Part 1 of 2 - Moved the SSPI based Negotiate authentication code.
LIB_VAUTH_CFILES = vauth/vauth.c vauth/cleartext.c vauth/cram.c \
vauth/digest.c vauth/digest_sspi.c vauth/krb5_gssapi.c \
- vauth/krb5_sspi.c vauth/ntlm.c vauth/ntlm_sspi.c vauth/oauth2.c
+ vauth/krb5_sspi.c vauth/ntlm.c vauth/ntlm_sspi.c vauth/oauth2.c \
+ vauth/spnego_sspi.c
+
LIB_VAUTH_HFILES = vauth/vauth.h vauth/digest.h vauth/ntlm.h
$(DIROBJ)\ntlm.obj \\r
$(DIROBJ)\ntlm_sspi.obj \\r
$(DIROBJ)\oauth2.obj \\r
+ $(DIROBJ)\spnego_sspi.obj \\r
$(DIROBJ)\vtls.obj \\r
$(DIROBJ)\openssl.obj \\r
$(DIROBJ)\strdup.obj \\r
#include "curl_base64.h"
#include "cookie.h"
#include "strequal.h"
+#include "vauth/vauth.h"
#include "vtls/vtls.h"
#include "http_digest.h"
#include "curl_ntlm.h"
void Curl_cleanup_negotiate(struct SessionHandle *data);
-#ifdef USE_WINDOWS_SSPI
-#define GSS_ERROR(status) (status & 0x80000000)
-#endif
-
#endif /* USE_SPNEGO */
#endif /* HEADER_CURL_HTTP_NEGOTIATE_H */
#include "urldata.h"
#include "sendf.h"
#include "rawstr.h"
-#include "warnless.h"
-#include "curl_base64.h"
#include "vauth/vauth.h"
#include "http_negotiate.h"
-#include "curl_multibyte.h"
#include "curl_printf.h"
/* The last #include files should be: */
const char *header)
{
struct SessionHandle *data = conn->data;
- BYTE *input_token = NULL;
- SecBufferDesc out_buff_desc;
- SecBuffer out_sec_buff;
- SecBufferDesc in_buff_desc;
- SecBuffer in_sec_buff;
- SECURITY_STATUS status;
- unsigned long attrs;
- TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
- size_t len = 0, input_token_len = 0;
- CURLcode result;
+ size_t len;
- /* Point to the username and password */
+ /* Point to the username, password, service and host */
const char *userp;
const char *passwdp;
+ const char *service;
+ const char *host;
/* Point to the correct struct with this */
struct negotiatedata *neg_ctx;
if(proxy) {
userp = conn->proxyuser;
passwdp = conn->proxypasswd;
+ service = data->set.str[STRING_PROXY_SERVICE_NAME];
+ host = conn->host.name;
neg_ctx = &data->state.proxyneg;
}
else {
userp = conn->user;
passwdp = conn->passwd;
+ service = data->set.str[STRING_SERVICE_NAME];
+ host = conn->proxy.name;
neg_ctx = &data->state.negotiate;
}
if(!passwdp)
passwdp = "";
- if(neg_ctx->context && neg_ctx->status == SEC_E_OK) {
- /* We finished successfully our part of authentication, but server
- * rejected it (since we're again here). Exit with an error since we
- * can't invent anything better */
- Curl_cleanup_negotiate(data);
- return CURLE_LOGIN_DENIED;
- }
-
- if(!neg_ctx->server_name) {
- /* Check proxy auth requested but no given proxy name */
- if(proxy && !conn->proxy.name)
- return CURLE_BAD_FUNCTION_ARGUMENT;
-
- /* Generate our SPN */
- neg_ctx->server_name = Curl_auth_build_spn(
- proxy ? data->set.str[STRING_PROXY_SERVICE_NAME] :
- data->set.str[STRING_SERVICE_NAME],
- proxy ? conn->proxy.name : conn->host.name);
- if(!neg_ctx->server_name)
- return CURLE_OUT_OF_MEMORY;
- }
-
- if(!neg_ctx->output_token) {
- PSecPkgInfo SecurityPackage;
- status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
- TEXT(SP_NAME_NEGOTIATE),
- &SecurityPackage);
- if(status != SEC_E_OK)
- return CURLE_NOT_BUILT_IN;
-
