spnego_sspi.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. * RFC4178 Simple and Protected GSS-API Negotiation Mechanism
  24. *
  25. ***************************************************************************/
  26. #include "curl_setup.h"
  27. #if defined(USE_WINDOWS_SSPI) && defined(USE_SPNEGO)
  28. #include <curl/curl.h>
  29. #include "vauth/vauth.h"
  30. #include "urldata.h"
  31. #include "curl_base64.h"
  32. #include "warnless.h"
  33. #include "curl_multibyte.h"
  34. #include "sendf.h"
  35. #include "strerror.h"
  36. /* The last #include files should be: */
  37. #include "curl_memory.h"
  38. #include "memdebug.h"
  39. /*
  40. * Curl_auth_is_spnego_supported()
  41. *
  42. * This is used to evaluate if SPNEGO (Negotiate) is supported.
  43. *
  44. * Parameters: None
  45. *
  46. * Returns TRUE if Negotiate is supported by Windows SSPI.
  47. */
  48. bool Curl_auth_is_spnego_supported(void)
  49. {
  50. PSecPkgInfo SecurityPackage;
  51. SECURITY_STATUS status;
  52. /* Query the security package for Negotiate */
  53. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
  54. TEXT(SP_NAME_NEGOTIATE),
  55. &SecurityPackage);
  56. /* Release the package buffer as it is not required anymore */
  57. if(status == SEC_E_OK) {
  58. s_pSecFn->FreeContextBuffer(SecurityPackage);
  59. }
  60. return (status == SEC_E_OK ? TRUE : FALSE);
  61. }
  62. /*
  63. * Curl_auth_decode_spnego_message()
  64. *
  65. * This is used to decode an already encoded SPNEGO (Negotiate) challenge
  66. * message.
  67. *
  68. * Parameters:
  69. *
  70. * data [in] - The session handle.
  71. * user [in] - The user name in the format User or Domain\User.
  72. * password [in] - The user's password.
  73. * service [in] - The service type such as http, smtp, pop or imap.
  74. * host [in] - The host name.
  75. * chlg64 [in] - The optional base64 encoded challenge message.
  76. * nego [in/out] - The Negotiate data struct being used and modified.
  77. *
  78. * Returns CURLE_OK on success.
  79. */
  80. CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
  81. const char *user,
  82. const char *password,
  83. const char *service,
  84. const char *host,
  85. const char *chlg64,
  86. struct negotiatedata *nego)
  87. {
  88. CURLcode result = CURLE_OK;
  89. size_t chlglen = 0;
  90. unsigned char *chlg = NULL;
  91. PSecPkgInfo SecurityPackage;
  92. SecBuffer chlg_buf[2];
  93. SecBuffer resp_buf;
  94. SecBufferDesc chlg_desc;
  95. SecBufferDesc resp_desc;
  96. unsigned long attrs;
  97. TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
  98. #if defined(CURL_DISABLE_VERBOSE_STRINGS)
  99. (void) data;
  100. #endif
  101. if(nego->context && nego->status == SEC_E_OK) {
  102. /* We finished successfully our part of authentication, but server
  103. * rejected it (since we're again here). Exit with an error since we
  104. * can't invent anything better */
  105. Curl_auth_cleanup_spnego(nego);
  106. return CURLE_LOGIN_DENIED;
  107. }
  108. if(!nego->spn) {
  109. /* Generate our SPN */
  110. nego->spn = Curl_auth_build_spn(service, host, NULL);
  111. if(!nego->spn)
  112. return CURLE_OUT_OF_MEMORY;
  113. }
  114. if(!nego->output_token) {
  115. /* Query the security package for Negotiate */
  116. nego->status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
  117. TEXT(SP_NAME_NEGOTIATE),
  118. &SecurityPackage);
  119. if(nego->status != SEC_E_OK) {
  120. failf(data, "SSPI: couldn't get auth info");
  121. return CURLE_AUTH_ERROR;
  122. }
  123. nego->token_max = SecurityPackage->cbMaxToken;
