gssapi 1.0.1 → 1.0.2

data/VERSION

@@ -1 +1 @@
-1.0.1
+1.0.2

data/lib/gssapi.rb

@@ -7,6 +7,7 @@ require 'ffi'
 module GSSAPI
   module LibGSSAPI
     extend FFI::Library
+    FFI::add_typedef(:uint32, :OM_uint32)
 
     GSSAPI_LIB_TYPE = :mit unless defined?(GSSAPI_LIB_TYPE)
   end

data/lib/gssapi/exceptions.rb

@@ -4,5 +4,39 @@ Copyright © 2010 Dan Wanek <dan.wanek@gmail.com>
 Licensed under the MIT License: http://www.opensource.org/licenses/mit-license.php
 =end
 module GSSAPI
-  class GssApiError < StandardError;  end
+  class GssApiError < StandardError
+
+    include LibGSSAPI
+
+    def message; to_s + ": " + @s; end
+
+    def initialize(maj_stat = nil, min_stat = nil)
+      if(maj_stat.nil? && min_stat.nil?)
+        @s = '(no error info)'
+      else
+        min = FFI::MemoryPointer.new :OM_uint32
+        message_context = FFI::MemoryPointer.new :OM_uint32
+        @s = ''
+        oid = GssOID.gss_c_no_oid
+        min_stat = min_stat.read_uint32
+        [[maj_stat, GSS_C_GSS_CODE], [min_stat, GSS_C_MECH_CODE]].each do |m, t|
+          message_context.write_int 0
+          begin
+            out_buff = ManagedGssBufferDesc.new
+            maj = gss_display_status(min, m, t, oid, message_context, out_buff.pointer)
+            if (maj != 0)
+              @s += "failed to retrieve GSSAPI display for status #{m}"
+              @s += " of major status #{maj_stat}, minor_status #{min_stat}\n"
+              @s += "(with major status #{maj}, minor status #{min.read_uint32}\n"
+              break
+            end
+            @s += out_buff.value.to_s + "\n"
+          end while message_context.read_int != 0
+        end
+      end
+
+      # We need to call this so we can pass the message to the Error when we have no arguments
+      super()
+    end
+  end
 end

data/lib/gssapi/lib_gssapi.rb

@@ -10,12 +10,10 @@ module GSSAPI
     # Libc functions
 
     # void *malloc(size_t size);
-    attach_function :malloc, [:uint32], :pointer
+    attach_function :malloc, [:size_t], :pointer
 
     # void *memcpy(void *dest, const void *src, size_t n);
-    attach_function :memcpy, [:pointer, :pointer, :uint32], :pointer
-
-    typedef :uint32, :OM_uint32
+    attach_function :memcpy, [:pointer, :pointer, :size_t], :pointer
 
     class GssOID < FFI::Struct
       layout  :length   =>  :OM_uint32,
@@ -58,8 +56,8 @@ module GSSAPI
     module GssBufferDescLayout
       def self.included(base)
         base.class_eval do
-          layout :length => :size_t,
-            :value  => :pointer # pointer of :void
+          layout :length => :OM_uint32,
+            :value => :pointer # pointer of :void
 
           def length
             self[:length]
@@ -108,7 +106,7 @@ module GSSAPI
         elsif(val.is_a?(Fixnum))
           buff = FFI::MemoryPointer.new :OM_uint32
           buff.write_int val
-          self[:length] = val.to_s.length
+          self[:length] = FFI::type_size :OM_uint32
           self[:value] = buff
         else
           raise StandardError, "Can't handle type #{val.class.name}"
@@ -190,11 +188,7 @@ module GSSAPI
     class GssCtxIdT < GssPointer
       def self.release_ptr(context_ptr)
         min_stat = FFI::MemoryPointer.new :OM_uint32
-        # FIXME: change to GSS_C_NO_BUFFER
-        empty_buff = LibGSSAPI::UnManagedGssBufferDesc.new
-        empty_buff[:length] = 0
-        empty_buff[:value] = nil
-        maj_stat = LibGSSAPI.gss_delete_sec_context(min_stat, context_ptr, empty_buff.pointer)
+        maj_stat = LibGSSAPI.gss_delete_sec_context(min_stat, context_ptr, LibGSSAPI::GSS_C_NO_BUFFER)
       end
 
