1 /***************************************************************************
3 * Project ___| | | | _ \| |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
8 * Copyright (C) 2014, Steve Holme, <steve_holme@hotmail.com>.
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at http://curl.haxx.se/docs/copyright.html.
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
21 * RFC4752 The Kerberos V5 ("GSSAPI") SASL Mechanism
23 ***************************************************************************/
25 #include "curl_setup.h"
27 #if defined(HAVE_GSSAPI) && defined(USE_KERBEROS5)
29 #ifdef HAVE_OLD_GSSMIT
30 #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
34 #define GSSAUTH_P_NONE 1
35 #define GSSAUTH_P_INTEGRITY 2
36 #define GSSAUTH_P_PRIVACY 4
38 #include <curl/curl.h>
40 #include "curl_sasl.h"
42 #include "curl_base64.h"
43 #include "curl_gssapi.h"
44 #include "curl_memory.h"
47 #define _MPRINTF_REPLACE /* use our functions only */
48 #include <curl/mprintf.h>
50 /* The last #include file should be: */
54 * Curl_sasl_build_gssapi_spn()
56 * This is used to build a SPN string in the format service@host.
60 * serivce [in] - The service type such as www, smtp, pop or imap.
61 * host [in] - The host name or realm.
63 * Returns a pointer to the newly allocated SPN.
65 static char *Curl_sasl_build_gssapi_spn(const char *service, const char *host)
67 /* Generate and return our SPN */
68 return aprintf("%s@%s", service, host);
72 * Curl_sasl_create_gssapi_user_message()
74 * This is used to generate an already encoded GSSAPI (Kerberos V5) user token
75 * message ready for sending to the recipient.
79 * data [in] - The session handle.
80 * userp [in] - The user name.
81 * passdwp [in] - The user's password.
82 * service [in] - The service type such as www, smtp, pop or imap.
83 * mutual_auth [in] - Flag specifing whether or not mutual authentication
85 * chlg64 [in] - Pointer to the optional base64 encoded challenge
87 * krb5 [in/out] - The gssapi data struct being used and modified.
88 * outptr [in/out] - The address where a pointer to newly allocated memory
89 * holding the result will be stored upon completion.
90 * outlen [out] - The length of the output message.
92 * Returns CURLE_OK on success.
94 CURLcode Curl_sasl_create_gssapi_user_message(struct SessionHandle *data,
98 const bool mutual_auth,
100 struct kerberos5data *krb5,
101 char **outptr, size_t *outlen)
103 CURLcode result = CURLE_OK;
105 unsigned char *chlg = NULL;
106 OM_uint32 gss_status;
107 OM_uint32 gss_major_status;
108 OM_uint32 gss_minor_status;
109 gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
110 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
111 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
116 if(krb5->context == GSS_C_NO_CONTEXT) {
117 /* Generate our SPN */
118 char *spn = Curl_sasl_build_gssapi_spn(service,
119 data->easy_conn->host.name);
121 return CURLE_OUT_OF_MEMORY;
123 /* Populate the SPN structure */
124 spn_token.value = spn;
125 spn_token.length = strlen(spn);
128 gss_major_status = gss_import_name(&gss_minor_status, &spn_token,
129 gss_nt_service_name, &krb5->spn);
130 if(GSS_ERROR(gss_major_status)) {
131 Curl_gss_log_error(data, gss_minor_status, "gss_import_name() failed: ");
133 return CURLE_OUT_OF_MEMORY;
137 /* Decode the base-64 encoded challenge message */
138 if(strlen(chlg64) && *chlg64 != '=') {
139 result = Curl_base64_decode(chlg64, &chlg, &chlglen);
144 /* Ensure we have a valid challenge message */
146 infof(data, "GSSAPI handshake failure (empty challenge message)\n");
148 return CURLE_BAD_CONTENT_ENCODING;
151 /* Setup the challenge "input" security buffer */
152 input_token.value = chlg;
153 input_token.length = chlglen;
156 gss_major_status = Curl_gss_init_sec_context(data,
161 GSS_C_NO_CHANNEL_BINDINGS,
167 Curl_safefree(input_token.value);
169 if(GSS_ERROR(gss_major_status)) {
170 if(output_token.value)
171 gss_release_buffer(&gss_status, &output_token);
173 Curl_gss_log_error(data, gss_minor_status,
174 "gss_init_sec_context() failed: ");
176 return CURLE_RECV_ERROR;
179 if(output_token.value && output_token.length) {
180 /* Base64 encode the response */
181 result = Curl_base64_encode(data, (char *) output_token.value,
182 output_token.length, outptr, outlen);
184 gss_release_buffer(&gss_status, &output_token);
191 * Curl_sasl_create_gssapi_security_message()
193 * This is used to generate an already encoded GSSAPI (Kerberos V5) security
194 * token message ready for sending to the recipient.
198 * data [in] - The session handle.
199 * chlg64 [in] - Pointer to the optional base64 encoded challenge message.
200 * krb5 [in/out] - The gssapi data struct being used and modified.
201 * outptr [in/out] - The address where a pointer to newly allocated memory
202 * holding the result will be stored upon completion.
203 * outlen [out] - The length of the output message.
205 * Returns CURLE_OK on success.
