Pileus Git - ~andy/fetchmail/blob - gssapi.c

   1 /*
   2  * gssapi.c -- GSSAPI authentication (see RFC 1508)
   3  *
   4  * For license terms, see the file COPYING in this directory.
   5  */
   6
   7 #include  "config.h"
   8 #include  <stdio.h>
   9 #include  <string.h>
  10 #include  <ctype.h>
  11 #if defined(STDC_HEADERS)
  12 #include  <stdlib.h>
  13 #endif
  14 #include  "fetchmail.h"
  15 #include  "socket.h"
  16
  17 #include  "i18n.h"
  18 #include "md5.h"
  19
  20 #include <sys/types.h>
  21 #include <netinet/in.h>  /* for htonl/ntohl */
  22
  23 #ifdef GSSAPI
  24 #  ifdef HAVE_GSS_H
  25 #    include <gss.h>
  26 #  else
  27 #  if defined(HAVE_GSSAPI_H) && !defined(HAVE_GSSAPI_GSSAPI_H)
  28 #    include <gssapi.h>
  29 #  endif
  30 #  ifdef HAVE_GSSAPI_GSSAPI_H
  31 #    include <gssapi/gssapi.h>
  32 #  endif
  33 #  ifdef HAVE_GSSAPI_GSSAPI_GENERIC_H
  34 #    include <gssapi/gssapi_generic.h>
  35 #  endif
  36 #  ifndef HAVE_GSS_C_NT_HOSTBASED_SERVICE
  37 #    define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
  38 #  endif
  39 #  endif
  40
  41 #define GSSAUTH_P_NONE      1
  42 #define GSSAUTH_P_INTEGRITY 2
  43 #define GSSAUTH_P_PRIVACY   4
  44
  45 int do_gssauth(int sock, char *command, char *service, char *hostname, char *username)
  46 {
  47     gss_buffer_desc request_buf, send_token;
  48     gss_buffer_t sec_token;
  49     gss_name_t target_name;
  50     gss_ctx_id_t context;
  51     gss_OID mech_name;
  52     gss_qop_t quality;
  53     int cflags;
  54     OM_uint32 maj_stat, min_stat;
  55     char buf1[8192], buf2[8192], server_conf_flags;
  56     unsigned long buf_size;
  57     int result;
  58
  59     /* first things first: get an imap ticket for host */
  60     snprintf(buf1, sizeof(buf1), "%s@%s", service, hostname);
  61     request_buf.value = buf1;
  62     request_buf.length = strlen(buf1) + 1;
  63     maj_stat = gss_import_name(&min_stat, &request_buf, GSS_C_NT_HOSTBASED_SERVICE,
  64         &target_name);
  65     if (maj_stat != GSS_S_COMPLETE) {
  66         report(stderr, GT_("Couldn't get service name for [%s]\n"), buf1);
  67         return PS_AUTHFAIL;
  68     }
  69     else if (outlevel >= O_DEBUG) {
  70         gss_display_name(&min_stat, target_name, &request_buf, &mech_name);
  71         report(stderr, GT_("Using service name [%s]\n"),
  72                (char *)request_buf.value);
  73         gss_release_buffer(&min_stat, &request_buf);
  74     }
  75
  76     gen_send(sock, "%s GSSAPI", command);
  77
  78     /* upon receipt of the GSSAPI authentication request, server returns
  79      * null data ready response. */
  80     result = gen_recv(sock, buf1, sizeof buf1);
  81     if (result)
  82         return result;
  83
  84     /* now start the security context initialisation loop... */
  85     sec_token = GSS_C_NO_BUFFER;
  86     context = GSS_C_NO_CONTEXT;
  87     if (outlevel >= O_VERBOSE)
  88         report(stdout, GT_("Sending credentials\n"));
  89     do {
  90         send_token.length = 0;
  91         send_token.value = NULL;
  92         maj_stat = gss_init_sec_context(&min_stat,
  93                                         GSS_C_NO_CREDENTIAL,
  94                                         &context,
  95                                         target_name,
  96                                         GSS_C_NO_OID,
  97                                         GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG,
  98                                         0,
  99                                         GSS_C_NO_CHANNEL_BINDINGS,
 100                                         sec_token,
 101                                         NULL,
 102                                         &send_token,
 103                                         NULL,
 104                                         NULL);
 105         if (maj_stat!=GSS_S_COMPLETE && maj_stat!=GSS_S_CONTINUE_NEEDED) {
 106             report(stderr, GT_("Error exchanging credentials\n"));
 107             gss_release_name(&min_stat, &target_name);
 108             /* wake up server and await NO response */
 109             SockWrite(sock, "\r\n", 2);
 110             result = gen_recv(sock, buf1, sizeof buf1);
 111             if (result)
 112                 return result;
 113             return PS_AUTHFAIL;
 114         }
 115         to64frombits(buf1, send_token.value, send_token.length);
