Squid Web Cache master
Loading...
Searching...
No Matches
peer_proxy_negotiate_auth.cc
Go to the documentation of this file.
1/*
2 * Copyright (C) 1996-2026 The Squid Software Foundation and contributors
3 *
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
7 */
8
9/*
10 * DEBUG: 11 Hypertext Transfer Protocol (HTTP)
11 */
12
13#include "squid.h"
14
15#if HAVE_AUTH_MODULE_NEGOTIATE && HAVE_KRB5 && HAVE_GSSAPI
16#include "base/Assure.h"
17#include "base64.h"
18#include "compat/krb5.h"
19#include "debug/Stream.h"
20#include "peer_proxy_negotiate_auth.h"
21
22#if HAVE_PROFILE_H
23#include <profile.h>
24#endif /* HAVE_PROFILE_H */
25#if HAVE_ET_COM_ERR_H && !HAVE_KRB5_H
26#include <et/com_err.h>
27#endif /* HAVE_COM_ERR_H */
28#if HAVE_COM_ERR_H
29#include <com_err.h>
30#endif /* HAVE_COM_ERR_H */
31#if HAVE_GSS_H
32#include <gss.h>
33#endif
34#if USE_APPLE_KRB5
35#define GSSKRB_APPLE_DEPRECATED(x)
36#endif
37#if HAVE_GSSAPI_GSSAPI_H
38#include <gssapi/gssapi.h>
39#elif HAVE_GSSAPI_H
40#include <gssapi.h>
41#endif /* HAVE_GSSAPI_H */
42#if HAVE_GSSAPI_GSSAPI_EXT_H
43#include <gssapi/gssapi_ext.h>
44#endif /* HAVE_GSSAPI_GSSAPI_EXT_H */
45#if HAVE_GSSAPI_GSSAPI_KRB5_H
46#include <gssapi/gssapi_krb5.h>
47#endif /* HAVE_GSSAPI_GSSAPI_KRB5_H */
48#if HAVE_GSSAPI_GSSAPI_GENERIC_H
49#include <gssapi/gssapi_generic.h>
50#endif /* HAVE_GSSAPI_GSSAPI_GENERIC_H */
51
52#ifndef gss_nt_service_name
53#define gss_nt_service_name GSS_C_NT_HOSTBASED_SERVICE
54#endif
55
56#if !HAVE_ERROR_MESSAGE && HAVE_KRB5_GET_ERROR_MESSAGE
57#define error_message(code) krb5_get_error_message(kparam.context,code)
58#elif !HAVE_ERROR_MESSAGE && HAVE_KRB5_GET_ERR_TEXT
59#define error_message(code) krb5_get_err_text(kparam.context,code)
60#elif !HAVE_ERROR_MESSAGE
61static char err_code[17];
62const char *KRB5_CALLCONV
63error_message(long code) {
64 snprintf(err_code,16,"%ld",code);
65 return err_code;
66}
67#endif
68
69#ifndef gss_mech_spnego
70static gss_OID_desc _gss_mech_spnego =
71{ 6, (void *) "\x2b\x06\x01\x05\x05\x02" };
72gss_OID gss_mech_spnego = &_gss_mech_spnego;
73#endif
74
75#if USE_IBM_KERBEROS
76#include <ibm_svc/krb5_svc.h>
77const char *KRB5_CALLCONV error_message(long code) {
78 char *msg = nullptr;
79 krb5_svc_get_msg(code, &msg);
80 return msg;
81}
82#endif
83
84/*
85 * Kerberos context and cache structure
86 * Caches authentication details to reduce
87 * number of authentication requests to kdc
88 */
89static struct kstruct {
90 krb5_context context;
91 krb5_ccache cc;
92} kparam = {
93 nullptr, nullptr
94};
95
96/*
97 * krb5_create_cache creates a Kerberos file credential cache or a memory
98 * credential cache if supported. The initial key for the principal
99 * principal_name is extracted from the keytab keytab_filename.
100 *
101 * If keytab_filename is NULL the default will be used.
102 * If principal_name is NULL the first working entry of the keytab will be used.
103 */
104int krb5_create_cache(char *keytab_filename, char *principal_name);
105
106/*
107 * krb5_cleanup clears used Keberos memory
108 */
109void krb5_cleanup(void);
110
111/*
112 * check_gss_err checks for gssapi error codes, extracts the error message
113 * and prints it.
