/*
* Wyllys Ingersoll <wyllys.ingersoll@sun.com>
*
* Based on work by
* Daniel Kouril <kouril@users.sourceforge.net>
* James E. Robinson, III <james@ncstate.net>
* Daniel Henninger <daniel@ncsu.edu>
* Ludek Sulak <xsulak@fi.muni.cz>
*/
/* ====================================================================
* The Apache Software License, Version 1.1
*
* Copyright (c) 2000-2003 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The names "Apache" and "Apache Software Foundation" must
* not be used to endorse or promote products derived from this
* software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache",
* nor may "Apache" appear in their name, without prior written
* permission of the Apache Software Foundation.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*
* Portions of this software are based upon public domain software
* originally written at the National Center for Supercomputing Applications,
* University of Illinois, Urbana-Champaign.
*/
/*
* Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
*/
#include <sys/types.h>
#include <strings.h>
#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_log.h"
#include "http_protocol.h"
#include "http_request.h"
#include "ap_config.h"
#include "apr_base64.h"
#include "apr_lib.h"
#include "apr_time.h"
#include "apr_errno.h"
#include "apr_global_mutex.h"
#include "apr_strings.h"
#include "ap_compat.h"
#include <gssapi/gssapi.h>
#include <gssapi/gssapi_ext.h>
module auth_gss_module;
static void *gss_create_dir_config(apr_pool_t *, char *);
int gss_authenticate(request_rec *);
typedef struct {
char *gss_service_name;
char *keytab_file;
int gss_debug;
} gss_auth_config;
static const char *set_service_name(cmd_parms *cmd, void *config,
const char *name)
{
((gss_auth_config *) config)->gss_service_name = (char *)name;
return NULL;
}
static const char *set_keytab_file(cmd_parms *cmd, void *config,
const char *file)
{
((gss_auth_config *) config)->keytab_file = (char *)file;
return NULL;
}
static const char *set_gss_debug(cmd_parms *cmd, void *config,
const char *debugflag)
{
((gss_auth_config *) config)->gss_debug = atoi(debugflag);
return NULL;
}
static const command_rec gss_auth_cmds[] = {
AP_INIT_TAKE1("AuthGSSServiceName", set_service_name, NULL,
OR_AUTHCFG, "Service name used for authentication."),
AP_INIT_TAKE1("AuthGSSKeytabFile", set_keytab_file, NULL,
OR_AUTHCFG,
"Location of Kerberos V5 keytab file."),
AP_INIT_TAKE1("AuthGssDebug", set_gss_debug, NULL,
OR_AUTHCFG,
"Enable debug logging in error_log"),
{ NULL }
};
static void
gss_register_hooks(apr_pool_t *p)
{
ap_hook_check_user_id(gss_authenticate,NULL,NULL,APR_HOOK_MIDDLE);
}
module AP_MODULE_DECLARE_DATA auth_gss_module = {
STANDARD20_MODULE_STUFF,
gss_create_dir_config, /* dir config creater */
NULL, /* dir merger --- default is to override */
NULL, /* server config */
NULL, /* merge server config */
gss_auth_cmds, /* command apr_table_t */
gss_register_hooks /* register hooks */
};
typedef struct {
gss_ctx_id_t context;
gss_cred_id_t server_creds;
} gss_connection_t;
static gss_connection_t *gss_connection = NULL;
static void *
gss_create_dir_config(apr_pool_t *p, char *d)
{
gss_auth_config *rec =
(gss_auth_config *) apr_pcalloc(p, sizeof(gss_auth_config));
((gss_auth_config *)rec)->gss_service_name = "HTTP";
((gss_auth_config *)rec)->keytab_file = "/var/apache2/http.keytab";
((gss_auth_config *)rec)->gss_debug = 0;
return rec;
}
void log_rerror(const char *file, int line, int level, int status,
const request_rec *r, const char *fmt, ...)