- /* Allocate input and output buffers according to the max token size
- as indicated by the security package */
- neg_ctx->token_max = SecurityPackage->cbMaxToken;
- neg_ctx->output_token = malloc(neg_ctx->token_max);
- s_pSecFn->FreeContextBuffer(SecurityPackage);
- }
-
/* Obtain the input token, if any */
header += strlen("Negotiate");
while(*header && ISSPACE(*header))
negotiation mechanisms */
return CURLE_LOGIN_DENIED;
}
-
- /* We have to acquire credentials and allocate memory for the context */
- neg_ctx->credentials = malloc(sizeof(CredHandle));
- neg_ctx->context = malloc(sizeof(CtxtHandle));
-
- if(!neg_ctx->credentials || !neg_ctx->context)
- return CURLE_OUT_OF_MEMORY;
-
- if(userp && *userp) {
- /* Populate our identity structure */
- result = Curl_create_sspi_identity(userp, passwdp, &neg_ctx->identity);
- if(result)
- return result;
-
- /* Allow proper cleanup of the identity structure */
- neg_ctx->p_identity = &neg_ctx->identity;
- }
- else
- /* Use the current Windows user */
- neg_ctx->p_identity = NULL;
-
- /* Acquire our credientials handle */
- neg_ctx->status =
- s_pSecFn->AcquireCredentialsHandle(NULL,
- (TCHAR *) TEXT(SP_NAME_NEGOTIATE),
- SECPKG_CRED_OUTBOUND, NULL,
- neg_ctx->p_identity, NULL, NULL,
- neg_ctx->credentials, &expiry);
- if(neg_ctx->status != SEC_E_OK)
- return CURLE_LOGIN_DENIED;
- }
- else {
- result = Curl_base64_decode(header,
- (unsigned char **)&input_token,
- &input_token_len);
- if(result)
- return result;
-
- if(!input_token_len) {
- infof(data,
- "Negotiate handshake failure (empty challenge message)\n");
-
- return CURLE_BAD_CONTENT_ENCODING;
- }
- }
-
- /* Setup the "output" security buffer */
- out_buff_desc.ulVersion = SECBUFFER_VERSION;
- out_buff_desc.cBuffers = 1;
- out_buff_desc.pBuffers = &out_sec_buff;
- out_sec_buff.BufferType = SECBUFFER_TOKEN;
- out_sec_buff.pvBuffer = neg_ctx->output_token;
- out_sec_buff.cbBuffer = curlx_uztoul(neg_ctx->token_max);
-
- /* Setup the "input" security buffer if present */
- if(input_token) {
- in_buff_desc.ulVersion = SECBUFFER_VERSION;
- in_buff_desc.cBuffers = 1;
- in_buff_desc.pBuffers = &in_sec_buff;
- in_sec_buff.BufferType = SECBUFFER_TOKEN;
- in_sec_buff.pvBuffer = input_token;
- in_sec_buff.cbBuffer = curlx_uztoul(input_token_len);
- }
-
- /* Generate our message */
- neg_ctx->status = s_pSecFn->InitializeSecurityContext(
- neg_ctx->credentials,
- input_token ? neg_ctx->context : NULL,
- neg_ctx->server_name,
- ISC_REQ_CONFIDENTIALITY,
- 0,
- SECURITY_NATIVE_DREP,
- input_token ? &in_buff_desc : NULL,
- 0,
- neg_ctx->context,
- &out_buff_desc,
- &attrs,
- &expiry);
-
- free(input_token);
-
- if(GSS_ERROR(neg_ctx->status))
- return CURLE_OUT_OF_MEMORY;
-
- if(neg_ctx->status == SEC_I_COMPLETE_NEEDED ||
- neg_ctx->status == SEC_I_COMPLETE_AND_CONTINUE) {
- neg_ctx->status = s_pSecFn->CompleteAuthToken(neg_ctx->context,
- &out_buff_desc);
- if(GSS_ERROR(neg_ctx->status))
- return CURLE_RECV_ERROR;
}
- neg_ctx->output_token_length = out_sec_buff.cbBuffer;
-
- return CURLE_OK;
+ /* Initilise the security context and decode our challenge */
+ return Curl_auth_decode_spnego_message(data, userp, passwdp, service, host,
+ header, neg_ctx);
}
