extensions/auth/nsAuthSSPI.cpp

   1 /* vim:set ts=4 sw=4 sts=4 et cindent: */
   2 /* ***** BEGIN LICENSE BLOCK *****
   3  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   4  *
   5  * The contents of this file are subject to the Mozilla Public License Version
   6  * 1.1 (the "License"); you may not use this file except in compliance with
   7  * the License. You may obtain a copy of the License at
   8  * http://www.mozilla.org/MPL/
   9  *
  10  * Software distributed under the License is distributed on an "AS IS" basis,
  11  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  12  * for the specific language governing rights and limitations under the
  13  * License.
  14  *
  15  * The Original Code is the SSPI NegotiateAuth Module
  16  *
  17  * The Initial Developer of the Original Code is IBM Corporation.
  18  * Portions created by the Initial Developer are Copyright (C) 2004
  19  * the Initial Developer. All Rights Reserved.
  20  *
  21  * Contributor(s):
  22  *   Darin Fisher <darin@meer.net>
  23  *
  24  * Alternatively, the contents of this file may be used under the terms of
  25  * either the GNU General Public License Version 2 or later (the "GPL"), or
  26  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  27  * in which case the provisions of the GPL or the LGPL are applicable instead
  28  * of those above. If you wish to allow use of your version of this file only
  29  * under the terms of either the GPL or the LGPL, and not to allow others to
  30  * use your version of this file under the terms of the MPL, indicate your
  31  * decision by deleting the provisions above and replace them with the notice
  32  * and other provisions required by the GPL or the LGPL. If you do not delete
  33  * the provisions above, a recipient may use your version of this file under
  34  * the terms of any one of the MPL, the GPL or the LGPL.
  35  *
  36  * ***** END LICENSE BLOCK ***** */
  37
  38 //
  39 // Negotiate Authentication Support Module
  40 //
  41 // Described by IETF Internet draft: draft-brezak-kerberos-http-00.txt
  42 // (formerly draft-brezak-spnego-http-04.txt)
  43 //
  44 // Also described here:
  45 // http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsecure/html/http-sso-1.asp
  46 //
  47
  48 #include "nsAuthSSPI.h"
  49 #include "nsIServiceManager.h"
  50 #include "nsIDNSService.h"
  51 #include "nsIDNSRecord.h"
  52 #include "nsNetCID.h"
  53 #include "nsCOMPtr.h"
  54
  55 #define SEC_SUCCESS(Status) ((Status) >= 0)
  56
  57 #ifndef KERB_WRAP_NO_ENCRYPT
  58 #define KERB_WRAP_NO_ENCRYPT 0x80000001
  59 #endif
  60
  61 #ifndef SECBUFFER_PADDING
  62 #define SECBUFFER_PADDING 9
  63 #endif
  64
  65 #ifndef SECBUFFER_STREAM
  66 #define SECBUFFER_STREAM 10
  67 #endif
  68
  69 //-----------------------------------------------------------------------------
  70
  71 static const char *const pTypeName [] = {
  72     "Kerberos",
  73     "Negotiate",
  74     "NTLM"
  75 };
  76
  77 #ifdef DEBUG
  78 #define CASE_(_x) case _x: return # _x;
  79 static const char *MapErrorCode(int rc)
  80 {
  81     switch (rc) {
  82     CASE_(SEC_E_OK)
  83     CASE_(SEC_I_CONTINUE_NEEDED)
  84     CASE_(SEC_I_COMPLETE_NEEDED)
  85     CASE_(SEC_I_COMPLETE_AND_CONTINUE)
  86     CASE_(SEC_E_INCOMPLETE_MESSAGE)
  87     CASE_(SEC_I_INCOMPLETE_CREDENTIALS)
  88     CASE_(SEC_E_INVALID_HANDLE)
  89     CASE_(SEC_E_TARGET_UNKNOWN)
  90     CASE_(SEC_E_LOGON_DENIED)
  91     CASE_(SEC_E_INTERNAL_ERROR)
  92     CASE_(SEC_E_NO_CREDENTIALS)
  93     CASE_(SEC_E_NO_AUTHENTICATING_AUTHORITY)
  94     CASE_(SEC_E_INSUFFICIENT_MEMORY)
  95     CASE_(SEC_E_INVALID_TOKEN)
  96     }
  97     return "<unknown>";
  98 }
  99 #else
 100 #define MapErrorCode(_rc) ""
 101 #endif
 102
 103 //-----------------------------------------------------------------------------
 104
 105 static HINSTANCE                 sspi_lib;
 106 static PSecurityFunctionTable    sspi;
 107
 108 static nsresult
 109 InitSSPI()
 110 {
 111     PSecurityFunctionTable (*initFun)(void);
 112
 113     LOG(("  InitSSPI\n"));
 114
 115     sspi_lib = LoadLibrary("secur32.dll");
