2
0

socks_gssapi.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. * Copyright (C) Markus Moeller, <markus_moeller@compuserve.com>
  10. *
  11. * This software is licensed as described in the file COPYING, which
  12. * you should have received as part of this distribution. The terms
  13. * are also available at https://curl.se/docs/copyright.html.
  14. *
  15. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16. * copies of the Software, and permit persons to whom the Software is
  17. * furnished to do so, under the terms of the COPYING file.
  18. *
  19. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20. * KIND, either express or implied.
  21. *
  22. * SPDX-License-Identifier: curl
  23. *
  24. ***************************************************************************/
  25. #include "curl_setup.h"
  26. #if defined(HAVE_GSSAPI) && !defined(CURL_DISABLE_PROXY)
  27. #include "curl_gssapi.h"
  28. #include "urldata.h"
  29. #include "sendf.h"
  30. #include "cfilters.h"
  31. #include "connect.h"
  32. #include "timeval.h"
  33. #include "socks.h"
  34. #include "warnless.h"
  35. #include "strdup.h"
  36. /* The last 3 #include files should be in this order */
  37. #include "curl_printf.h"
  38. #include "curl_memory.h"
  39. #include "memdebug.h"
  40. static gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
  41. /*
  42. * Helper GSS-API error functions.
  43. */
  44. static int check_gss_err(struct Curl_easy *data,
  45. OM_uint32 major_status,
  46. OM_uint32 minor_status,
  47. const char *function)
  48. {
  49. if(GSS_ERROR(major_status)) {
  50. OM_uint32 maj_stat, min_stat;
  51. OM_uint32 msg_ctx = 0;
  52. gss_buffer_desc status_string = GSS_C_EMPTY_BUFFER;
  53. char buf[1024];
  54. size_t len;
  55. len = 0;
  56. msg_ctx = 0;
  57. while(!msg_ctx) {
  58. /* convert major status code (GSS-API error) to text */
  59. maj_stat = gss_display_status(&min_stat, major_status,
  60. GSS_C_GSS_CODE,
  61. GSS_C_NULL_OID,
  62. &msg_ctx, &status_string);
  63. if(maj_stat == GSS_S_COMPLETE) {
  64. if(sizeof(buf) > len + status_string.length + 1) {
  65. strcpy(buf + len, (char *) status_string.value);
  66. len += status_string.length;
  67. }
  68. gss_release_buffer(&min_stat, &status_string);
  69. break;
  70. }
  71. gss_release_buffer(&min_stat, &status_string);
  72. }
  73. if(sizeof(buf) > len + 3) {
  74. strcpy(buf + len, ".\n");
  75. len += 2;
  76. }
  77. msg_ctx = 0;
  78. while(!msg_ctx) {
  79. /* convert minor status code (underlying routine error) to text */
  80. maj_stat = gss_display_status(&min_stat, minor_status,
  81. GSS_C_MECH_CODE,
  82. GSS_C_NULL_OID,
  83. &msg_ctx, &status_string);
  84. if(maj_stat == GSS_S_COMPLETE) {
  85. if(sizeof(buf) > len + status_string.length)
  86. strcpy(buf + len, (char *) status_string.value);
  87. gss_release_buffer(&min_stat, &status_string);
  88. break;
  89. }
  90. gss_release_buffer(&min_stat, &status_string);
  91. }
  92. failf(data, "GSS-API error: %s failed: %s", function, buf);
  93. return 1;
  94. }
  95. return 0;
  96. }
  97. CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
  98. struct Curl_easy *data)
  99. {
  100. struct connectdata *conn = cf->conn;
  101. curl_socket_t sock = conn->sock[cf->sockindex];
  102. CURLcode code;
  103. ssize_t actualread;
  104. ssize_t nwritten;
  105. int result;
  106. OM_uint32 gss_major_status, gss_minor_status, gss_status;
  107. OM_uint32 gss_ret_flags;
  108. int gss_conf_state, gss_enc;
  109. gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
  110. gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
  111. gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
  112. gss_buffer_desc gss_w_token = GSS_C_EMPTY_BUFFER;
  113. gss_buffer_desc *gss_token = GSS_C_NO_BUFFER;
  114. gss_name_t server = GSS_C_NO_NAME;
  115. gss_name_t gss_client_name = GSS_C_NO_NAME;
  116. unsigned short us_length;
  117. char *user = NULL;
  118. unsigned char socksreq[4]; /* room for GSS-API exchange header only */
  119. const char *serviceptr = data->set.str[STRING_PROXY_SERVICE_NAME] ?
