1 | /*************************************************************************** |
2 | * _ _ ____ _ |
3 | * Project ___| | | | _ \| | |
4 | * / __| | | | |_) | | |
5 | * | (__| |_| | _ <| |___ |
6 | * \___|\___/|_| \_\_____| |
7 | * |
8 | * Copyright (C) 2011 - 2022, Daniel Stenberg, <[email protected]>, et al. |
9 | * |
10 | * This software is licensed as described in the file COPYING, which |
11 | * you should have received as part of this distribution. The terms |
12 | * are also available at https://curl.se/docs/copyright.html. |
13 | * |
14 | * You may opt to use, copy, modify, merge, publish, distribute and/or sell |
15 | * copies of the Software, and permit persons to whom the Software is |
16 | * furnished to do so, under the terms of the COPYING file. |
17 | * |
18 | * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY |
19 | * KIND, either express or implied. |
20 | * |
21 | * SPDX-License-Identifier: curl |
22 | * |
23 | ***************************************************************************/ |
24 | |
25 | #include "curl_setup.h" |
26 | |
27 | #ifdef HAVE_GSSAPI |
28 | |
29 | #include "curl_gssapi.h" |
30 | #include "sendf.h" |
31 | |
32 | /* The last 3 #include files should be in this order */ |
33 | #include "curl_printf.h" |
34 | #include "curl_memory.h" |
35 | #include "memdebug.h" |
36 | |
37 | gss_OID_desc Curl_spnego_mech_oid = { |
38 | 6, (char *)"\x2b\x06\x01\x05\x05\x02" |
39 | }; |
40 | gss_OID_desc Curl_krb5_mech_oid = { |
41 | 9, (char *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" |
42 | }; |
43 | |
44 | OM_uint32 Curl_gss_init_sec_context( |
45 | struct Curl_easy *data, |
46 | OM_uint32 *minor_status, |
47 | gss_ctx_id_t *context, |
48 | gss_name_t target_name, |
49 | gss_OID mech_type, |
50 | gss_channel_bindings_t input_chan_bindings, |
51 | gss_buffer_t input_token, |
52 | gss_buffer_t output_token, |
53 | const bool mutual_auth, |
54 | OM_uint32 *ret_flags) |
55 | { |
56 | OM_uint32 req_flags = GSS_C_REPLAY_FLAG; |
57 | |
58 | if(mutual_auth) |
59 | req_flags |= GSS_C_MUTUAL_FLAG; |
60 | |
61 | if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_POLICY_FLAG) { |
62 | #ifdef GSS_C_DELEG_POLICY_FLAG |
63 | req_flags |= GSS_C_DELEG_POLICY_FLAG; |
64 | #else |
65 | infof(data, "WARNING: support for CURLGSSAPI_DELEGATION_POLICY_FLAG not " |
66 | "compiled in" ); |
67 | #endif |
68 | } |
69 | |
70 | if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_FLAG) |
71 | req_flags |= GSS_C_DELEG_FLAG; |
72 | |
73 | return gss_init_sec_context(minor_status, |
74 | GSS_C_NO_CREDENTIAL, /* cred_handle */ |
75 | context, |
76 | target_name, |
77 | mech_type, |
78 | req_flags, |
79 | 0, /* time_req */ |
80 | input_chan_bindings, |
81 | input_token, |
82 | NULL, /* actual_mech_type */ |
83 | output_token, |
84 | ret_flags, |
85 | NULL /* time_rec */); |
86 | } |
87 | |
88 | #define GSS_LOG_BUFFER_LEN 1024 |
89 | static size_t display_gss_error(OM_uint32 status, int type, |
90 | char *buf, size_t len) { |
91 | OM_uint32 maj_stat; |
92 | OM_uint32 min_stat; |
93 | OM_uint32 msg_ctx = 0; |
94 | gss_buffer_desc status_string = GSS_C_EMPTY_BUFFER; |
95 | |
96 | do { |
97 | maj_stat = gss_display_status(&min_stat, |
98 | status, |
99 | type, |
100 | GSS_C_NO_OID, |
101 | &msg_ctx, |
102 | &status_string); |
103 | if(maj_stat == GSS_S_COMPLETE && status_string.length > 0) { |
104 | if(GSS_LOG_BUFFER_LEN > len + status_string.length + 3) { |
105 | len += msnprintf(buf + len, GSS_LOG_BUFFER_LEN - len, |
106 | "%.*s. " , (int)status_string.length, |
107 | (char *)status_string.value); |
108 | } |
109 | } |
110 | gss_release_buffer(&min_stat, &status_string); |
111 | } while(!GSS_ERROR(maj_stat) && msg_ctx); |
112 | |
113 | return len; |
114 | } |
115 | |
116 | /* |
117 | * Curl_gss_log_error() |
118 | * |
119 | * This is used to log a GSS-API error status. |
120 | * |
121 | * Parameters: |
122 | * |
123 | * data [in] - The session handle. |
124 | * prefix [in] - The prefix of the log message. |
125 | * major [in] - The major status code. |
126 | * minor [in] - The minor status code. |
127 | */ |
128 | void Curl_gss_log_error(struct Curl_easy *data, const char *prefix, |
129 | OM_uint32 major, OM_uint32 minor) |
130 | { |
131 | char buf[GSS_LOG_BUFFER_LEN]; |
132 | size_t len = 0; |
133 | |
134 | if(major != GSS_S_FAILURE) |
135 | len = display_gss_error(major, GSS_C_GSS_CODE, buf, len); |
136 | |
137 | display_gss_error(minor, GSS_C_MECH_CODE, buf, len); |
138 | |
139 | infof(data, "%s%s" , prefix, buf); |
140 | #ifdef CURL_DISABLE_VERBOSE_STRINGS |
141 | (void)data; |
142 | (void)prefix; |
143 | #endif |
144 | } |
145 | |
146 | #endif /* HAVE_GSSAPI */ |
147 | |