git-market/curl-curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-11 12:01:42 +08:00
Code Issues Actions 14 Packages Projects Releases Wiki Activity
0df6c01db3
curl-curl/lib/socks_sspi.c
Viktor Szakats 0df6c01db3
tidy-up: rename Curl_safefree()/tool_safefree() to curlx_safefree() 
To sync names for the same macro logic between lib and src, and to move
it to the curlx namespace, to match `curlx_free()` that it's calling.

Closes #21151
2026-04-01 19:53:53 +02:00

539 lines
18 KiB
C
Raw Blame History

/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) Markus Moeller, <markus_moeller@compuserve.com>
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at https://curl.se/docs/copyright.html.
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
* SPDX-License-Identifier: curl
*
***************************************************************************/
#include "curl_setup.h"
#if defined(USE_WINDOWS_SSPI) && !defined(CURL_DISABLE_PROXY)
#include "urldata.h"
#include "curl_trc.h"
#include "cfilters.h"
#include "connect.h"
#include "strerror.h"
#include "curlx/nonblock.h"
#include "socks.h"
#include "curl_sspi.h"
#include "curlx/multibyte.h"
/*
* Helper sspi error functions.
*/
static int check_sspi_err(struct Curl_easy *data,
SECURITY_STATUS status,
const char *function)
{
if(status != SEC_E_OK &&
status != SEC_I_COMPLETE_AND_CONTINUE &&
status != SEC_I_COMPLETE_NEEDED &&
status != SEC_I_CONTINUE_NEEDED) {
char buffer[STRERROR_LEN];
failf(data, "SSPI error: %s failed: %s", function,
Curl_sspi_strerror(status, buffer, sizeof(buffer)));
return 1;
}
return 0;
}
/* This is the SSPI-using version of this function */
static CURLcode socks5_sspi_setup(struct Curl_cfilter *cf,
struct Curl_easy *data,
CredHandle *cred_handle,
char **service_namep)
{
struct connectdata *conn = cf->conn;
const char *service = data->set.str[STRING_PROXY_SERVICE_NAME] ?
data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd";
SECURITY_STATUS status;
/* prepare service name */
if(strchr(service, '/'))
*service_namep = curlx_strdup(service);
else
*service_namep = curl_maprintf("%s/%s",
service, conn->socks_proxy.host.name);
if(!*service_namep)
return CURLE_OUT_OF_MEMORY;
status =
Curl_pSecFn->AcquireCredentialsHandle(NULL,
(TCHAR *)CURL_UNCONST(TEXT("Kerberos")),
SECPKG_CRED_OUTBOUND,
NULL, NULL, NULL, NULL,
cred_handle, NULL);
if(check_sspi_err(data, status, "AcquireCredentialsHandle")) {
failf(data, "Failed to acquire credentials.");
return CURLE_COULDNT_CONNECT;
}
return CURLE_OK;
}
static CURLcode socks5_free_token(SecBuffer *send_token,
CURLcode result)
{
if(send_token->pvBuffer) {
Curl_pSecFn->FreeContextBuffer(send_token->pvBuffer);
send_token->pvBuffer = NULL;
}
return result;
}
static CURLcode socks5_sspi_loop(struct Curl_cfilter *cf,
struct Curl_easy *data,
CredHandle *cred_handle,
CtxtHandle *sspi_context,
char *service_name,
unsigned long *sspi_ret_flagsp)
{
struct connectdata *conn = cf->conn;
curl_socket_t sock = conn->sock[cf->sockindex];
CURLcode result = CURLE_OK;
CURLcode code;
