stub_gssapi.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 2017-2019, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.haxx.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. ***************************************************************************/
  22. /* Only provides the bare minimum to link with libcurl */
  23. #include <stdio.h>
  24. #include <stdlib.h>
  25. #include <string.h>
  26. #include "stub_gssapi.h"
  27. /* !checksrc! disable SNPRINTF all */
  28. #define MAX_CREDS_LENGTH 250
  29. #define APPROX_TOKEN_LEN 250
  30. enum min_err_code {
  31. GSS_OK = 0,
  32. GSS_NO_MEMORY,
  33. GSS_INVALID_ARGS,
  34. GSS_INVALID_CREDS,
  35. GSS_INVALID_CTX,
  36. GSS_SERVER_ERR,
  37. GSS_NO_MECH,
  38. GSS_LAST
  39. };
  40. static const char *min_err_table[] = {
  41. "stub-gss: no error",
  42. "stub-gss: no memory",
  43. "stub-gss: invalid arguments",
  44. "stub-gss: invalid credentials",
  45. "stub-gss: invalid context",
  46. "stub-gss: server returned error",
  47. "stub-gss: cannot find a mechanism",
  48. NULL
  49. };
  50. struct gss_ctx_id_t_desc_struct {
  51. enum { NONE, KRB5, NTLM1, NTLM3 } sent;
  52. int have_krb5;
  53. int have_ntlm;
  54. OM_uint32 flags;
  55. char creds[MAX_CREDS_LENGTH];
  56. };
  57. OM_uint32 gss_init_sec_context(OM_uint32 *min,
  58. gss_const_cred_id_t initiator_cred_handle,
  59. gss_ctx_id_t *context_handle,
  60. gss_const_name_t target_name,
  61. const gss_OID mech_type,
  62. OM_uint32 req_flags,
  63. OM_uint32 time_req,
  64. const gss_channel_bindings_t input_chan_bindings,
  65. const gss_buffer_t input_token,
  66. gss_OID *actual_mech_type,
  67. gss_buffer_t output_token,
  68. OM_uint32 *ret_flags,
  69. OM_uint32 *time_rec)
  70. {
  71. /* The token will be encoded in base64 */
  72. int length = APPROX_TOKEN_LEN * 3 / 4;
  73. int used = 0;
  74. char *token = NULL;
  75. const char *creds = NULL;
  76. gss_ctx_id_t ctx = NULL;
  77. (void)initiator_cred_handle;
  78. (void)mech_type;
  79. (void)time_req;
  80. (void)input_chan_bindings;
  81. (void)actual_mech_type;
  82. if(!min)
  83. return GSS_S_FAILURE;
  84. *min = 0;
  85. if(!context_handle || !target_name || !output_token) {
  86. *min = GSS_INVALID_ARGS;
  87. return GSS_S_FAILURE;
  88. }
  89. creds = getenv("CURL_STUB_GSS_CREDS");
  90. if(!creds || strlen(creds) >= MAX_CREDS_LENGTH) {
  91. *min = GSS_INVALID_CREDS;
  92. return GSS_S_FAILURE;
  93. }
  94. ctx = *context_handle;
  95. if(ctx && strcmp(ctx->creds, creds)) {
  96. *min = GSS_INVALID_CREDS;
  97. return GSS_S_FAILURE;
  98. }
  99. output_token->length = 0;
  100. output_token->value = NULL;
  101. if(input_token && input_token->length) {
  102. if(!ctx) {
  103. *min = GSS_INVALID_CTX;
  104. return GSS_S_FAILURE;
  105. }
  106. /* Server response, either D (RA==) or C (Qw==) */
  107. if(((char *) input_token->value)[0] == 'D') {
  108. /* Done */
  109. switch(ctx->sent) {
  110. case KRB5:
  111. case NTLM3:
  112. if(ret_flags)
  113. *ret_flags = ctx->flags;
  114. if(time_rec)
  115. *time_rec = GSS_C_INDEFINITE;
  116. return GSS_S_COMPLETE;
  117. default:
  118. *min = GSS_SERVER_ERR;
  119. return GSS_S_FAILURE;
  120. }
  121. }
  122. if(((char *) input_token->value)[0] != 'C') {
  123. /* We only support Done or Continue */
  124. *min = GSS_SERVER_ERR;
  125. return GSS_S_FAILURE;
  126. }
  127. /* Continue */
  128. switch(ctx->sent) {
  129. case KRB5:
  130. /* We sent KRB5 and it failed, let's try NTLM */
