auth: move gensec_start.c to the top level

This does not change who uses gensec for now, but makes it possible to
write new gensec modules outside source4/

Andrew Bartlett

7 files changed, 66 insertions, 972 deletions

diff --git a/source4/auth/gensec/cyrus_sasl.c b/source4/auth/gensec/cyrus_sasl.c
index 4a4422645d..136bb8d43a 100644
--- a/source4/auth/gensec/cyrus_sasl.c
+++ b/source4/auth/gensec/cyrus_sasl.c
@@ -24,6 +24,7 @@
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
 #include "auth/gensec/gensec_proto.h"
+#include "auth/gensec/gensec_toplevel_proto.h"
 #include <sasl/sasl.h>
 
 NTSTATUS gensec_sasl_init(void);
diff --git a/source4/auth/gensec/gensec.pc.in b/source4/auth/gensec/gensec.pc.in
deleted file mode 100644
index f32226d5e4..0000000000
--- a/source4/auth/gensec/gensec.pc.in
+++ /dev/null
@@ -1,11 +0,0 @@
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-includedir=@includedir@
-modulesdir=${prefix}/modules/gensec
-
-Name: gensec
-Description: Generic Security Library
-Version: @PACKAGE_VERSION@
-Libs: @LIB_RPATH@ -L${libdir} -lgensec
-Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/auth/gensec/gensec_start.c b/source4/auth/gensec/gensec_start.c
deleted file mode 100644
index 3150cced97..0000000000
--- a/source4/auth/gensec/gensec_start.c
+++ /dev/null
@@ -1,952 +0,0 @@
-/*
-   Unix SMB/CIFS implementation.
-
-   Generic Authentication Interface
-
-   Copyright (C) Andrew Tridgell 2003
-   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-#include "includes.h"
-#include "system/network.h"
-#include "lib/events/events.h"
-#include "lib/socket/socket.h"
-#include "lib/tsocket/tsocket.h"
-#include "../lib/util/tevent_ntstatus.h"
-#include "librpc/rpc/dcerpc.h"
-#include "auth/credentials/credentials.h"
-#include "auth/gensec/gensec.h"
-#include "auth/gensec/gensec_proto.h"
-#include "auth/auth.h"
-#include "auth/system_session_proto.h"
-#include "param/param.h"
-#include "lib/util/tsort.h"
-#include "auth/gensec/gensec_toplevel_proto.h"
-#include "lib/util/samba_modules.h"
-
-/* the list of currently registered GENSEC backends */
-static struct gensec_security_ops **generic_security_ops;
-static int gensec_num_backends;
-
-/* Return all the registered mechs.  Don't modify the return pointer,
- * but you may talloc_reference it if convient */
-_PUBLIC_ struct gensec_security_ops **gensec_security_all(void)
-{
-	return generic_security_ops;
-}
-
-bool gensec_security_ops_enabled(struct gensec_security_ops *ops, struct gensec_security *security)
-{
-	return lpcfg_parm_bool(security->settings->lp_ctx, NULL, "gensec", ops->name, ops->enabled);
-}
-
-/* Sometimes we want to force only kerberos, sometimes we want to
- * force it's avoidance.  The old list could be either
- * gensec_security_all(), or from cli_credentials_gensec_list() (ie,
- * an existing list we have trimmed down) */
-
-_PUBLIC_ struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx,
-						       struct gensec_security_ops **old_gensec_list,
-						       struct cli_credentials *creds)
-{
-	struct gensec_security_ops **new_gensec_list;
-	int i, j, num_mechs_in;
-	enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS;
-
-	if (creds) {
-		use_kerberos = cli_credentials_get_kerberos_state(creds);
-	}
-
-	if (use_kerberos == CRED_AUTO_USE_KERBEROS) {
-		if (!talloc_reference(mem_ctx, old_gensec_list)) {
-			return NULL;
-		}
-		return old_gensec_list;
-	}
-
-	for (num_mechs_in=0; old_gensec_list && old_gensec_list[num_mechs_in]; num_mechs_in++) {
-		/* noop */
-	}
-
-	new_gensec_list = talloc_array(mem_ctx, struct gensec_security_ops *, num_mechs_in + 1);
-	if (!new_gensec_list) {
-		return NULL;
-	}
-
-	j = 0;
-	for (i=0; old_gensec_list && old_gensec_list[i]; i++) {
-		int oid_idx;
-
-		for (oid_idx = 0; old_gensec_list[i]->oid && old_gensec_list[i]->oid[oid_idx]; oid_idx++) {
-			if (strcmp(old_gensec_list[i]->oid[oid_idx], GENSEC_OID_SPNEGO) == 0) {
-				new_gensec_list[j] = old_gensec_list[i];
-				j++;
-				break;
-			}
-		}
-		switch (use_kerberos) {
-		case CRED_DONT_USE_KERBEROS:
-			if (old_gensec_list[i]->kerberos == false) {
-				new_gensec_list[j] = old_gensec_list[i];
-				j++;
-			}
-			break;
-		case CRED_MUST_USE_KERBEROS:
-			if (old_gensec_list[i]->kerberos == true) {
-				new_gensec_list[j] = old_gensec_list[i];
-				j++;
-			}
-			break;
-		default:
-			/* Can't happen or invalid parameter */
-			return NULL;
-		}
-	}
-	new_gensec_list[j] = NULL;
-
-	return new_gensec_list;
-}
-
-struct gensec_security_ops **gensec_security_mechs(struct gensec_security *gensec_security,
-						   TALLOC_CTX *mem_ctx)
-{
-	struct gensec_security_ops **backends;
-	backends = gensec_security_all();
-	if (!gensec_security) {
-		if (!talloc_reference(mem_ctx, backends)) {
-			return NULL;
-		}
-		return backends;
-	} else {
-		struct cli_credentials *creds = gensec_get_credentials(gensec_security);
-		if (!creds) {
-			if (!talloc_reference(mem_ctx, backends)) {
-				return NULL;
-			}
-			return backends;
-		}
-		return gensec_use_kerberos_mechs(mem_ctx, backends, creds);
-	}
-}
-
-static const struct gensec_security_ops *gensec_security_by_authtype(struct gensec_security *gensec_security,
-								     uint8_t auth_type)
-{
-	int i;
-	struct gensec_security_ops **backends;
-	const struct gensec_security_ops *backend;
-	TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
-	if (!mem_ctx) {
-		return NULL;
-	}
-	backends = gensec_security_mechs(gensec_security, mem_ctx);
-	for (i=0; backends && backends[i]; i++) {
-		if (!gensec_security_ops_enabled(backends[i], gensec_security))
-				continue;
-		if (backends[i]->auth_type == auth_type) {
-			backend = backends[i];
-			talloc_free(mem_ctx);
-			return backend;
-		}
-	}
-	talloc_free(mem_ctx);
-
-	return NULL;
-}
-
-const struct gensec_security_ops *gensec_security_by_oid(struct gensec_security *gensec_security,
-							 const char *oid_string)
-{
-	int i, j;
-	struct gensec_security_ops **backends;
-	const struct gensec_security_ops *backend;
-	TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
-	if (!mem_ctx) {
-		return NULL;
-	}
-	backends = gensec_security_mechs(gensec_security, mem_ctx);
-	for (i=0; backends && backends[i]; i++) {
-		if (gensec_security != NULL &&
-				!gensec_security_ops_enabled(backends[i],
-											 gensec_security))
-		    continue;
-		if (backends[i]->oid) {
-			for (j=0; backends[i]->oid[j]; j++) {
-				if (backends[i]->oid[j] &&
-				    (strcmp(backends[i]->oid[j], oid_string) == 0)) {
-					backend = backends[i];
-					talloc_free(mem_ctx);
-					return backend;
-				}
-			}
-		}
-	}
-	talloc_free(mem_ctx);
-
-	return NULL;
-}
-
-const struct gensec_security_ops *gensec_security_by_sasl_name(struct gensec_security *gensec_security,
-							       const char *sasl_name)
-{
-	int i;
-	struct gensec_security_ops **backends;
-	const struct gensec_security_ops *backend;
-	TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
-	if (!mem_ctx) {
-		return NULL;
-	}
-	backends = gensec_security_mechs(gensec_security, mem_ctx);
-	for (i=0; backends && backends[i]; i++) {
-		if (!gensec_security_ops_enabled(backends[i], gensec_security))
-		    continue;
-		if (backends[i]->sasl_name
-		    && (strcmp(backends[i]->sasl_name, sasl_name) == 0)) {
-			backend = backends[i];
-			talloc_free(mem_ctx);
-			return backend;
-		}
-	}
-	talloc_free(mem_ctx);
-
-	return NULL;
-}
-
-static const struct gensec_security_ops *gensec_security_by_name(struct gensec_security *gensec_security,
-								 const char *name)
-{
-	int i;
-	struct gensec_security_ops **backends;
-	const struct gensec_security_ops *backend;
-	TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
-	if (!mem_ctx) {
-		return NULL;
-	}
-	backends = gensec_security_mechs(gensec_security, mem_ctx);
-	for (i=0; backends && backends[i]; i++) {
-		if (gensec_security != NULL &&
-				!gensec_security_ops_enabled(backends[i], gensec_security))
-		    continue;
-		if (backends[i]->name
-		    && (strcmp(backends[i]->name, name) == 0)) {
-			backend = backends[i];
-			talloc_free(mem_ctx);
-			return backend;
-		}
-	}
-	talloc_free(mem_ctx);
-	return NULL;
-}
-
-/**
- * Return a unique list of security subsystems from those specified in
- * the list of SASL names.