CURLcode Curl_output_negotiate(struct connectdata *conn, bool proxy)
{
struct negotiatedata *neg_ctx = proxy?&conn->data->state.proxyneg:
&conn->data->state.negotiate;
- char *encoded = NULL;
+ char *base64 = NULL;
size_t len = 0;
char *userp;
CURLcode result;
- result = Curl_base64_encode(conn->data,
- (const char*)neg_ctx->output_token,
- neg_ctx->output_token_length,
- &encoded, &len);
+ result = Curl_auth_create_spnego_message(conn->data, neg_ctx, &base64, &len);
if(result)
return result;
- if(!len)
- return CURLE_REMOTE_ACCESS_DENIED;
-
userp = aprintf("%sAuthorization: Negotiate %s\r\n", proxy ? "Proxy-" : "",
- encoded);
+ base64);
if(proxy) {
Curl_safefree(conn->allocptr.proxyuserpwd);
conn->allocptr.userpwd = userp;
}
- free(encoded);
+ free(base64);
return (userp == NULL) ? CURLE_OUT_OF_MEMORY : CURLE_OK;
}
-static void cleanup(struct negotiatedata *neg_ctx)
-{
- /* Free our security context */
- if(neg_ctx->context) {
- s_pSecFn->DeleteSecurityContext(neg_ctx->context);
- free(neg_ctx->context);
- neg_ctx->context = NULL;
- }
-
- /* Free our credentials handle */
- if(neg_ctx->credentials) {
- s_pSecFn->FreeCredentialsHandle(neg_ctx->credentials);
- free(neg_ctx->credentials);
- neg_ctx->credentials = NULL;
- }
-
- /* Free our identity */
- Curl_sspi_free_identity(neg_ctx->p_identity);
- neg_ctx->p_identity = NULL;
-
- /* Free the SPN and output token */
- Curl_safefree(neg_ctx->server_name);
- Curl_safefree(neg_ctx->output_token);
-
- /* Reset any variables */
- neg_ctx->token_max = 0;
-}
-
void Curl_cleanup_negotiate(struct SessionHandle *data)
{
- cleanup(&data->state.negotiate);
- cleanup(&data->state.proxyneg);
+ Curl_auth_spnego_cleanup(&data->state.negotiate);
+ Curl_auth_spnego_cleanup(&data->state.proxyneg);
}
#endif /* !CURL_DISABLE_HTTP && USE_SPNEGO */
--- /dev/null
+/***************************************************************************
+ * _ _ ____ _
+ * Project ___| | | | _ \| |
+ * / __| | | | |_) | |
+ * | (__| |_| | _ <| |___
+ * \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at http://curl.haxx.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * RFC4178 Simple and Protected GSS-API Negotiation Mechanism
+ *
+ ***************************************************************************/
+
+#include "curl_setup.h"
+
+#if defined(USE_WINDOWS_SSPI) && defined(USE_SPNEGO)
+
+#include <curl/curl.h>
+
+#include "vauth/vauth.h"
+#include "urldata.h"
+#include "curl_base64.h"
+#include "warnless.h"
+#include "curl_multibyte.h"
+#include "sendf.h"
+
+/* The last #include files should be: */
+#include "curl_memory.h"
+#include "memdebug.h"
+
+/*
+ * Curl_auth_decode_spnego_message()
+ *
+ * This is used to decode an already encoded SPNEGO (Negotiate) challenge
+ * message.
+ *
+ * Parameters:
+ *
+ * data [in] - The session handle.
+ * userp [in] - The user name in the format User or Domain\User.
+ * passdwp [in] - The user's password.
+ * service [in] - The service type such as www, smtp, pop or imap.
+ * hostname [in] - The host name.
+ * chlg64 [in] - The optional base64 encoded challenge message.
+ * nego [in/out] - The Negotiate data struct being used and modified.
+ *
+ * Returns CURLE_OK on success.
