1 /* This source code was modified by Martin Hedenfalk <mhe@stacken.kth.se> for
2 * use in Curl. Martin's latest changes were done 2000-09-18.
3 *
4 * It has since been patched away like a madman by Daniel Stenberg to make it
5 * better applied to curl conditions, and to make it not use globals, pollute
6 * name space and more.
7 *
8 * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska H�gskolan
9 * (Royal Institute of Technology, Stockholm, Sweden).
10 * Copyright (c) 2004 - 2008 Daniel Stenberg
11 * All rights reserved.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 *
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 *
20 * 2. Redistributions in binary form must reproduce the above copyright
21 * notice, this list of conditions and the following disclaimer in the
22 * documentation and/or other materials provided with the distribution.
23 *
24 * 3. Neither the name of the Institute nor the names of its contributors
25 * may be used to endorse or promote products derived from this software
26 * without specific prior written permission.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
29 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
32 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 * SUCH DAMAGE.
39 *
40 * $Id: krb4.c,v 1.51 2008-11-16 12:26:50 bagder Exp $
41 */
42
43 #include "setup.h"
44
45 #ifndef CURL_DISABLE_FTP
46 #ifdef HAVE_KRB4
47
48 #include <stdlib.h>
49 #ifdef HAVE_NETDB_H
50 #include <netdb.h>
51 #endif
52 #include <string.h>
53 #include <krb.h>
54 #include <des.h>
55
56 #ifdef HAVE_UNISTD_H
57 #include <unistd.h> /* for getpid() */
58 #endif
59
60 #include "urldata.h"
61 #include "curl_base64.h"
62 #include "ftp.h"
63 #include "sendf.h"
64 #include "krb4.h"
65 #include "inet_ntop.h"
66 #include "memory.h"
67
68 /* The last #include file should be: */
69 #include "memdebug.h"
70
71 #define LOCAL_ADDR (&conn->local_addr)
72 #define REMOTE_ADDR conn->ip_addr->ai_addr
73 #define myctladdr LOCAL_ADDR
74 #define hisctladdr REMOTE_ADDR
75
76 struct krb4_data {
77 des_cblock key;
78 des_key_schedule schedule;
79 char name[ANAME_SZ];
80 char instance[INST_SZ];
81 char realm[REALM_SZ];
82 };
83
84 #ifndef HAVE_STRLCPY
85 /* if it ever goes non-static, make it Curl_ prefixed! */
86 static size_t
strlcpy(char * dst,const char * src,size_t dst_sz)87 strlcpy (char *dst, const char *src, size_t dst_sz)
88 {
89 size_t n;
90 char *p;
91
92 for (p = dst, n = 0;
93 n + 1 < dst_sz && *src != '\0';
94 ++p, ++src, ++n)
95 *p = *src;
96 *p = '\0';
97 if(*src == '\0')
98 return n;
99 else
100 return n + strlen (src);
101 }
102 #else
103 size_t strlcpy (char *dst, const char *src, size_t dst_sz);
104 #endif
105
106 static int
krb4_check_prot(void * app_data,int level)107 krb4_check_prot(void *app_data, int level)
108 {
109 app_data = NULL; /* prevent compiler warning */
110 if(level == prot_confidential)
111 return -1;
112 return 0;
113 }
114
115 static int
krb4_decode(void * app_data,void * buf,int len,int level,struct connectdata * conn)116 krb4_decode(void *app_data, void *buf, int len, int level,
117 struct connectdata *conn)
118 {
119 MSG_DAT m;
120 int e;
121 struct krb4_data *d = app_data;
122
123 if(level == prot_safe)
124 e = krb_rd_safe(buf, len, &d->key,
125 (struct sockaddr_in *)REMOTE_ADDR,
126 (struct sockaddr_in *)LOCAL_ADDR, &m);
127 else
128 e = krb_rd_priv(buf, len, d->schedule, &d->key,
129 (struct sockaddr_in *)REMOTE_ADDR,
130 (struct sockaddr_in *)LOCAL_ADDR, &m);
131 if(e) {
132 struct SessionHandle *data = conn->data;
133 infof(data, "krb4_decode: %s\n", krb_get_err_text(e));
134 return -1;
135 }
136 memmove(buf, m.app_data, m.app_length);
137 return m.app_length;
138 }
139
140 static int
krb4_overhead(void * app_data,int level,int len)141 krb4_overhead(void *app_data, int level, int len)
142 {
143 /* no arguments are used, just init them to prevent compiler warnings */
144 app_data = NULL;
145 level = 0;
146 len = 0;
147 return 31;