 116     if (!sspi_lib) {
 117         sspi_lib = LoadLibrary("security.dll");
 118         if (!sspi_lib) {
 119             LOG(("SSPI library not found"));
 120             return NS_ERROR_UNEXPECTED;
 121         }
 122     }
 123
 124     initFun = (PSecurityFunctionTable (*)(void))
 125             GetProcAddress(sspi_lib, "InitSecurityInterfaceA");
 126     if (!initFun) {
 127         LOG(("InitSecurityInterfaceA not found"));
 128         return NS_ERROR_UNEXPECTED;
 129     }
 130
 131     sspi = initFun();
 132     if (!sspi) {
 133         LOG(("InitSecurityInterfaceA failed"));
 134         return NS_ERROR_UNEXPECTED;
 135     }
 136
 137     return NS_OK;
 138 }
 139
 140 //-----------------------------------------------------------------------------
 141
 142 static nsresult
 143 MakeSN(const char *principal, nsCString &result)
 144 {
 145     nsresult rv;
 146
 147     nsCAutoString buf(principal);
 148
 149     // The service name looks like "protocol@hostname", we need to map
 150     // this to a value that SSPI expects.  To be consistent with IE, we
 151     // need to map '@' to '/' and canonicalize the hostname.
 152     PRInt32 index = buf.FindChar('@');
 153     if (index == kNotFound)
 154         return NS_ERROR_UNEXPECTED;
 155
 156     nsCOMPtr<nsIDNSService> dns = do_GetService(NS_DNSSERVICE_CONTRACTID, &rv);
 157     if (NS_FAILED(rv))
 158         return rv;
 159
 160     // This could be expensive if our DNS cache cannot satisfy the request.
 161     // However, we should have at least hit the OS resolver once prior to
 162     // reaching this code, so provided the OS resolver has this information
 163     // cached, we should not have to worry about blocking on this function call
 164     // for very long.  NOTE: because we ask for the canonical hostname, we
 165     // might end up requiring extra network activity in cases where the OS
 166     // resolver might not have enough information to satisfy the request from
 167     // its cache.  This is not an issue in versions of Windows up to WinXP.
 168     nsCOMPtr<nsIDNSRecord> record;
 169     rv = dns->Resolve(Substring(buf, index + 1),
 170                       nsIDNSService::RESOLVE_CANONICAL_NAME,
 171                       getter_AddRefs(record));
 172     if (NS_FAILED(rv))
 173         return rv;
 174
 175     nsCAutoString cname;
 176     rv = record->GetCanonicalName(cname);
 177     if (NS_SUCCEEDED(rv)) {
 178         result = StringHead(buf, index) + NS_LITERAL_CSTRING("/") + cname;
 179         LOG(("Using SPN of [%s]\n", result.get()));
 180     }
 181     return rv;
 182 }
 183
 184 //-----------------------------------------------------------------------------
 185
 186 nsAuthSSPI::nsAuthSSPI(pType package)
 187     : mServiceFlags(REQ_DEFAULT)
 188     , mMaxTokenLen(0)
 189     , mPackage(package)
 190 {
 191     memset(&mCred, 0, sizeof(mCred));
 192     memset(&mCtxt, 0, sizeof(mCtxt));
 193 }
 194
 195 nsAuthSSPI::~nsAuthSSPI()
 196 {
 197     Reset();
 198
 199     if (mCred.dwLower || mCred.dwUpper) {
 200 #ifdef __MINGW32__
 201         (sspi->FreeCredentialsHandle)(&mCred);
 202 #else
 203         (sspi->FreeCredentialHandle)(&mCred);
 204 #endif
 205         memset(&mCred, 0, sizeof(mCred));
 206     }
 207 }
 208
 209 void
 210 nsAuthSSPI::Reset()
 211 {
 212     if (mCtxt.dwLower || mCtxt.dwUpper) {
 213         (sspi->DeleteSecurityContext)(&mCtxt);
 214         memset(&mCtxt, 0, sizeof(mCtxt));
 215     }
 216 }
 217
 218 NS_IMPL_ISUPPORTS1(nsAuthSSPI, nsIAuthModule)
 219
 220 NS_IMETHODIMP
 221 nsAuthSSPI::Init(const char *serviceName,
 222                  PRUint32    serviceFlags,
 223                  const PRUnichar *domain,
 224                  const PRUnichar *username,
 225                  const PRUnichar *password)
 226 {
 227     LOG(("  nsAuthSSPI::Init\n"));
 228
 229     // we don't expect to be passed any user credentials
 230     NS_ASSERTION(!domain && !username && !password, "unexpected credentials");
 231
 232     // if we're configured for SPNEGO (Negotiate) or Kerberos, then it's critical
 233     // that the caller supply a service name to be used.
