diff -rubwBEN curl-7.19.2/docs/curl.1 curl-7.19.2-socks-gssapi/docs/curl.1 --- curl-7.19.2/docs/curl.1 2008-10-29 21:15:24.000000000 +0000 +++ curl-7.19.2-socks-gssapi/docs/curl.1 2009-01-13 23:05:40.000000000 +0000 @@ -1107,6 +1107,20 @@ If this option is used several times, the last one will be used. (This option was previously wrongly documented and used as --socks without the number appended.) +.IP "--socks5-gssapi-service " +The default service name for a socks server is rcmd/server-fqdn. This +option allows you to change it. + +Examples: + --socks5 proxy-name \fI--socks5-gssapi-service\fP sockd would use +sockd/proxy-name + --socks5 proxy-name \fI--socks5-gssapi-service\fP sockd/real-name would use +sockd/real-name for cases the proxy-name does not match the princpal name. +.IP "--socks5-gssapi-nec" +As part of the gssapi negotiation a protection mode is negotiated. The +rfc1961 says in section 4.3/4.4 it should be protected, but the NEC +reference implementation does not. The option \fI--socks5-gssapi-nec\fP allows the +unprotected exchange of the protection mode negotiation .IP "--stderr " Redirect all writes to stderr to the specified file instead. If the file name is a plain '-', it is instead written to stdout. This option has no point when diff -rubwBEN curl-7.19.2/include/curl/curl.h curl-7.19.2-socks-gssapi/include/curl/curl.h --- curl-7.19.2/include/curl/curl.h 2008-10-17 06:58:26.000000000 +0100 +++ curl-7.19.2-socks-gssapi/include/curl/curl.h 2009-01-11 12:01:09.000000000 +0000 @@ -1149,6 +1149,12 @@ CINIT(PROXYUSERNAME, OBJECTPOINT, 175), CINIT(PROXYPASSWORD, OBJECTPOINT, 176), + /* Socks Service */ + CINIT(SOCKS5_GSSAPI_SERVICE, LONG, 177), + + /* Socks Service */ + CINIT(SOCKS5_GSSAPI_NEC, LONG, 178), + CURLOPT_LASTENTRY /* the last unused */ } CURLoption; diff -rubwBEN curl-7.19.2/lib/Makefile.inc curl-7.19.2-socks-gssapi/lib/Makefile.inc --- curl-7.19.2/lib/Makefile.inc 2008-10-30 19:06:12.000000000 +0000 +++ curl-7.19.2-socks-gssapi/lib/Makefile.inc 2009-01-11 12:02:47.000000000 +0000 @@ -9,7 +9,8 @@ http_negotiate.c http_ntlm.c inet_pton.c strtoofft.c strerror.c \ hostares.c hostasyn.c hostip4.c hostip6.c hostsyn.c hostthre.c \ inet_ntop.c parsedate.c select.c gtls.c sslgen.c tftp.c splay.c \ - strdup.c socks.c ssh.c nss.c qssl.c rawstr.c curl_addrinfo.c + strdup.c socks.c ssh.c nss.c qssl.c rawstr.c curl_addrinfo.c \ + socks_gssapi.c HHEADERS = arpa_telnet.h netrc.h file.h timeval.h qssl.h hostip.h \ progress.h formdata.h cookie.h http.h sendf.h ftp.h url.h dict.h \ diff -rubwBEN curl-7.19.2/lib/Makefile.vc6 curl-7.19.2-socks-gssapi/lib/Makefile.vc6 --- curl-7.19.2/lib/Makefile.vc6 2008-11-06 21:30:18.000000000 +0000 +++ curl-7.19.2-socks-gssapi/lib/Makefile.vc6 2009-01-11 12:04:09.000000000 +0000 @@ -469,6 +469,7 @@ $(DIROBJ)\sendf.obj \ $(DIROBJ)\share.obj \ $(DIROBJ)\socks.obj \ + $(DIROBJ)\socks_sspi.obj \ $(DIROBJ)\speedcheck.obj \ $(DIROBJ)\splay.obj \ $(DIROBJ)\sslgen.obj \ diff -rubwBEN curl-7.19.2/lib/Makefile.vc8 curl-7.19.2-socks-gssapi/lib/Makefile.vc8 --- curl-7.19.2/lib/Makefile.vc8 2008-11-13 13:03:27.000000000 +0000 +++ curl-7.19.2-socks-gssapi/lib/Makefile.vc8 2009-01-11 12:04:14.000000000 +0000 @@ -469,6 +469,7 @@ $(DIROBJ)\sendf.obj \ $(DIROBJ)\share.obj \ $(DIROBJ)\socks.obj \ + $(DIROBJ)\socks_sspi.obj \ $(DIROBJ)\speedcheck.obj \ $(DIROBJ)\splay.obj \ $(DIROBJ)\sslgen.obj \ diff -rubwBEN curl-7.19.2/lib/socks.c curl-7.19.2-socks-gssapi/lib/socks.c --- curl-7.19.2/lib/socks.c 2008-09-29 22:46:04.000000000 +0100 +++ curl-7.19.2-socks-gssapi/lib/socks.c 2009-01-13 22:46:37.000000000 +0000 @@ -60,7 +60,7 @@ * This is STUPID BLOCKING behaviour which we frown upon, but right now this * is what we have... */ -static int blockread_all(struct connectdata *conn, /* connection data */ +int Curl_blockread_all(struct connectdata *conn, /* connection data */ curl_socket_t sockfd, /* read from this socket */ char *buf, /* store read data here */ ssize_t buffersize, /* max amount to read */ @@ -264,7 +264,7 @@ packetsize = 8; /* receive data size */ /* Receive response */ - result = blockread_all(conn, sock, (char *)socksreq, packetsize, + result = Curl_blockread_all(conn, sock, (char *)socksreq, packetsize, &actualread, timeout); if((result != CURLE_OK) || (actualread != packetsize)) { failf(data, "Failed to receive SOCKS4 connect request ack."); @@ -379,8 +379,13 @@ o REP Reply field: o X'00' succeeded */ - - unsigned char socksreq[600]; /* room for large user/pw (255 max each) */ +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) +/* Max gssapi token length + header */ +#define SOCKS5REQLEN (1024*64-1)+4 +#else +#define SOCKS5REQLEN 600 +#endif + unsigned char socksreq[SOCKS5REQLEN]; /* room for large user/pw (255 max each) */ ssize_t actualread; ssize_t written; int result; @@ -429,9 +434,16 @@ } socksreq[0] = 5; /* version */ +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + socksreq[1] = (char)(proxy_name ? 3 : 2); /* number of methods (below) */ + socksreq[2] = 0; /* no authentication */ + socksreq[3] = 1; /* gssapi */ + socksreq[4] = 2; /* username/password */ +#else socksreq[1] = (char)(proxy_name ? 2 : 1); /* number of methods (below) */ socksreq[2] = 0; /* no authentication */ socksreq[3] = 2; /* username/password */ +#endif Curl_nonblock(sock, FALSE); @@ -462,7 +474,8 @@ Curl_nonblock(sock, FALSE); - result=blockread_all(conn, sock, (char *)socksreq, 2, &actualread, timeout); + result=Curl_blockread_all(conn, sock, (char *)socksreq, 2, &actualread, + timeout); if((result != CURLE_OK) || (actualread != 2)) { failf(data, "Unable to receive initial SOCKS5 response."); return CURLE_COULDNT_CONNECT; @@ -476,6 +489,21 @@ /* Nothing to do, no authentication needed */ ; } +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + else if(socksreq[1] == 1) { +#ifdef HAVE_GSSAPI + code = Curl_SOCKS5_gssapi_negotiate((unsigned char *)&socksreq, sockindex, + conn); +#elif defined(USE_WINDOWS_SSPI) + code = Curl_SOCKS5_sspi_negotiate((unsigned char *)&socksreq, sockindex, + conn); +#endif + if(code != CURLE_OK) { + failf(data, "Unable to negotiate SOCKS5 gssapi context."); + return CURLE_COULDNT_CONNECT; + } + } +#endif else if(socksreq[1] == 2) { /* Needs user name and password */ size_t userlen, pwlen; @@ -511,7 +539,7 @@ return CURLE_COULDNT_CONNECT; } - result=blockread_all(conn, sock, (char *)socksreq, 2, &actualread, + result=Curl_blockread_all(conn, sock, (char *)socksreq, 2, &actualread, timeout); if((result != CURLE_OK) || (actualread != 2)) { failf(data, "Unable to receive SOCKS5 sub-negotiation response."); @@ -529,12 +557,16 @@ } else { /* error */ +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + if(socksreq[1] == 255) { +#else if(socksreq[1] == 1) { failf(data, "SOCKS5 GSSAPI per-message authentication is not supported."); return CURLE_COULDNT_CONNECT; } else if(socksreq[1] == 255) { +#endif if(!proxy_name || !