1 /*************************************************************************** 2 * _ _ ____ _ 3 * Project ___| | | | _ \| | 4 * / __| | | | |_) | | 5 * | (__| |_| | _ <| |___ 6 * \___|\___/|_| \_\_____| 7 * 8 * Copyright (C) 2014 - 2016, Steve Holme, <steve_holme (at) hotmail.com>. 9 * Copyright (C) 2015, Daniel Stenberg, <daniel (at) haxx.se>, et al. 10 * 11 * This software is licensed as described in the file COPYING, which 12 * you should have received as part of this distribution. The terms 13 * are also available at https://curl.haxx.se/docs/copyright.html. 14 * 15 * You may opt to use, copy, modify, merge, publish, distribute and/or sell 16 * copies of the Software, and permit persons to whom the Software is 17 * furnished to do so, under the terms of the COPYING file. 18 * 19 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 20 * KIND, either express or implied. 21 * 22 * RFC4752 The Kerberos V5 ("GSSAPI") SASL Mechanism 23 * 24 ***************************************************************************/ 25 26 #include "curl_setup.h" 27 28 #if defined(HAVE_GSSAPI) && defined(USE_KERBEROS5) 29 30 #include <curl/curl.h> 31 32 #include "vauth/vauth.h" 33 #include "curl_sasl.h" 34 #include "urldata.h" 35 #include "curl_base64.h" 36 #include "curl_gssapi.h" 37 #include "sendf.h" 38 #include "curl_printf.h" 39 40 /* The last #include files should be: */ 41 #include "curl_memory.h" 42 #include "memdebug.h" 43 44 /* 45 * Curl_auth_create_gssapi_user_message() 46 * 47 * This is used to generate an already encoded GSSAPI (Kerberos V5) user token 48 * message ready for sending to the recipient. 49 * 50 * Parameters: 51 * 52 * data [in] - The session handle. 53 * userp [in] - The user name. 54 * passdwp [in] - The user's password. 55 * service [in] - The service type such as http, smtp, pop or imap. 56 * host [in[ - The host name. 57 * mutual_auth [in] - Flag specifing whether or not mutual authentication 58 * is enabled. 59 * chlg64 [in] - Pointer to the optional base64 encoded challenge 60 * message. 61 * krb5 [in/out] - The Kerberos 5 data struct being used and modified. 62 * outptr [in/out] - The address where a pointer to newly allocated memory 63 * holding the result will be stored upon completion. 64 * outlen [out] - The length of the output message. 65 * 66 * Returns CURLE_OK on success. 67 */ 68 CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data, 69 const char *userp, 70 const char *passwdp, 71 const char *service, 72 const char *host, 73 const bool mutual_auth, 74 const char *chlg64, 75 struct kerberos5data *krb5, 76 char **outptr, size_t *outlen) 77 { 78 CURLcode result = CURLE_OK; 79 size_t chlglen = 0; 80 unsigned char *chlg = NULL; 81 OM_uint32 major_status; 82 OM_uint32 minor_status; 83 OM_uint32 unused_status; 84 gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER; 85 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER; 86 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; 87 88 (void) userp; 89 (void) passwdp; 90 91 if(!krb5->spn) { 92 /* Generate our SPN */ 93 char *spn = Curl_auth_build_spn(service, NULL, host); 94 if(!spn) 95 return CURLE_OUT_OF_MEMORY; 96 97 /* Populate the SPN structure */ 98 spn_token.value = spn; 99 spn_token.length = strlen(spn); 100 101 /* Import the SPN */ 102 major_status = gss_import_name(&minor_status, &spn_token, 103 GSS_C_NT_HOSTBASED_SERVICE, &krb5->spn); 104 if(GSS_ERROR(major_status)) { 105 Curl_gss_log_error(data, "gss_import_name() failed: ", 106 major_status, minor_status); 107 108 free(spn); 109 110 return CURLE_OUT_OF_MEMORY; 111 } 112 113 free(spn); 114 } 115 116 if(chlg64 && *chlg64) { 117 /* Decode the base-64 encoded challenge message */ 118 if(*chlg64 != '=') { 119 result = Curl_base64_decode(chlg64, &chlg, &chlglen); 120 if(result) 121 return result; 122 } 123 124 /* Ensure we have a valid challenge message */ 125 if(!chlg) { 126 infof(data, "GSSAPI handshake failure (empty challenge