krb5.c 9.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343
  1. /* GSSAPI/krb5 support for FTP - loosely based on old krb4.c
  2. *
  3. * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
  4. * (Royal Institute of Technology, Stockholm, Sweden).
  5. * Copyright (c) 2004 - 2017 Daniel Stenberg
  6. * All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. *
  12. * 1. Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. *
  15. * 2. Redistributions in binary form must reproduce the above copyright
  16. * notice, this list of conditions and the following disclaimer in the
  17. * documentation and/or other materials provided with the distribution.
  18. *
  19. * 3. Neither the name of the Institute nor the names of its contributors
  20. * may be used to endorse or promote products derived from this software
  21. * without specific prior written permission.
  22. *
  23. * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26. * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33. * SUCH DAMAGE. */
  34. #include "curl_setup.h"
  35. #if defined(HAVE_GSSAPI) && !defined(CURL_DISABLE_FTP)
  36. #ifdef HAVE_NETDB_H
  37. #include <netdb.h>
  38. #endif
  39. #include "urldata.h"
  40. #include "curl_base64.h"
  41. #include "ftp.h"
  42. #include "curl_gssapi.h"
  43. #include "sendf.h"
  44. #include "curl_sec.h"
  45. #include "warnless.h"
  46. /* The last 3 #include files should be in this order */
  47. #include "curl_printf.h"
  48. #include "curl_memory.h"
  49. #include "memdebug.h"
  50. static int
  51. krb5_init(void *app_data)
  52. {
  53. gss_ctx_id_t *context = app_data;
  54. /* Make sure our context is initialized for krb5_end. */
  55. *context = GSS_C_NO_CONTEXT;
  56. return 0;
  57. }
  58. static int
  59. krb5_check_prot(void *app_data, int level)
  60. {
  61. (void)app_data; /* unused */
  62. if(level == PROT_CONFIDENTIAL)
  63. return -1;
  64. return 0;
  65. }
  66. static int
  67. krb5_decode(void *app_data, void *buf, int len,
  68. int level UNUSED_PARAM,
  69. struct connectdata *conn UNUSED_PARAM)
  70. {
  71. gss_ctx_id_t *context = app_data;
  72. OM_uint32 maj, min;
  73. gss_buffer_desc enc, dec;
  74. (void)level;
  75. (void)conn;
  76. enc.value = buf;
  77. enc.length = len;
  78. maj = gss_unwrap(&min, *context, &enc, &dec, NULL, NULL);
  79. if(maj != GSS_S_COMPLETE) {
  80. if(len >= 4)
  81. strcpy(buf, "599 ");
  82. return -1;
  83. }
  84. memcpy(buf, dec.value, dec.length);
  85. len = curlx_uztosi(dec.length);
  86. gss_release_buffer(&min, &dec);
  87. return len;
  88. }
  89. static int
  90. krb5_overhead(void *app_data, int level, int len)
  91. {
  92. /* no arguments are used */
  93. (void)app_data;
  94. (void)level;
  95. (void)len;
  96. return 0;
  97. }
  98. static int
  99. krb5_encode(void *app_data, const void *from, int length, int level, void **to)
  100. {
  101. gss_ctx_id_t *context = app_data;
  102. gss_buffer_desc dec, enc;
  103. OM_uint32 maj, min;
  104. int state;
  105. int len;
  106. /* NOTE that the cast is safe, neither of the krb5, gnu gss and heimdal
  107. * libraries modify the input buffer in gss_wrap()
  108. */
  109. dec.value = (void *)from;
  110. dec.length = length;
  111. maj = gss_wrap(&min, *context,
  112. level == PROT_PRIVATE,
  113. GSS_C_QOP_DEFAULT,
  114. &dec, &state, &enc);
  115. if(maj != GSS_S_COMPLETE)
  116. return -1;
  117. /* malloc a new buffer, in case gss_release_buffer doesn't work as
  118. expected */
  119. *to = malloc(enc.length);
  120. if(!*to)
  121. return -1;
  122. memcpy(*to, enc.value, enc.length);
  123. len = curlx_uztosi(enc.length);
  124. gss_release_buffer(&min, &enc);
  125. return len;
  126. }
  127. static int
  128. krb5_auth(void *app_data, struct connectdata *conn)
  129. {
  130. int ret = AUTH_OK;
  131. char *p;
  132. const char *host = conn->host.name;
  133. ssize_t nread;
  134. curl_socklen_t l = sizeof(conn->local_addr);
  135. struct Curl_easy *data = conn->data;
  136. CURLcode result;
  137. const char *service = data->set.str[STRING_SERVICE_NAME] ?