       def self.gss_c_no_context
@@ -335,6 +329,8 @@ module GSSAPI
     # OM_uint32 krb5_gss_register_acceptor_identity(const char *);
     attach_function :krb5_gss_register_acceptor_identity, [:string], :OM_uint32
 
+    # OM_uint32 gss_display_status(OM_uint32 *minor_status, OM_uint32 status_value, int status_type, gss_OID mech_type, OM_uint32 *message_context, gss_buffer_t status_string)
+    attach_function :gss_display_status, [:pointer, :OM_uint32, :int, :pointer, :pointer, :pointer], :OM_uint32
 
     # Variable definitions
     # --------------------
@@ -377,7 +373,9 @@ module GSSAPI
 
 
     # GSSAPI Status & Error Codes
-    GSS_S_COMPLETE = 0
+    GSS_S_COMPLETE  = 0
+    GSS_C_GSS_CODE  = 1
+    GSS_C_MECH_CODE = 2
 
     GSS_C_CALLING_ERRORS = {
       (1 << GSS_C_CALLING_ERROR_OFFSET) => "GSS_S_CALL_INACCESSIBLE_READ",
@@ -386,11 +384,11 @@ module GSSAPI
     }
 
     GSS_C_SUPPLEMENTARY_CODES = {
-			(1 << (GSS_C_SUPPLEMENTARY_OFFSET + 0)) => "GSS_S_CONTINUE_NEEDED",
-			(1 << (GSS_C_SUPPLEMENTARY_OFFSET + 1)) => "GSS_S_DUPLICATE_TOKEN",
-			(1 << (GSS_C_SUPPLEMENTARY_OFFSET + 2)) => "GSS_S_OLD_TOKEN",
-			(1 << (GSS_C_SUPPLEMENTARY_OFFSET + 3)) => "GSS_S_UNSEQ_TOKEN",
-			(1 << (GSS_C_SUPPLEMENTARY_OFFSET + 4)) => "GSS_S_GAP_TOKEN"
+      (1 << (GSS_C_SUPPLEMENTARY_OFFSET + 0)) => "GSS_S_CONTINUE_NEEDED",
+      (1 << (GSS_C_SUPPLEMENTARY_OFFSET + 1)) => "GSS_S_DUPLICATE_TOKEN",
+      (1 << (GSS_C_SUPPLEMENTARY_OFFSET + 2)) => "GSS_S_OLD_TOKEN",
+      (1 << (GSS_C_SUPPLEMENTARY_OFFSET + 3)) => "GSS_S_UNSEQ_TOKEN",
+      (1 << (GSS_C_SUPPLEMENTARY_OFFSET + 4)) => "GSS_S_GAP_TOKEN"
     }
 
