2
0

socks_gssapi.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. * Copyright (C) Markus Moeller, <markus_moeller@compuserve.com>
  10. *
  11. * This software is licensed as described in the file COPYING, which
  12. * you should have received as part of this distribution. The terms
  13. * are also available at https://curl.se/docs/copyright.html.
  14. *
  15. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16. * copies of the Software, and permit persons to whom the Software is
  17. * furnished to do so, under the terms of the COPYING file.
  18. *
  19. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20. * KIND, either express or implied.
  21. *
  22. * SPDX-License-Identifier: curl
  23. *
  24. ***************************************************************************/
  25. #include "curl_setup.h"
  26. #if defined(HAVE_GSSAPI) && !defined(CURL_DISABLE_PROXY)
  27. #include "curl_gssapi.h"
  28. #include "urldata.h"
  29. #include "sendf.h"
  30. #include "cfilters.h"
  31. #include "connect.h"
  32. #include "timeval.h"
  33. #include "socks.h"
  34. #include "warnless.h"
  35. /* The last 3 #include files should be in this order */
  36. #include "curl_printf.h"
  37. #include "curl_memory.h"
  38. #include "memdebug.h"
  39. static gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
  40. /*
  41. * Helper GSS-API error functions.
  42. */
  43. static int check_gss_err(struct Curl_easy *data,
  44. OM_uint32 major_status,
  45. OM_uint32 minor_status,
  46. const char *function)
  47. {
  48. if(GSS_ERROR(major_status)) {
  49. OM_uint32 maj_stat, min_stat;
  50. OM_uint32 msg_ctx = 0;
  51. gss_buffer_desc status_string = GSS_C_EMPTY_BUFFER;
  52. char buf[1024];
  53. size_t len;
  54. len = 0;
  55. msg_ctx = 0;
  56. while(!msg_ctx) {
  57. /* convert major status code (GSS-API error) to text */
  58. maj_stat = gss_display_status(&min_stat, major_status,
  59. GSS_C_GSS_CODE,
  60. GSS_C_NULL_OID,
  61. &msg_ctx, &status_string);
  62. if(maj_stat == GSS_S_COMPLETE) {
  63. if(sizeof(buf) > len + status_string.length + 1) {
  64. strcpy(buf + len, (char *) status_string.value);
  65. len += status_string.length;
  66. }
  67. gss_release_buffer(&min_stat, &status_string);
  68. break;
  69. }
  70. gss_release_buffer(&min_stat, &status_string);
  71. }
  72. if(sizeof(buf) > len + 3) {
  73. strcpy(buf + len, ".\n");
  74. len += 2;
  75. }
  76. msg_ctx = 0;
  77. while(!msg_ctx) {
  78. /* convert minor status code (underlying routine error) to text */
  79. maj_stat = gss_display_status(&min_stat, minor_status,
  80. GSS_C_MECH_CODE,
  81. GSS_C_NULL_OID,
  82. &msg_ctx, &status_string);
  83. if(maj_stat == GSS_S_COMPLETE) {
  84. if(sizeof(buf) > len + status_string.length)
  85. strcpy(buf + len, (char *) status_string.value);
  86. gss_release_buffer(&min_stat, &status_string);
  87. break;
  88. }
  89. gss_release_buffer(&min_stat, &status_string);
  90. }
  91. failf(data, "GSS-API error: %s failed: %s", function, buf);
  92. return 1;
  93. }
  94. return 0;
  95. }
  96. CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
  97. struct Curl_easy *data)
  98. {
  99. struct connectdata *conn = cf->conn;
  100. curl_socket_t sock = conn->sock[cf->sockindex];
  101. CURLcode code;
  102. ssize_t actualread;
  103. ssize_t nwritten;
  104. int result;
  105. OM_uint32 gss_major_status, gss_minor_status, gss_status;
  106. OM_uint32 gss_ret_flags;
  107. int gss_conf_state, gss_enc;
  108. gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
  109. gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
  110. gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
  111. gss_buffer_desc gss_w_token = GSS_C_EMPTY_BUFFER;
  112. gss_buffer_desc *gss_token = GSS_C_NO_BUFFER;
  113. gss_name_t server = GSS_C_NO_NAME;
  114. gss_name_t gss_client_name = GSS_C_NO_NAME;
  115. unsigned short us_length;
  116. char *user = NULL;
  117. unsigned char socksreq[4]; /* room for GSS-API exchange header only */
  118. const char *serviceptr = data->set.str[STRING_PROXY_SERVICE_NAME] ?
