#include <curl/curl.h>
+#include "vauth/vauth.h"
#include "curl_sasl.h"
#include "urldata.h"
#include "curl_base64.h"
#include "memdebug.h"
/*
-* Curl_sasl_build_gssapi_spn()
-*
-* This is used to build a SPN string in the format service@instance.
-*
-* Parameters:
-*
-* service [in] - The service type such as www, smtp, pop or imap.
-* instance [in] - The host name or realm.
-*
-* Returns a pointer to the newly allocated SPN.
-*/
-char *Curl_sasl_build_gssapi_spn(const char *service, const char *instance)
+ * Curl_auth_is_gssapi_supported()
+ *
+ * This is used to evaluate if GSSAPI (Kerberos V5) is supported.
+ *
+ * Parameters: None
+ *
+ * Returns TRUE if Kerberos V5 is supported by the GSS-API library.
+ */
+bool Curl_auth_is_gssapi_supported(void)
{
- /* Generate and return our SPN */
- return aprintf("%s@%s", service, instance);
+ return TRUE;
}
/*
- * Curl_sasl_create_gssapi_user_message()
+ * Curl_auth_create_gssapi_user_message()
*
* This is used to generate an already encoded GSSAPI (Kerberos V5) user token
* message ready for sending to the recipient.
* data [in] - The session handle.
* userp [in] - The user name.
* passdwp [in] - The user's password.
- * service [in] - The service type such as www, smtp, pop or imap.
+ * service [in] - The service type such as http, smtp, pop or imap.
+ * host [in[ - The host name.
* mutual_auth [in] - Flag specifing whether or not mutual authentication
* is enabled.
* chlg64 [in] - Pointer to the optional base64 encoded challenge
*
* Returns CURLE_OK on success.
*/
-CURLcode Curl_sasl_create_gssapi_user_message(struct SessionHandle *data,
+CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
const char *userp,
const char *passwdp,
const char *service,
+ const char *host,
const bool mutual_auth,
const char *chlg64,
struct kerberos5data *krb5,
CURLcode result = CURLE_OK;
size_t chlglen = 0;
unsigned char *chlg = NULL;
- OM_uint32 gss_status;
- OM_uint32 gss_major_status;
- OM_uint32 gss_minor_status;
+ OM_uint32 major_status;
+ OM_uint32 minor_status;
+ OM_uint32 unused_status;
gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
(void) userp;
(void) passwdp;
- if(krb5->context == GSS_C_NO_CONTEXT) {
+ if(!krb5->spn) {
/* Generate our SPN */
- char *spn = Curl_sasl_build_gssapi_spn(service,
- data->easy_conn->host.name);
+ char *spn = Curl_auth_build_spn(service, NULL, host);
if(!spn)
return CURLE_OUT_OF_MEMORY;
spn_token.length = strlen(spn);
/* Import the SPN */
- gss_major_status = gss_import_name(&gss_minor_status, &spn_token,
- GSS_C_NT_HOSTBASED_SERVICE, &krb5->spn);
- if(GSS_ERROR(gss_major_status)) {
- Curl_gss_log_error(data, gss_minor_status, "gss_import_name() failed: ");
+ major_status = gss_import_name(&minor_status, &spn_token,
+ GSS_C_NT_HOSTBASED_SERVICE, &krb5->spn);
+ if(GSS_ERROR(major_status)) {
+ Curl_gss_log_error(data, "gss_import_name() failed: ",
+ major_status, minor_status);
free(spn);
free(spn);
}
- else {
+
+ if(chlg64 && *chlg64) {
/* Decode the base-64 encoded challenge message */
- if(strlen(chlg64) && *chlg64 != '=') {
+ if(*chlg64 != '=') {
result = Curl_base64_decode(chlg64, &chlg, &chlglen);
if(result)
return result;
input_token.length = chlglen;
}
- gss_major_status = Curl_gss_init_sec_context(data,
- &gss_minor_status,