     GSS_C_ROUTINE_ERRORS = {
@@ -417,10 +415,10 @@ module GSSAPI
 
     # IOV Buffer Types (gssapi_ext.h)
     GSS_IOV_BUFFER_TYPE_EMPTY       = 0
-    GSS_IOV_BUFFER_TYPE_DATA        = 1	 # Packet data
-    GSS_IOV_BUFFER_TYPE_HEADER      = 2  # Mechanism header
-    GSS_IOV_BUFFER_TYPE_MECH_PARAMS = 3	 # Mechanism specific parameters
-    GSS_IOV_BUFFER_TYPE_TRAILER     = 7	 # Mechanism trailer
+    GSS_IOV_BUFFER_TYPE_DATA        = 1 # Packet data
+    GSS_IOV_BUFFER_TYPE_HEADER      = 2 # Mechanism header
+    GSS_IOV_BUFFER_TYPE_MECH_PARAMS = 3 # Mechanism specific parameters
+    GSS_IOV_BUFFER_TYPE_TRAILER     = 7 # Mechanism trailer
     GSS_IOV_BUFFER_TYPE_PADDING     = 9  # Padding
     GSS_IOV_BUFFER_TYPE_STREAM      = 10 # Complete wrap token
     GSS_IOV_BUFFER_TYPE_SIGN_ONLY   = 11 # Sign only packet data
@@ -432,13 +430,13 @@ module GSSAPI
 
 
     # Various Null values. (gssapi.h)
-		GSS_C_NO_NAME           = FFI::Pointer.new(:pointer, 0) # ((gss_name_t) 0)
-		GSS_C_NO_BUFFER         = FFI::Pointer.new(:pointer, 0) # ((gss_buffer_t) 0)
-		GSS_C_NO_OID            = FFI::Pointer.new(:pointer, 0) # ((gss_OID) 0)
-		GSS_C_NO_OID_SET        = FFI::Pointer.new(:pointer, 0) # ((gss_OID_set) 0)
-		GSS_C_NO_CONTEXT        = FFI::Pointer.new(:pointer, 0) # ((gss_ctx_id_t) 0)
-		GSS_C_NO_CREDENTIAL     = FFI::Pointer.new(:pointer, 0) # ((gss_cred_id_t) 0)
-		GSS_C_NO_CHANNEL_BINDINGS = FFI::Pointer.new(:pointer, 0) # ((gss_channel_bindings_t) 0)
+    GSS_C_NO_NAME           = FFI::Pointer.new(:pointer, 0) # ((gss_name_t) 0)
+    GSS_C_NO_BUFFER         = FFI::Pointer.new(:pointer, 0) # ((gss_buffer_t) 0)
+    GSS_C_NO_OID            = FFI::Pointer.new(:pointer, 0) # ((gss_OID) 0)
+    GSS_C_NO_OID_SET        = FFI::Pointer.new(:pointer, 0) # ((gss_OID_set) 0)
+    GSS_C_NO_CONTEXT        = FFI::Pointer.new(:pointer, 0) # ((gss_ctx_id_t) 0)
+    GSS_C_NO_CREDENTIAL     = FFI::Pointer.new(:pointer, 0) # ((gss_cred_id_t) 0)
+    GSS_C_NO_CHANNEL_BINDINGS = FFI::Pointer.new(:pointer, 0) # ((gss_channel_bindings_t) 0)
     GSS_C_EMPTY_BUFFER      = ManagedGssBufferDesc.new
 
   end #end LibGSSAPI

data/lib/gssapi/simple.rb

@@ -13,9 +13,12 @@ module GSSAPI
 
     # Initialize a new GSSAPI::Simple object
     # @param [String] host_name the fully qualified host name
-    # @param [String] service_name the service name. This can either be in the form svc@example.org 
-    #   or just svc.  If there is no '@example.org' part the host_name will be appended. If no
-    #   service_name is given at all the default service of 'host' will be used.
+    # @param [String] service_name The service name. This can either be a
+    #   GSS_KRB5_NT_PRINCIPAL_NAME in the form of srvc/fqdn@REALM
+    #   or
+    #   GSS_C_NT_HOSTBASED_SERVICE in the form of srvc@fqdn
+    #   If there is no '@fqdn' part, the host_name will be appended.
+    #   If no service_name is given at all the default service of 'host@fqdn' will be used.
     def initialize(host_name, service_name=nil, keytab=nil)
       @host = host_name
       @service = service_name.nil? ? "host@#{@host}" : (service_name.include?('@') ? service_name : "#{service_name}@#{@host}")
@@ -31,13 +34,17 @@ module GSSAPI
     def import_name(str)
       buff_str = LibGSSAPI::UnManagedGssBufferDesc.new
       buff_str.value = str
-      mech = LibGSSAPI::GssOID.gss_c_no_oid
-      #mech = LibGSSAPI.GSS_C_NT_HOSTBASED_SERVICE
+      # Choose the appropriate mechanism based on the string passed.
+      if (str =~ /[A-Za-z0-9]+\/[^@]+@.+$/)
+        mech = LibGSSAPI::GssOID.gss_c_no_oid
+      else
+        mech = LibGSSAPI.GSS_C_NT_HOSTBASED_SERVICE
+      end
       name = FFI::MemoryPointer.new :pointer # gss_name_t
-      min_stat = FFI::MemoryPointer.new :uint32
+      min_stat = FFI::MemoryPointer.new :OM_uint32
 