- *
- * Use the list of enabled GENSEC mechanisms from the credentials
- * attached to the gensec_security, and return in our preferred order.
- */
-
-const struct gensec_security_ops **gensec_security_by_sasl_list(struct gensec_security *gensec_security,
-								TALLOC_CTX *mem_ctx,
-								const char **sasl_names)
-{
-	const struct gensec_security_ops **backends_out;
-	struct gensec_security_ops **backends;
-	int i, k, sasl_idx;
-	int num_backends_out = 0;
-
-	if (!sasl_names) {
-		return NULL;
-	}
-
-	backends = gensec_security_mechs(gensec_security, mem_ctx);
-
-	backends_out = talloc_array(mem_ctx, const struct gensec_security_ops *, 1);
-	if (!backends_out) {
-		return NULL;
-	}
-	backends_out[0] = NULL;
-
-	/* Find backends in our preferred order, by walking our list,
-	 * then looking in the supplied list */
-	for (i=0; backends && backends[i]; i++) {
-		if (gensec_security != NULL &&
-				!gensec_security_ops_enabled(backends[i], gensec_security))
-		    continue;
-		for (sasl_idx = 0; sasl_names[sasl_idx]; sasl_idx++) {
-			if (!backends[i]->sasl_name ||
-			    !(strcmp(backends[i]->sasl_name,
-				     sasl_names[sasl_idx]) == 0)) {
-				continue;
-			}
-
-			for (k=0; backends_out[k]; k++) {
-				if (backends_out[k] == backends[i]) {
-					break;
-				}
-			}
-
-			if (k < num_backends_out) {
-				/* already in there */
-				continue;
-			}
-
-			backends_out = talloc_realloc(mem_ctx, backends_out,
-						      const struct gensec_security_ops *,
-						      num_backends_out + 2);
-			if (!backends_out) {
-				return NULL;
-			}
-
-			backends_out[num_backends_out] = backends[i];
-			num_backends_out++;
-			backends_out[num_backends_out] = NULL;
-		}
-	}
-	return backends_out;
-}
-
-/**
- * Return a unique list of security subsystems from those specified in
- * the OID list.  That is, where two OIDs refer to the same module,
- * return that module only once.
- *
- * Use the list of enabled GENSEC mechanisms from the credentials
- * attached to the gensec_security, and return in our preferred order.
- */
-
-const struct gensec_security_ops_wrapper *gensec_security_by_oid_list(struct gensec_security *gensec_security,
-								      TALLOC_CTX *mem_ctx,
-								      const char **oid_strings,
-								      const char *skip)
-{
-	struct gensec_security_ops_wrapper *backends_out;
-	struct gensec_security_ops **backends;
-	int i, j, k, oid_idx;
-	int num_backends_out = 0;
-
-	if (!oid_strings) {
-		return NULL;
-	}
-
-	backends = gensec_security_mechs(gensec_security, gensec_security);
-
-	backends_out = talloc_array(mem_ctx, struct gensec_security_ops_wrapper, 1);
-	if (!backends_out) {
-		return NULL;
-	}
-	backends_out[0].op = NULL;
-	backends_out[0].oid = NULL;
-
-	/* Find backends in our preferred order, by walking our list,
-	 * then looking in the supplied list */
-	for (i=0; backends && backends[i]; i++) {
-		if (gensec_security != NULL &&
-				!gensec_security_ops_enabled(backends[i], gensec_security))
-		    continue;
-		if (!backends[i]->oid) {
-			continue;
-		}
-		for (oid_idx = 0; oid_strings[oid_idx]; oid_idx++) {
-			if (strcmp(oid_strings[oid_idx], skip) == 0) {
-				continue;
-			}
-
-			for (j=0; backends[i]->oid[j]; j++) {
-				if (!backends[i]->oid[j] ||
-				    !(strcmp(backends[i]->oid[j],
-					    oid_strings[oid_idx]) == 0)) {
-					continue;
-				}
-
-				for (k=0; backends_out[k].op; k++) {
-					if (backends_out[k].op == backends[i]) {
-						break;
-					}
-				}
-
-				if (k < num_backends_out) {
-					/* already in there */
-					continue;
-				}
-
-				backends_out = talloc_realloc(mem_ctx, backends_out,
-							      struct gensec_security_ops_wrapper,
-							      num_backends_out + 2);
-				if (!backends_out) {
-					return NULL;
-				}
-
-				backends_out[num_backends_out].op = backends[i];
