curl_gssapi.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <[email protected]>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. #include "curl_setup.h"
  25. #ifdef HAVE_GSSAPI
  26. #include "curl_gssapi.h"
  27. #include "sendf.h"
  28. /* The last 3 #include files should be in this order */
  29. #include "curl_printf.h"
  30. #include "curl_memory.h"
  31. #include "memdebug.h"
  32. #ifdef __GNUC__
  33. #define CURL_ALIGN8 __attribute__((aligned(8)))
  34. #else
  35. #define CURL_ALIGN8
  36. #endif
  37. #if defined(__GNUC__) && defined(__APPLE__)
  38. #pragma GCC diagnostic push
  39. #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
  40. #endif
  41. gss_OID_desc Curl_spnego_mech_oid CURL_ALIGN8 = {
  42. 6, CURL_UNCONST("\x2b\x06\x01\x05\x05\x02")
  43. };
  44. gss_OID_desc Curl_krb5_mech_oid CURL_ALIGN8 = {
  45. 9, CURL_UNCONST("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02")
  46. };
  47. #ifdef DEBUGBUILD
  48. enum min_err_code {
  49. STUB_GSS_OK = 0,
  50. STUB_GSS_NO_MEMORY,
  51. STUB_GSS_INVALID_ARGS,
  52. STUB_GSS_INVALID_CREDS,
  53. STUB_GSS_INVALID_CTX,
  54. STUB_GSS_SERVER_ERR,
  55. STUB_GSS_NO_MECH,
  56. STUB_GSS_LAST
  57. };
  58. /* libcurl is also passing this struct to these functions, which are not yet
  59. * stubbed:
  60. * gss_inquire_context()
  61. * gss_unwrap()
  62. * gss_wrap()
  63. */
  64. struct stub_gss_ctx_id_t_desc {
  65. enum { STUB_GSS_NONE, STUB_GSS_KRB5, STUB_GSS_NTLM1, STUB_GSS_NTLM3 } sent;
  66. int have_krb5;
  67. int have_ntlm;
  68. OM_uint32 flags;
  69. char creds[250];
  70. };
  71. static OM_uint32
  72. stub_gss_init_sec_context(OM_uint32 *min,
  73. gss_cred_id_t initiator_cred_handle,
  74. struct stub_gss_ctx_id_t_desc **context,
  75. gss_name_t target_name,
  76. const gss_OID mech_type,
  77. OM_uint32 req_flags,
  78. OM_uint32 time_req,
  79. const gss_channel_bindings_t input_chan_bindings,
  80. gss_buffer_desc *input_token,
  81. gss_OID *actual_mech_type,
  82. gss_buffer_desc *output_token,
  83. OM_uint32 *ret_flags,
  84. OM_uint32 *time_rec)
  85. {
  86. struct stub_gss_ctx_id_t_desc *ctx = NULL;
  87. /* The token will be encoded in base64 */
  88. size_t length = sizeof(ctx->creds) * 3 / 4;
  89. size_t used = 0;
  90. char *token = NULL;
  91. const char *creds = NULL;
  92. (void)initiator_cred_handle;
  93. (void)mech_type;
  94. (void)time_req;
  95. (void)input_chan_bindings;
  96. (void)actual_mech_type;
  97. if(!min)
  98. return GSS_S_FAILURE;
  99. *min = 0;
  100. if(!context || !target_name || !output_token) {
  101. *min = STUB_GSS_INVALID_ARGS;
  102. return GSS_S_FAILURE;
  103. }
  104. creds = getenv("CURL_STUB_GSS_CREDS");
  105. if(!creds || strlen(creds) >= sizeof(ctx->creds)) {
  106. *min = STUB_GSS_INVALID_CREDS;
  107. return GSS_S_FAILURE;
  108. }
  109. ctx = *context;
  110. if(ctx && strcmp(ctx->creds, creds)) {
  111. *min = STUB_GSS_INVALID_CREDS;
  112. return GSS_S_FAILURE;
  113. }
  114. output_token->length = 0;
  115. output_token->value = NULL;
  116. if(input_token && input_token->length) {
  117. if(!ctx) {
  118. *min = STUB_GSS_INVALID_CTX;
  119. return GSS_S_FAILURE;
  120. }
  121. /* Server response, either D (RA==) or C (Qw==) */
  122. if(((char *) input_token->value)[0] == 'D') {
  123. /* Done */
  124. switch(ctx->sent) {
  125. case STUB_GSS_KRB5:
  126. case STUB_GSS_NTLM3:
  127. if(ret_flags)
  128. *ret_flags = ctx->flags;
  129. if(time_rec)
  130. *time_rec = GSS_C_INDEFINITE;
  131. return GSS_S_COMPLETE;
  132. default:
  133. *min = STUB_GSS_SERVER_ERR;
  134. return GSS_S_FAILURE;
  135. }
  136. }
