Support tls-server-end-point channel bindings for HTTP authentication.

net/http/http_auth_gssapi_posix.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_gssapi_posix.h"
 
 #include <limits>
 #include <string>
 
 #include "base/base64.h"
@@ skipping 682 matching lines @@
   if (scoped_sec_context_.get() == GSS_C_NO_CONTEXT) {
     return net::ParseFirstRoundChallenge(scheme_, tok);
   }
   std::string encoded_auth_token;
   return net::ParseLaterRoundChallenge(scheme_, tok, &encoded_auth_token,
                                        &decoded_server_auth_token_);
 }
 
 int HttpAuthGSSAPI::GenerateAuthToken(const AuthCredentials* credentials,
                                       const std::string& spn,
+                                      const std::string& channel_bindings,
                                       std::string* auth_token,
                                       const CompletionCallback& /*callback*/) {
   DCHECK(auth_token);
 
   gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
   input_token.length = decoded_server_auth_token_.length();
   input_token.value = (input_token.length > 0) ?
       const_cast<char*>(decoded_server_auth_token_.data()) :
       NULL;
   gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
   ScopedBuffer scoped_output_token(&output_token, library_);
-  int rv = GetNextSecurityToken(spn, &input_token, &output_token);
+  int rv =
+      GetNextSecurityToken(spn, channel_bindings, &input_token, &output_token);
   if (rv != OK)
     return rv;
 
   // Base64 encode data in output buffer and prepend the scheme.
   std::string encode_input(static_cast<char*>(output_token.value),
                            output_token.length);
   std::string encode_output;
   base::Base64Encode(encode_input, &encode_output);
   *auth_token = scheme_ + " " + encode_output;
   return OK;
@@ skipping 87 matching lines @@
                              GSS_S_UNSEQ_TOKEN | GSS_S_GAP_TOKEN))
     return ERR_INVALID_RESPONSE;
 
   // At this point, every documented status has been checked.
   return ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS;
 }
 
 }
 
 int HttpAuthGSSAPI::GetNextSecurityToken(const std::string& spn,
+                                         const std::string& channel_bindings,
                                          gss_buffer_t in_token,
                                          gss_buffer_t out_token) {
   // Create a name for the principal
   // TODO(cbentzel): Just do this on the first pass?
   std::string spn_principal = spn;
   gss_buffer_desc spn_buffer = GSS_C_EMPTY_BUFFER;
   spn_buffer.value = const_cast<char*>(spn_principal.c_str());
   spn_buffer.length = spn_principal.size() + 1;
   OM_uint32 minor_status = 0;
   gss_name_t principal_name = GSS_C_NO_NAME;
   OM_uint32 major_status = library_->import_name(
       &minor_status,
       &spn_buffer,
       GSS_C_NT_HOSTBASED_SERVICE,
       &principal_name);
   int rv = MapImportNameStatusToError(major_status);
   if (rv != OK) {
     LOG(ERROR) << "Problem importing name from "
                << "spn \"" << spn_principal << "\"\n"
                << DisplayExtendedStatus(library_, major_status, minor_status);
     return rv;
   }
   ScopedName scoped_name(principal_name, library_);
 
+  std::vector<char> channel_bindings_data;
+  scoped_ptr<gss_channel_bindings_struct> gss_channel_bindings;
+  if (!channel_bindings.empty()) {
+    gss_channel_bindings.reset(new gss_channel_bindings_struct);
+    memset(gss_channel_bindings.get(), 0, sizeof(gss_channel_bindings_struct));
+    channel_bindings_data.assign(channel_bindings.begin(),
+                                 channel_bindings.end());
+    gss_channel_bindings->application_data.value = channel_bindings_data.data();
+    gss_channel_bindings->application_data.length =
+        channel_bindings_data.size();
+  }
+
   // Continue creating a security context.
   OM_uint32 req_flags = 0;
   if (can_delegate_)
     req_flags |= GSS_C_DELEG_FLAG;
   major_status = library_->init_sec_context(
-      &minor_status,
-      GSS_C_NO_CREDENTIAL,
-      scoped_sec_context_.receive(),
-      principal_name,
-      gss_oid_,
-      req_flags,
-      GSS_C_INDEFINITE,
-      GSS_C_NO_CHANNEL_BINDINGS,
+      &minor_status, GSS_C_NO_CREDENTIAL, scoped_sec_context_.receive(),
+      principal_name, gss_oid_, req_flags, GSS_C_INDEFINITE,
+      gss_channel_bindings ? gss_channel_bindings.get()
+                           : GSS_C_NO_CHANNEL_BINDINGS,
       in_token,
-      NULL,  // actual_mech_type
+      nullptr,  // actual_mech_type
       out_token,
-      NULL,  // ret flags
-      NULL);
+      nullptr,  // ret flags
+      nullptr);
   rv = MapInitSecContextStatusToError(major_status);
   if (rv != OK) {
     LOG(ERROR) << "Problem initializing context. \n"
                << DisplayExtendedStatus(library_, major_status, minor_status)
                << '\n'
                << DescribeContext(library_, scoped_sec_context_.get());
   }
   return rv;
 }
 
 }  // namespace net