mirror of
https://github.com/curl/curl.git
synced 2026-08-05 05:56:12 +03:00
socks_gssapi: simplify Curl_SOCKS5_gssapi_negotiate
Also: pass in NULL when 'conf_state' is not wanted for gss_wrap() and gss_unwrap() Closes #21502
This commit is contained in:
Daniel Stenberg
parent
bc40e09f63
commit
f97f01f592
1 changed files with 138 additions and 80 deletions
|
|
@ -98,37 +98,13 @@ static int check_gss_err(struct Curl_easy *data,
|
|||
return 0;
|
||||
}
|
||||
|
||||
CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
||||
struct Curl_easy *data)
|
||||
static CURLcode socks5_gss_create_service_name(struct Curl_easy *data,
|
||||
struct connectdata *conn,
|
||||
const char *serviceptr,
|
||||
gss_name_t *server)
|
||||
{
|
||||
struct connectdata *conn = cf->conn;
|
||||
curl_socket_t sock = conn->sock[cf->sockindex];
|
||||
size_t actualread;
|
||||
size_t nwritten;
|
||||
CURLcode result;
|
||||
OM_uint32 gss_major_status, gss_minor_status, gss_status;
|
||||
OM_uint32 gss_ret_flags;
|
||||
int gss_conf_state, gss_enc;
|
||||
gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
|
||||
gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
|
||||
gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
|
||||
gss_buffer_desc gss_w_token = GSS_C_EMPTY_BUFFER;
|
||||
gss_buffer_desc *gss_token = GSS_C_NO_BUFFER;
|
||||
gss_name_t server = GSS_C_NO_NAME;
|
||||
gss_name_t gss_client_name = GSS_C_NO_NAME;
|
||||
unsigned short us_length;
|
||||
unsigned char socksreq[4]; /* room for GSS-API exchange header only */
|
||||
const char *serviceptr = data->set.str[STRING_PROXY_SERVICE_NAME] ?
|
||||
data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd";
|
||||
gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
|
||||
|
||||
/* GSS-API request looks like
|
||||
* +----+------+-----+----------------+
|
||||
* |VER | MTYP | LEN | TOKEN |
|
||||
* +----+------+----------------------+
|
||||
* | 1 | 1 | 2 | up to 2^16 - 1 |
|
||||
* +----+------+-----+----------------+
|
||||
*/
|
||||
gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
|
||||
|
||||
/* prepare service name */
|
||||
if(strchr(serviceptr, '/')) {
|
||||
|
|
@ -138,7 +114,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
return CURLE_OUT_OF_MEMORY;
|
||||
|
||||
gss_major_status = gss_import_name(&gss_minor_status, &service,
|
||||
(gss_OID)GSS_C_NULL_OID, &server);
|
||||
(gss_OID)GSS_C_NULL_OID, server);
|
||||
}
|
||||
else {
|
||||
service.value = curl_maprintf("%s@%s", serviceptr,
|
||||
|
|
@ -148,7 +124,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
service.length = strlen(service.value);
|
||||
|
||||
gss_major_status = gss_import_name(&gss_minor_status, &service,
|
||||
GSS_C_NT_HOSTBASED_SERVICE, &server);
|
||||
GSS_C_NT_HOSTBASED_SERVICE, server);
|
||||
}
|
||||
|
||||
curlx_safefree(service.value);
|
||||
|
|
@ -157,25 +133,50 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(check_gss_err(data, gss_major_status,
|
||||
gss_minor_status, "gss_import_name()")) {
|
||||
failf(data, "Failed to create service name.");
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_release_name(&gss_status, server);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
(void)curlx_nonblock(sock, FALSE);
|
||||
return CURLE_OK;
|
||||
}
|
||||
|
||||
static CURLcode socks5_gss_auth_loop(struct Curl_cfilter *cf,
|
||||
struct Curl_easy *data,
|
||||
gss_name_t *server_ptr,
|
||||
gss_ctx_id_t *gss_context,
|
||||
OM_uint32 *gss_ret_flags)
|
||||
{
|
||||
OM_uint32 gss_major_status, gss_minor_status, gss_status;
|
||||
gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
|
||||
gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
|
||||
gss_buffer_desc *gss_token = GSS_C_NO_BUFFER;
|
||||
unsigned short us_length;
|
||||
unsigned char socksreq[4];
|
||||
size_t actualread;
|
||||
size_t nwritten;
|
||||
CURLcode result;
|
||||
|
||||
/* GSS-API request looks like
|
||||
* +----+------+-----+----------------+
|
||||
* |VER | MTYP | LEN | TOKEN |
|
||||
* +----+------+----------------------+
|
||||
* | 1 | 1 | 2 | up to 2^16 - 1 |
|
||||
* +----+------+-----+----------------+
|
||||
*/
|
||||
|
||||
