← Commit list

f97f01f592

Daniel Stenberg
Daniel Stenberg
2026-05-05
SUCCESS Duration: 222s

Subject

socks_gssapi: simplify Curl_SOCKS5_gssapi_negotiate

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

lib/socks_gssapi.c +138 -80
lib/socks_gssapi.c+138 -80
@@ -98,37 +98,13 @@ static int check_gss_err(struct Curl_easy *data,
return 0;
}
-CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
- struct Curl_easy *data)
+static CURLcode socks5_gss_create_service_name(struct Curl_easy *data,
+ struct connectdata *conn,
+ const char *serviceptr,
+ gss_name_t *server)
{
- struct connectdata *conn = cf->conn;
- curl_socket_t sock = conn->sock[cf->sockindex];
- size_t actualread;
- size_t nwritten;
- CURLcode result;
OM_uint32 gss_major_status, gss_minor_status, gss_status;
- OM_uint32 gss_ret_flags;
- int gss_conf_state, gss_enc;
- gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
- gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
- gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
- gss_buffer_desc gss_w_token = GSS_C_EMPTY_BUFFER;
- gss_buffer_desc *gss_token = GSS_C_NO_BUFFER;
- gss_name_t server = GSS_C_NO_NAME;
- gss_name_t gss_client_name = GSS_C_NO_NAME;
- unsigned short us_length;
- unsigned char socksreq[4]; /* room for GSS-API exchange header only */
- const char *serviceptr = data->set.str[STRING_PROXY_SERVICE_NAME] ?
- data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd";
- gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
-
- /* GSS-API request looks like
- * +----+------+-----+----------------+
- * |VER | MTYP | LEN | TOKEN |
- * +----+------+----------------------+
- * | 1 | 1 | 2 | up to 2^16 - 1 |
- * +----+------+-----+----------------+
- */
+ gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
/* prepare service name */
if(strchr(serviceptr, '/')) {
@@ -138,7 +114,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
return CURLE_OUT_OF_MEMORY;
gss_major_status = gss_import_name(&gss_minor_status, &service,
- (gss_OID)GSS_C_NULL_OID, &server);
+ (gss_OID)GSS_C_NULL_OID, server);
}
else {
service.value = curl_maprintf("%s@%s", serviceptr,
@@ -148,7 +124,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
service.length = strlen(service.value);
gss_major_status = gss_import_name(&gss_minor_status, &service,
- GSS_C_NT_HOSTBASED_SERVICE, &server);
+ GSS_C_NT_HOSTBASED_SERVICE, server);
}
curlx_safefree(service.value);
@@ -157,25 +133,50 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
if(check_gss_err(data, gss_major_status,
gss_minor_status, "gss_import_name()")) {
failf(data, "Failed to create service name.");
- gss_release_name(&gss_status, &server);
+ gss_release_name(&gss_status, server);
return CURLE_COULDNT_CONNECT;
}
- (void)curlx_nonblock(sock, FALSE);
+ return CURLE_OK;
+}
+
+static CURLcode socks5_gss_auth_loop(struct Curl_cfilter *cf,
+ struct Curl_easy *data,
+ gss_name_t *server_ptr,
+ gss_ctx_id_t *gss_context,
+ OM_uint32 *gss_ret_flags)
+{
+ OM_uint32 gss_major_status, gss_minor_status, gss_status;
+ gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc *gss_token = GSS_C_NO_BUFFER;
+ unsigned short us_length;
+ unsigned char socksreq[4];
+ size_t actualread;
+ size_t nwritten;
+ CURLcode result;
+
+ /* GSS-API request looks like
+ * +----+------+-----+----------------+
+ * |VER | MTYP | LEN | TOKEN |
+ * +----+------+----------------------+
+ * | 1 | 1 | 2 | up to 2^16 - 1 |
+ * +----+------+-----+----------------+
+ */
/* As long as we need to keep sending some context info, and there is no
* errors, keep sending it... */
for(;;) {
gss_major_status = Curl_gss_init_sec_context(data,
&gss_minor_status,
- &gss_context,
- server,
+ gss_context,
+ *server_ptr,
&Curl_krb5_mech_oid,
NULL,
gss_token,
&gss_send_token,
TRUE,
- &gss_ret_flags);
+ gss_ret_flags);
if(gss_token != GSS_C_NO_BUFFER) {
curlx_safefree(gss_recv_token.value);
@@ -185,10 +186,10 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
gss_minor_status, "gss_init_sec_context") ||
/* the size needs to fit in a 16-bit field */
(gss_send_token.length > 0xffff)) {
- gss_release_name(&gss_status, &server);
+ gss_release_name(&gss_status, server_ptr);
gss_release_buffer(&gss_status, &gss_send_token);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
- failf(data, "Failed to initial GSS-API token.");
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
+ failf(data, "Failed to initialize GSS-API token.");
return CURLE_COULDNT_CONNECT;
}
@@ -202,9 +203,9 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
&nwritten);
if(result || (nwritten != 4)) {
failf(data, "Failed to send GSS-API authentication request.");
- gss_release_name(&gss_status, &server);
+ gss_release_name(&gss_status, server_ptr);
gss_release_buffer(&gss_status, &gss_send_token);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
@@ -213,9 +214,9 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
gss_send_token.length, FALSE, &nwritten);
if(result || (gss_send_token.length != nwritten)) {
failf(data, "Failed to send GSS-API authentication token.");
- gss_release_name(&gss_status, &server);
+ gss_release_name(&gss_status, server_ptr);