 234     if (mPackage != PACKAGE_TYPE_NTLM)
 235         NS_ENSURE_TRUE(serviceName && *serviceName, NS_ERROR_INVALID_ARG);
 236
 237     nsresult rv;
 238
 239     // XXX lazy initialization like this assumes that we are single threaded
 240     if (!sspi) {
 241         rv = InitSSPI();
 242         if (NS_FAILED(rv))
 243             return rv;
 244     }
 245
 246     SEC_CHAR *package;
 247
 248     package = (SEC_CHAR *) pTypeName[(int)mPackage];
 249
 250     if (mPackage != PACKAGE_TYPE_NTLM)
 251     {
 252         rv = MakeSN(serviceName, mServiceName);
 253         if (NS_FAILED(rv))
 254             return rv;
 255         mServiceFlags = serviceFlags;
 256     }
 257
 258     SECURITY_STATUS rc;
 259
 260     PSecPkgInfo pinfo;
 261     rc = (sspi->QuerySecurityPackageInfo)(package, &pinfo);
 262     if (rc != SEC_E_OK) {
 263         LOG(("%s package not found\n", package));
 264         return NS_ERROR_UNEXPECTED;
 265     }
 266     mMaxTokenLen = pinfo->cbMaxToken;
 267     (sspi->FreeContextBuffer)(pinfo);
 268
 269     TimeStamp useBefore;
 270
 271     rc = (sspi->AcquireCredentialsHandle)(NULL,
 272                                           package,
 273                                           SECPKG_CRED_OUTBOUND,
 274                                           NULL,
 275                                           NULL,
 276                                           NULL,
 277                                           NULL,
 278                                           &mCred,
 279                                           &useBefore);
 280     if (rc != SEC_E_OK)
 281         return NS_ERROR_UNEXPECTED;
 282
 283     return NS_OK;
 284 }
 285
 286 NS_IMETHODIMP
 287 nsAuthSSPI::GetNextToken(const void *inToken,
 288                          PRUint32    inTokenLen,
 289                          void      **outToken,
 290                          PRUint32   *outTokenLen)
 291 {
 292     SECURITY_STATUS rc;
 293     TimeStamp ignored;
 294
 295     DWORD ctxAttr, ctxReq = 0;
 296     CtxtHandle *ctxIn;
 297     SecBufferDesc ibd, obd;
 298     SecBuffer ib, ob;
 299
 300     LOG(("entering nsAuthSSPI::GetNextToken()\n"));
 301
 302     if (mServiceFlags & REQ_DELEGATE)
 303         ctxReq |= ISC_REQ_DELEGATE;
 304     if (mServiceFlags & REQ_MUTUAL_AUTH)
 305         ctxReq |= ISC_REQ_MUTUAL_AUTH;
 306
 307     if (inToken) {
 308         ib.BufferType = SECBUFFER_TOKEN;
 309         ib.cbBuffer = inTokenLen;
 310         ib.pvBuffer = (void *) inToken;
 311         ibd.ulVersion = SECBUFFER_VERSION;
 312         ibd.cBuffers = 1;
 313         ibd.pBuffers = &ib;
 314         ctxIn = &mCtxt;
 315     }
 316     else {
 317         // If there is no input token, then we are starting a new
 318         // authentication sequence.  If we have already initialized our
 319         // security context, then we're in trouble because it means that the
 320         // first sequence failed.  We need to bail or else we might end up in
 321         // an infinite loop.