  131. if(ctx->have_ntlm) {
  132. ctx->sent = NTLM1;
  133. break;
  134. }
  135. else {
  136. *min = GSS_SERVER_ERR;
  137. return GSS_S_FAILURE;
  138. }
  139. case NTLM1:
  140. ctx->sent = NTLM3;
  141. break;
  142. default:
  143. *min = GSS_SERVER_ERR;
  144. return GSS_S_FAILURE;
  145. }
  146. }
  147. else {
  148. if(ctx) {
  149. *min = GSS_INVALID_CTX;
  150. return GSS_S_FAILURE;
  151. }
  152. ctx = (gss_ctx_id_t) calloc(sizeof(*ctx), 1);
  153. if(!ctx) {
  154. *min = GSS_NO_MEMORY;
  155. return GSS_S_FAILURE;
  156. }
  157. if(strstr(creds, "KRB5"))
  158. ctx->have_krb5 = 1;
  159. if(strstr(creds, "NTLM"))
  160. ctx->have_ntlm = 1;
  161. if(ctx->have_krb5)
  162. ctx->sent = KRB5;
  163. else if(ctx->have_ntlm)
  164. ctx->sent = NTLM1;
  165. else {
  166. free(ctx);
  167. *min = GSS_NO_MECH;
  168. return GSS_S_FAILURE;
  169. }
  170. strcpy(ctx->creds, creds);
  171. ctx->flags = req_flags;
  172. }
  173. token = malloc(length);
  174. if(!token) {
  175. free(ctx);
  176. *min = GSS_NO_MEMORY;
  177. return GSS_S_FAILURE;
  178. }
  179. /* Token format: creds:target:type:padding */
  180. /* Note: this is using the *real* snprintf() and not the curl provided
  181. one */
  182. used = snprintf(token, length, "%s:%s:%d:", creds,
  183. (char *) target_name, ctx->sent);
  184. if(used >= length) {
  185. free(token);
  186. free(ctx);
  187. *min = GSS_NO_MEMORY;
  188. return GSS_S_FAILURE;
  189. }
  190. /* Overwrite null terminator */
  191. memset(token + used, 'A', length - used);
  192. *context_handle = ctx;
  193. output_token->value = token;
  194. output_token->length = length;
  195. return GSS_S_CONTINUE_NEEDED;
  196. }
  197. OM_uint32 gss_delete_sec_context(OM_uint32 *min,
  198. gss_ctx_id_t *context_handle,
  199. gss_buffer_t output_token)
  200. {
  201. (void)output_token;
  202. if(!min)
  203. return GSS_S_FAILURE;
  204. if(!context_handle) {
  205. *min = GSS_INVALID_CTX;
  206. return GSS_S_FAILURE;
  207. }
  208. free(*context_handle);
  209. *context_handle = NULL;
  210. *min = 0;
  211. return GSS_S_COMPLETE;
  212. }
  213. OM_uint32 gss_release_buffer(OM_uint32 *min,
  214. gss_buffer_t buffer)
  215. {
  216. if(min)
  217. *min = 0;
  218. if(buffer && buffer->length) {
  219. free(buffer->value);
  220. buffer->length = 0;
  221. }
  222. return GSS_S_COMPLETE;
  223. }
  224. OM_uint32 gss_import_name(OM_uint32 *min,
  225. const gss_buffer_t input_name_buffer,
  226. const gss_OID input_name_type,
  227. gss_name_t *output_name)
  228. {
  229. char *name = NULL;
  230. (void)input_name_type;
  231. if(!min)
  232. return GSS_S_FAILURE;
  233. if(!input_name_buffer || !output_name) {
  234. *min = GSS_INVALID_ARGS;
  235. return GSS_S_FAILURE;
  236. }
  237. name = strndup(input_name_buffer->value, input_name_buffer->length);
  238. if(!name) {
  239. *min = GSS_NO_MEMORY;
  240. return GSS_S_FAILURE;
  241. }
  242. *output_name = (gss_name_t) name;
  243. *min = 0;
  244. return GSS_S_COMPLETE;
  245. }
  246. OM_uint32 gss_release_name(OM_uint32 *min,
  247. gss_name_t *input_name)
  248. {
  249. if(min)
  250. *min = 0;
  251. if(input_name)
  252. free(*input_name);
  253. return GSS_S_COMPLETE;
  254. }
  255. OM_uint32 gss_display_status(OM_uint32 *min,
  256. OM_uint32 status_value,
  257. int status_type,
  258. const gss_OID mech_type,
  259. OM_uint32 *message_context,
  260. gss_buffer_t status_string)
  261. {
  262. const char maj_str[] = "Stub GSS error";
