spnego_gssapi.c 8.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. * RFC4178 Simple and Protected GSS-API Negotiation Mechanism
  24. *
  25. ***************************************************************************/
  26. #include "curl_setup.h"
  27. #if defined(HAVE_GSSAPI) && defined(USE_SPNEGO)
  28. #include <curl/curl.h>
  29. #include "vauth/vauth.h"
  30. #include "urldata.h"
  31. #include "curl_base64.h"
  32. #include "curl_gssapi.h"
  33. #include "warnless.h"
  34. #include "curl_multibyte.h"
  35. #include "sendf.h"
  36. /* The last #include files should be: */
  37. #include "curl_memory.h"
  38. #include "memdebug.h"
  39. /*
  40. * Curl_auth_is_spnego_supported()
  41. *
  42. * This is used to evaluate if SPNEGO (Negotiate) is supported.
  43. *
  44. * Parameters: None
  45. *
  46. * Returns TRUE if Negotiate supported by the GSS-API library.
  47. */
  48. bool Curl_auth_is_spnego_supported(void)
  49. {
  50. return TRUE;
  51. }
  52. /*
  53. * Curl_auth_decode_spnego_message()
  54. *
  55. * This is used to decode an already encoded SPNEGO (Negotiate) challenge
  56. * message.
  57. *
  58. * Parameters:
  59. *
  60. * data [in] - The session handle.
  61. * userp [in] - The user name in the format User or Domain\User.
  62. * passwdp [in] - The user's password.
  63. * service [in] - The service type such as http, smtp, pop or imap.
  64. * host [in] - The host name.
  65. * chlg64 [in] - The optional base64 encoded challenge message.
  66. * nego [in/out] - The Negotiate data struct being used and modified.
  67. *
  68. * Returns CURLE_OK on success.
  69. */
  70. CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
  71. const char *user,
  72. const char *password,
  73. const char *service,
  74. const char *host,
  75. const char *chlg64,
  76. struct negotiatedata *nego)
  77. {
  78. CURLcode result = CURLE_OK;
  79. size_t chlglen = 0;
  80. unsigned char *chlg = NULL;
  81. OM_uint32 major_status;
  82. OM_uint32 minor_status;
  83. OM_uint32 unused_status;
  84. gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
  85. gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
  86. gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
  87. (void) user;
  88. (void) password;
  89. if(nego->context && nego->status == GSS_S_COMPLETE) {
  90. /* We finished successfully our part of authentication, but server
  91. * rejected it (since we're again here). Exit with an error since we
  92. * can't invent anything better */
  93. Curl_auth_cleanup_spnego(nego);
  94. return CURLE_LOGIN_DENIED;
  95. }
  96. if(!nego->spn) {
  97. /* Generate our SPN */
  98. char *spn = Curl_auth_build_spn(service, NULL, host);
  99. if(!spn)
  100. return CURLE_OUT_OF_MEMORY;
  101. /* Populate the SPN structure */
  102. spn_token.value = spn;
  103. spn_token.length = strlen(spn);
  104. /* Import the SPN */
  105. major_status = gss_import_name(&minor_status, &spn_token,
  106. GSS_C_NT_HOSTBASED_SERVICE,
  107. &nego->spn);
  108. if(GSS_ERROR(major_status)) {
  109. Curl_gss_log_error(data, "gss_import_name() failed: ",
  110. major_status, minor_status);
  111. free(spn);
  112. return CURLE_AUTH_ERROR;
  113. }
  114. free(spn);
  115. }
  116. if(chlg64 && *chlg64) {
  117. /* Decode the base-64 encoded challenge message */
  118. if(*chlg64 != '=') {
  119. result = Curl_base64_decode(chlg64, &chlg, &chlglen);
  120. if(result)
  121. return result;
  122. }
  123. /* Ensure we have a valid challenge message */
  124. if(!chlg) {
  125. infof(data, "SPNEGO handshake failure (empty challenge message)");
  126. return CURLE_BAD_CONTENT_ENCODING;
  127. }
  128. /* Setup the challenge "input" security buffer */
  129. input_token.value = chlg;
  130. input_token.length = chlglen;