*proxy_name) { failf(data, "No authentication method was acceptable. (It is quite likely" @@ -616,6 +648,15 @@ *((unsigned short*)&socksreq[8]) = htons((unsigned short)remote_port); } +#ifdef HAVE_GSSAPI + if(conn->socks5_gssapi_enctype) { + failf(data, "SOCKS5 gssapi protection not yet implemented."); + } else +#elif defined(USE_WINDOWS_SSPI) + if(conn->socks5_sspi_enctype) { + failf(data, "SOCKS5 gssapi protection not yet implemented."); + } else +#endif code = Curl_write_plain(conn, sock, (char *)socksreq, packetsize, &written); if((code != CURLE_OK) || (written != packetsize)) { failf(data, "Failed to send SOCKS5 connect request."); @@ -624,7 +665,16 @@ packetsize = 10; /* minimum packet size is 10 */ - result = blockread_all(conn, sock, (char *)socksreq, packetsize, +#ifdef HAVE_GSSAPI + if(conn->socks5_gssapi_enctype) { + failf(data, "SOCKS5 gssapi protection not yet implemented."); + } else +#elif defined(USE_WINDOWS_SSPI) + if(conn->socks5_sspi_enctype) { + failf(data, "SOCKS5 gssapi protection not yet implemented."); + } else +#endif + result = Curl_blockread_all(conn, sock, (char *)socksreq, packetsize, &actualread, timeout); if((result != CURLE_OK) || (actualread != packetsize)) { failf(data, "Failed to receive SOCKS5 connect request ack."); @@ -674,15 +724,25 @@ } /* At this point we already read first 10 bytes */ +#ifdef HAVE_GSSAPI + if(!conn->socks5_gssapi_enctype) { + /* decrypt_gssapi_blockread read already the whole packet */ +#elif defined(USE_WINDOWS_SSPI) + if(!conn->socks5_sspi_enctype) { + /* decrypt_sspi_blockread read already the whole packet */ +#endif if(packetsize > 10) { packetsize -= 10; - result = blockread_all(conn, sock, (char *)&socksreq[10], packetsize, + result = Curl_blockread_all(conn, sock, (char *)&socksreq[10], packetsize, &actualread, timeout); if((result != CURLE_OK) || (actualread != packetsize)) { failf(data, "Failed to receive SOCKS5 connect request ack."); return CURLE_COULDNT_CONNECT; } } +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + } +#endif Curl_nonblock(sock, TRUE); return CURLE_OK; /* Proxy was successful! */ diff -rubwBEN curl-7.19.2/lib/socks_gssapi.c curl-7.19.2-socks-gssapi/lib/socks_gssapi.c --- curl-7.19.2/lib/socks_gssapi.c 1970-01-01 01:00:00.000000000 +0100 +++ curl-7.19.2-socks-gssapi/lib/socks_gssapi.c 2009-01-13 23:02:01.000000000 +0000 @@ -0,0 +1,501 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) 2009, Markus Moeller, + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at http://curl.haxx.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * $Id: socks.c,v 1.25 2008-06-20 10:43:32 bagder Exp $ + ***************************************************************************/ + +#include "setup.h" + +#ifdef HAVE_GSSAPI +#ifndef gss_nt_service_name +#define gss_nt_service_name GSS_C_NT_HOSTBASED_SERVICE +#endif +#include + +#ifdef NEED_MALLOC_H +#include +#endif +#ifdef HAVE_STDLIB_H +#include +#endif + +#include "urldata.h" +#include "sendf.h" +#include "connect.h" +#include "timeval.h" +#include "socks.h" + +static gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT; + +/* The last #include file should be: */ +#include "memdebug.h" + +/* + * Helper gssapi error functions. + */ +static int check_gss_err(struct SessionHandle *data, + OM_uint32 major_status, + OM_uint32 minor_status, + const char* function) +{ + if(GSS_ERROR(major_status)) { + OM_uint32 maj_stat,min_stat; + OM_uint32 msg_ctx = 0; + gss_buffer_desc status_string; + char buf[1024]; + size_t len; + + len = 0; + msg_ctx = 0; + while(!msg_ctx) { + /* convert major status code (GSS-API error) to text */ + maj_stat = gss_display_status(&min_stat, major_status, + GSS_C_GSS_CODE, + GSS_C_NULL_OID, + &msg_ctx, &status_string); + if(maj_stat == GSS_S_COMPLETE) { + if(sizeof(buf) > len + status_string.length + 1) { + sprintf(buf+len, "%s", (char*) status_string.value); + len += status_string.length; + } + gss_release_buffer(&min_stat, &status_string); + break; + } + gss_release_buffer(&min_stat, &status_string); + } + if(sizeof(buf) > len + 2) { + sprintf(buf+len, "%s", ".\n"); + len += 2; + } + msg_ctx = 0; + while(!msg_ctx) { + /* convert minor status code (underlying routine error) to text */ + maj_stat = gss_display_status(&min_stat, minor_status, + GSS_C_MECH_CODE, + GSS_C_NULL_OID, + &msg_ctx, &status_string); + if(maj_stat == GSS_S_COMPLETE) { + if(sizeof(buf) > len + status_string.length) { + sprintf(buf+len, "%s", (char*) status_string.value); + len += status_string.length; + } + gss_release_buffer(&min_stat, &status_string); + break; + } + gss_release_buffer(&min_stat, &status_string); + } + failf(data, "GSSAPI error: %s failed:\n%s\n", function, buf); + return(1); + } + + return(0); +} + +CURLcode Curl_SOCKS5_gssapi_negotiate(unsigned char *socksreq, + int sockindex, + struct connectdata *conn) +{ + struct SessionHandle *data = conn->data; + curl_socket_t sock = conn->sock[sockindex]; + CURLcode code; + ssize_t actualread; + ssize_t written; + int result; + long timeout; + OM_uint32 gss_major_status, gss_minor_status, gss_status; + OM_uint32 gss_ret_flags; + int gss_conf_state, gss_enc; + gss_buffer_desc service = GSS_C_EMPTY_BUFFER; + gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER; + gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER; + gss_buffer_desc gss_w_token = GSS_C_EMPTY_BUFFER; + gss_buffer_desc* gss_token = GSS_C_NO_BUFFER; + gss_name_t server = GSS_C_NO_NAME; + gss_name_t