114 */
115int check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
116 const char *function);
117
118int check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
119 const char *function) {
120 if (GSS_ERROR(major_status)) {
121 OM_uint32 maj_stat, min_stat;
122 OM_uint32 msg_ctx = 0;
123 gss_buffer_desc status_string;
124 char buf[1024];
125 size_t len;
126
127 len = 0;
128 msg_ctx = 0;
129 while (!msg_ctx) {
130 /* convert major status code (GSS-API error) to text */
131 maj_stat = gss_display_status(&min_stat, major_status,
132 GSS_C_GSS_CODE, GSS_C_NULL_OID, &msg_ctx, &status_string);
133 if (maj_stat == GSS_S_COMPLETE) {
134 if (sizeof(buf) > len + status_string.length + 1) {
135 memcpy(buf + len, status_string.value,
136 status_string.length);
137 len += status_string.length;
138 }
139 gss_release_buffer(&min_stat, &status_string);
140 break;
141 }
142 gss_release_buffer(&min_stat, &status_string);
143 }
144 if (sizeof(buf) > len + 2) {
145 strcpy(buf + len, ". ");
146 len += 2;
147 }
148 msg_ctx = 0;
149 while (!msg_ctx) {
150 /* convert minor status code (underlying routine error) to text */
151 maj_stat = gss_display_status(&min_stat, minor_status,
152 GSS_C_MECH_CODE, GSS_C_NULL_OID, &msg_ctx, &status_string);
153 if (maj_stat == GSS_S_COMPLETE) {
154 if (sizeof(buf) > len + status_string.length) {
155 memcpy(buf + len, status_string.value,
156 status_string.length);
157 len += status_string.length;
158 }
159 gss_release_buffer(&min_stat, &status_string);
160 break;
161 }
162 gss_release_buffer(&min_stat, &status_string);
163 }
164 debugs(11, 5, function << "failed: " << buf);
165 return (1);
166 }
167 return (0);
168}
169
170void krb5_cleanup() {
171 debugs(11, 5, "Cleanup kerberos context");
172 if (kparam.context) {
173 if (kparam.cc)
174 krb5_cc_destroy(kparam.context, kparam.cc);
175 kparam.cc = nullptr;
176 krb5_free_context(kparam.context);
177 kparam.context = nullptr;
178 }
179}
180
181int krb5_create_cache(char *kf, char *pn) {
182
183#define KT_PATH_MAX 256
184#define MAX_RENEW_TIME "365d"
185#define DEFAULT_SKEW (krb5_deltat) 600
186
187 static char *keytab_filename = nullptr, *principal_name = nullptr;
188 static krb5_keytab keytab = nullptr;
189 static krb5_keytab_entry entry;
190 static krb5_kt_cursor cursor;
191 static krb5_creds *creds = nullptr;
192#if HAVE_LIBHEIMDAL_KRB5 && !HAVE_KRB5_GET_RENEWED_CREDS
193 static krb5_creds creds2;
194#endif
195 static krb5_principal principal = nullptr;
196 static krb5_deltat skew;
197
198#if HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
199 krb5_get_init_creds_opt *options;
200#else
201 krb5_get_init_creds_opt options;
202#endif
203 krb5_error_code code = 0;
204 krb5_deltat rlife;
205#if HAVE_PROFILE_H && HAVE_KRB5_GET_PROFILE && HAVE_PROFILE_GET_INTEGER && HAVE_PROFILE_RELEASE
206 profile_t profile;
207#endif
208#if HAVE_LIBHEIMDAL_KRB5 && !HAVE_KRB5_GET_RENEWED_CREDS
209 krb5_kdc_flags flags;
210#if HAVE_KRB5_PRINCIPAL_GET_REALM
211 const char *client_realm;
212#else
213 krb5_realm client_realm;
214#endif
215#endif
216 char *mem_cache;
217
218restart:
219 /*
220 * Check if credentials need to be renewed
221 */
222 if (creds &&
223 (creds->times.endtime - time(nullptr) > skew) &&
224 (creds->times.renew_till - time(nullptr) > 2 * skew)) {
225 if (creds->times.endtime - time(nullptr) < 2 * skew) {
226#if HAVE_KRB5_GET_RENEWED_CREDS
227 /* renew ticket */
228 code =
229 krb5_get_renewed_creds(kparam.context, creds, principal,
230 kparam.cc, nullptr);
231#else
