Deleted Added
sdiff udiff text old ( 178826 ) new ( 233294 )
full compact
gssapi.c (178826) gssapi.c (233294)
1/*
1/*
2 * Copyright (c) 1998 - 2005 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
2 * Copyright (c) 1998 - 2005 Kungliga Tekniska H��gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#ifdef FTP_SERVER
35#include "ftpd_locl.h"
36#else
37#include "ftp_locl.h"
38#endif
32 */
33
34#ifdef FTP_SERVER
35#include "ftpd_locl.h"
36#else
37#include "ftp_locl.h"
38#endif
39#include
39#include <gssapi/gssapi.h>
40#include <gssapi/gssapi_krb5.h>
40#include <krb5_err.h>
41
41#include <krb5_err.h>
42
42RCSID("$Id: gssapi.c 21513 2007-07-12 12:45:25Z lha $");
43RCSID("$Id$");
43
44int ftp_do_gss_bindings = 0;
45int ftp_do_gss_delegate = 1;
46
44
45int ftp_do_gss_bindings = 0;
46int ftp_do_gss_delegate = 1;
47
47struct gss_data {
48struct gssapi_data {
48 gss_ctx_id_t context_hdl;
49 gss_ctx_id_t context_hdl;
49 char *client_name;
50 gss_name_t client_name;
50 gss_cred_id_t delegated_cred_handle;
51 void *mech_data;
52};
53
54static int
55gss_init(void *app_data)
56{
51 gss_cred_id_t delegated_cred_handle;
52 void *mech_data;
53};
54
55static int
56gss_init(void *app_data)
57{
57 struct gss_data *d = app_data;
58 struct gssapi_data *d = app_data;
58 d->context_hdl = GSS_C_NO_CONTEXT;
59 d->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
60#if defined(FTP_SERVER)
61 return 0;
62#else
63 /* XXX Check the gss mechanism; with gss_indicate_mechs() ? */
64#ifdef KRB5
65 return !use_kerberos;

--- 13 unchanged lines hidden (view full) ---

79
80static int
81gss_decode(void *app_data, void *buf, int len, int level)
82{
83 OM_uint32 maj_stat, min_stat;
84 gss_buffer_desc input, output;
85 gss_qop_t qop_state;
86 int conf_state;
59 d->context_hdl = GSS_C_NO_CONTEXT;
60 d->delegated_cred_handle = GSS_C_NO_CREDENTIAL;
61#if defined(FTP_SERVER)
62 return 0;
63#else
64 /* XXX Check the gss mechanism; with gss_indicate_mechs() ? */
65#ifdef KRB5
66 return !use_kerberos;

--- 13 unchanged lines hidden (view full) ---

80
81static int
82gss_decode(void *app_data, void *buf, int len, int level)
83{
84 OM_uint32 maj_stat, min_stat;
85 gss_buffer_desc input, output;
86 gss_qop_t qop_state;
87 int conf_state;
87 struct gss_data *d = app_data;
88 struct gssapi_data *d = app_data;
88 size_t ret_len;
89
90 input.length = len;
91 input.value = buf;
92 maj_stat = gss_unwrap (&min_stat,
93 d->context_hdl,
94 &input,
95 &output,

--- 15 unchanged lines hidden (view full) ---

111
112
113static int
114gss_encode(void *app_data, void *from, int length, int level, void **to)
115{
116 OM_uint32 maj_stat, min_stat;
117 gss_buffer_desc input, output;
118 int conf_state;
89 size_t ret_len;
90
91 input.length = len;
92 input.value = buf;
93 maj_stat = gss_unwrap (&min_stat,
94 d->context_hdl,
95 &input,
96 &output,

--- 15 unchanged lines hidden (view full) ---

112
113
114static int
115gss_encode(void *app_data, void *from, int length, int level, void **to)
116{
117 OM_uint32 maj_stat, min_stat;
118 gss_buffer_desc input, output;
119 int conf_state;
119 struct gss_data *d = app_data;
120 struct gssapi_data *d = app_data;
120
121 input.length = length;
122 input.value = from;
123 maj_stat = gss_wrap (&min_stat,
124 d->context_hdl,
125 level == prot_private,
126 GSS_C_QOP_DEFAULT,
127 &input,

