spnego_gssapi.c (9204B)
1 /*************************************************************************** 2 * _ _ ____ _ 3 * Project ___| | | | _ \| | 4 * / __| | | | |_) | | 5 * | (__| |_| | _ <| |___ 6 * \___|\___/|_| \_\_____| 7 * 8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. 9 * 10 * This software is licensed as described in the file COPYING, which 11 * you should have received as part of this distribution. The terms 12 * are also available at https://curl.se/docs/copyright.html. 13 * 14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell 15 * copies of the Software, and permit persons to whom the Software is 16 * furnished to do so, under the terms of the COPYING file. 17 * 18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 19 * KIND, either express or implied. 20 * 21 * SPDX-License-Identifier: curl 22 * 23 * RFC4178 Simple and Protected GSS-API Negotiation Mechanism 24 * 25 ***************************************************************************/ 26 27 #include "../curl_setup.h" 28 29 #if defined(HAVE_GSSAPI) && defined(USE_SPNEGO) 30 31 #include <curl/curl.h> 32 33 #include "vauth.h" 34 #include "../urldata.h" 35 #include "../curlx/base64.h" 36 #include "../curl_gssapi.h" 37 #include "../curlx/warnless.h" 38 #include "../curlx/multibyte.h" 39 #include "../sendf.h" 40 41 /* The last #include files should be: */ 42 #include "../curl_memory.h" 43 #include "../memdebug.h" 44 45 #if defined(__GNUC__) && defined(__APPLE__) 46 #pragma GCC diagnostic push 47 #pragma GCC diagnostic ignored "-Wdeprecated-declarations" 48 #endif 49 50 /* 51 * Curl_auth_is_spnego_supported() 52 * 53 * This is used to evaluate if SPNEGO (Negotiate) is supported. 54 * 55 * Parameters: None 56 * 57 * Returns TRUE if Negotiate supported by the GSS-API library. 58 */ 59 bool Curl_auth_is_spnego_supported(void) 60 { 61 return TRUE; 62 } 63 64 /* 65 * Curl_auth_decode_spnego_message() 66 * 67 * This is used to decode an already encoded SPNEGO (Negotiate) challenge 68 * message. 69 * 70 * Parameters: 71 * 72 * data [in] - The session handle. 73 * userp [in] - The username in the format User or Domain\User. 74 * passwdp [in] - The user's password. 75 * service [in] - The service type such as http, smtp, pop or imap. 76 * host [in] - The hostname. 77 * chlg64 [in] - The optional base64 encoded challenge message. 78 * nego [in/out] - The Negotiate data struct being used and modified. 79 * 80 * Returns CURLE_OK on success. 81 */ 82 CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data, 83 const char *user, 84 const char *password, 85 const char *service, 86 const char *host, 87 const char *chlg64, 88 struct negotiatedata *nego) 89 { 90 CURLcode result = CURLE_OK; 91 size_t chlglen = 0; 92 unsigned char *chlg = NULL; 93 OM_uint32 major_status; 94 OM_uint32 minor_status; 95 OM_uint32 unused_status; 96 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER; 97 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; 98 gss_channel_bindings_t chan_bindings = GSS_C_NO_CHANNEL_BINDINGS; 99 struct gss_channel_bindings_struct chan; 100 101 (void) user; 102 (void) password; 103 104 if(nego->context && nego->status == GSS_S_COMPLETE) { 105 /* We finished successfully our part of authentication, but server 106 * rejected it (since we are again here). Exit with an error since we 107 * cannot invent anything better */ 108 Curl_auth_cleanup_spnego(nego); 109 return CURLE_LOGIN_DENIED; 110 } 111 112 if(!nego->spn) { 113 gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER; 114 115 /* Generate our SPN */ 116 char *spn = Curl_auth_build_spn(service, NULL, host); 117 if(!spn) 118 return CURLE_OUT_OF_MEMORY; 119 120 /* Populate the SPN structure */ 121 spn_token.value = spn; 122 spn_token.length = strlen(spn); 123 124 /* Import the SPN */ 125 major_status = gss_import_name(&minor_status, &spn_token, 126 GSS_C_NT_HOSTBASED_SERVICE, 127 &nego->spn); 128 if(GSS_ERROR(major_status)) { 129 Curl_gss_log_error(data, "gss_import_name() failed: ", 130 major_status, minor_status); 131 132 free(spn); 133 134 return CURLE_AUTH_ERROR; 135 } 136 137 free(spn); 138 } 139 140 if(chlg64 && *chlg64) { 141 /* Decode the base-64 encoded challenge message */ 142 if(*chlg64 != '=') { 143 result = curlx_base64_decode(chlg64, &chlg, &chlglen); 144 if(result) 145 return result; 146 } 