/* As long as we need to keep sending some context info, and there is no
|
||||
* errors, keep sending it... */
|
||||
for(;;) {
|
||||
gss_major_status = Curl_gss_init_sec_context(data,
|
||||
&gss_minor_status,
|
||||
&gss_context,
|
||||
server,
|
||||
gss_context,
|
||||
*server_ptr,
|
||||
&Curl_krb5_mech_oid,
|
||||
NULL,
|
||||
gss_token,
|
||||
&gss_send_token,
|
||||
TRUE,
|
||||
&gss_ret_flags);
|
||||
gss_ret_flags);
|
||||
|
||||
if(gss_token != GSS_C_NO_BUFFER) {
|
||||
curlx_safefree(gss_recv_token.value);
|
||||
|
|
@ -185,10 +186,10 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_minor_status, "gss_init_sec_context") ||
|
||||
/* the size needs to fit in a 16-bit field */
|
||||
(gss_send_token.length > 0xffff)) {
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_release_name(&gss_status, server_ptr);
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
failf(data, "Failed to initial GSS-API token.");
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
failf(data, "Failed to initialize GSS-API token.");
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -202,9 +203,9 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
&nwritten);
|
||||
if(result || (nwritten != 4)) {
|
||||
failf(data, "Failed to send GSS-API authentication request.");
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_release_name(&gss_status, server_ptr);
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -213,9 +214,9 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_send_token.length, FALSE, &nwritten);
|
||||
if(result || (gss_send_token.length != nwritten)) {
|
||||
failf(data, "Failed to send GSS-API authentication token.");
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_release_name(&gss_status, server_ptr);
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
}
|
||||
|
|
@ -237,8 +238,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
|
||||
if(result || (actualread != 4)) {
|
||||
failf(data, "Failed to receive GSS-API authentication response.");
|
||||
gss_release_name(&gss_status, &server);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
gss_release_name(&gss_status, server_ptr);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -246,16 +247,16 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(socksreq[1] == 255) { /* status / message type */
|
||||
failf(data, "User was rejected by the SOCKS5 server (%d %d).",
|
||||
socksreq[0], socksreq[1]);
|
||||
gss_release_name(&gss_status, &server);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
gss_release_name(&gss_status, server_ptr);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
if(socksreq[1] != 1) { /* status / message type */
|
||||
failf(data, "Invalid GSS-API authentication response type (%d %d).",
|
||||
socksreq[0], socksreq[1]);
|
||||
gss_release_name(&gss_status, &server);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
gss_release_name(&gss_status, server_ptr);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -264,8 +265,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
|
||||
if(!us_length) {
|
||||
failf(data, "Invalid zero-length GSS-API authentication token.");
|
||||
gss_release_name(&gss_status, &server);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
gss_release_name(&gss_status, server_ptr);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -275,8 +276,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
failf(data,
|
||||
"Could not allocate memory for GSS-API authentication "
|
||||
"response token.");
|
||||
gss_release_name(&gss_status, &server);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
gss_release_name(&gss_status, server_ptr);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
|
|
@ -285,25 +286,34 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
|
||||
if(result || (actualread != us_length)) {
|
||||
failf(data, "Failed to receive GSS-API authentication token.");
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_release_name(&gss_status, server_ptr);
|
||||
curlx_safefree(gss_recv_token.value);
|
||||
gss_recv_token.length = 0;
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
gss_token = &gss_recv_token;
|
||||
}
|
||||
