crypto/kerberosIV/appl/ftp/ftp/gssapi.c

   1 /*
   2  * Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #ifdef FTP_SERVER
  35 #include "ftpd_locl.h"
  36 #else
  37 #include "ftp_locl.h"
  38 #endif
  39 #include <gssapi.h>
  40
  41 RCSID("$Id: gssapi.c,v 1.13 1999/12/02 16:58:29 joda Exp $");
  42
  43 struct gss_data {
  44     gss_ctx_id_t context_hdl;
  45     char *client_name;
  46 };
  47
  48 static int
  49 gss_init(void *app_data)
  50 {
  51     struct gss_data *d = app_data;
  52     d->context_hdl = GSS_C_NO_CONTEXT;
  53     return 0;
  54 }
  55
  56 static int
  57 gss_check_prot(void *app_data, int level)
  58 {
  59     if(level == prot_confidential)
  60         return -1;
  61     return 0;
  62 }
  63
  64 static int
  65 gss_decode(void *app_data, void *buf, int len, int level)
  66 {
  67     OM_uint32 maj_stat, min_stat;
  68     gss_buffer_desc input, output;
  69     gss_qop_t qop_state;
  70     int conf_state;
  71     struct gss_data *d = app_data;
  72
  73     input.length = len;
  74     input.value = buf;
  75     maj_stat = gss_unwrap (&min_stat,
  76                            d->context_hdl,
  77                            &input,
  78                            &output,
  79                            &conf_state,
  80                            &qop_state);
  81     if(GSS_ERROR(maj_stat))
  82         return -1;
  83     memmove(buf, output.value, output.length);
  84     return output.length;
  85 }
  86
  87 static int
  88 gss_overhead(void *app_data, int level, int len)
  89 {
  90     return 100; /* dunno? */
  91 }
  92
  93
  94 static int
  95 gss_encode(void *app_data, void *from, int length, int level, void **to)
  96 {
  97     OM_uint32 maj_stat, min_stat;
  98     gss_buffer_desc input, output;
  99     int conf_state;
 100     struct gss_data *d = app_data;
 101
 102     input.length = length;
 103     input.value = from;
 104     maj_stat = gss_wrap (&min_stat,
 105                          d->context_hdl,
 106                          level == prot_private,
 107                          GSS_C_QOP_DEFAULT,
 108                          &input,
 109                          &conf_state,
 110                          &output);
 111     *to = output.value;
 112     return output.length;
 113 }
 114
 115 static void
 116 sockaddr_to_gss_address (const struct sockaddr *sa,
 117                          OM_uint32 *addr_type,
 118                          gss_buffer_desc *gss_addr)
 119 {
 120     switch (sa->sa_family) {
 121 #ifdef HAVE_IPV6
 122     case AF_INET6 : {
 123         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 124
 125         gss_addr->length = 16;
 126         gss_addr->value  = &sin6->sin6_addr;
 127         *addr_type       = GSS_C_AF_INET6;
 128         break;
 129     }
 130 #endif
 131     case AF_INET : {
 132         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 133
 134         gss_addr->length = 4;
 135         gss_addr->value  = &sin->sin_addr;
 136         *addr_type       = GSS_C_AF_INET;
 137         break;
 138     }
 139     default :
 140         errx (1, "unknown address family %d", sa->sa_family);
 141
 142     }
 143 }
 144
 145 /* end common stuff */
 146
 147 #ifdef FTP_SERVER
 148
 149 static int
 150 gss_adat(void *app_data, void *buf, size_t len)
 151 {
 152     char *p = NULL;
 153     gss_buffer_desc input_token, output_token;
 154     OM_uint32 maj_stat, min_stat;
 155     gss_name_t client_name;
 156     struct gss_data *d = app_data;
 157
 158     gss_channel_bindings_t bindings = malloc(sizeof(*bindings));
 159     sockaddr_to_gss_address (his_addr,
 160                              &bindings->initiator_addrtype,
 161                              &bindings->initiator_address);
 162     sockaddr_to_gss_address (ctrl_addr,
 163                              &bindings->acceptor_addrtype,
 164                              &bindings->acceptor_address);
 165
 166     bindings->application_data.length = 0;
 167     bindings->application_data.value = NULL;
 168
 169     input_token.value = buf;
 170     input_token.length = len;
 171
 172     maj_stat = gss_accept_sec_context (&min_stat,
 173                                        &d->context_hdl,
 174                                        GSS_C_NO_CREDENTIAL,
 175                                        &input_token,
 176                                        bindings,
 177                                        &client_name,
 178                                        NULL,
 179                                        &output_token,
 180                                        NULL,
 181                                        NULL,
 182                                        NULL);
 183
 184     if(output_token.length) {
 185         if(base64_encode(output_token.value, output_token.length, &p) < 0) {
 186             reply(535, "Out of memory base64-encoding.");
 187             return -1;
 188         }
 189     }
 190     if(maj_stat == GSS_S_COMPLETE){
 191         char *name;
 192         gss_buffer_desc export_name;
 193         maj_stat = gss_export_name(&min_stat, client_name, &export_name);
 194         if(maj_stat != 0) {
 195             reply(500, "Error exporting name");
 196             goto out;
 197         }
 198         name = realloc(export_name.value, export_name.length + 1);
 199         if(name == NULL) {
 200             reply(500, "Out of memory");
 201             free(export_name.value);
 202             goto out;
 203         }
 204         name[export_name.length] = '\0';
 205         d->client_name = name;
 206         if(p)
 207             reply(235, "ADAT=%s", p);
 208         else
 209             reply(235, "ADAT Complete");
 210         sec_complete = 1;
 211
 212     } else if(maj_stat == GSS_S_CONTINUE_NEEDED) {
 213         if(p)