148 }
149
150 static int
krb4_encode(void * app_data,const void * from,int length,int level,void ** to,struct connectdata * conn)151 krb4_encode(void *app_data, const void *from, int length, int level, void **to,
152 struct connectdata *conn)
153 {
154 struct krb4_data *d = app_data;
155 *to = malloc(length + 31);
156 if(!*to)
157 return -1;
158 if(level == prot_safe)
159 /* NOTE that the void* cast is safe, krb_mk_safe/priv don't modify the
160 * input buffer
161 */
162 return krb_mk_safe((void*)from, *to, length, &d->key,
163 (struct sockaddr_in *)LOCAL_ADDR,
164 (struct sockaddr_in *)REMOTE_ADDR);
165 else if(level == prot_private)
166 return krb_mk_priv((void*)from, *to, length, d->schedule, &d->key,
167 (struct sockaddr_in *)LOCAL_ADDR,
168 (struct sockaddr_in *)REMOTE_ADDR);
169 else
170 return -1;
171 }
172
173 static int
mk_auth(struct krb4_data * d,KTEXT adat,const char * service,char * host,int checksum)174 mk_auth(struct krb4_data *d, KTEXT adat,
175 const char *service, char *host, int checksum)
176 {
177 int ret;
178 CREDENTIALS cred;
179 char sname[SNAME_SZ], inst[INST_SZ], realm[REALM_SZ];
180
181 strlcpy(sname, service, sizeof(sname));
182 strlcpy(inst, krb_get_phost(host), sizeof(inst));
183 strlcpy(realm, krb_realmofhost(host), sizeof(realm));
184 ret = krb_mk_req(adat, sname, inst, realm, checksum);
185 if(ret)
186 return ret;
187 strlcpy(sname, service, sizeof(sname));
188 strlcpy(inst, krb_get_phost(host), sizeof(inst));
189 strlcpy(realm, krb_realmofhost(host), sizeof(realm));
190 ret = krb_get_cred(sname, inst, realm, &cred);
191 memmove(&d->key, &cred.session, sizeof(des_cblock));
192 des_key_sched(&d->key, d->schedule);
193 memset(&cred, 0, sizeof(cred));
194 return ret;
195 }
196
197 #ifdef HAVE_KRB_GET_OUR_IP_FOR_REALM
198 int krb_get_our_ip_for_realm(char *, struct in_addr *);
199 #endif
200
201 static int
krb4_auth(void * app_data,struct connectdata * conn)202 krb4_auth(void *app_data, struct connectdata *conn)
203 {
204 int ret;
205 char *p;
206 unsigned char *ptr;
207 size_t len;
208 KTEXT_ST adat;
209 MSG_DAT msg_data;
210 int checksum;
211 u_int32_t cs;
212 struct krb4_data *d = app_data;
213 char *host = conn->host.name;
214 ssize_t nread;
215 int l = sizeof(conn->local_addr);
216 struct SessionHandle *data = conn->data;
217 CURLcode result;
218
219 if(getsockname(conn->sock[FIRSTSOCKET],
220 (struct sockaddr *)LOCAL_ADDR, &l) < 0)
221 perror("getsockname()");
222
223 checksum = getpid();
224 ret = mk_auth(d, &adat, "ftp", host, checksum);
225 if(ret == KDC_PR_UNKNOWN)
226 ret = mk_auth(d, &adat, "rcmd", host, checksum);
227 if(ret) {
228 infof(data, "%s\n", krb_get_err_text(ret));
229 return AUTH_CONTINUE;
230 }
231
232 #ifdef HAVE_KRB_GET_OUR_IP_FOR_REALM
233 if(krb_get_config_bool("nat_in_use")) {
234 struct sockaddr_in *localaddr = (struct sockaddr_in *)LOCAL_ADDR;
235 struct in_addr natAddr;
236
237 if(krb_get_our_ip_for_realm(krb_realmofhost(host),
238 &natAddr) != KSUCCESS
239 && krb_get_our_ip_for_realm(NULL, &natAddr) != KSUCCESS)
240 infof(data, "Can't get address for realm %s\n",
241 krb_realmofhost(host));
242 else {
243 if(natAddr.s_addr != localaddr->sin_addr.s_addr) {
244 char addr_buf[128];
245 if(Curl_inet_ntop(AF_INET, natAddr, addr_buf, sizeof(addr_buf)))
246 infof(data, "Using NAT IP address (%s) for kerberos 4\n", addr_buf);
247 localaddr->sin_addr = natAddr;
248 }
249 }
250 }
251 #endif
252
253 if(Curl_base64_encode(conn->data, (char *)adat.dat, adat.length, &p) < 1) {
254 Curl_failf(data, "Out of memory base64-encoding");
255 return AUTH_CONTINUE;
256 }
257
258 result = Curl_ftpsendf(conn, "ADAT %s", p);
259
260 free(p);
261
262 if(result)
263 return -2;
264
265 if(Curl_GetFTPResponse(&nread, conn, NULL))
266 return -1;
267
268 if(data->state.buffer[0] != '2'){
269 Curl_failf(data, "Server didn't accept auth data");
270 return AUTH_ERROR;
271 }
272
273 p = strstr(data->state.buffer, "ADAT=");
274 if(!p) {