232 /* renew ticket */
233 flags.i = 0;
234 flags.b.renewable = flags.b.renew = 1;
235
236 code =
237 krb5_cc_get_principal(kparam.context, kparam.cc,
238 &creds2.client);
239 if (code) {
240 debugs(11, 5,
241
242 "Error while getting principal from credential cache : "
243 << error_message(code));
244 return (1);
245 }
246#if HAVE_KRB5_PRINCIPAL_GET_REALM
247 client_realm = krb5_principal_get_realm(kparam.context, principal);
248#else
249 client_realm = krb5_princ_realm(kparam.context, creds2.client);
250#endif
251 code =
252 krb5_make_principal(kparam.context, &creds2.server,
253 (krb5_const_realm)&client_realm, KRB5_TGS_NAME,
254 (krb5_const_realm)&client_realm, nullptr);
255 if (code) {
256 debugs(11, 5,
257 "Error while getting krbtgt principal : " <<
258 error_message(code));
259 return (1);
260 }
261 code =
262 krb5_get_kdc_cred(kparam.context, kparam.cc, flags, nullptr,
263 nullptr, &creds2, &creds);
264 krb5_free_creds(kparam.context, &creds2);
265#endif
266 if (code) {
267 if (code == KRB5KRB_AP_ERR_TKT_EXPIRED) {
268 krb5_free_creds(kparam.context, creds);
269 creds = nullptr;
270 /* this can happen because of clock skew */
271 goto restart;
272 }
273 debugs(11, 5,
274 "Error while get credentials : " <<
275 error_message(code));
276 return (1);
277 }
278 }
279 } else {
280 /* reinit */
281 if (!kparam.context) {
282 code = krb5_init_context(&kparam.context);
283 if (code) {
284 debugs(11, 5,
285 "Error while initialising Kerberos library : "
286 << error_message(code));
287 return (1);
288 }
289 }
290#if HAVE_PROFILE_H && HAVE_KRB5_GET_PROFILE && HAVE_PROFILE_GET_INTEGER && HAVE_PROFILE_RELEASE
291 code = krb5_get_profile(kparam.context, &profile);
292 if (code) {
293 if (profile)
294 profile_release(profile);
295 debugs(11, 5,
296 "Error while getting profile : " <<
297 error_message(code));
298 return (1);
299 }
300 code =
301 profile_get_integer(profile, "libdefaults", "clockskew", nullptr,
302 5 * 60, &skew);
303 if (profile)
304 profile_release(profile);
305 if (code) {
306 debugs(11, 5,
307 "Error while getting clockskew : " <<
308 error_message(code));
309 return (1);
310 }
311#elif HAVE_LIBHEIMDAL_KRB5
312 skew = krb5_get_max_time_skew(kparam.context);
313#else
314 skew = DEFAULT_SKEW;
315#endif
316
317 if (!kf) {
318 char buf[KT_PATH_MAX], *p;
319
320 krb5_kt_default_name(kparam.context, buf, KT_PATH_MAX);
321 p = strchr(buf, ':');
322 if (p)
323 ++p;
324 xfree(keytab_filename);
325 keytab_filename = xstrdup(p ? p : buf);
326 } else {
327 keytab_filename = xstrdup(kf);
328 }
329
330 code = krb5_kt_resolve(kparam.context, keytab_filename, &keytab);
331 if (code) {
332 debugs(11, 5,
333 "Error while resolving keytab filename " <<
334 keytab_filename << " : " << error_message(code));
335 return (1);
336 }
337
338 if (!pn) {
339 code = krb5_kt_start_seq_get(kparam.context, keytab, &cursor);
340 if (code) {
341 debugs(11, 5,
342 "Error while starting keytab scan : " <<
343 error_message(code));
344 return (1);
345 }
346 code =
347 krb5_kt_next_entry(kparam.context, keytab, &entry, &cursor);
348 krb5_copy_principal(kparam.context, entry.principal,
349 &principal);
350 if (code && code != KRB5_KT_END) {
351 debugs(11, 5,
352 "Error while scanning keytab : " <<
353 error_message(code));
354 return (1);
355 }
356
357 code = krb5_kt_end_seq_get(kparam.context, keytab, &cursor);
358 if (code) {
359 debugs(11, 5,
360 "Error while ending keytab scan : " <<
361 error_message(code));
362 return (1);
363 }
