Adding upstream version 2:4.17.12+dfsg.upstream/2%4.17.12+dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1147 insertions, 0 deletions

diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c
new file mode 100644
index 0000000..bd5b725
--- /dev/null
+++ b/auth/gensec/gensec_start.c
@@ -0,0 +1,1147 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Generic Authentication Interface
+
+   Copyright (C) Andrew Tridgell 2003
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "system/network.h"
+#include "tevent.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "librpc/gen_ndr/dcerpc.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h"
+#include "lib/param/param.h"
+#include "lib/param/loadparm.h"
+#include "lib/util/tsort.h"
+#include "lib/util/samba_modules.h"
+#include "lib/util/base64.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_AUTH
+
+#undef strcasecmp
+
+/* the list of currently registered GENSEC backends */
+static const struct gensec_security_ops **generic_security_ops;
+static int gensec_num_backends;
+
+bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct gensec_security *security)
+{
+	bool ok = lpcfg_parm_bool(security->settings->lp_ctx,
+				  NULL,
+				  "gensec",
+				  ops->name,
+				  ops->enabled);
+
+	if (ops->weak_crypto &&
+	    lpcfg_weak_crypto(security->settings->lp_ctx) != SAMBA_WEAK_CRYPTO_ALLOWED) {
+		ok = false;
+	}
+
+	return ok;
+}
+
+/* Sometimes we want to force only kerberos, sometimes we want to
+ * force it's avoidance.  The old list could be either
+ * gensec_security_all(), or from cli_credentials_gensec_list() (ie,
+ * an existing list we have trimmed down)
+ *
+ * The intended logic is:
+ *
+ * if we are in the default AUTO have kerberos:
+ * - take a reference to the master list
+ * otherwise
+ * - always add spnego then:
+ * - if we 'MUST' have kerberos:
+ *   only add kerberos mechs
+ * - if we 'DONT' want kerberos':
+ *   only add non-kerberos mechs
+ *
+ * Once we get things like NegoEx or moonshot, this will of course get
+ * more compplex.
+ */
+
+static const struct gensec_security_ops **gensec_use_kerberos_mechs(
+		TALLOC_CTX *mem_ctx,
+		const struct gensec_security_ops * const *old_gensec_list,
+		enum credentials_use_kerberos use_kerberos,
+		bool keep_schannel)
+{
+	const struct gensec_security_ops **new_gensec_list;
+	int i, j, num_mechs_in;
+
+	for (num_mechs_in=0; old_gensec_list && old_gensec_list[num_mechs_in]; num_mechs_in++) {
+		/* noop */
+	}
+
+	new_gensec_list = talloc_array(mem_ctx,
+				       const struct gensec_security_ops *,
+				       num_mechs_in + 1);
+	if (!new_gensec_list) {
+		return NULL;
+	}
+
+	j = 0;
+	for (i=0; old_gensec_list && old_gensec_list[i]; i++) {
+		bool keep = false;
+
+		/*
+		 * We want to keep SPNGEO and other backends
+		 */
+		keep = old_gensec_list[i]->glue;
+
+		if (old_gensec_list[i]->auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
+			keep = keep_schannel;
+		}
+
+		switch (use_kerberos) {
+		case CRED_USE_KERBEROS_DESIRED:
+			keep = true;
+			break;
+
+		case CRED_USE_KERBEROS_DISABLED:
+			if (old_gensec_list[i]->kerberos == false) {
+				keep = true;
+			}
+
+			break;
+
+		case CRED_USE_KERBEROS_REQUIRED:
+			if (old_gensec_list[i]->kerberos == true) {
+				keep = true;
+			}
+
+			break;
+		default:
+			/* Can't happen or invalid parameter */
+			return NULL;
+		}
+
+		if (!keep) {
+			continue;
+		}
+
+		new_gensec_list[j] = old_gensec_list[i];
+		j++;
+	}
+	new_gensec_list[j] = NULL;
+
+	return new_gensec_list;
+}
+
+_PUBLIC_ const struct gensec_security_ops **gensec_security_mechs(
+				struct gensec_security *gensec_security,
+				TALLOC_CTX *mem_ctx)
+{
+	const struct gensec_security_ops * const *backends =
+		generic_security_ops;
+	enum credentials_use_kerberos use_kerberos = CRED_USE_KERBEROS_DESIRED;
+	bool keep_schannel = false;
+
+	if (gensec_security != NULL) {
+		struct cli_credentials *creds = NULL;
+
+		creds = gensec_get_credentials(gensec_security);
+		if (creds != NULL) {
+			use_kerberos = cli_credentials_get_kerberos_state(creds);
+			if (cli_credentials_get_netlogon_creds(creds) != NULL) {
+				keep_schannel = true;
+			}
+
+			/*
+			 * Even if Kerberos is set to REQUIRED, keep the
+			 * schannel auth mechanism that machine accounts are
+			 * able to authenticate via netlogon.
