2
0

krb5_sspi.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. * RFC4752 The Kerberos V5 ("GSSAPI") SASL Mechanism
  24. *
  25. ***************************************************************************/
  26. #include "curl_setup.h"
  27. #if defined(USE_WINDOWS_SSPI) && defined(USE_KERBEROS5)
  28. #include <curl/curl.h>
  29. #include "vauth/vauth.h"
  30. #include "urldata.h"
  31. #include "warnless.h"
  32. #include "curl_multibyte.h"
  33. #include "sendf.h"
  34. /* The last #include files should be: */
  35. #include "curl_memory.h"
  36. #include "memdebug.h"
  37. /*
  38. * Curl_auth_is_gssapi_supported()
  39. *
  40. * This is used to evaluate if GSSAPI (Kerberos V5) is supported.
  41. *
  42. * Parameters: None
  43. *
  44. * Returns TRUE if Kerberos V5 is supported by Windows SSPI.
  45. */
  46. bool Curl_auth_is_gssapi_supported(void)
  47. {
  48. PSecPkgInfo SecurityPackage;
  49. SECURITY_STATUS status;
  50. /* Query the security package for Kerberos */
  51. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
  52. TEXT(SP_NAME_KERBEROS),
  53. &SecurityPackage);
  54. /* Release the package buffer as it is not required anymore */
  55. if(status == SEC_E_OK) {
  56. s_pSecFn->FreeContextBuffer(SecurityPackage);
  57. }
  58. return (status == SEC_E_OK ? TRUE : FALSE);
  59. }
  60. /*
  61. * Curl_auth_create_gssapi_user_message()
  62. *
  63. * This is used to generate an already encoded GSSAPI (Kerberos V5) user token
  64. * message ready for sending to the recipient.
  65. *
  66. * Parameters:
  67. *
  68. * data [in] - The session handle.
  69. * userp [in] - The user name in the format User or Domain\User.
  70. * passwdp [in] - The user's password.
  71. * service [in] - The service type such as http, smtp, pop or imap.
  72. * host [in] - The host name.
  73. * mutual_auth [in] - Flag specifying whether or not mutual authentication
  74. * is enabled.
  75. * chlg [in] - Optional challenge message.
  76. * krb5 [in/out] - The Kerberos 5 data struct being used and modified.
  77. * out [out] - The result storage.
  78. *
  79. * Returns CURLE_OK on success.
  80. */
  81. CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
  82. const char *userp,
  83. const char *passwdp,
  84. const char *service,
  85. const char *host,
  86. const bool mutual_auth,
  87. const struct bufref *chlg,
  88. struct kerberos5data *krb5,
  89. struct bufref *out)
  90. {
  91. CURLcode result = CURLE_OK;
  92. CtxtHandle context;
  93. PSecPkgInfo SecurityPackage;
  94. SecBuffer chlg_buf;
  95. SecBuffer resp_buf;
  96. SecBufferDesc chlg_desc;
  97. SecBufferDesc resp_desc;
  98. SECURITY_STATUS status;
  99. unsigned long attrs;
  100. TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
  101. if(!krb5->spn) {
  102. /* Generate our SPN */
  103. krb5->spn = Curl_auth_build_spn(service, host, NULL);
  104. if(!krb5->spn)
  105. return CURLE_OUT_OF_MEMORY;
  106. }
  107. if(!krb5->output_token) {
  108. /* Query the security package for Kerberos */
  109. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
  110. TEXT(SP_NAME_KERBEROS),
  111. &SecurityPackage);
  112. if(status != SEC_E_OK) {
  113. failf(data, "SSPI: couldn't get auth info");
  114. return CURLE_AUTH_ERROR;
  115. }
  116. krb5->token_max = SecurityPackage->cbMaxToken;
  117. /* Release the package buffer as it is not required anymore */
  118. s_pSecFn->FreeContextBuffer(SecurityPackage);
  119. /* Allocate our response buffer */
  120. krb5->output_token = malloc(krb5->token_max);
  121. if(!krb5->output_token)
  122. return CURLE_OUT_OF_MEMORY;
