krb5_sspi.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. * RFC4752 The Kerberos V5 ("GSSAPI") SASL Mechanism
  24. *
  25. ***************************************************************************/
  26. #include "curl_setup.h"
  27. #if defined(USE_WINDOWS_SSPI) && defined(USE_KERBEROS5)
  28. #include <curl/curl.h>
  29. #include "vauth/vauth.h"
  30. #include "urldata.h"
  31. #include "warnless.h"
  32. #include "curl_multibyte.h"
  33. #include "sendf.h"
  34. /* The last #include files should be: */
  35. #include "curl_memory.h"
  36. #include "memdebug.h"
  37. /*
  38. * Curl_auth_is_gssapi_supported()
  39. *
  40. * This is used to evaluate if GSSAPI (Kerberos V5) is supported.
  41. *
  42. * Parameters: None
  43. *
  44. * Returns TRUE if Kerberos V5 is supported by Windows SSPI.
  45. */
  46. bool Curl_auth_is_gssapi_supported(void)
  47. {
  48. PSecPkgInfo SecurityPackage;
  49. SECURITY_STATUS status;
  50. /* Query the security package for Kerberos */
  51. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
  52. TEXT(SP_NAME_KERBEROS),
  53. &SecurityPackage);
  54. /* Release the package buffer as it is not required anymore */
  55. if(status == SEC_E_OK) {
  56. s_pSecFn->FreeContextBuffer(SecurityPackage);
  57. }
  58. return (status == SEC_E_OK ? TRUE : FALSE);
  59. }
  60. /*
  61. * Curl_auth_create_gssapi_user_message()
  62. *
  63. * This is used to generate an already encoded GSSAPI (Kerberos V5) user token
  64. * message ready for sending to the recipient.
  65. *
  66. * Parameters:
  67. *
  68. * data [in] - The session handle.
  69. * userp [in] - The user name in the format User or Domain\User.
  70. * passwdp [in] - The user's password.
  71. * service [in] - The service type such as http, smtp, pop or imap.
  72. * host [in] - The host name.
  73. * mutual_auth [in] - Flag specifying whether or not mutual authentication
  74. * is enabled.
  75. * chlg [in] - Optional challenge message.
  76. * krb5 [in/out] - The Kerberos 5 data struct being used and modified.
  77. * out [out] - The result storage.
  78. *
  79. * Returns CURLE_OK on success.
  80. */
  81. CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
  82. const char *userp,
  83. const char *passwdp,
  84. const char *service,
  85. const char *host,
  86. const bool mutual_auth,
  87. const struct bufref *chlg,
  88. struct kerberos5data *krb5,
  89. struct bufref *out)
  90. {
  91. CURLcode result = CURLE_OK;
  92. CtxtHandle context;
  93. PSecPkgInfo SecurityPackage;
  94. SecBuffer chlg_buf;
  95. SecBuffer resp_buf;
  96. SecBufferDesc chlg_desc;
  97. SecBufferDesc resp_desc;
  98. SECURITY_STATUS status;
  99. unsigned long attrs;
  100. TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
  101. if(!krb5->spn) {
  102. /* Generate our SPN */
  103. krb5->spn = Curl_auth_build_spn(service, host, NULL);
  104. if(!krb5->spn)
  105. return CURLE_OUT_OF_MEMORY;
  106. }
  107. if(!krb5->output_token) {
  108. /* Query the security package for Kerberos */
  109. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
  110. TEXT(SP_NAME_KERBEROS),
  111. &SecurityPackage);
  112. if(status != SEC_E_OK) {
  113. failf(data, "SSPI: couldn't get auth info");
  114. return CURLE_AUTH_ERROR;
  115. }
  116. krb5->token_max = SecurityPackage->cbMaxToken;
  117. /* Release the package buffer as it is not required anymore */
  118. s_pSecFn->FreeContextBuffer(SecurityPackage);
  119. /* Allocate our response buffer */
  120. krb5->output_token = malloc(krb5->token_max);
  121. if(!krb5->output_token)
  122. return CURLE_OUT_OF_MEMORY;
  123. }
  124. if(!krb5->credentials) {
  125. /* Do we have credentials to use or are we using single sign-on? */
  126. if(userp && *userp) {
  127. /* Populate our identity structure */
  128. result = Curl_create_sspi_identity(userp, passwdp, &krb5->identity);
  129. if(result)
  130. return result;
  131. /* Allow proper cleanup of the identity structure */
  132. krb5->p_identity = &krb5->identity;
  133. }
  134. else
  135. /* Use the current Windows user */
  136. krb5->p_identity = NULL;
  137. /* Allocate our credentials handle */
  138. krb5->credentials = calloc(1, sizeof(CredHandle));
  139. if(!krb5->credentials)
  140. return CURLE_OUT_OF_MEMORY;
  141. /* Acquire our credentials handle */
  142. status = s_pSecFn->AcquireCredentialsHandle(NULL,
  143. (TCHAR *)
  144. TEXT(SP_NAME_KERBEROS),
  145. SECPKG_CRED_OUTBOUND, NULL,
  146. krb5->p_identity, NULL, NULL,
  147. krb5->credentials, &expiry);
  148. if(status != SEC_E_OK)
  149. return CURLE_LOGIN_DENIED;
  150. /* Allocate our new context handle */
  151. krb5->context = calloc(1, sizeof(CtxtHandle));
  152. if(!krb5->context)
  153. return CURLE_OUT_OF_MEMORY;
  154. }
  155. if(chlg) {
  156. if(!Curl_bufref_len(chlg)) {
  157. infof(data, "GSSAPI handshake failure (empty challenge message)");
  158. return CURLE_BAD_CONTENT_ENCODING;
  159. }
  160. /* Setup the challenge "input" security buffer */
  161. chlg_desc.ulVersion = SECBUFFER_VERSION;
  162. chlg_desc.cBuffers = 1;
  163. chlg_desc.pBuffers = &chlg_buf;
  164. chlg_buf.BufferType = SECBUFFER_TOKEN;
  165. chlg_buf.pvBuffer = (void *) Curl_bufref_ptr(chlg);
  166. chlg_buf.cbBuffer = curlx_uztoul(Curl_bufref_len(chlg));
  167. }
  168. /* Setup the response "output" security buffer */
  169. resp_desc.ulVersion = SECBUFFER_VERSION;
  170. resp_desc.cBuffers = 1;
  171. resp_desc.pBuffers = &resp_buf;
  172. resp_buf.BufferType = SECBUFFER_TOKEN;
  173. resp_buf.pvBuffer = krb5->output_token;
  174. resp_buf.cbBuffer = curlx_uztoul(krb5->token_max);
  175. /* Generate our challenge-response message */
  176. status = s_pSecFn->InitializeSecurityContext(krb5->credentials,
  177. chlg ? krb5->context : NULL,
  178. krb5->spn,
  179. (mutual_auth ?
  180. ISC_REQ_MUTUAL_AUTH : 0),
  181. 0, SECURITY_NATIVE_DREP,
  182. chlg ? &chlg_desc : NULL, 0,
  183. &context,
  184. &resp_desc, &attrs,
  185. &expiry);
  186. if(status == SEC_E_INSUFFICIENT_MEMORY)
  187. return CURLE_OUT_OF_MEMORY;
  188. if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED)
  189. return CURLE_AUTH_ERROR;
  190. if(memcmp(&context, krb5->context, sizeof(context))) {
  191. s_pSecFn->DeleteSecurityContext(krb5->context);
  192. memcpy(krb5->context, &context, sizeof(context));
  193. }
  194. if(resp_buf.cbBuffer) {
  195. result = Curl_bufref_memdup(out, resp_buf.pvBuffer, resp_buf.cbBuffer);
  196. }
  197. else if(mutual_auth)
  198. Curl_bufref_set(out, "", 0, NULL);
  199. else
  200. Curl_bufref_set(out, NULL, 0, NULL);
  201. return result;
  202. }
  203. /*
  204. * Curl_auth_create_gssapi_security_message()
  205. *
  206. * This is used to generate an already encoded GSSAPI (Kerberos V5) security
  207. * token message ready for sending to the recipient.
  208. *
  209. * Parameters:
  210. *
  211. * data [in] - The session handle.
  212. * authzid [in] - The authorization identity if some.
  213. * chlg [in] - The optional challenge message.
  214. * krb5 [in/out] - The Kerberos 5 data struct being used and modified.
  215. * out [out] - The result storage.
  216. *
  217. * Returns CURLE_OK on success.
