generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

socks_sspi.c: further cleanup

Browse Source
This commit is contained in:
Yang Tse 2012-06-12 12:34:52 +02:00
parent 38f05cea46
commit 1e8e6057ea
1 changed files with 64 additions and 74 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

138
lib/socks_sspi.c
View File

@ -76,7 +76,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
ssize_t written; ssize_t written;
int result; int result;
/* Needs GSSAPI authentication */ /* Needs GSSAPI authentication */
SECURITY_STATUS sspi_status; SECURITY_STATUS status;
unsigned long sspi_ret_flags = 0; unsigned long sspi_ret_flags = 0;
int gss_enc; int gss_enc;
SecBuffer sspi_send_token, sspi_recv_token, sspi_w_token[3]; SecBuffer sspi_send_token, sspi_recv_token, sspi_w_token[3];
@ -139,20 +139,19 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
cred_handle.dwLower = 0; cred_handle.dwLower = 0;
cred_handle.dwUpper = 0; cred_handle.dwUpper = 0;
sspi_status = s_pSecFn->AcquireCredentialsHandleA( NULL, status = s_pSecFn->AcquireCredentialsHandleA(NULL,
(char *)"Kerberos", (char *)"Kerberos",
SECPKG_CRED_OUTBOUND, SECPKG_CRED_OUTBOUND,
NULL, NULL,
NULL, NULL,
NULL, NULL,
NULL, NULL,
&cred_handle, &cred_handle,
&expiry); &expiry);
if(check_sspi_err(conn, sspi_status, "AcquireCredentialsHandleA")) { if(check_sspi_err(conn, status, "AcquireCredentialsHandleA")) {
failf(data, "Failed to acquire credentials."); failf(data, "Failed to acquire credentials.");
free(service_name); Curl_safefree(service_name);
service_name=NULL;
s_pSecFn->FreeCredentialsHandle(&cred_handle); s_pSecFn->FreeCredentialsHandle(&cred_handle);
return CURLE_COULDNT_CONNECT; return CURLE_COULDNT_CONNECT;
} }
@ -161,22 +160,21 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
/* errors, keep sending it... */ /* errors, keep sending it... */
for(;;) { for(;;) {
sspi_status = s_pSecFn->InitializeSecurityContextA( status = s_pSecFn->InitializeSecurityContextA(&cred_handle,
&cred_handle, context_handle,
context_handle, service_name,
service_name, ISC_REQ_MUTUAL_AUTH |
ISC_REQ_MUTUAL_AUTH | ISC_REQ_ALLOCATE_MEMORY |
ISC_REQ_ALLOCATE_MEMORY | ISC_REQ_CONFIDENTIALITY |
ISC_REQ_CONFIDENTIALITY | ISC_REQ_REPLAY_DETECT,
ISC_REQ_REPLAY_DETECT, 0,
0, SECURITY_NATIVE_DREP,
SECURITY_NATIVE_DREP, &input_desc,
&input_desc, 0,
0, &sspi_context,
&sspi_context, &output_desc,
&output_desc, &sspi_ret_flags,
&sspi_ret_flags, &expiry);
&expiry);
if(sspi_recv_token.pvBuffer) { if(sspi_recv_token.pvBuffer) {
s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer); s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
@ -184,9 +182,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
sspi_recv_token.cbBuffer = 0; sspi_recv_token.cbBuffer = 0;
} }
if(check_sspi_err(conn, sspi_status, "InitializeSecurityContextA")) { if(check_sspi_err(conn, status, "InitializeSecurityContextA")) {
free(service_name); Curl_safefree(service_name);
service_name=NULL;
s_pSecFn->FreeCredentialsHandle(&cred_handle); s_pSecFn->FreeCredentialsHandle(&cred_handle);
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer); s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
@ -203,8 +200,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
code = Curl_write_plain(conn, sock, (char *)socksreq, 4, &written); code = Curl_write_plain(conn, sock, (char *)socksreq, 4, &written);
if((code != CURLE_OK) || (4 != written)) { if((code != CURLE_OK) || (4 != written)) {
failf(data, "Failed to send SSPI authentication request."); failf(data, "Failed to send SSPI authentication request.");
free(service_name); Curl_safefree(service_name);
service_name=NULL;
s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer); s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer); s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
s_pSecFn->FreeCredentialsHandle(&cred_handle); s_pSecFn->FreeCredentialsHandle(&cred_handle);
@ -216,8 +212,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
sspi_send_token.cbBuffer, &written); sspi_send_token.cbBuffer, &written);
if((code != CURLE_OK) || (sspi_send_token.cbBuffer != (size_t)written)) { if((code != CURLE_OK) || (sspi_send_token.cbBuffer != (size_t)written)) {
failf(data, "Failed to send SSPI authentication token."); failf(data, "Failed to send SSPI authentication token.");
free(service_name); Curl_safefree(service_name);
service_name=NULL;
s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer); s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer); s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
s_pSecFn->FreeCredentialsHandle(&cred_handle); s_pSecFn->FreeCredentialsHandle(&cred_handle);
@ -233,7 +228,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer); s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
sspi_recv_token.pvBuffer = NULL; sspi_recv_token.pvBuffer = NULL;
sspi_recv_token.cbBuffer = 0; sspi_recv_token.cbBuffer = 0;
if(sspi_status != SEC_I_CONTINUE_NEEDED) break; if(status != SEC_I_CONTINUE_NEEDED)
break;
/* analyse response */ /* analyse response */
@ -245,11 +241,10 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
* +----+------+-----+----------------+ * +----+------+-----+----------------+
*/ */
result=Curl_blockread_all(conn, sock, (char *)socksreq, 4, &actualread); result = Curl_blockread_all(conn, sock, (char *)socksreq, 4, &actualread);
if(result != CURLE_OK || actualread != 4) { if(result != CURLE_OK || actualread != 4) {
failf(data, "Failed to receive SSPI authentication response."); failf(data, "Failed to receive SSPI authentication response.");
free(service_name); Curl_safefree(service_name);
service_name=NULL;
s_pSecFn->FreeCredentialsHandle(&cred_handle); s_pSecFn->FreeCredentialsHandle(&cred_handle);
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
return CURLE_COULDNT_CONNECT; return CURLE_COULDNT_CONNECT;
@ -259,8 +254,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
if(socksreq[1] == 255) { /* status / message type */ if(socksreq[1] == 255) { /* status / message type */
failf(data, "User was rejected by the SOCKS5 server (%d %d).", failf(data, "User was rejected by the SOCKS5 server (%d %d).",
socksreq[0], socksreq[1]); socksreq[0], socksreq[1]);
free(service_name); Curl_safefree(service_name);
service_name=NULL;
s_pSecFn->FreeCredentialsHandle(&cred_handle); s_pSecFn->FreeCredentialsHandle(&cred_handle);
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
return CURLE_COULDNT_CONNECT; return CURLE_COULDNT_CONNECT;
@ -269,8 +263,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
if(socksreq[1] != 1) { /* status / messgae type */ if(socksreq[1] != 1) { /* status / messgae type */
failf(data, "Invalid SSPI authentication response type (%d %d).", failf(data, "Invalid SSPI authentication response type (%d %d).",
socksreq[0], socksreq[1]); socksreq[0], socksreq[1]);
free(service_name); Curl_safefree(service_name);
service_name=NULL;
s_pSecFn->FreeCredentialsHandle(&cred_handle); s_pSecFn->FreeCredentialsHandle(&cred_handle);
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
return CURLE_COULDNT_CONNECT; return CURLE_COULDNT_CONNECT;
@ -283,8 +276,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
sspi_recv_token.pvBuffer = malloc(us_length); sspi_recv_token.pvBuffer = malloc(us_length);
if(!sspi_recv_token.pvBuffer) { if(!sspi_recv_token.pvBuffer) {
free(service_name); Curl_safefree(service_name);
service_name=NULL;
s_pSecFn->FreeCredentialsHandle(&cred_handle); s_pSecFn->FreeCredentialsHandle(&cred_handle);
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;
@ -294,8 +286,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
if(result != CURLE_OK || actualread != us_length) { if(result != CURLE_OK || actualread != us_length) {
failf(data, "Failed to receive SSPI authentication token."); failf(data, "Failed to receive SSPI authentication token.");
free(service_name); Curl_safefree(service_name);
service_name=NULL;
s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer); s_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
s_pSecFn->FreeCredentialsHandle(&cred_handle); s_pSecFn->FreeCredentialsHandle(&cred_handle);
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
@ -305,15 +296,14 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
context_handle = &sspi_context; context_handle = &sspi_context;
} }
free(service_name); Curl_safefree(service_name);
service_name=NULL;
/* Everything is good so far, user was authenticated! */ /* Everything is good so far, user was authenticated! */
sspi_status = s_pSecFn->QueryCredentialsAttributes( &cred_handle, status = s_pSecFn->QueryCredentialsAttributes(&cred_handle,
SECPKG_CRED_ATTR_NAMES, SECPKG_CRED_ATTR_NAMES,
&names); &names);
s_pSecFn->FreeCredentialsHandle(&cred_handle); s_pSecFn->FreeCredentialsHandle(&cred_handle);
if(check_sspi_err(conn, sspi_status, "QueryCredentialAttributes")) { if(check_sspi_err(conn, status, "QueryCredentialAttributes")) {
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
s_pSecFn->FreeContextBuffer(names.sUserName); s_pSecFn->FreeContextBuffer(names.sUserName);
failf(data, "Failed to determine user name."); failf(data, "Failed to determine user name.");
@ -375,10 +365,10 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
memcpy(socksreq+2, &us_length, sizeof(short)); memcpy(socksreq+2, &us_length, sizeof(short));
} }
else { else {
sspi_status = s_pSecFn->QueryContextAttributesA( &sspi_context, status = s_pSecFn->QueryContextAttributesA(&sspi_context,
SECPKG_ATTR_SIZES, SECPKG_ATTR_SIZES,
&sspi_sizes); &sspi_sizes);
if(check_sspi_err(conn, sspi_status, "QueryContextAttributesA")) { if(check_sspi_err(conn, status, "QueryContextAttributesA")) {
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
failf(data, "Failed to query security context attributes."); failf(data, "Failed to query security context attributes.");
return CURLE_COULDNT_CONNECT; return CURLE_COULDNT_CONNECT;
@ -411,11 +401,11 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;
} }
sspi_status = s_pSecFn->EncryptMessage( &sspi_context, status = s_pSecFn->EncryptMessage(&sspi_context,
KERB_WRAP_NO_ENCRYPT, KERB_WRAP_NO_ENCRYPT,
&wrap_desc, &wrap_desc,
0); 0);
if(check_sspi_err(conn, sspi_status, "EncryptMessage")) { if(check_sspi_err(conn, status, "EncryptMessage")) {
s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer); s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer); s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
s_pSecFn->FreeContextBuffer(sspi_w_token[2].pvBuffer); s_pSecFn->FreeContextBuffer(sspi_w_token[2].pvBuffer);
@ -487,7 +477,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer); s_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
} }
result=Curl_blockread_all(conn, sock, (char *)socksreq, 4, &actualread); result = Curl_blockread_all(conn, sock, (char *)socksreq, 4, &actualread);
if(result != CURLE_OK || actualread != 4) { if(result != CURLE_OK || actualread != 4) {
failf(data, "Failed to receive SSPI encryption response."); failf(data, "Failed to receive SSPI encryption response.");
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
@ -519,8 +509,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;
} }
result=Curl_blockread_all(conn, sock, (char *)sspi_w_token[0].pvBuffer, result = Curl_blockread_all(conn, sock, (char *)sspi_w_token[0].pvBuffer,
sspi_w_token[0].cbBuffer, &actualread); sspi_w_token[0].cbBuffer, &actualread);
if(result != CURLE_OK || actualread != us_length) { if(result != CURLE_OK || actualread != us_length) {
failf(data, "Failed to receive SSPI encryption type."); failf(data, "Failed to receive SSPI encryption type.");
@ -537,12 +527,12 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
sspi_w_token[1].cbBuffer = 0; sspi_w_token[1].cbBuffer = 0;
sspi_w_token[1].pvBuffer = NULL; sspi_w_token[1].pvBuffer = NULL;
sspi_status = s_pSecFn->DecryptMessage( &sspi_context, status = s_pSecFn->DecryptMessage(&sspi_context,
&wrap_desc, &wrap_desc,
0, 0,
&qop); &qop);
if(check_sspi_err(conn, sspi_status, "DecryptMessage")) { if(check_sspi_err(conn, status, "DecryptMessage")) {
s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer); s_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer); s_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
@ -582,10 +572,10 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
/* For later use if encryption is required /* For later use if encryption is required
conn->socks5_gssapi_enctype = socksreq[0]; conn->socks5_gssapi_enctype = socksreq[0];
if(socksreq[0] != 0) if(socksreq[0] != 0)
conn->socks5_sspi_context = sspi_context; conn->socks5_sspi_context = sspi_context;
else { else {
s_pSecFn->DeleteSecurityContext(&sspi_context); s_pSecFn->DeleteSecurityContext(&sspi_context);
conn->socks5_sspi_context = sspi_context; conn->socks5_sspi_context = sspi_context;
} }
*/ */
return CURLE_OK; return CURLE_OK;