 116         gss_release_buffer(&min_stat, &send_token);
 117
 118         suppress_tags = TRUE;
 119         gen_send(sock, buf1, strlen(buf1));
 120         suppress_tags = FALSE;
 121
 122         if (maj_stat == GSS_S_CONTINUE_NEEDED) {
 123             result = gen_recv(sock, buf1, sizeof buf1);
 124             if (result) {
 125                 gss_release_name(&min_stat, &target_name);
 126                 return result;
 127             }
 128             request_buf.length = from64tobits(buf2, buf1 + 2, sizeof(buf2));
 129             if ((int)request_buf.length == -1)  /* in case of bad data */
 130                 request_buf.length = 0;
 131             request_buf.value = buf2;
 132             sec_token = &request_buf;
 133         }
 134     } while
 135         (maj_stat == GSS_S_CONTINUE_NEEDED);
 136     gss_release_name(&min_stat, &target_name);
 137
 138     /* get security flags and buffer size */
 139     result = gen_recv(sock, buf1, sizeof buf1);
 140     if (result)
 141         return result;
 142
 143     request_buf.length = from64tobits(buf2, buf1 + 2, sizeof(buf2));
 144     if ((int)request_buf.length == -1)  /* in case of bad data */
 145         request_buf.length = 0;
 146     request_buf.value = buf2;
 147
 148     maj_stat = gss_unwrap(&min_stat, context,
 149                           &request_buf, &send_token, &cflags, &quality);
 150     if (maj_stat != GSS_S_COMPLETE) {
 151         report(stderr, GT_("Couldn't unwrap security level data\n"));
 152         gss_release_buffer(&min_stat, &send_token);
 153         return PS_AUTHFAIL;
 154     }
 155     if (outlevel >= O_DEBUG)
 156         report(stdout, GT_("Credential exchange complete\n"));
 157     /* first octet is security levels supported. We want none, for now */
 158     server_conf_flags = ((char *)send_token.value)[0];
 159     if ( !(((char *)send_token.value)[0] & GSSAUTH_P_NONE) ) {
 160         report(stderr, GT_("Server requires integrity and/or privacy\n"));
 161         gss_release_buffer(&min_stat, &send_token);
 162         return PS_AUTHFAIL;
 163     }
 164     ((char *)send_token.value)[0] = 0;
 165     buf_size = ntohl(*((long *)send_token.value));
 166     /* we don't care about buffer size if we don't wrap data */
 167     gss_release_buffer(&min_stat, &send_token);
 168     if (outlevel >= O_DEBUG) {
 169         report(stdout, GT_("Unwrapped security level flags: %s%s%s\n"),
 170             server_conf_flags & GSSAUTH_P_NONE ? "N" : "-",
 171             server_conf_flags & GSSAUTH_P_INTEGRITY ? "I" : "-",
 172             server_conf_flags & GSSAUTH_P_PRIVACY ? "C" : "-");
 173         report(stdout, GT_("Maximum GSS token size is %ld\n"),buf_size);
 174     }
 175
 176     /* now respond in kind (hack!!!) */
 177     buf_size = htonl(buf_size); /* do as they do... only matters if we do enc */
 178     memcpy(buf1, &buf_size, 4);
 179     buf1[0] = GSSAUTH_P_NONE;
 180     strlcpy(buf1+4, username, sizeof(buf1) - 4); /* server decides if princ is user */
 181     request_buf.length = 4 + strlen(username) + 1;
 182     request_buf.value = buf1;
 183     maj_stat = gss_wrap(&min_stat, context, 0, GSS_C_QOP_DEFAULT, &request_buf,
 184         &cflags, &send_token);
 185     if (maj_stat != GSS_S_COMPLETE) {
 186         report(stderr, GT_("Error creating security level request\n"));
 187         return PS_AUTHFAIL;
 188     }
 189     to64frombits(buf1, send_token.value, send_token.length);
 190
 191     suppress_tags = TRUE;
 192     result = gen_transact(sock, buf1, strlen(buf1));
 193     suppress_tags = FALSE;
 194
 195     /* flush security context */
 196     if (outlevel >= O_DEBUG)
 197         report(stdout, GT_("Releasing GSS credentials\n"));
 198     maj_stat = gss_delete_sec_context(&min_stat, &context, &send_token);
 199     if (maj_stat != GSS_S_COMPLETE) {
 200         report(stderr, GT_("Error releasing credentials\n"));
 201         return PS_AUTHFAIL;
 202     }
 203     /* send_token may contain a notification to the server to flush
 204      * credentials. RFC 1731 doesn't specify what to do, and since this
 205      * support is only for authentication, we'll assume the server
 206      * knows enough to flush its own credentials */
 207     gss_release_buffer(&min_stat, &send_token);
 208
 209     if (result)
 210         return(result);
 211     else
 212         return(PS_SUCCESS);
 213 }
 214 #endif /* GSSAPI */
 215
 216 /* gssapi.c ends here */