socks_gssapi.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 2012 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. * Copyright (C) 2009, Markus Moeller, <markus_moeller@compuserve.com>
  10. *
  11. * This software is licensed as described in the file COPYING, which
  12. * you should have received as part of this distribution. The terms
  13. * are also available at https://curl.se/docs/copyright.html.
  14. *
  15. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16. * copies of the Software, and permit persons to whom the Software is
  17. * furnished to do so, under the terms of the COPYING file.
  18. *
  19. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20. * KIND, either express or implied.
  21. *
  22. ***************************************************************************/
  23. #include "curl_setup.h"
  24. #if defined(HAVE_GSSAPI) && !defined(CURL_DISABLE_PROXY)
  25. #include "curl_gssapi.h"
  26. #include "urldata.h"
  27. #include "sendf.h"
  28. #include "connect.h"
  29. #include "timeval.h"
  30. #include "socks.h"
  31. #include "warnless.h"
  32. /* The last 3 #include files should be in this order */
  33. #include "curl_printf.h"
  34. #include "curl_memory.h"
  35. #include "memdebug.h"
  36. static gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
  37. /*
  38. * Helper GSS-API error functions.
  39. */
  40. static int check_gss_err(struct Curl_easy *data,
  41. OM_uint32 major_status,
  42. OM_uint32 minor_status,
  43. const char *function)
  44. {
  45. if(GSS_ERROR(major_status)) {
  46. OM_uint32 maj_stat, min_stat;
  47. OM_uint32 msg_ctx = 0;
  48. gss_buffer_desc status_string;
  49. char buf[1024];
  50. size_t len;
  51. len = 0;
  52. msg_ctx = 0;
  53. while(!msg_ctx) {
  54. /* convert major status code (GSS-API error) to text */
  55. maj_stat = gss_display_status(&min_stat, major_status,
  56. GSS_C_GSS_CODE,
  57. GSS_C_NULL_OID,
  58. &msg_ctx, &status_string);
  59. if(maj_stat == GSS_S_COMPLETE) {
  60. if(sizeof(buf) > len + status_string.length + 1) {
  61. strcpy(buf + len, (char *) status_string.value);
  62. len += status_string.length;
  63. }
  64. gss_release_buffer(&min_stat, &status_string);
  65. break;
  66. }
  67. gss_release_buffer(&min_stat, &status_string);
  68. }
  69. if(sizeof(buf) > len + 3) {
  70. strcpy(buf + len, ".\n");
  71. len += 2;
  72. }
  73. msg_ctx = 0;
  74. while(!msg_ctx) {
  75. /* convert minor status code (underlying routine error) to text */
  76. maj_stat = gss_display_status(&min_stat, minor_status,
  77. GSS_C_MECH_CODE,
  78. GSS_C_NULL_OID,
  79. &msg_ctx, &status_string);
  80. if(maj_stat == GSS_S_COMPLETE) {
  81. if(sizeof(buf) > len + status_string.length)
  82. strcpy(buf + len, (char *) status_string.value);
  83. gss_release_buffer(&min_stat, &status_string);
  84. break;
  85. }
  86. gss_release_buffer(&min_stat, &status_string);
  87. }
  88. failf(data, "GSS-API error: %s failed: %s", function, buf);
  89. return 1;
  90. }
  91. return 0;
  92. }
  93. CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
  94. struct connectdata *conn)
  95. {
  96. struct Curl_easy *data = conn->data;
  97. curl_socket_t sock = conn->sock[sockindex];
  98. CURLcode code;
  99. ssize_t actualread;
  100. ssize_t written;
  101. int result;
  102. OM_uint32 gss_major_status, gss_minor_status, gss_status;
  103. OM_uint32 gss_ret_flags;
  104. int gss_conf_state, gss_enc;
  105. gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
  106. gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
  107. gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
  108. gss_buffer_desc gss_w_token = GSS_C_EMPTY_BUFFER;
  109. gss_buffer_desc *gss_token = GSS_C_NO_BUFFER;
  110. gss_name_t server = GSS_C_NO_NAME;
  111. gss_name_t gss_client_name = GSS_C_NO_NAME;
  112. unsigned short us_length;
  113. char *user = NULL;
  114. unsigned char socksreq[4]; /* room for GSS-API exchange header only */
  115. const char *serviceptr = data->set.str[STRING_PROXY_SERVICE_NAME] ?
  116. data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd";
  117. const size_t serviceptr_length = strlen(serviceptr);
  118. /* GSS-API request looks like
  119. * +----+------+-----+----------------+
  120. * |VER | MTYP | LEN | TOKEN |
  121. * +----+------+----------------------+
  122. * | 1 | 1 | 2 | up to 2^16 - 1 |
  123. * +----+------+-----+----------------+
  124. */
  125. /* prepare service name */
  126. if(strchr(serviceptr, '/')) {
  127. service.length = serviceptr_length;
  128. service.value = malloc(service.length);
  129. if(!service.value)
  130. return CURLE_OUT_OF_MEMORY;
  131. memcpy(service.value, serviceptr, service.length);
  132. gss_major_status = gss_import_name(&gss_minor_status, &service,
  133. (gss_OID) GSS_C_NULL_OID, &server);
  134. }
  135. else {
  136. service.value = malloc(serviceptr_length +
  137. strlen(conn->socks_proxy.host.name) + 2);
  138. if(!service.value)
  139. return CURLE_OUT_OF_MEMORY;
  140. service.length = serviceptr_length +
  141. strlen(conn->socks_proxy.host.name) + 1;
  142. msnprintf(service.value, service.length + 1, "%s@%s",
  143. serviceptr, conn->socks_proxy.host.name);
  144. gss_major_status = gss_import_name(&gss_minor_status, &service,
  145. GSS_C_NT_HOSTBASED_SERVICE, &server);
  146. }
  147. gss_release_buffer(&gss_status, &service); /* clear allocated memory */
  148. if(check_gss_err(data, gss_major_status,
  149. gss_minor_status, "gss_import_name()")) {
  150. failf(data, "Failed to create service name.");
  151. gss_release_name(&gss_status, &server);
  152. return CURLE_COULDNT_CONNECT;
  153. }
  154. (void)curlx_nonblock(sock, FALSE);
  155. /* As long as we need to keep sending some context info, and there's no */
  156. /* errors, keep sending it... */
  157. for(;;) {
  158. gss_major_status = Curl_gss_init_sec_context(data,
  159. &gss_minor_status,
  160. &gss_context,
  161. server,
  162. &Curl_krb5_mech_oid,
  163. NULL,
  164. gss_token,
  165. &gss_send_token,
  166. TRUE,
  167. &gss_ret_flags);
  168. if(gss_token != GSS_C_NO_BUFFER)
  169. gss_release_buffer(&gss_status, &gss_recv_token);
  170. if(check_gss_err(data, gss_major_status,
  171. gss_minor_status, "gss_init_sec_context")) {
  172. gss_release_name(&gss_status, &server);
  173. gss_release_buffer(&gss_status, &gss_recv_token);
  174. gss_release_buffer(&gss_status, &gss_send_token);
  175. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  176. failf(data, "Failed to initial GSS-API token.");
  177. return CURLE_COULDNT_CONNECT;
  178. }
  179. if(gss_send_token.length != 0) {
  180. socksreq[0] = 1; /* GSS-API subnegotiation version */
  181. socksreq[1] = 1; /* authentication message type */
  182. us_length = htons((short)gss_send_token.length);
  183. memcpy(socksreq + 2, &us_length, sizeof(short));
  184. code = Curl_write_plain(conn, sock, (char *)socksreq, 4, &written);
  185. if(code || (4 != written)) {
  186. failf(data, "Failed to send GSS-API authentication request.");
  187. gss_release_name(&gss_status, &server);
  188. gss_release_buffer(&gss_status, &gss_recv_token);
  189. gss_release_buffer(&gss_status, &gss_send_token);
  190. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  191. return CURLE_COULDNT_CONNECT;
  192. }
  193. code = Curl_write_plain(conn, sock, (char *)gss_send_token.value,
  194. gss_send_token.length, &written);
  195. if(code || ((ssize_t)gss_send_token.length != written)) {
  196. failf(data, "Failed to send GSS-API authentication token.");
  197. gss_release_name(&gss_status, &server);
  198. gss_release_buffer(&gss_status, &gss_recv_token);
  199. gss_release_buffer(&gss_status, &gss_send_token);
  200. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  201. return CURLE_COULDNT_CONNECT;
  202. }
  203. }
  204. gss_release_buffer(&gss_status, &gss_send_token);
  205. gss_release_buffer(&gss_status, &gss_recv_token);
  206. if(gss_major_status != GSS_S_CONTINUE_NEEDED)
  207. break;
  208. /* analyse response */
  209. /* GSS-API response looks like
  210. * +----+------+-----+----------------+
  211. * |VER | MTYP | LEN | TOKEN |
  212. * +----+------+----------------------+
  213. * | 1 | 1 | 2 | up to 2^16 - 1 |
  214. * +----+------+-----+----------------+
  215. */
  216. result = Curl_blockread_all(conn, sock, (char *)socksreq, 4, &actualread);
  217. if(result || (actualread != 4)) {
  218. failf(data, "Failed to receive GSS-API authentication response.");
  219. gss_release_name(&gss_status, &server);
  220. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  221. return CURLE_COULDNT_CONNECT;
  222. }
  223. /* ignore the first (VER) byte */
  224. if(socksreq[1] == 255) { /* status / message type */
  225. failf(data, "User was rejected by the SOCKS5 server (%d %d).",
  226. socksreq[0], socksreq[1]);
  227. gss_release_name(&gss_status, &server);
  228. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  229. return CURLE_COULDNT_CONNECT;
  230. }
  231. if(socksreq[1] != 1) { /* status / messgae type */
  232. failf(data, "Invalid GSS-API authentication response type (%d %d).",
  233. socksreq[0], socksreq[1]);
  234. gss_release_name(&gss_status, &server);
  235. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  236. return CURLE_COULDNT_CONNECT;
  237. }
  238. memcpy(&us_length, socksreq + 2, sizeof(short));
  239. us_length = ntohs(us_length);
  240. gss_recv_token.length = us_length;
  241. gss_recv_token.value = malloc(us_length);
  242. if(!gss_recv_token.value) {
  243. failf(data,
  244. "Could not allocate memory for GSS-API authentication "
  245. "response token.");
  246. gss_release_name(&gss_status, &server);
  247. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  248. return CURLE_OUT_OF_MEMORY;
  249. }
  250. result = Curl_blockread_all(conn, sock, (char *)gss_recv_token.value,
  251. gss_recv_token.length, &actualread);
  252. if(result || (actualread != us_length)) {
  253. failf(data, "Failed to receive GSS-API authentication token.");
  254. gss_release_name(&gss_status, &server);
  255. gss_release_buffer(&gss_status, &gss_recv_token);
  256. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  257. return CURLE_COULDNT_CONNECT;
  258. }
  259. gss_token = &gss_recv_token;
  260. }
  261. gss_release_name(&gss_status, &server);
  262. /* Everything is good so far, user was authenticated! */
  263. gss_major_status = gss_inquire_context(&gss_minor_status, gss_context,
  264. &gss_client_name, NULL, NULL, NULL,
  265. NULL, NULL, NULL);
  266. if(check_gss_err(data, gss_major_status,
  267. gss_minor_status, "gss_inquire_context")) {
  268. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  269. gss_release_name(&gss_status, &gss_client_name);
  270. failf(data, "Failed to determine user name.");
  271. return CURLE_COULDNT_CONNECT;
  272. }
  273. gss_major_status = gss_display_name(&gss_minor_status, gss_client_name,
  274. &gss_send_token, NULL);
  275. if(check_gss_err(data, gss_major_status,
  276. gss_minor_status, "gss_display_name")) {
  277. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  278. gss_release_name(&gss_status, &gss_client_name);
  279. gss_release_buffer(&gss_status, &gss_send_token);
  280. failf(data, "Failed to determine user name.");
  281. return CURLE_COULDNT_CONNECT;
  282. }
  283. user = malloc(gss_send_token.length + 1);
  284. if(!user) {
  285. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  286. gss_release_name(&gss_status, &gss_client_name);
  287. gss_release_buffer(&gss_status, &gss_send_token);
  288. return CURLE_OUT_OF_MEMORY;
  289. }
  290. memcpy(user, gss_send_token.value, gss_send_token.length);
  291. user[gss_send_token.length] = '\0';
  292. gss_release_name(&gss_status, &gss_client_name);
  293. gss_release_buffer(&gss_status, &gss_send_token);
  294. infof(data, "SOCKS5 server authenticated user %s with GSS-API.\n",user);
  295. free(user);
  296. user = NULL;
  297. /* Do encryption */
  298. socksreq[0] = 1; /* GSS-API subnegotiation version */
  299. socksreq[1] = 2; /* encryption message type */
  300. gss_enc = 0; /* no data protection */
  301. /* do confidentiality protection if supported */
  302. if(gss_ret_flags & GSS_C_CONF_FLAG)
  303. gss_enc = 2;
  304. /* else do integrity protection */
  305. else if(gss_ret_flags & GSS_C_INTEG_FLAG)
  306. gss_enc = 1;
  307. infof(data, "SOCKS5 server supports GSS-API %s data protection.\n",
  308. (gss_enc == 0)?"no":((gss_enc==1)?"integrity":"confidentiality"));
  309. /* force for the moment to no data protection */
  310. gss_enc = 0;
  311. /*
  312. * Sending the encryption type in clear seems wrong. It should be
  313. * protected with gss_seal()/gss_wrap(). See RFC1961 extract below
  314. * The NEC reference implementations on which this is based is
  315. * therefore at fault
  316. *
  317. * +------+------+------+.......................+
  318. * + ver | mtyp | len | token |
  319. * +------+------+------+.......................+
  320. * + 0x01 | 0x02 | 0x02 | up to 2^16 - 1 octets |
  321. * +------+------+------+.......................+
  322. *
  323. * Where:
  324. *
  325. * - "ver" is the protocol version number, here 1 to represent the
  326. * first version of the SOCKS/GSS-API protocol
  327. *
  328. * - "mtyp" is the message type, here 2 to represent a protection
  329. * -level negotiation message
  330. *
  331. * - "len" is the length of the "token" field in octets
  332. *
  333. * - "token" is the GSS-API encapsulated protection level
  334. *
  335. * The token is produced by encapsulating an octet containing the
  336. * required protection level using gss_seal()/gss_wrap() with conf_req
  337. * set to FALSE. The token is verified using gss_unseal()/
  338. * gss_unwrap().
  339. *
  340. */
  341. if(data->set.socks5_gssapi_nec) {
  342. us_length = htons((short)1);
  343. memcpy(socksreq + 2, &us_length, sizeof(short));
  344. }
  345. else {
  346. gss_send_token.length = 1;
  347. gss_send_token.value = malloc(1);
  348. if(!gss_send_token.value) {
  349. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  350. return CURLE_OUT_OF_MEMORY;
  351. }
  352. memcpy(gss_send_token.value, &gss_enc, 1);
  353. gss_major_status = gss_wrap(&gss_minor_status, gss_context, 0,
  354. GSS_C_QOP_DEFAULT, &gss_send_token,
  355. &gss_conf_state, &gss_w_token);
  356. if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_wrap")) {
  357. gss_release_buffer(&gss_status, &gss_send_token);
  358. gss_release_buffer(&gss_status, &gss_w_token);
  359. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  360. failf(data, "Failed to wrap GSS-API encryption value into token.");
  361. return CURLE_COULDNT_CONNECT;
  362. }
  363. gss_release_buffer(&gss_status, &gss_send_token);
  364. us_length = htons((short)gss_w_token.length);
  365. memcpy(socksreq + 2, &us_length, sizeof(short));
  366. }
  367. code = Curl_write_plain(conn, sock, (char *)socksreq, 4, &written);
  368. if(code || (4 != written)) {
  369. failf(data, "Failed to send GSS-API encryption request.");
  370. gss_release_buffer(&gss_status, &gss_w_token);
  371. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  372. return CURLE_COULDNT_CONNECT;
  373. }
  374. if(data->set.socks5_gssapi_nec) {
  375. memcpy(socksreq, &gss_enc, 1);
  376. code = Curl_write_plain(conn, sock, socksreq, 1, &written);
  377. if(code || ( 1 != written)) {
  378. failf(data, "Failed to send GSS-API encryption type.");
  379. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  380. return CURLE_COULDNT_CONNECT;
  381. }
  382. }
  383. else {
  384. code = Curl_write_plain(conn, sock, (char *)gss_w_token.value,
  385. gss_w_token.length, &written);