--- 24 unchanged lines hidden (view full) ---

152
153 gss_addr->length = 4;
154 gss_addr->value = &sin4->sin_addr;
155 *addr_type = GSS_C_AF_INET;
156 break;
157 }
158 default :
159 errx (1, "unknown address family %d", sa->sa_family);
121
122 input.length = length;
123 input.value = from;
124 maj_stat = gss_wrap (&min_stat,
125 d->context_hdl,
126 level == prot_private,
127 GSS_C_QOP_DEFAULT,
128 &input,

--- 24 unchanged lines hidden (view full) ---

153
154 gss_addr->length = 4;
155 gss_addr->value = &sin4->sin_addr;
156 *addr_type = GSS_C_AF_INET;
157 break;
158 }
159 default :
160 errx (1, "unknown address family %d", sa->sa_family);
160
161
161 }
162}
163
164/* end common stuff */
165
166#ifdef FTP_SERVER
167
168static int
169gss_adat(void *app_data, void *buf, size_t len)
170{
171 char *p = NULL;
172 gss_buffer_desc input_token, output_token;
173 OM_uint32 maj_stat, min_stat;
174 gss_name_t client_name;
162 }
163}
164
165/* end common stuff */
166
167#ifdef FTP_SERVER
168
169static int
170gss_adat(void *app_data, void *buf, size_t len)
171{
172 char *p = NULL;
173 gss_buffer_desc input_token, output_token;
174 OM_uint32 maj_stat, min_stat;
175 gss_name_t client_name;
175 struct gss_data *d = app_data;
176 struct gssapi_data *d = app_data;
176 gss_channel_bindings_t bindings;
177
178 if (ftp_do_gss_bindings) {
179 bindings = malloc(sizeof(*bindings));
180 if (bindings == NULL)
181 errx(1, "out of memory");
182
183 sockaddr_to_gss_address (his_addr,
184 &bindings->initiator_addrtype,
185 &bindings->initiator_address);
186 sockaddr_to_gss_address (ctrl_addr,
187 &bindings->acceptor_addrtype,
188 &bindings->acceptor_address);
177 gss_channel_bindings_t bindings;
178
179 if (ftp_do_gss_bindings) {
180 bindings = malloc(sizeof(*bindings));
181 if (bindings == NULL)
182 errx(1, "out of memory");
183
184 sockaddr_to_gss_address (his_addr,
185 &bindings->initiator_addrtype,
186 &bindings->initiator_address);
187 sockaddr_to_gss_address (ctrl_addr,
188 &bindings->acceptor_addrtype,
189 &bindings->acceptor_address);
189
190
190 bindings->application_data.length = 0;
191 bindings->application_data.value = NULL;
192 } else
193 bindings = GSS_C_NO_CHANNEL_BINDINGS;
194
195 input_token.value = buf;
196 input_token.length = len;
197

--- 15 unchanged lines hidden (view full) ---

213 if(output_token.length) {
214 if(base64_encode(output_token.value, output_token.length, &p) < 0) {
215 reply(535, "Out of memory base64-encoding.");
216 return -1;
217 }
218 gss_release_buffer(&min_stat, &output_token);
219 }
220 if(maj_stat == GSS_S_COMPLETE){
191 bindings->application_data.length = 0;
192 bindings->application_data.value = NULL;
193 } else
194 bindings = GSS_C_NO_CHANNEL_BINDINGS;
195
196 input_token.value = buf;
197 input_token.length = len;
198

