def unsecure_data(self, cred, data): def pull_seqnum(blob): """Pulls initial seq_num off of blob, checks it, then returns data. """ # blob = seq_num + data p.reset(blob) try: seq_num = p.unpack_uint() except: log_gss.exception("unsecure_data - unpacking seq_num") raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) if seq_num != cred.seq_num: raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) return p.get_buffer()[p.get_position():] def check_gssapi(qop): if qop != cred.qop: # XXX Not sure what error to give here log_gss.warn("unsecure_data: mismatched qop %i != %i" % (qop, cred.qop)) raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) cred = cred.body if cred.service == rpc_gss_svc_none or \ cred.gss_proc in (RPCSEC_GSS_INIT, RPCSEC_GSS_CONTINUE_INIT): return data p = GSSUnpacker(data) context = self._get_context(cred.handle) try: if cred.service == rpc_gss_svc_integrity: # data = opaque[gss_seq_num+data] + opaque[checksum] try: data = p.unpack_opaque() checksum = p.unpack_opaque() p.done() except: log_gss.exception("unsecure_data - initial unpacking") raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) qop = context.verifyMIC(data, checksum) check_gssapi(qop) data = pull_seqnum(data) elif cred.service == rpc_gss_svc_privacy: # data = opaque[wrap([gss_seq_num+data])] try: data = p.unpack_opaque() p.done() except: log_gss.exception("unsecure_data - initial unpacking") raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) # data, qop, conf = context.unwrap(data) data, qop = context.unwrap(data) check_gssapi(qop) data = pull_seqnum(data) else: # Can't get here, but doesn't hurt log_gss.error("Unknown service %i for RPCSEC_GSS" % cred.service) except gssapi.Error as e: log_gss.warn("unsecure_data: gssapi call returned %s" % e.name) raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) return data
def unsecure_data(self, cred, data): def pull_seqnum(blob): """Pulls initial seq_num off of blob, checks it, then returns data. """ # blob = seq_num + data p.reset(blob) try: seq_num = p.unpack_uint() except: log_gss.exception("unsecure_data - unpacking seq_num") raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) if seq_num != cred.seq_num: raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) return p.get_buffer()[p.get_position():] def check_gssapi(qop): if qop != cred.qop: # XXX Not sure what error to give here log_gss.warn("unsecure_data: mismatched qop %i != %i" % (qop, cred.qop)) raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) cred = cred.body if cred.service == rpc_gss_svc_none or \ cred.gss_proc in (RPCSEC_GSS_INIT, RPCSEC_GSS_CONTINUE_INIT): return data p = GSSUnpacker(data) context = self._get_context(cred.handle) try: if cred.service == rpc_gss_svc_integrity: # data = opaque[gss_seq_num+data] + opaque[checksum] try: data = p.unpack_opaque() checksum = p.unpack_opaque() p.done() except: log_gss.exception("unsecure_data - initial unpacking") raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) qop = context.verifyMIC(data, checksum) check_gssapi(qop) data = pull_seqnum(data) elif cred.service == rpc_gss_svc_privacy: # data = opaque[wrap([gss_seq_num+data])] try: data = p.unpack_opaque() p.done() except: log_gss.exception("unsecure_data - initial unpacking") raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS) # data, qop, conf = context.unwrap(data) data, qop = context.unwrap(data) check_gssapi(qop) data = pull_seqnum(data) else: # Can't get here, but doesn't hurt log_gss.error("Unknown service %i for RPCSEC_GSS" % cred.service) except gssapi.Error, e: log_gss.warn("unsecure_data: gssapi call returned %s" % e.name) raise rpclib.RPCUnsuccessfulReply(GARBAGE_ARGS)
def handle_gss_init(self, cred, data, first): p = GSSUnpacker(data) token = p.unpack_opaque() p.done() log_gss.debug("***ACCEPTSECCONTEXT***") if first: context = gssapi.Context() else: context = self._get_context(cred.body.handle) try: token = context.accept(token) except gssapi.Error, e: log_gss.debug("RPCSEC_GSS_INIT failed (%s, %i)!" % (e.name, e.minor)) res = rpc_gss_init_res('', e.major, e.minor, 0, '')
def handle_gss_init(self, cred, data, first): p = GSSUnpacker(data) token = p.unpack_opaque() p.done() log_gss.debug("***ACCEPTSECCONTEXT***") if first: context = gssapi.Context() else: context = self._get_context(cred.body.handle) try: token = context.accept(token) except gssapi.Error as e: log_gss.debug("RPCSEC_GSS_INIT failed (%s, %i)!" % (e.name, e.minor)) res = rpc_gss_init_res('', e.major, e.minor, 0, '') else: log_gss.debug("RPCSEC_GSS_*INIT succeeded!") if first: handle = self._add_context(context) # XXX HACK - this ensures make_reply_verf works, but # is a subtle side-effect that could introduce bugs if code # is ever reorganized. Currently cred is forgotten once # we leave here though. cred.body.rpc_gss_cred_vers_1_t.handle = handle else: handle = cred.body.handle if context.open: major = gssapi.GSS_S_COMPLETE else: major = gssapi.GSS_S_CONTINUE_NEEDED res = rpc_gss_init_res( handle, major, 0, # XXX can't see minor WINDOWSIZE, token) # Prepare response p = GSSPacker() p.pack_rpc_gss_init_res(res) # NOTE this is an annoying case for make_reply_verf. # It is the only time that you need msg_data to feed into it. verf = self.make_reply_verf(cred, major) raise rpclib.RPCSuccessfulReply(verf, p.get_buffer())
def handle_gss_init(self, cred, data, first): p = GSSUnpacker(data) token = p.unpack_opaque() p.done() log_gss.debug("***ACCEPTSECCONTEXT***") if first: context = gssapi.Context() else: context = self._get_context(cred.body.handle) try: token = context.accept(token) except gssapi.Error as e: log_gss.debug("RPCSEC_GSS_INIT failed (%s, %i)!" % (e.name, e.minor)) res = rpc_gss_init_res('', e.major, e.minor, 0, '') else: log_gss.debug("RPCSEC_GSS_*INIT succeeded!") if first: handle = self._add_context(context) # XXX HACK - this ensures make_reply_verf works, but # is a subtle side-effect that could introduce bugs if code # is ever reorganized. Currently cred is forgotten once # we leave here though. cred.body.rpc_gss_cred_vers_1_t.handle = handle else: handle = cred.body.handle if context.open: major = gssapi.GSS_S_COMPLETE else: major = gssapi.GSS_S_CONTINUE_NEEDED res = rpc_gss_init_res(handle, major, 0, # XXX can't see minor WINDOWSIZE, token) # Prepare response p = GSSPacker() p.pack_rpc_gss_init_res(res) # NOTE this is an annoying case for make_reply_verf. # It is the only time that you need msg_data to feed into it. verf = self.make_reply_verf(cred, major) raise rpclib.RPCSuccessfulReply(verf, p.get_buffer())