  218. */
  219. CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
  220. const char *authzid,
  221. const struct bufref *chlg,
  222. struct kerberos5data *krb5,
  223. struct bufref *out)
  224. {
  225. size_t offset = 0;
  226. size_t messagelen = 0;
  227. size_t appdatalen = 0;
  228. unsigned char *trailer = NULL;
  229. unsigned char *message = NULL;
  230. unsigned char *padding = NULL;
  231. unsigned char *appdata = NULL;
  232. SecBuffer input_buf[2];
  233. SecBuffer wrap_buf[3];
  234. SecBufferDesc input_desc;
  235. SecBufferDesc wrap_desc;
  236. unsigned char *indata;
  237. unsigned long qop = 0;
  238. unsigned long sec_layer = 0;
  239. unsigned long max_size = 0;
  240. SecPkgContext_Sizes sizes;
  241. SECURITY_STATUS status;
  242. #if defined(CURL_DISABLE_VERBOSE_STRINGS)
  243. (void) data;
  244. #endif
  245. /* Ensure we have a valid challenge message */
  246. if(!Curl_bufref_len(chlg)) {
  247. infof(data, "GSSAPI handshake failure (empty security message)");
  248. return CURLE_BAD_CONTENT_ENCODING;
  249. }
  250. /* Get our response size information */
  251. status = s_pSecFn->QueryContextAttributes(krb5->context,
  252. SECPKG_ATTR_SIZES,
  253. &sizes);
  254. if(status == SEC_E_INSUFFICIENT_MEMORY)
  255. return CURLE_OUT_OF_MEMORY;
  256. if(status != SEC_E_OK)
  257. return CURLE_AUTH_ERROR;
  258. /* Setup the "input" security buffer */
  259. input_desc.ulVersion = SECBUFFER_VERSION;
  260. input_desc.cBuffers = 2;
  261. input_desc.pBuffers = input_buf;
  262. input_buf[0].BufferType = SECBUFFER_STREAM;
  263. input_buf[0].pvBuffer = (void *) Curl_bufref_ptr(chlg);
  264. input_buf[0].cbBuffer = curlx_uztoul(Curl_bufref_len(chlg));
  265. input_buf[1].BufferType = SECBUFFER_DATA;
  266. input_buf[1].pvBuffer = NULL;
  267. input_buf[1].cbBuffer = 0;
  268. /* Decrypt the inbound challenge and obtain the qop */
  269. status = s_pSecFn->DecryptMessage(krb5->context, &input_desc, 0, &qop);
  270. if(status != SEC_E_OK) {
  271. infof(data, "GSSAPI handshake failure (empty security message)");
  272. return CURLE_BAD_CONTENT_ENCODING;
  273. }
  274. /* Not 4 octets long so fail as per RFC4752 Section 3.1 */
  275. if(input_buf[1].cbBuffer != 4) {
  276. infof(data, "GSSAPI handshake failure (invalid security data)");
  277. return CURLE_BAD_CONTENT_ENCODING;
  278. }
  279. /* Extract the security layer and the maximum message size */
  280. indata = input_buf[1].pvBuffer;
  281. sec_layer = indata[0];
  282. max_size = ((unsigned long)indata[1] << 16) |
  283. ((unsigned long)indata[2] << 8) | indata[3];
  284. /* Free the challenge as it is not required anymore */
  285. s_pSecFn->FreeContextBuffer(input_buf[1].pvBuffer);
  286. /* Process the security layer */
  287. if(!(sec_layer & KERB_WRAP_NO_ENCRYPT)) {
  288. infof(data, "GSSAPI handshake failure (invalid security layer)");
  289. return CURLE_BAD_CONTENT_ENCODING;
  290. }
  291. sec_layer &= KERB_WRAP_NO_ENCRYPT; /* We do not support a security layer */
  292. /* Process the maximum message size the server can receive */
  293. if(max_size > 0) {
  294. /* The server has told us it supports a maximum receive buffer, however, as
  295. we don't require one unless we are encrypting data, we tell the server
  296. our receive buffer is zero. */
  297. max_size = 0;
  298. }
  299. /* Allocate the trailer */
  300. trailer = malloc(sizes.cbSecurityTrailer);
  301. if(!trailer)
  302. return CURLE_OUT_OF_MEMORY;
  303. /* Allocate our message */
  304. messagelen = 4;
  305. if(authzid)
  306. messagelen += strlen(authzid);
  307. message = malloc(messagelen);