  120. data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd";
  121. const size_t serviceptr_length = strlen(serviceptr);
  122. /* GSS-API request looks like
  123. * +----+------+-----+----------------+
  124. * |VER | MTYP | LEN | TOKEN |
  125. * +----+------+----------------------+
  126. * | 1 | 1 | 2 | up to 2^16 - 1 |
  127. * +----+------+-----+----------------+
  128. */
  129. /* prepare service name */
  130. if(strchr(serviceptr, '/')) {
  131. service.length = serviceptr_length;
  132. service.value = Curl_memdup(serviceptr, service.length);
  133. if(!service.value)
  134. return CURLE_OUT_OF_MEMORY;
  135. gss_major_status = gss_import_name(&gss_minor_status, &service,
  136. (gss_OID) GSS_C_NULL_OID, &server);
  137. }
  138. else {
  139. service.value = malloc(serviceptr_length +
  140. strlen(conn->socks_proxy.host.name) + 2);
  141. if(!service.value)
  142. return CURLE_OUT_OF_MEMORY;
  143. service.length = serviceptr_length +
  144. strlen(conn->socks_proxy.host.name) + 1;
  145. msnprintf(service.value, service.length + 1, "%s@%s",
  146. serviceptr, conn->socks_proxy.host.name);
  147. gss_major_status = gss_import_name(&gss_minor_status, &service,
  148. GSS_C_NT_HOSTBASED_SERVICE, &server);
  149. }
  150. gss_release_buffer(&gss_status, &service); /* clear allocated memory */
  151. if(check_gss_err(data, gss_major_status,
  152. gss_minor_status, "gss_import_name()")) {
  153. failf(data, "Failed to create service name.");
  154. gss_release_name(&gss_status, &server);
  155. return CURLE_COULDNT_CONNECT;
  156. }
  157. (void)curlx_nonblock(sock, FALSE);
  158. /* As long as we need to keep sending some context info, and there's no */
  159. /* errors, keep sending it... */
  160. for(;;) {
  161. gss_major_status = Curl_gss_init_sec_context(data,
  162. &gss_minor_status,
  163. &gss_context,
  164. server,
  165. &Curl_krb5_mech_oid,
  166. NULL,
  167. gss_token,
  168. &gss_send_token,
  169. TRUE,
  170. &gss_ret_flags);
  171. if(gss_token != GSS_C_NO_BUFFER)
  172. gss_release_buffer(&gss_status, &gss_recv_token);
  173. if(check_gss_err(data, gss_major_status,
  174. gss_minor_status, "gss_init_sec_context")) {
  175. gss_release_name(&gss_status, &server);
  176. gss_release_buffer(&gss_status, &gss_recv_token);
  177. gss_release_buffer(&gss_status, &gss_send_token);
  178. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  179. failf(data, "Failed to initial GSS-API token.");
  180. return CURLE_COULDNT_CONNECT;
  181. }
  182. if(gss_send_token.length) {
  183. socksreq[0] = 1; /* GSS-API subnegotiation version */
  184. socksreq[1] = 1; /* authentication message type */
  185. us_length = htons((short)gss_send_token.length);
  186. memcpy(socksreq + 2, &us_length, sizeof(short));
  187. nwritten = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, &code);
  188. if(code || (4 != nwritten)) {
  189. failf(data, "Failed to send GSS-API authentication request.");
  190. gss_release_name(&gss_status, &server);
  191. gss_release_buffer(&gss_status, &gss_recv_token);
  192. gss_release_buffer(&gss_status, &gss_send_token);
  193. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  194. return CURLE_COULDNT_CONNECT;
  195. }
  196. nwritten = Curl_conn_cf_send(cf->next, data,
  197. (char *)gss_send_token.value,
  198. gss_send_token.length, &code);
  199. if(code || ((ssize_t)gss_send_token.length != nwritten)) {
  200. failf(data, "Failed to send GSS-API authentication token.");
  201. gss_release_name(&gss_status, &server);
  202. gss_release_buffer(&gss_status, &gss_recv_token);
  203. gss_release_buffer(&gss_status, &gss_send_token);
  204. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  205. return CURLE_COULDNT_CONNECT;
  206. }
  207. }
  208. gss_release_buffer(&gss_status, &gss_send_token);
  209. gss_release_buffer(&gss_status, &gss_recv_token);
