ Object (readonly)
Returns the value of attribute context.
12 13 14 |
# File 'lib/gssapi/simple.rb', line 12 def context @context end |
#delegated_credentials ⇒ Object (readonly)
Returns the value of attribute delegated_credentials.
13 14 15 |
# File 'lib/gssapi/simple.rb', line 13 def delegated_credentials @delegated_credentials end |
Instance Method Details
#accept_context(in_token) ⇒ String, true
Accept a security context that was initiated by a remote peer.
111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 |
# File 'lib/gssapi/simple.rb', line 111 def accept_context(in_token) raise GssApiError, "No credentials yet acquired. Call #{self.class.name}#acquire_credentials first" if @scred.nil? min_stat = FFI::MemoryPointer.new :OM_uint32 pctx = (@context.nil? ? LibGSSAPI::GssCtxIdT.gss_c_no_context.address_of : @context.address_of) no_chn_bind = LibGSSAPI::GSS_C_NO_CHANNEL_BINDINGS @client = FFI::MemoryPointer.new :pointer # Will hold the initiating client name after the call mech = FFI::MemoryPointer.new :pointer # Will hold the mech being used after the call in_tok = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new in_tok.value = in_token out_tok = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new ret_flags = FFI::MemoryPointer.new :OM_uint32 delegated_cred_handle = FFI::MemoryPointer.new :pointer maj_stat = LibGSSAPI.gss_accept_sec_context(min_stat, pctx, @scred, in_tok.pointer, no_chn_bind, @client, mech, out_tok.pointer, ret_flags, nil, delegated_cred_handle) raise GssApiError.new(maj_stat, min_stat), "gss_accept_sec_context did not return GSS_S_COMPLETE" if maj_stat > 1 if (ret_flags.read_uint32 & LibGSSAPI::GSS_C_DELEG_FLAG) != 0 @delegated_credentials = LibGSSAPI::GssCredIdT.new(delegated_cred_handle.get_pointer(0)) end # The returned context may be equal to the passed in @context. If so, we # must not create another AutoPointer to the same gss_buffer_t. If we do # we will double delete it. ctx = pctx.get_pointer(0) @context = LibGSSAPI::GssCtxIdT.new(ctx) if ctx != @context out_tok.length > 0 ? out_tok.value : true end |
#acquire_credentials(princ = @int_svc_name, opts = {:usage => :accept}) ⇒ true
Acquire security credentials. This does not log you in. It grabs the credentials from a cred cache or keytab.
193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 |
# File 'lib/gssapi/simple.rb', line 193 def acquire_credentials(princ = @int_svc_name, opts = {:usage => :accept}) min_stat = FFI::MemoryPointer.new :OM_uint32 scred = FFI::MemoryPointer.new :pointer case opts[:usage] when :accept usage = LibGSSAPI::GSS_C_ACCEPT when :initiate usage = LibGSSAPI::GSS_C_INITIATE when :both usage = LibGSSAPI::GSS_C_BOTH else raise GssApiError, "Bad option passed to #{self.class.name}#acquire_credentials" end maj_stat = LibGSSAPI.gss_acquire_cred(min_stat, princ, 0, LibGSSAPI::GSS_C_NO_OID_SET, usage, scred, nil, nil) raise GssApiError.new(maj_stat, min_stat), "gss_acquire_cred did not return GSS_S_COMPLETE" if maj_stat != 0 @scred = LibGSSAPI::GssCredIdT.new(scred.get_pointer(0)) true end |
#display_name ⇒ String
Get textual representation of internal GSS name
168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 |
# File 'lib/gssapi/simple.rb', line 168 def display_name raise GssApiError.new(), "No context accepted yet. Call #{self.class.name}#accept_context(in_token) first" if @client.nil? output_name = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new min_stat = FFI::MemoryPointer.new :OM_uint32 maj_stat = LibGSSAPI.gss_display_name(min_stat, @client.get_pointer(0), output_name.pointer, nil) if maj_stat != GSSAPI::LibGSSAPI::GSS_S_COMPLETE raise GssApiError.new(maj_stat, min_stat), "gss_display_name did not return GSS_S_COMPLETE but #{ maj_stat }" end output_name.value end |
#get_mic(token) ⇒ Object
153 154 155 156 157 158 159 160 161 162 163 |
# File 'lib/gssapi/simple.rb', line 153 def get_mic(token) min_stat = FFI::MemoryPointer.new :OM_uint32 qop_req = GSSAPI::LibGSSAPI::GSS_C_QOP_DEFAULT in_buff = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new in_buff.value = token out_buff = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new maj_stat = GSSAPI::LibGSSAPI.gss_get_mic(min_stat, @context, qop_req, in_buff.pointer, out_buff.pointer) raise GssApiError.new(maj_stat, min_stat), "Failed to gss_get_mic" if maj_stat != 0 out_buff.value end |
#import_name(str) ⇒ Object
Convert a String to a GSSAPI usable buffer (gss_buffer_desc)
36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 |
# File 'lib/gssapi/simple.rb', line 36 def import_name(str) buff_str = LibGSSAPI::UnManagedGssBufferDesc.new buff_str.value = str # Choose the appropriate mechanism based on the string passed. if (str =~ /[A-Za-z0-9]+\/[^@]+@.+$/) mech = LibGSSAPI::GssOID.gss_c_no_oid else mech = LibGSSAPI::GSS_C_NT_HOSTBASED_SERVICE end name = FFI::MemoryPointer.new :pointer # gss_name_t min_stat = FFI::MemoryPointer.new :OM_uint32 maj_stat = LibGSSAPI.gss_import_name(min_stat, buff_str.pointer, mech, name) raise GssApiError.new(maj_stat, min_stat), "gss_import_name did not return GSS_S_COMPLETE" if maj_stat != 0 LibGSSAPI::GssNameT.new(name.get_pointer(0)) end |
#init_context(in_token = nil, opts = {}) ⇒ String, true
Initialize the GSS security context (client initiator). If there was a previous call that issued a
continue you can pass the continuation token in via the token param.
