1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
9 *
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at https://curl.se/docs/copyright.html.
13 *
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
17 *
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
20 *
21 * SPDX-License-Identifier: curl
22 *
23 ***************************************************************************/
24
25 #include "curl_setup.h"
26
27 #include <curl/curl.h>
28
29 #include "vauth.h"
30 #include "urldata.h"
31 #include "strcase.h"
32 #include "curl_multibyte.h"
33 #include "curl_printf.h"
34
35 /* The last #include files should be: */
36 #include "curl_memory.h"
37 #include "memdebug.h"
38
39 /*
40 * Curl_auth_build_spn()
41 *
42 * This is used to build a SPN string in the following formats:
43 *
44 * service/host@realm (Not currently used)
45 * service/host (Not used by GSS-API)
46 * service@realm (Not used by Windows SSPI)
47 *
48 * Parameters:
49 *
50 * service [in] - The service type such as http, smtp, pop or imap.
51 * host [in] - The hostname.
52 * realm [in] - The realm.
53 *
54 * Returns a pointer to the newly allocated SPN.
55 */
56 #if !defined(USE_WINDOWS_SSPI)
Curl_auth_build_spn(const char * service,const char * host,const char * realm)57 char *Curl_auth_build_spn(const char *service, const char *host,
58 const char *realm)
59 {
60 char *spn = NULL;
61
62 /* Generate our SPN */
63 if(host && realm)
64 spn = aprintf("%s/%s@%s", service, host, realm);
65 else if(host)
66 spn = aprintf("%s/%s", service, host);
67 else if(realm)
68 spn = aprintf("%s@%s", service, realm);
69
70 /* Return our newly allocated SPN */
71 return spn;
72 }
73 #else
Curl_auth_build_spn(const char * service,const char * host,const char * realm)74 TCHAR *Curl_auth_build_spn(const char *service, const char *host,
75 const char *realm)
76 {
77 char *utf8_spn = NULL;
78 TCHAR *tchar_spn = NULL;
79 TCHAR *dupe_tchar_spn = NULL;
80
81 (void) realm;
82
83 /* Note: We could use DsMakeSPN() or DsClientMakeSpnForTargetServer() rather
84 than doing this ourselves but the first is only available in Windows XP
85 and Windows Server 2003 and the latter is only available in Windows 2000
86 but not Windows95/98/ME or Windows NT4.0 unless the Active Directory
87 Client Extensions are installed. As such it is far simpler for us to
88 formulate the SPN instead. */
89
90 /* Generate our UTF8 based SPN */
91 utf8_spn = aprintf("%s/%s", service, host);
92 if(!utf8_spn)
93 return NULL;
94
95 /* Allocate and return a TCHAR based SPN. Since curlx_convert_UTF8_to_tchar
96 must be freed by curlx_unicodefree we will dupe the result so that the
97 pointer this function returns can be normally free'd. */
98 tchar_spn = curlx_convert_UTF8_to_tchar(utf8_spn);
99 free(utf8_spn);
100 if(!tchar_spn)
101 return NULL;
102 dupe_tchar_spn = _tcsdup(tchar_spn);
103 curlx_unicodefree(tchar_spn);
104 return dupe_tchar_spn;
105 }
106 #endif /* USE_WINDOWS_SSPI */
107
108 /*
109 * Curl_auth_user_contains_domain()
110 *
111 * This is used to test if the specified user contains a Windows domain name as
112 * follows:
113 *
114 * Domain\User (Down-level Logon Name)
115 * Domain/User (curl Down-level format - for compatibility with existing code)
116 * User@Domain (User Principal Name)
117 *
118 * Note: The username may be empty when using a GSS-API library or Windows
119 * SSPI as the user and domain are either obtained from the credentials cache
120 * when using GSS-API or via the currently logged in user's credentials when
121 * using Windows SSPI.
122 *
123 * Parameters:
124 *
125 * user [in] - The username.
126 *
127 * Returns TRUE on success; otherwise FALSE.
128 */
Curl_auth_user_contains_domain(const char * user)129 bool Curl_auth_user_contains_domain(const char *user)
130 {
131 bool valid = FALSE;
132
133 if(user && *user) {
134 /* Check we have a domain name or UPN present */
135 char *p = strpbrk(user, "\\/@");
136
137 valid = (p != NULL && p > user && p < user + strlen(user) - 1);
138 }
139 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
140 else
141 /* User and domain are obtained from the GSS-API credentials cache or the
142 currently logged in user from Windows */
143 valid = TRUE;
144 #endif
145
146 return valid;
147 }
148
149 /*
150 * Curl_auth_ollowed_to_host() tells if authentication, cookies or other
151 * "sensitive data" can (still) be sent to this host.
152 */
Curl_auth_allowed_to_host(struct Curl_easy * data)153 bool Curl_auth_allowed_to_host(struct Curl_easy *data)
154 {
155 struct connectdata *conn = data->conn;
156 return (!data->state.this_is_a_follow ||
157 data->set.allow_auth_to_other_hosts ||
158 (data->state.first_host &&
159 strcasecompare(data->state.first_host, conn->host.name) &&
160 (data->state.first_remote_port == conn->remote_port) &&
161 (data->state.first_remote_protocol == conn->handler->protocol)));
162 }
163