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_release_name(&gss_status, server_ptr);
|
||||
return CURLE_OK;
|
||||
}
|
||||
|
||||
static CURLcode socks5_gss_auth_verify(struct Curl_easy *data,
|
||||
gss_ctx_id_t *gss_context)
|
||||
{
|
||||
OM_uint32 gss_major_status, gss_minor_status, gss_status;
|
||||
gss_name_t gss_client_name = GSS_C_NO_NAME;
|
||||
gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
|
||||
|
||||
/* Everything is good so far, user was authenticated! */
|
||||
gss_major_status = gss_inquire_context(&gss_minor_status, gss_context,
|
||||
gss_major_status = gss_inquire_context(&gss_minor_status, *gss_context,
|
||||
&gss_client_name, NULL, NULL, NULL,
|
||||
NULL, NULL, NULL);
|
||||
if(check_gss_err(data, gss_major_status,
|
||||
gss_minor_status, "gss_inquire_context")) {
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
gss_release_name(&gss_status, &gss_client_name);
|
||||
failf(data, "Failed to determine username.");
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
|
|
@ -312,7 +322,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
&gss_send_token, NULL);
|
||||
if(check_gss_err(data, gss_major_status,
|
||||
gss_minor_status, "gss_display_name")) {
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
gss_release_name(&gss_status, &gss_client_name);
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
failf(data, "Failed to determine username.");
|
||||
|
|
@ -325,6 +335,26 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_release_name(&gss_status, &gss_client_name);
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
|
||||
return CURLE_OK;
|
||||
}
|
||||
|
||||
static CURLcode socks5_gss_negotiate_enc(struct Curl_cfilter *cf,
|
||||
struct Curl_easy *data,
|
||||
gss_ctx_id_t *gss_context,
|
||||
OM_uint32 gss_ret_flags)
|
||||
{
|
||||
struct connectdata *conn = cf->conn;
|
||||
OM_uint32 gss_major_status, gss_minor_status, gss_status;
|
||||
gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
|
||||
gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
|
||||
gss_buffer_desc gss_w_token = GSS_C_EMPTY_BUFFER;
|
||||
unsigned short us_length;
|
||||
unsigned char socksreq[4];
|
||||
size_t actualread;
|
||||
size_t nwritten;
|
||||
CURLcode result;
|
||||
int gss_enc;
|
||||
|
||||
/* Do encryption */
|
||||
socksreq[0] = 1; /* GSS-API subnegotiation version */
|
||||
socksreq[1] = 2; /* encryption message type */
|
||||
|
|
@ -379,19 +409,19 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_send_token.length = 1;
|
||||
gss_send_token.value = curlx_memdup(&gss_enc, gss_send_token.length);
|
||||
if(!gss_send_token.value) {
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
gss_major_status = gss_wrap(&gss_minor_status, gss_context, 0,
|
||||
gss_major_status = gss_wrap(&gss_minor_status, *gss_context, 0,
|
||||
GSS_C_QOP_DEFAULT, &gss_send_token,
|
||||
&gss_conf_state, &gss_w_token);
|
||||
NULL, &gss_w_token);
|
||||
|
||||
if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_wrap")) {
|
||||
curlx_safefree(gss_send_token.value);
|
||||
gss_send_token.length = 0;
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
failf(data, "Failed to wrap GSS-API encryption value into token.");
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
|
@ -406,7 +436,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(result || (nwritten != 4)) {
|
||||
failf(data, "Failed to send GSS-API encryption request.");
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -415,7 +445,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
result = Curl_conn_cf_send(cf->next, data, socksreq, 1, FALSE, &nwritten);
|
||||
if(result || (nwritten != 1)) {
|
||||
failf(data, "Failed to send GSS-API encryption type.");
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
}
|
||||
|
|
@ -425,7 +455,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(result || (gss_w_token.length != nwritten)) {
|
||||
failf(data, "Failed to send GSS-API encryption type.");
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
|
|
@ -434,7 +464,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
|
||||
if(result || (actualread != 4)) {
|
||||
failf(data, "Failed to receive GSS-API encryption response.");
