romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 10:53:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

spnego_gssapi: implement TLS channel bindings for openssl

Browse source 
Channel Bindings are used to tie the session context to a specific TLS
channel. This is to provide additional proof of valid identity,
mitigating authentication relay attacks.

Major web servers have the ability to require (None/Accept/Require)
GSSAPI channel binding, rendering Curl unable to connect to such
websites unless support for channel bindings is implemented.

IIS calls this feature Extended Protection (EPA), which is used in
Enterprise environments using Kerberos for authentication.

This change require krb5 >= 1.19, otherwise channel bindings won't be
forwarded through SPNEGO.

Co-Authored-By: Steffen Kieß <947515+steffen-kiess@users.noreply.github.com>
Closes #13098
This commit is contained in:
Max Faxälv 2024-02-29 09:12:59 +01:00 • committed by Daniel Stenberg
parent 9dfdc6ff42
commit 0a5ea09a91
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
14 changed files with 153 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
lib/vauth/spnego_gssapi.c
View file

@ -91,6 +91,8 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
gss_channel_bindings_t chan_bindings = GSS_C_NO_CHANNEL_BINDINGS;
struct gss_channel_bindings_struct chan;
(void) user;
(void) password;
@ -148,13 +150,21 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
input_token.length = chlglen;
}
/* Set channel binding data if available */
if(nego->channel_binding_data.leng > 0) {
memset(&chan, 0, sizeof(struct gss_channel_bindings_struct));
chan.application_data.length = nego->channel_binding_data.leng;
chan.application_data.value = nego->channel_binding_data.bufr;
chan_bindings = &chan;
}
/* Generate our challenge-response message */
major_status = Curl_gss_init_sec_context(data,
&minor_status,
&nego->context,
nego->spn,
&Curl_spnego_mech_oid,
GSS_C_NO_CHANNEL_BINDINGS,
chan_bindings,
&input_token,
&output_token,
TRUE,