2
0

stub_gssapi.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. /* Only provides the bare minimum to link with libcurl */
  25. #include <stdio.h>
  26. #include <stdlib.h>
  27. #include <string.h>
  28. #include "stub_gssapi.h"
  29. /* !checksrc! disable SNPRINTF all */
  30. #define MAX_CREDS_LENGTH 250
  31. #define APPROX_TOKEN_LEN 250
  32. enum min_err_code {
  33. GSS_OK = 0,
  34. GSS_NO_MEMORY,
  35. GSS_INVALID_ARGS,
  36. GSS_INVALID_CREDS,
  37. GSS_INVALID_CTX,
  38. GSS_SERVER_ERR,
  39. GSS_NO_MECH,
  40. GSS_LAST
  41. };
  42. static const char *min_err_table[] = {
  43. "stub-gss: no error",
  44. "stub-gss: no memory",
  45. "stub-gss: invalid arguments",
  46. "stub-gss: invalid credentials",
  47. "stub-gss: invalid context",
  48. "stub-gss: server returned error",
  49. "stub-gss: cannot find a mechanism",
  50. NULL
  51. };
  52. struct gss_ctx_id_t_desc_struct {
  53. enum { NONE, KRB5, NTLM1, NTLM3 } sent;
  54. int have_krb5;
  55. int have_ntlm;
  56. OM_uint32 flags;
  57. char creds[MAX_CREDS_LENGTH];
  58. };
  59. /* simple implementation of strndup(), which isn't portable */
  60. static char *my_strndup(const char *ptr, size_t len)
  61. {
  62. char *copy = malloc(len + 1);
  63. if(!copy)
  64. return NULL;
  65. memcpy(copy, ptr, len);
  66. copy[len] = '\0';
  67. return copy;
  68. }
  69. OM_uint32 gss_init_sec_context(OM_uint32 *min,
  70. gss_const_cred_id_t initiator_cred_handle,
  71. gss_ctx_id_t *context_handle,
  72. gss_const_name_t target_name,
  73. const gss_OID mech_type,
  74. OM_uint32 req_flags,
  75. OM_uint32 time_req,
  76. const gss_channel_bindings_t input_chan_bindings,
  77. const gss_buffer_t input_token,
  78. gss_OID *actual_mech_type,
  79. gss_buffer_t output_token,
  80. OM_uint32 *ret_flags,
  81. OM_uint32 *time_rec)
  82. {
  83. /* The token will be encoded in base64 */
  84. size_t length = APPROX_TOKEN_LEN * 3 / 4;
  85. size_t used = 0;
  86. char *token = NULL;
  87. const char *creds = NULL;
  88. gss_ctx_id_t ctx = NULL;
  89. (void)initiator_cred_handle;
  90. (void)mech_type;
  91. (void)time_req;
  92. (void)input_chan_bindings;
  93. (void)actual_mech_type;
  94. if(!min)
  95. return GSS_S_FAILURE;
  96. *min = 0;
  97. if(!context_handle || !target_name || !output_token) {
  98. *min = GSS_INVALID_ARGS;
  99. return GSS_S_FAILURE;
  100. }
  101. creds = getenv("CURL_STUB_GSS_CREDS");
  102. if(!creds || strlen(creds) >= MAX_CREDS_LENGTH) {
  103. *min = GSS_INVALID_CREDS;
  104. return GSS_S_FAILURE;
  105. }
  106. ctx = *context_handle;
  107. if(ctx && strcmp(ctx->creds, creds)) {
  108. *min = GSS_INVALID_CREDS;
  109. return GSS_S_FAILURE;
  110. }
  111. output_token->length = 0;
  112. output_token->value = NULL;
  113. if(input_token && input_token->length) {
  114. if(!ctx) {
  115. *min = GSS_INVALID_CTX;
  116. return GSS_S_FAILURE;
  117. }
  118. /* Server response, either D (RA==) or C (Qw==) */
  119. if(((char *) input_token->value)[0] == 'D') {
  120. /* Done */
  121. switch(ctx->sent) {
  122. case KRB5:
  123. case NTLM3:
  124. if(ret_flags)
  125. *ret_flags = ctx->flags;
  126. if(time_rec)
  127. *time_rec = GSS_C_INDEFINITE;
  128. return GSS_S_COMPLETE;
  129. default:
  130. *min = GSS_SERVER_ERR;
  131. return GSS_S_FAILURE;
  132. }
  133. }
  134. if(((char *) input_token->value)[0] != 'C') {
  135. /* We only support Done or Continue */
  136. *min = GSS_SERVER_ERR;
  137. return GSS_S_FAILURE;
  138. }
  139. /* Continue */
  140. switch(ctx->sent) {
  141. case KRB5:
  142. /* We sent KRB5 and it failed, let's try NTLM */
  143. if(ctx->have_ntlm) {
  144. ctx->sent = NTLM1;
  145. break;
  146. }
  147. else {
  148. *min = GSS_SERVER_ERR;
  149. return GSS_S_FAILURE;
  150. }
  151. case NTLM1:
  152. ctx->sent = NTLM3;
  153. break;
  154. default:
  155. *min = GSS_SERVER_ERR;
  156. return GSS_S_FAILURE;
  157. }
  158. }
  159. else {
  160. if(ctx) {
  161. *min = GSS_INVALID_CTX;
  162. return GSS_S_FAILURE;
  163. }
  164. ctx = (gss_ctx_id_t) calloc(1, sizeof(*ctx));
  165. if(!ctx) {
  166. *min = GSS_NO_MEMORY;
  167. return GSS_S_FAILURE;
  168. }
  169. if(strstr(creds, "KRB5"))
  170. ctx->have_krb5 = 1;
  171. if(strstr(creds, "NTLM"))
  172. ctx->have_ntlm = 1;
  173. if(ctx->have_krb5)
  174. ctx->sent = KRB5;
  175. else if(ctx->have_ntlm)
  176. ctx->sent = NTLM1;
  177. else {
  178. free(ctx);
  179. *min = GSS_NO_MECH;
  180. return GSS_S_FAILURE;
  181. }
  182. strcpy(ctx->creds, creds);
  183. ctx->flags = req_flags;
  184. }
  185. token = malloc(length);
  186. if(!token) {
  187. free(ctx);
  188. *min = GSS_NO_MEMORY;
  189. return GSS_S_FAILURE;
  190. }
  191. /* Token format: creds:target:type:padding */
  192. /* Note: this is using the *real* snprintf() and not the curl provided
  193. one */
  194. used = (size_t) snprintf(token, length, "%s:%s:%d:", creds,
  195. (char *) target_name, ctx->sent);
  196. if(used >= length) {
  197. free(token);
  198. free(ctx);
  199. *min = GSS_NO_MEMORY;
  200. return GSS_S_FAILURE;
  201. }
  202. /* Overwrite null terminator */
  203. memset(token + used, 'A', length - used);
  204. *context_handle = ctx;
  205. output_token->value = token;
  206. output_token->length = length;
  207. return GSS_S_CONTINUE_NEEDED;
  208. }
  209. OM_uint32 gss_delete_sec_context(OM_uint32 *min,
  210. gss_ctx_id_t *context_handle,
  211. gss_buffer_t output_token)
  212. {
  213. (void)output_token;
  214. if(!min)
  215. return GSS_S_FAILURE;
  216. if(!context_handle) {
  217. *min = GSS_INVALID_CTX;
  218. return GSS_S_FAILURE;
  219. }
  220. free(*context_handle);
  221. *context_handle = NULL;
  222. *min = 0;
  223. return GSS_S_COMPLETE;
  224. }
  225. OM_uint32 gss_release_buffer(OM_uint32 *min,
  226. gss_buffer_t buffer)
  227. {
  228. if(min)
  229. *min = 0;
  230. if(buffer && buffer->length) {
  231. free(buffer->value);
  232. buffer->length = 0;
  233. }
  234. return GSS_S_COMPLETE;
  235. }
  236. OM_uint32 gss_import_name(OM_uint32 *min,
  237. const gss_buffer_t input_name_buffer,
  238. const gss_OID input_name_type,
  239. gss_name_t *output_name)
  240. {
  241. char *name = NULL;
  242. (void)input_name_type;
  243. if(!min)
  244. return GSS_S_FAILURE;
  245. if(!input_name_buffer || !output_name) {
  246. *min = GSS_INVALID_ARGS;
  247. return GSS_S_FAILURE;
  248. }
  249. name = my_strndup(input_name_buffer->value, input_name_buffer->length);
  250. if(!name) {
  251. *min = GSS_NO_MEMORY;
  252. return GSS_S_FAILURE;
  253. }
  254. *output_name = (gss_name_t) name;
  255. *min = 0;
  256. return GSS_S_COMPLETE;
  257. }
  258. OM_uint32 gss_release_name(OM_uint32 *min,
  259. gss_name_t *input_name)
  260. {
  261. if(min)
  262. *min = 0;
  263. if(input_name)
  264. free(*input_name);
  265. return GSS_S_COMPLETE;
  266. }
  267. OM_uint32 gss_display_status(OM_uint32 *min,
  268. OM_uint32 status_value,
  269. int status_type,
  270. const gss_OID mech_type,
  271. OM_uint32 *message_context,
  272. gss_buffer_t status_string)
  273. {