gss_client_name = GSS_C_NO_NAME; + u_short us_length; + char *user=NULL; + + /* get timeout */ + timeout = Curl_timeleft(conn, NULL, TRUE); + + /* GSSAPI request looks like + * +----+------+-----+----------------+ + * |VER | MTYP | LEN | TOKEN | + * +----+------+----------------------+ + * | 1 | 1 | 2 | up to 2^16 - 1 | + * +----+------+-----+----------------+ + */ + + /* prepare service name */ + if (strchr(data->set.str[STRING_SOCKS5_GSSAPI_SERVICE],'/')) { + service.value = malloc(strlen(data->set.str[STRING_SOCKS5_GSSAPI_SERVICE])); + service.length = strlen(data->set.str[STRING_SOCKS5_GSSAPI_SERVICE]); + memcpy(service.value,data->set.str[STRING_SOCKS5_GSSAPI_SERVICE], + service.length); + + gss_major_status = gss_import_name(&gss_minor_status, &service, + (gss_OID) GSS_C_NULL_OID, &server); + } else { + service.value = malloc(strlen(data->set.str[STRING_SOCKS5_GSSAPI_SERVICE]) + +strlen(conn->proxy.name)+2); + service.length = strlen(data->set.str[STRING_SOCKS5_GSSAPI_SERVICE]) + +strlen(conn->proxy.name)+1; + snprintf(service.value,service.length+1,"%s@%s", + data->set.str[STRING_SOCKS5_GSSAPI_SERVICE],conn->proxy.name); + + gss_major_status = gss_import_name(&gss_minor_status, &service, + gss_nt_service_name, &server); + } + + if(check_gss_err(data,gss_major_status, + gss_minor_status,"gss_import_name()")) { + failf(data, "Failed to create service name."); + gss_release_buffer(&gss_status, &service); + gss_release_name(&gss_status, &server); + return CURLE_COULDNT_CONNECT; + } + gss_release_buffer(&gss_status, &service); + + /* As long as we need to keep sending some context info, and there's no */ + /* errors, keep sending it... */ + for(;;) { + gss_major_status = gss_init_sec_context(&gss_minor_status, + GSS_C_NO_CREDENTIAL, + &gss_context, server, + GSS_C_NULL_OID, + GSS_C_MUTUAL_FLAG | + GSS_C_REPLAY_FLAG, + 0, + NULL, + gss_token, + NULL, + &gss_send_token, + &gss_ret_flags, + NULL); + + if(gss_token != GSS_C_NO_BUFFER) + gss_release_buffer(&gss_status, &gss_recv_token); + if(check_gss_err(data,gss_major_status, + gss_minor_status,"gss_init_sec_context")) { + gss_release_name(&gss_status, &server); + gss_release_buffer(&gss_status, &gss_send_token); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + failf(data, "Failed to initial GSSAPI token."); + return CURLE_COULDNT_CONNECT; + } + + if(gss_send_token.length != 0) { + socksreq[0] = 1; /* gssapi subnegotiation version */ + socksreq[1] = 1; /* authentication message type */ + us_length = htons((short)gss_send_token.length); + memcpy(socksreq+2,&us_length,sizeof(short)); + + code = Curl_write_plain(conn, sock, (char *)socksreq, 4, &written); + if((code != CURLE_OK) || (4 != written)) { + failf(data, "Failed to send GSSAPI authentication request."); + gss_release_name(&gss_status, &server); + gss_release_buffer(&gss_status, &gss_send_token); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + + memcpy(socksreq, gss_send_token.value, (int) gss_send_token.length); + + code = Curl_write_plain(conn, sock, (char *)socksreq, + gss_send_token.length, &written); + if((code != CURLE_OK) || (gss_send_token.length != written)) { + failf(data, "Failed to send GSSAPI authentication token."); + gss_release_name(&gss_status, &server); + gss_release_buffer(&gss_status, &gss_send_token); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + + } + + gss_release_buffer(&gss_status, &gss_send_token); + if(gss_major_status != GSS_S_CONTINUE_NEEDED) break; + + /* analyse response */ + + /* GSSAPI response looks like + * +----+------+-----+----------------+ + * |VER | MTYP | LEN | TOKEN | + * +----+------+----------------------+ + * | 1 | 1 | 2 | up to 2^16 - 1 | + * +----+------+-----+----------------+ + */ + + result=Curl_blockread_all(conn, sock, (char *)socksreq, 4, + &actualread, timeout); + if(result != CURLE_OK || actualread != 4) { + failf(data, "Failed to receive GSSAPI authentication response."); + gss_release_name(&gss_status, &server); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + + /* ignore the first (VER) byte */ + if(socksreq[1] == 255) { /* status / message type */ + failf(data, "User was rejected by the SOCKS5 server (%d %d).", + socksreq[0], socksreq[1]); + gss_release_name(&gss_status, &server); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + + if(socksreq[1] != 1) { /* status / messgae type */ + failf(data, "Invalid GSSAPI authentication response type (%d %d).", + socksreq[0], socksreq[1]); + gss_release_name(&gss_status, &server); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + + memcpy(&us_length, socksreq+2, sizeof(short)); + us_length = ntohs(us_length); + + gss_recv_token.length=us_length; + gss_recv_token.value=malloc(us_length); + if(!gss_recv_token.value) { + failf(data, + "Could not allocate memory for GSSAPI authentication response token."); + gss_release_name(&gss_status, &server); + return CURLE_COULDNT_CONNECT; + } + + result=Curl_blockread_all(conn, sock, (char *)gss_recv_token.value, + gss_recv_token.length, + &actualread, timeout); + + if(result != CURLE_OK || actualread != us_length) { + failf(data, "Failed to receive GSSAPI authentication token."); + gss_release_name(&gss_status, &server); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + + gss_token = &gss_recv_token; + } + + gss_release_name(&gss_status, &server); + gss_release_buffer(&gss_status, &gss_send_token); + + /* Everything is good so far, user was authenticated! */ + gss_major_status = gss_inquire_context (&gss_minor_status, gss_context, + &gss_client_name, NULL, NULL, NULL, + NULL, NULL, NULL); + if(check_gss_err(data,gss_major_status, + gss_minor_status,"gss_inquire_context")) { + gss_delete_sec_context(&gss_status, &gss_context, NULL); + gss_release_name(&gss_status, &gss_client_name); + failf(data, "Failed to determine user name."); + return CURLE_COULDNT_CONNECT; + } + gss_major_status = gss_display_name(&gss_minor_status, gss_client_name, + &gss_send_token, NULL); + if(check_gss_err(data,gss_major_status, + gss_minor_status,"gss_display_name")) { + gss_delete_sec_context(&gss_status, &gss_context, NULL); + gss_release_name(&gss_status, &gss_client_name); + failf(data, "Failed to determine user name."); + return CURLE_COULDNT_CONNECT; + } + user=malloc(gss_send_token.length+1); + memcpy(user,gss_send_token.value, gss_send_token.length); + user[gss_send_token.length] = '\0'; + gss_release_name(&gss_status, &gss_client_name); + gss_release_buffer(&gss_status, &gss_send_token); + infof(data, "SOCKS5 server authencticated user %s with gssapi.