1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) 2014 - 2016, Steve Holme, <steve_holme@hotmail.com>.
9 * Copyright (C) 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
10 *
11 * This software is licensed as described in the file COPYING, which
12 * you should have received as part of this distribution. The terms
13 * are also available at https://curl.haxx.se/docs/copyright.html.
14 *
15 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
16 * copies of the Software, and permit persons to whom the Software is
17 * furnished to do so, under the terms of the COPYING file.
18 *
19 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20 * KIND, either express or implied.
21 *
22 * RFC4752 The Kerberos V5 ("GSSAPI") SASL Mechanism
23 *
24 ***************************************************************************/
25
26 #include "curl_setup.h"
27
28 #if defined(HAVE_GSSAPI) && defined(USE_KERBEROS5)
29
30 #include <curl/curl.h>
31
32 #include "vauth/vauth.h"
33 #include "curl_sasl.h"
34 #include "urldata.h"
35 #include "curl_base64.h"
36 #include "curl_gssapi.h"
37 #include "sendf.h"
38 #include "curl_printf.h"
39
40 /* The last #include files should be: */
41 #include "curl_memory.h"
42 #include "memdebug.h"
43
44 /*
45 * Curl_auth_create_gssapi_user_message()
46 *
47 * This is used to generate an already encoded GSSAPI (Kerberos V5) user token
48 * message ready for sending to the recipient.
49 *
50 * Parameters:
51 *
52 * data [in] - The session handle.
53 * userp [in] - The user name.
54 * passdwp [in] - The user's password.
55 * service [in] - The service type such as http, smtp, pop or imap.
56 * host [in[ - The host name.
57 * mutual_auth [in] - Flag specifing whether or not mutual authentication
58 * is enabled.
59 * chlg64 [in] - Pointer to the optional base64 encoded challenge
60 * message.
61 * krb5 [in/out] - The Kerberos 5 data struct being used and modified.
62 * outptr [in/out] - The address where a pointer to newly allocated memory
63 * holding the result will be stored upon completion.
64 * outlen [out] - The length of the output message.
65 *
66 * Returns CURLE_OK on success.
67 */
Curl_auth_create_gssapi_user_message(struct Curl_easy * data,const char * userp,const char * passwdp,const char * service,const char * host,const bool mutual_auth,const char * chlg64,struct kerberos5data * krb5,char ** outptr,size_t * outlen)68 CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
69 const char *userp,
70 const char *passwdp,
71 const char *service,
72 const char *host,
73 const bool mutual_auth,
74 const char *chlg64,
75 struct kerberos5data *krb5,
76 char **outptr, size_t *outlen)
77 {
78 CURLcode result = CURLE_OK;
79 size_t chlglen = 0;
80 unsigned char *chlg = NULL;
81 OM_uint32 major_status;
82 OM_uint32 minor_status;
83 OM_uint32 unused_status;
84 gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
85 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
86 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
87
88 (void) userp;
89 (void) passwdp;
90
91 if(!krb5->spn) {
92 /* Generate our SPN */
93 char *spn = Curl_auth_build_spn(service, NULL, host);
94 if(!spn)
95 return CURLE_OUT_OF_MEMORY;
96
97 /* Populate the SPN structure */
98 spn_token.value = spn;
99 spn_token.length = strlen(spn);
100
101 /* Import the SPN */
102 major_status = gss_import_name(&minor_status, &spn_token,
103 GSS_C_NT_HOSTBASED_SERVICE, &krb5->spn);
104 if(GSS_ERROR(major_status)) {
105 Curl_gss_log_error(data, "gss_import_name() failed: ",
106 major_status, minor_status);
107
108 free(spn);
109
110 return CURLE_OUT_OF_MEMORY;
111 }
112
113 free(spn);
114 }
115
116 if(chlg64 && *chlg64) {
117 /* Decode the base-64 encoded challenge message */
118 if(*chlg64 != '=') {
119 result = Curl_base64_decode(chlg64, &chlg, &chlglen);
120 if(result)
121 return result;
122 }
123
124 /* Ensure we have a valid challenge message */
125 if(!chlg) {
126 infof(data, "GSSAPI handshake failure (empty challenge message)\n");
127
128 return CURLE_BAD_CONTENT_ENCODING;
129 }
130
131 /* Setup the challenge "input" security buffer */
132 input_token.value = chlg;
133 input_token.length = chlglen;
134 }
135
136 major_status = Curl_gss_init_sec_context(data,
137 &minor_status,
138 &krb5->context,
139 krb5->spn,
140 &Curl_krb5_mech_oid,
141 GSS_C_NO_CHANNEL_BINDINGS,
142 &input_token,
143 &output_token,
144 mutual_auth,
145 NULL);
146
147 /* Free the decoded challenge as it is not required anymore */
148 free(input_token.value);
149
150 if(GSS_ERROR(major_status)) {
151 if(output_token.value)
152 gss_release_buffer(&unused_status, &output_token);
153
154 Curl_gss_log_error(data, "gss_init_sec_context() failed: ",
155 major_status, minor_status);
156
157 return CURLE_RECV_ERROR;
158 }
159
160 if(output_token.value && output_token.length) {
161 /* Base64 encode the response */
162 result = Curl_base64_encode(data, (char *) output_token.value,
163 output_token.length, outptr, outlen);
164
165 gss_release_buffer(&unused_status, &output_token);
166 }
167 else if(mutual_auth) {
168 *outptr = strdup("");
169 if(!*outptr)
170 result = CURLE_OUT_OF_MEMORY;
171 }
172
173 return result;
174 }
175
176 /*
177 * Curl_auth_create_gssapi_security_message()
178 *
179 * This is used to generate an already encoded GSSAPI (Kerberos V5) security
180 * token message ready for sending to the recipient.