  210. if(gss_major_status != GSS_S_CONTINUE_NEEDED)
  211. break;
  212. /* analyse response */
  213. /* GSS-API response looks like
  214. * +----+------+-----+----------------+
  215. * |VER | MTYP | LEN | TOKEN |
  216. * +----+------+----------------------+
  217. * | 1 | 1 | 2 | up to 2^16 - 1 |
  218. * +----+------+-----+----------------+
  219. */
  220. result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
  221. if(result || (actualread != 4)) {
  222. failf(data, "Failed to receive GSS-API authentication response.");
  223. gss_release_name(&gss_status, &server);
  224. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  225. return CURLE_COULDNT_CONNECT;
  226. }
  227. /* ignore the first (VER) byte */
  228. if(socksreq[1] == 255) { /* status / message type */
  229. failf(data, "User was rejected by the SOCKS5 server (%d %d).",
  230. socksreq[0], socksreq[1]);
  231. gss_release_name(&gss_status, &server);
  232. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  233. return CURLE_COULDNT_CONNECT;
  234. }
  235. if(socksreq[1] != 1) { /* status / message type */
  236. failf(data, "Invalid GSS-API authentication response type (%d %d).",
  237. socksreq[0], socksreq[1]);
  238. gss_release_name(&gss_status, &server);
  239. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  240. return CURLE_COULDNT_CONNECT;
  241. }
  242. memcpy(&us_length, socksreq + 2, sizeof(short));
  243. us_length = ntohs(us_length);
  244. gss_recv_token.length = us_length;
  245. gss_recv_token.value = malloc(us_length);
  246. if(!gss_recv_token.value) {
  247. failf(data,
  248. "Could not allocate memory for GSS-API authentication "
  249. "response token.");
  250. gss_release_name(&gss_status, &server);
  251. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  252. return CURLE_OUT_OF_MEMORY;
  253. }
  254. result = Curl_blockread_all(cf, data, (char *)gss_recv_token.value,
  255. gss_recv_token.length, &actualread);
  256. if(result || (actualread != us_length)) {
  257. failf(data, "Failed to receive GSS-API authentication token.");
  258. gss_release_name(&gss_status, &server);
  259. gss_release_buffer(&gss_status, &gss_recv_token);
  260. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  261. return CURLE_COULDNT_CONNECT;
  262. }
  263. gss_token = &gss_recv_token;
  264. }
  265. gss_release_name(&gss_status, &server);
  266. /* Everything is good so far, user was authenticated! */
  267. gss_major_status = gss_inquire_context(&gss_minor_status, gss_context,
  268. &gss_client_name, NULL, NULL, NULL,
  269. NULL, NULL, NULL);
  270. if(check_gss_err(data, gss_major_status,
  271. gss_minor_status, "gss_inquire_context")) {
  272. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  273. gss_release_name(&gss_status, &gss_client_name);
  274. failf(data, "Failed to determine user name.");
  275. return CURLE_COULDNT_CONNECT;
  276. }
  277. gss_major_status = gss_display_name(&gss_minor_status, gss_client_name,
  278. &gss_send_token, NULL);
  279. if(check_gss_err(data, gss_major_status,
  280. gss_minor_status, "gss_display_name")) {
  281. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  282. gss_release_name(&gss_status, &gss_client_name);
  283. gss_release_buffer(&gss_status, &gss_send_token);
  284. failf(data, "Failed to determine user name.");
  285. return CURLE_COULDNT_CONNECT;
  286. }
  287. user = malloc(gss_send_token.length + 1);
  288. if(!user) {
  289. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  290. gss_release_name(&gss_status, &gss_client_name);
  291. gss_release_buffer(&gss_status, &gss_send_token);
  292. return CURLE_OUT_OF_MEMORY;
  293. }
  294. memcpy(user, gss_send_token.value, gss_send_token.length);
  295. user[gss_send_token.length] = '\0';
  296. gss_release_name(&gss_status, &gss_client_name);
  297. gss_release_buffer(&gss_status, &gss_send_token);