       maj_stat = LibGSSAPI.gss_import_name(min_stat, buff_str.pointer, mech, name)
-      raise GssApiError, "gss_import_name did not return GSS_S_COMPLETE.  Error code: maj: #{maj_stat}, min: #{min_stat.read_int}" if maj_stat != 0
+      raise GssApiError.new(maj_stat, min_stat), "gss_import_name did not return GSS_S_COMPLETE" if maj_stat != 0
 
       LibGSSAPI::GssNameT.new(name.get_pointer(0))
     end
@@ -53,7 +60,7 @@ module GSSAPI
     # @return [String, true] if a continuation flag is set it will return the output token that is needed to send
     #   to the remote host.  Otherwise it returns true and the GSS security context has been established.
     def init_context(in_token = nil, opts = {})
-      min_stat = FFI::MemoryPointer.new :uint32
+      min_stat = FFI::MemoryPointer.new :OM_uint32
       ctx = (@context.nil? ? LibGSSAPI::GssCtxIdT.gss_c_no_context.address_of : @context.address_of)
       mech = LibGSSAPI::GssOID.gss_c_no_oid
       if(opts[:flags])
@@ -66,7 +73,7 @@ module GSSAPI
       in_tok = LibGSSAPI::UnManagedGssBufferDesc.new
       in_tok.value = in_token
       out_tok = LibGSSAPI::ManagedGssBufferDesc.new
-      ret_flags = FFI::MemoryPointer.new :uint32
+      ret_flags = FFI::MemoryPointer.new :OM_uint32
 
 
       maj_stat = LibGSSAPI.gss_init_sec_context(min_stat,
@@ -83,7 +90,7 @@ module GSSAPI
                                                 ret_flags,
                                                 nil)
 
-      raise GssApiError, "gss_init_sec_context did not return GSS_S_COMPLETE.  Error code: maj: #{maj_stat}, min: #{min_stat.read_int}" if maj_stat > 1
+      raise GssApiError.new(maj_stat, min_stat), "gss_init_sec_context did not return GSS_S_COMPLETE" if maj_stat > 1
       
       @context = LibGSSAPI::GssCtxIdT.new(ctx.get_pointer(0))
       maj_stat == 1 ? out_tok.value : true
@@ -97,7 +104,7 @@ module GSSAPI
     def accept_context(in_token)
       raise GssApiError, "No credentials yet acquired. Call #{self.class.name}#acquire_credentials first" if @scred.nil?
 
-      min_stat = FFI::MemoryPointer.new :uint32
+      min_stat = FFI::MemoryPointer.new :OM_uint32
       ctx = (@context.nil? ? LibGSSAPI::GssCtxIdT.gss_c_no_context.address_of : @context.address_of)
       no_chn_bind = LibGSSAPI::GSS_C_NO_CHANNEL_BINDINGS
       client = FFI::MemoryPointer.new :pointer  # Will hold the initiating client name after the call
@@ -105,7 +112,7 @@ module GSSAPI
       in_tok = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new
       in_tok.value = in_token
       out_tok = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new
-      ret_flags = FFI::MemoryPointer.new :uint32
+      ret_flags = FFI::MemoryPointer.new :OM_uint32
 
       maj_stat = LibGSSAPI.gss_accept_sec_context(min_stat,
                                                   ctx,
@@ -118,7 +125,7 @@ module GSSAPI
                                                   ret_flags,
                                                   nil, nil)
 