  119. data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd";
  120. const size_t serviceptr_length = strlen(serviceptr);
  121. /* GSS-API request looks like
  122. * +----+------+-----+----------------+
  123. * |VER | MTYP | LEN | TOKEN |
  124. * +----+------+----------------------+
  125. * | 1 | 1 | 2 | up to 2^16 - 1 |
  126. * +----+------+-----+----------------+
  127. */
  128. /* prepare service name */
  129. if(strchr(serviceptr, '/')) {
  130. service.length = serviceptr_length;
  131. service.value = malloc(service.length);
  132. if(!service.value)
  133. return CURLE_OUT_OF_MEMORY;
  134. memcpy(service.value, serviceptr, service.length);
  135. gss_major_status = gss_import_name(&gss_minor_status, &service,
  136. (gss_OID) GSS_C_NULL_OID, &server);
  137. }
  138. else {
  139. service.value = malloc(serviceptr_length +
  140. strlen(conn->socks_proxy.host.name) + 2);
  141. if(!service.value)
  142. return CURLE_OUT_OF_MEMORY;
  143. service.length = serviceptr_length +
  144. strlen(conn->socks_proxy.host.name) + 1;
  145. msnprintf(service.value, service.length + 1, "%s@%s",
  146. serviceptr, conn->socks_proxy.host.name);
  147. gss_major_status = gss_import_name(&gss_minor_status, &service,
  148. GSS_C_NT_HOSTBASED_SERVICE, &server);
  149. }
  150. gss_release_buffer(&gss_status, &service); /* clear allocated memory */
  151. if(check_gss_err(data, gss_major_status,
  152. gss_minor_status, "gss_import_name()")) {
  153. failf(data, "Failed to create service name.");
  154. gss_release_name(&gss_status, &server);
  155. return CURLE_COULDNT_CONNECT;
  156. }
  157. (void)curlx_nonblock(sock, FALSE);
  158. /* As long as we need to keep sending some context info, and there's no */
  159. /* errors, keep sending it... */
  160. for(;;) {
  161. gss_major_status = Curl_gss_init_sec_context(data,
  162. &gss_minor_status,
  163. &gss_context,
  164. server,
  165. &Curl_krb5_mech_oid,
  166. NULL,
  167. gss_token,
  168. &gss_send_token,
  169. TRUE,
  170. &gss_ret_flags);
  171. if(gss_token != GSS_C_NO_BUFFER)
  172. gss_release_buffer(&gss_status, &gss_recv_token);
  173. if(check_gss_err(data, gss_major_status,
  174. gss_minor_status, "gss_init_sec_context")) {
  175. gss_release_name(&gss_status, &server);
  176. gss_release_buffer(&gss_status, &gss_recv_token);
  177. gss_release_buffer(&gss_status, &gss_send_token);
  178. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  179. failf(data, "Failed to initial GSS-API token.");
  180. return CURLE_COULDNT_CONNECT;
  181. }
  182. if(gss_send_token.length) {
  183. socksreq[0] = 1; /* GSS-API subnegotiation version */
  184. socksreq[1] = 1; /* authentication message type */
  185. us_length = htons((short)gss_send_token.length);
  186. memcpy(socksreq + 2, &us_length, sizeof(short));
  187. nwritten = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, &code);
  188. if(code || (4 != nwritten)) {
  189. failf(data, "Failed to send GSS-API authentication request.");
  190. gss_release_name(&gss_status, &server);
  191. gss_release_buffer(&gss_status, &gss_recv_token);
  192. gss_release_buffer(&gss_status, &gss_send_token);
  193. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  194. return CURLE_COULDNT_CONNECT;
  195. }
  196. nwritten = Curl_conn_cf_send(cf->next, data,
  197. (char *)gss_send_token.value,
  198. gss_send_token.length, &code);
  199. if(code || ((ssize_t)gss_send_token.length != nwritten)) {
  200. failf(data, "Failed to send GSS-API authentication token.");
  201. gss_release_name(&gss_status, &server);
  202. gss_release_buffer(&gss_status, &gss_recv_token);
  203. gss_release_buffer(&gss_status, &gss_send_token);
  204. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  205. return CURLE_COULDNT_CONNECT;
  206. }
  207. }
  208. gss_release_buffer(&gss_status, &gss_send_token);
  209. gss_release_buffer(&gss_status, &gss_recv_token);