--- 15 unchanged lines hidden (view full) ---

214 if(output_token.length) {
215 if(base64_encode(output_token.value, output_token.length, &p) < 0) {
216 reply(535, "Out of memory base64-encoding.");
217 return -1;
218 }
219 gss_release_buffer(&min_stat, &output_token);
220 }
221 if(maj_stat == GSS_S_COMPLETE){
221 char *name;
222 gss_buffer_desc export_name;
223 gss_OID oid;
224
225 maj_stat = gss_display_name(&min_stat, client_name,
226 &export_name, &oid);
227 if(maj_stat != 0) {
228 reply(500, "Error displaying name");
229 goto out;
230 }
231 /* XXX kerberos */
232 if(oid != GSS_KRB5_NT_PRINCIPAL_NAME) {
233 reply(500, "OID not kerberos principal name");
234 gss_release_buffer(&min_stat, &export_name);
235 goto out;
236 }
237 name = malloc(export_name.length + 1);
238 if(name == NULL) {
239 reply(500, "Out of memory");
240 gss_release_buffer(&min_stat, &export_name);
241 goto out;
242 }
243 memcpy(name, export_name.value, export_name.length);
244 name[export_name.length] = '\0';
245 gss_release_buffer(&min_stat, &export_name);
246 d->client_name = name;
222 d->client_name = client_name;
223 client_name = GSS_C_NO_NAME;
247 if(p)
248 reply(235, "ADAT=%s", p);
249 else
250 reply(235, "ADAT Complete");
251 sec_complete = 1;
252
253 } else if(maj_stat == GSS_S_CONTINUE_NEEDED) {
254 if(p)

--- 5 unchanged lines hidden (view full) ---

260 OM_uint32 msg_ctx = 0;
261 gss_buffer_desc status_string;
262 gss_display_status(&new_stat,
263 min_stat,
264 GSS_C_MECH_CODE,
265 GSS_C_NO_OID,
266 &msg_ctx,
267 &status_string);
224 if(p)
225 reply(235, "ADAT=%s", p);
226 else
227 reply(235, "ADAT Complete");
228 sec_complete = 1;
229
230 } else if(maj_stat == GSS_S_CONTINUE_NEEDED) {
231 if(p)

--- 5 unchanged lines hidden (view full) ---

237 OM_uint32 msg_ctx = 0;
238 gss_buffer_desc status_string;
239 gss_display_status(&new_stat,
240 min_stat,
241 GSS_C_MECH_CODE,
242 GSS_C_NO_OID,
243 &msg_ctx,
244 &status_string);
268 syslog(LOG_ERR, "gss_accept_sec_context: %s",
245 syslog(LOG_ERR, "gss_accept_sec_context: %.*s",
246 (int)status_string.length,
269 (char*)status_string.value);
270 gss_release_buffer(&new_stat, &status_string);
271 reply(431, "Security resource unavailable");
272 }
247 (char*)status_string.value);
248 gss_release_buffer(&new_stat, &status_string);
249 reply(431, "Security resource unavailable");
250 }
273 out:
251
274 if (client_name)
275 gss_release_name(&min_stat, &client_name);
276 free(p);
277 return 0;
278}
279
252 if (client_name)
253 gss_release_name(&min_stat, &client_name);
254 free(p);
255 return 0;
256}
257
280int gss_userok(void*, char*);
281int gss_session(void*, char*);
258int gssapi_userok(void*, char*);
259int gssapi_session(void*, char*);
282
283struct sec_server_mech gss_server_mech = {
284 "GSSAPI",
260
261struct sec_server_mech gss_server_mech = {
262 "GSSAPI",
285 sizeof(struct gss_data),
263 sizeof(struct gssapi_data),
286 gss_init, /* init */
287 NULL, /* end */
288 gss_check_prot,
289 gss_overhead,
290 gss_encode,
291 gss_decode,
292 /* */
293 NULL,
294 gss_adat,
295 NULL, /* pbsz */
296 NULL, /* ccc */
264 gss_init, /* init */
265 NULL, /* end */
266 gss_check_prot,
267 gss_overhead,
268 gss_encode,
269 gss_decode,
270 /* */
271 NULL,
272 gss_adat,
273 NULL, /* pbsz */
274 NULL, /* ccc */
297 gss_userok,
298 gss_session
275 gssapi_userok,
276 gssapi_session
299};
300
301#else /* FTP_SERVER */
302
303extern struct sockaddr *hisctladdr, *myctladdr;
304
305static int
306import_name(const char *kname, const char *host, gss_name_t *target_name)