- &krb5->context,
- krb5->spn,
- &Curl_krb5_mech_oid,
- GSS_C_NO_CHANNEL_BINDINGS,
- &input_token,
- &output_token,
- mutual_auth,
- NULL);
-
+ major_status = Curl_gss_init_sec_context(data,
+ &minor_status,
+ &krb5->context,
+ krb5->spn,
+ &Curl_krb5_mech_oid,
+ GSS_C_NO_CHANNEL_BINDINGS,
+ &input_token,
+ &output_token,
+ mutual_auth,
+ NULL);
+
+ /* Free the decoded challenge as it is not required anymore */
free(input_token.value);
- if(GSS_ERROR(gss_major_status)) {
+ if(GSS_ERROR(major_status)) {
if(output_token.value)
- gss_release_buffer(&gss_status, &output_token);
+ gss_release_buffer(&unused_status, &output_token);
- Curl_gss_log_error(data, gss_minor_status,
- "gss_init_sec_context() failed: ");
+ Curl_gss_log_error(data, "gss_init_sec_context() failed: ",
+ major_status, minor_status);
return CURLE_RECV_ERROR;
}
result = Curl_base64_encode(data, (char *) output_token.value,
output_token.length, outptr, outlen);
- gss_release_buffer(&gss_status, &output_token);
+ gss_release_buffer(&unused_status, &output_token);
+ }
+ else if(mutual_auth) {
+ *outptr = strdup("");
+ if(!*outptr)
+ result = CURLE_OUT_OF_MEMORY;
}
return result;
}
/*
- * Curl_sasl_create_gssapi_security_message()
+ * Curl_auth_create_gssapi_security_message()
*
* This is used to generate an already encoded GSSAPI (Kerberos V5) security
* token message ready for sending to the recipient.
*
* Returns CURLE_OK on success.
*/
-CURLcode Curl_sasl_create_gssapi_security_message(struct SessionHandle *data,
+CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
const char *chlg64,
struct kerberos5data *krb5,
char **outptr,
size_t messagelen = 0;
unsigned char *chlg = NULL;
unsigned char *message = NULL;
- OM_uint32 gss_status;
- OM_uint32 gss_major_status;
- OM_uint32 gss_minor_status;
+ OM_uint32 major_status;
+ OM_uint32 minor_status;
+ OM_uint32 unused_status;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
unsigned int indata = 0;
}
/* Get the fully qualified username back from the context */
- gss_major_status = gss_inquire_context(&gss_minor_status, krb5->context,
- &username, NULL, NULL, NULL, NULL,
- NULL, NULL);
- if(GSS_ERROR(gss_major_status)) {
- Curl_gss_log_error(data, gss_minor_status,
- "gss_inquire_context() failed: ");
+ major_status = gss_inquire_context(&minor_status, krb5->context,
+ &username, NULL, NULL, NULL, NULL,
+ NULL, NULL);
+ if(GSS_ERROR(major_status)) {
+ Curl_gss_log_error(data, "gss_inquire_context() failed: ",
+ major_status, minor_status);
free(chlg);
}
/* Convert the username from internal format to a displayable token */
- gss_major_status = gss_display_name(&gss_minor_status, username,
- &username_token, NULL);
- if(GSS_ERROR(gss_major_status)) {
- Curl_gss_log_error(data, gss_minor_status, "gss_display_name() failed: ");
+ major_status = gss_display_name(&minor_status, username,
+ &username_token, NULL);
+ if(GSS_ERROR(major_status)) {
+ Curl_gss_log_error(data, "gss_display_name() failed: ",
+ major_status, minor_status);
free(chlg);
input_token.length = chlglen;
/* Decrypt the inbound challenge and obtain the qop */
- gss_major_status = gss_unwrap(&gss_minor_status, krb5->context, &input_token,
- &output_token, NULL, &qop);
- if(GSS_ERROR(gss_major_status)) {
- Curl_gss_log_error(data, gss_minor_status, "gss_unwrap() failed: ");
+ major_status = gss_unwrap(&minor_status, krb5->context, &input_token,
+ &output_token, NULL, &qop);
+ if(GSS_ERROR(major_status)) {
+ Curl_gss_log_error(data, "gss_unwrap() failed: ",
+ major_status, minor_status);
- gss_release_buffer(&gss_status, &username_token);
+ gss_release_buffer(&unused_status, &username_token);
free(chlg);
return CURLE_BAD_CONTENT_ENCODING;
if(output_token.length != 4) {
infof(data, "GSSAPI handshake failure (invalid security data)\n");
- gss_release_buffer(&gss_status, &username_token);
+ gss_release_buffer(&unused_status, &username_token);
free(chlg);
return CURLE_BAD_CONTENT_ENCODING;
/* Copy the data out and free the challenge as it is not required anymore */
memcpy(&indata, output_token.value, 4);
- gss_release_buffer(&gss_status, &output_token);
+ gss_release_buffer(&unused_status, &output_token);
free(chlg);
/* Extract the security layer */
if(!(sec_layer & GSSAUTH_P_NONE)) {
infof(data, "GSSAPI handshake failure (invalid security layer)\n");
- gss_release_buffer(&gss_status, &username_token);
+ gss_release_buffer(&unused_status, &username_token);
return CURLE_BAD_CONTENT_ENCODING;
}
messagelen = sizeof(outdata) + username_token.length + 1;
message = malloc(messagelen);
if(!message) {
- gss_release_buffer(&gss_status, &username_token);
+ gss_release_buffer(&unused_status, &username_token);
return CURLE_OUT_OF_MEMORY;
}
/* Populate the message with the security layer, client supported receive
message size and authorization identity including the 0x00 based
- terminator. Note: Dispite RFC4752 Section 3.1 stating "The authorization
+ terminator. Note: Despite RFC4752 Section 3.1 stating "The authorization
identity is not terminated with the zero-valued (%x00) octet." it seems
necessary to include it. */
outdata = htonl(max_size) | sec_layer;
message[messagelen - 1] = '\0';
/* Free the username token as it is not required anymore */
- gss_release_buffer(&gss_status, &username_token);
+ gss_release_buffer(&unused_status, &username_token);
/* Setup the "authentication data" security buffer */
input_token.value = message;
input_token.length = messagelen;
/* Encrypt the data */
- gss_major_status = gss_wrap(&gss_minor_status, krb5->context, 0,
- GSS_C_QOP_DEFAULT, &input_token, NULL,
- &output_token);
- if(GSS_ERROR(gss_major_status)) {
- Curl_gss_log_error(data, gss_minor_status, "gss_wrap() failed: ");
+ major_status = gss_wrap(&minor_status, krb5->context, 0,
+ GSS_C_QOP_DEFAULT, &input_token, NULL,
+ &output_token);
+ if(GSS_ERROR(major_status)) {
+ Curl_gss_log_error(data, "gss_wrap() failed: ",
+ major_status, minor_status);
free(message);
output_token.length, outptr, outlen);
/* Free the output buffer */
- gss_release_buffer(&gss_status, &output_token);
+ gss_release_buffer(&unused_status, &output_token);
/* Free the message buffer */
free(message);
}
/*
- * Curl_sasl_gssapi_cleanup()
+ * Curl_auth_gssapi_cleanup()
*
* This is used to clean up the GSSAPI (Kerberos V5) specific data.
*
* krb5 [in/out] - The Kerberos 5 data struct being cleaned up.
*
*/
-void Curl_sasl_gssapi_cleanup(struct kerberos5data *krb5)
+void Curl_auth_gssapi_cleanup(struct kerberos5data *krb5)
{
OM_uint32 minor_status;
projects / platform / upstream / curl.git / blobdiff