+ */
+CURLcode Curl_auth_decode_spnego_message(struct SessionHandle *data,
+ const char *user,
+ const char *password,
+ const char *service,
+ const char *host,
+ const char *chlg64,
+ struct negotiatedata *nego)
+{
+ CURLcode result = CURLE_OK;
+ size_t chlglen = 0;
+ unsigned char *chlg = NULL;
+ PSecPkgInfo SecurityPackage;
+ SecBuffer chlg_buf;
+ SecBuffer resp_buf;
+ SecBufferDesc chlg_desc;
+ SecBufferDesc resp_desc;
+ unsigned long attrs;
+ TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
+
+#if defined(CURL_DISABLE_VERBOSE_STRINGS)
+ (void) data;
+#endif
+
+ if(nego->context && nego->status == SEC_E_OK) {
+ /* We finished successfully our part of authentication, but server
+ * rejected it (since we're again here). Exit with an error since we
+ * can't invent anything better */
+ Curl_auth_spnego_cleanup(nego);
+ return CURLE_LOGIN_DENIED;
+ }
+
+ /* Generate our SPN */
+ if(!nego->server_name) {
+ nego->server_name = Curl_auth_build_spn(service, host);
+ if(!nego->server_name)
+ return CURLE_OUT_OF_MEMORY;
+ }
+
+ if(!nego->output_token) {
+ /* Query the security package for Negotiate */
+ nego->status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
+ TEXT(SP_NAME_NEGOTIATE),
+ &SecurityPackage);
+ if(nego->status != SEC_E_OK)
+ return CURLE_NOT_BUILT_IN;
+
+ nego->token_max = SecurityPackage->cbMaxToken;
+
+ /* Release the package buffer as it is not required anymore */
+ s_pSecFn->FreeContextBuffer(SecurityPackage);
+
+ /* Allocate our output buffer */
+ nego->output_token = malloc(nego->token_max);
+ if(!nego->output_token)
+ return CURLE_OUT_OF_MEMORY;
+ }
+
+ if(!nego->credentials) {
+ if(user && *user) {
+ /* Populate our identity structure */
+ result = Curl_create_sspi_identity(user, password, &nego->identity);
+ if(result)
+ return result;
+
+ /* Allow proper cleanup of the identity structure */
+ nego->p_identity = &nego->identity;
+ }
+ else
+ /* Use the current Windows user */
+ nego->p_identity = NULL;
+
+ /* Allocate our credentials handle */
+ nego->credentials = malloc(sizeof(CredHandle));
+ if(!nego->credentials)
+ return CURLE_OUT_OF_MEMORY;
+
+ memset(nego->credentials, 0, sizeof(CredHandle));
+
+ /* Acquire our credentials handle */
+ nego->status =
+ s_pSecFn->AcquireCredentialsHandle(NULL,
+ (TCHAR *)TEXT(SP_NAME_NEGOTIATE),
+ SECPKG_CRED_OUTBOUND, NULL,
+ nego->p_identity, NULL, NULL,
+ nego->credentials, &expiry);
+ if(nego->status != SEC_E_OK)
+ return CURLE_LOGIN_DENIED;
+
+ /* Allocate our new context handle */
+ nego->context = malloc(sizeof(CtxtHandle));
+ if(!nego->context)
+ return CURLE_OUT_OF_MEMORY;
+
+ memset(nego->context, 0, sizeof(CtxtHandle));
+ }
+
+ if(chlg64 && strlen(chlg64)) {
+ /* Decode the base-64 encoded challenge message */
+ if(*chlg64 != '=') {
+ result = Curl_base64_decode(chlg64, &chlg, &chlglen);
+ if(result)
+ return result;
+ }
+
+ /* Ensure we have a valid challenge message */
+ if(!chlg) {
+ infof(data, "SPNEGO handshake failure (empty challenge message)\n");
+
+ return CURLE_BAD_CONTENT_ENCODING;
+ }
+
+ /* Setup the challenge "input" security buffer */
+ chlg_desc.ulVersion = SECBUFFER_VERSION;
+ chlg_desc.cBuffers = 1;
+ chlg_desc.pBuffers = &chlg_buf;
+ chlg_buf.BufferType = SECBUFFER_TOKEN;
+ chlg_buf.pvBuffer = chlg;
+ chlg_buf.cbBuffer = curlx_uztoul(chlglen);
+ }
+
+ /* Setup the response "output" security buffer */
+ resp_desc.ulVersion = SECBUFFER_VERSION;
+ resp_desc.cBuffers = 1;
+ resp_desc.pBuffers = &resp_buf;
+ resp_buf.BufferType = SECBUFFER_TOKEN;
+ resp_buf.pvBuffer = nego->output_token;
+ resp_buf.cbBuffer = curlx_uztoul(nego->token_max);
+
+ /* Generate our challenge-response message */
+ nego->status = s_pSecFn->InitializeSecurityContext(nego->credentials,
+ chlg ? nego->context :
+ NULL,
+ nego->server_name,
+ ISC_REQ_CONFIDENTIALITY,
+ 0, SECURITY_NATIVE_DREP,
+ chlg ? &chlg_desc : NULL,
+ 0, nego->context,
+ &resp_desc, &attrs,
+ &expiry);
+
+ if(GSS_ERROR(nego->status)) {
+ free(chlg);
+ return CURLE_OUT_OF_MEMORY;
+ }
+
+ if(nego->status == SEC_I_COMPLETE_NEEDED ||
+ nego->status == SEC_I_COMPLETE_AND_CONTINUE) {
+ nego->status = s_pSecFn->CompleteAuthToken(nego->context, &resp_desc);
+ if(GSS_ERROR(nego->status)) {
+ free(chlg);
+ return CURLE_RECV_ERROR;
+ }
+ }
+
+ nego->output_token_length = resp_buf.cbBuffer;
+
+ /* Free the decoded challenge */
+ free(chlg);
+
+ return result;
+}
+
+/*
+ * Curl_auth_create_spnego_message()
+ *
+ * This is used to generate an already encoded SPNEGO (Negotiate) response
+ * message ready for sending to the recipient.