-      raise GssApiError, "gss_accept_sec_context did not return GSS_S_COMPLETE.  Error code: maj: #{maj_stat}, min: #{min_stat.read_int}" if maj_stat > 1
+      raise GssApiError.new(maj_stat, min_stat), "gss_accept_sec_context did not return GSS_S_COMPLETE" if maj_stat > 1
 
       @context = LibGSSAPI::GssCtxIdT.new(ctx.get_pointer(0))
       out_tok.length > 0 ? out_tok.value : true
@@ -132,7 +139,7 @@ module GSSAPI
     # @return [true] It will return true if everything succeeds and the @scred variable will be set for future methods. If
     #   an error ocurrs an exception will be raised.
     def acquire_credentials(princ = @int_svc_name, opts = {:usage => :accept})
-      min_stat = FFI::MemoryPointer.new :uint32
+      min_stat = FFI::MemoryPointer.new :OM_uint32
       scred = FFI::MemoryPointer.new :pointer
 
       case opts[:usage]
@@ -147,7 +154,7 @@ module GSSAPI
       end
 
       maj_stat = LibGSSAPI.gss_acquire_cred(min_stat, princ, 0, LibGSSAPI::GSS_C_NO_OID_SET, usage, scred, nil, nil)
-      raise GssApiError, "gss_acquire_cred did not return GSS_S_COMPLETE.  Error code: maj: #{maj_stat}, min: #{min_stat.read_int}" if maj_stat != 0
+      raise GssApiError.new(maj_stat, min_stat), "gss_acquire_cred did not return GSS_S_COMPLETE" if maj_stat != 0
 
       @scred = LibGSSAPI::GssCredIdT.new(scred.get_pointer(0))
       true
@@ -158,15 +165,15 @@ module GSSAPI
     # @param [Boolean] encrypt Whether or not to encrypt the message or just sign it.  The default is to encrypt.
     # @return [String] The wrapped message. It will raise an exception on error
     def wrap_message(msg, encrypt = true)
-      min_stat = FFI::MemoryPointer.new :uint32
+      min_stat = FFI::MemoryPointer.new :OM_uint32
       conf_req = (encrypt ? 1 : 0)
       qop_req = GSSAPI::LibGSSAPI::GSS_C_QOP_DEFAULT
       in_buff = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new
       in_buff.value = msg
-      conf_state = FFI::MemoryPointer.new :uint32
+      conf_state = FFI::MemoryPointer.new :OM_uint32
       out_buff = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new
       maj_stat = GSSAPI::LibGSSAPI.gss_wrap(min_stat, @context, conf_req, qop_req, in_buff.pointer, conf_state, out_buff.pointer)
-      raise GssApiError, "Failed to gss_wrap message. Error code: maj: #{maj_stat}, min: #{min_stat.read_int}" if maj_stat != 0
+      raise GssApiError.new(maj_stat, min_stat), "Failed to gss_wrap message" if maj_stat != 0
       out_buff.value
     end
 