364#if HAVE_LIBHEIMDAL_KRB5 || ( HAVE_KRB5_KT_FREE_ENTRY && HAVE_DECL_KRB5_KT_FREE_ENTRY)
365 code = krb5_kt_free_entry(kparam.context, &entry);
366#else
367 code = krb5_free_keytab_entry_contents(kparam.context, &entry);
368#endif
369 if (code) {
370 debugs(11, 5,
371 "Error while freeing keytab entry : " <<
372 error_message(code));
373 return (1);
374 }
375
376 } else {
377 principal_name = xstrdup(pn);
378 }
379
380 if (!principal) {
381 code =
382 krb5_parse_name(kparam.context, principal_name, &principal);
383 if (code) {
384 debugs(11, 5,
385 "Error while parsing principal name " <<
386 principal_name << " : " << error_message(code));
387 return (1);
388 }
389 }
390
391 creds = (krb5_creds *) xmalloc(sizeof(*creds));
392 memset(creds, 0, sizeof(*creds));
393#if HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
394 krb5_get_init_creds_opt_alloc(kparam.context, &options);
395#else
396 krb5_get_init_creds_opt_init(&options);
397#endif
398 code = krb5_string_to_deltat((char *) MAX_RENEW_TIME, &rlife);
399 if (code != 0 || rlife == 0) {
400 debugs(11, 5,
401 "Error bad lifetime value " << MAX_RENEW_TIME <<
402 " : " << error_message(code));
403 return (1);
404 }
405#if HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
406 krb5_get_init_creds_opt_set_renew_life(options, rlife);
407 code =
408 krb5_get_init_creds_keytab(kparam.context, creds, principal,
409 keytab, 0, nullptr, options);
410#if HAVE_KRB5_GET_INIT_CREDS_FREE_CONTEXT
411 krb5_get_init_creds_opt_free(kparam.context, options);
412#else
413 krb5_get_init_creds_opt_free(options);
414#endif
415#else
416 krb5_get_init_creds_opt_set_renew_life(&options, rlife);
417 code =
418 krb5_get_init_creds_keytab(kparam.context, creds, principal,
419 keytab, 0, nullptr, &options);
420#endif
421 if (code) {
422 debugs(11, 5,
423
424 "Error while initializing credentials from keytab : " <<
425 error_message(code));
426 return (1);
427 }
428#if !HAVE_KRB5_MEMORY_CACHE
429 mem_cache =
430 (char *) xmalloc(strlen("FILE:/tmp/peer_proxy_negotiate_auth_")
431 + 16);
432 if (!mem_cache) {
433 debugs(11, 5, "Error while allocating memory");
434 return(1);
435 }
436 snprintf(mem_cache,
437 strlen("FILE:/tmp/peer_proxy_negotiate_auth_") + 16,
438 "FILE:/tmp/peer_proxy_negotiate_auth_%d", (int) getpid());
439#else
440 mem_cache =
441 (char *) xmalloc(strlen("MEMORY:peer_proxy_negotiate_auth_") +
442 16);
443 if (!mem_cache) {
444 debugs(11, 5, "Error while allocating memory");
445 return(1);
446 }
447 snprintf(mem_cache,
448 strlen("MEMORY:peer_proxy_negotiate_auth_") + 16,
449 "MEMORY:peer_proxy_negotiate_auth_%d", (int) getpid());
450#endif
451
452 setenv("KRB5CCNAME", mem_cache, 1);
453 code = krb5_cc_resolve(kparam.context, mem_cache, &kparam.cc);
454 xfree(mem_cache);
455 if (code) {
456 debugs(11, 5,
457 "Error while resolving memory credential cache : "
458 << error_message(code));
459 return (1);
460 }
461 code = krb5_cc_initialize(kparam.context, kparam.cc, principal);
462 if (code) {
463 debugs(11, 5,
464
465 "Error while initializing memory credential cache : " <<
466 error_message(code));
467 return (1);
468 }
469 code = krb5_cc_store_cred(kparam.context, kparam.cc, creds);
470 if (code) {
471 debugs(11, 5,
472 "Error while storing credentials : " <<
473 error_message(code));
474 return (1);
475 }
476
477 if (!creds->times.starttime)
478 creds->times.starttime = creds->times.authtime;
479 }
480 return (0);
481}
482
483/*
484 * peer_proxy_negotiate_auth gets a GSSAPI token for principal_name
485 * and base64 encodes it.
