3ca86602ef — curl

Subject

spnego_sspi: pass channel bindings on initial context

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

lib/vauth/ntlm_sspi.c +9 -3 lib/vauth/spnego_sspi.c +33 -25

lib/vauth/ntlm_sspi.c+9 -3

@@ -242,6 +242,9 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
	SecBufferDesc type_3_desc;
	SECURITY_STATUS status;
	unsigned long attrs;
+	#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
+	SecPkgContext_Bindings pkgBindings = { 0, NULL };
+	#endif

	(void)creds;

@@ -262,9 +265,6 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
	* https://learn.microsoft.com/security-updates/SecurityAdvisories/2009/973811
	*/
	if(ntlm->sslContext) {
-	SEC_CHANNEL_BINDINGS channelBindings;
-	SecPkgContext_Bindings pkgBindings;
-	pkgBindings.Bindings = &channelBindings;
	status = Curl_pSecFn->QueryContextAttributes(
	ntlm->sslContext,
	SECPKG_ATTR_ENDPOINT_BINDINGS,
@@ -296,6 +296,12 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
	0, ntlm->context,
	&type_3_desc,
	&attrs, NULL);
+
+	#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
+	if(pkgBindings.Bindings)
+	Curl_pSecFn->FreeContextBuffer(pkgBindings.Bindings);
+	#endif
+
	if(status != SEC_E_OK) {
	infof(data, "NTLM handshake failure (type-3 message): Status=0x%08lx",
	(unsigned long)status);

lib/vauth/spnego_sspi.c+33 -25

@@ -93,6 +93,9 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
	SecBufferDesc chlg_desc;
	SecBufferDesc resp_desc;
	unsigned long attrs;
+	#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
+	SecPkgContext_Bindings pkgBindings = { 0, NULL };
+	#endif

	if(nego->context && nego->status == SEC_E_OK) {
	/* We finished successfully our part of authentication, but server
@@ -194,6 +197,10 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
	return CURLE_OUT_OF_MEMORY;
	}

+	chlg_desc.ulVersion = SECBUFFER_VERSION;
+	chlg_desc.cBuffers = 0;
+	chlg_desc.pBuffers = chlg_buf;
+
	if(chlg64 && *chlg64) {
	/* Decode the base-64 encoded challenge message */
	if(*chlg64 != '=') {
@@ -209,38 +216,33 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
	}

	/* Setup the challenge "input" security buffer */
-	chlg_desc.ulVersion = SECBUFFER_VERSION;
	chlg_desc.cBuffers = 1;
-	chlg_desc.pBuffers = &chlg_buf[0];
	chlg_buf[0].BufferType = SECBUFFER_TOKEN;
	chlg_buf[0].pvBuffer = chlg;
	chlg_buf[0].cbBuffer = curlx_uztoul(chlglen);
+	}

	#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
-	/* SSL context comes from Schannel.
-	* When extended protection is used in IIS server,
-	* we have to pass a second SecBuffer to the SecBufferDesc
-	* otherwise IIS does not pass the authentication (401 response).
-	* Minimum supported version is Windows 7.
-	* https://learn.microsoft.com/security-updates/SecurityAdvisories/2009/973811
-	*/
-	if(nego->sslContext) {
-	SEC_CHANNEL_BINDINGS channelBindings;
-	SecPkgContext_Bindings pkgBindings;
-	pkgBindings.Bindings = &channelBindings;
-	nego->status = Curl_pSecFn->QueryContextAttributes(
-	nego->sslContext,
-	SECPKG_ATTR_ENDPOINT_BINDINGS,
-	&pkgBindings);
-	if(nego->status == SEC_E_OK) {
-	chlg_desc.cBuffers++;
-	chlg_buf[1].BufferType = SECBUFFER_CHANNEL_BINDINGS;
-	chlg_buf[1].cbBuffer = pkgBindings.BindingsLength;
-	chlg_buf[1].pvBuffer = pkgBindings.Bindings;
-	}
+	/* SSL context comes from Schannel.
+	* When extended protection is used in IIS server, pass its channel
+	* bindings on the initial call too. HTTP Negotiate can create and send a
+	* Kerberos token before receiving a challenge from the server.
+	* Minimum supported version is Windows 7.
+	* https://learn.microsoft.com/security-updates/SecurityAdvisories/2009/973811
+	*/
+	if(nego->sslContext) {
+	nego->status = Curl_pSecFn->QueryContextAttributes(
+	nego->sslContext,
+	SECPKG_ATTR_ENDPOINT_BINDINGS,
+	&pkgBindings);
+	if(nego->status == SEC_E_OK) {
+	SecBuffer *binding_buf = &chlg_buf[chlg_desc.cBuffers++];
+	binding_buf->BufferType = SECBUFFER_CHANNEL_BINDINGS;
+	binding_buf->cbBuffer = pkgBindings.BindingsLength;
+	binding_buf->pvBuffer = pkgBindings.Bindings;
	}
-	#endif
	}
+	#endif

	/* Setup the response "output" security buffer */
	resp_desc.ulVersion = SECBUFFER_VERSION;
@@ -261,11 +263,17 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
	nego->spn,
	sspi_flags,
	0, SECURITY_NATIVE_DREP,
-	chlg ? &chlg_desc : NULL,
+	chlg_desc.cBuffers ?
+	&chlg_desc : NULL,
	0, nego->context,
	&resp_desc, &attrs, NULL);
	}

+	#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
+	if(pkgBindings.Bindings)
+	Curl_pSecFn->FreeContextBuffer(pkgBindings.Bindings);
+	#endif
+
	/* Free the decoded challenge as it is not required anymore */
	curlx_free(chlg);