{
char errstr[1024];
va_list ap;
va_start(ap, fmt);
vsnprintf(errstr, sizeof(errstr), fmt, ap);
va_end(ap);
ap_log_rerror(file, line, level | APLOG_NOERRNO, NULL, r, "%s", errstr);
}
/*********************************************************************
* GSSAPI Authentication
********************************************************************/
static const char *
gss_error_msg(apr_pool_t *p, OM_uint32 maj, OM_uint32 min, char *prefix)
{
OM_uint32 maj_stat, min_stat;
OM_uint32 msg_ctx = 0;
gss_buffer_desc msg;
char *err_msg = (char *)apr_pstrdup(p, prefix);
do {
maj_stat = gss_display_status (&min_stat,
maj, GSS_C_GSS_CODE,
GSS_C_NO_OID, &msg_ctx,
&msg);
if (GSS_ERROR(maj_stat))
break;
err_msg = apr_pstrcat(p, err_msg, ": ", (char*) msg.value,
NULL);
(void) gss_release_buffer(&min_stat, &msg);
maj_stat = gss_display_status (&min_stat,
min, GSS_C_MECH_CODE,
GSS_C_NULL_OID, &msg_ctx,
&msg);
if (!GSS_ERROR(maj_stat)) {
err_msg = apr_pstrcat(p, err_msg,
" (", (char*) msg.value, ")", NULL);
(void) gss_release_buffer(&min_stat, &msg);
}
} while (!GSS_ERROR(maj_stat) && msg_ctx != 0);
return (err_msg);
}
static int
cleanup_gss_connection(void *data)
{
OM_uint32 ret;
OM_uint32 minor_status;
gss_connection_t *gss_conn = (gss_connection_t *)data;
if (data == NULL)
return 0;
if (gss_conn->context != GSS_C_NO_CONTEXT) {
(void) gss_delete_sec_context(&minor_status,
&gss_conn->context,
GSS_C_NO_BUFFER);
}
if (gss_conn->server_creds != GSS_C_NO_CREDENTIAL) {
(void) gss_release_cred(&minor_status, &gss_conn->server_creds);
}
gss_connection = NULL;
return 0;
}
static int
acquire_server_creds(request_rec *r,
gss_auth_config *conf,
gss_OID_set mechset,
gss_cred_id_t *server_creds)
{
int ret = 0;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
OM_uint32 major_status, minor_status, minor_status2;
gss_name_t server_name = GSS_C_NO_NAME;
char buf[1024];
snprintf(buf, sizeof(buf), "%s@%s",
conf->gss_service_name, r->hostname);
if (conf->gss_debug)
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"acquire_server_creds for %s", buf);
input_token.value = buf;
input_token.length = strlen(buf) + 1;
major_status = gss_import_name(&minor_status, &input_token,
GSS_C_NT_HOSTBASED_SERVICE,
&server_name);
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"%s", gss_error_msg(r->pool, major_status, minor_status,
"gss_import_name() failed"));
return (HTTP_INTERNAL_SERVER_ERROR);
}
major_status = gss_acquire_cred(&minor_status, server_name,
GSS_C_INDEFINITE,
mechset, GSS_C_ACCEPT,
server_creds, NULL, NULL);
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"%s", gss_error_msg(r->pool, major_status, minor_status,
"gss_acquire_cred() failed"));
ret = HTTP_INTERNAL_SERVER_ERROR;
}
(void) gss_release_name(&minor_status2, &server_name);
return (ret);
}
static int
authenticate_user_gss(request_rec *r, gss_auth_config *conf,
const char *auth_line, char **negotiate_ret_value)
{
int ret = 0;
OM_uint32 major_status, minor_status, minor_status2;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
const char *auth_param = NULL;
gss_name_t client_name = GSS_C_NO_NAME;
gss_cred_id_t delegated_cred = GSS_C_NO_CREDENTIAL;
if (conf->gss_debug)
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"authenticate_user_gss called");
*negotiate_ret_value = (char *)"";
if (gss_connection == NULL) {
gss_connection = apr_pcalloc(r->connection->pool, sizeof(*gss_connection));
if (gss_connection == NULL) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"apr_pcalloc() failed (not enough memory)");
ret = HTTP_INTERNAL_SERVER_ERROR;
goto end;
}
(void) memset(gss_connection, 0, sizeof(*gss_connection));
apr_pool_cleanup_register(r->connection->pool, gss_connection,
cleanup_gss_connection, apr_pool_cleanup_null);
}
if (conf->keytab_file) {
char *ktname;
/*
* We don't use the ap_* calls here, since the string
* passed to putenv() will become part of the enviroment
* and shouldn't be free()ed by apache.
