negotiate_kerberos_auth_test.cc
Go to the documentation of this file.
1 /*
2  * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
3  *
4  * Squid software is distributed under GPLv2+ license and includes
5  * contributions from numerous individuals and organizations.
6  * Please see the COPYING and CONTRIBUTORS files for details.
7  */
8 
9 /*
10  * -----------------------------------------------------------------------------
11  *
12  * Author: Markus Moeller (markus_moeller at compuserve.com)
13  *
14  * Copyright (C) 2007 Markus Moeller. All rights reserved.
15  *
16  * This program is free software; you can redistribute it and/or modify
17  * it under the terms of the GNU General Public License as published by
18  * the Free Software Foundation; either version 2 of the License, or
19  * (at your option) any later version.
20  *
21  * This program is distributed in the hope that it will be useful,
22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24  * GNU General Public License for more details.
25  *
26  * You should have received a copy of the GNU General Public License
27  * along with this program; if not, write to the Free Software
28  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
29  *
30  * -----------------------------------------------------------------------------
31  */
32 
33 #include "squid.h"
34 
35 #if HAVE_GSSAPI
36 #if USE_APPLE_KRB5
37 #define GSSKRB_APPLE_DEPRECATED(x)
38 #endif
39 
40 #include <cerrno>
41 #include <cstring>
42 #include <ctime>
43 #if HAVE_NETDB_H
44 #include <netdb.h>
45 #endif
46 #if HAVE_UNISTD_H
47 #include <unistd.h>
48 #endif
49 
50 #include "base64.h"
51 #include "util.h"
52 
53 #if USE_HEIMDAL_KRB5
54 #if HAVE_GSSAPI_GSSAPI_H
55 #include <gssapi/gssapi.h>
56 #elif HAVE_GSSAPI_H
57 #include <gssapi.h>
58 #endif
59 #elif USE_GNUGSS
60 #if HAVE_GSS_H
61 #include <gss.h>
62 #endif
63 #else
64 #if HAVE_GSSAPI_GSSAPI_H
65 #include <gssapi/gssapi.h>
66 #elif HAVE_GSSAPI_H
67 #include <gssapi.h>
68 #endif
69 #if HAVE_GSSAPI_GSSAPI_KRB5_H
70 #include <gssapi/gssapi_krb5.h>
71 #endif
72 #if HAVE_GSSAPI_GSSAPI_GENERIC_H
73 #include <gssapi/gssapi_generic.h>
74 #endif
75 #if HAVE_GSSAPI_GSSAPI_EXT_H
76 #include <gssapi/gssapi_ext.h>
77 #endif
78 #endif
79 
80 #ifndef gss_nt_service_name
81 #define gss_nt_service_name GSS_C_NT_HOSTBASED_SERVICE
82 #endif
83 
84 static const char *LogTime(void);
85 
86 int check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
87  const char *function);
88 
89 const char *squid_kerb_proxy_auth(char *proxy);
90 
91 #define PROGRAM "negotiate_kerberos_auth_test"
92 
93 static const char *
94 LogTime()
95 {
96  struct tm *tm;
97  struct timeval now;
98  static time_t last_t = 0;
99  static char buf[128];
100 
101  gettimeofday(&now, NULL);
102  if (now.tv_sec != last_t) {
103  tm = localtime((const time_t *) &now.tv_sec);
104  strftime(buf, 127, "%Y/%m/%d %H:%M:%S", tm);
105  last_t = now.tv_sec;
106  }
107  return buf;
108 }
109 
110 #ifndef gss_mech_spnego
111 static gss_OID_desc _gss_mech_spnego = {6, (void *) "\x2b\x06\x01\x05\x05\x02"};
112 gss_OID gss_mech_spnego = &_gss_mech_spnego;
113 #endif
114 
115 int
116 check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
117  const char *function)
118 {
119  if (GSS_ERROR(major_status)) {
120  OM_uint32 maj_stat, min_stat;
121  OM_uint32 msg_ctx = 0;
122  gss_buffer_desc status_string;
123  char buf[1024];
124  size_t len;
125 
126  len = 0;
127  msg_ctx = 0;
128  do {
129  /* convert major status code (GSS-API error) to text */
130  maj_stat = gss_display_status(&min_stat, major_status,
131  GSS_C_GSS_CODE, GSS_C_NULL_OID, &msg_ctx, &status_string);
132  if (maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
133  if (sizeof(buf) > len + status_string.length + 1) {
134  snprintf(buf + len, (sizeof(buf) - len), "%s", (char *) status_string.value);
135  len += status_string.length;
136  }
137  } else
138  msg_ctx = 0;
139  gss_release_buffer(&min_stat, &status_string);
140  } while (msg_ctx);
141  if (sizeof(buf) > len + 2) {
142  snprintf(buf + len, (sizeof(buf) - len), "%s", ". ");
143  len += 2;
144  }
145  msg_ctx = 0;
146  do {
147  /* convert minor status code (underlying routine error) to text */
148  maj_stat = gss_display_status(&min_stat, minor_status,
149  GSS_C_MECH_CODE, GSS_C_NULL_OID, &msg_ctx, &status_string);
150  if (maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
151  if (sizeof(buf) > len + status_string.length) {
152  snprintf(buf + len, (sizeof(buf) - len), "%s", (char *) status_string.value);
153  len += status_string.length;
154  }
155  } else
156  msg_ctx = 0;
157  gss_release_buffer(&min_stat, &status_string);
158  } while (msg_ctx);
159  fprintf(stderr, "%s| %s: %s failed: %s\n", LogTime(), PROGRAM, function,
160  buf);
161  return (1);
162  }
163  return (0);
164 }
165 
166 const char *
167 squid_kerb_proxy_auth(char *proxy)
168 {
169  OM_uint32 major_status, minor_status;
170  gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
171  gss_name_t server_name = GSS_C_NO_NAME;
172  gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
173  gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
174  gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
175  char *token = NULL;
176 
177  setbuf(stdout, NULL);
178  setbuf(stdin, NULL);
179 
180  if (!proxy) {
181  fprintf(stderr, "%s| %s: Error: No proxy server name\n", LogTime(),
182  PROGRAM);
183  return NULL;
184  }
185  service.value = xmalloc(strlen("HTTP") + strlen(proxy) + 2);
186  snprintf((char *) service.value, strlen("HTTP") + strlen(proxy) + 2, "%s@%s", "HTTP", proxy);
187  service.length = strlen((char *) service.value);
188 
189  major_status = gss_import_name(&minor_status, &service,
190  gss_nt_service_name, &server_name);
191 
192  if (!check_gss_err(major_status, minor_status, "gss_import_name()")) {
193 
194  major_status = gss_init_sec_context(&minor_status,
195  GSS_C_NO_CREDENTIAL, &gss_context, server_name,
196  gss_mech_spnego,
197  0,
198  0,
199  GSS_C_NO_CHANNEL_BINDINGS,
200  &input_token, NULL, &output_token, NULL, NULL);
201 
202  if (!check_gss_err(major_status, minor_status, "gss_init_sec_context()") && output_token.length) {
203  token = (char *) xcalloc(base64_encode_len(output_token.length), 1);
204  struct base64_encode_ctx ctx;
205  base64_encode_init(&ctx);
206  size_t blen = base64_encode_update(&ctx, reinterpret_cast<uint8_t*>(token), output_token.length, reinterpret_cast<const uint8_t*>(output_token.value));
207  blen += base64_encode_final(&ctx, reinterpret_cast<uint8_t*>(token)+blen);
208  }
209  }
210 
211  gss_delete_sec_context(&minor_status, &gss_context, NULL);
212  gss_release_buffer(&minor_status, &service);
213  gss_release_buffer(&minor_status, &input_token);
214  gss_release_buffer(&minor_status, &output_token);
215  gss_release_name(&minor_status, &server_name);
216 
217  return token;
218 }
219 
220 int
221 main(int argc, char *argv[])
222 {
223  const char *Token;
224  int count;
225 
226  if (argc < 2) {
227  fprintf(stderr, "%s| %s: Error: No proxy server name given\n",
228  LogTime(), PROGRAM);
229  return 99;
230  }
231  if (argc == 3) {
232  count = atoi(argv[2]);
233  while (count > 0) {
234  Token = (const char *) squid_kerb_proxy_auth(argv[1]);
235  fprintf(stdout, "YR %s\n", Token ? Token : "NULL");
236  --count;
237  }
238  fprintf(stdout, "QQ\n");
239  } else {
240  Token = (const char *) squid_kerb_proxy_auth(argv[1]);
241  fprintf(stdout, "Token: %s\n", Token ? Token : "NULL");
242  }
243 
244  return EXIT_SUCCESS;
245 }
246 
247 #else
248 #include <cstdlib>
249 int
250 main(int argc, char *argv[])
251 {
252  return -1;
253 }
254 
255 #endif /* HAVE_GSSAPI */
256 
const char * LogTime(void)
#define xcalloc
Definition: membanger.c:57
int main(int argc, char *argv[])
#define gss_nt_service_name
size_t base64_encode_final(struct base64_encode_ctx *ctx, uint8_t *dst)
DST should point to an area of size at least BASE64_ENCODE_FINAL_LENGTH.
Definition: base64.c:253
void base64_encode_init(struct base64_encode_ctx *ctx)
Definition: base64.c:182
int unsigned int const char *desc STUB void int len
Definition: stub_fd.cc:20
void const char * buf
Definition: stub_helper.cc:16
#define xmalloc
#define PROGRAM
Definition: support.h:188
int check_gss_err(OM_uint32 major_status, OM_uint32 minor_status, const char *function, int log, int sout)
size_t base64_encode_update(struct base64_encode_ctx *ctx, uint8_t *dst, size_t length, const uint8_t *src)
Definition: base64.c:213
static hrtime_t now
Definition: ProfStats.cc:256
#define NULL
Definition: types.h:166
#define base64_encode_len(length)
Definition: base64.h:93

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors