|
| 1 | +use std::borrow::Cow; |
| 2 | + |
| 3 | +use rsasl::callback::{Context, Request, SessionCallback, SessionData}; |
| 4 | +use rsasl::mechanisms::gssapi::properties::GssService; |
| 5 | +use rsasl::prelude::*; |
| 6 | +use rsasl::property::Hostname; |
| 7 | + |
| 8 | +use crate::error::Error; |
| 9 | + |
| 10 | +pub(crate) type Result<T, E = crate::error::Error> = std::result::Result<T, E>; |
| 11 | + |
| 12 | +#[derive(Clone, Debug)] |
| 13 | +enum SaslInnerOptions { |
| 14 | + Gssapi(GssapiSaslOptions), |
| 15 | +} |
| 16 | + |
| 17 | +impl From<GssapiSaslOptions> for SaslOptions { |
| 18 | + fn from(options: GssapiSaslOptions) -> Self { |
| 19 | + Self(SaslInnerOptions::Gssapi(options)) |
| 20 | + } |
| 21 | +} |
| 22 | + |
| 23 | +/// Client side SASL options. |
| 24 | +#[derive(Clone, Debug)] |
| 25 | +pub struct SaslOptions(SaslInnerOptions); |
| 26 | + |
| 27 | +impl SaslOptions { |
| 28 | + /// Constructs a default [GssapiSaslOptions] for further customization. |
| 29 | + /// |
| 30 | + /// Make sure localhost is granted by Kerberos KDC, unlike Java counterpart this library |
| 31 | + /// provides no mean to grant ticket from KDC but simply utilizes whatever the ticket cache |
| 32 | + /// have. |
| 33 | + pub fn gssapi() -> GssapiSaslOptions { |
| 34 | + GssapiSaslOptions::new() |
| 35 | + } |
| 36 | + |
| 37 | + pub(crate) fn new_session(&self, hostname: &str) -> Result<SaslSession> { |
| 38 | + match &self.0 { |
| 39 | + SaslInnerOptions::Gssapi(options) => { |
| 40 | + struct GssapiOptionsProvider { |
| 41 | + username: Cow<'static, str>, |
| 42 | + hostname: Cow<'static, str>, |
| 43 | + } |
| 44 | + impl SessionCallback for GssapiOptionsProvider { |
| 45 | + fn callback( |
| 46 | + &self, |
| 47 | + _session_data: &SessionData, |
| 48 | + _context: &Context, |
| 49 | + request: &mut Request<'_>, |
| 50 | + ) -> Result<(), SessionError> { |
| 51 | + if request.is::<Hostname>() { |
| 52 | + request.satisfy::<Hostname>(&self.hostname)?; |
| 53 | + } else if request.is::<GssService>() { |
| 54 | + request.satisfy::<GssService>(&self.username)?; |
| 55 | + } |
| 56 | + Ok(()) |
| 57 | + } |
| 58 | + } |
| 59 | + let provider = GssapiOptionsProvider { |
| 60 | + username: options.username.clone(), |
| 61 | + hostname: options.hostname_or(hostname), |
| 62 | + }; |
| 63 | + let config = SASLConfig::builder().with_defaults().with_callback(provider).unwrap(); |
| 64 | + let client = SASLClient::new(config); |
| 65 | + let session = client.start_suggested(&[Mechname::parse(b"GSSAPI").unwrap()]).unwrap(); |
| 66 | + SaslSession::new(session) |
| 67 | + }, |
| 68 | + } |
| 69 | + } |
| 70 | +} |
| 71 | + |
| 72 | +pub struct SaslSession { |
| 73 | + output: Vec<u8>, |
| 74 | + session: Session, |
| 75 | + finished: bool, |
| 76 | +} |
| 77 | + |
| 78 | +impl SaslSession { |
| 79 | + fn new(session: Session) -> Result<Self> { |
| 80 | + let mut session = Self { session, output: Default::default(), finished: false }; |
| 81 | + if session.session.are_we_first() { |
| 82 | + session.step(Default::default())?; |
| 83 | + } |
| 84 | + Ok(session) |
| 85 | + } |
| 86 | + |
| 87 | + pub fn name(&self) -> &str { |
| 88 | + self.session.get_mechname().as_str() |
| 89 | + } |
| 90 | + |
| 91 | + pub fn initial(&self) -> &[u8] { |
| 92 | + &self.output |
| 93 | + } |
| 94 | + |
| 95 | + pub fn step(&mut self, challenge: &[u8]) -> Result<Option<&[u8]>> { |
| 96 | + if self.finished { |
| 97 | + return Err(Error::UnexpectedError(format!("SASL {} session already finished", self.name()))); |
| 98 | + } |
| 99 | + self.output.clear(); |
| 100 | + match self.session.step(Some(challenge), &mut self.output).map_err(|e| Error::other(format!("{e}"), e))? { |
| 101 | + State::Running => Ok(Some(&self.output)), |
| 102 | + State::Finished(MessageSent::Yes) => { |
| 103 | + self.finished = true; |
| 104 | + Ok(Some(&self.output)) |
| 105 | + }, |
| 106 | + State::Finished(MessageSent::No) => { |
| 107 | + self.finished = true; |
| 108 | + Ok(None) |
| 109 | + }, |
| 110 | + } |
| 111 | + } |
| 112 | +} |
| 113 | + |
| 114 | +/// GSSAPI SASL options. |
| 115 | +#[derive(Clone, Debug)] |
| 116 | +pub struct GssapiSaslOptions { |
| 117 | + username: Cow<'static, str>, |
| 118 | + hostname: Option<Cow<'static, str>>, |
| 119 | +} |
| 120 | + |
| 121 | +impl GssapiSaslOptions { |
| 122 | + fn new() -> Self { |
| 123 | + Self { username: Cow::from("zookeeper"), hostname: None } |
| 124 | + } |
| 125 | + |
| 126 | + /// Specifies the primary part of Kerberos principal. |
| 127 | + /// |
| 128 | + /// It is `zookeeper.sasl.client.username` in Java client, but the word "client" is misleading |
| 129 | + /// as it is the username of targeting server. |
| 130 | + /// |
| 131 | + /// Defaults to "zookeeper". |
| 132 | + pub fn with_username(self, username: impl Into<Cow<'static, str>>) -> Self { |
| 133 | + Self { username: username.into(), ..self } |
| 134 | + } |
| 135 | + |
| 136 | + /// Specifies the instance part of Kerberos principal. |
| 137 | + /// |
| 138 | + /// Defaults to hostname or ip of targeting server in connecting string. |
| 139 | + pub fn with_hostname(self, hostname: impl Into<Cow<'static, str>>) -> Self { |
| 140 | + Self { hostname: Some(hostname.into()), ..self } |
| 141 | + } |
| 142 | + |
| 143 | + fn hostname_or(&self, hostname: &str) -> Cow<'static, str> { |
| 144 | + match self.hostname.as_ref() { |
| 145 | + None => Cow::Owned(hostname.to_string()), |
| 146 | + Some(hostname) => hostname.clone(), |
| 147 | + } |
| 148 | + } |
| 149 | +} |
0 commit comments