  308. if(!message) {
  309. free(trailer);
  310. return CURLE_OUT_OF_MEMORY;
  311. }
  312. /* Populate the message with the security layer and client supported receive
  313. message size. */
  314. message[0] = sec_layer & 0xFF;
  315. message[1] = (max_size >> 16) & 0xFF;
  316. message[2] = (max_size >> 8) & 0xFF;
  317. message[3] = max_size & 0xFF;
  318. /* If given, append the authorization identity. */
  319. if(authzid && *authzid)
  320. memcpy(message + 4, authzid, messagelen - 4);
  321. /* Allocate the padding */
  322. padding = malloc(sizes.cbBlockSize);
  323. if(!padding) {
  324. free(message);
  325. free(trailer);
  326. return CURLE_OUT_OF_MEMORY;
  327. }
  328. /* Setup the "authentication data" security buffer */
  329. wrap_desc.ulVersion = SECBUFFER_VERSION;
  330. wrap_desc.cBuffers = 3;
  331. wrap_desc.pBuffers = wrap_buf;
  332. wrap_buf[0].BufferType = SECBUFFER_TOKEN;
  333. wrap_buf[0].pvBuffer = trailer;
  334. wrap_buf[0].cbBuffer = sizes.cbSecurityTrailer;
  335. wrap_buf[1].BufferType = SECBUFFER_DATA;
  336. wrap_buf[1].pvBuffer = message;
  337. wrap_buf[1].cbBuffer = curlx_uztoul(messagelen);
  338. wrap_buf[2].BufferType = SECBUFFER_PADDING;
  339. wrap_buf[2].pvBuffer = padding;
  340. wrap_buf[2].cbBuffer = sizes.cbBlockSize;
  341. /* Encrypt the data */
  342. status = s_pSecFn->EncryptMessage(krb5->context, KERB_WRAP_NO_ENCRYPT,
  343. &wrap_desc, 0);
  344. if(status != SEC_E_OK) {
  345. free(padding);
  346. free(message);
  347. free(trailer);
  348. if(status == SEC_E_INSUFFICIENT_MEMORY)
  349. return CURLE_OUT_OF_MEMORY;
  350. return CURLE_AUTH_ERROR;
  351. }
  352. /* Allocate the encryption (wrap) buffer */
  353. appdatalen = wrap_buf[0].cbBuffer + wrap_buf[1].cbBuffer +
  354. wrap_buf[2].cbBuffer;
  355. appdata = malloc(appdatalen);
  356. if(!appdata) {
  357. free(padding);
  358. free(message);
  359. free(trailer);
  360. return CURLE_OUT_OF_MEMORY;
  361. }
  362. /* Populate the encryption buffer */
  363. memcpy(appdata, wrap_buf[0].pvBuffer, wrap_buf[0].cbBuffer);
  364. offset += wrap_buf[0].cbBuffer;
  365. memcpy(appdata + offset, wrap_buf[1].pvBuffer, wrap_buf[1].cbBuffer);
  366. offset += wrap_buf[1].cbBuffer;
  367. memcpy(appdata + offset, wrap_buf[2].pvBuffer, wrap_buf[2].cbBuffer);
  368. /* Free all of our local buffers */
  369. free(padding);
  370. free(message);
  371. free(trailer);
  372. /* Return the response. */
  373. Curl_bufref_set(out, appdata, appdatalen, curl_free);
  374. return CURLE_OK;
  375. }
  376. /*
  377. * Curl_auth_cleanup_gssapi()
  378. *
  379. * This is used to clean up the GSSAPI (Kerberos V5) specific data.
  380. *
  381. * Parameters:
  382. *
  383. * krb5 [in/out] - The Kerberos 5 data struct being cleaned up.
  384. *
  385. */
  386. void Curl_auth_cleanup_gssapi(struct kerberos5data *krb5)
  387. {
  388. /* Free our security context */
  389. if(krb5->context) {
  390. s_pSecFn->DeleteSecurityContext(krb5->context);
  391. free(krb5->context);
  392. krb5->context = NULL;
  393. }
  394. /* Free our credentials handle */
  395. if(krb5->credentials) {
  396. s_pSecFn->FreeCredentialsHandle(krb5->credentials);
  397. free(krb5->credentials);
  398. krb5->credentials = NULL;
  399. }
  400. /* Free our identity */
  401. Curl_sspi_free_identity(krb5->p_identity);
  402. krb5->p_identity = NULL;
  403. /* Free the SPN and output token */
  404. Curl_safefree(krb5->spn);
  405. Curl_safefree(krb5->output_token);
  406. /* Reset any variables */
  407. krb5->token_max = 0;
  408. }
  409. #endif /* USE_WINDOWS_SSPI && USE_KERBEROS5 */