207 CURLcode Curl_sasl_create_gssapi_security_message(struct SessionHandle *data,
209 struct kerberos5data *krb5,
213 CURLcode result = CURLE_OK;
215 size_t messagelen = 0;
216 unsigned char *chlg = NULL;
217 unsigned char *message = NULL;
218 OM_uint32 gss_status;
219 OM_uint32 gss_major_status;
220 OM_uint32 gss_minor_status;
221 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
222 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
223 unsigned int indata = 0;
224 unsigned int outdata = 0;
225 gss_qop_t qop = GSS_C_QOP_DEFAULT;
226 unsigned int sec_layer = 0;
227 unsigned int max_size = 0;
228 gss_name_t username = GSS_C_NO_NAME;
229 gss_buffer_desc username_token;
231 /* Decode the base-64 encoded input message */
232 if(strlen(chlg64) && *chlg64 != '=') {
233 result = Curl_base64_decode(chlg64, &chlg, &chlglen);
238 /* Ensure we have a valid challenge message */
240 infof(data, "GSSAPI handshake failure (empty security message)\n");
242 return CURLE_BAD_CONTENT_ENCODING;
245 /* Get the fully qualified username back from the context */
246 gss_major_status = gss_inquire_context(&gss_minor_status, krb5->context,
247 &username, NULL, NULL, NULL, NULL,
249 if(GSS_ERROR(gss_major_status)) {
250 Curl_gss_log_error(data, gss_minor_status,
251 "gss_inquire_context() failed: ");
255 return CURLE_OUT_OF_MEMORY;
258 /* Convert the username from internal format to a displayable token */
259 gss_major_status = gss_display_name(&gss_minor_status, username,
260 &username_token, NULL);
261 if(GSS_ERROR(gss_major_status)) {
262 Curl_gss_log_error(data, gss_minor_status, "gss_display_name() failed: ");
266 return CURLE_OUT_OF_MEMORY;
269 /* Setup the challenge "input" security buffer */
270 input_token.value = chlg;
271 input_token.length = chlglen;
273 /* Decrypt the inbound challenge and obtain the qop */
274 gss_major_status = gss_unwrap(&gss_minor_status, krb5->context, &input_token,
275 &output_token, NULL, &qop);
276 if(GSS_ERROR(gss_major_status)) {
277 Curl_gss_log_error(data, gss_minor_status, "gss_unwrap() failed: ");
279 gss_release_buffer(&gss_status, &username_token);
282 return CURLE_BAD_CONTENT_ENCODING;
285 /* Not 4 octets long so fail as per RFC4752 Section 3.1 */
286 if(output_token.length != 4) {
287 infof(data, "GSSAPI handshake failure (invalid security data)\n");
289 gss_release_buffer(&gss_status, &username_token);
292 return CURLE_BAD_CONTENT_ENCODING;
295 /* Copy the data out and free the challenge as it is not required anymore */
296 memcpy(&indata, output_token.value, 4);
297 gss_release_buffer(&gss_status, &output_token);
300 /* Extract the security layer */
301 sec_layer = indata & 0x000000FF;
302 if(!(sec_layer & GSSAUTH_P_NONE)) {
303 infof(data, "GSSAPI handshake failure (invalid security layer)\n");
305 gss_release_buffer(&gss_status, &username_token);
307 return CURLE_BAD_CONTENT_ENCODING;
310 /* Extract the maximum message size the server can receive */
311 max_size = ntohl(indata & 0xFFFFFF00);
313 /* The server has told us it supports a maximum receive buffer, however, as
314 we don't require one unless we are encrypting data, we tell the server
315 our receive buffer is zero. */
319 /* Allocate our message */
320 messagelen = sizeof(outdata) + username_token.length + 1;
321 message = malloc(messagelen);
323 gss_release_buffer(&gss_status, &username_token);
325 return CURLE_OUT_OF_MEMORY;
328 /* Populate the message with the security layer, client supported receive
329 message size and authorization identity including the 0x00 based
330 terminator. Note: Dispite RFC4752 Section 3.1 stating "The authorization
331 identity is not terminated with the zero-valued (%x00) octet." it seems
332 necessary to include it. */
333 outdata = htonl(max_size) | sec_layer;
334 memcpy(message, &outdata, sizeof(outdata));
335 memcpy(message + sizeof(outdata), username_token.value,
336 username_token.length);
337 message[messagelen - 1] = '\0';
339 /* Free the username token as it is not required anymore */
340 gss_release_buffer(&gss_status, &username_token);
342 /* Setup the "authentication data" security buffer */
343 input_token.value = message;
344 input_token.length = messagelen;
346 /* Encrypt the data */
347 gss_major_status = gss_wrap(&gss_minor_status, krb5->context, 0,
348 GSS_C_QOP_DEFAULT, &input_token, NULL,
350 if(GSS_ERROR(gss_major_status)) {
351 Curl_gss_log_error(data, gss_minor_status, "gss_wrap() failed: ");
353 Curl_safefree(message);
355 return CURLE_OUT_OF_MEMORY;
358 /* Base64 encode the response */
359 result = Curl_base64_encode(data, (char *) output_token.value,
360 output_token.length, outptr, outlen);
362 /* Free the output buffer */
363 gss_release_buffer(&gss_status, &output_token);
365 /* Free the message buffer */
366 Curl_safefree(message);
372 * Curl_sasl_gssapi_cleanup()
374 * This is used to clean up the gssapi specific data.
378 * krb5 [in/out] - The kerberos 5 data struct being cleaned up.
381 void Curl_sasl_gssapi_cleanup(struct kerberos5data *krb5)
383 OM_uint32 minor_status;
385 /* Free our security context */
386 if(krb5->context != GSS_C_NO_CONTEXT) {
387 gss_delete_sec_context(&minor_status, &krb5->context, GSS_C_NO_BUFFER);
388 krb5->context = GSS_C_NO_CONTEXT;
392 if(krb5->spn != GSS_C_NO_NAME) {
393 gss_release_name(&minor_status, &krb5->spn);
394 krb5->spn = GSS_C_NO_NAME;
398 #endif /* HAVE_GSSAPI && USE_KERBEROS5 */