SECURITY_STATUS status;
SecBuffer sspi_send_token, sspi_recv_token;
SecBufferDesc input_desc, output_desc;
PCtxtHandle context_handle = NULL;
unsigned short us_length;
size_t actualread;
size_t written;
unsigned char socksreq[4];
input_desc.cBuffers = 1;
input_desc.pBuffers = &sspi_recv_token;
input_desc.ulVersion = SECBUFFER_VERSION;
sspi_recv_token.BufferType = SECBUFFER_TOKEN;
sspi_recv_token.cbBuffer = 0;
sspi_recv_token.pvBuffer = NULL;
output_desc.cBuffers = 1;
output_desc.pBuffers = &sspi_send_token;
output_desc.ulVersion = SECBUFFER_VERSION;
sspi_send_token.BufferType = SECBUFFER_TOKEN;
sspi_send_token.cbBuffer = 0;
sspi_send_token.pvBuffer = NULL;
(void)curlx_nonblock(sock, FALSE);
for(;;) {
TCHAR *sname = curlx_convert_UTF8_to_tchar(service_name);
if(!sname) {
curlx_free(sspi_recv_token.pvBuffer);
return socks5_free_token(&sspi_send_token, CURLE_OUT_OF_MEMORY);
}
status =
Curl_pSecFn->InitializeSecurityContext(cred_handle, context_handle,
sname,
ISC_REQ_MUTUAL_AUTH |
ISC_REQ_ALLOCATE_MEMORY |
ISC_REQ_CONFIDENTIALITY |
ISC_REQ_REPLAY_DETECT,
0, SECURITY_NATIVE_DREP,
&input_desc, 0,
sspi_context,
&output_desc,
sspi_ret_flagsp, NULL);
curlx_free(sname);
curlx_safefree(sspi_recv_token.pvBuffer);
sspi_recv_token.cbBuffer = 0;
if(check_sspi_err(data, status, "InitializeSecurityContext")) {
failf(data, "Failed to initialise security context.");
return socks5_free_token(&sspi_send_token, CURLE_COULDNT_CONNECT);
}
if(sspi_send_token.cbBuffer) {
socksreq[0] = 1; /* GSS-API subnegotiation version */
socksreq[1] = 1; /* authentication message type */
if(sspi_send_token.cbBuffer > 0xffff) {
/* needs to fit in an unsigned 16-bit field */
return socks5_free_token(&sspi_send_token, CURLE_COULDNT_CONNECT);
}
us_length = htons((unsigned short)sspi_send_token.cbBuffer);
memcpy(socksreq + 2, &us_length, sizeof(short));
code = Curl_conn_cf_send(cf->next, data, socksreq, 4, FALSE, &written);
if(code || (written != 4)) {
failf(data, "Failed to send SSPI authentication request.");
return socks5_free_token(&sspi_send_token, CURLE_COULDNT_CONNECT);
}
code = Curl_conn_cf_send(cf->next, data,
sspi_send_token.pvBuffer,
sspi_send_token.cbBuffer, FALSE, &written);
if(code || (sspi_send_token.cbBuffer != written)) {
failf(data, "Failed to send SSPI authentication token.");
return socks5_free_token(&sspi_send_token, CURLE_COULDNT_CONNECT);
}
}
if(sspi_send_token.pvBuffer)
socks5_free_token(&sspi_send_token, CURLE_OK);
sspi_send_token.cbBuffer = 0;
curlx_safefree(sspi_recv_token.pvBuffer);
sspi_recv_token.cbBuffer = 0;
if(status != SEC_I_CONTINUE_NEEDED)
break;
result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
if(result || (actualread != 4)) {
failf(data, "Failed to receive SSPI authentication response.");
return result ? result : CURLE_COULDNT_CONNECT;
}
if(socksreq[1] == 255) {
failf(data, "User was rejected by the SOCKS5 server (%u %u).",
(unsigned int)socksreq[0], (unsigned int)socksreq[1]);
return CURLE_COULDNT_CONNECT;
}
if(socksreq[1] != 1) {
failf(data, "Invalid SSPI authentication response type (%u %u).",