 322         if (mCtxt.dwLower || mCtxt.dwUpper) {
 323             LOG(("Cannot restart authentication sequence!"));
 324             return NS_ERROR_UNEXPECTED;
 325         }
 326
 327         ctxIn = NULL;
 328     }
 329
 330     obd.ulVersion = SECBUFFER_VERSION;
 331     obd.cBuffers = 1;
 332     obd.pBuffers = &ob;
 333     ob.BufferType = SECBUFFER_TOKEN;
 334     ob.cbBuffer = mMaxTokenLen;
 335     ob.pvBuffer = nsMemory::Alloc(ob.cbBuffer);
 336     if (!ob.pvBuffer)
 337         return NS_ERROR_OUT_OF_MEMORY;
 338     memset(ob.pvBuffer, 0, ob.cbBuffer);
 339
 340     SEC_CHAR *sn;
 341
 342     if (mPackage == PACKAGE_TYPE_NTLM)
 343         sn = NULL;
 344     else
 345         sn = (SEC_CHAR *) mServiceName.get();
 346
 347     rc = (sspi->InitializeSecurityContext)(&mCred,
 348                                            ctxIn,
 349                                            sn,
 350                                            ctxReq,
 351                                            0,
 352                                            SECURITY_NATIVE_DREP,
 353                                            inToken ? &ibd : NULL,
 354                                            0,
 355                                            &mCtxt,
 356                                            &obd,
 357                                            &ctxAttr,
 358                                            &ignored);
 359     if (rc == SEC_I_CONTINUE_NEEDED || rc == SEC_E_OK) {
 360         if (!ob.cbBuffer) {
 361             nsMemory::Free(ob.pvBuffer);
 362             ob.pvBuffer = NULL;
 363         }
 364         *outToken = ob.pvBuffer;
 365         *outTokenLen = ob.cbBuffer;
 366
 367         if (rc == SEC_E_OK)
 368             return NS_SUCCESS_AUTH_FINISHED;
 369
 370         return NS_OK;
 371     }
 372
 373     LOG(("InitializeSecurityContext failed [rc=%d:%s]\n", rc, MapErrorCode(rc)));
 374     Reset();
 375     nsMemory::Free(ob.pvBuffer);
 376     return NS_ERROR_FAILURE;
 377 }
 378
 379 NS_IMETHODIMP
 380 nsAuthSSPI::Unwrap(const void *inToken,
 381                    PRUint32    inTokenLen,
 382                    void      **outToken,
 383                    PRUint32   *outTokenLen)
 384 {
 385     SECURITY_STATUS rc;
 386     SecBufferDesc ibd;
 387     SecBuffer ib[2];
 388
 389     ibd.cBuffers = 2;
 390     ibd.pBuffers = ib;
 391     ibd.ulVersion = SECBUFFER_VERSION;
 392
 393     // SSPI Buf
 394     ib[0].BufferType = SECBUFFER_STREAM;
 395     ib[0].cbBuffer = inTokenLen;
 396     ib[0].pvBuffer = nsMemory::Alloc(ib[0].cbBuffer);
 397     if (!ib[0].pvBuffer)
 398         return NS_ERROR_OUT_OF_MEMORY;
 399
 400     memcpy(ib[0].pvBuffer, inToken, inTokenLen);
 401
 402     // app data
 403     ib[1].BufferType = SECBUFFER_DATA;
 404     ib[1].cbBuffer = 0;
 405     ib[1].pvBuffer = NULL;
 406
 407     rc = (sspi->DecryptMessage)(
 408                                 &mCtxt,
 409                                 &ibd,
 410                                 0, // no sequence numbers
 411                                 NULL
 412                                 );
 413
 414     if (SEC_SUCCESS(rc)) {
 415         *outToken = ib[1].pvBuffer;