  124. /* Release the package buffer as it is not required anymore */
  125. s_pSecFn->FreeContextBuffer(SecurityPackage);
  126. /* Allocate our output buffer */
  127. nego->output_token = malloc(nego->token_max);
  128. if(!nego->output_token)
  129. return CURLE_OUT_OF_MEMORY;
  130. }
  131. if(!nego->credentials) {
  132. /* Do we have credentials to use or are we using single sign-on? */
  133. if(user && *user) {
  134. /* Populate our identity structure */
  135. result = Curl_create_sspi_identity(user, password, &nego->identity);
  136. if(result)
  137. return result;
  138. /* Allow proper cleanup of the identity structure */
  139. nego->p_identity = &nego->identity;
  140. }
  141. else
  142. /* Use the current Windows user */
  143. nego->p_identity = NULL;
  144. /* Allocate our credentials handle */
  145. nego->credentials = calloc(1, sizeof(CredHandle));
  146. if(!nego->credentials)
  147. return CURLE_OUT_OF_MEMORY;
  148. /* Acquire our credentials handle */
  149. nego->status =
  150. s_pSecFn->AcquireCredentialsHandle(NULL,
  151. (TCHAR *)TEXT(SP_NAME_NEGOTIATE),
  152. SECPKG_CRED_OUTBOUND, NULL,
  153. nego->p_identity, NULL, NULL,
  154. nego->credentials, &expiry);
  155. if(nego->status != SEC_E_OK)
  156. return CURLE_AUTH_ERROR;
  157. /* Allocate our new context handle */
  158. nego->context = calloc(1, sizeof(CtxtHandle));
  159. if(!nego->context)
  160. return CURLE_OUT_OF_MEMORY;
  161. }
  162. if(chlg64 && *chlg64) {
  163. /* Decode the base-64 encoded challenge message */
  164. if(*chlg64 != '=') {
  165. result = Curl_base64_decode(chlg64, &chlg, &chlglen);
  166. if(result)
  167. return result;
  168. }
  169. /* Ensure we have a valid challenge message */
  170. if(!chlg) {
  171. infof(data, "SPNEGO handshake failure (empty challenge message)");
  172. return CURLE_BAD_CONTENT_ENCODING;
  173. }
  174. /* Setup the challenge "input" security buffer */
  175. chlg_desc.ulVersion = SECBUFFER_VERSION;
  176. chlg_desc.cBuffers = 1;
  177. chlg_desc.pBuffers = &chlg_buf[0];
  178. chlg_buf[0].BufferType = SECBUFFER_TOKEN;
  179. chlg_buf[0].pvBuffer = chlg;
  180. chlg_buf[0].cbBuffer = curlx_uztoul(chlglen);
  181. #ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
  182. /* ssl context comes from Schannel.
  183. * When extended protection is used in IIS server,
  184. * we have to pass a second SecBuffer to the SecBufferDesc
  185. * otherwise IIS will not pass the authentication (401 response).
  186. * Minimum supported version is Windows 7.
  187. * https://docs.microsoft.com/en-us/security-updates
  188. * /SecurityAdvisories/2009/973811
  189. */
  190. if(nego->sslContext) {
  191. SEC_CHANNEL_BINDINGS channelBindings;
  192. SecPkgContext_Bindings pkgBindings;
  193. pkgBindings.Bindings = &channelBindings;
  194. nego->status = s_pSecFn->QueryContextAttributes(
  195. nego->sslContext,
  196. SECPKG_ATTR_ENDPOINT_BINDINGS,
  197. &pkgBindings
  198. );
  199. if(nego->status == SEC_E_OK) {
  200. chlg_desc.cBuffers++;
  201. chlg_buf[1].BufferType = SECBUFFER_CHANNEL_BINDINGS;
  202. chlg_buf[1].cbBuffer = pkgBindings.BindingsLength;
  203. chlg_buf[1].pvBuffer = pkgBindings.Bindings;
  204. }
  205. }
  206. #endif
  207. }
  208. /* Setup the response "output" security buffer */
  209. resp_desc.ulVersion = SECBUFFER_VERSION;
  210. resp_desc.cBuffers = 1;
  211. resp_desc.pBuffers = &resp_buf;
  212. resp_buf.BufferType = SECBUFFER_TOKEN;
  213. resp_buf.pvBuffer = nego->output_token;
  214. resp_buf.cbBuffer = curlx_uztoul(nego->token_max);
  215. /* Generate our challenge-response message */