147 148 /* Ensure we have a valid challenge message */ 149 if(!chlg) { 150 infof(data, "SPNEGO handshake failure (empty challenge message)"); 151 return CURLE_BAD_CONTENT_ENCODING; 152 } 153 154 /* Setup the challenge "input" security buffer */ 155 input_token.value = chlg; 156 input_token.length = chlglen; 157 } 158 159 /* Set channel binding data if available */ 160 if(curlx_dyn_len(&nego->channel_binding_data)) { 161 memset(&chan, 0, sizeof(struct gss_channel_bindings_struct)); 162 chan.application_data.length = curlx_dyn_len(&nego->channel_binding_data); 163 chan.application_data.value = curlx_dyn_ptr(&nego->channel_binding_data); 164 chan_bindings = &chan; 165 } 166 167 /* Generate our challenge-response message */ 168 major_status = Curl_gss_init_sec_context(data, 169 &minor_status, 170 &nego->context, 171 nego->spn, 172 &Curl_spnego_mech_oid, 173 chan_bindings, 174 &input_token, 175 &output_token, 176 TRUE, 177 NULL); 178 179 /* Free the decoded challenge as it is not required anymore */ 180 Curl_safefree(input_token.value); 181 182 nego->status = major_status; 183 if(GSS_ERROR(major_status)) { 184 if(output_token.value) 185 gss_release_buffer(&unused_status, &output_token); 186 187 Curl_gss_log_error(data, "gss_init_sec_context() failed: ", 188 major_status, minor_status); 189 190 return CURLE_AUTH_ERROR; 191 } 192 193 if(!output_token.value || !output_token.length) { 194 if(output_token.value) 195 gss_release_buffer(&unused_status, &output_token); 196 197 return CURLE_AUTH_ERROR; 198 } 199 200 /* Free previous token */ 201 if(nego->output_token.length && nego->output_token.value) 202 gss_release_buffer(&unused_status, &nego->output_token); 203 204 nego->output_token = output_token; 205 206 return CURLE_OK; 207 } 208 209 /* 210 * Curl_auth_create_spnego_message() 211 * 212 * This is used to generate an already encoded SPNEGO (Negotiate) response 213 * message ready for sending to the recipient. 214 * 215 * Parameters: 216 * 217 * data [in] - The session handle. 218 * nego [in/out] - The Negotiate data struct being used and modified. 219 * outptr [in/out] - The address where a pointer to newly allocated memory 220 * holding the result will be stored upon completion. 221 * outlen [out] - The length of the output message. 222 * 223 * Returns CURLE_OK on success. 224 */ 225 CURLcode Curl_auth_create_spnego_message(struct negotiatedata *nego, 226 char **outptr, size_t *outlen) 227 { 228 CURLcode result; 229 OM_uint32 minor_status; 230 231 /* Base64 encode the already generated response */ 232 result = curlx_base64_encode(nego->output_token.value, 233 nego->output_token.length, 234 outptr, outlen); 235 236 if(result) { 237 gss_release_buffer(&minor_status, &nego->output_token); 238 nego->output_token.value = NULL; 239 nego->output_token.length = 0; 240 241 return result; 242 } 243 244 if(!*outptr || !*outlen) { 245 gss_release_buffer(&minor_status, &nego->output_token); 246 nego->output_token.value = NULL; 247 nego->output_token.length = 0; 248 249 return CURLE_REMOTE_ACCESS_DENIED; 250 } 251 252 return CURLE_OK; 253 } 254 255 /* 256 * Curl_auth_cleanup_spnego() 257 * 258 * This is used to clean up the SPNEGO (Negotiate) specific data. 259 * 260 * Parameters: 261 * 262 * nego [in/out] - The Negotiate data struct being cleaned up. 263 * 264 */ 265 void Curl_auth_cleanup_spnego(struct negotiatedata *nego) 266 { 267 OM_uint32 minor_status; 268 269 /* Free our security context */ 270 if(nego->context != GSS_C_NO_CONTEXT) { 271 Curl_gss_delete_sec_context(&minor_status, &nego->context, 272 GSS_C_NO_BUFFER); 273 nego->context = GSS_C_NO_CONTEXT; 274 } 275 276 /* Free the output token */ 277 if(nego->output_token.value) { 278 gss_release_buffer(&minor_status, &nego->output_token); 279 nego->output_token.value = NULL; 280 nego->output_token.length = 0; 281 } 282 283 /* Free the SPN */ 284 if(nego->spn != GSS_C_NO_NAME) { 285 gss_release_name(&minor_status, &nego->spn); 286 nego->spn = GSS_C_NO_NAME; 287 } 288 289 /* Reset any variables */ 290 nego->status = 0; 291 nego->noauthpersist = FALSE; 292 nego->havenoauthpersist = FALSE; 293 nego->havenegdata = FALSE; 294 nego->havemultiplerequests = FALSE; 295 } 296 297 #if defined(__GNUC__) && defined(__APPLE__) 298 #pragma GCC diagnostic pop 299 #endif 300 301 #endif /* HAVE_GSSAPI && USE_SPNEGO */