-				backends_out[num_backends_out].oid = backends[i]->oid[j];
-				num_backends_out++;
-				backends_out[num_backends_out].op = NULL;
-				backends_out[num_backends_out].oid = NULL;
-			}
-		}
-	}
-	return backends_out;
-}
-
-/**
- * Return OIDS from the security subsystems listed
- */
-
-const char **gensec_security_oids_from_ops(struct gensec_security *gensec_security,
-										   TALLOC_CTX *mem_ctx,
-					   struct gensec_security_ops **ops,
-					   const char *skip)
-{
-	int i;
-	int j = 0;
-	int k;
-	const char **oid_list;
-	if (!ops) {
-		return NULL;
-	}
-	oid_list = talloc_array(mem_ctx, const char *, 1);
-	if (!oid_list) {
-		return NULL;
-	}
-
-	for (i=0; ops && ops[i]; i++) {
-		if (gensec_security != NULL &&
-			!gensec_security_ops_enabled(ops[i], gensec_security)) {
-			continue;
-		}
-		if (!ops[i]->oid) {
-			continue;
-		}
-
-		for (k = 0; ops[i]->oid[k]; k++) {
-			if (skip && strcmp(skip, ops[i]->oid[k])==0) {
-			} else {
-				oid_list = talloc_realloc(mem_ctx, oid_list, const char *, j + 2);
-				if (!oid_list) {
-					return NULL;
-				}
-				oid_list[j] = ops[i]->oid[k];
-				j++;
-			}
-		}
-	}
-	oid_list[j] = NULL;
-	return oid_list;
-}
-
-
-/**
- * Return OIDS from the security subsystems listed
- */
-
-const char **gensec_security_oids_from_ops_wrapped(TALLOC_CTX *mem_ctx,
-						   const struct gensec_security_ops_wrapper *wops)
-{
-	int i;
-	int j = 0;
-	int k;
-	const char **oid_list;
-	if (!wops) {
-		return NULL;
-	}
-	oid_list = talloc_array(mem_ctx, const char *, 1);
-	if (!oid_list) {
-		return NULL;
-	}
-
-	for (i=0; wops[i].op; i++) {
-		if (!wops[i].op->oid) {
-			continue;
-		}
-
-		for (k = 0; wops[i].op->oid[k]; k++) {
-			oid_list = talloc_realloc(mem_ctx, oid_list, const char *, j + 2);
-			if (!oid_list) {
-				return NULL;
-			}
-			oid_list[j] = wops[i].op->oid[k];
-			j++;
-		}
-	}
-	oid_list[j] = NULL;
-	return oid_list;
-}
-
-
-/**
- * Return all the security subsystems currently enabled on a GENSEC context.
- *
- * This is taken from a list attached to the cli_credentials, and
- * skips the OID in 'skip'.  (Typically the SPNEGO OID)
- *
- */
-
-const char **gensec_security_oids(struct gensec_security *gensec_security,
-				  TALLOC_CTX *mem_ctx,
-				  const char *skip)
-{
-	struct gensec_security_ops **ops
-		= gensec_security_mechs(gensec_security, mem_ctx);
-	return gensec_security_oids_from_ops(gensec_security, mem_ctx, ops, skip);
-}
-
-/**
-  Start the GENSEC system, returning a context pointer.
-  @param mem_ctx The parent TALLOC memory context.
-  @param gensec_security Returned GENSEC context pointer.
-  @note  The mem_ctx is only a parent and may be NULL.
-  @note, the auth context is moved to be a referenced pointer of the
-  @ gensec_security return
-*/
-static NTSTATUS gensec_start(TALLOC_CTX *mem_ctx,
-			     struct tevent_context *ev,
-			     struct gensec_settings *settings,
-			     struct auth4_context *auth_context,
-			     struct gensec_security **gensec_security)
-{
-	if (ev == NULL) {
-		DEBUG(0, ("No event context available!\n"));
-		return NT_STATUS_INTERNAL_ERROR;
-	}
-
-	(*gensec_security) = talloc_zero(mem_ctx, struct gensec_security);
-	NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
-
-	(*gensec_security)->event_ctx = ev;
-	SMB_ASSERT(settings->lp_ctx != NULL);
-	(*gensec_security)->settings = talloc_reference(*gensec_security, settings);
-
-	/* We need to reference this, not steal, as the caller may be
-	 * python, which won't like it if we steal it's object away
-	 * from it */
-	(*gensec_security)->auth_context = talloc_reference(*gensec_security, auth_context);
-
-	return NT_STATUS_OK;
-}
-
-/**
- * Start a GENSEC subcontext, with a copy of the properties of the parent
- * @param mem_ctx The parent TALLOC memory context.