  298. infof(data, "SOCKS5 server authenticated user %s with GSS-API.",user);
  299. free(user);
  300. user = NULL;
  301. /* Do encryption */
  302. socksreq[0] = 1; /* GSS-API subnegotiation version */
  303. socksreq[1] = 2; /* encryption message type */
  304. gss_enc = 0; /* no data protection */
  305. /* do confidentiality protection if supported */
  306. if(gss_ret_flags & GSS_C_CONF_FLAG)
  307. gss_enc = 2;
  308. /* else do integrity protection */
  309. else if(gss_ret_flags & GSS_C_INTEG_FLAG)
  310. gss_enc = 1;
  311. infof(data, "SOCKS5 server supports GSS-API %s data protection.",
  312. (gss_enc == 0)?"no":((gss_enc==1)?"integrity":"confidentiality"));
  313. /* force for the moment to no data protection */
  314. gss_enc = 0;
  315. /*
  316. * Sending the encryption type in clear seems wrong. It should be
  317. * protected with gss_seal()/gss_wrap(). See RFC1961 extract below
  318. * The NEC reference implementations on which this is based is
  319. * therefore at fault
  320. *
  321. * +------+------+------+.......................+
  322. * + ver | mtyp | len | token |
  323. * +------+------+------+.......................+
  324. * + 0x01 | 0x02 | 0x02 | up to 2^16 - 1 octets |
  325. * +------+------+------+.......................+
  326. *
  327. * Where:
  328. *
  329. * - "ver" is the protocol version number, here 1 to represent the
  330. * first version of the SOCKS/GSS-API protocol
  331. *
  332. * - "mtyp" is the message type, here 2 to represent a protection
  333. * -level negotiation message
  334. *
  335. * - "len" is the length of the "token" field in octets
  336. *
  337. * - "token" is the GSS-API encapsulated protection level
  338. *
  339. * The token is produced by encapsulating an octet containing the
  340. * required protection level using gss_seal()/gss_wrap() with conf_req
  341. * set to FALSE. The token is verified using gss_unseal()/
  342. * gss_unwrap().
  343. *
  344. */
  345. if(data->set.socks5_gssapi_nec) {
  346. us_length = htons((short)1);
  347. memcpy(socksreq + 2, &us_length, sizeof(short));
  348. }
  349. else {
  350. gss_send_token.length = 1;
  351. gss_send_token.value = Curl_memdup(&gss_enc, 1);
  352. if(!gss_send_token.value) {
  353. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  354. return CURLE_OUT_OF_MEMORY;
  355. }
  356. gss_major_status = gss_wrap(&gss_minor_status, gss_context, 0,
  357. GSS_C_QOP_DEFAULT, &gss_send_token,
  358. &gss_conf_state, &gss_w_token);
  359. if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_wrap")) {
  360. gss_release_buffer(&gss_status, &gss_send_token);
  361. gss_release_buffer(&gss_status, &gss_w_token);
  362. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  363. failf(data, "Failed to wrap GSS-API encryption value into token.");
  364. return CURLE_COULDNT_CONNECT;
  365. }
  366. gss_release_buffer(&gss_status, &gss_send_token);
  367. us_length = htons((short)gss_w_token.length);
  368. memcpy(socksreq + 2, &us_length, sizeof(short));
  369. }
  370. nwritten = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, &code);
  371. if(code || (4 != nwritten)) {
  372. failf(data, "Failed to send GSS-API encryption request.");
  373. gss_release_buffer(&gss_status, &gss_w_token);
  374. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  375. return CURLE_COULDNT_CONNECT;
  376. }
  377. if(data->set.socks5_gssapi_nec) {
  378. memcpy(socksreq, &gss_enc, 1);
  379. nwritten = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 1, &code);
  380. if(code || ( 1 != nwritten)) {
  381. failf(data, "Failed to send GSS-API encryption type.");
  382. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  383. return CURLE_COULDNT_CONNECT;
  384. }
  385. }
  386. else {
  387. nwritten = Curl_conn_cf_send(cf->next, data,
  388. (char *)gss_w_token.value,
  389. gss_w_token.length, &code);