+ *
+ * Parameters:
+ *
+ * data [in] - The session handle.
+ * nego [in/out] - The Negotiate data struct being used and modified.
+ * outptr [in/out] - The address where a pointer to newly allocated memory
+ * holding the result will be stored upon completion.
+ * outlen [out] - The length of the output message.
+ *
+ * Returns CURLE_OK on success.
+ */
+CURLcode Curl_auth_create_spnego_message(struct SessionHandle *data,
+ struct negotiatedata *nego,
+ char **outptr, size_t *outlen)
+{
+ CURLcode result;
+
+ /* Base64 encode the already generated response */
+ result = Curl_base64_encode(data,
+ (const char*) nego->output_token,
+ nego->output_token_length,
+ outptr, outlen);
+
+ if(result)
+ return result;
+
+ if(!*outptr || !*outlen)
+ return CURLE_REMOTE_ACCESS_DENIED;
+
+ return CURLE_OK;
+}
+
+/*
+ * Curl_auth_spnego_cleanup()
+ *
+ * This is used to clean up the SPNEGO (Negotiate) specific data.
+ *
+ * Parameters:
+ *
+ * nego [in/out] - The Negotiate data struct being cleaned up.
+ *
+ */
+void Curl_auth_spnego_cleanup(struct negotiatedata* nego)
+{
+ /* Free our security context */
+ if(nego->context) {
+ s_pSecFn->DeleteSecurityContext(nego->context);
+ free(nego->context);
+ nego->context = NULL;
+ }
+
+ /* Free our credentials handle */
+ if(nego->credentials) {
+ s_pSecFn->FreeCredentialsHandle(nego->credentials);
+ free(nego->credentials);
+ nego->credentials = NULL;
+ }
+
+ /* Free our identity */
+ Curl_sspi_free_identity(nego->p_identity);
+ nego->p_identity = NULL;
+
+ /* Free the SPN and output token */
+ Curl_safefree(nego->server_name);
+ Curl_safefree(nego->output_token);
+
+ /* Reset any variables */
+ nego->token_max = 0;
+}
+
+#endif /* USE_WINDOWS_SSPI && USE_SPNEGO */
struct kerberos5data;
#endif
+#if defined(USE_WINDOWS_SSPI) && defined(USE_SPNEGO)
+struct negotiatedata;
+#endif
+
+#if defined(USE_WINDOWS_SSPI)
+#define GSS_ERROR(status) (status & 0x80000000)
+#endif
+
/* This is used to build a SPN string */
#if !defined(USE_WINDOWS_SSPI)
char *Curl_auth_build_spn(const char *service, const char *instance);
void Curl_auth_gssapi_cleanup(struct kerberos5data *krb5);
#endif /* USE_KERBEROS5 */
+#if defined(USE_WINDOWS_SSPI) && defined(USE_SPNEGO)
+/* This is used to decode a base64 encoded SPNEGO (Negotiate) challenge
+ message */
+CURLcode Curl_auth_decode_spnego_message(struct SessionHandle *data,
+ const char *user,
+ const char *passwood,
+ const char *service,
+ const char *host,
+ const char *chlg64,
+ struct negotiatedata *nego);
+
+/* This is used to generate a base64 encoded SPNEGO (Negotiate) response
+ message */
+CURLcode Curl_auth_create_spnego_message(struct SessionHandle *data,
+ struct negotiatedata *nego,
+ char **outptr, size_t *outlen);
+
+/* This is used to clean up the SPNEGO specifiec data */
+void Curl_auth_spnego_cleanup(struct negotiatedata* nego);
+
+#endif /* USE_WINDOWS_SSPI && USE_SPNEGO */
+
#endif /* HEADER_CURL_VAUTH_H */
curl_sasl_sspi.c smb.c curl_endian.c curl_des.c \
vauth/vauth.c vauth/cleartext.c vauth/cram.c vauth/digest.c \
vauth/digest_sspi.c vauth/krb5_gssapi.c vauth/krb5_sspi.c \
- vauth/ntlm.c vauth/ntlm_sspi.c vauth/oauth2.c
+ vauth/ntlm.c vauth/ntlm_sspi.c vauth/oauth2.c vauth/spnego_sspi.c
USERINCLUDE ../../../lib ../../../include/curl
#ifdef ENABLE_SSL
projects / thirdparty / curl.git / commitdiff