  123. }
  124. if(!krb5->credentials) {
  125. /* Do we have credentials to use or are we using single sign-on? */
  126. if(userp && *userp) {
  127. /* Populate our identity structure */
  128. result = Curl_create_sspi_identity(userp, passwdp, &krb5->identity);
  129. if(result)
  130. return result;
  131. /* Allow proper cleanup of the identity structure */
  132. krb5->p_identity = &krb5->identity;
  133. }
  134. else
  135. /* Use the current Windows user */
  136. krb5->p_identity = NULL;
  137. /* Allocate our credentials handle */
  138. krb5->credentials = calloc(1, sizeof(CredHandle));
  139. if(!krb5->credentials)
  140. return CURLE_OUT_OF_MEMORY;
  141. /* Acquire our credentials handle */
  142. status = s_pSecFn->AcquireCredentialsHandle(NULL,
  143. (TCHAR *)
  144. TEXT(SP_NAME_KERBEROS),
  145. SECPKG_CRED_OUTBOUND, NULL,
  146. krb5->p_identity, NULL, NULL,
  147. krb5->credentials, &expiry);
  148. if(status != SEC_E_OK)
  149. return CURLE_LOGIN_DENIED;
  150. /* Allocate our new context handle */
  151. krb5->context = calloc(1, sizeof(CtxtHandle));
  152. if(!krb5->context)
  153. return CURLE_OUT_OF_MEMORY;
  154. }
  155. if(chlg) {
  156. if(!Curl_bufref_len(chlg)) {
  157. infof(data, "GSSAPI handshake failure (empty challenge message)");
  158. return CURLE_BAD_CONTENT_ENCODING;
  159. }
  160. /* Setup the challenge "input" security buffer */
  161. chlg_desc.ulVersion = SECBUFFER_VERSION;
  162. chlg_desc.cBuffers = 1;
  163. chlg_desc.pBuffers = &chlg_buf;
  164. chlg_buf.BufferType = SECBUFFER_TOKEN;
  165. chlg_buf.pvBuffer = (void *) Curl_bufref_ptr(chlg);
  166. chlg_buf.cbBuffer = curlx_uztoul(Curl_bufref_len(chlg));
  167. }
  168. /* Setup the response "output" security buffer */
  169. resp_desc.ulVersion = SECBUFFER_VERSION;
  170. resp_desc.cBuffers = 1;
  171. resp_desc.pBuffers = &resp_buf;
  172. resp_buf.BufferType = SECBUFFER_TOKEN;
  173. resp_buf.pvBuffer = krb5->output_token;
  174. resp_buf.cbBuffer = curlx_uztoul(krb5->token_max);
  175. /* Generate our challenge-response message */
  176. status = s_pSecFn->InitializeSecurityContext(krb5->credentials,
  177. chlg ? krb5->context : NULL,
  178. krb5->spn,
  179. (mutual_auth ?
  180. ISC_REQ_MUTUAL_AUTH : 0),
  181. 0, SECURITY_NATIVE_DREP,
  182. chlg ? &chlg_desc : NULL, 0,
  183. &context,
  184. &resp_desc, &attrs,
  185. &expiry);
  186. if(status == SEC_E_INSUFFICIENT_MEMORY)
  187. return CURLE_OUT_OF_MEMORY;
  188. if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED)
  189. return CURLE_AUTH_ERROR;
  190. if(memcmp(&context, krb5->context, sizeof(context))) {
  191. s_pSecFn->DeleteSecurityContext(krb5->context);
  192. memcpy(krb5->context, &context, sizeof(context));
  193. }
  194. if(resp_buf.cbBuffer) {
  195. result = Curl_bufref_memdup(out, resp_buf.pvBuffer, resp_buf.cbBuffer);
  196. }
  197. else if(mutual_auth)
  198. Curl_bufref_set(out, "", 0, NULL);
  199. else
  200. Curl_bufref_set(out, NULL, 0, NULL);
  201. return result;
  202. }
  203. /*
  204. * Curl_auth_create_gssapi_security_message()
  205. *
  206. * This is used to generate an already encoded GSSAPI (Kerberos V5) security
  207. * token message ready for sending to the recipient.
  208. *
  209. * Parameters:
  210. *
  211. * data [in] - The session handle.
  212. * authzid [in] - The authorization identity if some.
  213. * chlg [in] - The optional challenge message.
  214. * krb5 [in/out] - The Kerberos 5 data struct being used and modified.
  215. * out [out] - The result storage.
  216. *
  217. * Returns CURLE_OK on success.
  218. */
  219. CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
  220. const char *authzid,
  221. const struct bufref *chlg,
  222. struct kerberos5data *krb5,
  223. struct bufref *out)
  224. {
  225. size_t offset = 0;
  226. size_t messagelen = 0;
  227. size_t appdatalen = 0;
  228. unsigned char *trailer = NULL;
  229. unsigned char *message = NULL;
  230. unsigned char *padding = NULL;
  231. unsigned char *appdata = NULL;
  232. SecBuffer input_buf[2];
  233. SecBuffer wrap_buf[3];
  234. SecBufferDesc input_desc;
  235. SecBufferDesc wrap_desc;
  236. unsigned char *indata;
  237. unsigned long qop = 0;
  238. unsigned long sec_layer = 0;
  239. unsigned long max_size = 0;
  240. SecPkgContext_Sizes sizes;
  241. SECURITY_STATUS status;
  242. #if defined(CURL_DISABLE_VERBOSE_STRINGS)
  243. (void) data;
  244. #endif
  245. /* Ensure we have a valid challenge message */
  246. if(!Curl_bufref_len(chlg)) {
  247. infof(data, "GSSAPI handshake failure (empty security message)");
  248. return CURLE_BAD_CONTENT_ENCODING;
  249. }
  250. /* Get our response size information */
  251. status = s_pSecFn->QueryContextAttributes(krb5->context,
  252. SECPKG_ATTR_SIZES,
  253. &sizes);
  254. if(status == SEC_E_INSUFFICIENT_MEMORY)
  255. return CURLE_OUT_OF_MEMORY;
  256. if(status != SEC_E_OK)
  257. return CURLE_AUTH_ERROR;
  258. /* Setup the "input" security buffer */
  259. input_desc.ulVersion = SECBUFFER_VERSION;
  260. input_desc.cBuffers = 2;
  261. input_desc.pBuffers = input_buf;
  262. input_buf[0].BufferType = SECBUFFER_STREAM;
  263. input_buf[0].pvBuffer = (void *) Curl_bufref_ptr(chlg);
  264. input_buf[0].cbBuffer = curlx_uztoul(Curl_bufref_len(chlg));
  265. input_buf[1].BufferType = SECBUFFER_DATA;
  266. input_buf[1].pvBuffer = NULL;
  267. input_buf[1].cbBuffer = 0;
  268. /* Decrypt the inbound challenge and obtain the qop */
  269. status = s_pSecFn->DecryptMessage(krb5->context, &input_desc, 0, &qop);
  270. if(status != SEC_E_OK) {
  271. infof(data, "GSSAPI handshake failure (empty security message)");
  272. return CURLE_BAD_CONTENT_ENCODING;
  273. }
  274. /* Not 4 octets long so fail as per RFC4752 Section 3.1 */
  275. if(input_buf[1].cbBuffer != 4) {
  276. infof(data, "GSSAPI handshake failure (invalid security data)");
  277. return CURLE_BAD_CONTENT_ENCODING;
  278. }
  279. /* Extract the security layer and the maximum message size */
  280. indata = input_buf[1].pvBuffer;
  281. sec_layer = indata[0];
  282. max_size = (indata[1] << 16) | (indata[2] << 8) | indata[3];
  283. /* Free the challenge as it is not required anymore */
  284. s_pSecFn->FreeContextBuffer(input_buf[1].pvBuffer);
  285. /* Process the security layer */
  286. if(!(sec_layer & KERB_WRAP_NO_ENCRYPT)) {
  287. infof(data, "GSSAPI handshake failure (invalid security layer)");
  288. return CURLE_BAD_CONTENT_ENCODING;
  289. }
  290. sec_layer &= KERB_WRAP_NO_ENCRYPT; /* We do not support a security layer */
  291. /* Process the maximum message size the server can receive */
  292. if(max_size > 0) {
  293. /* The server has told us it supports a maximum receive buffer, however, as
  294. we don't require one unless we are encrypting data, we tell the server
  295. our receive buffer is zero. */
  296. max_size = 0;
  297. }
  298. /* Allocate the trailer */
  299. trailer = malloc(sizes.cbSecurityTrailer);
  300. if(!trailer)
  301. return CURLE_OUT_OF_MEMORY;
  302. /* Allocate our message */
  303. messagelen = 4;
  304. if(authzid)
  305. messagelen += strlen(authzid);
  306. message = malloc(messagelen);
  307. if(!message) {