*/
ktname = malloc(strlen("KRB5_KTNAME=") + strlen(conf->keytab_file) + 1);
if (ktname == NULL) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"malloc() failed: not enough memory");
ret = HTTP_INTERNAL_SERVER_ERROR;
goto end;
}
/*
* Put the keytab name in the environment so that Kerberos
* knows where to look later.
*/
sprintf(ktname, "KRB5_KTNAME=%s", conf->keytab_file);
putenv(ktname);
if (conf->gss_debug)
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Using keytab: %s", ktname);
}
/* ap_getword() shifts parameter */
auth_param = ap_getword_white(r->pool, &auth_line);
if (auth_param == NULL) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"No Authorization parameter in request from client");
ret = HTTP_UNAUTHORIZED;
goto end;
}
input_token.length = apr_base64_decode_len(auth_param) + 1;
input_token.value = apr_pcalloc(r->connection->pool, input_token.length);
if (input_token.value == NULL) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"apr_pcalloc() failed (not enough memory)");
ret = HTTP_INTERNAL_SERVER_ERROR;
goto end;
}
input_token.length = apr_base64_decode(input_token.value, auth_param);
if (gss_connection->server_creds == GSS_C_NO_CREDENTIAL) {
gss_OID_set_desc desiredMechs;
gss_OID_desc client_mech_desc;
gss_OID client_mechoid = &client_mech_desc;
char *mechstr = NULL;
if (!__gss_get_mech_type(client_mechoid, &input_token)) {
mechstr = (char *)__gss_oid_to_mech(client_mechoid);
}
if (mechstr == NULL) {
client_mechoid = GSS_C_NULL_OID;
mechstr = "<unknown>";
}
if (conf->gss_debug)
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"Client wants GSS mech: %s", mechstr);
desiredMechs.count = 1;
desiredMechs.elements = client_mechoid;
/* Get creds using the mechanism that the client requested */
ret = acquire_server_creds(r, conf, &desiredMechs,
&gss_connection->server_creds);
if (ret)
goto end;
}
/*
* Try to display the server creds information.
*/
if (conf->gss_debug) {
gss_name_t sname;
gss_buffer_desc dname;
major_status = gss_inquire_cred(&minor_status,
gss_connection->server_creds,
&sname, NULL, NULL, NULL);
if (major_status == GSS_S_COMPLETE) {
major_status = gss_display_name(&minor_status,
sname, &dname, NULL);
}
if (major_status == GSS_S_COMPLETE) {
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"got server creds for: %.*s",
(int)dname.length,
(char *)dname.value);
(void) gss_release_name(&minor_status, &sname);
(void) gss_release_buffer(&minor_status, &dname);
}
}
major_status = gss_accept_sec_context(&minor_status,
&gss_connection->context,
gss_connection->server_creds,
&input_token,
GSS_C_NO_CHANNEL_BINDINGS,
&client_name,
NULL,
&output_token,
NULL,
NULL,
&delegated_cred);
if (output_token.length) {
char *token = NULL;
size_t len;
len = apr_base64_encode_len(output_token.length) + 1;
token = apr_pcalloc(r->connection->pool, len + 1);
if (token == NULL) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"apr_pcalloc() failed (not enough memory)");
ret = HTTP_INTERNAL_SERVER_ERROR;
gss_release_buffer(&minor_status2, &output_token);
goto end;
}
apr_base64_encode(token, output_token.value, output_token.length);
token[len] = '\0';
*negotiate_ret_value = token;
}
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"%s", gss_error_msg(r->pool, major_status, minor_status,
"gss_accept_sec_context() failed"));
/* Don't offer the Negotiate method again if call to GSS layer failed */
*negotiate_ret_value = NULL;
ret = HTTP_UNAUTHORIZED;
goto end;
}
if (major_status == GSS_S_CONTINUE_NEEDED) {
/*
* Some GSSAPI mechanisms may require multiple iterations to
* establish authentication. Most notably, when MUTUAL_AUTHENTICATION
* flag is used, multiple round trips are needed.
