http_negotiate_sspi.c 8.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at http://curl.haxx.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. ***************************************************************************/
  22. #include "curl_setup.h"
  23. #ifdef USE_WINDOWS_SSPI
  24. #ifndef CURL_DISABLE_HTTP
  25. #include "urldata.h"
  26. #include "sendf.h"
  27. #include "rawstr.h"
  28. #include "warnless.h"
  29. #include "curl_base64.h"
  30. #include "http_negotiate.h"
  31. #include "curl_memory.h"
  32. #include "curl_multibyte.h"
  33. #define _MPRINTF_REPLACE /* use our functions only */
  34. #include <curl/mprintf.h>
  35. /* The last #include file should be: */
  36. #include "memdebug.h"
  37. static int
  38. get_gss_name(struct connectdata *conn, bool proxy,
  39. struct negotiatedata *neg_ctx)
  40. {
  41. const char* service;
  42. size_t length;
  43. if(proxy && !conn->proxy.name)
  44. /* proxy auth requested but no given proxy name, error out! */
  45. return -1;
  46. /* GSSAPI implementation by Globus (known as GSI) requires the name to be
  47. of form "<service>/<fqdn>" instead of <service>@<fqdn> (ie. slash instead
  48. of at-sign). Also GSI servers are often identified as 'host' not 'khttp'.
  49. Change following lines if you want to use GSI */
  50. /* IIS uses the <service>@<fqdn> form but uses 'http' as the service name,
  51. and SSPI then generates an NTLM token. When using <service>/<fqdn> a
  52. Kerberos token is generated. */
  53. if(neg_ctx->gss)
  54. service = "KHTTP";
  55. else
  56. service = "HTTP";
  57. length = strlen(service) + 1 + strlen(proxy ? conn->proxy.name :
  58. conn->host.name) + 1;
  59. if(length + 1 > sizeof(neg_ctx->server_name))
  60. return EMSGSIZE;
  61. snprintf(neg_ctx->server_name, sizeof(neg_ctx->server_name), "%s/%s",
  62. service, proxy ? conn->proxy.name : conn->host.name);
  63. return 0;
  64. }
  65. /* returning zero (0) means success, everything else is treated as "failure"
  66. with no care exactly what the failure was */
  67. int Curl_input_negotiate(struct connectdata *conn, bool proxy,
  68. const char *header)
  69. {
  70. struct negotiatedata *neg_ctx = proxy?&conn->data->state.proxyneg:
  71. &conn->data->state.negotiate;
  72. BYTE *input_token = 0;
  73. SecBufferDesc out_buff_desc;
  74. SecBuffer out_sec_buff;
  75. SecBufferDesc in_buff_desc;
  76. SecBuffer in_sec_buff;
  77. unsigned long context_attributes;
  78. TimeStamp lifetime;
  79. TCHAR *sname;
  80. int ret;
  81. size_t len = 0, input_token_len = 0;
  82. bool gss = FALSE;
  83. const char* protocol;
  84. CURLcode error;
  85. if(checkprefix("GSS-Negotiate", header)) {
  86. protocol = "GSS-Negotiate";
  87. gss = TRUE;
  88. }
  89. else if(checkprefix("Negotiate", header)) {
  90. protocol = "Negotiate";
  91. gss = FALSE;
  92. }
  93. else
  94. return -1;
  95. if(neg_ctx->context) {
  96. if(neg_ctx->gss != gss) {
  97. return -1;
  98. }
  99. }
  100. else {
  101. neg_ctx->protocol = protocol;
  102. neg_ctx->gss = gss;
  103. }
  104. if(neg_ctx->context && neg_ctx->status == SEC_E_OK) {
  105. /* We finished successfully our part of authentication, but server
  106. * rejected it (since we're again here). Exit with an error since we
  107. * can't invent anything better */
  108. Curl_cleanup_negotiate(conn->data);
  109. return -1;
  110. }
  111. if(0 == strlen(neg_ctx->server_name)) {
  112. ret = get_gss_name(conn, proxy, neg_ctx);
  113. if(ret)
  114. return ret;
  115. }
  116. if(!neg_ctx->output_token) {
  117. PSecPkgInfo SecurityPackage;
  118. ret = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT("Negotiate"),
  119. &SecurityPackage);
  120. if(ret != SEC_E_OK)
  121. return -1;
  122. /* Allocate input and output buffers according to the max token size
  123. as indicated by the security package */
  124. neg_ctx->max_token_length = SecurityPackage->cbMaxToken;
  125. neg_ctx->output_token = malloc(neg_ctx->max_token_length);
  126. s_pSecFn->FreeContextBuffer(SecurityPackage);
  127. }
  128. /* Obtain the input token, if any */
  129. header += strlen(neg_ctx->protocol);
  130. while(*header && ISSPACE(*header))