(unsigned int)socksreq[0], (unsigned int)socksreq[1]);
return CURLE_COULDNT_CONNECT;
}
memcpy(&us_length, socksreq + 2, sizeof(short));
us_length = ntohs(us_length);
if(!us_length) {
failf(data, "Invalid zero-length SSPI authentication token.");
return CURLE_COULDNT_CONNECT;
}
sspi_recv_token.cbBuffer = us_length;
sspi_recv_token.pvBuffer = curlx_malloc(us_length);
if(!sspi_recv_token.pvBuffer)
return CURLE_OUT_OF_MEMORY;
result = Curl_blockread_all(cf, data, (char *)sspi_recv_token.pvBuffer,
sspi_recv_token.cbBuffer, &actualread);
if(result || (actualread != us_length)) {
failf(data, "Failed to receive SSPI authentication token.");
curlx_free(sspi_recv_token.pvBuffer);
return result ? result : CURLE_COULDNT_CONNECT;
}
context_handle = sspi_context;
}
return CURLE_OK;
}
static CURLcode socks5_free(SecBuffer *sspi_w_token,
CURLcode result)
{
curlx_safefree(sspi_w_token[0].pvBuffer);
curlx_safefree(sspi_w_token[1].pvBuffer);
curlx_safefree(sspi_w_token[2].pvBuffer);
return result;
}
static CURLcode socks5_sspi_encrypt(struct Curl_cfilter *cf,
struct Curl_easy *data,
CtxtHandle *sspi_context,
unsigned long sspi_ret_flags)
{
CURLcode result = CURLE_OK;
CURLcode code;
SECURITY_STATUS status;
unsigned char gss_enc;
SecBuffer sspi_w_token[3];
SecBufferDesc wrap_desc;
SecPkgContext_Sizes sspi_sizes;
unsigned short us_length;
unsigned long qop;
unsigned char socksreq[4];
uint8_t *etbuf = NULL;
size_t etbuf_size = 0;
size_t actualread;
size_t written;
gss_enc = 0;
if(sspi_ret_flags & ISC_REQ_CONFIDENTIALITY)
gss_enc = 2;
else if(sspi_ret_flags & ISC_REQ_INTEGRITY)
gss_enc = 1;
infof(data, "SOCKS5 server supports GSS-API %s data protection.",
(gss_enc == 0) ? "no" :
((gss_enc == 1) ? "integrity" : "confidentiality"));
sspi_w_token[0].pvBuffer =
sspi_w_token[1].pvBuffer =
sspi_w_token[2].pvBuffer = NULL;
wrap_desc.cBuffers = 3;
wrap_desc.pBuffers = sspi_w_token;
wrap_desc.ulVersion = SECBUFFER_VERSION;
socksreq[0] = 1;
socksreq[1] = 2;
if(data->set.socks5_gssapi_nec) {
us_length = htons((unsigned short)1);
memcpy(socksreq + 2, &us_length, sizeof(short));
}
else {
status = Curl_pSecFn->QueryContextAttributes(sspi_context,
SECPKG_ATTR_SIZES,
&sspi_sizes);
if(check_sspi_err(data, status, "QueryContextAttributes")) {
failf(data, "Failed to query security context attributes.");
return CURLE_COULDNT_CONNECT;
}
sspi_w_token[0].cbBuffer = sspi_sizes.cbSecurityTrailer;
sspi_w_token[0].BufferType = SECBUFFER_TOKEN;
sspi_w_token[0].pvBuffer = curlx_malloc(sspi_sizes.cbSecurityTrailer);
if(!sspi_w_token[0].pvBuffer)
return CURLE_OUT_OF_MEMORY;
sspi_w_token[1].cbBuffer = 1;
sspi_w_token[1].BufferType = SECBUFFER_DATA;
sspi_w_token[1].pvBuffer = curlx_malloc(1);
if(!sspi_w_token[1].pvBuffer)
return socks5_free(sspi_w_token, CURLE_OUT_OF_MEMORY);
memcpy(sspi_w_token[1].pvBuffer, &gss_enc, 1);
sspi_w_token[2].BufferType = SECBUFFER_PADDING;
sspi_w_token[2].cbBuffer = sspi_sizes.cbBlockSize;
sspi_w_token[2].pvBuffer = curlx_malloc(sspi_sizes.cbBlockSize);
if(!sspi_w_token[2].pvBuffer)
return socks5_free(sspi_w_token, CURLE_OUT_OF_MEMORY);
status = Curl_pSecFn->EncryptMessage(sspi_context,
KERB_WRAP_NO_ENCRYPT,
&wrap_desc, 0);
if(check_sspi_err(data, status, "EncryptMessage"))
return socks5_free(sspi_w_token, CURLE_COULDNT_CONNECT);
etbuf_size = sspi_w_token[0].cbBuffer + sspi_w_token[1].cbBuffer +
sspi_w_token[2].cbBuffer;
if(etbuf_size > 0xffff)
return socks5_free(sspi_w_token, CURLE_COULDNT_CONNECT);
etbuf = curlx_malloc(etbuf_size);
if(!etbuf)
return socks5_free(sspi_w_token, CURLE_OUT_OF_MEMORY);
memcpy(etbuf, sspi_w_token[0].pvBuffer, sspi_w_token[0].cbBuffer);
memcpy(etbuf + sspi_w_token[0].cbBuffer,
sspi_w_token[1].pvBuffer, sspi_w_token[1].cbBuffer);
memcpy(etbuf + sspi_w_token[0].cbBuffer + sspi_w_token[1].cbBuffer,
sspi_w_token[2].pvBuffer, sspi_w_token[2].cbBuffer);
(void)socks5_free(sspi_w_token, CURLE_OK);
us_length = htons((unsigned short)etbuf_size);
memcpy(socksreq + 2, &us_length, sizeof(short));
}
code = Curl_conn_cf_send(cf->next, data, socksreq, 4, FALSE, &written);
if(code || (written != 4)) {
failf(data, "Failed to send SSPI encryption request.");
curlx_free(etbuf);
return CURLE_COULDNT_CONNECT;
}
if(data->set.socks5_gssapi_nec) {
memcpy(socksreq, &gss_enc, 1);
code = Curl_conn_cf_send(cf->next, data, socksreq, 1, FALSE, &written);
if(code || (written != 1)) {
failf(data, "Failed to send SSPI encryption type.");
return CURLE_COULDNT_CONNECT;
}
}
else {
code = Curl_conn_cf_send(cf->next, data, etbuf, etbuf_size, FALSE,
&written);
curlx_free(etbuf);
if(code || (etbuf_size != written)) {
failf(data, "Failed to send SSPI encryption type.");
return CURLE_COULDNT_CONNECT;
}
}
result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
if(result || (actualread != 4)) {
failf(data, "Failed to receive SSPI encryption response.");
return result ? result : CURLE_COULDNT_CONNECT;
}
if(socksreq[1] == 255) {
failf(data, "User was rejected by the SOCKS5 server (%u %u).",
(unsigned int)socksreq[0], (unsigned int)socksreq[1]);
return CURLE_COULDNT_CONNECT;
}
if(socksreq[1] != 2) {
failf(data, "Invalid SSPI encryption response type (%u %u).",
(unsigned int)socksreq[0], (unsigned int)socksreq[1]);
return CURLE_COULDNT_CONNECT;
}
memcpy(&us_length, socksreq + 2, sizeof(short));
us_length = ntohs(us_length);
if(!us_length) {
failf(data, "Invalid zero-length SSPI encryption token.");
return CURLE_COULDNT_CONNECT;
}
sspi_w_token[0].cbBuffer = us_length;
sspi_w_token[0].pvBuffer = curlx_malloc(us_length);
if(!sspi_w_token[0].pvBuffer)
return CURLE_OUT_OF_MEMORY;
result = Curl_blockread_all(cf, data, (char *)sspi_w_token[0].pvBuffer,
sspi_w_token[0].cbBuffer, &actualread);
if(result || (actualread != us_length)) {
failf(data, "Failed to receive SSPI encryption type.");
curlx_free(sspi_w_token[0].pvBuffer);
return result ? result : CURLE_COULDNT_CONNECT;
}
if(!data->set.socks5_gssapi_nec) {
wrap_desc.cBuffers = 2;
sspi_w_token[0].BufferType = SECBUFFER_STREAM;
sspi_w_token[1].BufferType = SECBUFFER_DATA;
sspi_w_token[1].cbBuffer = 0;
sspi_w_token[1].pvBuffer = NULL;
status = Curl_pSecFn->DecryptMessage(sspi_context, &wrap_desc,
0, &qop);
if(check_sspi_err(data, status, "DecryptMessage")) {
if(sspi_w_token[1].pvBuffer)
Curl_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
curlx_free(sspi_w_token[0].pvBuffer);
return CURLE_COULDNT_CONNECT;
}
if(sspi_w_token[1].cbBuffer != 1) {
failf(data, "Invalid SSPI encryption response length (%lu).",
(unsigned long)sspi_w_token[1].cbBuffer);
if(sspi_w_token[1].pvBuffer)
Curl_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
curlx_free(sspi_w_token[0].pvBuffer);
return CURLE_COULDNT_CONNECT;
}
memcpy(socksreq, sspi_w_token[1].pvBuffer, sspi_w_token[1].cbBuffer);
Curl_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
}
else {
if(sspi_w_token[0].cbBuffer != 1) {
failf(data, "Invalid SSPI encryption response length (%lu).",
(unsigned long)sspi_w_token[0].cbBuffer);
curlx_free(sspi_w_token[0].pvBuffer);
return CURLE_COULDNT_CONNECT;
}
memcpy(socksreq, sspi_w_token[0].pvBuffer, sspi_w_token[0].cbBuffer);
}
curlx_free(sspi_w_token[0].pvBuffer);
infof(data, "SOCKS5 access with%s protection granted BUT NOT USED.",
(socksreq[0] == 0) ? "out GSS-API data" :
((socksreq[0] == 1) ? " GSS-API integrity" :
" GSS-API confidentiality"));
return CURLE_OK;
}
CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
struct connectdata *conn = cf->conn;
curl_socket_t sock = conn->sock[cf->sockindex];
CURLcode result;
SECURITY_STATUS status;
CredHandle cred_handle;
CtxtHandle sspi_context;
SecPkgCredentials_Names names;
char *service_name = NULL;
unsigned long sspi_ret_flags = 0;
memset(&cred_handle, 0, sizeof(cred_handle));
memset(&sspi_context, 0, sizeof(sspi_context));
names.sUserName = NULL;
result = socks5_sspi_setup(cf, data, &cred_handle, &service_name);
if(result)
goto error;
result = socks5_sspi_loop(cf, data, &cred_handle, &sspi_context,
service_name, &sspi_ret_flags);
if(result)
goto error;
curlx_safefree(service_name);
status = Curl_pSecFn->QueryCredentialsAttributes(&cred_handle,
SECPKG_CRED_ATTR_NAMES,
&names);
if(check_sspi_err(data, status, "QueryCredentialAttributes")) {
failf(data, "Failed to determine username.");
result = CURLE_COULDNT_CONNECT;
goto error;
}
else {
VERBOSE(char *user_utf8 = curlx_convert_tchar_to_UTF8(names.sUserName));
infof(data, "SOCKS5 server authenticated user %s with GSS-API.",
(user_utf8 ? user_utf8 : "(unknown)"));
VERBOSE(curlx_free(user_utf8));
Curl_pSecFn->FreeContextBuffer(names.sUserName);
names.sUserName = NULL;
}
result = socks5_sspi_encrypt(cf, data, &sspi_context, sspi_ret_flags);
if(result)
goto error;
(void)curlx_nonblock(sock, TRUE);
Curl_pSecFn->DeleteSecurityContext(&sspi_context);
Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
return CURLE_OK;
error:
(void)curlx_nonblock(sock, TRUE);
curlx_free(service_name);
Curl_pSecFn->DeleteSecurityContext(&sspi_context);
Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
if(names.sUserName)
Curl_pSecFn->FreeContextBuffer(names.sUserName);
return result;
}
#endif
Reference in New Issue View Git Blame Copy Permalink