  137. if(((char *) input_token->value)[0] != 'C') {
  138. /* We only support Done or Continue */
  139. *min = STUB_GSS_SERVER_ERR;
  140. return GSS_S_FAILURE;
  141. }
  142. /* Continue */
  143. switch(ctx->sent) {
  144. case STUB_GSS_KRB5:
  145. /* We sent KRB5 and it failed, let's try NTLM */
  146. if(ctx->have_ntlm) {
  147. ctx->sent = STUB_GSS_NTLM1;
  148. break;
  149. }
  150. else {
  151. *min = STUB_GSS_SERVER_ERR;
  152. return GSS_S_FAILURE;
  153. }
  154. case STUB_GSS_NTLM1:
  155. ctx->sent = STUB_GSS_NTLM3;
  156. break;
  157. default:
  158. *min = STUB_GSS_SERVER_ERR;
  159. return GSS_S_FAILURE;
  160. }
  161. }
  162. else {
  163. if(ctx) {
  164. *min = STUB_GSS_INVALID_CTX;
  165. return GSS_S_FAILURE;
  166. }
  167. ctx = calloc(1, sizeof(*ctx));
  168. if(!ctx) {
  169. *min = STUB_GSS_NO_MEMORY;
  170. return GSS_S_FAILURE;
  171. }
  172. if(strstr(creds, "KRB5"))
  173. ctx->have_krb5 = 1;
  174. if(strstr(creds, "NTLM"))
  175. ctx->have_ntlm = 1;
  176. if(ctx->have_krb5)
  177. ctx->sent = STUB_GSS_KRB5;
  178. else if(ctx->have_ntlm)
  179. ctx->sent = STUB_GSS_NTLM1;
  180. else {
  181. free(ctx);
  182. *min = STUB_GSS_NO_MECH;
  183. return GSS_S_FAILURE;
  184. }
  185. strcpy(ctx->creds, creds);
  186. ctx->flags = req_flags;
  187. }
  188. /* To avoid memdebug macro replacement, wrap the name in parentheses to call
  189. the original version. It is freed via the GSS API gss_release_buffer(). */
  190. token = (malloc)(length);
  191. if(!token) {
  192. free(ctx);
  193. *min = STUB_GSS_NO_MEMORY;
  194. return GSS_S_FAILURE;
  195. }
  196. {
  197. gss_buffer_desc target_desc;
  198. gss_OID name_type = GSS_C_NO_OID;
  199. OM_uint32 minor_status;
  200. OM_uint32 major_status;
  201. major_status = gss_display_name(&minor_status, target_name,
  202. &target_desc, &name_type);
  203. if(GSS_ERROR(major_status)) {
  204. (free)(token);
  205. free(ctx);
  206. *min = STUB_GSS_NO_MEMORY;
  207. return GSS_S_FAILURE;
  208. }
  209. if(strlen(creds) + target_desc.length + 5 >= sizeof(ctx->creds)) {
  210. (free)(token);
  211. free(ctx);
  212. *min = STUB_GSS_NO_MEMORY;
  213. return GSS_S_FAILURE;
  214. }
  215. /* Token format: creds:target:type:padding */
  216. used = msnprintf(token, length, "%s:%.*s:%d:", creds,
  217. (int)target_desc.length, (const char *)target_desc.value,
  218. ctx->sent);
  219. gss_release_buffer(&minor_status, &target_desc);
  220. }
  221. if(used >= length) {
  222. (free)(token);
  223. free(ctx);
  224. *min = STUB_GSS_NO_MEMORY;
  225. return GSS_S_FAILURE;
  226. }
  227. /* Overwrite null-terminator */
  228. memset(token + used, 'A', length - used);
  229. *context = ctx;
  230. output_token->value = token;
  231. output_token->length = length;
  232. return GSS_S_CONTINUE_NEEDED;
  233. }
  234. static OM_uint32
  235. stub_gss_delete_sec_context(OM_uint32 *min,
  236. struct stub_gss_ctx_id_t_desc **context,
  237. gss_buffer_t output_token)
  238. {
  239. (void)output_token;
  240. if(!min)
  241. return GSS_S_FAILURE;
  242. if(!context) {
  243. *min = STUB_GSS_INVALID_CTX;
  244. return GSS_S_FAILURE;
  245. }
  246. if(!*context) {
  247. *min = STUB_GSS_INVALID_CTX;
  248. return GSS_S_FAILURE;
  249. }
  250. free(*context);
  251. *context = NULL;
  252. *min = 0;
  253. return GSS_S_COMPLETE;
  254. }
  255. #endif /* DEBUGBUILD */
  256. OM_uint32 Curl_gss_init_sec_context(struct Curl_easy *data,
  257. OM_uint32 *minor_status,
  258. gss_ctx_id_t *context,
  259. gss_name_t target_name,
  260. gss_OID mech_type,
  261. gss_channel_bindings_t input_chan_bindings,
  262. gss_buffer_t input_token,
  263. gss_buffer_t output_token,