486 */
487char *peer_proxy_negotiate_auth(char *principal_name, const char * const proxy, int flags) {
488 int rc = 0;
489 OM_uint32 major_status, minor_status;
490 gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
491 gss_name_t server_name = GSS_C_NO_NAME;
492 gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
493 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
494 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
495 char *token = nullptr;
496
497 setbuf(stdout, nullptr);
498 setbuf(stdin, nullptr);
499
500 if (!proxy) {
501 debugs(11, 5, "Error : No proxy server name");
502 return nullptr;
503 }
504
505 if (!(flags & PEER_PROXY_NEGOTIATE_NOKEYTAB)) {
506 if (principal_name)
507 debugs(11, 5,
508 "Creating credential cache for " << principal_name);
509 else
510 debugs(11, 5, "Creating credential cache");
511 rc = krb5_create_cache(nullptr, principal_name);
512 if (rc) {
513 debugs(11, 5, "Error : Failed to create Kerberos cache");
514 krb5_cleanup();
515 return nullptr;
516 }
517 }
518
519 service.value = (void *) xmalloc(strlen("HTTP") + strlen(proxy) + 2);
520 snprintf((char *) service.value, strlen("HTTP") + strlen(proxy) + 2,
521 "%s@%s", "HTTP", proxy);
522 service.length = strlen((char *) service.value);
523
524 debugs(11, 5, "Import gss name");
525 major_status = gss_import_name(&minor_status, &service,
526 gss_nt_service_name, &server_name);
527
528 if (check_gss_err(major_status, minor_status, "gss_import_name()"))
529 goto cleanup;
530
531 debugs(11, 5, "Initialize gss security context");
532 major_status = gss_init_sec_context(&minor_status,
533 GSS_C_NO_CREDENTIAL,
534 &gss_context,
535 server_name,
536 gss_mech_spnego,
537 0,
538 0,
539 GSS_C_NO_CHANNEL_BINDINGS,
540 &input_token, nullptr, &output_token, nullptr, nullptr);
541
542 if (check_gss_err(major_status, minor_status, "gss_init_sec_context()"))
543 goto cleanup;
544
545 debugs(11, 5, "Got token with length " << output_token.length);
546 if (output_token.length) {
547 static char b64buf[8192]; // XXX: 8KB only because base64_encode_bin() used to.
548 struct base64_encode_ctx ctx;
549 base64_encode_init(&ctx);
550 Assure(base64_encode_len(output_token.length) < sizeof(b64buf));
551 size_t blen = base64_encode_update(&ctx, b64buf, output_token.length, reinterpret_cast<const uint8_t*>(output_token.value));
552 blen += base64_encode_final(&ctx, b64buf+blen);
553 b64buf[blen] = '\0';
554
555 token = reinterpret_cast<char*>(b64buf);
556 }
557
558cleanup:
559 gss_delete_sec_context(&minor_status, &gss_context, nullptr);
560 gss_release_buffer(&minor_status, &service);
561 gss_release_buffer(&minor_status, &input_token);
562 gss_release_buffer(&minor_status, &output_token);
563 gss_release_name(&minor_status, &server_name);
564
565 return token;
566}
567
568#endif /* HAVE_AUTH_MODULE_NEGOTIATE && HAVE_KRB5 && HAVE_GSSAPI */
569
Assure
#define Assure(condition)
Definition Assure.h:35
base64_encode_init
void base64_encode_init(struct base64_encode_ctx *ctx)
Definition base64.cc:232
base64_encode_update
size_t base64_encode_update(struct base64_encode_ctx *ctx, char *dst, size_t length, const uint8_t *src)
Definition base64.cc:265
base64_encode_final
size_t base64_encode_final(struct base64_encode_ctx *ctx, char *dst)
Definition base64.cc:308
base64_encode_len
#define base64_encode_len(length)
Definition base64.h:161
debugs
#define debugs(SECTION, LEVEL, CONTENT)
Definition Stream.h:192
gss_nt_service_name
#define gss_nt_service_name
Definition negotiate_kerberos.h:77
check_gss_err
int check_gss_err(OM_uint32 major_status, OM_uint32 minor_status, const char *function, int log, int sout)
xfree
#define xfree
Definition negotiate_wrapper.cc:50
xstrdup
#define xstrdup
Definition negotiate_wrapper.cc:47
xmalloc
#define xmalloc
Definition negotiate_wrapper.cc:44
peer_proxy_negotiate_auth.h
PEER_PROXY_NEGOTIATE_NOKEYTAB
#define PEER_PROXY_NEGOTIATE_NOKEYTAB
Definition peer_proxy_negotiate_auth.h:12
base64_encode_ctx
Definition base64.h:65