+			 */
+			if (gensec_security->gensec_role == GENSEC_SERVER) {
+				keep_schannel = true;
+			}
+		}
+
+		if (gensec_security->settings->backends) {
+			backends = gensec_security->settings->backends;
+		}
+	}
+
+	return gensec_use_kerberos_mechs(mem_ctx, backends,
+					 use_kerberos, keep_schannel);
+
+}
+
+_PUBLIC_ const struct gensec_security_ops *gensec_security_by_oid(
+				struct gensec_security *gensec_security,
+				const char *oid_string)
+{
+	int i, j;
+	const struct gensec_security_ops **backends;
+	const struct gensec_security_ops *backend;
+	TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
+	if (!mem_ctx) {
+		return NULL;
+	}
+	backends = gensec_security_mechs(gensec_security, mem_ctx);
+	for (i=0; backends && backends[i]; i++) {
+		if (gensec_security != NULL &&
+				!gensec_security_ops_enabled(backends[i],
+											 gensec_security))
+		    continue;
+		if (backends[i]->oid) {
+			for (j=0; backends[i]->oid[j]; j++) {
+				if (backends[i]->oid[j] &&
+				    (strcmp(backends[i]->oid[j], oid_string) == 0)) {
+					backend = backends[i];
+					talloc_free(mem_ctx);
+					return backend;
+				}
+			}
+		}
+	}
+	talloc_free(mem_ctx);
+
+	return NULL;
+}
+
+_PUBLIC_ const struct gensec_security_ops *gensec_security_by_sasl_name(
+				struct gensec_security *gensec_security,
+				const char *sasl_name)
+{
+	int i;
+	const struct gensec_security_ops **backends;
+	const struct gensec_security_ops *backend;
+	TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
+	if (!mem_ctx) {
+		return NULL;
+	}
+	backends = gensec_security_mechs(gensec_security, mem_ctx);
+	for (i=0; backends && backends[i]; i++) {
+		if (gensec_security != NULL &&
+		    !gensec_security_ops_enabled(backends[i], gensec_security)) {
+			continue;
+		}
+		if (backends[i]->sasl_name
+		    && (strcmp(backends[i]->sasl_name, sasl_name) == 0)) {
+			backend = backends[i];
+			talloc_free(mem_ctx);
+			return backend;
+		}
+	}
+	talloc_free(mem_ctx);
+
+	return NULL;
+}
+
+_PUBLIC_ const struct gensec_security_ops *gensec_security_by_auth_type(
+				struct gensec_security *gensec_security,
+				uint32_t auth_type)
+{
+	int i;
+	const struct gensec_security_ops **backends;
+	const struct gensec_security_ops *backend;
+	TALLOC_CTX *mem_ctx;
+
+	if (auth_type == DCERPC_AUTH_TYPE_NONE) {
+		return NULL;
+	}
+
+	mem_ctx = talloc_new(gensec_security);
+	if (!mem_ctx) {
+		return NULL;
+	}
+	backends = gensec_security_mechs(gensec_security, mem_ctx);
+	for (i=0; backends && backends[i]; i++) {
+		if (gensec_security != NULL &&
+		    !gensec_security_ops_enabled(backends[i], gensec_security)) {
+			continue;
+		}
+		if (backends[i]->auth_type == auth_type) {
+			backend = backends[i];
+			talloc_free(mem_ctx);
+			return backend;
+		}
+	}
+	talloc_free(mem_ctx);
+
+	return NULL;
+}
+
+const struct gensec_security_ops *gensec_security_by_name(struct gensec_security *gensec_security,
+							  const char *name)
+{
+	int i;
+	const struct gensec_security_ops **backends;
+	const struct gensec_security_ops *backend;
+	TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
+	if (!mem_ctx) {
+		return NULL;
+	}
+	backends = gensec_security_mechs(gensec_security, mem_ctx);
+	for (i=0; backends && backends[i]; i++) {
+		if (gensec_security != NULL &&
+				!gensec_security_ops_enabled(backends[i], gensec_security))
+		    continue;
+		if (backends[i]->name
+		    && (strcmp(backends[i]->name, name) == 0)) {
+			backend = backends[i];
+			talloc_free(mem_ctx);
+			return backend;
+		}
+	}
+	talloc_free(mem_ctx);
+	return NULL;
+}
+
+static const char **gensec_security_sasl_names_from_ops(
+	struct gensec_security *gensec_security,
+	TALLOC_CTX *mem_ctx,
+	const struct gensec_security_ops * const *ops)
+{