If no flags are set the default flags are LibGSSAPI::GSS_C_MUTUAL_FLAG | LibGSSAPI::GSS_C_SEQUENCE_FLAG
64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 |
# File 'lib/gssapi/simple.rb', line 64 def init_context(in_token = nil, opts = {}) min_stat = FFI::MemoryPointer.new :OM_uint32 pctx = (@context.nil? ? LibGSSAPI::GssCtxIdT.gss_c_no_context.address_of : @context.address_of) mech = LibGSSAPI::GssOID.gss_c_no_oid if(opts[:flags]) flags = opts[:flags] else flags = (LibGSSAPI::GSS_C_MUTUAL_FLAG | LibGSSAPI::GSS_C_SEQUENCE_FLAG | LibGSSAPI::GSS_C_CONF_FLAG | LibGSSAPI::GSS_C_INTEG_FLAG) flags |= LibGSSAPI::GSS_C_DELEG_FLAG if opts[:delegate] flags |= LibGSSAPI::GSS_C_DELEG_POLICY_FLAG if opts[:delegate] end in_tok = LibGSSAPI::UnManagedGssBufferDesc.new in_tok.value = in_token out_tok = LibGSSAPI::ManagedGssBufferDesc.new ret_flags = FFI::MemoryPointer.new :OM_uint32 maj_stat = LibGSSAPI.gss_init_sec_context(min_stat, nil, pctx, @int_svc_name, mech, flags, 0, nil, in_tok.pointer, nil, out_tok.pointer, ret_flags, nil) raise GssApiError.new(maj_stat, min_stat), "gss_init_sec_context did not return GSS_S_COMPLETE" if maj_stat > 1 # The returned context may be equal to the passed in @context. If so, we # must not create another AutoPointer to the same gss_buffer_t. If we do # we will double delete it. ctx = pctx.get_pointer(0) @context = LibGSSAPI::GssCtxIdT.new(ctx) if ctx != @context maj_stat == 1 ? out_tok.value : true end |
#set_keytab(keytab) ⇒ Object
Add a path to a custom keytab file
251 252 253 254 255 |
# File 'lib/gssapi/simple.rb', line 251 def set_keytab(keytab) maj_stat = LibGSSAPI.krb5_gss_register_acceptor_identity(keytab) raise GssApiError.new(maj_stat, min_stat), "krb5_gss_register_acceptor_identity did not return GSS_S_COMPLETE" if maj_stat != 0 true end |
#unwrap_message(msg, encrypted = true) ⇒ Object
Unwrap a message previously wrapped with gss_wrap.
235 236 237 238 239 240 241 242 243 244 245 246 247 |
# File 'lib/gssapi/simple.rb', line 235 def (msg, encrypted = true) min_stat = FFI::MemoryPointer.new :OM_uint32 in_buff = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new in_buff.value = msg out_buff = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new conf_state = FFI::MemoryPointer.new :int conf_state.write_int((encrypted ? 1 : 0)) q_op = FFI::MemoryPointer.new :OM_uint32 q_op.write_int(0) maj_stat = GSSAPI::LibGSSAPI.gss_unwrap(min_stat, @context, in_buff.pointer, out_buff.pointer, conf_state, q_op) raise GssApiError.new(maj_stat, min_stat), "Failed to gss_unwrap message" if maj_stat != 0 out_buff.value end |
#wrap_message(msg, encrypt = true) ⇒ String
Wrap a message using gss_wrap. It can either encrypt the message (confidentiality) or simply sign it (integrity).
219 220 221 222 223 224 225 226 227 228 229 230 |
# File 'lib/gssapi/simple.rb', line 219 def (msg, encrypt = true) min_stat = FFI::MemoryPointer.new :OM_uint32 conf_req = (encrypt ? 1 : 0) qop_req = GSSAPI::LibGSSAPI::GSS_C_QOP_DEFAULT in_buff = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new in_buff.value = msg conf_state = FFI::MemoryPointer.new :OM_uint32 out_buff = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new maj_stat = GSSAPI::LibGSSAPI.gss_wrap(min_stat, @context, conf_req, qop_req, in_buff.pointer, conf_state, out_buff.pointer) raise GssApiError.new(maj_stat, min_stat), "Failed to gss_wrap message" if maj_stat != 0 out_buff.value end |