helpers/negotiate_auth/kerberos/negotiate_kerberos_auth_test.cc

   1 /*
   2  * -----------------------------------------------------------------------------
   3  *
   4  * Author: Markus Moeller (markus_moeller at compuserve.com)
   5  *
   6  * Copyright (C) 2007 Markus Moeller. All rights reserved.
   7  *
   8  *   This program is free software; you can redistribute it and/or modify
   9  *   it under the terms of the GNU General Public License as published by
  10  *   the Free Software Foundation; either version 2 of the License, or
  11  *   (at your option) any later version.
  12  *
  13  *   This program is distributed in the hope that it will be useful,
  14  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *   GNU General Public License for more details.
  17  *
  18  *   You should have received a copy of the GNU General Public License
  19  *   along with this program; if not, write to the Free Software
  20  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
  21  *
  22  * -----------------------------------------------------------------------------
  23  */
  24 /*
  25  * Hosted at http://sourceforge.net/projects/squidkerbauth
  26  */
  27
  28 #include "config.h"
  29
  30 #if HAVE_GSSAPI
  31 #include <string.h>
  32 #include <stdio.h>
  33 #include <stdlib.h>
  34 #include <netdb.h>
  35 #include <unistd.h>
  36 #include <time.h>
  37 #include <sys/time.h>
  38 #include <errno.h>
  39
  40 #include "util.h"
  41
  42 #if HAVE_HEIMDAL_KERBEROS
  43 #if HAVE_GSSAPI_GSSAPI_H
  44 #include <gssapi/gssapi.h>
  45 #elif HAVE_GSSAPI_H
  46 #include <gssapi.h>
  47 #endif /* HAVE_GSSAPI_GSSAPI_H */
  48 #define gss_nt_service_name GSS_C_NT_HOSTBASED_SERVICE
  49 #else /* HAVE_HEIMDAL_KERBEROS */
  50 #if HAVE_GSSAPI_GSSAPI_H
  51 #include <gssapi/gssapi.h>
  52 #elif HAVE_GSSAPI_H
  53 #include <gssapi.h>
  54 #endif /* HAVE_GSSAPI_GSSAPI_H */
  55 #if HAVE_GSSAPI_GSSAPI_KRB5_H
  56 #include <gssapi/gssapi_krb5.h>
  57 #endif /* HAVE_GSSAPI_GSSAPI_KRB5_H */
  58 #if HAVE_GSSAPI_GSSAPI_GENERIC_H
  59 #include <gssapi/gssapi_generic.h>
  60 #endif /* HAVE_GSSAPI_GSSAPI_GENERIC_H */
  61 #endif /* HAVE_HEIMDAL_KERBEROS */
  62
  63 #include "base64.h"
  64
  65 static const char *LogTime(void);
  66
  67 int check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
  68     const char *function);
  69
  70 const char *squid_kerb_proxy_auth(char *proxy);
  71
  72 #define PROGRAM "squid_kerb_auth_test"
  73
  74 static const char *
  75 LogTime()
  76 {
  77     struct tm *tm;
  78     struct timeval now;
  79     static time_t last_t = 0;
  80     static char buf[128];
  81
  82     gettimeofday(&now, NULL);
  83     if (now.tv_sec != last_t) {
  84         tm = localtime(&now.tv_sec);
  85         strftime(buf, 127, "%Y/%m/%d %H:%M:%S", tm);
  86         last_t = now.tv_sec;
  87     }
  88     return buf;
  89 }
  90
  91 #ifdef HAVE_SPNEGO
  92 #ifndef gss_mech_spnego
  93 static gss_OID_desc _gss_mech_spnego =
  94     { 6, (void *) "\x2b\x06\x01\x05\x05\x02" };
  95 gss_OID gss_mech_spnego = &_gss_mech_spnego;
  96 #endif
  97 #endif
  98
  99 int
 100 check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
 101     const char *function)
 102 {
 103     if (GSS_ERROR(major_status)) {
 104         OM_uint32 maj_stat, min_stat;
 105         OM_uint32 msg_ctx = 0;
 106         gss_buffer_desc status_string;
 107         char buf[1024];
 108         size_t len;
 109
 110         len = 0;
 111         msg_ctx = 0;
 112         while (!msg_ctx) {
 113             /* convert major status code (GSS-API error) to text */
 114             maj_stat = gss_display_status(&min_stat, major_status,
 115                 GSS_C_GSS_CODE, GSS_C_NULL_OID, &msg_ctx, &status_string);
 116             if (maj_stat == GSS_S_COMPLETE) {
 117                 if (sizeof(buf) > len + status_string.length + 1) {
 118                     sprintf(buf + len, "%s", (char *) status_string.value);
 119                     len += status_string.length;
 120                 }
 121                 gss_release_buffer(&min_stat, &status_string);
 122                 break;
 123             }
 124             gss_release_buffer(&min_stat, &status_string);