275 Curl_failf(data, "Remote host didn't send adat reply");
276 return AUTH_ERROR;
277 }
278 p += 5;
279 len = Curl_base64_decode(p, &ptr);
280 if(len > sizeof(adat.dat)-1) {
281 free(ptr);
282 len=0;
283 }
284 if(!len || !ptr) {
285 Curl_failf(data, "Failed to decode base64 from server");
286 return AUTH_ERROR;
287 }
288 memcpy((char *)adat.dat, ptr, len);
289 free(ptr);
290 adat.length = len;
291 ret = krb_rd_safe(adat.dat, adat.length, &d->key,
292 (struct sockaddr_in *)hisctladdr,
293 (struct sockaddr_in *)myctladdr, &msg_data);
294 if(ret) {
295 Curl_failf(data, "Error reading reply from server: %s",
296 krb_get_err_text(ret));
297 return AUTH_ERROR;
298 }
299 krb_get_int(msg_data.app_data, &cs, 4, 0);
300 if(cs - checksum != 1) {
301 Curl_failf(data, "Bad checksum returned from server");
302 return AUTH_ERROR;
303 }
304 return AUTH_OK;
305 }
306
307 struct Curl_sec_client_mech Curl_krb4_client_mech = {
308 "KERBEROS_V4",
309 sizeof(struct krb4_data),
310 NULL, /* init */
311 krb4_auth,
312 NULL, /* end */
313 krb4_check_prot,
314 krb4_overhead,
315 krb4_encode,
316 krb4_decode
317 };
318
Curl_krb_kauth(struct connectdata * conn)319 CURLcode Curl_krb_kauth(struct connectdata *conn)
320 {
321 des_cblock key;
322 des_key_schedule schedule;
323 KTEXT_ST tkt, tktcopy;
324 char *name;
325 char *p;
326 char passwd[100];
327 size_t tmp;
328 ssize_t nread;
329 int save;
330 CURLcode result;
331 unsigned char *ptr;
332
333 save = Curl_set_command_prot(conn, prot_private);
334
335 result = Curl_ftpsendf(conn, "SITE KAUTH %s", conn->user);
336
337 if(result)
338 return result;
339
340 result = Curl_GetFTPResponse(&nread, conn, NULL);
341 if(result)
342 return result;
343
344 if(conn->data->state.buffer[0] != '3'){
345 Curl_set_command_prot(conn, save);
346 return CURLE_FTP_WEIRD_SERVER_REPLY;
347 }
348
349 p = strstr(conn->data->state.buffer, "T=");
350 if(!p) {
351 Curl_failf(conn->data, "Bad reply from server");
352 Curl_set_command_prot(conn, save);
353 return CURLE_FTP_WEIRD_SERVER_REPLY;
354 }
355
356 p += 2;
357 tmp = Curl_base64_decode(p, &ptr);
358 if(tmp >= sizeof(tkt.dat)) {
359 free(ptr);
360 tmp=0;
361 }
362 if(!tmp || !ptr) {
363 Curl_failf(conn->data, "Failed to decode base64 in reply");
364 Curl_set_command_prot(conn, save);
365 return CURLE_FTP_WEIRD_SERVER_REPLY;
366 }
367 memcpy((char *)tkt.dat, ptr, tmp);
368 free(ptr);
369 tkt.length = tmp;
370 tktcopy.length = tkt.length;
371
372 p = strstr(conn->data->state.buffer, "P=");
373 if(!p) {
374 Curl_failf(conn->data, "Bad reply from server");
375 Curl_set_command_prot(conn, save);
376 return CURLE_FTP_WEIRD_SERVER_REPLY;
377 }
378 name = p + 2;
379 for(; *p && *p != ' ' && *p != '\r' && *p != '\n'; p++);
380 *p = 0;
381
382 des_string_to_key (conn->passwd, &key);
383 des_key_sched(&key, schedule);
384
385 des_pcbc_encrypt((void *)tkt.dat, (void *)tktcopy.dat,
386 tkt.length,
387 schedule, &key, DES_DECRYPT);
388 if(strcmp ((char*)tktcopy.dat + 8,
389 KRB_TICKET_GRANTING_TICKET) != 0) {
390 afs_string_to_key(passwd,
391 krb_realmofhost(conn->host.name),
392 &key);
393 des_key_sched(&key, schedule);
394 des_pcbc_encrypt((void *)tkt.dat, (void *)tktcopy.dat,
395 tkt.length,
396 schedule, &key, DES_DECRYPT);
397 }
398 memset(key, 0, sizeof(key));
399 memset(schedule, 0, sizeof(schedule));
400 memset(passwd, 0, sizeof(passwd));
401 if(Curl_base64_encode(conn->data, (char *)tktcopy.dat, tktcopy.length, &p)
402 < 1) {
403 failf(conn->data, "Out of memory base64-encoding.");
404 Curl_set_command_prot(conn, save);
405 return CURLE_OUT_OF_MEMORY;
406 }
407 memset (tktcopy.dat, 0, tktcopy.length);
408
409 result = Curl_ftpsendf(conn, "SITE KAUTH %s %s", name, p);
410 free(p);
411 if(result)
412 return result;
413
414 result = Curl_GetFTPResponse(&nread, conn, NULL);
415 if(result)
416 return result;
417 Curl_set_command_prot(conn, save);
418
419 return CURLE_OK;
420 }
421
422 #endif /* HAVE_KRB4 */
423 #endif /* CURL_DISABLE_FTP */
424