1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
|
/*
* Copyright (c) 2015 Isode Limited.
* All rights reserved.
* See the COPYING file for more information.
*/
#include <Swiften/SASL/WindowsGSSAPIClientAuthenticator.h>
#include <Swiften/Base/Log.h>
#include <Swiften/SASL/WindowsAuthentication.h>
#include <Swiften/SASL/WindowsServicePrincipalName.h>
#define SECURITY_LAYER_NONE 1
namespace Swift {
WindowsGSSAPIClientAuthenticator::WindowsGSSAPIClientAuthenticator(const std::string& hostname, const std::string& domainname) : ClientAuthenticator("GSSAPI"), step_(BuildingSecurityContext), error_(false), haveCredentialsHandle_(false), haveContextHandle_(false), haveCompleteContext_(false) {
WindowsServicePrincipalName servicePrincipalName(domainname);
servicePrincipalName.setInstanceName(hostname);
servicePrincipalNameString_ = servicePrincipalName.toString();
errorCode_ = acquireCredentialsHandle(&credentialsHandle_);
if (isError()) {
return;
}
else {
haveCredentialsHandle_ = true;
}
buildSecurityContext(NULL);
}
WindowsGSSAPIClientAuthenticator::~WindowsGSSAPIClientAuthenticator() {
if (haveContextHandle_) {
deleteSecurityContext(&contextHandle_);
}
if (haveCredentialsHandle_) {
freeCredentialsHandle(&credentialsHandle_);
}
}
boost::optional<SafeByteArray> WindowsGSSAPIClientAuthenticator::getResponse() const {
SWIFT_LOG(debug) << "response_.size(): " << response_.size() << std::endl;
return response_;
}
bool WindowsGSSAPIClientAuthenticator::setChallenge(const boost::optional<ByteArray>& challengeData) {
/* Following http://tools.ietf.org/html/rfc4752, https://msdn.microsoft.com/en-us/library/windows/desktop/aa380496%28v=vs.85%29.aspx */
if (step_ == BuildingSecurityContext) {
buildSecurityContext(challengeData);
}
else if (step_ == SecurityLayerNegotiation) {
if (!challengeData) {
SWIFT_LOG(debug) << "Empty message received from the server" << std::endl;
error_ = true;
return false;
}
SafeByteArray challenge;
errorCode_ = decryptMessage(&contextHandle_, challengeData.get(), challenge);
if (isError()) {
return false;
}
if (challenge.size() != 4) {
SWIFT_LOG(debug) << "Token received from the server of incorrect length: " << challenge.size() << std::endl;
error_ = true;
return false;
}
unsigned char* challengePointer = vecptr(challenge);
unsigned char serverSecurityLayer = challengePointer[0];
if (serverSecurityLayer == 0) {
SWIFT_LOG(debug) << "Server supports unknown security layer, assuming no security layer" << std::endl;
serverSecurityLayer = SECURITY_LAYER_NONE;
}
else if (serverSecurityLayer == SECURITY_LAYER_NONE) {
SWIFT_LOG(debug) << "Server supports no security layer" << std::endl;
}
else {
SWIFT_LOG(debug) << "Server supports security layer" << std::endl;
}
unsigned int serverMaximumBuffer = (challengePointer[1] << 16) |
(challengePointer[2] << 8) |
(challengePointer[3] << 0);
if ((serverSecurityLayer == SECURITY_LAYER_NONE) && (serverMaximumBuffer != 0)) {
SWIFT_LOG(debug) << "Server supports no security layer but has maximum buffer size" << serverMaximumBuffer << std::endl;
error_ = true;
return false;
}
SafeByteArray message(4);
/* Commenting this out as streamSizes was not obtained before
if (message.size() > streamSizes_.cbMaximumMessage) {
error_ = true;
return false;
} */
unsigned char* messagePointer = vecptr(message);
messagePointer[0] = SECURITY_LAYER_NONE;
/* The next 3 bytes indicate the client's maximum size buffer which is set to 0 as we do not support a security layer */
messagePointer[1] = 0;
messagePointer[2] = 0;
messagePointer[3] = 0;
/* The authorization identity is omitted as it is the same as the authentication identity */
errorCode_ = encryptMessage(&contextHandle_, sizes_, message, response_);
if (isError()) {
return false;
}
step_ = ServerAuthenticated;
}
if (isError()) {
return false;
}
return true;
}
bool WindowsGSSAPIClientAuthenticator::isError() {
if (error_) {
return true;
}
if (!errorCode_) {
return false;
}
return true;
}
void WindowsGSSAPIClientAuthenticator::buildSecurityContext(const boost::optional<ByteArray>& inputToken) {
ULONG contextSupported;
/* An XMPP server may not support Kerberos encryption or SASL security layer so not requesting integrity or confidentiality */
errorCode_ = initializeSecurityContext(inputToken, servicePrincipalNameString_, &credentialsHandle_, haveContextHandle_, &contextHandle_, ISC_REQ_MUTUAL_AUTH, &contextSupported, &haveCompleteContext_, response_);
if (isError()) {
return;
}
haveContextHandle_ = true;
if (!haveCompleteContext_) {
return;
}
if (contextSupported & ISC_REQ_MUTUAL_AUTH == 0) {
SWIFT_LOG(debug) << "Mutual authentication not supported" << std::endl;
error_ = true;
return;
}
errorCode_ = queryContextAttributes(&contextHandle_, SECPKG_ATTR_SIZES, &sizes_);
if (isError()) {
return;
}
/* Commenting this out as it gives the error code 0x80090302: The function requested is not supported
errorCode_ = queryContextAttributes(&contextHandle_, SECPKG_ATTR_STREAM_SIZES, &streamSizes_);
if (isError()) {
return;
}*/
SecPkgContext_Names names;
errorCode_ = queryContextAttributes(&contextHandle_, SECPKG_ATTR_NAMES, &names);
if (isError()) {
return;
}
userName_ = names.sUserName;
SWIFT_LOG(debug) << "User name: " << userName_ << std::endl;
std::size_t position = userName_.find("\\");
clientName_ = userName_.substr(position + 1);
SWIFT_LOG(debug) << "Client name: " << clientName_ << std::endl;
serverName_ = userName_.substr(0, position);
SWIFT_LOG(debug) << "Server name: " << serverName_ << std::endl;
freeContextBuffer(names.sUserName);
step_ = SecurityLayerNegotiation;
}
}
|
Swift