@@ -174,16 +181,16 @@ module GSSAPI
     # @param [String] msg The message to unwrap
     # @param [Boolean] encrypted Whether or not this message was encrypted (true) or just signed (false)
     def unwrap_message(msg, encrypted = true)
-      min_stat = FFI::MemoryPointer.new :uint32
+      min_stat = FFI::MemoryPointer.new :OM_uint32
       in_buff = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new
       in_buff.value = msg
       out_buff = GSSAPI::LibGSSAPI::ManagedGssBufferDesc.new
       conf_state = FFI::MemoryPointer.new :int
       conf_state.write_int((encrypted ? 1 : 0))
-      q_op = FFI::MemoryPointer.new :uint32
+      q_op = FFI::MemoryPointer.new :OM_uint32
       q_op.write_int(0)
       maj_stat = GSSAPI::LibGSSAPI.gss_unwrap(min_stat, @context, in_buff.pointer, out_buff.pointer, conf_state, q_op)
-      raise GssApiError, "Failed to gss_unwrap message. Error code: maj: #{maj_stat}, min: #{min_stat.read_int}" if maj_stat != 0
+      raise GssApiError.new(maj_stat, min_stat), "Failed to gss_unwrap message" if maj_stat != 0
       out_buff.value
     end
 
@@ -191,7 +198,7 @@ module GSSAPI
     # @param [String] keytab the path to the keytab
     def set_keytab(keytab)
       maj_stat = LibGSSAPI.krb5_gss_register_acceptor_identity(keytab)
-      raise GssApiError, "krb5_gss_register_acceptor_identity did not return GSS_S_COMPLETE.  Error code: maj: #{maj_stat}, min: #{min_stat.read_int}" if maj_stat != 0
+      raise GssApiError.new(maj_stat, min_stat), "krb5_gss_register_acceptor_identity did not return GSS_S_COMPLETE" if maj_stat != 0
       true
     end
 

data/test/spec/gssapi_simple_spec.rb

@@ -0,0 +1,24 @@
+$: << File.dirname(__FILE__) + '/../../lib/'
+require 'gssapi'
+require 'base64'
+require 'yaml'
+
+
+describe GSSAPI::Simple, 'Test the Simple GSSAPI interface' do
+
+  before :all do
+    @conf = YAML.load_file "#{File.dirname(__FILE__)}/conf_file.yaml"
+  end
+
+  it 'should get the initial context for a client' do
+    gsscli = GSSAPI::Simple.new(@conf[:c_host], @conf[:c_service])
+    token = gsscli.init_context
+    token.should_not be_empty
+  end
+
+  it 'should acquire credentials for a server service' do
+    gsscli = GSSAPI::Simple.new(@conf[:s_host], @conf[:s_service], @conf[:keytab])
+    gsscli.acquire_credentials.should be_true
+  end
+
+end

data/test/spec/test_buffer_spec.rb

@@ -0,0 +1,15 @@
+$: << File.dirname(__FILE__) + '/../../lib/'
+require 'gssapi'
+
+describe GSSAPI::LibGSSAPI::UnManagedGssBufferDesc, 'Unmanaged Buffer Test' do
+  it 'should create a new UnManagedGssBufferDesc and assign to it and test GC' do
+    0.upto 100 do |i|
+      b = GSSAPI::LibGSSAPI::UnManagedGssBufferDesc.new
+      GC.start
+      b.value = 'asdf'
+    end
+
+    # If we get here without any errors we should be golden
+    true.should be_true
+  end
+end

metadata

@@ -2,7 +2,7 @@
 name: gssapi
 version: !ruby/object:Gem::Version 
   prerelease: 
-  version: 1.0.1
+  version: 1.0.2
 platform: ruby
 authors: 
 - Dan Wanek
@@ -10,8 +10,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-08-22 00:00:00 -05:00
-default_executable: 
+date: 2011-09-10 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: ffi
@@ -48,7 +47,8 @@ files:
 - lib/gssapi/lib_gssapi_loader.rb
 - lib/gssapi/simple.rb
 - preamble
-has_rdoc: true
+- test/spec/gssapi_simple_spec.rb
+- test/spec/test_buffer_spec.rb
 homepage: http://github.com/zenchild/gssapi
 licenses: []
 
@@ -75,7 +75,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.6.2
+rubygems_version: 1.8.10
 signing_key: 
 specification_version: 3
 summary: A FFI wrapper around the system GSSAPI library.