 214             reply(335, "ADAT=%s", p);
 215         else
 216             reply(335, "OK, need more data");
 217     } else
 218         reply(535, "foo?");
 219 out:
 220     free(p);
 221     return 0;
 222 }
 223
 224 int gss_userok(void*, char*);
 225
 226 struct sec_server_mech gss_server_mech = {
 227     "GSSAPI",
 228     sizeof(struct gss_data),
 229     gss_init, /* init */
 230     NULL, /* end */
 231     gss_check_prot,
 232     gss_overhead,
 233     gss_encode,
 234     gss_decode,
 235     /* */
 236     NULL,
 237     gss_adat,
 238     NULL, /* pbsz */
 239     NULL, /* ccc */
 240     gss_userok
 241 };
 242
 243 #else /* FTP_SERVER */
 244
 245 extern struct sockaddr *hisctladdr, *myctladdr;
 246
 247 static int
 248 gss_auth(void *app_data, char *host)
 249 {
 250
 251     OM_uint32 maj_stat, min_stat;
 252     gss_buffer_desc name;
 253     gss_name_t target_name;
 254     gss_buffer_desc input, output_token;
 255     int context_established = 0;
 256     char *p;
 257     int n;
 258     gss_channel_bindings_t bindings;
 259     struct gss_data *d = app_data;
 260
 261     name.length = asprintf((char**)&name.value, "ftp@%s", host);
 262     maj_stat = gss_import_name(&min_stat,
 263                                &name,
 264                                GSS_C_NT_HOSTBASED_SERVICE,
 265                                &target_name);
 266     if (GSS_ERROR(maj_stat)) {
 267         OM_uint32 new_stat;
 268         OM_uint32 msg_ctx = 0;
 269         gss_buffer_desc status_string;
 270
 271         gss_display_status(&new_stat,
 272                            min_stat,
 273                            GSS_C_MECH_CODE,
 274                            GSS_C_NO_OID,
 275                            &msg_ctx,
 276                            &status_string);
 277         printf("Error importing name %s: %s\n",
 278                (char *)name.value,
 279                (char *)status_string.value);
 280         gss_release_buffer(&new_stat, &status_string);
 281         return AUTH_ERROR;
 282     }
 283     free(name.value);
 284
 285
 286     input.length = 0;
 287     input.value = NULL;
 288
 289     bindings = malloc(sizeof(*bindings));
 290
 291     sockaddr_to_gss_address (myctladdr,
 292                              &bindings->initiator_addrtype,
 293                              &bindings->initiator_address);
 294     sockaddr_to_gss_address (hisctladdr,
 295                              &bindings->acceptor_addrtype,
 296                              &bindings->acceptor_address);
 297
 298     bindings->application_data.length = 0;
 299     bindings->application_data.value = NULL;
 300
 301     while(!context_established) {
 302         maj_stat = gss_init_sec_context(&min_stat,
 303                                         GSS_C_NO_CREDENTIAL,
 304                                         &d->context_hdl,
 305                                         target_name,
 306                                         GSS_C_NO_OID,
 307                                         GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG,
 308                                         0,
 309                                         bindings,
 310                                         &input,
 311                                         NULL,
 312                                         &output_token,
 313                                         NULL,
 314                                         NULL);
 315         if (GSS_ERROR(maj_stat)) {
 316             OM_uint32 new_stat;
 317             OM_uint32 msg_ctx = 0;
 318             gss_buffer_desc status_string;
 319
 320             gss_display_status(&new_stat,
 321                                min_stat,
 322                                GSS_C_MECH_CODE,
 323                                GSS_C_NO_OID,
 324                                &msg_ctx,
 325                                &status_string);
 326             printf("Error initializing security context: %s\n",
 327                    (char*)status_string.value);
 328             gss_release_buffer(&new_stat, &status_string);
 329             return AUTH_CONTINUE;
 330         }
 331
 332         gss_release_buffer(&min_stat, &input);
 333         if (output_token.length != 0) {
 334             base64_encode(output_token.value, output_token.length, &p);
 335             gss_release_buffer(&min_stat, &output_token);
 336             n = command("ADAT %s", p);
 337             free(p);
 338         }
 339         if (GSS_ERROR(maj_stat)) {
 340             if (d->context_hdl != GSS_C_NO_CONTEXT)
 341                 gss_delete_sec_context (&min_stat,
 342                                         &d->context_hdl,
 343                                         GSS_C_NO_BUFFER);
 344             break;
 345         }
 346         if (maj_stat & GSS_S_CONTINUE_NEEDED) {
 347             p = strstr(reply_string, "ADAT=");
 348             if(p == NULL){
 349                 printf("Error: expected ADAT in reply.\n");
 350                 return AUTH_ERROR;
 351             } else {
 352                 p+=5;
 353                 input.value = malloc(strlen(p));
 354                 input.length = base64_decode(p, input.value);
 355             }
 356         } else {
 357             if(code != 235) {
 358                 printf("Unrecognized response code: %d\n", code);
 359                 return AUTH_ERROR;
 360             }
 361             context_established = 1;
 362         }
 363     }
 364     return AUTH_OK;
 365 }
 366
 367 struct sec_client_mech gss_client_mech = {
 368     "GSSAPI",
 369     sizeof(struct gss_data),
 370     gss_init,
 371     gss_auth,
 372     NULL, /* end */
 373     gss_check_prot,
 374     gss_overhead,
 375     gss_encode,
 376     gss_decode,
 377 };
 378
 379 #endif /* FTP_SERVER */