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -442,14 +472,14 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(socksreq[1] == 255) { /* status / message type */
|
||||
failf(data, "User was rejected by the SOCKS5 server (%d %d).",
|
||||
socksreq[0], socksreq[1]);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
if(socksreq[1] != 2) { /* status / message type */
|
||||
failf(data, "Invalid GSS-API encryption response type (%d %d).",
|
||||
socksreq[0], socksreq[1]);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -458,14 +488,14 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
|
||||
if(!us_length) {
|
||||
failf(data, "Invalid zero-length GSS-API encryption token.");
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
gss_recv_token.length = us_length;
|
||||
gss_recv_token.value = curlx_malloc(gss_recv_token.length);
|
||||
if(!gss_recv_token.value) {
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_OUT_OF_MEMORY;
|
||||
}
|
||||
result = Curl_blockread_all(cf, data, (char *)gss_recv_token.value,
|
||||
|
|
@ -475,20 +505,20 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
failf(data, "Failed to receive GSS-API encryption type.");
|
||||
curlx_safefree(gss_recv_token.value);
|
||||
gss_recv_token.length = 0;
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
if(!data->set.socks5_gssapi_nec) {
|
||||
gss_major_status = gss_unwrap(&gss_minor_status, gss_context,
|
||||
gss_major_status = gss_unwrap(&gss_minor_status, *gss_context,
|
||||
&gss_recv_token, &gss_w_token,
|
||||
0, GSS_C_QOP_DEFAULT);
|
||||
NULL, NULL);
|
||||
|
||||
if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_unwrap")) {
|
||||
curlx_safefree(gss_recv_token.value);
|
||||
gss_recv_token.length = 0;
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
failf(data, "Failed to unwrap GSS-API encryption value into token.");
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
|
@ -499,7 +529,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
failf(data, "Invalid GSS-API encryption response length (%zu).",
|
||||
gss_w_token.length);
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -512,7 +542,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_recv_token.length);
|
||||
curlx_safefree(gss_recv_token.value);
|
||||
gss_recv_token.length = 0;
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -521,8 +551,6 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_recv_token.length = 0;
|
||||
}
|
||||
|
||||
(void)curlx_nonblock(sock, TRUE);
|
||||
|
||||
infof(data, "SOCKS5 access with%s protection granted.",
|
||||
(socksreq[0] == 0) ? "out GSS-API data" :
|
||||
((socksreq[0] == 1) ? " GSS-API integrity" :
|
||||
|
|
@ -530,11 +558,41 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
|
||||
conn->socks5_gssapi_enctype = socksreq[0];
|
||||
if(socksreq[0] == 0)
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
|
||||
|
||||
return CURLE_OK;
|
||||
}
|
||||
|
||||
CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
||||
struct Curl_easy *data)
|
||||
{
|
||||
struct connectdata *conn = cf->conn;
|
||||
curl_socket_t sock = conn->sock[cf->sockindex];
|
||||
CURLcode result;
|
||||
OM_uint32 gss_ret_flags = 0;
|
||||
gss_name_t server = GSS_C_NO_NAME;
|
||||
const char *serviceptr =
|
||||
data->set.str[STRING_PROXY_SERVICE_NAME] ?
|
||||
data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd";
|
||||
gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
|
||||
|
||||
result = socks5_gss_create_service_name(data, conn, serviceptr, &server);
|
||||
if(!result) {
|
||||
(void)curlx_nonblock(sock, FALSE);
|
||||
result = socks5_gss_auth_loop(cf, data, &server, &gss_context,
|
||||
&gss_ret_flags);
|
||||
}
|
||||
if(!result)
|
||||
result = socks5_gss_auth_verify(data, &gss_context);
|
||||
if(!result)
|
||||
result = socks5_gss_negotiate_enc(cf, data, &gss_context, gss_ret_flags);
|
||||
|
||||
/* unconditionally put it back to non-blocking */
|
||||
(void)curlx_nonblock(sock, TRUE);
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
|
||||
#pragma GCC diagnostic pop
|
||||
#endif
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue