helpers/negotiate_auth/kerberos/negotiate_kerberos_auth_test.cc

   1 /*
   2  * -----------------------------------------------------------------------------
   3  *
   4  * Author: Markus Moeller (markus_moeller at compuserve.com)
   5  *
   6  * Copyright (C) 2007 Markus Moeller. All rights reserved.
   7  *
   8  *   This program is free software; you can redistribute it and/or modify
   9  *   it under the terms of the GNU General Public License as published by
  10  *   the Free Software Foundation; either version 2 of the License, or
  11  *   (at your option) any later version.
  12  *
  13  *   This program is distributed in the hope that it will be useful,
  14  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *   GNU General Public License for more details.
  17  *
  18  *   You should have received a copy of the GNU General Public License
  19  *   along with this program; if not, write to the Free Software
  20  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
  21  *
  22  * -----------------------------------------------------------------------------
  23  */
  24 /*
  25  * Hosted at http://sourceforge.net/projects/squidkerbauth
  26  */
  27
  28 #include "squid.h"
  29
  30 #if HAVE_GSSAPI
  31
  32 #if HAVE_STRING_H
  33 #include <string.h>
  34 #endif
  35 #if HAVE_STDIO_H
  36 #include <stdio.h>
  37 #endif
  38 #if HAVE_NETDB_H
  39 #include <netdb.h>
  40 #endif
  41 #if HAVE_UNISTD_H
  42 #include <unistd.h>
  43 #endif
  44 #if HAVE_TIME_H
  45 #include <time.h>
  46 #endif
  47 #if HAVE_ERRNO_H
  48 #include <errno.h>
  49 #endif
  50
  51 #include "base64.h"
  52 #include "util.h"
  53
  54 #if HAVE_GSSAPI_GSSAPI_H
  55 #include <gssapi/gssapi.h>
  56 #elif HAVE_GSSAPI_H
  57 #include <gssapi.h>
  58 #endif
  59
  60 #if !HAVE_HEIMDAL_KERBEROS
  61 #if HAVE_GSSAPI_GSSAPI_KRB5_H
  62 #include <gssapi/gssapi_krb5.h>
  63 #endif
  64 #if HAVE_GSSAPI_GSSAPI_GENERIC_H
  65 #include <gssapi/gssapi_generic.h>
  66 #endif
  67 #if HAVE_GSSAPI_GSSAPI_EXT_H
  68 #include <gssapi/gssapi_ext.h>
  69 #endif
  70 #endif
  71
  72 #ifndef gss_nt_service_name
  73 #define gss_nt_service_name GSS_C_NT_HOSTBASED_SERVICE
  74 #endif
  75
  76 static const char *LogTime(void);
  77
  78 int check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
  79                   const char *function);
  80
  81 const char *squid_kerb_proxy_auth(char *proxy);
  82
  83 #define PROGRAM "negotiate_kerberos_auth_test"
  84
  85 static const char *
  86 LogTime()
  87 {
  88     struct tm *tm;
  89     struct timeval now;
  90     static time_t last_t = 0;
  91     static char buf[128];
  92
  93     gettimeofday(&now, NULL);
  94     if (now.tv_sec != last_t) {
  95         tm = localtime((const time_t *) &now.tv_sec);
  96         strftime(buf, 127, "%Y/%m/%d %H:%M:%S", tm);
  97         last_t = now.tv_sec;
  98     }
  99     return buf;
 100 }
 101
 102 #ifndef gss_mech_spnego
 103 static gss_OID_desc _gss_mech_spnego = {6, (void *) "\x2b\x06\x01\x05\x05\x02"};
 104 gss_OID gss_mech_spnego = &_gss_mech_spnego;
 105 #endif
 106
 107 int
 108 check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
 109               const char *function)
 110 {
 111     if (GSS_ERROR(major_status)) {
 112         OM_uint32 maj_stat, min_stat;
 113         OM_uint32 msg_ctx = 0;
 114         gss_buffer_desc status_string;
 115         char buf[1024];
 116         size_t len;
 117
 118         len = 0;
 119         msg_ctx = 0;
 120         do {
 121             /* convert major status code (GSS-API error) to text */
 122             maj_stat = gss_display_status(&min_stat, major_status,
 123                                           GSS_C_GSS_CODE, GSS_C_NULL_OID, &msg_ctx, &status_string);
 124             if (maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
 125                 if (sizeof(buf) > len + status_string.length + 1) {
 126                     snprintf(buf + len, (sizeof(buf) - len), "%s", (char *) status_string.value);
 127                     len += status_string.length;
 128                 }
 129             } else
 130                 msg_ctx = 0;
 131             gss_release_buffer(&min_stat, &status_string);
 132         } while (msg_ctx);
 133         if (sizeof(buf) > len + 2) {
 134             snprintf(buf + len, (sizeof(buf) - len), "%s", ". ");
 135             len += 2;
 136         }
 137         msg_ctx = 0;
 138         do {
 139             /* convert minor status code (underlying routine error) to text */
 140             maj_stat = gss_display_status(&min_stat, minor_status,
 141                                           GSS_C_MECH_CODE, GSS_C_NULL_OID, &msg_ctx, &status_string);
 142             if (maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
 143                 if (sizeof(buf) > len + status_string.length) {
 144                     snprintf(buf + len, (sizeof(buf) - len), "%s", (char *) status_string.value);
 145                     len += status_string.length;
 146                 }
 147             } else
 148                 msg_ctx = 0;
 149             gss_release_buffer(&min_stat, &status_string);
 150         } while (msg_ctx);
 151         fprintf(stderr, "%s| %s: %s failed: %s\n", LogTime(), PROGRAM, function,
 152                 buf);
 153         return (1);
 154     }
 155     return (0);
 156 }
 157
 158 const char *
 159 squid_kerb_proxy_auth(char *proxy)
 160 {
 161     OM_uint32 major_status, minor_status;
 162     gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
 163     gss_name_t server_name = GSS_C_NO_NAME;
 164     gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
 165     gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
 166     gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
 167     char *token = NULL;
 168
 169     setbuf(stdout, NULL);
 170     setbuf(stdin, NULL);
 171
 172     if (!proxy) {
 173         fprintf(stderr, "%s| %s: Error: No proxy server name\n", LogTime(),
 174                 PROGRAM);
 175         return NULL;
 176     }
 177     service.value = xmalloc(strlen("HTTP") + strlen(proxy) + 2);
 178     snprintf((char *) service.value, strlen("HTTP") + strlen(proxy) + 2, "%s@%s", "HTTP", proxy);
 179     service.length = strlen((char *) service.value);
 180
 181     major_status = gss_import_name(&minor_status, &service,
 182                                    gss_nt_service_name, &server_name);
 183
 184     if (check_gss_err(major_status, minor_status, "gss_import_name()"))
 185         goto cleanup;
 186
 187     major_status = gss_init_sec_context(&minor_status,
 188                                         GSS_C_NO_CREDENTIAL, &gss_context, server_name,
 189                                         gss_mech_spnego,
 190                                         0,
 191                                         0,
 192                                         GSS_C_NO_CHANNEL_BINDINGS,
 193                                         &input_token, NULL, &output_token, NULL, NULL);
 194
 195     if (check_gss_err(major_status, minor_status, "gss_init_sec_context()"))
 196         goto cleanup;
 197
 198     if (output_token.length) {
 199         token = (char *) xmalloc(base64_encode_len(output_token.length));
 200         base64_encode_str(token, base64_encode_len(output_token.length),
 201                           (const char *) output_token.value, output_token.length);
 202     }
 203 cleanup:
 204     gss_delete_sec_context(&minor_status, &gss_context, NULL);
 205     gss_release_buffer(&minor_status, &service);
 206     gss_release_buffer(&minor_status, &input_token);
 207     gss_release_buffer(&minor_status, &output_token);
 208     gss_release_name(&minor_status, &server_name);
 209
 210     return token;
 211 }
 212
 213 int
 214 main(int argc, char *argv[])
 215 {
 216
 217     const char *Token;
 218     int count;
 219
 220     if (argc < 2) {
 221         fprintf(stderr, "%s| %s: Error: No proxy server name given\n",
 222                 LogTime(), PROGRAM);
 223         exit(99);
 224     }
 225     if (argc == 3) {
 226         count = atoi(argv[2]);
 227         while (count > 0) {
 228             Token = (const char *) squid_kerb_proxy_auth(argv[1]);
 229             fprintf(stdout, "YR %s\n", Token ? Token : "NULL");
 230             count--;
 231         }
 232         fprintf(stdout, "QQ\n");
 233     } else {
 234         Token = (const char *) squid_kerb_proxy_auth(argv[1]);
 235         fprintf(stdout, "Token: %s\n", Token ? Token : "NULL");
 236     }
 237
 238     exit(0);
 239 }
 240
 241 #else
 242 #include <stdlib.h>
 243 int
 244 main(int argc, char *argv[])
 245 {
 246     exit(-1);
 247 }
 248
 249 #endif /* HAVE_GSSAPI */