  210. if(gss_major_status != GSS_S_CONTINUE_NEEDED)
  211. break;
  212. /* analyse response */
  213. /* GSS-API response looks like
  214. * +----+------+-----+----------------+
  215. * |VER | MTYP | LEN | TOKEN |
  216. * +----+------+----------------------+
  217. * | 1 | 1 | 2 | up to 2^16 - 1 |
  218. * +----+------+-----+----------------+
  219. */
  220. result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
  221. if(result || (actualread != 4)) {
  222. failf(data, "Failed to receive GSS-API authentication response.");
  223. gss_release_name(&gss_status, &server);
  224. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  225. return CURLE_COULDNT_CONNECT;
  226. }
  227. /* ignore the first (VER) byte */
  228. if(socksreq[1] == 255) { /* status / message type */
  229. failf(data, "User was rejected by the SOCKS5 server (%d %d).",
  230. socksreq[0], socksreq[1]);
  231. gss_release_name(&gss_status, &server);
  232. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  233. return CURLE_COULDNT_CONNECT;
  234. }
  235. if(socksreq[1] != 1) { /* status / message type */
  236. failf(data, "Invalid GSS-API authentication response type (%d %d).",
  237. socksreq[0], socksreq[1]);
  238. gss_release_name(&gss_status, &server);
  239. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  240. return CURLE_COULDNT_CONNECT;
  241. }
  242. memcpy(&us_length, socksreq + 2, sizeof(short));
  243. us_length = ntohs(us_length);
  244. gss_recv_token.length = us_length;
  245. gss_recv_token.value = malloc(us_length);
  246. if(!gss_recv_token.value) {
  247. failf(data,
  248. "Could not allocate memory for GSS-API authentication "
  249. "response token.");
  250. gss_release_name(&gss_status, &server);
  251. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  252. return CURLE_OUT_OF_MEMORY;
  253. }
  254. result = Curl_blockread_all(cf, data, (char *)gss_recv_token.value,
  255. gss_recv_token.length, &actualread);
  256. if(result || (actualread != us_length)) {
  257. failf(data, "Failed to receive GSS-API authentication token.");
  258. gss_release_name(&gss_status, &server);
  259. gss_release_buffer(&gss_status, &gss_recv_token);
  260. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  261. return CURLE_COULDNT_CONNECT;
  262. }
  263. gss_token = &gss_recv_token;
  264. }
  265. gss_release_name(&gss_status, &server);
  266. /* Everything is good so far, user was authenticated! */
  267. gss_major_status = gss_inquire_context(&gss_minor_status, gss_context,
  268. &gss_client_name, NULL, NULL, NULL,
  269. NULL, NULL, NULL);
  270. if(check_gss_err(data, gss_major_status,
  271. gss_minor_status, "gss_inquire_context")) {
  272. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  273. gss_release_name(&gss_status, &gss_client_name);
  274. failf(data, "Failed to determine user name.");
  275. return CURLE_COULDNT_CONNECT;
  276. }
  277. gss_major_status = gss_display_name(&gss_minor_status, gss_client_name,
  278. &gss_send_token, NULL);
  279. if(check_gss_err(data, gss_major_status,
  280. gss_minor_status, "gss_display_name")) {
  281. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  282. gss_release_name(&gss_status, &gss_client_name);
  283. gss_release_buffer(&gss_status, &gss_send_token);
  284. failf(data, "Failed to determine user name.");
  285. return CURLE_COULDNT_CONNECT;
  286. }
  287. user = malloc(gss_send_token.length + 1);
  288. if(!user) {
  289. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  290. gss_release_name(&gss_status, &gss_client_name);
  291. gss_release_buffer(&gss_status, &gss_send_token);
  292. return CURLE_OUT_OF_MEMORY;
  293. }
  294. memcpy(user, gss_send_token.value, gss_send_token.length);
  295. user[gss_send_token.length] = '\0';
  296. gss_release_name(&gss_status, &gss_client_name);
  297. gss_release_buffer(&gss_status, &gss_send_token);