--- 12 unchanged lines hidden (view full) ---

319 maj_stat = gss_import_name(&min_stat,
320 &name,
321 GSS_C_NT_HOSTBASED_SERVICE,
322 target_name);
323 if (GSS_ERROR(maj_stat)) {
324 OM_uint32 new_stat;
325 OM_uint32 msg_ctx = 0;
326 gss_buffer_desc status_string;
277};
278
279#else /* FTP_SERVER */
280
281extern struct sockaddr *hisctladdr, *myctladdr;
282
283static int
284import_name(const char *kname, const char *host, gss_name_t *target_name)

--- 12 unchanged lines hidden (view full) ---

297 maj_stat = gss_import_name(&min_stat,
298 &name,
299 GSS_C_NT_HOSTBASED_SERVICE,
300 target_name);
301 if (GSS_ERROR(maj_stat)) {
302 OM_uint32 new_stat;
303 OM_uint32 msg_ctx = 0;
304 gss_buffer_desc status_string;
327
305
328 gss_display_status(&new_stat,
329 min_stat,
330 GSS_C_MECH_CODE,
331 GSS_C_NO_OID,
332 &msg_ctx,
333 &status_string);
306 gss_display_status(&new_stat,
307 min_stat,
308 GSS_C_MECH_CODE,
309 GSS_C_NO_OID,
310 &msg_ctx,
311 &status_string);
334 printf("Error importing name %s: %s\n",
312 printf("Error importing name %.*s: %.*s\n",
313 (int)name.length,
335 (char *)name.value,
314 (char *)name.value,
315 (int)status_string.length,
336 (char *)status_string.value);
337 free(name.value);
338 gss_release_buffer(&new_stat, &status_string);
339 return AUTH_ERROR;
340 }
341 free(name.value);
342 return 0;
343}
344
345static int
346gss_auth(void *app_data, char *host)
347{
316 (char *)status_string.value);
317 free(name.value);
318 gss_release_buffer(&new_stat, &status_string);
319 return AUTH_ERROR;
320 }
321 free(name.value);
322 return 0;
323}
324
325static int
326gss_auth(void *app_data, char *host)
327{
348
328
349 OM_uint32 maj_stat, min_stat;
350 gss_name_t target_name;
351 gss_buffer_desc input, output_token;
352 int context_established = 0;
353 char *p;
354 int n;
355 gss_channel_bindings_t bindings;
329 OM_uint32 maj_stat, min_stat;
330 gss_name_t target_name;
331 gss_buffer_desc input, output_token;
332 int context_established = 0;
333 char *p;
334 int n;
335 gss_channel_bindings_t bindings;
356 struct gss_data *d = app_data;
336 struct gssapi_data *d = app_data;
357 OM_uint32 mech_flags = GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG;
358
359 const char *knames[] = { "ftp", "host", NULL }, **kname = knames;
337 OM_uint32 mech_flags = GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG;
338
339 const char *knames[] = { "ftp", "host", NULL }, **kname = knames;
360
361
340
341
362 if(import_name(*kname++, host, &target_name))
363 return AUTH_ERROR;
364
365 input.length = 0;
366 input.value = NULL;
367
368 if (ftp_do_gss_bindings) {
369 bindings = malloc(sizeof(*bindings));
370 if (bindings == NULL)
371 errx(1, "out of memory");
342 if(import_name(*kname++, host, &target_name))
343 return AUTH_ERROR;
344
345 input.length = 0;
346 input.value = NULL;
347
348 if (ftp_do_gss_bindings) {
349 bindings = malloc(sizeof(*bindings));
350 if (bindings == NULL)
351 errx(1, "out of memory");
372
352
373 sockaddr_to_gss_address (myctladdr,
374 &bindings->initiator_addrtype,
375 &bindings->initiator_address);
376 sockaddr_to_gss_address (hisctladdr,
377 &bindings->acceptor_addrtype,
378 &bindings->acceptor_address);
353 sockaddr_to_gss_address (myctladdr,
354 &bindings->initiator_addrtype,
355 &bindings->initiator_address);
356 sockaddr_to_gss_address (hisctladdr,
357 &bindings->acceptor_addrtype,
358 &bindings->acceptor_address);
379
359
380 bindings->application_data.length = 0;
381 bindings->application_data.value = NULL;
382 } else
383 bindings = GSS_C_NO_CHANNEL_BINDINGS;
384
385 if (ftp_do_gss_delegate)
386 mech_flags |= GSS_C_DELEG_FLAG;
387