  263. (void)mech_type;
  264. if(min)
  265. *min = 0;
  266. if(message_context)
  267. *message_context = 0;
  268. if(status_string) {
  269. status_string->value = NULL;
  270. status_string->length = 0;
  271. if(status_value >= GSS_LAST)
  272. return GSS_S_FAILURE;
  273. switch(status_type) {
  274. case GSS_C_GSS_CODE:
  275. status_string->value = strdup(maj_str);
  276. break;
  277. case GSS_C_MECH_CODE:
  278. status_string->value = strdup(min_err_table[status_value]);
  279. break;
  280. default:
  281. return GSS_S_FAILURE;
  282. }
  283. if(status_string->value)
  284. status_string->length = strlen(status_string->value);
  285. else
  286. return GSS_S_FAILURE;
  287. }
  288. return GSS_S_COMPLETE;
  289. }
  290. /* Stubs returning error */
  291. OM_uint32 gss_display_name(OM_uint32 *min,
  292. gss_const_name_t input_name,
  293. gss_buffer_t output_name_buffer,
  294. gss_OID *output_name_type)
  295. {
  296. (void)min;
  297. (void)input_name;
  298. (void)output_name_buffer;
  299. (void)output_name_type;
  300. return GSS_S_FAILURE;
  301. }
  302. OM_uint32 gss_inquire_context(OM_uint32 *min,
  303. gss_const_ctx_id_t context_handle,
  304. gss_name_t *src_name,
  305. gss_name_t *targ_name,
  306. OM_uint32 *lifetime_rec,
  307. gss_OID *mech_type,
  308. OM_uint32 *ctx_flags,
  309. int *locally_initiated,
  310. int *open_context)
  311. {
  312. (void)min;
  313. (void)context_handle;
  314. (void)src_name;
  315. (void)targ_name;
  316. (void)lifetime_rec;
  317. (void)mech_type;
  318. (void)ctx_flags;
  319. (void)locally_initiated;
  320. (void)open_context;
  321. return GSS_S_FAILURE;
  322. }
  323. OM_uint32 gss_wrap(OM_uint32 *min,
  324. gss_const_ctx_id_t context_handle,
  325. int conf_req_flag,
  326. gss_qop_t qop_req,
  327. const gss_buffer_t input_message_buffer,
  328. int *conf_state,
  329. gss_buffer_t output_message_buffer)
  330. {
  331. (void)min;
  332. (void)context_handle;
  333. (void)conf_req_flag;
  334. (void)qop_req;
  335. (void)input_message_buffer;
  336. (void)conf_state;
  337. (void)output_message_buffer;
  338. return GSS_S_FAILURE;
  339. }
  340. OM_uint32 gss_unwrap(OM_uint32 *min,
  341. gss_const_ctx_id_t context_handle,
  342. const gss_buffer_t input_message_buffer,
  343. gss_buffer_t output_message_buffer,
  344. int *conf_state,
  345. gss_qop_t *qop_state)
  346. {
  347. (void)min;
  348. (void)context_handle;
  349. (void)input_message_buffer;
  350. (void)output_message_buffer;
  351. (void)conf_state;
  352. (void)qop_state;
  353. return GSS_S_FAILURE;
  354. }
  355. OM_uint32 gss_seal(OM_uint32 *min,
  356. gss_ctx_id_t context_handle,
  357. int conf_req_flag,
  358. int qop_req,
  359. gss_buffer_t input_message_buffer,
  360. int *conf_state,
  361. gss_buffer_t output_message_buffer)
  362. {
  363. (void)min;
  364. (void)context_handle;
  365. (void)conf_req_flag;
  366. (void)qop_req;
  367. (void)input_message_buffer;
  368. (void)conf_state;
  369. (void)output_message_buffer;
  370. return GSS_S_FAILURE;
  371. }
  372. OM_uint32 gss_unseal(OM_uint32 *min,
  373. gss_ctx_id_t context_handle,
  374. gss_buffer_t input_message_buffer,
  375. gss_buffer_t output_message_buffer,
  376. int *conf_state,
  377. int *qop_state)
  378. {
  379. (void)min;
  380. (void)context_handle;
  381. (void)input_message_buffer;
  382. (void)output_message_buffer;
  383. (void)conf_state;
  384. (void)qop_state;
  385. return GSS_S_FAILURE;
  386. }