  264. const bool mutual_auth,
  265. OM_uint32 *ret_flags)
  266. {
  267. OM_uint32 req_flags = GSS_C_REPLAY_FLAG;
  268. if(mutual_auth)
  269. req_flags |= GSS_C_MUTUAL_FLAG;
  270. if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_POLICY_FLAG) {
  271. #ifdef GSS_C_DELEG_POLICY_FLAG
  272. req_flags |= GSS_C_DELEG_POLICY_FLAG;
  273. #else
  274. infof(data, "WARNING: support for CURLGSSAPI_DELEGATION_POLICY_FLAG not "
  275. "compiled in");
  276. #endif
  277. }
  278. if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_FLAG)
  279. req_flags |= GSS_C_DELEG_FLAG;
  280. #ifdef DEBUGBUILD
  281. if(getenv("CURL_STUB_GSS_CREDS"))
  282. return stub_gss_init_sec_context(minor_status,
  283. GSS_C_NO_CREDENTIAL, /* cred_handle */
  284. (struct stub_gss_ctx_id_t_desc **)context,
  285. target_name,
  286. mech_type,
  287. req_flags,
  288. 0, /* time_req */
  289. input_chan_bindings,
  290. input_token,
  291. NULL, /* actual_mech_type */
  292. output_token,
  293. ret_flags,
  294. NULL /* time_rec */);
  295. #endif /* DEBUGBUILD */
  296. return gss_init_sec_context(minor_status,
  297. GSS_C_NO_CREDENTIAL, /* cred_handle */
  298. context,
  299. target_name,
  300. mech_type,
  301. req_flags,
  302. 0, /* time_req */
  303. input_chan_bindings,
  304. input_token,
  305. NULL, /* actual_mech_type */
  306. output_token,
  307. ret_flags,
  308. NULL /* time_rec */);
  309. }
  310. OM_uint32 Curl_gss_delete_sec_context(OM_uint32 *min,
  311. gss_ctx_id_t *context,
  312. gss_buffer_t output_token)
  313. {
  314. #ifdef DEBUGBUILD
  315. if(getenv("CURL_STUB_GSS_CREDS"))
  316. return stub_gss_delete_sec_context(min,
  317. (struct stub_gss_ctx_id_t_desc **)context,
  318. output_token);
  319. #endif /* DEBUGBUILD */
  320. return gss_delete_sec_context(min, context, output_token);
  321. }
  322. #define GSS_LOG_BUFFER_LEN 1024
  323. static size_t display_gss_error(OM_uint32 status, int type,
  324. char *buf, size_t len) {
  325. OM_uint32 maj_stat;
  326. OM_uint32 min_stat;
  327. OM_uint32 msg_ctx = 0;
  328. gss_buffer_desc status_string = GSS_C_EMPTY_BUFFER;
  329. do {
  330. maj_stat = gss_display_status(&min_stat,
  331. status,
  332. type,
  333. GSS_C_NO_OID,
  334. &msg_ctx,
  335. &status_string);
  336. if(maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
  337. if(GSS_LOG_BUFFER_LEN > len + status_string.length + 3) {
  338. len += msnprintf(buf + len, GSS_LOG_BUFFER_LEN - len,
  339. "%.*s. ", (int)status_string.length,
  340. (char *)status_string.value);
  341. }
  342. }
  343. gss_release_buffer(&min_stat, &status_string);
  344. } while(!GSS_ERROR(maj_stat) && msg_ctx);
  345. return len;
  346. }
  347. /*
  348. * Curl_gss_log_error()
  349. *
  350. * This is used to log a GSS-API error status.
  351. *
  352. * Parameters:
  353. *
  354. * data [in] - The session handle.
  355. * prefix [in] - The prefix of the log message.
  356. * major [in] - The major status code.
  357. * minor [in] - The minor status code.
  358. */
  359. void Curl_gss_log_error(struct Curl_easy *data, const char *prefix,
  360. OM_uint32 major, OM_uint32 minor)
  361. {
  362. char buf[GSS_LOG_BUFFER_LEN];
  363. size_t len = 0;
  364. if(major != GSS_S_FAILURE)
  365. len = display_gss_error(major, GSS_C_GSS_CODE, buf, len);
  366. display_gss_error(minor, GSS_C_MECH_CODE, buf, len);
  367. infof(data, "%s%s", prefix, buf);
  368. #ifdef CURL_DISABLE_VERBOSE_STRINGS
  369. (void)data;
  370. (void)prefix;
  371. #endif
  372. }
  373. #if defined(__GNUC__) && defined(__APPLE__)
  374. #pragma GCC diagnostic pop
  375. #endif
  376. #endif /* HAVE_GSSAPI */