  216. nego->status = s_pSecFn->InitializeSecurityContext(nego->credentials,
  217. chlg ? nego->context :
  218. NULL,
  219. nego->spn,
  220. ISC_REQ_CONFIDENTIALITY,
  221. 0, SECURITY_NATIVE_DREP,
  222. chlg ? &chlg_desc : NULL,
  223. 0, nego->context,
  224. &resp_desc, &attrs,
  225. &expiry);
  226. /* Free the decoded challenge as it is not required anymore */
  227. free(chlg);
  228. if(GSS_ERROR(nego->status)) {
  229. char buffer[STRERROR_LEN];
  230. failf(data, "InitializeSecurityContext failed: %s",
  231. Curl_sspi_strerror(nego->status, buffer, sizeof(buffer)));
  232. if(nego->status == (DWORD)SEC_E_INSUFFICIENT_MEMORY)
  233. return CURLE_OUT_OF_MEMORY;
  234. return CURLE_AUTH_ERROR;
  235. }
  236. if(nego->status == SEC_I_COMPLETE_NEEDED ||
  237. nego->status == SEC_I_COMPLETE_AND_CONTINUE) {
  238. nego->status = s_pSecFn->CompleteAuthToken(nego->context, &resp_desc);
  239. if(GSS_ERROR(nego->status)) {
  240. char buffer[STRERROR_LEN];
  241. failf(data, "CompleteAuthToken failed: %s",
  242. Curl_sspi_strerror(nego->status, buffer, sizeof(buffer)));
  243. if(nego->status == (DWORD)SEC_E_INSUFFICIENT_MEMORY)
  244. return CURLE_OUT_OF_MEMORY;
  245. return CURLE_AUTH_ERROR;
  246. }
  247. }
  248. nego->output_token_length = resp_buf.cbBuffer;
  249. return result;
  250. }
  251. /*
  252. * Curl_auth_create_spnego_message()
  253. *
  254. * This is used to generate an already encoded SPNEGO (Negotiate) response
  255. * message ready for sending to the recipient.
  256. *
  257. * Parameters:
  258. *
  259. * data [in] - The session handle.
  260. * nego [in/out] - The Negotiate data struct being used and modified.
  261. * outptr [in/out] - The address where a pointer to newly allocated memory
  262. * holding the result will be stored upon completion.
  263. * outlen [out] - The length of the output message.
  264. *
  265. * Returns CURLE_OK on success.
  266. */
  267. CURLcode Curl_auth_create_spnego_message(struct negotiatedata *nego,
  268. char **outptr, size_t *outlen)
  269. {
  270. /* Base64 encode the already generated response */
  271. CURLcode result = Curl_base64_encode((const char *) nego->output_token,
  272. nego->output_token_length, outptr,
  273. outlen);
  274. if(!result && (!*outptr || !*outlen)) {
  275. free(*outptr);
  276. result = CURLE_REMOTE_ACCESS_DENIED;
  277. }
  278. return result;
  279. }
  280. /*
  281. * Curl_auth_cleanup_spnego()
  282. *
  283. * This is used to clean up the SPNEGO (Negotiate) specific data.
  284. *
  285. * Parameters:
  286. *
  287. * nego [in/out] - The Negotiate data struct being cleaned up.
  288. *
  289. */
  290. void Curl_auth_cleanup_spnego(struct negotiatedata *nego)
  291. {
  292. /* Free our security context */
  293. if(nego->context) {
  294. s_pSecFn->DeleteSecurityContext(nego->context);
  295. free(nego->context);
  296. nego->context = NULL;
  297. }
  298. /* Free our credentials handle */
  299. if(nego->credentials) {
  300. s_pSecFn->FreeCredentialsHandle(nego->credentials);
  301. free(nego->credentials);
  302. nego->credentials = NULL;
  303. }
  304. /* Free our identity */
  305. Curl_sspi_free_identity(nego->p_identity);
  306. nego->p_identity = NULL;
  307. /* Free the SPN and output token */
  308. Curl_safefree(nego->spn);
  309. Curl_safefree(nego->output_token);
  310. /* Reset any variables */
  311. nego->status = 0;
  312. nego->token_max = 0;
  313. nego->noauthpersist = FALSE;
  314. nego->havenoauthpersist = FALSE;
  315. nego->havenegdata = FALSE;
  316. nego->havemultiplerequests = FALSE;
  317. }
  318. #endif /* USE_WINDOWS_SSPI && USE_SPNEGO */