181 *
182 * Parameters:
183 *
184 * data [in] - The session handle.
185 * chlg64 [in] - Pointer to the optional base64 encoded challenge message.
186 * krb5 [in/out] - The Kerberos 5 data struct being used and modified.
187 * outptr [in/out] - The address where a pointer to newly allocated memory
188 * holding the result will be stored upon completion.
189 * outlen [out] - The length of the output message.
190 *
191 * Returns CURLE_OK on success.
192 */
Curl_auth_create_gssapi_security_message(struct Curl_easy * data,const char * chlg64,struct kerberos5data * krb5,char ** outptr,size_t * outlen)193 CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
194 const char *chlg64,
195 struct kerberos5data *krb5,
196 char **outptr,
197 size_t *outlen)
198 {
199 CURLcode result = CURLE_OK;
200 size_t chlglen = 0;
201 size_t messagelen = 0;
202 unsigned char *chlg = NULL;
203 unsigned char *message = NULL;
204 OM_uint32 major_status;
205 OM_uint32 minor_status;
206 OM_uint32 unused_status;
207 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
208 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
209 unsigned int indata = 0;
210 unsigned int outdata = 0;
211 gss_qop_t qop = GSS_C_QOP_DEFAULT;
212 unsigned int sec_layer = 0;
213 unsigned int max_size = 0;
214 gss_name_t username = GSS_C_NO_NAME;
215 gss_buffer_desc username_token;
216
217 /* Decode the base-64 encoded input message */
218 if(strlen(chlg64) && *chlg64 != '=') {
219 result = Curl_base64_decode(chlg64, &chlg, &chlglen);
220 if(result)
221 return result;
222 }
223
224 /* Ensure we have a valid challenge message */
225 if(!chlg) {
226 infof(data, "GSSAPI handshake failure (empty security message)\n");
227
228 return CURLE_BAD_CONTENT_ENCODING;
229 }
230
231 /* Get the fully qualified username back from the context */
232 major_status = gss_inquire_context(&minor_status, krb5->context,
233 &username, NULL, NULL, NULL, NULL,
234 NULL, NULL);
235 if(GSS_ERROR(major_status)) {
236 Curl_gss_log_error(data, "gss_inquire_context() failed: ",
237 major_status, minor_status);
238
239 free(chlg);
240
241 return CURLE_OUT_OF_MEMORY;
242 }
243
244 /* Convert the username from internal format to a displayable token */
245 major_status = gss_display_name(&minor_status, username,
246 &username_token, NULL);
247 if(GSS_ERROR(major_status)) {
248 Curl_gss_log_error(data, "gss_display_name() failed: ",
249 major_status, minor_status);
250
251 free(chlg);
252
253 return CURLE_OUT_OF_MEMORY;
254 }
255
256 /* Setup the challenge "input" security buffer */
257 input_token.value = chlg;
258 input_token.length = chlglen;
259
260 /* Decrypt the inbound challenge and obtain the qop */
261 major_status = gss_unwrap(&minor_status, krb5->context, &input_token,
262 &output_token, NULL, &qop);
263 if(GSS_ERROR(major_status)) {
264 Curl_gss_log_error(data, "gss_unwrap() failed: ",
265 major_status, minor_status);
266
267 gss_release_buffer(&unused_status, &username_token);
268 free(chlg);
269
270 return CURLE_BAD_CONTENT_ENCODING;
271 }
272
273 /* Not 4 octets long so fail as per RFC4752 Section 3.1 */
274 if(output_token.length != 4) {
275 infof(data, "GSSAPI handshake failure (invalid security data)\n");
276
277 gss_release_buffer(&unused_status, &username_token);
278 free(chlg);
279
280 return CURLE_BAD_CONTENT_ENCODING;
281 }
282