+	const char **sasl_names = NULL;
+	size_t i, sasl_names_count = 0;
+
+	if (ops == NULL) {
+		return NULL;
+	}
+
+	sasl_names = talloc_array(mem_ctx, const char *, 1);
+	if (sasl_names == NULL) {
+		return NULL;
+	}
+
+	for (i = 0; ops[i] != NULL; i++) {
+		enum gensec_role role = GENSEC_SERVER;
+		const char **tmp = NULL;
+
+		if (ops[i]->sasl_name == NULL) {
+			continue;
+		}
+
+		if (gensec_security != NULL) {
+			if (!gensec_security_ops_enabled(ops[i],
+							 gensec_security)) {
+				continue;
+			}
+
+			role = gensec_security->gensec_role;
+		}
+
+		switch (role) {
+		case GENSEC_CLIENT:
+			if (ops[i]->client_start == NULL) {
+				continue;
+			}
+			break;
+		case GENSEC_SERVER:
+			if (ops[i]->server_start == NULL) {
+				continue;
+			}
+			break;
+		}
+
+		tmp = talloc_realloc(mem_ctx,
+				     sasl_names,
+				     const char *,
+				     sasl_names_count + 2);
+		if (tmp == NULL) {
+			TALLOC_FREE(sasl_names);
+			return NULL;
+		}
+		sasl_names = tmp;
+
+		sasl_names[sasl_names_count] = ops[i]->sasl_name;
+		sasl_names_count++;
+	}
+	sasl_names[sasl_names_count] = NULL;
+
+	return sasl_names;
+}
+
+/**
+ * @brief Get the sasl names from the gensec security context.
+ *
+ * @param[in]  gensec_security The gensec security context.
+ *
+ * @param[in]  mem_ctx The memory context to allocate memory on.
+ *
+ * @return An allocated array with sasl names, NULL on error.
+ */
+_PUBLIC_
+const char **gensec_security_sasl_names(struct gensec_security *gensec_security,
+					TALLOC_CTX *mem_ctx)
+{
+	const struct gensec_security_ops **ops = NULL;
+
+	ops = gensec_security_mechs(gensec_security, mem_ctx);
+
+	return gensec_security_sasl_names_from_ops(gensec_security,
+						   mem_ctx,
+						   ops);
+}
+
+/**
+ * Return a unique list of security subsystems from those specified in
+ * the list of SASL names.
+ *
+ * Use the list of enabled GENSEC mechanisms from the credentials
+ * attached to the gensec_security, and return in our preferred order.
+ */
+
+static const struct gensec_security_ops **gensec_security_by_sasl_list(
+	struct gensec_security *gensec_security,
+	TALLOC_CTX *mem_ctx,
+	const char **sasl_names)
+{
+	const struct gensec_security_ops **backends_out;
+	const struct gensec_security_ops **backends;
+	int i, k, sasl_idx;
+	int num_backends_out = 0;
+
+	if (!sasl_names) {
+		return NULL;
+	}
+
+	backends = gensec_security_mechs(gensec_security, mem_ctx);
+
+	backends_out = talloc_array(mem_ctx, const struct gensec_security_ops *, 1);
+	if (!backends_out) {
+		return NULL;
+	}
+	backends_out[0] = NULL;
+
+	/* Find backends in our preferred order, by walking our list,
+	 * then looking in the supplied list */
+	for (i=0; backends && backends[i]; i++) {
+		if (gensec_security != NULL &&
+				!gensec_security_ops_enabled(backends[i], gensec_security))
+		    continue;
+		for (sasl_idx = 0; sasl_names[sasl_idx]; sasl_idx++) {
+			if (!backends[i]->sasl_name ||
+			    !(strcmp(backends[i]->sasl_name,
+				     sasl_names[sasl_idx]) == 0)) {
+				continue;
+			}
+
+			for (k=0; backends_out[k]; k++) {
+				if (backends_out[k] == backends[i]) {
+					break;
+				}
+			}
+
+			if (k < num_backends_out) {
+				/* already in there */
+				continue;
+			}
+
+			backends_out = talloc_realloc(mem_ctx, backends_out,
+						      const struct gensec_security_ops *,
+						      num_backends_out + 2);
+			if (!backends_out) {
+				return NULL;
+			}
+
+			backends_out[num_backends_out] = backends[i];
+			num_backends_out++;
+			backends_out[num_backends_out] = NULL;
+		}
+	}
+	return backends_out;
+}
+
+/**
+ * Return a unique list of security subsystems from those specified in
+ * the OID list.  That is, where two OIDs refer to the same module,
+ * return that module only once.