\n",user); + if(user) { + free(user); + user=NULL; + } + + /* Do encryption */ + socksreq[0] = 1; /* gssapi subnegotiation version */ + socksreq[1] = 2; /* encryption message type */ + + gss_enc = 0; /* no data protection */ + /* do confidentiality protection if supported */ + if(gss_ret_flags & GSS_C_CONF_FLAG) gss_enc = 2; + /* else do integrity protection */ + else if(gss_ret_flags & GSS_C_INTEG_FLAG) gss_enc = 1; + + infof(data, "SOCKS5 server supports gssapi %s data protection.\n", + (gss_enc==0)?"no":((gss_enc==1)?"integrity":"confidentiality")); + /* force for the moment to no data protection */ + gss_enc = 0; + /* + * Sending the encryption type in clear seems wrong. It should be + * protected with gss_seal()/gss_wrap(). See RFC1961 extract below + * The NEC reference implementations on which this is based is + * therefore at fault + * + * +------+------+------+.......................+ + * + ver | mtyp | len | token | + * +------+------+------+.......................+ + * + 0x01 | 0x02 | 0x02 | up to 2^16 - 1 octets | + * +------+------+------+.......................+ + * + * Where: + * + * - "ver" is the protocol version number, here 1 to represent the + * first version of the SOCKS/GSS-API protocol + * + * - "mtyp" is the message type, here 2 to represent a protection + * -level negotiation message + * + * - "len" is the length of the "token" field in octets + * + * - "token" is the GSS-API encapsulated protection level + * + * The token is produced by encapsulating an octet containing the + * required protection level using gss_seal()/gss_wrap() with conf_req + * set to FALSE. The token is verified using gss_unseal()/ + * gss_unwrap(). + * + */ + if(data->set.socks5_gssapi_nec) { + us_length = htons((short)1); + memcpy(socksreq+2,&us_length,sizeof(short)); + } else { + gss_send_token.length = 1; + gss_send_token.value = malloc(1); + memcpy(gss_send_token.value,&gss_enc,1); + + gss_major_status = gss_wrap(&gss_minor_status, gss_context, 0, + GSS_C_QOP_DEFAULT, &gss_send_token, + &gss_conf_state, &gss_w_token); + + if(check_gss_err(data,gss_major_status,gss_minor_status,"gss_wrap")) { + gss_release_buffer(&gss_status, &gss_send_token); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + failf(data, "Failed to wrap GSSAPI encryption value into token."); + return CURLE_COULDNT_CONNECT; + } + gss_release_buffer(&gss_status, &gss_send_token); + + us_length = htons((short)gss_w_token.length); + memcpy(socksreq+2,&us_length,sizeof(short)); + } + + code = Curl_write_plain(conn, sock, (char *)socksreq, 4, &written); + if((code != CURLE_OK) || (4 != written)) { + failf(data, "Failed to send GSSAPI encryption request."); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + + if(data->set.socks5_gssapi_nec) { + memcpy(socksreq,&gss_enc,1); + code = Curl_write_plain(conn, sock, socksreq, 1, &written); + if((code != CURLE_OK) || ( 1 != written)) { + failf(data, "Failed to send GSSAPI encryption type."); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + } else { + code = Curl_write_plain(conn, sock, (char *)gss_w_token.value, + gss_w_token.length, &written); + if((code != CURLE_OK) || (gss_w_token.length != written)) { + failf(data, "Failed to send GSSAPI encryption type."); + gss_release_buffer(&gss_status, &gss_w_token); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + gss_release_buffer(&gss_status, &gss_w_token); + } + + result=Curl_blockread_all(conn, sock, (char *)socksreq, 4, + &actualread, timeout); + if(result != CURLE_OK || actualread != 4) { + failf(data, "Failed to receive GSSAPI encryption response."); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + + /* ignore the first (VER) byte */ + if(socksreq[1] == 255) { /* status / message type */ + failf(data, "User was rejected by the SOCKS5 server (%d %d).", + socksreq[0], socksreq[1]); + return CURLE_COULDNT_CONNECT; + } + + if(socksreq[1] != 2) { /* status / messgae type */ + failf(data, "Invalid GSSAPI encryption response type (%d %d).", + socksreq[0], socksreq[1]); + return CURLE_COULDNT_CONNECT; + } + + memcpy(&us_length, socksreq+2, sizeof(short)); + us_length = ntohs(us_length); + + gss_recv_token.length= us_length; + gss_recv_token.value=malloc(gss_recv_token.length); + result=Curl_blockread_all(conn, sock, (char *)gss_recv_token.value, + gss_recv_token.length, + &actualread, timeout); + + if(result != CURLE_OK || actualread != us_length) { + failf(data, "Failed to receive GSSAPI encryptrion type."); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + + if(!data->set.socks5_gssapi_nec) { + gss_major_status = gss_unwrap(&gss_minor_status, gss_context, + &gss_recv_token, &gss_w_token, + 0, GSS_C_QOP_DEFAULT); + + if(check_gss_err(data,gss_major_status,gss_minor_status,"gss_unwrap")) { + gss_release_buffer(&gss_status, &gss_recv_token); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + failf(data, "Failed to unwrap GSSAPI encryption value into token."); + return CURLE_COULDNT_CONNECT; + } + gss_release_buffer(&gss_status, &gss_recv_token); + + if(gss_w_token.length != 1) { + failf(data, "Invalid GSSAPI encryption response length (%d).", + gss_w_token.length); + gss_release_buffer(&gss_status, &gss_w_token); + gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + + memcpy(socksreq,gss_w_token.value,gss_w_token.length); + gss_release_buffer(&gss_status, &gss_recv_token); + } else { + memcpy(socksreq,gss_recv_token.value,gss_recv_token.length); + gss_release_buffer(&gss_status, &gss_recv_token); + } + + infof(data, "SOCKS5 access with%s protection granted.