283 /* Copy the data out and free the challenge as it is not required anymore */
284 memcpy(&indata, output_token.value, 4);
285 gss_release_buffer(&unused_status, &output_token);
286 free(chlg);
287
288 /* Extract the security layer */
289 sec_layer = indata & 0x000000FF;
290 if(!(sec_layer & GSSAUTH_P_NONE)) {
291 infof(data, "GSSAPI handshake failure (invalid security layer)\n");
292
293 gss_release_buffer(&unused_status, &username_token);
294
295 return CURLE_BAD_CONTENT_ENCODING;
296 }
297
298 /* Extract the maximum message size the server can receive */
299 max_size = ntohl(indata & 0xFFFFFF00);
300 if(max_size > 0) {
301 /* The server has told us it supports a maximum receive buffer, however, as
302 we don't require one unless we are encrypting data, we tell the server
303 our receive buffer is zero. */
304 max_size = 0;
305 }
306
307 /* Allocate our message */
308 messagelen = sizeof(outdata) + username_token.length + 1;
309 message = malloc(messagelen);
310 if(!message) {
311 gss_release_buffer(&unused_status, &username_token);
312
313 return CURLE_OUT_OF_MEMORY;
314 }
315
316 /* Populate the message with the security layer, client supported receive
317 message size and authorization identity including the 0x00 based
318 terminator. Note: Despite RFC4752 Section 3.1 stating "The authorization
319 identity is not terminated with the zero-valued (%x00) octet." it seems
320 necessary to include it. */
321 outdata = htonl(max_size) | sec_layer;
322 memcpy(message, &outdata, sizeof(outdata));
323 memcpy(message + sizeof(outdata), username_token.value,
324 username_token.length);
325 message[messagelen - 1] = '\0';
326
327 /* Free the username token as it is not required anymore */
328 gss_release_buffer(&unused_status, &username_token);
329
330 /* Setup the "authentication data" security buffer */
331 input_token.value = message;
332 input_token.length = messagelen;
333
334 /* Encrypt the data */
335 major_status = gss_wrap(&minor_status, krb5->context, 0,
336 GSS_C_QOP_DEFAULT, &input_token, NULL,
337 &output_token);
338 if(GSS_ERROR(major_status)) {
339 Curl_gss_log_error(data, "gss_wrap() failed: ",
340 major_status, minor_status);
341
342 free(message);
343
344 return CURLE_OUT_OF_MEMORY;
345 }
346
347 /* Base64 encode the response */
348 result = Curl_base64_encode(data, (char *) output_token.value,
349 output_token.length, outptr, outlen);
350
351 /* Free the output buffer */
352 gss_release_buffer(&unused_status, &output_token);
353
354 /* Free the message buffer */
355 free(message);
356
357 return result;
358 }
359
360 /*
361 * Curl_auth_gssapi_cleanup()
362 *
363 * This is used to clean up the GSSAPI (Kerberos V5) specific data.
364 *
365 * Parameters:
366 *
367 * krb5 [in/out] - The Kerberos 5 data struct being cleaned up.
368 *
369 */
Curl_auth_gssapi_cleanup(struct kerberos5data * krb5)370 void Curl_auth_gssapi_cleanup(struct kerberos5data *krb5)
371 {
372 OM_uint32 minor_status;
373
374 /* Free our security context */
375 if(krb5->context != GSS_C_NO_CONTEXT) {
376 gss_delete_sec_context(&minor_status, &krb5->context, GSS_C_NO_BUFFER);
377 krb5->context = GSS_C_NO_CONTEXT;
378 }
379
380 /* Free the SPN */
381 if(krb5->spn != GSS_C_NO_NAME) {
382 gss_release_name(&minor_status, &krb5->spn);
383 krb5->spn = GSS_C_NO_NAME;
384 }
385 }
386
387 #endif /* HAVE_GSSAPI && USE_KERBEROS5 */
388