+ *
+ * Use the list of enabled GENSEC mechanisms from the credentials
+ * attached to the gensec_security, and return in our preferred order.
+ */
+
+_PUBLIC_ const struct gensec_security_ops_wrapper *gensec_security_by_oid_list(
+					struct gensec_security *gensec_security,
+					TALLOC_CTX *mem_ctx,
+					const char * const *oid_strings,
+					const char *skip)
+{
+	struct gensec_security_ops_wrapper *backends_out;
+	const struct gensec_security_ops **backends;
+	int i, j, k, oid_idx;
+	int num_backends_out = 0;
+
+	if (!oid_strings) {
+		return NULL;
+	}
+
+	backends = gensec_security_mechs(gensec_security, gensec_security);
+
+	backends_out = talloc_array(mem_ctx, struct gensec_security_ops_wrapper, 1);
+	if (!backends_out) {
+		return NULL;
+	}
+	backends_out[0].op = NULL;
+	backends_out[0].oid = NULL;
+
+	/* Find backends in our preferred order, by walking our list,
+	 * then looking in the supplied list */
+	for (i=0; backends && backends[i]; i++) {
+		if (gensec_security != NULL &&
+				!gensec_security_ops_enabled(backends[i], gensec_security))
+		    continue;
+		if (!backends[i]->oid) {
+			continue;
+		}
+		for (oid_idx = 0; oid_strings[oid_idx]; oid_idx++) {
+			if (strcmp(oid_strings[oid_idx], skip) == 0) {
+				continue;
+			}
+
+			for (j=0; backends[i]->oid[j]; j++) {
+				if (!backends[i]->oid[j] ||
+				    !(strcmp(backends[i]->oid[j],
+					    oid_strings[oid_idx]) == 0)) {
+					continue;
+				}
+
+				for (k=0; backends_out[k].op; k++) {
+					if (backends_out[k].op == backends[i]) {
+						break;
+					}
+				}
+
+				if (k < num_backends_out) {
+					/* already in there */
+					continue;
+				}
+
+				backends_out = talloc_realloc(mem_ctx, backends_out,
+							      struct gensec_security_ops_wrapper,
+							      num_backends_out + 2);
+				if (!backends_out) {
+					return NULL;
+				}
+
+				backends_out[num_backends_out].op = backends[i];
+				backends_out[num_backends_out].oid = backends[i]->oid[j];
+				num_backends_out++;
+				backends_out[num_backends_out].op = NULL;
+				backends_out[num_backends_out].oid = NULL;
+			}
+		}
+	}
+	return backends_out;
+}
+
+/**
+ * Return OIDS from the security subsystems listed
+ */
+
+static const char **gensec_security_oids_from_ops(
+	struct gensec_security *gensec_security,
+	TALLOC_CTX *mem_ctx,
+	const struct gensec_security_ops * const *ops,
+	const char *skip)
+{
+	int i;
+	int j = 0;
+	int k;
+	const char **oid_list;
+	if (!ops) {
+		return NULL;
+	}
+	oid_list = talloc_array(mem_ctx, const char *, 1);
+	if (!oid_list) {
+		return NULL;
+	}
+
+	for (i=0; ops && ops[i]; i++) {
+		if (gensec_security != NULL &&
+			!gensec_security_ops_enabled(ops[i], gensec_security)) {
+			continue;
+		}
+		if (!ops[i]->oid) {
+			continue;
+		}
+
+		for (k = 0; ops[i]->oid[k]; k++) {
+			if (skip && strcmp(skip, ops[i]->oid[k])==0) {
+			} else {
+				oid_list = talloc_realloc(mem_ctx, oid_list, const char *, j + 2);
+				if (!oid_list) {
+					return NULL;
+				}
+				oid_list[j] = ops[i]->oid[k];
+				j++;
+			}
+		}
+	}
+	oid_list[j] = NULL;
+	return oid_list;
+}
+
+
+/**
+ * Return OIDS from the security subsystems listed
+ */
+
+_PUBLIC_ const char **gensec_security_oids_from_ops_wrapped(TALLOC_CTX *mem_ctx,
+				const struct gensec_security_ops_wrapper *wops)
+{
+	int i;
+	int j = 0;
+	int k;
+	const char **oid_list;
+	if (!wops) {
+		return NULL;
+	}
+	oid_list = talloc_array(mem_ctx, const char *, 1);
+	if (!oid_list) {
+		return NULL;
+	}
+
+	for (i=0; wops[i].op; i++) {
+		if (!wops[i].op->oid) {
+			continue;
+		}
+
+		for (k = 0; wops[i].op->oid[k]; k++) {
+			oid_list = talloc_realloc(mem_ctx, oid_list, const char *, j + 2);
+			if (!oid_list) {
+				return NULL;
+			}
+			oid_list[j] = wops[i].op->oid[k];
+			j++;
+		}
+	}
+	oid_list[j] = NULL;
+	return oid_list;
+}
+
+
+/**
+ * Return all the security subsystems currently enabled on a GENSEC context.
