krb5.c 9.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338
  1. /* GSSAPI/krb5 support for FTP - loosely based on old krb4.c
  2. *
  3. * Copyright (c) 1995, 1996, 1997, 1998, 1999, 2013 Kungliga Tekniska Högskolan
  4. * (Royal Institute of Technology, Stockholm, Sweden).
  5. * Copyright (c) 2004 - 2014 Daniel Stenberg
  6. * All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. *
  12. * 1. Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. *
  15. * 2. Redistributions in binary form must reproduce the above copyright
  16. * notice, this list of conditions and the following disclaimer in the
  17. * documentation and/or other materials provided with the distribution.
  18. *
  19. * 3. Neither the name of the Institute nor the names of its contributors
  20. * may be used to endorse or promote products derived from this software
  21. * without specific prior written permission.
  22. *
  23. * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26. * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33. * SUCH DAMAGE. */
  34. #include "curl_setup.h"
  35. #ifndef CURL_DISABLE_FTP
  36. #ifdef HAVE_GSSAPI
  37. #ifdef HAVE_OLD_GSSMIT
  38. #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
  39. #define NCOMPAT 1
  40. #endif
  41. #ifdef HAVE_NETDB_H
  42. #include <netdb.h>
  43. #endif
  44. #include "urldata.h"
  45. #include "curl_base64.h"
  46. #include "ftp.h"
  47. #include "curl_gssapi.h"
  48. #include "sendf.h"
  49. #include "curl_sec.h"
  50. #include "curl_memory.h"
  51. #include "warnless.h"
  52. #define _MPRINTF_REPLACE /* use our functions only */
  53. #include <curl/mprintf.h>
  54. /* The last #include file should be: */
  55. #include "memdebug.h"
  56. #define LOCAL_ADDR (&conn->local_addr)
  57. #define REMOTE_ADDR conn->ip_addr->ai_addr
  58. static int
  59. krb5_init(void *app_data)
  60. {
  61. gss_ctx_id_t *context = app_data;
  62. /* Make sure our context is initialized for krb5_end. */
  63. *context = GSS_C_NO_CONTEXT;
  64. return 0;
  65. }
  66. static int
  67. krb5_check_prot(void *app_data, int level)
  68. {
  69. (void)app_data; /* unused */
  70. if(level == PROT_CONFIDENTIAL)
  71. return -1;
  72. return 0;
  73. }
  74. static int
  75. krb5_decode(void *app_data, void *buf, int len,
  76. int level UNUSED_PARAM,
  77. struct connectdata *conn UNUSED_PARAM)
  78. {
  79. gss_ctx_id_t *context = app_data;
  80. OM_uint32 maj, min;
  81. gss_buffer_desc enc, dec;
  82. (void)level;
  83. (void)conn;
  84. enc.value = buf;
  85. enc.length = len;
  86. maj = gss_unseal(&min, *context, &enc, &dec, NULL, NULL);
  87. if(maj != GSS_S_COMPLETE) {
  88. if(len >= 4)
  89. strcpy(buf, "599 ");
  90. return -1;
  91. }
  92. memcpy(buf, dec.value, dec.length);
  93. len = curlx_uztosi(dec.length);
  94. gss_release_buffer(&min, &dec);
  95. return len;
  96. }
  97. static int
  98. krb5_overhead(void *app_data, int level, int len)
  99. {
  100. /* no arguments are used */
  101. (void)app_data;
  102. (void)level;
  103. (void)len;
  104. return 0;
  105. }
  106. static int
  107. krb5_encode(void *app_data, const void *from, int length, int level, void **to)
  108. {
  109. gss_ctx_id_t *context = app_data;
  110. gss_buffer_desc dec, enc;
  111. OM_uint32 maj, min;
  112. int state;
  113. int len;
  114. /* NOTE that the cast is safe, neither of the krb5, gnu gss and heimdal
  115. * libraries modify the input buffer in gss_seal()
  116. */
  117. dec.value = (void*)from;
  118. dec.length = length;
  119. maj = gss_seal(&min, *context,
  120. level == PROT_PRIVATE,
  121. GSS_C_QOP_DEFAULT,
  122. &dec, &state, &enc);
  123. if(maj != GSS_S_COMPLETE)
  124. return -1;
  125. /* malloc a new buffer, in case gss_release_buffer doesn't work as
  126. expected */
  127. *to = malloc(enc.length);
  128. if(!*to)
  129. return -1;
  130. memcpy(*to, enc.value, enc.length);
  131. len = curlx_uztosi(enc.length);
  132. gss_release_buffer(&min, &enc);
  133. return len;
  134. }
  135. static int
  136. krb5_auth(void *app_data, struct connectdata *conn)
  137. {
  138. int ret = AUTH_OK;
  139. char *p;
  140. const char *host = conn->host.name;
  141. ssize_t nread;
  142. curl_socklen_t l = sizeof(conn->local_addr);
  143. struct SessionHandle *data = conn->data;
  144. CURLcode result;
  145. const char *service = "ftp", *srv_host = "host";
  146. gss_buffer_desc input_buffer, output_buffer, _gssresp, *gssresp;
  147. OM_uint32 maj, min;
  148. gss_name_t gssname;
  149. gss_ctx_id_t *context = app_data;
  150. struct gss_channel_bindings_struct chan;