  390. if(code || ((ssize_t)gss_w_token.length != nwritten)) {
  391. failf(data, "Failed to send GSS-API encryption type.");
  392. gss_release_buffer(&gss_status, &gss_w_token);
  393. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  394. return CURLE_COULDNT_CONNECT;
  395. }
  396. gss_release_buffer(&gss_status, &gss_w_token);
  397. }
  398. result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
  399. if(result || (actualread != 4)) {
  400. failf(data, "Failed to receive GSS-API encryption response.");
  401. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  402. return CURLE_COULDNT_CONNECT;
  403. }
  404. /* ignore the first (VER) byte */
  405. if(socksreq[1] == 255) { /* status / message type */
  406. failf(data, "User was rejected by the SOCKS5 server (%d %d).",
  407. socksreq[0], socksreq[1]);
  408. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  409. return CURLE_COULDNT_CONNECT;
  410. }
  411. if(socksreq[1] != 2) { /* status / message type */
  412. failf(data, "Invalid GSS-API encryption response type (%d %d).",
  413. socksreq[0], socksreq[1]);
  414. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  415. return CURLE_COULDNT_CONNECT;
  416. }
  417. memcpy(&us_length, socksreq + 2, sizeof(short));
  418. us_length = ntohs(us_length);
  419. gss_recv_token.length = us_length;
  420. gss_recv_token.value = malloc(gss_recv_token.length);
  421. if(!gss_recv_token.value) {
  422. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  423. return CURLE_OUT_OF_MEMORY;
  424. }
  425. result = Curl_blockread_all(cf, data, (char *)gss_recv_token.value,
  426. gss_recv_token.length, &actualread);
  427. if(result || (actualread != us_length)) {
  428. failf(data, "Failed to receive GSS-API encryption type.");
  429. gss_release_buffer(&gss_status, &gss_recv_token);
  430. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  431. return CURLE_COULDNT_CONNECT;
  432. }
  433. if(!data->set.socks5_gssapi_nec) {
  434. gss_major_status = gss_unwrap(&gss_minor_status, gss_context,
  435. &gss_recv_token, &gss_w_token,
  436. 0, GSS_C_QOP_DEFAULT);
  437. if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_unwrap")) {
  438. gss_release_buffer(&gss_status, &gss_recv_token);
  439. gss_release_buffer(&gss_status, &gss_w_token);
  440. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  441. failf(data, "Failed to unwrap GSS-API encryption value into token.");
  442. return CURLE_COULDNT_CONNECT;
  443. }
  444. gss_release_buffer(&gss_status, &gss_recv_token);
  445. if(gss_w_token.length != 1) {
  446. failf(data, "Invalid GSS-API encryption response length (%zu).",
  447. gss_w_token.length);
  448. gss_release_buffer(&gss_status, &gss_w_token);
  449. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  450. return CURLE_COULDNT_CONNECT;
  451. }
  452. memcpy(socksreq, gss_w_token.value, gss_w_token.length);
  453. gss_release_buffer(&gss_status, &gss_w_token);
  454. }
  455. else {
  456. if(gss_recv_token.length != 1) {
  457. failf(data, "Invalid GSS-API encryption response length (%zu).",
  458. gss_recv_token.length);
  459. gss_release_buffer(&gss_status, &gss_recv_token);
  460. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  461. return CURLE_COULDNT_CONNECT;
  462. }
  463. memcpy(socksreq, gss_recv_token.value, gss_recv_token.length);
  464. gss_release_buffer(&gss_status, &gss_recv_token);
  465. }
  466. (void)curlx_nonblock(sock, TRUE);
  467. infof(data, "SOCKS5 access with%s protection granted.",
  468. (socksreq[0] == 0)?"out GSS-API data":
  469. ((socksreq[0] == 1)?" GSS-API integrity":" GSS-API confidentiality"));
  470. conn->socks5_gssapi_enctype = socksreq[0];
  471. if(socksreq[0] == 0)
  472. gss_delete_sec_context(&gss_status, &gss_context, NULL);
  473. return CURLE_OK;
  474. }
  475. #endif /* HAVE_GSSAPI && !CURL_DISABLE_PROXY */