gss_release_buffer(&gss_status, &gss_send_token);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
}
@@ -237,8 +238,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
if(result || (actualread != 4)) {
failf(data, "Failed to receive GSS-API authentication response.");
- gss_release_name(&gss_status, &server);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ gss_release_name(&gss_status, server_ptr);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
@@ -246,16 +247,16 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
if(socksreq[1] == 255) { /* status / message type */
failf(data, "User was rejected by the SOCKS5 server (%d %d).",
socksreq[0], socksreq[1]);
- gss_release_name(&gss_status, &server);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ gss_release_name(&gss_status, server_ptr);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
if(socksreq[1] != 1) { /* status / message type */
failf(data, "Invalid GSS-API authentication response type (%d %d).",
socksreq[0], socksreq[1]);
- gss_release_name(&gss_status, &server);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ gss_release_name(&gss_status, server_ptr);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
@@ -264,8 +265,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
if(!us_length) {
failf(data, "Invalid zero-length GSS-API authentication token.");
- gss_release_name(&gss_status, &server);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ gss_release_name(&gss_status, server_ptr);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
@@ -275,8 +276,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
failf(data,
"Could not allocate memory for GSS-API authentication "
"response token.");
- gss_release_name(&gss_status, &server);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ gss_release_name(&gss_status, server_ptr);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_OUT_OF_MEMORY;
}
@@ -285,25 +286,34 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
if(result || (actualread != us_length)) {
failf(data, "Failed to receive GSS-API authentication token.");
- gss_release_name(&gss_status, &server);
+ gss_release_name(&gss_status, server_ptr);
curlx_safefree(gss_recv_token.value);
gss_recv_token.length = 0;
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
gss_token = &gss_recv_token;
}
- gss_release_name(&gss_status, &server);
+ gss_release_name(&gss_status, server_ptr);
+ return CURLE_OK;
+}
+
+static CURLcode socks5_gss_auth_verify(struct Curl_easy *data,
+ gss_ctx_id_t *gss_context)
+{
+ OM_uint32 gss_major_status, gss_minor_status, gss_status;
+ gss_name_t gss_client_name = GSS_C_NO_NAME;
+ gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
/* Everything is good so far, user was authenticated! */
- gss_major_status = gss_inquire_context(&gss_minor_status, gss_context,
+ gss_major_status = gss_inquire_context(&gss_minor_status, *gss_context,
&gss_client_name, NULL, NULL, NULL,
NULL, NULL, NULL);
if(check_gss_err(data, gss_major_status,
gss_minor_status, "gss_inquire_context")) {
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
gss_release_name(&gss_status, &gss_client_name);
failf(data, "Failed to determine username.");
return CURLE_COULDNT_CONNECT;
@@ -312,7 +322,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
&gss_send_token, NULL);
if(check_gss_err(data, gss_major_status,
gss_minor_status, "gss_display_name")) {
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
gss_release_name(&gss_status, &gss_client_name);
gss_release_buffer(&gss_status, &gss_send_token);
failf(data, "Failed to determine username.");
@@ -325,6 +335,26 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
gss_release_name(&gss_status, &gss_client_name);
gss_release_buffer(&gss_status, &gss_send_token);
+ return CURLE_OK;
+}
+
+static CURLcode socks5_gss_negotiate_enc(struct Curl_cfilter *cf,
+ struct Curl_easy *data,
+ gss_ctx_id_t *gss_context,
+ OM_uint32 gss_ret_flags)
+{
+ struct connectdata *conn = cf->conn;
+ OM_uint32 gss_major_status, gss_minor_status, gss_status;
+ gss_buffer_desc gss_send_token = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc gss_recv_token = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc gss_w_token = GSS_C_EMPTY_BUFFER;
+ unsigned short us_length;
+ unsigned char socksreq[4];
+ size_t actualread;
+ size_t nwritten;
+ CURLcode result;
+ int gss_enc;
+
/* Do encryption */
socksreq[0] = 1; /* GSS-API subnegotiation version */
socksreq[1] = 2; /* encryption message type */
@@ -379,19 +409,19 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
gss_send_token.length = 1;
gss_send_token.value = curlx_memdup(&gss_enc, gss_send_token.length);
if(!gss_send_token.value) {
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_OUT_OF_MEMORY;
}
- gss_major_status = gss_wrap(&gss_minor_status, gss_context, 0,
+ gss_major_status = gss_wrap(&gss_minor_status, *gss_context, 0,
GSS_C_QOP_DEFAULT, &gss_send_token,
- &gss_conf_state, &gss_w_token);
+ NULL, &gss_w_token);
if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_wrap")) {
curlx_safefree(gss_send_token.value);