  151. size_t base64_sz = 0;
  152. if(getsockname(conn->sock[FIRSTSOCKET],
  153. (struct sockaddr *)LOCAL_ADDR, &l) < 0)
  154. perror("getsockname()");
  155. chan.initiator_addrtype = GSS_C_AF_INET;
  156. chan.initiator_address.length = l - 4;
  157. chan.initiator_address.value =
  158. &((struct sockaddr_in *)LOCAL_ADDR)->sin_addr.s_addr;
  159. chan.acceptor_addrtype = GSS_C_AF_INET;
  160. chan.acceptor_address.length = l - 4;
  161. chan.acceptor_address.value =
  162. &((struct sockaddr_in *)REMOTE_ADDR)->sin_addr.s_addr;
  163. chan.application_data.length = 0;
  164. chan.application_data.value = NULL;
  165. /* this loop will execute twice (once for service, once for host) */
  166. for(;;) {
  167. /* this really shouldn't be repeated here, but can't help it */
  168. if(service == srv_host) {
  169. result = Curl_ftpsendf(conn, "AUTH GSSAPI");
  170. if(result)
  171. return -2;
  172. if(Curl_GetFTPResponse(&nread, conn, NULL))
  173. return -1;
  174. if(data->state.buffer[0] != '3')
  175. return -1;
  176. }
  177. input_buffer.value = data->state.buffer;
  178. input_buffer.length = snprintf(input_buffer.value, BUFSIZE, "%s@%s",
  179. service, host);
  180. maj = gss_import_name(&min, &input_buffer, GSS_C_NT_HOSTBASED_SERVICE,
  181. &gssname);
  182. if(maj != GSS_S_COMPLETE) {
  183. gss_release_name(&min, &gssname);
  184. if(service == srv_host) {
  185. Curl_failf(data, "Error importing service name %s",
  186. input_buffer.value);
  187. return AUTH_ERROR;
  188. }
  189. service = srv_host;
  190. continue;
  191. }
  192. /* We pass NULL as |output_name_type| to avoid a leak. */
  193. gss_display_name(&min, gssname, &output_buffer, NULL);
  194. Curl_infof(data, "Trying against %s\n", output_buffer.value);
  195. gssresp = GSS_C_NO_BUFFER;
  196. *context = GSS_C_NO_CONTEXT;
  197. do {
  198. /* Release the buffer at each iteration to avoid leaking: the first time
  199. we are releasing the memory from gss_display_name. The last item is
  200. taken care by a final gss_release_buffer. */
  201. gss_release_buffer(&min, &output_buffer);
  202. ret = AUTH_OK;
  203. maj = Curl_gss_init_sec_context(data,
  204. &min,
  205. context,
  206. gssname,
  207. &Curl_krb5_mech_oid,
  208. &chan,
  209. gssresp,
  210. &output_buffer,
  211. NULL);
  212. if(gssresp) {
  213. free(_gssresp.value);
  214. gssresp = NULL;
  215. }
  216. if(GSS_ERROR(maj)) {
  217. Curl_infof(data, "Error creating security context\n");
  218. ret = AUTH_ERROR;
  219. break;
  220. }
  221. if(output_buffer.length != 0) {
  222. result = Curl_base64_encode(data, (char *)output_buffer.value,
  223. output_buffer.length, &p, &base64_sz);
  224. if(result) {
  225. Curl_infof(data,"base64-encoding: %s\n", curl_easy_strerror(result));
  226. ret = AUTH_CONTINUE;
  227. break;
  228. }
  229. result = Curl_ftpsendf(conn, "ADAT %s", p);
  230. free(p);
  231. if(result) {
  232. ret = -2;
  233. break;
  234. }
  235. if(Curl_GetFTPResponse(&nread, conn, NULL)) {
  236. ret = -1;
  237. break;
  238. }
  239. if(data->state.buffer[0] != '2' && data->state.buffer[0] != '3') {
  240. Curl_infof(data, "Server didn't accept auth data\n");
  241. ret = AUTH_ERROR;
  242. break;
  243. }
  244. p = data->state.buffer + 4;
  245. p = strstr(p, "ADAT=");
  246. if(p) {
  247. result = Curl_base64_decode(p + 5,
  248. (unsigned char **)&_gssresp.value,
  249. &_gssresp.length);
  250. if(result) {
  251. Curl_failf(data,"base64-decoding: %s", curl_easy_strerror(result));
  252. ret = AUTH_CONTINUE;
  253. break;
  254. }
  255. }
  256. gssresp = &_gssresp;
  257. }
  258. } while(maj == GSS_S_CONTINUE_NEEDED);
  259. gss_release_name(&min, &gssname);
  260. gss_release_buffer(&min, &output_buffer);
  261. if(gssresp)
  262. free(_gssresp.value);
  263. if(ret == AUTH_OK || service == srv_host)
  264. return ret;
  265. service = srv_host;
  266. }
  267. return ret;
  268. }
  269. static void krb5_end(void *app_data)
  270. {
  271. OM_uint32 min;
  272. gss_ctx_id_t *context = app_data;
  273. if(*context != GSS_C_NO_CONTEXT) {
  274. #ifdef DEBUGBUILD
  275. OM_uint32 maj =
  276. #endif
  277. gss_delete_sec_context(&min, context, GSS_C_NO_BUFFER);
  278. DEBUGASSERT(maj == GSS_S_COMPLETE);
  279. }
  280. }
  281. struct Curl_sec_client_mech Curl_krb5_client_mech = {
  282. "GSSAPI",
  283. sizeof(gss_ctx_id_t),
  284. krb5_init,
  285. krb5_auth,
  286. krb5_end,
  287. krb5_check_prot,
  288. krb5_overhead,
  289. krb5_encode,
  290. krb5_decode
  291. };
  292. #endif /* HAVE_GSSAPI */
  293. #endif /* CURL_DISABLE_FTP */