+ *
+ * This is taken from a list attached to the cli_credentials, and
+ * skips the OID in 'skip'.  (Typically the SPNEGO OID)
+ *
+ */
+
+_PUBLIC_ const char **gensec_security_oids(struct gensec_security *gensec_security,
+					   TALLOC_CTX *mem_ctx,
+					   const char *skip)
+{
+	const struct gensec_security_ops **ops;
+
+	ops = gensec_security_mechs(gensec_security, mem_ctx);
+
+	return gensec_security_oids_from_ops(gensec_security, mem_ctx, ops, skip);
+}
+
+static int gensec_security_destructor(struct gensec_security *gctx)
+{
+	if (gctx->parent_security != NULL) {
+		if (gctx->parent_security->child_security == gctx) {
+			gctx->parent_security->child_security = NULL;
+		}
+		gctx->parent_security = NULL;
+	}
+
+	if (gctx->child_security != NULL) {
+		if (gctx->child_security->parent_security == gctx) {
+			gctx->child_security->parent_security = NULL;
+		}
+		gctx->child_security = NULL;
+	}
+
+	return 0;
+}
+
+/**
+  Start the GENSEC system, returning a context pointer.
+  @param mem_ctx The parent TALLOC memory context.
+  @param gensec_security Returned GENSEC context pointer.
+  @note  The mem_ctx is only a parent and may be NULL.
+  @note, the auth context is moved to be a referenced pointer of the
+  @ gensec_security return
+*/
+static NTSTATUS gensec_start(TALLOC_CTX *mem_ctx,
+			     struct gensec_settings *settings,
+			     struct auth4_context *auth_context,
+			     struct gensec_security **gensec_security)
+{
+	(*gensec_security) = talloc_zero(mem_ctx, struct gensec_security);
+	NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
+
+	(*gensec_security)->max_update_size = 0;
+
+	SMB_ASSERT(settings->lp_ctx != NULL);
+	(*gensec_security)->settings = talloc_reference(*gensec_security, settings);
+
+	/* We need to reference this, not steal, as the caller may be
+	 * python, which won't like it if we steal it's object away
+	 * from it */
+	(*gensec_security)->auth_context = talloc_reference(*gensec_security, auth_context);
+
+	talloc_set_destructor((*gensec_security), gensec_security_destructor);
+	return NT_STATUS_OK;
+}
+
+/**
+ * Start a GENSEC subcontext, with a copy of the properties of the parent
+ * @param mem_ctx The parent TALLOC memory context.
+ * @param parent The parent GENSEC context
+ * @param gensec_security Returned GENSEC context pointer.
+ * @note Used by SPNEGO in particular, for the actual implementation mechanism
+ */
+
+_PUBLIC_ NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx,
+				 struct gensec_security *parent,
+				 struct gensec_security **gensec_security)
+{
+	if (parent->child_security != NULL) {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	(*gensec_security) = talloc_zero(mem_ctx, struct gensec_security);
+	NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
+
+	(**gensec_security) = *parent;
+	(*gensec_security)->ops = NULL;
+	(*gensec_security)->private_data = NULL;
+	(*gensec_security)->update_busy_ptr = NULL;
+
+	(*gensec_security)->subcontext = true;
+	(*gensec_security)->want_features = parent->want_features;
+	(*gensec_security)->max_update_size = parent->max_update_size;
+	(*gensec_security)->dcerpc_auth_level = parent->dcerpc_auth_level;
+	(*gensec_security)->auth_context = talloc_reference(*gensec_security, parent->auth_context);
+	(*gensec_security)->settings = talloc_reference(*gensec_security, parent->settings);
+	(*gensec_security)->auth_context = talloc_reference(*gensec_security, parent->auth_context);
+
+	talloc_set_destructor((*gensec_security), gensec_security_destructor);
+	return NT_STATUS_OK;
+}
+
+_PUBLIC_ NTSTATUS gensec_child_ready(struct gensec_security *parent,
+				     struct gensec_security *child)
+{
+	if (parent->child_security != NULL) {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	if (child->parent_security != NULL) {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	parent->child_security = child;
+	child->parent_security = parent;
+	return NT_STATUS_OK;
+}
+
+/**
+  Start the GENSEC system, in client mode, returning a context pointer.