message)\n"); 127 128 return CURLE_BAD_CONTENT_ENCODING; 129 } 130 131 /* Setup the challenge "input" security buffer */ 132 input_token.value = chlg; 133 input_token.length = chlglen; 134 } 135 136 major_status = Curl_gss_init_sec_context(data, 137 &minor_status, 138 &krb5->context, 139 krb5->spn, 140 &Curl_krb5_mech_oid, 141 GSS_C_NO_CHANNEL_BINDINGS, 142 &input_token, 143 &output_token, 144 mutual_auth, 145 NULL); 146 147 /* Free the decoded challenge as it is not required anymore */ 148 free(input_token.value); 149 150 if(GSS_ERROR(major_status)) { 151 if(output_token.value) 152 gss_release_buffer(&unused_status, &output_token); 153 154 Curl_gss_log_error(data, "gss_init_sec_context() failed: ", 155 major_status, minor_status); 156 157 return CURLE_RECV_ERROR; 158 } 159 160 if(output_token.value && output_token.length) { 161 /* Base64 encode the response */ 162 result = Curl_base64_encode(data, (char *) output_token.value, 163 output_token.length, outptr, outlen); 164 165 gss_release_buffer(&unused_status, &output_token); 166 } 167 else if(mutual_auth) { 168 *outptr = strdup(""); 169 if(!*outptr) 170 result = CURLE_OUT_OF_MEMORY; 171 } 172 173 return result; 174 } 175 176 /* 177 * Curl_auth_create_gssapi_security_message() 178 * 179 * This is used to generate an already encoded GSSAPI (Kerberos V5) security 180 * token message ready for sending to the recipient. 181 * 182 * Parameters: 183 * 184 * data [in] - The session handle. 185 * chlg64 [in] - Pointer to the optional base64 encoded challenge message. 186 * krb5 [in/out] - The Kerberos 5 data struct being used and modified. 187 * outptr [in/out] - The address where a pointer to newly allocated memory 188 * holding the result will be stored upon completion. 189 * outlen [out] - The length of the output message. 190 * 191 * Returns CURLE_OK on success. 192 */ 193 CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data, 194 const char *chlg64, 195 struct kerberos5data *krb5, 196 char **outptr, 197 size_t *outlen) 198 { 199 CURLcode result = CURLE_OK; 200 size_t chlglen = 0; 201 size_t messagelen = 0; 202 unsigned char *chlg = NULL; 203 unsigned char *message = NULL; 204 OM_uint32 major_status; 205 OM_uint32 minor_status; 206 OM_uint32 unused_status; 207 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER; 208 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; 209 unsigned int indata = 0; 210 unsigned int outdata = 0; 211 gss_qop_t qop = GSS_C_QOP_DEFAULT; 212 unsigned int sec_layer = 0; 213 unsigned int max_size = 0; 214 gss_name_t username = GSS_C_NO_NAME; 215 gss_buffer_desc username_token; 216 217 /* Decode the base-64 encoded input message */ 218 if(strlen(chlg64) && *chlg64 != '=') { 219 result = Curl_base64_decode(chlg64, &chlg, &chlglen); 220 if(result) 221 return result; 222 } 223 224 /* Ensure we have a valid challenge message */ 225 if(!chlg) { 226 infof(data, "GSSAPI handshake failure (empty security message)\n"); 227 228 return CURLE_BAD_CONTENT_ENCODING; 229 } 230 231 /* Get the fully qualified username back from the context */ 232 major_status = gss_inquire_context(&minor_status, krb5->context, 233 &username, NULL, NULL, NULL, NULL, 234 NULL, NULL); 235 if(GSS_ERROR(major_status)) { 236 Curl_gss_log_error(data, "gss_inquire_context() failed: ", 237 major_status, minor_status); 238 239 free(chlg); 240 241 return CURLE_OUT_OF_MEMORY; 242 } 243 244 /* Convert the username from internal format to a displayable token */ 245 major_status = gss_display_name(&minor_status, username, 246 &username_token, NULL); 247 if(GSS_ERROR(major_status)) { 248 Curl_gss_log_error(data, "gss_display_name() failed: ", 249 major_status, minor_status); 250 251 free(chlg); 252 253 return CURLE_OUT_OF_MEMORY; 254 } 255 256 /* Setup the challenge "input" security buffer */ 257 input_token.value = chlg; 258 input_token.length = chlglen; 259 260 /* Decrypt the inbound challenge and obtain the qop */ 261 major_status = gss_unwrap(&minor_status, krb5->context, &input_token, 262 &output_token, NULL, &qop); 263 if(GSS_ERROR(major_status)) { 264 Curl_gss_log_error(data, "gss_unwrap() failed: ", 265 major_status, minor_status); 266 267 gss_release_buffer(&unused_status, &username_token); 268 free(chlg); 269 270 return CURLE_BAD_CONTENT_ENCODING; 271 } 272 273 /* Not 4 octets long so fail as per RFC4752 Section 3.1 */ 274 if(output_token.length != 4) { 275 infof(data, "GSSAPI handshake failure (invalid security data)\n"); 276 277 gss_release_buffer(&unused_status, &username_token); 278 free(chlg); 279 280 return CURLE_BAD_CONTENT_ENCODING; 281 } 282 283 /* Copy the data out and free the challenge as it is not required anymore */ 284 memcpy(&indata, output_token.value, 4); 285 gss_release_buffer(&unused_status, &output_token); 286 free(chlg); 287 288 /* Extract the security layer */ 289 sec_layer = indata & 0x000000FF; 290 if(!(sec_layer & GSSAUTH_P_NONE)) { 291 infof(data, "GSSAPI handshake failure (invalid security layer)\n"); 292 293 gss_release_buffer(&unused_status, &username_token); 294 295 return CURLE_BAD_CONTENT_ENCODING; 296 } 297 298 /* Extract the maximum message size the server can receive */ 299 max_size = ntohl(indata & 0xFFFFFF00); 300 if(max_size > 0) { 301 /* The server has told us it supports a maximum receive buffer, however, as 302 we don't require one unless we are encrypting data, we tell the server 303 our receive buffer is zero. */ 304 max_size = 0; 305 } 306 307 /* Allocate our message */ 308 messagelen = sizeof(outdata) + username_token.length + 1; 309 message = malloc(messagelen); 310 if(!message) { 311 gss_release_buffer(&unused_status, &username_token); 312 313 return CURLE_OUT_OF_MEMORY; 314 } 315 316 /* Populate the message with the security layer, client supported receive 317 message size and authorization identity including the 0x00 based 318 terminator. Note: Despite RFC4752 Section 3.1 stating "The authorization 319 identity is not terminated with the zero-valued (%x00) octet." it seems 320 necessary to include it. */ 321 outdata = htonl(max_size) | sec_layer; 322 memcpy(message, &outdata, sizeof(outdata)); 323 memcpy(message + sizeof(outdata), username_token.value, 324 username_token.length); 325 message[messagelen - 1] = '\0'; 326 327 /* Free the username token as it is not required anymore */ 328 gss_release_buffer(&unused_status, &username_token); 329 330 /* Setup the "authentication data" security buffer */ 331 input_token.value = message; 332 input_token.length = messagelen; 333 334 /* Encrypt the data */ 335 major_status = gss_wrap(&minor_status, krb5->context, 0, 336 GSS_C_QOP_DEFAULT, &input_token, NULL, 337 &output_token); 338 if(GSS_ERROR(major_status)) { 339 Curl_gss_log_error(data, "gss_wrap() failed: ", 340 major_status, minor_status); 341 342 free(message); 343 344 return CURLE_OUT_OF_MEMORY; 345 } 346 347 /* Base64 encode the response */ 348 result = Curl_base64_encode(data, (char *) output_token.value, 349 output_token.length, outptr, outlen); 350 351 /* Free the output buffer */ 352 gss_release_buffer(&unused_status, &output_token); 353 354 /* Free the message buffer */ 355 free(message); 356 357 return result; 358 } 359 360 /* 361 * Curl_auth_gssapi_cleanup() 362 * 363 * This is used to clean up the GSSAPI (Kerberos V5) specific data. 364 * 365 * Parameters: 366 * 367 * krb5 [in/out] - The Kerberos 5 data struct being cleaned up. 368 * 369 */ 370 void Curl_auth_gssapi_cleanup(struct kerberos5data *krb5) 371 { 372 OM_uint32 minor_status; 373 374 /* Free our security context */ 375 if(krb5->context != GSS_C_NO_CONTEXT) { 376 gss_delete_sec_context(&minor_status, &krb5->context, GSS_C_NO_BUFFER); 377 krb5->context = GSS_C_NO_CONTEXT; 378 } 379 380 /* Free the SPN */ 381 if(krb5->spn != GSS_C_NO_NAME) { 382 gss_release_name(&minor_status, &krb5->spn); 383 krb5->spn = GSS_C_NO_NAME; 384 } 385 } 386 387 #endif /* HAVE_GSSAPI && USE_KERBEROS5 */ 388