- * @param parent The parent GENSEC context
- * @param gensec_security Returned GENSEC context pointer.
- * @note Used by SPNEGO in particular, for the actual implementation mechanism
- */
-
-_PUBLIC_ NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx,
-				 struct gensec_security *parent,
-				 struct gensec_security **gensec_security)
-{
-	(*gensec_security) = talloc_zero(mem_ctx, struct gensec_security);
-	NT_STATUS_HAVE_NO_MEMORY(*gensec_security);
-
-	(**gensec_security) = *parent;
-	(*gensec_security)->ops = NULL;
-	(*gensec_security)->private_data = NULL;
-
-	(*gensec_security)->subcontext = true;
-	(*gensec_security)->want_features = parent->want_features;
-	(*gensec_security)->event_ctx = parent->event_ctx;
-	(*gensec_security)->auth_context = talloc_reference(*gensec_security, parent->auth_context);
-	(*gensec_security)->settings = talloc_reference(*gensec_security, parent->settings);
-	(*gensec_security)->auth_context = talloc_reference(*gensec_security, parent->auth_context);
-
-	return NT_STATUS_OK;
-}
-
-/**
-  Start the GENSEC system, in client mode, returning a context pointer.
-  @param mem_ctx The parent TALLOC memory context.
-  @param gensec_security Returned GENSEC context pointer.
-  @note  The mem_ctx is only a parent and may be NULL.
-*/
-_PUBLIC_ NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx,
-			     struct gensec_security **gensec_security,
-			     struct tevent_context *ev,
-			     struct gensec_settings *settings)
-{
-	NTSTATUS status;
-
-	if (settings == NULL) {
-		DEBUG(0,("gensec_client_start: no settings given!\n"));
-		return NT_STATUS_INTERNAL_ERROR;
-	}
-
-	status = gensec_start(mem_ctx, ev, settings, NULL, gensec_security);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
-	(*gensec_security)->gensec_role = GENSEC_CLIENT;
-
-	return status;
-}
-
-
-
-/**
-  Start the GENSEC system, in server mode, returning a context pointer.
-  @param mem_ctx The parent TALLOC memory context.
-  @param gensec_security Returned GENSEC context pointer.
-  @note  The mem_ctx is only a parent and may be NULL.
-*/
-_PUBLIC_ NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx,
-				      struct tevent_context *ev,
-				      struct gensec_settings *settings,
-				      struct auth4_context *auth_context,
-				      struct gensec_security **gensec_security)
-{
-	NTSTATUS status;
-
-	if (!ev) {
-		DEBUG(0,("gensec_server_start: no event context given!\n"));
-		return NT_STATUS_INTERNAL_ERROR;
-	}
-
-	if (!settings) {
-		DEBUG(0,("gensec_server_start: no settings given!\n"));
-		return NT_STATUS_INTERNAL_ERROR;
-	}
-
-	status = gensec_start(mem_ctx, ev, settings, auth_context, gensec_security);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
-	(*gensec_security)->gensec_role = GENSEC_SERVER;
-
-	return status;
-}
-
-NTSTATUS gensec_start_mech(struct gensec_security *gensec_security)
-{
-	NTSTATUS status;
-	DEBUG(5, ("Starting GENSEC %smechanism %s\n",
-		  gensec_security->subcontext ? "sub" : "",
-		  gensec_security->ops->name));
-	switch (gensec_security->gensec_role) {
-	case GENSEC_CLIENT:
-		if (gensec_security->ops->client_start) {
-			status = gensec_security->ops->client_start(gensec_security);
-			if (!NT_STATUS_IS_OK(status)) {
-				DEBUG(gensec_security->subcontext?4:2, ("Failed to start GENSEC client mech %s: %s\n",
-					  gensec_security->ops->name, nt_errstr(status)));
-			}
-			return status;
-		}
-		break;
-	case GENSEC_SERVER:
-		if (gensec_security->ops->server_start) {
-			status = gensec_security->ops->server_start(gensec_security);
-			if (!NT_STATUS_IS_OK(status)) {
-				DEBUG(1, ("Failed to start GENSEC server mech %s: %s\n",
-					  gensec_security->ops->name, nt_errstr(status)));
-			}
-			return status;
-		}
-		break;
-	}
-	return NT_STATUS_INVALID_PARAMETER;
-}
-
-/**
- * Start a GENSEC sub-mechanism with a specified mechansim structure, used in SPNEGO
- *
- */
-
-NTSTATUS gensec_start_mech_by_ops(struct gensec_security *gensec_security,
-				  const struct gensec_security_ops *ops)
-{
-	gensec_security->ops = ops;
-	return gensec_start_mech(gensec_security);
-}
-
-
-/**
- * Start a GENSEC sub-mechanism by DCERPC allocated 'auth type' number
- * @param gensec_security GENSEC context pointer.
- * @param auth_type DCERPC auth type
- * @param auth_level DCERPC auth level
- */
-
-_PUBLIC_ NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
-				       uint8_t auth_type, uint8_t auth_level)
-{
-	gensec_security->ops = gensec_security_by_authtype(gensec_security, auth_type);
-	if (!gensec_security->ops) {
-		DEBUG(3, ("Could not find GENSEC backend for auth_type=%d\n", (int)auth_type));
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-	gensec_want_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE);
-	gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
-	if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
-		gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
-	} else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
-		gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
-		gensec_want_feature(gensec_security, GENSEC_FEATURE_SEAL);
-	} else if (auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
-		/* Default features */
-	} else {
-		DEBUG(2,("auth_level %d not supported in DCE/RPC authentication\n",
-			 auth_level));
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-
-	return gensec_start_mech(gensec_security);
-}
-
-_PUBLIC_ const char *gensec_get_name_by_authtype(struct gensec_security *gensec_security, uint8_t authtype)
-{
-	const struct gensec_security_ops *ops;
-	ops = gensec_security_by_authtype(gensec_security, authtype);
-	if (ops) {
-		return ops->name;
-	}
-	return NULL;
-}
-
-
-_PUBLIC_ const char *gensec_get_name_by_oid(struct gensec_security *gensec_security,
-											const char *oid_string)
-{
-	const struct gensec_security_ops *ops;
-	ops = gensec_security_by_oid(gensec_security, oid_string);
-	if (ops) {
-		return ops->name;
-	}
-	return oid_string;
-}
-
-/**
- * Start a GENSEC sub-mechanism by OID, used in SPNEGO
- *
- * @note This should also be used when you wish to just start NLTMSSP (for example), as it uses a
- *       well-known #define to hook it in.
- */
-
-_PUBLIC_ NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security,
-				  const char *mech_oid)
-{
-	SMB_ASSERT(gensec_security != NULL);
-
-	gensec_security->ops = gensec_security_by_oid(gensec_security, mech_oid);
-	if (!gensec_security->ops) {
-		DEBUG(3, ("Could not find GENSEC backend for oid=%s\n", mech_oid));
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-	return gensec_start_mech(gensec_security);
-}
-
-/**
- * Start a GENSEC sub-mechanism by a well know SASL name
- *
- */
-
-_PUBLIC_ NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security,
-					const char *sasl_name)
-{
-	gensec_security->ops = gensec_security_by_sasl_name(gensec_security, sasl_name);
-	if (!gensec_security->ops) {
-		DEBUG(3, ("Could not find GENSEC backend for sasl_name=%s\n", sasl_name));
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-	return gensec_start_mech(gensec_security);
-}
-
-/**
- * Start a GENSEC sub-mechanism with the preferred option from a SASL name list
- *
- */
-
-_PUBLIC_ NTSTATUS gensec_start_mech_by_sasl_list(struct gensec_security *gensec_security,
-						 const char **sasl_names)
-{
-	NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
-	TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
-	const struct gensec_security_ops **ops;
-	int i;
-	if (!mem_ctx) {
-		return NT_STATUS_NO_MEMORY;
-	}
-	ops = gensec_security_by_sasl_list(gensec_security, mem_ctx, sasl_names);
-	if (!ops || !*ops) {
-		DEBUG(3, ("Could not find GENSEC backend for any of sasl_name = %s\n",
-			  str_list_join(mem_ctx,
-					sasl_names, ' ')));
-		talloc_free(mem_ctx);
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-	for (i=0; ops[i]; i++) {
-		nt_status = gensec_start_mech_by_ops(gensec_security, ops[i]);
-		if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
-			break;
-		}
-	}
-	talloc_free(mem_ctx);
-	return nt_status;
-}
-
-/**
- * Start a GENSEC sub-mechanism by an internal name
- *
- */
-
-_PUBLIC_ NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
-					const char *name)
-{
-	gensec_security->ops = gensec_security_by_name(gensec_security, name);
-	if (!gensec_security->ops) {
-		DEBUG(3, ("Could not find GENSEC backend for name=%s\n", name));
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-	return gensec_start_mech(gensec_security);
-}
-
-/**
- * Associate a credentials structure with a GENSEC context - talloc_reference()s it to the context
- *
- */
-
-_PUBLIC_ NTSTATUS gensec_set_credentials(struct gensec_security *gensec_security, struct cli_credentials *credentials)
-{
-	gensec_security->credentials = talloc_reference(gensec_security, credentials);
-	NT_STATUS_HAVE_NO_MEMORY(gensec_security->credentials);
-	gensec_want_feature(gensec_security, cli_credentials_get_gensec_features(gensec_security->credentials));
-	return NT_STATUS_OK;
-}
-
-NTSTATUS gensec_generate_session_info(TALLOC_CTX *mem_ctx,
-				      struct gensec_security *gensec_security,
-				      struct auth_user_info_dc *user_info_dc,
-				      struct auth_session_info **session_info)
-{
-	NTSTATUS nt_status;
-	uint32_t session_info_flags = 0;
-
-	if (gensec_security->want_features & GENSEC_FEATURE_UNIX_TOKEN) {
-		session_info_flags |= AUTH_SESSION_INFO_UNIX_TOKEN;
-	}
-
-	session_info_flags |= AUTH_SESSION_INFO_DEFAULT_GROUPS;
-	if (user_info_dc->info->authenticated) {
-		session_info_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
-	}
-
-	if (gensec_security->auth_context) {
-		nt_status = gensec_security->auth_context->generate_session_info(mem_ctx, gensec_security->auth_context,
-										 user_info_dc,
-										 session_info_flags,
-										 session_info);
-	} else {
-		session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
-		nt_status = auth_generate_session_info(mem_ctx,
-						       NULL,
-						       NULL,
-						       user_info_dc, session_info_flags,
-						       session_info);
-	}
-	return nt_status;
-}
-
-/*
-  register a GENSEC backend.
-
-  The 'name' can be later used by other backends to find the operations
-  structure for this backend.
-*/
-NTSTATUS gensec_register(const struct gensec_security_ops *ops)
-{
-	if (gensec_security_by_name(NULL, ops->name) != NULL) {
-		/* its already registered! */
-		DEBUG(0,("GENSEC backend '%s' already registered\n",
-			 ops->name));
-		return NT_STATUS_OBJECT_NAME_COLLISION;
-	}
-
-	generic_security_ops = talloc_realloc(talloc_autofree_context(),
-					      generic_security_ops,
-					      struct gensec_security_ops *,
-					      gensec_num_backends+2);
-	if (!generic_security_ops) {
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	generic_security_ops[gensec_num_backends] = discard_const_p(struct gensec_security_ops, ops);
-	gensec_num_backends++;
-	generic_security_ops[gensec_num_backends] = NULL;
-
-	DEBUG(3,("GENSEC backend '%s' registered\n",
-		 ops->name));
-
-	return NT_STATUS_OK;
-}
-
-/*
-  return the GENSEC interface version, and the size of some critical types
-  This can be used by backends to either detect compilation errors, or provide
-  multiple implementations for different smbd compilation options in one module
-*/
-const struct gensec_critical_sizes *gensec_interface_version(void)
-{
-	static const struct gensec_critical_sizes critical_sizes = {
-		GENSEC_INTERFACE_VERSION,
-		sizeof(struct gensec_security_ops),
-		sizeof(struct gensec_security),
-	};
-
-	return &critical_sizes;
-}
-
-static int sort_gensec(struct gensec_security_ops **gs1, struct gensec_security_ops **gs2) {
-	return (*gs2)->priority - (*gs1)->priority;
-}
-
-int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value)
-{
-	return lpcfg_parm_int(settings->lp_ctx, NULL, mechanism, name, default_value);
-}
-
-bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value)
-{
-	return lpcfg_parm_bool(settings->lp_ctx, NULL, mechanism, name, default_value);
-}
-
-/*
-  initialise the GENSEC subsystem
-*/