  274. const char maj_str[] = "Stub GSS error";
  275. (void)mech_type;
  276. if(min)
  277. *min = 0;
  278. if(message_context)
  279. *message_context = 0;
  280. if(status_string) {
  281. status_string->value = NULL;
  282. status_string->length = 0;
  283. if(status_value >= GSS_LAST)
  284. return GSS_S_FAILURE;
  285. switch(status_type) {
  286. case GSS_C_GSS_CODE:
  287. status_string->value = strdup(maj_str);
  288. break;
  289. case GSS_C_MECH_CODE:
  290. status_string->value = strdup(min_err_table[status_value]);
  291. break;
  292. default:
  293. return GSS_S_FAILURE;
  294. }
  295. if(status_string->value)
  296. status_string->length = strlen(status_string->value);
  297. else
  298. return GSS_S_FAILURE;
  299. }
  300. return GSS_S_COMPLETE;
  301. }
  302. /* Stubs returning error */
  303. OM_uint32 gss_display_name(OM_uint32 *min,
  304. gss_const_name_t input_name,
  305. gss_buffer_t output_name_buffer,
  306. gss_OID *output_name_type)
  307. {
  308. (void)min;
  309. (void)input_name;
  310. (void)output_name_buffer;
  311. (void)output_name_type;
  312. return GSS_S_FAILURE;
  313. }
  314. OM_uint32 gss_inquire_context(OM_uint32 *min,
  315. gss_const_ctx_id_t context_handle,
  316. gss_name_t *src_name,
  317. gss_name_t *targ_name,
  318. OM_uint32 *lifetime_rec,
  319. gss_OID *mech_type,
  320. OM_uint32 *ctx_flags,
  321. int *locally_initiated,
  322. int *open_context)
  323. {
  324. (void)min;
  325. (void)context_handle;
  326. (void)src_name;
  327. (void)targ_name;
  328. (void)lifetime_rec;
  329. (void)mech_type;
  330. (void)ctx_flags;
  331. (void)locally_initiated;
  332. (void)open_context;
  333. return GSS_S_FAILURE;
  334. }
  335. OM_uint32 gss_wrap(OM_uint32 *min,
  336. gss_const_ctx_id_t context_handle,
  337. int conf_req_flag,
  338. gss_qop_t qop_req,
  339. const gss_buffer_t input_message_buffer,
  340. int *conf_state,
  341. gss_buffer_t output_message_buffer)
  342. {
  343. (void)min;
  344. (void)context_handle;
  345. (void)conf_req_flag;
  346. (void)qop_req;
  347. (void)input_message_buffer;
  348. (void)conf_state;
  349. (void)output_message_buffer;
  350. return GSS_S_FAILURE;
  351. }
  352. OM_uint32 gss_unwrap(OM_uint32 *min,
  353. gss_const_ctx_id_t context_handle,
  354. const gss_buffer_t input_message_buffer,
  355. gss_buffer_t output_message_buffer,
  356. int *conf_state,
  357. gss_qop_t *qop_state)
  358. {
  359. (void)min;
  360. (void)context_handle;
  361. (void)input_message_buffer;
  362. (void)output_message_buffer;
  363. (void)conf_state;
  364. (void)qop_state;
  365. return GSS_S_FAILURE;
  366. }
  367. OM_uint32 gss_seal(OM_uint32 *min,
  368. gss_ctx_id_t context_handle,
  369. int conf_req_flag,
  370. int qop_req,
  371. gss_buffer_t input_message_buffer,
  372. int *conf_state,
  373. gss_buffer_t output_message_buffer)
  374. {
  375. (void)min;
  376. (void)context_handle;
  377. (void)conf_req_flag;
  378. (void)qop_req;
  379. (void)input_message_buffer;
  380. (void)conf_state;
  381. (void)output_message_buffer;
  382. return GSS_S_FAILURE;
  383. }
  384. OM_uint32 gss_unseal(OM_uint32 *min,
  385. gss_ctx_id_t context_handle,
  386. gss_buffer_t input_message_buffer,
  387. gss_buffer_t output_message_buffer,
  388. int *conf_state,
  389. int *qop_state)
  390. {
  391. (void)min;
  392. (void)context_handle;
  393. (void)input_message_buffer;
  394. (void)output_message_buffer;
  395. (void)conf_state;
  396. (void)qop_state;
  397. return GSS_S_FAILURE;
  398. }