  308. free(trailer);
  309. return CURLE_OUT_OF_MEMORY;
  310. }
  311. /* Populate the message with the security layer and client supported receive
  312. message size. */
  313. message[0] = sec_layer & 0xFF;
  314. message[1] = (max_size >> 16) & 0xFF;
  315. message[2] = (max_size >> 8) & 0xFF;
  316. message[3] = max_size & 0xFF;
  317. /* If given, append the authorization identity. */
  318. if(authzid && *authzid)
  319. memcpy(message + 4, authzid, messagelen - 4);
  320. /* Allocate the padding */
  321. padding = malloc(sizes.cbBlockSize);
  322. if(!padding) {
  323. free(message);
  324. free(trailer);
  325. return CURLE_OUT_OF_MEMORY;
  326. }
  327. /* Setup the "authentication data" security buffer */
  328. wrap_desc.ulVersion = SECBUFFER_VERSION;
  329. wrap_desc.cBuffers = 3;
  330. wrap_desc.pBuffers = wrap_buf;
  331. wrap_buf[0].BufferType = SECBUFFER_TOKEN;
  332. wrap_buf[0].pvBuffer = trailer;
  333. wrap_buf[0].cbBuffer = sizes.cbSecurityTrailer;
  334. wrap_buf[1].BufferType = SECBUFFER_DATA;
  335. wrap_buf[1].pvBuffer = message;
  336. wrap_buf[1].cbBuffer = curlx_uztoul(messagelen);
  337. wrap_buf[2].BufferType = SECBUFFER_PADDING;
  338. wrap_buf[2].pvBuffer = padding;
  339. wrap_buf[2].cbBuffer = sizes.cbBlockSize;
  340. /* Encrypt the data */
  341. status = s_pSecFn->EncryptMessage(krb5->context, KERB_WRAP_NO_ENCRYPT,
  342. &wrap_desc, 0);
  343. if(status != SEC_E_OK) {
  344. free(padding);
  345. free(message);
  346. free(trailer);
  347. if(status == SEC_E_INSUFFICIENT_MEMORY)
  348. return CURLE_OUT_OF_MEMORY;
  349. return CURLE_AUTH_ERROR;
  350. }
  351. /* Allocate the encryption (wrap) buffer */
  352. appdatalen = wrap_buf[0].cbBuffer + wrap_buf[1].cbBuffer +
  353. wrap_buf[2].cbBuffer;
  354. appdata = malloc(appdatalen);
  355. if(!appdata) {
  356. free(padding);
  357. free(message);
  358. free(trailer);
  359. return CURLE_OUT_OF_MEMORY;
  360. }
  361. /* Populate the encryption buffer */
  362. memcpy(appdata, wrap_buf[0].pvBuffer, wrap_buf[0].cbBuffer);
  363. offset += wrap_buf[0].cbBuffer;
  364. memcpy(appdata + offset, wrap_buf[1].pvBuffer, wrap_buf[1].cbBuffer);
  365. offset += wrap_buf[1].cbBuffer;
  366. memcpy(appdata + offset, wrap_buf[2].pvBuffer, wrap_buf[2].cbBuffer);
  367. /* Free all of our local buffers */
  368. free(padding);
  369. free(message);
  370. free(trailer);
  371. /* Return the response. */
  372. Curl_bufref_set(out, appdata, appdatalen, curl_free);
  373. return CURLE_OK;
  374. }
  375. /*
  376. * Curl_auth_cleanup_gssapi()
  377. *
  378. * This is used to clean up the GSSAPI (Kerberos V5) specific data.
  379. *
  380. * Parameters:
  381. *
  382. * krb5 [in/out] - The Kerberos 5 data struct being cleaned up.
  383. *
  384. */
  385. void Curl_auth_cleanup_gssapi(struct kerberos5data *krb5)
  386. {
  387. /* Free our security context */
  388. if(krb5->context) {
  389. s_pSecFn->DeleteSecurityContext(krb5->context);
  390. free(krb5->context);
  391. krb5->context = NULL;
  392. }
  393. /* Free our credentials handle */
  394. if(krb5->credentials) {
  395. s_pSecFn->FreeCredentialsHandle(krb5->credentials);
  396. free(krb5->credentials);
  397. krb5->credentials = NULL;
  398. }
  399. /* Free our identity */
  400. Curl_sspi_free_identity(krb5->p_identity);
  401. krb5->p_identity = NULL;
  402. /* Free the SPN and output token */
  403. Curl_safefree(krb5->spn);
  404. Curl_safefree(krb5->output_token);
  405. /* Reset any variables */
  406. krb5->token_max = 0;
  407. }
  408. #endif /* USE_WINDOWS_SSPI && USE_KERBEROS5 */