  138. data->set.str[STRING_SERVICE_NAME] :
  139. "ftp";
  140. const char *srv_host = "host";
  141. gss_buffer_desc input_buffer, output_buffer, _gssresp, *gssresp;
  142. OM_uint32 maj, min;
  143. gss_name_t gssname;
  144. gss_ctx_id_t *context = app_data;
  145. struct gss_channel_bindings_struct chan;
  146. size_t base64_sz = 0;
  147. struct sockaddr_in **remote_addr =
  148. (struct sockaddr_in **)&conn->ip_addr->ai_addr;
  149. char *stringp;
  150. if(getsockname(conn->sock[FIRSTSOCKET],
  151. (struct sockaddr *)&conn->local_addr, &l) < 0)
  152. perror("getsockname()");
  153. chan.initiator_addrtype = GSS_C_AF_INET;
  154. chan.initiator_address.length = l - 4;
  155. chan.initiator_address.value = &conn->local_addr.sin_addr.s_addr;
  156. chan.acceptor_addrtype = GSS_C_AF_INET;
  157. chan.acceptor_address.length = l - 4;
  158. chan.acceptor_address.value = &(*remote_addr)->sin_addr.s_addr;
  159. chan.application_data.length = 0;
  160. chan.application_data.value = NULL;
  161. /* this loop will execute twice (once for service, once for host) */
  162. for(;;) {
  163. /* this really shouldn't be repeated here, but can't help it */
  164. if(service == srv_host) {
  165. result = Curl_ftpsend(conn, "AUTH GSSAPI");
  166. if(result)
  167. return -2;
  168. if(Curl_GetFTPResponse(&nread, conn, NULL))
  169. return -1;
  170. if(data->state.buffer[0] != '3')
  171. return -1;
  172. }
  173. stringp = aprintf("%s@%s", service, host);
  174. if(!stringp)
  175. return -2;
  176. input_buffer.value = stringp;
  177. input_buffer.length = strlen(stringp);
  178. maj = gss_import_name(&min, &input_buffer, GSS_C_NT_HOSTBASED_SERVICE,
  179. &gssname);
  180. free(stringp);
  181. if(maj != GSS_S_COMPLETE) {
  182. gss_release_name(&min, &gssname);
  183. if(service == srv_host) {
  184. failf(data, "Error importing service name %s@%s", service, host);
  185. return AUTH_ERROR;
  186. }
  187. service = srv_host;
  188. continue;
  189. }
  190. /* We pass NULL as |output_name_type| to avoid a leak. */
  191. gss_display_name(&min, gssname, &output_buffer, NULL);
  192. Curl_infof(data, "Trying against %s\n", output_buffer.value);
  193. gssresp = GSS_C_NO_BUFFER;
  194. *context = GSS_C_NO_CONTEXT;
  195. do {
  196. /* Release the buffer at each iteration to avoid leaking: the first time
  197. we are releasing the memory from gss_display_name. The last item is
  198. taken care by a final gss_release_buffer. */
  199. gss_release_buffer(&min, &output_buffer);
  200. ret = AUTH_OK;
  201. maj = Curl_gss_init_sec_context(data,
  202. &min,
  203. context,
  204. gssname,
  205. &Curl_krb5_mech_oid,
  206. &chan,
  207. gssresp,
  208. &output_buffer,
  209. TRUE,
  210. NULL);
  211. if(gssresp) {
  212. free(_gssresp.value);
  213. gssresp = NULL;
  214. }
  215. if(GSS_ERROR(maj)) {
  216. Curl_infof(data, "Error creating security context\n");
  217. ret = AUTH_ERROR;
  218. break;
  219. }
  220. if(output_buffer.length != 0) {
  221. char *cmd;
  222. result = Curl_base64_encode(data, (char *)output_buffer.value,
  223. output_buffer.length, &p, &base64_sz);
  224. if(result) {
  225. Curl_infof(data, "base64-encoding: %s\n",
  226. curl_easy_strerror(result));
  227. ret = AUTH_ERROR;
  228. break;
  229. }
  230. cmd = aprintf("ADAT %s", p);
  231. if(cmd)
  232. result = Curl_ftpsend(conn, cmd);
  233. else
  234. result = CURLE_OUT_OF_MEMORY;
  235. free(p);
  236. free(cmd);
  237. if(result) {
  238. ret = -2;
  239. break;
  240. }
  241. if(Curl_GetFTPResponse(&nread, conn, NULL)) {
  242. ret = -1;
  243. break;
  244. }
  245. if(data->state.buffer[0] != '2' && data->state.buffer[0] != '3') {
  246. Curl_infof(data, "Server didn't accept auth data\n");
  247. ret = AUTH_ERROR;
  248. break;
  249. }
  250. _gssresp.value = NULL; /* make sure it is initialized */
  251. p = data->state.buffer + 4;
  252. p = strstr(p, "ADAT=");
  253. if(p) {
  254. result = Curl_base64_decode(p + 5,
  255. (unsigned char **)&_gssresp.value,
  256. &_gssresp.length);
  257. if(result) {
  258. failf(data, "base64-decoding: %s", curl_easy_strerror(result));
  259. ret = AUTH_CONTINUE;
  260. break;
  261. }
  262. }
  263. gssresp = &_gssresp;
  264. }
  265. } while(maj == GSS_S_CONTINUE_NEEDED);
  266. gss_release_name(&min, &gssname);
  267. gss_release_buffer(&min, &output_buffer);
  268. if(gssresp)
  269. free(_gssresp.value);
  270. if(ret == AUTH_OK || service == srv_host)
  271. return ret;
  272. service = srv_host;
  273. }
  274. return ret;
  275. }
  276. static void krb5_end(void *app_data)
  277. {
  278. OM_uint32 min;
  279. gss_ctx_id_t *context = app_data;
  280. if(*context != GSS_C_NO_CONTEXT) {
  281. #ifdef DEBUGBUILD
  282. OM_uint32 maj =
  283. #endif
  284. gss_delete_sec_context(&min, context, GSS_C_NO_BUFFER);
  285. DEBUGASSERT(maj == GSS_S_COMPLETE);
  286. }
  287. }
  288. struct Curl_sec_client_mech Curl_krb5_client_mech = {
  289. "GSSAPI",
  290. sizeof(gss_ctx_id_t),
  291. krb5_init,
  292. krb5_auth,
  293. krb5_end,
  294. krb5_check_prot,
  295. krb5_overhead,
  296. krb5_encode,
  297. krb5_decode
  298. };
  299. #endif /* HAVE_GSSAPI && !CURL_DISABLE_FTP */