  386. if(code || ((ssize_t)gss_w_token.length != written)) {
  387. failf(data, "Failed to send GSS-API encryption type.");
  388. gss_release_buffer(&gss_status, &gss_w_token);
  389. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  390. return CURLE_COULDNT_CONNECT;
  391. }
  392. gss_release_buffer(&gss_status, &gss_w_token);
  393. }
  394. result = Curl_blockread_all(conn, sock, (char *)socksreq, 4, &actualread);
  395. if(result || (actualread != 4)) {
  396. failf(data, "Failed to receive GSS-API encryption response.");
  397. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  398. return CURLE_COULDNT_CONNECT;
  399. }
  400. /* ignore the first (VER) byte */
  401. if(socksreq[1] == 255) { /* status / message type */
  402. failf(data, "User was rejected by the SOCKS5 server (%d %d).",
  403. socksreq[0], socksreq[1]);
  404. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  405. return CURLE_COULDNT_CONNECT;
  406. }
  407. if(socksreq[1] != 2) { /* status / messgae type */
  408. failf(data, "Invalid GSS-API encryption response type (%d %d).",
  409. socksreq[0], socksreq[1]);
  410. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  411. return CURLE_COULDNT_CONNECT;
  412. }
  413. memcpy(&us_length, socksreq + 2, sizeof(short));
  414. us_length = ntohs(us_length);
  415. gss_recv_token.length = us_length;
  416. gss_recv_token.value = malloc(gss_recv_token.length);
  417. if(!gss_recv_token.value) {
  418. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  419. return CURLE_OUT_OF_MEMORY;
  420. }
  421. result = Curl_blockread_all(conn, sock, (char *)gss_recv_token.value,
  422. gss_recv_token.length, &actualread);
  423. if(result || (actualread != us_length)) {
  424. failf(data, "Failed to receive GSS-API encryptrion type.");
  425. gss_release_buffer(&gss_status, &gss_recv_token);
  426. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  427. return CURLE_COULDNT_CONNECT;
  428. }
  429. if(!data->set.socks5_gssapi_nec) {
  430. gss_major_status = gss_unwrap(&gss_minor_status, gss_context,
  431. &gss_recv_token, &gss_w_token,
  432. 0, GSS_C_QOP_DEFAULT);
  433. if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_unwrap")) {
  434. gss_release_buffer(&gss_status, &gss_recv_token);
  435. gss_release_buffer(&gss_status, &gss_w_token);
  436. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  437. failf(data, "Failed to unwrap GSS-API encryption value into token.");
  438. return CURLE_COULDNT_CONNECT;
  439. }
  440. gss_release_buffer(&gss_status, &gss_recv_token);
  441. if(gss_w_token.length != 1) {
  442. failf(data, "Invalid GSS-API encryption response length (%zu).",
  443. gss_w_token.length);
  444. gss_release_buffer(&gss_status, &gss_w_token);
  445. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  446. return CURLE_COULDNT_CONNECT;
  447. }
  448. memcpy(socksreq, gss_w_token.value, gss_w_token.length);
  449. gss_release_buffer(&gss_status, &gss_w_token);
  450. }
  451. else {
  452. if(gss_recv_token.length != 1) {
  453. failf(data, "Invalid GSS-API encryption response length (%zu).",
  454. gss_recv_token.length);
  455. gss_release_buffer(&gss_status, &gss_recv_token);
  456. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  457. return CURLE_COULDNT_CONNECT;
  458. }
  459. memcpy(socksreq, gss_recv_token.value, gss_recv_token.length);
  460. gss_release_buffer(&gss_status, &gss_recv_token);
  461. }
  462. (void)curlx_nonblock(sock, TRUE);
  463. infof(data, "SOCKS5 access with%s protection granted.\n",
  464. (socksreq[0] == 0)?"out GSS-API data":
  465. ((socksreq[0] == 1)?" GSS-API integrity":" GSS-API confidentiality"));
  466. conn->socks5_gssapi_enctype = socksreq[0];
  467. if(socksreq[0] == 0)
  468. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  469. return CURLE_OK;
  470. }
  471. #endif /* HAVE_GSSAPI && !CURL_DISABLE_PROXY */