+  @param mem_ctx The parent TALLOC memory context.
+  @param gensec_security Returned GENSEC context pointer.
+  @note  The mem_ctx is only a parent and may be NULL.
+*/
+_PUBLIC_ NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx,
+			     struct gensec_security **gensec_security,
+			     struct gensec_settings *settings)
+{
+	NTSTATUS status;
+
+	if (settings == NULL) {
+		DEBUG(0,("gensec_client_start: no settings given!\n"));
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	status = gensec_start(mem_ctx, settings, NULL, gensec_security);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	(*gensec_security)->gensec_role = GENSEC_CLIENT;
+
+	return status;
+}
+
+
+
+/**
+  Start the GENSEC system, in server mode, returning a context pointer.
+  @param mem_ctx The parent TALLOC memory context.
+  @param gensec_security Returned GENSEC context pointer.
+  @note  The mem_ctx is only a parent and may be NULL.
+*/
+_PUBLIC_ NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx,
+				      struct gensec_settings *settings,
+				      struct auth4_context *auth_context,
+				      struct gensec_security **gensec_security)
+{
+	NTSTATUS status;
+
+	if (!settings) {
+		DEBUG(0,("gensec_server_start: no settings given!\n"));
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	status = gensec_start(mem_ctx, settings, auth_context, gensec_security);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	(*gensec_security)->gensec_role = GENSEC_SERVER;
+
+	return status;
+}
+
+static NTSTATUS gensec_start_mech(struct gensec_security *gensec_security)
+{
+	NTSTATUS status;
+
+	/*
+	 * Callers sometimes just reuse a context, we should
+	 * clear the internal state before starting it again.
+	 */
+	talloc_unlink(gensec_security, gensec_security->private_data);
+	gensec_security->private_data = NULL;
+
+	if (gensec_security->child_security != NULL) {
+		/*
+		 * The talloc_unlink(.., gensec_security->private_data)
+		 * should have cleared this via
+		 * gensec_security_destructor().
+		 */
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	if (gensec_security->credentials) {
+		const char *forced_mech = cli_credentials_get_forced_sasl_mech(gensec_security->credentials);
+		if (forced_mech &&
+		    (gensec_security->ops->sasl_name == NULL ||
+		     strcasecmp(forced_mech, gensec_security->ops->sasl_name) != 0)) {
+			DEBUG(5, ("GENSEC mechanism %s (%s) skipped, as it "
+				  "did not match forced mechanism %s\n",
+				  gensec_security->ops->name,
+				  gensec_security->ops->sasl_name,
+				  forced_mech));
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+	}
+	DEBUG(5, ("Starting GENSEC %smechanism %s\n",
+		  gensec_security->subcontext ? "sub" : "",
+		  gensec_security->ops->name));
+	switch (gensec_security->gensec_role) {
+	case GENSEC_CLIENT:
+		if (gensec_security->ops->client_start) {
+			status = gensec_security->ops->client_start(gensec_security);
+			if (!NT_STATUS_IS_OK(status)) {
+				DEBUG(gensec_security->subcontext?4:2, ("Failed to start GENSEC client mech %s: %s\n",
+					  gensec_security->ops->name, nt_errstr(status)));
+			}
+			return status;
+		}
+		break;
+	case GENSEC_SERVER:
+		if (gensec_security->ops->server_start) {
+			status = gensec_security->ops->server_start(gensec_security);
+			if (!NT_STATUS_IS_OK(status)) {
+				DEBUG(1, ("Failed to start GENSEC server mech %s: %s\n",
+					  gensec_security->ops->name, nt_errstr(status)));
+			}
+			return status;
+		}
+		break;
+	}
+	return NT_STATUS_INVALID_PARAMETER;
+}
+
+/**
+ * Start a GENSEC sub-mechanism with a specified mechansim structure, used in SPNEGO
+ *
+ */
+
+NTSTATUS gensec_start_mech_by_ops(struct gensec_security *gensec_security,
+				  const struct gensec_security_ops *ops)
+{
+	gensec_security->ops = ops;
+	return gensec_start_mech(gensec_security);
+}
+
+
+/**
+ * Start a GENSEC sub-mechanism by DCERPC allocated 'auth type' number
+ * @param gensec_security GENSEC context pointer.
+ * @param auth_type DCERPC auth type
+ * @param auth_level DCERPC auth level
+ */
+
+_PUBLIC_ NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
+				       uint8_t auth_type, uint8_t auth_level)
+{
+	gensec_security->ops = gensec_security_by_auth_type(gensec_security, auth_type);
+	if (!gensec_security->ops) {
+		DEBUG(3, ("Could not find GENSEC backend for auth_type=%d\n", (int)auth_type));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	gensec_security->dcerpc_auth_level = auth_level;
+	/*
+	 * We need to reset sign/seal in order to reset it.
+	 * We may got some default features inherited by the credentials
+	 */
+	gensec_security->want_features &= ~GENSEC_FEATURE_SIGN;
+	gensec_security->want_features &= ~GENSEC_FEATURE_SEAL;
+	gensec_want_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE);
+	gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
+	if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
+		if (gensec_security->gensec_role == GENSEC_CLIENT) {
+			gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
+		}
+	} else if (auth_level == DCERPC_AUTH_LEVEL_PACKET) {
+		/*
+		 * For connection oriented DCERPC DCERPC_AUTH_LEVEL_PACKET (4)
+		 * has the same behavior as DCERPC_AUTH_LEVEL_INTEGRITY (5).
+		 */
+		if (gensec_security->gensec_role == GENSEC_CLIENT) {
+			gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
+		}
+	} else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
+		gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
+		gensec_want_feature(gensec_security, GENSEC_FEATURE_SEAL);
+	} else if (auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
+		/* Default features */
+	} else {
+		DEBUG(2,("auth_level %d not supported in DCE/RPC authentication\n",
+			 auth_level));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	return gensec_start_mech(gensec_security);
+}
+
+_PUBLIC_ const char *gensec_get_name_by_authtype(struct gensec_security *gensec_security, uint8_t authtype)
+{
+	const struct gensec_security_ops *ops;
+	ops = gensec_security_by_auth_type(gensec_security, authtype);
+	if (ops) {
+		return ops->name;
+	}
+	return NULL;
+}
+
+
+_PUBLIC_ const char *gensec_get_name_by_oid(struct gensec_security *gensec_security,
+											const char *oid_string)
+{
+	const struct gensec_security_ops *ops;
+	ops = gensec_security_by_oid(gensec_security, oid_string);
+	if (ops) {
+		return ops->name;
+	}
+	return oid_string;
+}
+
+/**
+ * Start a GENSEC sub-mechanism by OID, used in SPNEGO
+ *
+ * @note This should also be used when you wish to just start NLTMSSP (for example), as it uses a
+ *       well-known #define to hook it in.
+ */
+
+_PUBLIC_ NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security,
+				  const char *mech_oid)
+{
+	SMB_ASSERT(gensec_security != NULL);
+
+	gensec_security->ops = gensec_security_by_oid(gensec_security, mech_oid);
+	if (!gensec_security->ops) {
+		DEBUG(3, ("Could not find GENSEC backend for oid=%s\n", mech_oid));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	return gensec_start_mech(gensec_security);
+}
+
+/**
+ * Start a GENSEC sub-mechanism by a well know SASL name
+ *
+ */
+
+_PUBLIC_ NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
+					const char *sasl_name)
+{
+	gensec_security->ops = gensec_security_by_sasl_name(gensec_security, sasl_name);
+	if (!gensec_security->ops) {
+		DEBUG(3, ("Could not find GENSEC backend for sasl_name=%s\n", sasl_name));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	return gensec_start_mech(gensec_security);
+}
+
+/**
+ * Start a GENSEC sub-mechanism with the preferred option from a SASL name list
+ *
+ */
+
+_PUBLIC_ NTSTATUS gensec_start_mech_by_sasl_list(struct gensec_security *gensec_security,
+						 const char **sasl_names)
+{
+	NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
+	TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
+	const struct gensec_security_ops **ops;
+	int i;
+	if (!mem_ctx) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	ops = gensec_security_by_sasl_list(gensec_security, mem_ctx, sasl_names);