--- 24 unchanged lines hidden (view full) ---

412
413 if(import_name(*kname++, host, &target_name)) {
414 if (bindings != GSS_C_NO_CHANNEL_BINDINGS)
415 free(bindings);
416 return AUTH_ERROR;
417 }
418 continue;
419 }
360 bindings->application_data.length = 0;
361 bindings->application_data.value = NULL;
362 } else
363 bindings = GSS_C_NO_CHANNEL_BINDINGS;
364
365 if (ftp_do_gss_delegate)
366 mech_flags |= GSS_C_DELEG_FLAG;
367

--- 24 unchanged lines hidden (view full) ---

392
393 if(import_name(*kname++, host, &target_name)) {
394 if (bindings != GSS_C_NO_CHANNEL_BINDINGS)
395 free(bindings);
396 return AUTH_ERROR;
397 }
398 continue;
399 }
420
400
421 if (bindings != GSS_C_NO_CHANNEL_BINDINGS)
422 free(bindings);
423
424 gss_display_status(&new_stat,
425 min_stat,
426 GSS_C_MECH_CODE,
427 GSS_C_NO_OID,
428 &msg_ctx,
429 &status_string);
401 if (bindings != GSS_C_NO_CHANNEL_BINDINGS)
402 free(bindings);
403
404 gss_display_status(&new_stat,
405 min_stat,
406 GSS_C_MECH_CODE,
407 GSS_C_NO_OID,
408 &msg_ctx,
409 &status_string);
430 printf("Error initializing security context: %s\n",
410 printf("Error initializing security context: %.*s\n",
411 (int)status_string.length,
431 (char*)status_string.value);
432 gss_release_buffer(&new_stat, &status_string);
433 return AUTH_CONTINUE;
434 }
435
436 if (input.value) {
437 free(input.value);
438 input.value = NULL;

--- 57 unchanged lines hidden (view full) ---

496 NULL);
497 if (GSS_ERROR(maj_stat) == 0) {
498 gss_buffer_desc name;
499 maj_stat = gss_display_name (&min_stat,
500 targ_name,
501 &name,
502 NULL);
503 if (GSS_ERROR(maj_stat) == 0) {
412 (char*)status_string.value);
413 gss_release_buffer(&new_stat, &status_string);
414 return AUTH_CONTINUE;
415 }
416
417 if (input.value) {
418 free(input.value);
419 input.value = NULL;

--- 57 unchanged lines hidden (view full) ---

477 NULL);
478 if (GSS_ERROR(maj_stat) == 0) {
479 gss_buffer_desc name;
480 maj_stat = gss_display_name (&min_stat,
481 targ_name,
482 &name,
483 NULL);
484 if (GSS_ERROR(maj_stat) == 0) {
504 printf("Authenticated to <%s>\n", (char *)name.value);
485 printf("Authenticated to <%.*s>\n",
486 (int)name.length,
487 (char *)name.value);
505 gss_release_buffer(&min_stat, &name);
506 }
507 gss_release_name(&min_stat, &targ_name);
508 } else
509 printf("Failed to get gss name of peer.\n");
488 gss_release_buffer(&min_stat, &name);
489 }
490 gss_release_name(&min_stat, &targ_name);
491 } else
492 printf("Failed to get gss name of peer.\n");
510 }
493 }
511
512
513 return AUTH_OK;
514}
515
516struct sec_client_mech gss_client_mech = {
517 "GSSAPI",
494
495
496 return AUTH_OK;
497}
498
499struct sec_client_mech gss_client_mech = {
500 "GSSAPI",
518 sizeof(struct gss_data),
501 sizeof(struct gssapi_data),
519 gss_init,
520 gss_auth,
521 NULL, /* end */
522 gss_check_prot,
523 gss_overhead,
524 gss_encode,
525 gss_decode,
526};
527
528#endif /* FTP_SERVER */
502 gss_init,
503 gss_auth,
504 NULL, /* end */
505 gss_check_prot,
506 gss_overhead,
507 gss_encode,
508 gss_decode,
509};
510
511#endif /* FTP_SERVER */