 416         *outTokenLen = ib[1].cbBuffer;
 417     }
 418     else
 419         nsMemory::Free(ib[1].pvBuffer);
 420
 421     nsMemory::Free(ib[0].pvBuffer);
 422
 423     if (!SEC_SUCCESS(rc))
 424         return NS_ERROR_FAILURE;
 425
 426     return NS_OK;
 427 }
 428
 429 // utility class used to free memory on exit
 430 class secBuffers
 431 {
 432 public:
 433
 434     SecBuffer ib[3];
 435
 436     secBuffers() { memset(&ib, 0, sizeof(ib)); }
 437
 438     ~secBuffers()
 439     {
 440         if (ib[0].pvBuffer)
 441             nsMemory::Free(ib[0].pvBuffer);
 442
 443         if (ib[1].pvBuffer)
 444             nsMemory::Free(ib[1].pvBuffer);
 445
 446         if (ib[2].pvBuffer)
 447             nsMemory::Free(ib[2].pvBuffer);
 448     }
 449 };
 450
 451 NS_IMETHODIMP
 452 nsAuthSSPI::Wrap(const void *inToken,
 453                  PRUint32    inTokenLen,
 454                  PRBool      confidential,
 455                  void      **outToken,
 456                  PRUint32   *outTokenLen)
 457 {
 458     SECURITY_STATUS rc;
 459
 460     SecBufferDesc ibd;
 461     secBuffers bufs;
 462     SecPkgContext_Sizes sizes;
 463
 464     rc = (sspi->QueryContextAttributes)(
 465          &mCtxt,
 466          SECPKG_ATTR_SIZES,
 467          &sizes);
 468
 469     if (!SEC_SUCCESS(rc))
 470         return NS_ERROR_FAILURE;
 471
 472     ibd.cBuffers = 3;
 473     ibd.pBuffers = bufs.ib;
 474     ibd.ulVersion = SECBUFFER_VERSION;
 475
 476     // SSPI
 477     bufs.ib[0].cbBuffer = sizes.cbSecurityTrailer;
 478     bufs.ib[0].BufferType = SECBUFFER_TOKEN;
 479     bufs.ib[0].pvBuffer = nsMemory::Alloc(sizes.cbSecurityTrailer);
 480
 481     if (!bufs.ib[0].pvBuffer)
 482         return NS_ERROR_OUT_OF_MEMORY;
 483
 484     // APP Data
 485     bufs.ib[1].BufferType = SECBUFFER_DATA;
 486     bufs.ib[1].pvBuffer = nsMemory::Alloc(inTokenLen);
 487     bufs.ib[1].cbBuffer = inTokenLen;
 488
 489     if (!bufs.ib[1].pvBuffer)
 490         return NS_ERROR_OUT_OF_MEMORY;
 491
 492     memcpy(bufs.ib[1].pvBuffer, inToken, inTokenLen);
 493
 494     // SSPI
 495     bufs.ib[2].BufferType = SECBUFFER_PADDING;
 496     bufs.ib[2].cbBuffer = sizes.cbBlockSize;
 497     bufs.ib[2].pvBuffer = nsMemory::Alloc(bufs.ib[2].cbBuffer);
 498
 499     if (!bufs.ib[2].pvBuffer)
 500         return NS_ERROR_OUT_OF_MEMORY;
 501
 502     rc = (sspi->EncryptMessage)(&mCtxt,
 503           confidential ? 0 : KERB_WRAP_NO_ENCRYPT,
 504          &ibd, 0);
 505
 506     if (SEC_SUCCESS(rc)) {
 507         int len  = bufs.ib[0].cbBuffer + bufs.ib[1].cbBuffer + bufs.ib[2].cbBuffer;
 508         char *p = (char *) nsMemory::Alloc(len);
 509
 510         if (!p)
 511             return NS_ERROR_OUT_OF_MEMORY;
 512
 513         *outToken = (void *) p;
 514         *outTokenLen = len;
 515
 516         memcpy(p, bufs.ib[0].pvBuffer, bufs.ib[0].cbBuffer);
 517         p += bufs.ib[0].cbBuffer;
 518
 519         memcpy(p,bufs.ib[1].pvBuffer, bufs.ib[1].cbBuffer);
 520         p += bufs.ib[1].cbBuffer;
 521
 522         memcpy(p,bufs.ib[2].pvBuffer, bufs.ib[2].cbBuffer);
 523
 524         return NS_OK;
 525     }
 526
 527     return NS_ERROR_FAILURE;
 528 }