+	if (!ops || !*ops) {
+		DEBUG(3, ("Could not find GENSEC backend for any of sasl_name = %s\n",
+			  str_list_join(mem_ctx,
+					sasl_names, ' ')));
+		talloc_free(mem_ctx);
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	for (i=0; ops[i]; i++) {
+		nt_status = gensec_start_mech_by_ops(gensec_security, ops[i]);
+		if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
+			break;
+		}
+	}
+	talloc_free(mem_ctx);
+	return nt_status;
+}
+
+/**
+ * Start a GENSEC sub-mechanism by an internal name
+ *
+ */
+
+_PUBLIC_ NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
+					const char *name)
+{
+	gensec_security->ops = gensec_security_by_name(gensec_security, name);
+	if (!gensec_security->ops) {
+		DEBUG(3, ("Could not find GENSEC backend for name=%s\n", name));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	return gensec_start_mech(gensec_security);
+}
+
+/**
+ * Associate a credentials structure with a GENSEC context - talloc_reference()s it to the context
+ *
+ */
+
+_PUBLIC_ NTSTATUS gensec_set_credentials(struct gensec_security *gensec_security, struct cli_credentials *credentials)
+{
+	gensec_security->credentials = talloc_reference(gensec_security, credentials);
+	NT_STATUS_HAVE_NO_MEMORY(gensec_security->credentials);
+	gensec_want_feature(gensec_security, cli_credentials_get_gensec_features(gensec_security->credentials));
+	return NT_STATUS_OK;
+}
+
+/*
+  register a GENSEC backend.
+
+  The 'name' can be later used by other backends to find the operations
+  structure for this backend.
+*/
+_PUBLIC_ NTSTATUS gensec_register(TALLOC_CTX *ctx,
+			const struct gensec_security_ops *ops)
+{
+	if (gensec_security_by_name(NULL, ops->name) != NULL) {
+		/* its already registered! */
+		DEBUG(0,("GENSEC backend '%s' already registered\n",
+			 ops->name));
+		return NT_STATUS_OBJECT_NAME_COLLISION;
+	}
+
+	generic_security_ops = talloc_realloc(ctx,
+					      generic_security_ops,
+					      const struct gensec_security_ops *,
+					      gensec_num_backends+2);
+	if (!generic_security_ops) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	generic_security_ops[gensec_num_backends] = ops;
+	gensec_num_backends++;
+	generic_security_ops[gensec_num_backends] = NULL;
+
+	DEBUG(3,("GENSEC backend '%s' registered\n",
+		 ops->name));
+
+	return NT_STATUS_OK;
+}
+
+/*
+  return the GENSEC interface version, and the size of some critical types
+  This can be used by backends to either detect compilation errors, or provide
+  multiple implementations for different smbd compilation options in one module
+*/
+_PUBLIC_ const struct gensec_critical_sizes *gensec_interface_version(void)
+{
+	static const struct gensec_critical_sizes critical_sizes = {
+		GENSEC_INTERFACE_VERSION,
+		sizeof(struct gensec_security_ops),
+		sizeof(struct gensec_security),
+	};
+
+	return &critical_sizes;
+}
+
+static int sort_gensec(const struct gensec_security_ops **gs1, const struct gensec_security_ops **gs2) {
+	return (*gs2)->priority - (*gs1)->priority;
+}
+
+int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value)
+{
+	return lpcfg_parm_int(settings->lp_ctx, NULL, mechanism, name, default_value);
+}
+
+bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value)
+{
+	return lpcfg_parm_bool(settings->lp_ctx, NULL, mechanism, name, default_value);
+}
+
+/*
+  initialise the GENSEC subsystem
+*/
+_PUBLIC_ NTSTATUS gensec_init(void)
+{
+	static bool initialized = false;
+#define _MODULE_PROTO(init) extern NTSTATUS init(TALLOC_CTX *);
+#ifdef STATIC_gensec_MODULES
+	STATIC_gensec_MODULES_PROTO;
+	init_module_fn static_init[] = { STATIC_gensec_MODULES };
+#else
+	init_module_fn *static_init = NULL;
+#endif
+	init_module_fn *shared_init;
+
+	if (initialized) return NT_STATUS_OK;
+	initialized = true;
+
+	shared_init = load_samba_modules(NULL, "gensec");
+
+	run_init_functions(NULL, static_init);
+	run_init_functions(NULL, shared_init);
+
+	talloc_free(shared_init);
+
+	TYPESAFE_QSORT(generic_security_ops, gensec_num_backends, sort_gensec);
+
+	return NT_STATUS_OK;
+}