 125         }
 126         if (sizeof(buf) > len + 2) {
 127             sprintf(buf + len, "%s", ". ");
 128             len += 2;
 129         }
 130         msg_ctx = 0;
 131         while (!msg_ctx) {
 132             /* convert minor status code (underlying routine error) to text */
 133             maj_stat = gss_display_status(&min_stat, minor_status,
 134                 GSS_C_MECH_CODE, GSS_C_NULL_OID, &msg_ctx, &status_string);
 135             if (maj_stat == GSS_S_COMPLETE) {
 136                 if (sizeof(buf) > len + status_string.length) {
 137                     sprintf(buf + len, "%s", (char *) status_string.value);
 138                     len += status_string.length;
 139                 }
 140                 gss_release_buffer(&min_stat, &status_string);
 141                 break;
 142             }
 143             gss_release_buffer(&min_stat, &status_string);
 144         }
 145         fprintf(stderr, "%s| %s: %s failed: %s\n", LogTime(), PROGRAM, function,
 146             buf);
 147         return (1);
 148     }
 149     return (0);
 150 }
 151
 152 const char *
 153 squid_kerb_proxy_auth(char *proxy)
 154 {
 155     OM_uint32 major_status, minor_status;
 156     gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
 157     gss_name_t server_name = GSS_C_NO_NAME;
 158     gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
 159     gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
 160     gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
 161     char *token = NULL;
 162
 163     setbuf(stdout, NULL);
 164     setbuf(stdin, NULL);
 165
 166     if (!proxy) {
 167         fprintf(stderr, "%s| %s: Error: No proxy server name\n", LogTime(),
 168             PROGRAM);
 169         return NULL;
 170     }
 171
 172     service.value = xmalloc(strlen("HTTP") + strlen(proxy) + 2);
 173     snprintf(service.value, strlen("HTTP") + strlen(proxy) + 2, "%s@%s", "HTTP",
 174         proxy);
 175     service.length = strlen((char *) service.value);
 176
 177     major_status = gss_import_name(&minor_status, &service,
 178         gss_nt_service_name, &server_name);
 179
 180     if (check_gss_err(major_status, minor_status, "gss_import_name()"))
 181         goto cleanup;
 182
 183     major_status = gss_init_sec_context(&minor_status,
 184         GSS_C_NO_CREDENTIAL, &gss_context, server_name,
 185 #ifdef HAVE_SPNEGO
 186         gss_mech_spnego,
 187 #else
 188         0,
 189 #endif
 190         0,
 191         0,
 192         GSS_C_NO_CHANNEL_BINDINGS,
 193         &input_token, NULL, &output_token, NULL, NULL);
 194
 195     if (check_gss_err(major_status, minor_status, "gss_init_sec_context()"))
 196         goto cleanup;
 197
 198     if (output_token.length) {
 199         token = xmalloc(ska_base64_encode_len(output_token.length));
 200         ska_base64_encode(token, (const char *) output_token.value,
 201             ska_base64_encode_len(output_token.length), output_token.length);
 202     }
 203
 204
 205   cleanup:
 206     gss_delete_sec_context(&minor_status, &gss_context, NULL);
 207     gss_release_buffer(&minor_status, &service);
 208     gss_release_buffer(&minor_status, &input_token);
 209     gss_release_buffer(&minor_status, &output_token);
 210     gss_release_name(&minor_status, &server_name);
 211
 212     return token;
 213 }
 214
 215 int
 216 main(int argc, char *argv[])
 217 {
 218
 219     const char *Token;
 220     int count;
 221
 222     if (argc < 2) {
 223         fprintf(stderr, "%s| %s: Error: No proxy server name given\n",
 224             LogTime(), PROGRAM);
 225         exit(99);
 226     }
 227     if (argc == 3) {
 228         count = atoi(argv[2]);
 229         while (count > 0) {
 230             Token = (const char *) squid_kerb_proxy_auth(argv[1]);
 231             fprintf(stdout, "YR %s\n", Token ? Token : "NULL");
 232             count--;
 233         }
 234         fprintf(stdout, "QQ\n");
 235     } else {
 236         Token = (const char *) squid_kerb_proxy_auth(argv[1]);
 237         fprintf(stdout, "Token: %s\n", Token ? Token : "NULL");
 238     }
 239
 240     exit(0);
 241 }
 242 #endif /* HAVE_GSSAPI */