1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
9 *
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at https://curl.se/docs/copyright.html.
13 *
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
17 *
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
20 *
21 * SPDX-License-Identifier: curl
22 *
23 ***************************************************************************/
24
25 #include "curl_setup.h"
26
27 #ifdef HAVE_GSSAPI
28
29 #include "curl_gssapi.h"
30 #include "sendf.h"
31
32 /* The last 3 #include files should be in this order */
33 #include "curl_printf.h"
34 #include "curl_memory.h"
35 #include "memdebug.h"
36
37 #if defined(__GNUC__)
38 #define CURL_ALIGN8 __attribute__ ((aligned(8)))
39 #else
40 #define CURL_ALIGN8
41 #endif
42
43 gss_OID_desc Curl_spnego_mech_oid CURL_ALIGN8 = {
44 6, (char *)"\x2b\x06\x01\x05\x05\x02"
45 };
46 gss_OID_desc Curl_krb5_mech_oid CURL_ALIGN8 = {
47 9, (char *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"
48 };
49
Curl_gss_init_sec_context(struct Curl_easy * data,OM_uint32 * minor_status,gss_ctx_id_t * context,gss_name_t target_name,gss_OID mech_type,gss_channel_bindings_t input_chan_bindings,gss_buffer_t input_token,gss_buffer_t output_token,const bool mutual_auth,OM_uint32 * ret_flags)50 OM_uint32 Curl_gss_init_sec_context(
51 struct Curl_easy *data,
52 OM_uint32 *minor_status,
53 gss_ctx_id_t *context,
54 gss_name_t target_name,
55 gss_OID mech_type,
56 gss_channel_bindings_t input_chan_bindings,
57 gss_buffer_t input_token,
58 gss_buffer_t output_token,
59 const bool mutual_auth,
60 OM_uint32 *ret_flags)
61 {
62 OM_uint32 req_flags = GSS_C_REPLAY_FLAG;
63
64 if(mutual_auth)
65 req_flags |= GSS_C_MUTUAL_FLAG;
66
67 if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_POLICY_FLAG) {
68 #ifdef GSS_C_DELEG_POLICY_FLAG
69 req_flags |= GSS_C_DELEG_POLICY_FLAG;
70 #else
71 infof(data, "WARNING: support for CURLGSSAPI_DELEGATION_POLICY_FLAG not "
72 "compiled in");
73 #endif
74 }
75
76 if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_FLAG)
77 req_flags |= GSS_C_DELEG_FLAG;
78
79 return gss_init_sec_context(minor_status,
80 GSS_C_NO_CREDENTIAL, /* cred_handle */
81 context,
82 target_name,
83 mech_type,
84 req_flags,
85 0, /* time_req */
86 input_chan_bindings,
87 input_token,
88 NULL, /* actual_mech_type */
89 output_token,
90 ret_flags,
91 NULL /* time_rec */);
92 }
93
94 #define GSS_LOG_BUFFER_LEN 1024
display_gss_error(OM_uint32 status,int type,char * buf,size_t len)95 static size_t display_gss_error(OM_uint32 status, int type,
96 char *buf, size_t len) {
97 OM_uint32 maj_stat;
98 OM_uint32 min_stat;
99 OM_uint32 msg_ctx = 0;
100 gss_buffer_desc status_string = GSS_C_EMPTY_BUFFER;
101
102 do {
103 maj_stat = gss_display_status(&min_stat,
104 status,
105 type,
106 GSS_C_NO_OID,
107 &msg_ctx,
108 &status_string);
109 if(maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
110 if(GSS_LOG_BUFFER_LEN > len + status_string.length + 3) {
111 len += msnprintf(buf + len, GSS_LOG_BUFFER_LEN - len,
112 "%.*s. ", (int)status_string.length,
113 (char *)status_string.value);
114 }
115 }
116 gss_release_buffer(&min_stat, &status_string);
117 } while(!GSS_ERROR(maj_stat) && msg_ctx);
118
119 return len;
120 }
121
122 /*
123 * Curl_gss_log_error()
124 *
125 * This is used to log a GSS-API error status.
126 *
127 * Parameters:
128 *
129 * data [in] - The session handle.
130 * prefix [in] - The prefix of the log message.
131 * major [in] - The major status code.
132 * minor [in] - The minor status code.
133 */
Curl_gss_log_error(struct Curl_easy * data,const char * prefix,OM_uint32 major,OM_uint32 minor)134 void Curl_gss_log_error(struct Curl_easy *data, const char *prefix,
135 OM_uint32 major, OM_uint32 minor)
136 {
137 char buf[GSS_LOG_BUFFER_LEN];
138 size_t len = 0;
139
140 if(major != GSS_S_FAILURE)
141 len = display_gss_error(major, GSS_C_GSS_CODE, buf, len);
142
143 display_gss_error(minor, GSS_C_MECH_CODE, buf, len);
144
145 infof(data, "%s%s", prefix, buf);
146 #ifdef CURL_DISABLE_VERBOSE_STRINGS
147 (void)data;
148 (void)prefix;
149 #endif
150 }
151
152 #endif /* HAVE_GSSAPI */
153