\n", + (socksreq[0]==0)?"out gssapi data": + ((socksreq[0]==1)?" gssapi integrity":" gssapi confidentiality")); + + conn->socks5_gssapi_enctype = socksreq[0]; + if(socksreq[0] == 0) + gss_delete_sec_context(&gss_status, &gss_context, NULL); + + return CURLE_OK; +} +#endif diff -rubwBEN curl-7.19.2/lib/socks.h curl-7.19.2-socks-gssapi/lib/socks.h --- curl-7.19.2/lib/socks.h 2008-01-02 21:40:12.000000000 +0000 +++ curl-7.19.2-socks-gssapi/lib/socks.h 2009-01-13 22:17:31.000000000 +0000 @@ -24,6 +24,20 @@ ***************************************************************************/ /* + * Helper read-from-socket functions. Does the same as Curl_read() but it + * blocks until all bytes amount of buffersize will be read. No more, no less. + * + * This is STUPID BLOCKING behaviour which we frown upon, but right now this + * is what we have... + */ +int Curl_blockread_all(struct connectdata *conn, + curl_socket_t sockfd, + char *buf, + ssize_t buffersize, + ssize_t *n, + long conn_timeout); + +/* * This function logs in to a SOCKS4(a) proxy and sends the specifics to the * final destination server. */ @@ -45,4 +59,13 @@ int sockindex, struct connectdata *conn); +#ifdef HAVE_GSSAPI +CURLcode Curl_SOCKS5_gssapi_negotiate(unsigned char *socksreq, + int sockindex, + struct connectdata *conn); +#elif defined(USE_WINDOWS_SSPI) +CURLcode Curl_SOCKS5_sspi_negotiate(unsigned char *socksreq, + int sockindex, + struct connectdata *conn); +#endif #endif diff -rubwBEN curl-7.19.2/lib/socks_sspi.c curl-7.19.2-socks-gssapi/lib/socks_sspi.c --- curl-7.19.2/lib/socks_sspi.c 1970-01-01 01:00:00.000000000 +0100 +++ curl-7.19.2-socks-gssapi/lib/socks_sspi.c 2009-01-13 23:02:01.000000000 +0000 @@ -0,0 +1,632 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) 2009, Markus Moeller, + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at http://curl.haxx.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * $Id: socks.c,v 1.25 2008-06-20 10:43:32 bagder Exp $ + ***************************************************************************/ + + +#include "setup.h" + +#ifdef USE_WINDOWS_SSPI +#include + +#include + +#ifdef NEED_MALLOC_H +#include +#endif +#ifdef HAVE_STDLIB_H +#include +#endif + +#include "urldata.h" +#include "sendf.h" +#include "connect.h" +#include "timeval.h" +#include "socks.h" + +/* The last #include file should be: */ +#include "memdebug.h" + +/* + * Helper sspi error functions. + */ +typedef long OM_uint32; +static int check_sspi_err(struct SessionHandle *data, + OM_uint32 major_status, + OM_uint32 minor_status, + const char* function) +{ + char *txt; + + if(major_status != SEC_E_OK && + major_status != SEC_I_COMPLETE_AND_CONTINUE && + major_status != SEC_I_COMPLETE_NEEDED && + major_status != SEC_I_CONTINUE_NEEDED) { + failf(data, "SSPI error: %s failed: %d\n", function, major_status); + switch (major_status) { + case SEC_I_COMPLETE_AND_CONTINUE: + txt="SEC_I_COMPLETE_AND_CONTINUE"; + break; + case SEC_I_COMPLETE_NEEDED: + txt="SEC_I_COMPLETE_NEEDED"; + break; + case SEC_I_CONTINUE_NEEDED: + txt="SEC_I_CONTINUE_NEEDED"; + break; + case SEC_I_INCOMPLETE_CREDENTIALS: + txt="SEC_I_INCOMPLETE_CREDENTIALS"; + break; + case SEC_E_INSUFFICIENT_MEMORY: + txt="SEC_E_INSUFFICIENT_MEMORY"; + break; + case SEC_E_INTERNAL_ERROR: + txt="SEC_E_INTERNAL_ERROR"; + break; + case SEC_E_INVALID_HANDLE: + txt="SEC_E_INVALID_HANDLE"; + break; + case SEC_E_INVALID_TOKEN: + txt="SEC_E_INVALID_TOKEN"; + break; + case SEC_E_LOGON_DENIED: + txt="SEC_E_LOGON_DENIED"; + break; + case SEC_E_NO_AUTHENTICATING_AUTHORITY: + txt="SEC_E_NO_AUTHENTICATING_AUTHORITY"; + break; + case SEC_E_NO_CREDENTIALS: + txt="SEC_E_NO_CREDENTIALS"; + break; + case SEC_E_TARGET_UNKNOWN: + txt="SEC_E_TARGET_UNKNOWN"; + break; + case SEC_E_UNSUPPORTED_FUNCTION: + txt="SEC_E_UNSUPPORTED_FUNCTION"; + break; + case SEC_E_WRONG_PRINCIPAL: + txt="SEC_E_WRONG_PRINCIPAL"; + break; + default: + txt="Unknown error"; + + } + failf(data, "SSPI error: %s failed: %s\n", function, txt); + return(1); + } + return(0); +} + +CURLcode Curl_SOCKS5_sspi_negotiate(unsigned char *socksreq, + int sockindex, + struct connectdata *conn) +{ + struct SessionHandle *data = conn->data; + curl_socket_t sock = conn->sock[sockindex]; + CURLcode code; + ssize_t actualread; + ssize_t written; + int result; + long timeout; + /* Needs GSSAPI authentication */ + OM_uint32 sspi_major_status, sspi_minor_status=0; + OM_uint32 sspi_ret_flags=0; + int gss_enc; + SecBuffer sspi_send_token, sspi_recv_token, sspi_w_token[3]; + SecBufferDesc input_desc, output_desc, wrap_desc; + SecPkgContext_Sizes sspi_sizes; + CredHandle cred_handle; + CtxtHandle sspi_context; + PCtxtHandle context_handle = NULL; + SecPkgCredentials_Names names; + TimeStamp expiry; + char *service_name=NULL; + u_short us_length; + ULONG qop; + + /* get timeout */ + timeout = Curl_timeleft(conn, NULL, TRUE); + + /* GSSAPI request looks like + * +----+------+-----+----------------+ + * |VER | MTYP | LEN | TOKEN | + * +----+------+----------------------+ + * | 1 | 1 | 2 | up to 2^16 - 1 | + * +----+------+-----+----------------+ + */ + + /* prepare service name */ + if (strchr(data->set.str[STRING_SOCKS5_GSSAPI_SERVICE],'/')) { + service_name = malloc(strlen(data->set.str[STRING_SOCKS5_GSSAPI_SERVICE])); + memcpy(service_name,data->set.str[STRING_SOCKS5_GSSAPI_SERVICE], + strlen(data->set.str[STRING_SOCKS5_GSSAPI_SERVICE])); + } else { + service_name = malloc(strlen(data->set.str[STRING_SOCKS5_GSSAPI_SERVICE]) + +strlen(conn->proxy.name)+2); + _snprintf(service_name,strlen(data->set.str[STRING_SOCKS5_GSSAPI_SERVICE]) + +strlen(conn->proxy.name)+2,"%s/%s", + data->set.str[STRING_SOCKS5_GSSAPI_SERVICE],conn->proxy.name); + } + + input_desc.cBuffers = 1; + input_desc.pBuffers = &sspi_recv_token; + input_desc.ulVersion = SECBUFFER_VERSION; + + sspi_recv_token.BufferType = SECBUFFER_TOKEN; + sspi_recv_token.cbBuffer = 0; + sspi_recv_token.pvBuffer = NULL; + + output_desc.cBuffers = 1; + output_desc.pBuffers = &sspi_send_token; + output_desc.ulVersion = SECBUFFER_VERSION; + + sspi_send_token.BufferType = SECBUFFER_TOKEN; + sspi_send_token.cbBuffer = 0; + sspi_send_token.pvBuffer = NULL; + + wrap_desc.cBuffers = 3; + wrap_desc.pBuffers = sspi_w_token; + wrap_desc.ulVersion = SECBUFFER_VERSION; + + cred_handle.dwLower = 0; + cred_handle.dwUpper = 0; + + sspi_major_status = AcquireCredentialsHandle( NULL, + "Kerberos", + SECPKG_CRED_OUTBOUND, + NULL, + NULL, + NULL, + NULL, + &cred_handle, + &expiry); + + if(check_sspi_err(data, sspi_major_status,sspi_minor_status, + "AcquireCredentialsHandle") ) { + failf(data, "Failed to acquire credentials."); + if(service_name) { + free(service_name); + service_name=NULL; + } + return CURLE_COULDNT_CONNECT; + } + + /* As long as we need to keep sending some context info, and there's no */ + /* errors, keep sending it... */ + for(;;) { + + sspi_major_status = InitializeSecurityContext( &cred_handle, + context_handle, + service_name, + ISC_REQ_MUTUAL_AUTH | + ISC_REQ_ALLOCATE_MEMORY | + ISC_REQ_CONFIDENTIALITY | + ISC_REQ_REPLAY_DETECT, + 0, + SECURITY_NATIVE_DREP, + &input_desc, + 0, + &sspi_context, + &output_desc, + &sspi_ret_flags, + &expiry); + + if(sspi_recv_token.pvBuffer) { + FreeContextBuffer(sspi_recv_token.pvBuffer); + sspi_recv_token.pvBuffer = NULL; + sspi_recv_token.cbBuffer = 0; + } + + if(check_sspi_err(data,sspi_major_status,sspi_minor_status, + "InitializeSecurityContext") ){ + if(service_name) { + free(service_name); + service_name=NULL; + } + FreeCredentialsHandle(&cred_handle); + DeleteSecurityContext(&sspi_context); + failf(data, "Failed to initialise security context."); + return CURLE_COULDNT_CONNECT; + } + + if(sspi_send_token.cbBuffer != 0) { + socksreq[0] = 1; /* gssapi subnegotiation version */ + socksreq[1] = 1; /* authentication message type */ + us_length = htons((short)sspi_send_token.cbBuffer); + memcpy(socksreq+2,&us_length,sizeof(short)); + + code = Curl_write_plain(conn, sock, (char *)socksreq, 4, &written); + if((code != CURLE_OK) || (4 != written)) { + failf(data, "Failed to send SSPI authentication request."); + if(service_name) { + free(service_name); + service_name=NULL; + } + FreeContextBuffer(sspi_send_token.pvBuffer); + FreeCredentialsHandle(&cred_handle); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + + memcpy(socksreq ,sspi_send_token.pvBuffer , + (int) sspi_send_token.cbBuffer); + + code = Curl_write_plain(conn, sock, (char *)socksreq, + sspi_send_token.cbBuffer, &written); + if((code != CURLE_OK) || (sspi_send_token.cbBuffer != written)) { + failf(data, "Failed to send SSPI authentication token."); + if(service_name) { + free(service_name); + service_name=NULL; + } + FreeContextBuffer(sspi_send_token.pvBuffer); + FreeCredentialsHandle(&cred_handle); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + + } + + FreeContextBuffer(sspi_send_token.pvBuffer); + sspi_send_token.pvBuffer = NULL; + sspi_send_token.cbBuffer = 0; + if(sspi_major_status != SEC_I_CONTINUE_NEEDED) break; + + /* analyse response */ + + /* GSSAPI response looks like + * +----+------+-----+----------------+ + * |VER | MTYP | LEN | TOKEN | + * +----+------+----------------------+ + * | 1 | 1 | 2 | up to 2^16 - 1 | + * +----+------+-----+----------------+ + */ + + result=Curl_blockread_all(conn, sock, (char *)socksreq, 4, + &actualread, timeout); + if(result != CURLE_OK || actualread != 4) { + failf(data, "Failed to receive SSPI authentication response."); + if(service_name) { + free(service_name); + service_name=NULL; + } + FreeCredentialsHandle(&cred_handle); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + + /* ignore the first (VER) byte */ + if(socksreq[1] == 255) { /* status / message type */ + failf(data, "User was rejected by the SOCKS5 server (%d %d).", + socksreq[0], socksreq[1]); + if(service_name) { + free(service_name); + service_name=NULL; + } + FreeCredentialsHandle(&cred_handle); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + + if(socksreq[1] != 1) { /* status / messgae type */ + failf(data, "Invalid SSPI authentication response type (%d %d).", + socksreq[0], socksreq[1]); + if(service_name) { + free(service_name); + service_name=NULL; + } + FreeCredentialsHandle(&cred_handle); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + + memcpy(&us_length, socksreq+2, sizeof(short)); + us_length = ntohs(us_length); + + sspi_recv_token.cbBuffer=us_length; + sspi_recv_token.pvBuffer=malloc(us_length); + result=Curl_blockread_all(conn, sock, (char *)sspi_recv_token.pvBuffer, + sspi_recv_token.cbBuffer, + &actualread, timeout); + + if(result != CURLE_OK || actualread != us_length) { + failf(data, "Failed to receive SSPI authentication token."); + if(service_name) { + free(service_name); + service_name=NULL; + } + FreeCredentialsHandle(&cred_handle); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + + if(!sspi_recv_token.pvBuffer) { + failf(data, + "Could not allocate memory for SSPI authentication response token."); + if(service_name) { + free(service_name); + service_name=NULL; + } + FreeCredentialsHandle(&cred_handle); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + context_handle = &sspi_context; + } + + if(service_name) { + free(service_name); + service_name=NULL; + } + + /* Everything is good so far, user was authenticated! */ + sspi_major_status = QueryCredentialsAttributes(&cred_handle, + SECPKG_CRED_ATTR_NAMES,&names); + FreeCredentialsHandle(&cred_handle); + if(check_sspi_err(data,sspi_major_status,sspi_minor_status, + "QueryCredentialAttributes") ){ + DeleteSecurityContext(&sspi_context); + failf(data, "Failed to determine user name."); + return CURLE_COULDNT_CONNECT; + } + infof(data, "SOCKS5 server authencticated user %s with gssapi.\n", + names.sUserName); + + /* Do encryption */ + socksreq[0] = 1; /* gssapi subnegotiation version */ + socksreq[1] = 2; /* encryption message type */ + + gss_enc = 0; /* no data protection */ + /* do confidentiality protection if supported */ + if(sspi_ret_flags & ISC_REQ_CONFIDENTIALITY) gss_enc = 2; + /* else do integrity protection */ + else if(sspi_ret_flags & ISC_REQ_INTEGRITY) gss_enc = 1; + + infof(data, "SOCKS5 server supports gssapi %s data protection.\n", + (gss_enc==0)?"no":((gss_enc==1)?"integrity":"confidentiality") ); + /* force to no data protection, avoid encryption/decryption for now */ + gss_enc = 0; + /* + * Sending the encryption type in clear seems wrong. It should be + * protected with gss_seal()/gss_wrap(). See RFC1961 extract below + * The NEC reference implementations on which this is based is + * therefore at fault + * + * +------+------+------+.......................+ + * + ver | mtyp | len | token | + * +------+------+------+.......................+ + * + 0x01 | 0x02 | 0x02 | up to 2^16 - 1 octets | + * +------+------+------+.......................+ + * + * Where: + * + * - "ver" is the protocol version number, here 1 to represent the + * first version of the SOCKS/GSS-API protocol + * + * - "mtyp" is the message type, here 2 to represent a protection + * -level negotiation message + * + * - "len" is the length of the "token" field in octets + * + * - "token" is the GSS-API encapsulated protection level + * + * The token is produced by encapsulating an octet containing the + * required protection level using gss_seal()/gss_wrap() with conf_req + * set to FALSE. The token is verified using gss_unseal()/ + * gss_unwrap(). + * + */ + + if(data->set.socks5_gssapi_nec) { + us_length = htons((short)1); + memcpy(socksreq+2,&us_length,sizeof(short)); + } else { + sspi_major_status = QueryContextAttributes( &sspi_context, + SECPKG_ATTR_SIZES, + &sspi_sizes); + if(check_sspi_err(data,sspi_major_status,sspi_minor_status, + "QueryContextAttributes")){ + DeleteSecurityContext(&sspi_context); + failf(data, "Failed to query security context attributes."); + return CURLE_COULDNT_CONNECT; + } + + sspi_w_token[0].cbBuffer = sspi_sizes.cbSecurityTrailer; + sspi_w_token[0].BufferType = SECBUFFER_TOKEN; + sspi_w_token[0].pvBuffer = malloc(sspi_sizes.cbSecurityTrailer); + sspi_w_token[1].cbBuffer = 1; + sspi_w_token[1].pvBuffer = malloc(1); + memcpy(sspi_w_token[1].pvBuffer,&gss_enc,1); + sspi_w_token[2].BufferType = SECBUFFER_PADDING; + sspi_w_token[2].cbBuffer = sspi_sizes.cbBlockSize; + sspi_w_token[2].pvBuffer = malloc(sspi_sizes.cbBlockSize); + + sspi_major_status = EncryptMessage( &sspi_context, + KERB_WRAP_NO_ENCRYPT, + &wrap_desc, + 0); + if(check_sspi_err(data,sspi_major_status,sspi_minor_status, + "EncryptMessage") ){ + FreeContextBuffer(sspi_w_token[0].pvBuffer); + sspi_w_token[0].pvBuffer = NULL; + sspi_w_token[0].cbBuffer = 0; + FreeContextBuffer(sspi_w_token[1].pvBuffer); + sspi_w_token[1].pvBuffer = NULL; + sspi_w_token[1].cbBuffer = 0; + FreeContextBuffer(sspi_w_token[2].pvBuffer); + sspi_w_token[2].pvBuffer = NULL; + sspi_w_token[2].cbBuffer = 0; + DeleteSecurityContext(&sspi_context); + failf(data, "Failed to query security context attributes."); + return CURLE_COULDNT_CONNECT; + } + sspi_send_token.cbBuffer = sspi_w_token[0].cbBuffer + +sspi_w_token[1].cbBuffer + +sspi_w_token[2].cbBuffer; + sspi_send_token.pvBuffer = malloc(sspi_send_token.cbBuffer); + memcpy(sspi_send_token.pvBuffer, sspi_w_token[0].pvBuffer, + sspi_w_token[0].cbBuffer); + memcpy((PUCHAR) sspi_send_token.pvBuffer +(int)sspi_w_token[0].cbBuffer, + sspi_w_token[1].pvBuffer, sspi_w_token[1].cbBuffer); + memcpy((PUCHAR) sspi_send_token.pvBuffer + +sspi_w_token[0].cbBuffer + +sspi_w_token[1].cbBuffer, + sspi_w_token[2].pvBuffer, sspi_w_token[2].cbBuffer); + + FreeContextBuffer(sspi_w_token[0].pvBuffer); + sspi_w_token[0].pvBuffer = NULL; + sspi_w_token[0].cbBuffer = 0; + FreeContextBuffer(sspi_w_token[1].pvBuffer); + sspi_w_token[1].pvBuffer = NULL; + sspi_w_token[1].cbBuffer = 0; + FreeContextBuffer(sspi_w_token[2].pvBuffer); + sspi_w_token[2].pvBuffer = NULL; + sspi_w_token[2].cbBuffer = 0; + + us_length = htons((short)sspi_send_token.cbBuffer); + memcpy(socksreq+2,&us_length,sizeof(short)); + } + + code = Curl_write_plain(conn, sock, (char *)socksreq, 4, &written); + if((code != CURLE_OK) || (4 != written)) { + failf(data, "Failed to send SSPI encryption request."); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + + if(data->set.socks5_gssapi_nec) { + memcpy(socksreq,&gss_enc,1); + code = Curl_write_plain(conn, sock, (char *)socksreq, 1, &written); + if((code != CURLE_OK) || (1 != written)) { + failf(data, "Failed to send SSPI encryption type."); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + } else { + code = Curl_write_plain(conn, sock, (char *)sspi_send_token.pvBuffer, + sspi_send_token.cbBuffer, &written); + if((code != CURLE_OK) || (sspi_send_token.cbBuffer != written)) { + failf(data, "Failed to send SSPI encryption type."); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + } + + result=Curl_blockread_all(conn, sock, (char *)socksreq, 4, + &actualread, timeout); + if(result != CURLE_OK || actualread != 4) { + failf(data, "Failed to receive SSPI encryption response."); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + + /* ignore the first (VER) byte */ + if(socksreq[1] == 255) { /* status / message type */ + failf(data, "User was rejected by the SOCKS5 server (%d %d).", + socksreq[0], socksreq[1]); + return CURLE_COULDNT_CONNECT; + } + + if(socksreq[1] != 2) { /* status / message type */ + failf(data, "Invalid SSPI encryption response type (%d %d).", + socksreq[0], socksreq[1]); + return CURLE_COULDNT_CONNECT; + } + + memcpy(&us_length, socksreq+2, sizeof(short)); + us_length = ntohs(us_length); + + sspi_w_token[0].cbBuffer = us_length; + sspi_w_token[0].pvBuffer = malloc(us_length); + result=Curl_blockread_all(conn, sock, (char *)sspi_w_token[0].pvBuffer, + sspi_w_token[0].cbBuffer, + &actualread, timeout); + + if(result != CURLE_OK || actualread != us_length) { + failf(data, "Failed to receive SSPI encryption type."); + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + + + if(!data->set.socks5_gssapi_nec) { + wrap_desc.cBuffers = 2; + sspi_w_token[0].BufferType = SECBUFFER_STREAM; + sspi_w_token[1].BufferType = SECBUFFER_DATA; + sspi_w_token[1].cbBuffer = 0; + sspi_w_token[1].pvBuffer = NULL; + + sspi_major_status = DecryptMessage(&sspi_context, &wrap_desc, 0, &qop); + + if(check_sspi_err(data,sspi_major_status,sspi_minor_status, + "DecryptMessage")) { + FreeContextBuffer(sspi_w_token[0].pvBuffer); + sspi_w_token[0].pvBuffer = NULL; + sspi_w_token[0].cbBuffer = 0; + FreeContextBuffer(sspi_w_token[1].pvBuffer); + sspi_w_token[1].pvBuffer = NULL; + sspi_w_token[1].cbBuffer = 0; + DeleteSecurityContext(&sspi_context); + failf(data, "Failed to query security context attributes."); + return CURLE_COULDNT_CONNECT; + } + + memcpy(socksreq,sspi_w_token[1].pvBuffer,sspi_w_token[1].cbBuffer); + + if(sspi_w_token[1].cbBuffer != 1) { + failf(data, "Invalid SSPI encryption response length (%d).", + sspi_w_token[1].cbBuffer); + FreeContextBuffer(sspi_w_token[0].pvBuffer); + sspi_w_token[0].pvBuffer = NULL; + sspi_w_token[0].cbBuffer = 0; + FreeContextBuffer(sspi_w_token[1].pvBuffer); + sspi_w_token[1].pvBuffer = NULL; + sspi_w_token[1].cbBuffer = 0; + DeleteSecurityContext(&sspi_context); + return CURLE_COULDNT_CONNECT; + } + FreeContextBuffer(sspi_w_token[0].pvBuffer); + sspi_w_token[0].pvBuffer = NULL; + sspi_w_token[0].cbBuffer = 0; + FreeContextBuffer(sspi_w_token[1].pvBuffer); + sspi_w_token[1].pvBuffer = NULL; + sspi_w_token[1].cbBuffer = 0; + } else { + memcpy(socksreq,sspi_w_token[0].pvBuffer,sspi_w_token[0].cbBuffer); + FreeContextBuffer(sspi_w_token[0].pvBuffer); + sspi_w_token[0].cbBuffer = 0; + } + + infof(data, "SOCKS5 access with%s protection granted.