negotiate_kerberos_auth_test.cc
Go to the documentation of this file.
1/*
2 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
3 *
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
7 */
8
9/*
10 * -----------------------------------------------------------------------------
11 *
12 * Author: Markus Moeller (markus_moeller at compuserve.com)
13 *
14 * Copyright (C) 2007 Markus Moeller. All rights reserved.
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 2 of the License, or
19 * (at your option) any later version.
20 *
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, write to the Free Software
28 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
29 *
30 * -----------------------------------------------------------------------------
31 */
32
33#include "squid.h"
34
35#if HAVE_GSSAPI
36#if USE_APPLE_KRB5
37#define GSSKRB_APPLE_DEPRECATED(x)
38#endif
39
40#include <cerrno>
41#include <cstring>
42#include <ctime>
43#if HAVE_NETDB_H
44#include <netdb.h>
45#endif
46#if HAVE_UNISTD_H
47#include <unistd.h>
48#endif
49
50#include "base64.h"
51#include "util.h"
52
53#if USE_HEIMDAL_KRB5
54#if HAVE_GSSAPI_GSSAPI_H
55#include <gssapi/gssapi.h>
56#elif HAVE_GSSAPI_H
57#include <gssapi.h>
58#endif
59#elif USE_GNUGSS
60#if HAVE_GSS_H
61#include <gss.h>
62#endif
63#else
64#if HAVE_GSSAPI_GSSAPI_H
65#include <gssapi/gssapi.h>
66#elif HAVE_GSSAPI_H
67#include <gssapi.h>
68#endif
69#if HAVE_GSSAPI_GSSAPI_KRB5_H
70#include <gssapi/gssapi_krb5.h>
71#endif
72#if HAVE_GSSAPI_GSSAPI_GENERIC_H
73#include <gssapi/gssapi_generic.h>
74#endif
75#if HAVE_GSSAPI_GSSAPI_EXT_H
76#include <gssapi/gssapi_ext.h>
77#endif
78#endif
79
80#ifndef gss_nt_service_name
81#define gss_nt_service_name GSS_C_NT_HOSTBASED_SERVICE
82#endif
83
84static const char *LogTime(void);
85
86int check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
87 const char *function);
88
89const char *squid_kerb_proxy_auth(char *proxy);
90
91#define PROGRAM "negotiate_kerberos_auth_test"
92
93static const char *
94LogTime()
95{
96 struct tm *tm;
97 struct timeval now;
98 static time_t last_t = 0;
99 static char buf[128];
100
101 gettimeofday(&now, nullptr);
102 if (now.tv_sec != last_t) {
103 tm = localtime((const time_t *) &now.tv_sec);
104 strftime(buf, 127, "%Y/%m/%d %H:%M:%S", tm);
105 last_t = now.tv_sec;
106 }
107 return buf;
108}
109
110#ifndef gss_mech_spnego
111static gss_OID_desc _gss_mech_spnego = {6, (void *) "\x2b\x06\x01\x05\x05\x02"};
112gss_OID gss_mech_spnego = &_gss_mech_spnego;
113#endif
114
115int
116check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
117 const char *function)
118{
119 if (GSS_ERROR(major_status)) {
120 OM_uint32 maj_stat, min_stat;
121 OM_uint32 msg_ctx = 0;
122 gss_buffer_desc status_string;
123 char buf[1024];
124 size_t len;
125
126 len = 0;
127 msg_ctx = 0;
128 do {
129 /* convert major status code (GSS-API error) to text */
130 maj_stat = gss_display_status(&min_stat, major_status,
131 GSS_C_GSS_CODE, GSS_C_NULL_OID, &msg_ctx, &status_string);
132 if (maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
133 if (sizeof(buf) > len + status_string.length + 1) {
134 snprintf(buf + len, (sizeof(buf) - len), "%s", (char *) status_string.value);
135 len += status_string.length;
136 }
137 } else
138 msg_ctx = 0;
139 gss_release_buffer(&min_stat, &status_string);
140 } while (msg_ctx);
141 if (sizeof(buf) > len + 2) {
142 snprintf(buf + len, (sizeof(buf) - len), "%s", ". ");
143 len += 2;
144 }
145 msg_ctx = 0;
146 do {
147 /* convert minor status code (underlying routine error) to text */
148 maj_stat = gss_display_status(&min_stat, minor_status,
149 GSS_C_MECH_CODE, GSS_C_NULL_OID, &msg_ctx, &status_string);
150 if (maj_stat == GSS_S_COMPLETE && status_string.length > 0) {
151 if (sizeof(buf) > len + status_string.length) {