  131. header++;
  132. len = strlen(header);
  133. if(!len) {
  134. /* first call in a new negotation, we have to acquire credentials,
  135. and allocate memory for the context */
  136. neg_ctx->credentials = malloc(sizeof(CredHandle));
  137. neg_ctx->context = malloc(sizeof(CtxtHandle));
  138. if(!neg_ctx->credentials || !neg_ctx->context)
  139. return -1;
  140. neg_ctx->status =
  141. s_pSecFn->AcquireCredentialsHandle(NULL,
  142. (TCHAR *) TEXT("Negotiate"),
  143. SECPKG_CRED_OUTBOUND, NULL, NULL,
  144. NULL, NULL, neg_ctx->credentials,
  145. &lifetime);
  146. if(neg_ctx->status != SEC_E_OK)
  147. return -1;
  148. }
  149. else {
  150. input_token = malloc(neg_ctx->max_token_length);
  151. if(!input_token)
  152. return -1;
  153. error = Curl_base64_decode(header,
  154. (unsigned char **)&input_token,
  155. &input_token_len);
  156. if(error || input_token_len == 0)
  157. return -1;
  158. }
  159. /* prepare the output buffers, and input buffers if present */
  160. out_buff_desc.ulVersion = 0;
  161. out_buff_desc.cBuffers = 1;
  162. out_buff_desc.pBuffers = &out_sec_buff;
  163. out_sec_buff.cbBuffer = curlx_uztoul(neg_ctx->max_token_length);
  164. out_sec_buff.BufferType = SECBUFFER_TOKEN;
  165. out_sec_buff.pvBuffer = neg_ctx->output_token;
  166. if(input_token) {
  167. in_buff_desc.ulVersion = 0;
  168. in_buff_desc.cBuffers = 1;
  169. in_buff_desc.pBuffers = &in_sec_buff;
  170. in_sec_buff.cbBuffer = curlx_uztoul(input_token_len);
  171. in_sec_buff.BufferType = SECBUFFER_TOKEN;
  172. in_sec_buff.pvBuffer = input_token;
  173. }
  174. sname = Curl_convert_UTF8_to_tchar(neg_ctx->server_name);
  175. if(!sname)
  176. return CURLE_OUT_OF_MEMORY;
  177. neg_ctx->status = s_pSecFn->InitializeSecurityContext(
  178. neg_ctx->credentials,
  179. input_token ? neg_ctx->context : 0,
  180. sname,
  181. ISC_REQ_CONFIDENTIALITY,
  182. 0,
  183. SECURITY_NATIVE_DREP,
  184. input_token ? &in_buff_desc : 0,
  185. 0,
  186. neg_ctx->context,
  187. &out_buff_desc,
  188. &context_attributes,
  189. &lifetime);
  190. Curl_unicodefree(sname);
  191. if(GSS_ERROR(neg_ctx->status))
  192. return -1;
  193. if(neg_ctx->status == SEC_I_COMPLETE_NEEDED ||
  194. neg_ctx->status == SEC_I_COMPLETE_AND_CONTINUE) {
  195. neg_ctx->status = s_pSecFn->CompleteAuthToken(neg_ctx->context,
  196. &out_buff_desc);
  197. if(GSS_ERROR(neg_ctx->status))
  198. return -1;
  199. }
  200. neg_ctx->output_token_length = out_sec_buff.cbBuffer;
  201. return 0;
  202. }
  203. CURLcode Curl_output_negotiate(struct connectdata *conn, bool proxy)
  204. {
  205. struct negotiatedata *neg_ctx = proxy?&conn->data->state.proxyneg:
  206. &conn->data->state.negotiate;
  207. char *encoded = NULL;
  208. size_t len = 0;
  209. char *userp;
  210. CURLcode error;
  211. error = Curl_base64_encode(conn->data,
  212. (const char*)neg_ctx->output_token,
  213. neg_ctx->output_token_length,
  214. &encoded, &len);
  215. if(error)
  216. return error;
  217. if(len == 0)
  218. return CURLE_REMOTE_ACCESS_DENIED;
  219. userp = aprintf("%sAuthorization: %s %s\r\n", proxy ? "Proxy-" : "",
  220. neg_ctx->protocol, encoded);
  221. if(proxy)
  222. conn->allocptr.proxyuserpwd = userp;
  223. else
  224. conn->allocptr.userpwd = userp;
  225. free(encoded);
  226. Curl_cleanup_negotiate (conn->data);
  227. return (userp == NULL) ? CURLE_OUT_OF_MEMORY : CURLE_OK;
  228. }
  229. static void cleanup(struct negotiatedata *neg_ctx)
  230. {
  231. if(neg_ctx->context) {
  232. s_pSecFn->DeleteSecurityContext(neg_ctx->context);
  233. free(neg_ctx->context);
  234. neg_ctx->context = 0;
  235. }
  236. if(neg_ctx->credentials) {
  237. s_pSecFn->FreeCredentialsHandle(neg_ctx->credentials);
  238. free(neg_ctx->credentials);
  239. neg_ctx->credentials = 0;
  240. }
  241. if(neg_ctx->output_token) {
  242. free(neg_ctx->output_token);
  243. neg_ctx->output_token = 0;
  244. }
  245. neg_ctx->max_token_length = 0;
  246. }
  247. void Curl_cleanup_negotiate(struct SessionHandle *data)
  248. {
  249. cleanup(&data->state.negotiate);
  250. cleanup(&data->state.proxyneg);
  251. }
  252. #endif
  253. #endif