  131. }
  132. /* Generate our challenge-response message */
  133. major_status = Curl_gss_init_sec_context(data,
  134. &minor_status,
  135. &nego->context,
  136. nego->spn,
  137. &Curl_spnego_mech_oid,
  138. GSS_C_NO_CHANNEL_BINDINGS,
  139. &input_token,
  140. &output_token,
  141. TRUE,
  142. NULL);
  143. /* Free the decoded challenge as it is not required anymore */
  144. Curl_safefree(input_token.value);
  145. nego->status = major_status;
  146. if(GSS_ERROR(major_status)) {
  147. if(output_token.value)
  148. gss_release_buffer(&unused_status, &output_token);
  149. Curl_gss_log_error(data, "gss_init_sec_context() failed: ",
  150. major_status, minor_status);
  151. return CURLE_AUTH_ERROR;
  152. }
  153. if(!output_token.value || !output_token.length) {
  154. if(output_token.value)
  155. gss_release_buffer(&unused_status, &output_token);
  156. return CURLE_AUTH_ERROR;
  157. }
  158. /* Free previous token */
  159. if(nego->output_token.length && nego->output_token.value)
  160. gss_release_buffer(&unused_status, &nego->output_token);
  161. nego->output_token = output_token;
  162. return CURLE_OK;
  163. }
  164. /*
  165. * Curl_auth_create_spnego_message()
  166. *
  167. * This is used to generate an already encoded SPNEGO (Negotiate) response
  168. * message ready for sending to the recipient.
  169. *
  170. * Parameters:
  171. *
  172. * data [in] - The session handle.
  173. * nego [in/out] - The Negotiate data struct being used and modified.
  174. * outptr [in/out] - The address where a pointer to newly allocated memory
  175. * holding the result will be stored upon completion.
  176. * outlen [out] - The length of the output message.
  177. *
  178. * Returns CURLE_OK on success.
  179. */
  180. CURLcode Curl_auth_create_spnego_message(struct negotiatedata *nego,
  181. char **outptr, size_t *outlen)
  182. {
  183. CURLcode result;
  184. OM_uint32 minor_status;
  185. /* Base64 encode the already generated response */
  186. result = Curl_base64_encode(nego->output_token.value,
  187. nego->output_token.length,
  188. outptr, outlen);
  189. if(result) {
  190. gss_release_buffer(&minor_status, &nego->output_token);
  191. nego->output_token.value = NULL;
  192. nego->output_token.length = 0;
  193. return result;
  194. }
  195. if(!*outptr || !*outlen) {
  196. gss_release_buffer(&minor_status, &nego->output_token);
  197. nego->output_token.value = NULL;
  198. nego->output_token.length = 0;
  199. return CURLE_REMOTE_ACCESS_DENIED;
  200. }
  201. return CURLE_OK;
  202. }
  203. /*
  204. * Curl_auth_cleanup_spnego()
  205. *
  206. * This is used to clean up the SPNEGO (Negotiate) specific data.
  207. *
  208. * Parameters:
  209. *
  210. * nego [in/out] - The Negotiate data struct being cleaned up.
  211. *
  212. */
  213. void Curl_auth_cleanup_spnego(struct negotiatedata *nego)
  214. {
  215. OM_uint32 minor_status;
  216. /* Free our security context */
  217. if(nego->context != GSS_C_NO_CONTEXT) {
  218. gss_delete_sec_context(&minor_status, &nego->context, GSS_C_NO_BUFFER);
  219. nego->context = GSS_C_NO_CONTEXT;
  220. }
  221. /* Free the output token */
  222. if(nego->output_token.value) {
  223. gss_release_buffer(&minor_status, &nego->output_token);
  224. nego->output_token.value = NULL;
  225. nego->output_token.length = 0;
  226. }
  227. /* Free the SPN */
  228. if(nego->spn != GSS_C_NO_NAME) {
  229. gss_release_name(&minor_status, &nego->spn);
  230. nego->spn = GSS_C_NO_NAME;
  231. }
  232. /* Reset any variables */
  233. nego->status = 0;
  234. nego->noauthpersist = FALSE;
  235. nego->havenoauthpersist = FALSE;
  236. nego->havenegdata = FALSE;
  237. nego->havemultiplerequests = FALSE;
  238. }
  239. #endif /* HAVE_GSSAPI && USE_SPNEGO */