gss_send_token.length = 0;
gss_release_buffer(&gss_status, &gss_w_token);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
failf(data, "Failed to wrap GSS-API encryption value into token.");
return CURLE_COULDNT_CONNECT;
}
@@ -406,7 +436,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
if(result || (nwritten != 4)) {
failf(data, "Failed to send GSS-API encryption request.");
gss_release_buffer(&gss_status, &gss_w_token);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
@@ -415,7 +445,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
result = Curl_conn_cf_send(cf->next, data, socksreq, 1, FALSE, &nwritten);
if(result || (nwritten != 1)) {
failf(data, "Failed to send GSS-API encryption type.");
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
}
@@ -425,7 +455,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
if(result || (gss_w_token.length != nwritten)) {
failf(data, "Failed to send GSS-API encryption type.");
gss_release_buffer(&gss_status, &gss_w_token);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
gss_release_buffer(&gss_status, &gss_w_token);
@@ -434,7 +464,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
if(result || (actualread != 4)) {
failf(data, "Failed to receive GSS-API encryption response.");
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
@@ -442,14 +472,14 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
if(socksreq[1] == 255) { /* status / message type */
failf(data, "User was rejected by the SOCKS5 server (%d %d).",
socksreq[0], socksreq[1]);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
if(socksreq[1] != 2) { /* status / message type */
failf(data, "Invalid GSS-API encryption response type (%d %d).",
socksreq[0], socksreq[1]);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
@@ -458,14 +488,14 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
if(!us_length) {
failf(data, "Invalid zero-length GSS-API encryption token.");
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
gss_recv_token.length = us_length;
gss_recv_token.value = curlx_malloc(gss_recv_token.length);
if(!gss_recv_token.value) {
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_OUT_OF_MEMORY;
}
result = Curl_blockread_all(cf, data, (char *)gss_recv_token.value,
@@ -475,20 +505,20 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
failf(data, "Failed to receive GSS-API encryption type.");
curlx_safefree(gss_recv_token.value);
gss_recv_token.length = 0;
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
if(!data->set.socks5_gssapi_nec) {
- gss_major_status = gss_unwrap(&gss_minor_status, gss_context,
+ gss_major_status = gss_unwrap(&gss_minor_status, *gss_context,
&gss_recv_token, &gss_w_token,
- 0, GSS_C_QOP_DEFAULT);
+ NULL, NULL);
if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_unwrap")) {
curlx_safefree(gss_recv_token.value);
gss_recv_token.length = 0;
gss_release_buffer(&gss_status, &gss_w_token);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
failf(data, "Failed to unwrap GSS-API encryption value into token.");
return CURLE_COULDNT_CONNECT;
}
@@ -499,7 +529,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
failf(data, "Invalid GSS-API encryption response length (%zu).",
gss_w_token.length);
gss_release_buffer(&gss_status, &gss_w_token);
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
@@ -512,7 +542,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
gss_recv_token.length);
curlx_safefree(gss_recv_token.value);
gss_recv_token.length = 0;
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
@@ -521,8 +551,6 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
gss_recv_token.length = 0;
}
- (void)curlx_nonblock(sock, TRUE);
-
infof(data, "SOCKS5 access with%s protection granted.",
(socksreq[0] == 0) ? "out GSS-API data" :
((socksreq[0] == 1) ? " GSS-API integrity" :
@@ -530,11 +558,41 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
conn->socks5_gssapi_enctype = socksreq[0];
if(socksreq[0] == 0)
- Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
+ Curl_gss_delete_sec_context(&gss_status, gss_context, NULL);
return CURLE_OK;
}
+CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
+ struct Curl_easy *data)
+{
+ struct connectdata *conn = cf->conn;
+ curl_socket_t sock = conn->sock[cf->sockindex];
+ CURLcode result;
+ OM_uint32 gss_ret_flags = 0;
+ gss_name_t server = GSS_C_NO_NAME;
+ const char *serviceptr =
+ data->set.str[STRING_PROXY_SERVICE_NAME] ?
+ data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd";
+ gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
+
+ result = socks5_gss_create_service_name(data, conn, serviceptr, &server);
+ if(!result) {
+ (void)curlx_nonblock(sock, FALSE);
+ result = socks5_gss_auth_loop(cf, data, &server, &gss_context,
+ &gss_ret_flags);
+ }
+ if(!result)
+ result = socks5_gss_auth_verify(data, &gss_context);
+ if(!result)
+ result = socks5_gss_negotiate_enc(cf, data, &gss_context, gss_ret_flags);
+
+ /* unconditionally put it back to non-blocking */
+ (void)curlx_nonblock(sock, TRUE);
+
+ return result;
+}
+
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
#pragma GCC diagnostic pop
#endif