1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
9 *
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at https://curl.se/docs/copyright.html.
13 *
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
17 *
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
20 *
21 * SPDX-License-Identifier: curl
22 *
23 ***************************************************************************/
24
25 #include "curl_setup.h"
26
27 #ifdef HAVE_GSSAPI
28
29 #include "curl_gssapi.h"
30 #include "sendf.h"
31
32 /* The last 3 #include files should be in this order */
33 #include "curl_printf.h"
34 #include "curl_memory.h"
35 #include "memdebug.h"
36
37 #if defined(__GNUC__)
38 #define CURL_ALIGN8 __attribute__((aligned(8)))
39 #else
40 #define CURL_ALIGN8
41 #endif
42
43 #if defined(__GNUC__) && defined(__APPLE__)
44 #pragma GCC diagnostic push
45 #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
46 #endif
47
48 gss_OID_desc Curl_spnego_mech_oid CURL_ALIGN8 = {
49 6, (char *)"\x2b\x06\x01\x05\x05\x02"
50 };
51 gss_OID_desc Curl_krb5_mech_oid CURL_ALIGN8 = {
52 9, (char *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"
53 };
54
Curl_gss_init_sec_context(struct Curl_easy * data,OM_uint32 * minor_status,gss_ctx_id_t * context,gss_name_t target_name,gss_OID mech_type,gss_channel_bindings_t input_chan_bindings,gss_buffer_t input_token,gss_buffer_t output_token,const bool mutual_auth,OM_uint32 * ret_flags)55 OM_uint32 Curl_gss_init_sec_context(
56 struct Curl_easy *data,
57 OM_uint32 *minor_status,
58 gss_ctx_id_t *context,
59 gss_name_t target_name,
60 gss_OID mech_type,
61 gss_channel_bindings_t input_chan_bindings,
62 gss_buffer_t input_token,
63 gss_buffer_t output_token,
64 const bool mutual_auth,
65 OM_uint32 *ret_flags)
66 {
67 OM_uint32 req_flags = GSS_C_REPLAY_FLAG;
68
69 if(mutual_auth)
70 req_flags |= GSS_C_MUTUAL_FLAG;
71
72 if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_POLICY_FLAG) {
73 #ifdef GSS_C_DELEG_POLICY_FLAG
74 req_flags |= GSS_C_DELEG_POLICY_FLAG;
75 #else
76 infof(data, "WARNING: support for CURLGSSAPI_DELEGATION_POLICY_FLAG not "
77 "compiled in");
78 #endif
79 }
80
81 if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_FLAG)
82 req_flags |= GSS_C_DELEG_FLAG;
83
84 return gss_init_sec_context(minor_status,
85 GSS_C_NO_CREDENTIAL, /* cred_handle */
86 context,
87 target_name,
88 mech_type,
89 req_flags,
90 0, /* time_req */
91 input_chan_bindings,
92 input_token,
93 NULL, /* actual_mech_type */
94 output_token,
95 ret_flags,
96 NULL /* time_rec */);
97 }
98
99 #define GSS_LOG_BUFFER_LEN 1024
display_gss_error(OM_uint32 status,int type,char * buf,size_t len)100 static size_t display_gss_error(OM_uint32 status, int type,
101 char *buf, size_t len) {
102 OM_uint32 maj_stat;
103 OM_uint32 min_stat;
104 OM_uint32 msg_ctx = 0;
105 gss_buffer_desc status_string = GSS_C_EMPTY_BUFFER;
106
107 do {
108 maj_stat = gss_display_status(&min_stat,
109 status,
110 type,
111 GSS_C_NO_OID,
112 &msg_ctx,
113 &status_string);
114 if(maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
115 if(GSS_LOG_BUFFER_LEN > len + status_string.length + 3) {
116 len += msnprintf(buf + len, GSS_LOG_BUFFER_LEN - len,
117 "%.*s. ", (int)status_string.length,
118 (char *)status_string.value);
119 }
120 }
121 gss_release_buffer(&min_stat, &status_string);
122 } while(!GSS_ERROR(maj_stat) && msg_ctx);
123
124 return len;
125 }
126
127 /*
128 * Curl_gss_log_error()
129 *
130 * This is used to log a GSS-API error status.
131 *
132 * Parameters:
133 *
134 * data [in] - The session handle.
135 * prefix [in] - The prefix of the log message.
136 * major [in] - The major status code.
137 * minor [in] - The minor status code.
138 */
Curl_gss_log_error(struct Curl_easy * data,const char * prefix,OM_uint32 major,OM_uint32 minor)139 void Curl_gss_log_error(struct Curl_easy *data, const char *prefix,
140 OM_uint32 major, OM_uint32 minor)
141 {
142 char buf[GSS_LOG_BUFFER_LEN];
143 size_t len = 0;
144
145 if(major != GSS_S_FAILURE)
146 len = display_gss_error(major, GSS_C_GSS_CODE, buf, len);
147
148 display_gss_error(minor, GSS_C_MECH_CODE, buf, len);
149
150 infof(data, "%s%s", prefix, buf);
151 #ifdef CURL_DISABLE_VERBOSE_STRINGS
152 (void)data;
153 (void)prefix;
154 #endif
155 }
156
157 #if defined(__GNUC__) && defined(__APPLE__)
158 #pragma GCC diagnostic pop
159 #endif
160
161 #endif /* HAVE_GSSAPI */
162