1 files changed, 17 insertions, 184 deletions

diff --git a/lib/http_negotiate_sspi.c b/lib/http_negotiate_sspi.c
index 2d869ae88..c79b55102 100644
--- a/lib/http_negotiate_sspi.c
+++ b/lib/http_negotiate_sspi.c
@@ -29,11 +29,8 @@
 #include "urldata.h"
 #include "sendf.h"
 #include "rawstr.h"
-#include "warnless.h"
-#include "curl_base64.h"
 #include "vauth/vauth.h"
 #include "http_negotiate.h"
-#include "curl_multibyte.h"
 #include "curl_printf.h"
 
 /* The last #include files should be: */
@@ -44,20 +41,13 @@ CURLcode Curl_input_negotiate(struct connectdata *conn, bool proxy,
                               const char *header)
 {
   struct SessionHandle *data = conn->data;
-  BYTE              *input_token = NULL;
-  SecBufferDesc     out_buff_desc;
-  SecBuffer         out_sec_buff;
-  SecBufferDesc     in_buff_desc;
-  SecBuffer         in_sec_buff;
-  SECURITY_STATUS   status;
-  unsigned long     attrs;
-  TimeStamp         expiry; /* For Windows 9x compatibility of SSPI calls */
-  size_t len = 0, input_token_len = 0;
-  CURLcode result;
+  size_t len;
 
-  /* Point to the username and password */
+  /* Point to the username, password, service and host */
   const char *userp;
   const char *passwdp;
+  const char *service;
+  const char *host;
 
   /* Point to the correct struct with this */
   struct negotiatedata *neg_ctx;
@@ -65,11 +55,15 @@ CURLcode Curl_input_negotiate(struct connectdata *conn, bool proxy,
   if(proxy) {
     userp = conn->proxyuser;
     passwdp = conn->proxypasswd;
+    service = data->set.str[STRING_PROXY_SERVICE_NAME];
+    host = conn->host.name;
     neg_ctx = &data->state.proxyneg;
   }
   else {
     userp = conn->user;
     passwdp = conn->passwd;
+    service = data->set.str[STRING_SERVICE_NAME];
+    host = conn->proxy.name;
     neg_ctx = &data->state.negotiate;
   }
 
@@ -80,43 +74,6 @@ CURLcode Curl_input_negotiate(struct connectdata *conn, bool proxy,
   if(!passwdp)
     passwdp = "";
 
-  if(neg_ctx->context && neg_ctx->status == SEC_E_OK) {
-    /* We finished successfully our part of authentication, but server
-     * rejected it (since we're again here). Exit with an error since we
-     * can't invent anything better */
-    Curl_cleanup_negotiate(data);
-    return CURLE_LOGIN_DENIED;
-  }
-
-  if(!neg_ctx->server_name) {
-    /* Check proxy auth requested but no given proxy name */
-    if(proxy && !conn->proxy.name)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-
-    /* Generate our SPN */
-    neg_ctx->server_name = Curl_auth_build_spn(
-      proxy ? data->set.str[STRING_PROXY_SERVICE_NAME] :
-      data->set.str[STRING_SERVICE_NAME],
-      proxy ? conn->proxy.name : conn->host.name);
-    if(!neg_ctx->server_name)
-      return CURLE_OUT_OF_MEMORY;
-  }
-
-  if(!neg_ctx->output_token) {
-    PSecPkgInfo SecurityPackage;
-    status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
-                                                TEXT(SP_NAME_NEGOTIATE),
-                                                &SecurityPackage);
-    if(status != SEC_E_OK)
-      return CURLE_NOT_BUILT_IN;
-
-    /* Allocate input and output buffers according to the max token size
-       as indicated by the security package */
-    neg_ctx->token_max = SecurityPackage->cbMaxToken;
-    neg_ctx->output_token = malloc(neg_ctx->token_max);
-    s_pSecFn->FreeContextBuffer(SecurityPackage);
-  }
-
   /* Obtain the input token, if any */
   header += strlen("Negotiate");
   while(*header && ISSPACE(*header))
@@ -130,124 +87,28 @@ CURLcode Curl_input_negotiate(struct connectdata *conn, bool proxy,
          negotiation mechanisms */
       return CURLE_LOGIN_DENIED;
     }
-
-    /* We have to acquire credentials and allocate memory for the context */
-    neg_ctx->credentials = malloc(sizeof(CredHandle));
-    neg_ctx->context = malloc(sizeof(CtxtHandle));
-
-    if(!neg_ctx->credentials || !neg_ctx->context)
-      return CURLE_OUT_OF_MEMORY;
-
-    if(userp && *userp) {
-      /* Populate our identity structure */
-      result = Curl_create_sspi_identity(userp, passwdp, &neg_ctx->identity);
-      if(result)
-        return result;
-
-      /* Allow proper cleanup of the identity structure */
-      neg_ctx->p_identity = &neg_ctx->identity;
-    }
-    else
-      /* Use the current Windows user */
-      neg_ctx->p_identity = NULL;
-
-    /* Acquire our credientials handle */
-    neg_ctx->status =
-      s_pSecFn->AcquireCredentialsHandle(NULL,
-                                         (TCHAR *) TEXT(SP_NAME_NEGOTIATE),
-                                         SECPKG_CRED_OUTBOUND, NULL,
-                                         neg_ctx->p_identity, NULL, NULL,
-                                         neg_ctx->credentials, &expiry);
-    if(neg_ctx->status != SEC_E_OK)
-      return CURLE_LOGIN_DENIED;
-  }
-  else {
-    result = Curl_base64_decode(header,
-                                (unsigned char **)&input_token,
-                                &input_token_len);
-    if(result)
-      return result;
-
-    if(!input_token_len) {
-      infof(data,
-            "Negotiate handshake failure (empty challenge message)\n");
-
-      return CURLE_BAD_CONTENT_ENCODING;
-    }
-  }
-
-  /* Setup the "output" security buffer */
-  out_buff_desc.ulVersion = SECBUFFER_VERSION;
-  out_buff_desc.cBuffers  = 1;
-  out_buff_desc.pBuffers  = &out_sec_buff;
-  out_sec_buff.BufferType = SECBUFFER_TOKEN;
-  out_sec_buff.pvBuffer   = neg_ctx->output_token;
-  out_sec_buff.cbBuffer   = curlx_uztoul(neg_ctx->token_max);
-
-  /* Setup the "input" security buffer if present */
-  if(input_token) {
-    in_buff_desc.ulVersion = SECBUFFER_VERSION;
-    in_buff_desc.cBuffers  = 1;
-    in_buff_desc.pBuffers  = &in_sec_buff;
-    in_sec_buff.BufferType = SECBUFFER_TOKEN;
-    in_sec_buff.pvBuffer   = input_token;
-    in_sec_buff.cbBuffer   = curlx_uztoul(input_token_len);
-  }
-
-  /* Generate our message */
-  neg_ctx->status = s_pSecFn->InitializeSecurityContext(
-    neg_ctx->credentials,
-    input_token ? neg_ctx->context : NULL,
-    neg_ctx->server_name,
-    ISC_REQ_CONFIDENTIALITY,
-    0,
-    SECURITY_NATIVE_DREP,
-    input_token ? &in_buff_desc : NULL,
-    0,
-    neg_ctx->context,
-    &out_buff_desc,
-    &attrs,
-    &expiry);
-
-  free(input_token);
-
-  if(GSS_ERROR(neg_ctx->status))
-    return CURLE_OUT_OF_MEMORY;
-
-  if(neg_ctx->status == SEC_I_COMPLETE_NEEDED ||
-     neg_ctx->status == SEC_I_COMPLETE_AND_CONTINUE) {
-    neg_ctx->status = s_pSecFn->CompleteAuthToken(neg_ctx->context,
-                                                  &out_buff_desc);
-    if(GSS_ERROR(neg_ctx->status))
-      return CURLE_RECV_ERROR;
   }
 
-  neg_ctx->output_token_length = out_sec_buff.cbBuffer;
-
-  return CURLE_OK;
+  /* Initilise the security context and decode our challenge */
+  return Curl_auth_decode_spnego_message(data, userp, passwdp, service, host,
+                                         header, neg_ctx);
 }
 
 CURLcode Curl_output_negotiate(struct connectdata *conn, bool proxy)
 {
   struct negotiatedata *neg_ctx = proxy?&conn->data->state.proxyneg:
     &conn->data->state.negotiate;
-  char *encoded = NULL;
+  char *base64 = NULL;
   size_t len = 0;
   char *userp;
   CURLcode result;
 
-  result = Curl_base64_encode(conn->data,
-                              (const char*)neg_ctx->output_token,
-                              neg_ctx->output_token_length,
-                              &encoded, &len);
+  result = Curl_auth_create_spnego_message(conn->data, neg_ctx, &base64, &len);
   if(result)
     return result;
 
-  if(!len)
-    return CURLE_REMOTE_ACCESS_DENIED;
-
   userp = aprintf("%sAuthorization: Negotiate %s\r\n", proxy ? "Proxy-" : "",
-                  encoded);
+                  base64);
 
   if(proxy) {
     Curl_safefree(conn->allocptr.proxyuserpwd);
@@ -258,43 +119,15 @@ CURLcode Curl_output_negotiate(struct connectdata *conn, bool proxy)
     conn->allocptr.userpwd = userp;
   }
 
-  free(encoded);
+  free(base64);
 
   return (userp == NULL) ? CURLE_OUT_OF_MEMORY : CURLE_OK;
 }
 
-static void cleanup(struct negotiatedata *neg_ctx)
-{
-  /* Free our security context */
-  if(neg_ctx->context) {
-    s_pSecFn->DeleteSecurityContext(neg_ctx->context);
-    free(neg_ctx->context);
-    neg_ctx->context = NULL;
-  }
-
-  /* Free our credentials handle */
-  if(neg_ctx->credentials) {
-    s_pSecFn->FreeCredentialsHandle(neg_ctx->credentials);
-    free(neg_ctx->credentials);
-    neg_ctx->credentials = NULL;
-  }
-
-  /* Free our identity */
-  Curl_sspi_free_identity(neg_ctx->p_identity);
-  neg_ctx->p_identity = NULL;
-
-  /* Free the SPN and output token */
-  Curl_safefree(neg_ctx->server_name);
-  Curl_safefree(neg_ctx->output_token);
-
-  /* Reset any variables */
-  neg_ctx->token_max = 0;
-}
-
 void Curl_cleanup_negotiate(struct SessionHandle *data)
 {
-  cleanup(&data->state.negotiate);
-  cleanup(&data->state.proxyneg);
+  Curl_auth_spnego_cleanup(&data->state.negotiate);
+  Curl_auth_spnego_cleanup(&data->state.proxyneg);
 }
 
 #endif /* !CURL_DISABLE_HTTP && USE_SPNEGO */