1/***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) 2011 - 2022, Daniel Stenberg, <[email protected]>, et al.
9 *
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at https://curl.se/docs/copyright.html.
13 *
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
17 *
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
20 *
21 * SPDX-License-Identifier: curl
22 *
23 ***************************************************************************/
24
25#include "curl_setup.h"
26
27#ifdef HAVE_GSSAPI
28
29#include "curl_gssapi.h"
30#include "sendf.h"
31
32/* The last 3 #include files should be in this order */
33#include "curl_printf.h"
34#include "curl_memory.h"
35#include "memdebug.h"
36
37gss_OID_desc Curl_spnego_mech_oid = {
38 6, (char *)"\x2b\x06\x01\x05\x05\x02"
39};
40gss_OID_desc Curl_krb5_mech_oid = {
41 9, (char *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"
42};
43
44OM_uint32 Curl_gss_init_sec_context(
45 struct Curl_easy *data,
46 OM_uint32 *minor_status,
47 gss_ctx_id_t *context,
48 gss_name_t target_name,
49 gss_OID mech_type,
50 gss_channel_bindings_t input_chan_bindings,
51 gss_buffer_t input_token,
52 gss_buffer_t output_token,
53 const bool mutual_auth,
54 OM_uint32 *ret_flags)
55{
56 OM_uint32 req_flags = GSS_C_REPLAY_FLAG;
57
58 if(mutual_auth)
59 req_flags |= GSS_C_MUTUAL_FLAG;
60
61 if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_POLICY_FLAG) {
62#ifdef GSS_C_DELEG_POLICY_FLAG
63 req_flags |= GSS_C_DELEG_POLICY_FLAG;
64#else
65 infof(data, "WARNING: support for CURLGSSAPI_DELEGATION_POLICY_FLAG not "
66 "compiled in");
67#endif
68 }
69
70 if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_FLAG)
71 req_flags |= GSS_C_DELEG_FLAG;
72
73 return gss_init_sec_context(minor_status,
74 GSS_C_NO_CREDENTIAL, /* cred_handle */
75 context,
76 target_name,
77 mech_type,
78 req_flags,
79 0, /* time_req */
80 input_chan_bindings,
81 input_token,
82 NULL, /* actual_mech_type */
83 output_token,
84 ret_flags,
85 NULL /* time_rec */);
86}
87
88#define GSS_LOG_BUFFER_LEN 1024
89static size_t display_gss_error(OM_uint32 status, int type,
90 char *buf, size_t len) {
91 OM_uint32 maj_stat;
92 OM_uint32 min_stat;
93 OM_uint32 msg_ctx = 0;
94 gss_buffer_desc status_string = GSS_C_EMPTY_BUFFER;
95
96 do {
97 maj_stat = gss_display_status(&min_stat,
98 status,
99 type,
100 GSS_C_NO_OID,
101 &msg_ctx,
102 &status_string);
103 if(maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
104 if(GSS_LOG_BUFFER_LEN > len + status_string.length + 3) {
105 len += msnprintf(buf + len, GSS_LOG_BUFFER_LEN - len,
106 "%.*s. ", (int)status_string.length,
107 (char *)status_string.value);
108 }
109 }
110 gss_release_buffer(&min_stat, &status_string);
111 } while(!GSS_ERROR(maj_stat) && msg_ctx);
112
113 return len;
114}
115
116/*
117 * Curl_gss_log_error()
118 *
119 * This is used to log a GSS-API error status.
120 *
121 * Parameters:
122 *
123 * data [in] - The session handle.
124 * prefix [in] - The prefix of the log message.
125 * major [in] - The major status code.
126 * minor [in] - The minor status code.
127 */
128void Curl_gss_log_error(struct Curl_easy *data, const char *prefix,
129 OM_uint32 major, OM_uint32 minor)
130{
131 char buf[GSS_LOG_BUFFER_LEN];
132 size_t len = 0;
133
134 if(major != GSS_S_FAILURE)
135 len = display_gss_error(major, GSS_C_GSS_CODE, buf, len);
136
137 display_gss_error(minor, GSS_C_MECH_CODE, buf, len);
138
139 infof(data, "%s%s", prefix, buf);
140#ifdef CURL_DISABLE_VERBOSE_STRINGS
141 (void)data;
142 (void)prefix;
143#endif
144}
145
146#endif /* HAVE_GSSAPI */
147