freebsd-dev/contrib/serf/auth/auth_spnego_sspi.c
2013-08-02 19:21:46 +00:00

298 lines
8.6 KiB
C

/* Copyright 2010 Justin Erenkrantz and Greg Stein
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "auth_spnego.h"
#include "serf.h"
#include "serf_private.h"
#ifdef SERF_USE_SSPI
#include <apr.h>
#include <apr_strings.h>
#define SECURITY_WIN32
#include <sspi.h>
/* SEC_E_MUTUAL_AUTH_FAILED is not defined in Windows Platform SDK 5.0. */
#ifndef SEC_E_MUTUAL_AUTH_FAILED
#define SEC_E_MUTUAL_AUTH_FAILED _HRESULT_TYPEDEF_(0x80090363L)
#endif
struct serf__spnego_context_t
{
CredHandle sspi_credentials;
CtxtHandle sspi_context;
BOOL initalized;
apr_pool_t *pool;
/* Service Principal Name (SPN) used for authentication. */
const char *target_name;
/* One of SERF_AUTHN_* authentication types.*/
int authn_type;
};
/* Map SECURITY_STATUS from SSPI to APR error code. Some error codes mapped
* to our own codes and some to Win32 error codes:
* http://support.microsoft.com/kb/113996
*/
static apr_status_t
map_sspi_status(SECURITY_STATUS sspi_status)
{
switch(sspi_status)
{
case SEC_E_INSUFFICIENT_MEMORY:
return APR_FROM_OS_ERROR(ERROR_NO_SYSTEM_RESOURCES);
case SEC_E_INVALID_HANDLE:
return APR_FROM_OS_ERROR(ERROR_INVALID_HANDLE);
case SEC_E_UNSUPPORTED_FUNCTION:
return APR_FROM_OS_ERROR(ERROR_INVALID_FUNCTION);
case SEC_E_TARGET_UNKNOWN:
return APR_FROM_OS_ERROR(ERROR_BAD_NETPATH);
case SEC_E_INTERNAL_ERROR:
return APR_FROM_OS_ERROR(ERROR_INTERNAL_ERROR);
case SEC_E_SECPKG_NOT_FOUND:
case SEC_E_BAD_PKGID:
return APR_FROM_OS_ERROR(ERROR_NO_SUCH_PACKAGE);
case SEC_E_NO_IMPERSONATION:
return APR_FROM_OS_ERROR(ERROR_CANNOT_IMPERSONATE);
case SEC_E_NO_AUTHENTICATING_AUTHORITY:
return APR_FROM_OS_ERROR(ERROR_NO_LOGON_SERVERS);
case SEC_E_UNTRUSTED_ROOT:
return APR_FROM_OS_ERROR(ERROR_TRUST_FAILURE);
case SEC_E_WRONG_PRINCIPAL:
return APR_FROM_OS_ERROR(ERROR_WRONG_TARGET_NAME);
case SEC_E_MUTUAL_AUTH_FAILED:
return APR_FROM_OS_ERROR(ERROR_MUTUAL_AUTH_FAILED);
case SEC_E_TIME_SKEW:
return APR_FROM_OS_ERROR(ERROR_TIME_SKEW);
default:
return SERF_ERROR_AUTHN_FAILED;
}
}
/* Cleans the SSPI context object, when the pool used to create it gets
cleared or destroyed. */
static apr_status_t
cleanup_ctx(void *data)
{
serf__spnego_context_t *ctx = data;
if (SecIsValidHandle(&ctx->sspi_context)) {
DeleteSecurityContext(&ctx->sspi_context);
SecInvalidateHandle(&ctx->sspi_context);
}
if (SecIsValidHandle(&ctx->sspi_credentials)) {
FreeCredentialsHandle(&ctx->sspi_context);
SecInvalidateHandle(&ctx->sspi_context);
}
return APR_SUCCESS;
}
static apr_status_t
cleanup_sec_buffer(void *data)
{
FreeContextBuffer(data);
return APR_SUCCESS;
}
apr_status_t
serf__spnego_create_sec_context(serf__spnego_context_t **ctx_p,
const serf__authn_scheme_t *scheme,
apr_pool_t *result_pool,
apr_pool_t *scratch_pool)
{
SECURITY_STATUS sspi_status;
serf__spnego_context_t *ctx;
const char *sspi_package;
ctx = apr_pcalloc(result_pool, sizeof(*ctx));
SecInvalidateHandle(&ctx->sspi_context);
SecInvalidateHandle(&ctx->sspi_credentials);
ctx->initalized = FALSE;
ctx->pool = result_pool;
ctx->target_name = NULL;
ctx->authn_type = scheme->type;
apr_pool_cleanup_register(result_pool, ctx,
cleanup_ctx,
apr_pool_cleanup_null);
if (ctx->authn_type == SERF_AUTHN_NEGOTIATE)
sspi_package = "Negotiate";
else
sspi_package = "NTLM";
sspi_status = AcquireCredentialsHandle(
NULL, sspi_package, SECPKG_CRED_OUTBOUND,
NULL, NULL, NULL, NULL,
&ctx->sspi_credentials, NULL);
if (FAILED(sspi_status)) {
return map_sspi_status(sspi_status);
}
*ctx_p = ctx;
return APR_SUCCESS;
}
static apr_status_t
get_canonical_hostname(const char **canonname,
const char *hostname,
apr_pool_t *pool)
{
struct addrinfo hints;
struct addrinfo *addrinfo;
ZeroMemory(&hints, sizeof(hints));
hints.ai_flags = AI_CANONNAME;
if (getaddrinfo(hostname, NULL, &hints, &addrinfo)) {
return apr_get_netos_error();
}
if (addrinfo) {
*canonname = apr_pstrdup(pool, addrinfo->ai_canonname);
}
else {
*canonname = apr_pstrdup(pool, hostname);
}
freeaddrinfo(addrinfo);
return APR_SUCCESS;
}
apr_status_t
serf__spnego_reset_sec_context(serf__spnego_context_t *ctx)
{
if (SecIsValidHandle(&ctx->sspi_context)) {
DeleteSecurityContext(&ctx->sspi_context);
SecInvalidateHandle(&ctx->sspi_context);
}
ctx->initalized = FALSE;
return APR_SUCCESS;
}
apr_status_t
serf__spnego_init_sec_context(serf__spnego_context_t *ctx,
const char *service,
const char *hostname,
serf__spnego_buffer_t *input_buf,
serf__spnego_buffer_t *output_buf,
apr_pool_t *result_pool,
apr_pool_t *scratch_pool
)
{
SECURITY_STATUS status;
ULONG actual_attr;
SecBuffer sspi_in_buffer;
SecBufferDesc sspi_in_buffer_desc;
SecBuffer sspi_out_buffer;
SecBufferDesc sspi_out_buffer_desc;
apr_status_t apr_status;
const char *canonname;
if (!ctx->initalized && ctx->authn_type == SERF_AUTHN_NEGOTIATE) {
apr_status = get_canonical_hostname(&canonname, hostname, scratch_pool);
if (apr_status) {
return apr_status;
}
ctx->target_name = apr_pstrcat(scratch_pool, service, "/", canonname,
NULL);
serf__log(AUTH_VERBOSE, __FILE__,
"Using SPN '%s' for '%s'\n", ctx->target_name, hostname);
}
else if (ctx->authn_type == SERF_AUTHN_NTLM)
{
/* Target name is not used for NTLM authentication. */
ctx->target_name = NULL;
}
/* Prepare input buffer description. */
sspi_in_buffer.BufferType = SECBUFFER_TOKEN;
sspi_in_buffer.pvBuffer = input_buf->value;
sspi_in_buffer.cbBuffer = input_buf->length;
sspi_in_buffer_desc.cBuffers = 1;
sspi_in_buffer_desc.pBuffers = &sspi_in_buffer;
sspi_in_buffer_desc.ulVersion = SECBUFFER_VERSION;
/* Output buffers. Output buffer will be allocated by system. */
sspi_out_buffer.BufferType = SECBUFFER_TOKEN;
sspi_out_buffer.pvBuffer = NULL;
sspi_out_buffer.cbBuffer = 0;
sspi_out_buffer_desc.cBuffers = 1;
sspi_out_buffer_desc.pBuffers = &sspi_out_buffer;
sspi_out_buffer_desc.ulVersion = SECBUFFER_VERSION;
status = InitializeSecurityContext(
&ctx->sspi_credentials,
ctx->initalized ? &ctx->sspi_context : NULL,
ctx->target_name,
ISC_REQ_ALLOCATE_MEMORY
| ISC_REQ_MUTUAL_AUTH
| ISC_REQ_CONFIDENTIALITY,
0, /* Reserved1 */
SECURITY_NETWORK_DREP,
&sspi_in_buffer_desc,
0, /* Reserved2 */
&ctx->sspi_context,
&sspi_out_buffer_desc,
&actual_attr,
NULL);
if (sspi_out_buffer.cbBuffer > 0) {
apr_pool_cleanup_register(result_pool, sspi_out_buffer.pvBuffer,
cleanup_sec_buffer,
apr_pool_cleanup_null);
}
ctx->initalized = TRUE;
/* Finish authentication if SSPI requires so. */
if (status == SEC_I_COMPLETE_NEEDED
|| status == SEC_I_COMPLETE_AND_CONTINUE)
{
CompleteAuthToken(&ctx->sspi_context, &sspi_out_buffer_desc);
}
output_buf->value = sspi_out_buffer.pvBuffer;
output_buf->length = sspi_out_buffer.cbBuffer;
switch(status) {
case SEC_I_COMPLETE_AND_CONTINUE:
case SEC_I_CONTINUE_NEEDED:
return APR_EAGAIN;
case SEC_I_COMPLETE_NEEDED:
case SEC_E_OK:
return APR_SUCCESS;
default:
return map_sspi_status(status);
}
}
#endif /* SERF_USE_SSPI */