  298. infof(data, "SOCKS5 server authenticated user %s with GSS-API.",user);
  299. free(user);
  300. user = NULL;
  301. /* Do encryption */
  302. socksreq[0] = 1; /* GSS-API subnegotiation version */
  303. socksreq[1] = 2; /* encryption message type */
  304. gss_enc = 0; /* no data protection */
  305. /* do confidentiality protection if supported */
  306. if(gss_ret_flags & GSS_C_CONF_FLAG)
  307. gss_enc = 2;
  308. /* else do integrity protection */
  309. else if(gss_ret_flags & GSS_C_INTEG_FLAG)
  310. gss_enc = 1;
  311. infof(data, "SOCKS5 server supports GSS-API %s data protection.",
  312. (gss_enc == 0)?"no":((gss_enc==1)?"integrity":"confidentiality"));
  313. /* force for the moment to no data protection */
  314. gss_enc = 0;
  315. /*
  316. * Sending the encryption type in clear seems wrong. It should be
  317. * protected with gss_seal()/gss_wrap(). See RFC1961 extract below
  318. * The NEC reference implementations on which this is based is
  319. * therefore at fault
  320. *
  321. * +------+------+------+.......................+
  322. * + ver | mtyp | len | token |
  323. * +------+------+------+.......................+
  324. * + 0x01 | 0x02 | 0x02 | up to 2^16 - 1 octets |
  325. * +------+------+------+.......................+
  326. *
  327. * Where:
  328. *
  329. * - "ver" is the protocol version number, here 1 to represent the
  330. * first version of the SOCKS/GSS-API protocol
  331. *
  332. * - "mtyp" is the message type, here 2 to represent a protection
  333. * -level negotiation message
  334. *
  335. * - "len" is the length of the "token" field in octets
  336. *
  337. * - "token" is the GSS-API encapsulated protection level
  338. *
  339. * The token is produced by encapsulating an octet containing the
  340. * required protection level using gss_seal()/gss_wrap() with conf_req
  341. * set to FALSE. The token is verified using gss_unseal()/
  342. * gss_unwrap().
  343. *
  344. */
  345. if(data->set.socks5_gssapi_nec) {
  346. us_length = htons((short)1);
  347. memcpy(socksreq + 2, &us_length, sizeof(short));
  348. }
  349. else {
  350. gss_send_token.length = 1;
  351. gss_send_token.value = malloc(1);
  352. if(!gss_send_token.value) {
  353. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  354. return CURLE_OUT_OF_MEMORY;
  355. }
  356. memcpy(gss_send_token.value, &gss_enc, 1);
  357. gss_major_status = gss_wrap(&gss_minor_status, gss_context, 0,
  358. GSS_C_QOP_DEFAULT, &gss_send_token,
  359. &gss_conf_state, &gss_w_token);
  360. if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_wrap")) {
  361. gss_release_buffer(&gss_status, &gss_send_token);
  362. gss_release_buffer(&gss_status, &gss_w_token);
  363. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  364. failf(data, "Failed to wrap GSS-API encryption value into token.");
  365. return CURLE_COULDNT_CONNECT;
  366. }
  367. gss_release_buffer(&gss_status, &gss_send_token);
  368. us_length = htons((short)gss_w_token.length);
  369. memcpy(socksreq + 2, &us_length, sizeof(short));
  370. }
  371. nwritten = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, &code);
  372. if(code || (4 != nwritten)) {
  373. failf(data, "Failed to send GSS-API encryption request.");
  374. gss_release_buffer(&gss_status, &gss_w_token);
  375. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  376. return CURLE_COULDNT_CONNECT;
  377. }
  378. if(data->set.socks5_gssapi_nec) {
  379. memcpy(socksreq, &gss_enc, 1);
  380. nwritten = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 1, &code);
  381. if(code || ( 1 != nwritten)) {
  382. failf(data, "Failed to send GSS-API encryption type.");
  383. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  384. return CURLE_COULDNT_CONNECT;
  385. }
  386. }
  387. else {
  388. nwritten = Curl_conn_cf_send(cf->next, data,
  389. (char *)gss_w_token.value,