*/
ret = HTTP_UNAUTHORIZED;
goto end;
}
if (client_name != GSS_C_NO_NAME) {
gss_buffer_desc name_token = GSS_C_EMPTY_BUFFER;
major_status = gss_display_name(&minor_status, client_name,
&name_token, NULL);
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"%s", gss_error_msg(r->pool, major_status,
minor_status,
"gss_export_name() failed"));
ret = HTTP_INTERNAL_SERVER_ERROR;
goto end;
}
if (name_token.length) {
r->user = apr_pstrdup(r->pool, name_token.value);
gss_release_buffer(&minor_status, &name_token);
}
if (conf->gss_debug)
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"Authenticated user: %s",
r->user ? r->user : "<unknown>");
}
r->ap_auth_type = "Negotiate";
ret = OK;
end:
if (delegated_cred)
gss_release_cred(&minor_status, &delegated_cred);
if (output_token.length)
gss_release_buffer(&minor_status, &output_token);
if (client_name != GSS_C_NO_NAME)
gss_release_name(&minor_status, &client_name);
cleanup_gss_connection(gss_connection);
return ret;
}
static int
already_succeeded(request_rec *r)
{
if (ap_is_initial_req(r) || r->ap_auth_type == NULL)
return 0;
return (strcmp(r->ap_auth_type, "Negotiate") ||
(strcmp(r->ap_auth_type, "Basic") && strchr(r->user, '@')));
}
static void
note_gss_auth_failure(request_rec *r, const gss_auth_config *conf,
char *negotiate_ret_value)
{
const char *auth_name = NULL;
int set_basic = 0;
char *negoauth_param;
/* get the user realm specified in .htaccess */
auth_name = ap_auth_name(r);
if (conf->gss_debug)
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"note_gss_auth_failure: auth_name = %s",
auth_name ? auth_name : "<undefined>");
if (negotiate_ret_value != NULL) {
negoauth_param = (*negotiate_ret_value == '\0') ? "Negotiate" :
apr_pstrcat(r->pool, "Negotiate ", negotiate_ret_value, NULL);
apr_table_add(r->err_headers_out, "WWW-Authenticate", negoauth_param);
}
}
int
gss_authenticate(request_rec *r)
{
int ret;
gss_auth_config *conf =
(gss_auth_config *) ap_get_module_config(r->per_dir_config,
&auth_gss_module);
const char *auth_type = NULL;
const char *auth_line = NULL;
const char *type = NULL;
char *negotiate_ret_value;
static int last_return = HTTP_UNAUTHORIZED;
/* get the type specified in .htaccess */
type = ap_auth_type(r);
if (conf->gss_debug)
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"gss_authenticate: type = %s", type);
if (type == NULL || (strcasecmp(type, "GSSAPI") != 0)) {
return DECLINED;
}
/* get what the user sent us in the HTTP header */
auth_line = apr_table_get(r->headers_in, "Authorization");
if (!auth_line) {
if (conf->gss_debug)
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"No authentication data found");
note_gss_auth_failure(r, conf, "\0");
return HTTP_UNAUTHORIZED;
}
auth_type = ap_getword_white(r->pool, &auth_line);
if (already_succeeded(r))
return last_return;
if (strcasecmp(auth_type, "Negotiate") == 0) {
ret = authenticate_user_gss(r, conf, auth_line, &negotiate_ret_value);
} else {
ret = HTTP_UNAUTHORIZED;
}
if (ret == HTTP_UNAUTHORIZED) {
if (conf->gss_debug)
log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"Authentication failed.");
note_gss_auth_failure(r, conf, negotiate_ret_value);
}
last_return = ret;
return ret;
}