-_PUBLIC_ NTSTATUS gensec_init(void)
-{
-	static bool initialized = false;
-#define _MODULE_PROTO(init) extern NTSTATUS init(void);
-#if _SAMBA_BUILD_ == 4
-	STATIC_gensec_MODULES_PROTO;
-	init_module_fn static_init[] = { STATIC_gensec_MODULES };
-#else
-	init_module_fn *static_init = NULL;
-#endif
-	init_module_fn *shared_init;
-
-	if (initialized) return NT_STATUS_OK;
-	initialized = true;
-
-	shared_init = load_samba_modules(NULL, "gensec");
-
-	run_init_functions(static_init);
-	run_init_functions(shared_init);
-
-	talloc_free(shared_init);
-
-	TYPESAFE_QSORT(generic_security_ops, gensec_num_backends, sort_gensec);
-
-	return NT_STATUS_OK;
-}
diff --git a/source4/auth/gensec/gensec_util.c b/source4/auth/gensec/gensec_util.c
new file mode 100644
index 0000000000..267366af61
--- /dev/null
+++ b/source4/auth/gensec/gensec_util.c
@@ -0,0 +1,59 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Generic Authentication Interface
+
+   Copyright (C) Andrew Tridgell 2003
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2006
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "auth/gensec/gensec.h"
+#include "auth/auth.h"
+#include "auth/system_session_proto.h"
+
+NTSTATUS gensec_generate_session_info(TALLOC_CTX *mem_ctx,
+				      struct gensec_security *gensec_security,
+				      struct auth_user_info_dc *user_info_dc,
+				      struct auth_session_info **session_info)
+{
+	NTSTATUS nt_status;
+	uint32_t session_info_flags = 0;
+
+	if (gensec_security->want_features & GENSEC_FEATURE_UNIX_TOKEN) {
+		session_info_flags |= AUTH_SESSION_INFO_UNIX_TOKEN;
+	}
+
+	session_info_flags |= AUTH_SESSION_INFO_DEFAULT_GROUPS;
+	if (user_info_dc->info->authenticated) {
+		session_info_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
+	}
+
+	if (gensec_security->auth_context) {
+		nt_status = gensec_security->auth_context->generate_session_info(mem_ctx, gensec_security->auth_context,
+										 user_info_dc,
+										 session_info_flags,
+										 session_info);
+	} else {
+		session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
+		nt_status = auth_generate_session_info(mem_ctx,
+						       NULL,
+						       NULL,
+						       user_info_dc, session_info_flags,
+						       session_info);
+	}
+	return nt_status;
+}
diff --git a/source4/auth/gensec/schannel.c b/source4/auth/gensec/schannel.c
index b70d65a093..35713ce068 100644
--- a/source4/auth/gensec/schannel.c
+++ b/source4/auth/gensec/schannel.c
@@ -30,6 +30,7 @@
 #include "librpc/rpc/dcerpc.h"
 #include "param/param.h"
 #include "auth/gensec/schannel.h"
+#include "auth/gensec/gensec_toplevel_proto.h"
 
 _PUBLIC_ NTSTATUS gensec_schannel_init(void);
 
diff --git a/source4/auth/gensec/wscript_build b/source4/auth/gensec/wscript_build
index a7fa12f56a..86d958950f 100644
--- a/source4/auth/gensec/wscript_build
+++ b/source4/auth/gensec/wscript_build
@@ -1,14 +1,9 @@
 #!/usr/bin/env python
 
-bld.SAMBA_LIBRARY('gensec',
-	source='gensec_start.c socket.c gensec_tstream.c',
-	pc_files='gensec.pc',
-	autoproto='gensec_proto.h',
-	public_deps='tevent-util samba-util errors LIBPACKET auth_system_session gensec_runtime samba-modules',
-	public_headers='',
-	deps='com_err',
-	vnum='0.0.1'
-	)
+bld.SAMBA_SUBSYSTEM('gensec_util',
+                    source='socket.c gensec_tstream.c gensec_util.c',
+                    deps='tevent-util tevent samba-util LIBTSOCKET',
+                    autoproto='gensec_proto.h')
 
 bld.SAMBA_MODULE('gensec_krb5',
 	source='gensec_krb5.c',
diff --git a/source4/auth/ntlmssp/ntlmssp.c b/source4/auth/ntlmssp/ntlmssp.c
index d90c908d8d..9b3aef0c65 100644
--- a/source4/auth/ntlmssp/ntlmssp.c
+++ b/source4/auth/ntlmssp/ntlmssp.c
@@ -27,6 +27,7 @@
 #include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "auth/gensec/gensec.h"
 #include "auth/gensec/gensec_proto.h"
+#include "auth/gensec/gensec_toplevel_proto.h"
 
 /**
  * Callbacks for NTLMSSP - for both client and server operating modes