  390. gss_w_token.length, &code);
  391. if(code || ((ssize_t)gss_w_token.length != nwritten)) {
  392. failf(data, "Failed to send GSS-API encryption type.");
  393. gss_release_buffer(&gss_status, &gss_w_token);
  394. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  395. return CURLE_COULDNT_CONNECT;
  396. }
  397. gss_release_buffer(&gss_status, &gss_w_token);
  398. }
  399. result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
  400. if(result || (actualread != 4)) {
  401. failf(data, "Failed to receive GSS-API encryption response.");
  402. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  403. return CURLE_COULDNT_CONNECT;
  404. }
  405. /* ignore the first (VER) byte */
  406. if(socksreq[1] == 255) { /* status / message type */
  407. failf(data, "User was rejected by the SOCKS5 server (%d %d).",
  408. socksreq[0], socksreq[1]);
  409. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  410. return CURLE_COULDNT_CONNECT;
  411. }
  412. if(socksreq[1] != 2) { /* status / message type */
  413. failf(data, "Invalid GSS-API encryption response type (%d %d).",
  414. socksreq[0], socksreq[1]);
  415. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  416. return CURLE_COULDNT_CONNECT;
  417. }
  418. memcpy(&us_length, socksreq + 2, sizeof(short));
  419. us_length = ntohs(us_length);
  420. gss_recv_token.length = us_length;
  421. gss_recv_token.value = malloc(gss_recv_token.length);
  422. if(!gss_recv_token.value) {
  423. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  424. return CURLE_OUT_OF_MEMORY;
  425. }
  426. result = Curl_blockread_all(cf, data, (char *)gss_recv_token.value,
  427. gss_recv_token.length, &actualread);
  428. if(result || (actualread != us_length)) {
  429. failf(data, "Failed to receive GSS-API encryptrion type.");
  430. gss_release_buffer(&gss_status, &gss_recv_token);
  431. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  432. return CURLE_COULDNT_CONNECT;
  433. }
  434. if(!data->set.socks5_gssapi_nec) {
  435. gss_major_status = gss_unwrap(&gss_minor_status, gss_context,
  436. &gss_recv_token, &gss_w_token,
  437. 0, GSS_C_QOP_DEFAULT);
  438. if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_unwrap")) {
  439. gss_release_buffer(&gss_status, &gss_recv_token);
  440. gss_release_buffer(&gss_status, &gss_w_token);
  441. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  442. failf(data, "Failed to unwrap GSS-API encryption value into token.");
  443. return CURLE_COULDNT_CONNECT;
  444. }
  445. gss_release_buffer(&gss_status, &gss_recv_token);
  446. if(gss_w_token.length != 1) {
  447. failf(data, "Invalid GSS-API encryption response length (%zu).",
  448. gss_w_token.length);
  449. gss_release_buffer(&gss_status, &gss_w_token);
  450. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  451. return CURLE_COULDNT_CONNECT;
  452. }
  453. memcpy(socksreq, gss_w_token.value, gss_w_token.length);
  454. gss_release_buffer(&gss_status, &gss_w_token);
  455. }
  456. else {
  457. if(gss_recv_token.length != 1) {
  458. failf(data, "Invalid GSS-API encryption response length (%zu).",
  459. gss_recv_token.length);
  460. gss_release_buffer(&gss_status, &gss_recv_token);
  461. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  462. return CURLE_COULDNT_CONNECT;
  463. }
  464. memcpy(socksreq, gss_recv_token.value, gss_recv_token.length);
  465. gss_release_buffer(&gss_status, &gss_recv_token);
  466. }
  467. (void)curlx_nonblock(sock, TRUE);
  468. infof(data, "SOCKS5 access with%s protection granted.",
  469. (socksreq[0] == 0)?"out GSS-API data":
  470. ((socksreq[0] == 1)?" GSS-API integrity":" GSS-API confidentiality"));
  471. conn->socks5_gssapi_enctype = socksreq[0];
  472. if(socksreq[0] == 0)
  473. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  474. return CURLE_OK;
  475. }
  476. #endif /* HAVE_GSSAPI && !CURL_DISABLE_PROXY */