\n", + (socksreq[0]==0)?"out gssapi data": + ((socksreq[0]==1)?" gssapi integrity":" gssapi confidentiality")); + + /* For later use if encryption is required + conn->socks5_sspi_enctype = socksreq[0]; + if (socksreq[0] != 0) + conn->socks5_sspi_context = sspi_context; + else { + DeleteSecurityContext(&sspi_context); + conn->socks5_sspi_context = sspi_context; + } + */ + return CURLE_OK; +} +#endif diff -rubwBEN curl-7.19.2/lib/url.c curl-7.19.2-socks-gssapi/lib/url.c --- curl-7.19.2/lib/url.c 2008-11-11 13:20:02.000000000 +0000 +++ curl-7.19.2-socks-gssapi/lib/url.c 2009-01-11 12:29:36.000000000 +0000 @@ -733,6 +733,16 @@ Curl_easy_initHandleData(data); + /* set default gssapi service name */ + res = setstropt(&data->set.str[STRING_SOCKS5_GSSAPI_SERVICE], + (char *) CURL_DEFAULT_SOCKS5_GSSAPI_SERVICE); + /* + * disallow unprotected protection negotiation + * NEC reference implementation seem not to follow rfc1961 + * section 4.3/4.4 + */ + data->set.socks5_gssapi_nec = FALSE; + /* * libcurl 7.10 introduced SSL verification *by default*! This needs to be * switched off unless wanted. @@ -1409,6 +1419,21 @@ break; #endif + case CURLOPT_SOCKS5_GSSAPI_SERVICE: + /* + * Set gssapi service name + */ + result = setstropt(&data->set.str[STRING_SOCKS5_GSSAPI_SERVICE], + va_arg(param, char *)); + break; + + case CURLOPT_SOCKS5_GSSAPI_NEC: + /* + * set flag for nec socks5 support + */ + data->set.socks5_gssapi_nec = (bool)(0 != va_arg(param, long)); + break; + case CURLOPT_WRITEHEADER: /* * Custom pointer to pass the header write callback function diff -rubwBEN curl-7.19.2/lib/urldata.h curl-7.19.2-socks-gssapi/lib/urldata.h --- curl-7.19.2/lib/urldata.h 2008-11-11 19:19:56.000000000 +0000 +++ curl-7.19.2-socks-gssapi/lib/urldata.h 2009-01-13 22:14:54.000000000 +0000 @@ -1032,6 +1032,12 @@ } proto; int cselect_bits; /* bitmask of socket events */ + +#ifdef HAVE_GSSAPI + int socks5_gssapi_enctype; +#elif defined(USE_WINDOWS_SSPI) + int socks5_sspi_enctype; +#endif }; /* The end of connectdata. */ @@ -1344,6 +1350,7 @@ STRING_PASSWORD, /* , if used */ STRING_PROXYUSERNAME, /* Proxy , if used */ STRING_PROXYPASSWORD, /* Proxy , if used */ + STRING_SOCKS5_GSSAPI_SERVICE, /* GSSAPI service name */ /* -- end of strings -- */ STRING_LAST /* not used, just an end-of-list marker */ @@ -1501,6 +1508,7 @@ via an HTTP proxy */ char *str[STRING_LAST]; /* array of strings, pointing to allocated memory */ unsigned int scope; /* address scope for IPv6 */ + long socks5_gssapi_nec; /* flag to support nec socks5 server */ }; struct Names { diff -rubwBEN curl-7.19.2/lib/url.h curl-7.19.2-socks-gssapi/lib/url.h --- curl-7.19.2/lib/url.h 2008-04-05 22:13:31.000000000 +0100 +++ curl-7.19.2-socks-gssapi/lib/url.h 2009-01-11 12:32:38.000000000 +0000 @@ -78,5 +78,6 @@ void Curl_reset_reqproto(struct connectdata *conn); #define CURL_DEFAULT_PROXY_PORT 1080 /* default proxy port unless specified */ +#define CURL_DEFAULT_SOCKS5_GSSAPI_SERVICE "rcmd" /* default socks5 gssapi service */ #endif diff -rubwBEN curl-7.19.2/src/main.c curl-7.19.2-socks-gssapi/src/main.c --- curl-7.19.2/src/main.c 2008-10-28 22:12:02.000000000 +0000 +++ curl-7.19.2-socks-gssapi/src/main.c 2009-01-13 22:51:09.000000000 +0000 @@ -542,6 +542,10 @@ char *socksproxy; /* set to server string */ int socksver; /* set to CURLPROXY_SOCKS* define */ + char *socks5_gssapi_service; /* set service name for gssapi principal + * default rcmd */ + int socks5_gssapi_nec ; /* The NEC reference server does not protect + * the encryption type exchange */ bool tcp_nodelay; long req_retry; /* number of retries */ @@ -811,6 +815,8 @@ " --socks4a SOCKS4a proxy on given host + port", " --socks5 SOCKS5 proxy on given host + port", " --socks5-hostname SOCKS5 proxy, pass host name to proxy", + " --socks5-gssapi-service SOCKS5 proxy service name for gssapi", + " --socks5-gssapi-nec Compatibility with NEC SOCKS5 server", " -Y/--speed-limit Stop transfer if below speed-limit for 'speed-time' secs", " -y/--speed-time Time needed to trig speed-limit abort. Defaults to 30", " -2/--sslv2 Use SSLv2 (SSL)", @@ -1672,6 +1678,8 @@ {"$2", "socks5-hostname", TRUE}, {"$3", "keepalive-time", TRUE}, {"$4", "post302", FALSE}, + {"$5", "socks5-gssapi-service", TRUE}, + {"$6", "socks5-gssapi-nec", FALSE}, {"0", "http1.0", FALSE}, {"1", "tlsv1", FALSE}, @@ -2181,6 +2189,12 @@ case '4': /* --post302 */ config->post302 = toggle; break; + case '5': /* --socks5-gssapi-service */ + GetStr(&config->socks5_gssapi_service, nextarg); + break; + case '6': /* --socks5-gssapi-nec*/ + config->socks5_gssapi_nec = TRUE; + break; } break; case '#': /* --progress-bar */ @@ -3697,6 +3711,8 @@ free(config->referer); if (config->hostpubmd5) free(config->hostpubmd5); + if(config->socks5_gssapi_service) + free(config->socks5_gssapi_service); curl_slist_free_all(config->quote); /* checks for config->quote == NULL */ curl_slist_free_all(config->prequote); @@ -4758,6 +4774,17 @@ my_setopt(curl, CURLOPT_PROXYTYPE, config->socksver); } + /* new in curl 7.19.4 */ + if(config->socks5_gssapi_service) { + my_setopt(curl, CURLOPT_SOCKS5_GSSAPI_SERVICE, + config->socks5_gssapi_service); + } + + /* new in curl 7.19.4 */ + if(config->socks5_gssapi_nec) { + my_setopt(curl, CURLOPT_SOCKS5_GSSAPI_NEC, config->socks5_gssapi_nec); + } + /* curl 7.13.0 */ my_setopt(curl, CURLOPT_FTP_ACCOUNT, config->ftp_account);