152 snprintf(buf + len, (sizeof(buf) - len), "%s", (char *) status_string.value);
153 len += status_string.length;
154 }
155 } else
156 msg_ctx = 0;
157 gss_release_buffer(&min_stat, &status_string);
158 } while (msg_ctx);
159 fprintf(stderr, "%s| %s: %s failed: %s\n", LogTime(), PROGRAM, function,
160 buf);
161 return (1);
162 }
163 return (0);
164}
165
166const char *
167squid_kerb_proxy_auth(char *proxy)
168{
169 OM_uint32 major_status, minor_status;
170 gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
171 gss_name_t server_name = GSS_C_NO_NAME;
172 gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
173 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
174 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
175 char *token = nullptr;
176
177 setbuf(stdout, nullptr);
178 setbuf(stdin, nullptr);
179
180 if (!proxy) {
181 fprintf(stderr, "%s| %s: Error: No proxy server name\n", LogTime(),
182 PROGRAM);
183 return nullptr;
184 }
185 service.value = xmalloc(strlen("HTTP") + strlen(proxy) + 2);
186 snprintf((char *) service.value, strlen("HTTP") + strlen(proxy) + 2, "%s@%s", "HTTP", proxy);
187 service.length = strlen((char *) service.value);
188
189 major_status = gss_import_name(&minor_status, &service,
190 gss_nt_service_name, &server_name);
191
192 if (!check_gss_err(major_status, minor_status, "gss_import_name()")) {
193
194 major_status = gss_init_sec_context(&minor_status,
195 GSS_C_NO_CREDENTIAL, &gss_context, server_name,
196 gss_mech_spnego,
197 0,
198 0,
199 GSS_C_NO_CHANNEL_BINDINGS,
200 &input_token, nullptr, &output_token, nullptr, nullptr);
201
202 if (!check_gss_err(major_status, minor_status, "gss_init_sec_context()") && output_token.length) {
203 token = (char *) xcalloc(base64_encode_len(output_token.length), 1);
204 struct base64_encode_ctx ctx;
205 base64_encode_init(&ctx);
206 size_t blen = base64_encode_update(&ctx, token, output_token.length, reinterpret_cast<const uint8_t*>(output_token.value));
207 blen += base64_encode_final(&ctx, token+blen);
208 }
209 }
210
211 gss_delete_sec_context(&minor_status, &gss_context, nullptr);
212 gss_release_buffer(&minor_status, &service);
213 gss_release_buffer(&minor_status, &input_token);
214 gss_release_buffer(&minor_status, &output_token);
215 gss_release_name(&minor_status, &server_name);
216
217 return token;
218}
219
220int
221main(int argc, char *argv[])
222{
223 const char *Token;
224 int count;
225
226 if (argc < 2) {
227 fprintf(stderr, "%s| %s: Error: No proxy server name given\n",
228 LogTime(), PROGRAM);
229 return 99;
230 }
231 if (argc == 3) {
232 count = atoi(argv[2]);
233 while (count > 0) {
234 Token = (const char *) squid_kerb_proxy_auth(argv[1]);
235 fprintf(stdout, "YR %s\n", Token ? Token : "NULL");
236 --count;
237 }
238 fprintf(stdout, "QQ\n");
239 } else {
240 Token = (const char *) squid_kerb_proxy_auth(argv[1]);
241 fprintf(stdout, "Token: %s\n", Token ? Token : "NULL");
242 }
243
244 return EXIT_SUCCESS;
245}
246
247#else
248#include <cstdlib>
249int
250main(int argc, char *argv[])
251{
252 return -1;
253}
254
255#endif /* HAVE_GSSAPI */
256
#define PROGRAM
Definition: support.h:166
const char * LogTime(void)
void base64_encode_init(struct base64_encode_ctx *ctx)
Definition: base64.c:232
size_t base64_encode_update(struct base64_encode_ctx *ctx, char *dst, size_t length, const uint8_t *src)
Definition: base64.c:265
size_t base64_encode_final(struct base64_encode_ctx *ctx, char *dst)
Definition: base64.c:308
#define base64_encode_len(length)
Definition: base64.h:169
static time_t now
Definition: cachemgr.cc:109
#define gss_nt_service_name
int check_gss_err(OM_uint32 major_status, OM_uint32 minor_status, const char *function, int log, int sout)
int main(int argc, char *argv[])
#define xmalloc
void * xcalloc(size_t n, size_t sz)
Definition: xalloc.cc:71

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors