appl/ftp/ftp/krb4.c

   1 /*
   2  * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #ifdef FTP_SERVER
  35 #include "ftpd_locl.h"
  36 #else
  37 #include "ftp_locl.h"
  38 #endif
  39 #include <krb.h>
  40
  41 RCSID("$Id$");
  42
  43 #ifdef FTP_SERVER
  44 #define LOCAL_ADDR ctrl_addr
  45 #define REMOTE_ADDR his_addr
  46 #else
  47 #define LOCAL_ADDR myctladdr
  48 #define REMOTE_ADDR hisctladdr
  49 #endif
  50
  51 extern struct sockaddr *LOCAL_ADDR, *REMOTE_ADDR;
  52
  53 struct krb4_data {
  54     des_cblock key;
  55     des_key_schedule schedule;
  56     char name[ANAME_SZ];
  57     char instance[INST_SZ];
  58     char realm[REALM_SZ];
  59 };
  60
  61 static int
  62 krb4_check_prot(void *app_data, int level)
  63 {
  64     if(level == prot_confidential)
  65         return -1;
  66     return 0;
  67 }
  68
  69 static int
  70 krb4_decode(void *app_data, void *buf, int len, int level)
  71 {
  72     MSG_DAT m;
  73     int e;
  74     struct krb4_data *d = app_data;
  75
  76     if(level == prot_safe)
  77         e = krb_rd_safe(buf, len, &d->key,
  78                         (struct sockaddr_in *)REMOTE_ADDR,
  79                         (struct sockaddr_in *)LOCAL_ADDR, &m);
  80     else
  81         e = krb_rd_priv(buf, len, d->schedule, &d->key,
  82                         (struct sockaddr_in *)REMOTE_ADDR,
  83                         (struct sockaddr_in *)LOCAL_ADDR, &m);
  84     if(e){
  85         syslog(LOG_ERR, "krb4_decode: %s", krb_get_err_text(e));
  86         return -1;
  87     }
  88     memmove(buf, m.app_data, m.app_length);
  89     return m.app_length;
  90 }
  91
  92 static int
  93 krb4_overhead(void *app_data, int level, int len)
  94 {
  95     return 31;
  96 }
  97
  98 static int
  99 krb4_encode(void *app_data, void *from, int length, int level, void **to)
 100 {
 101     struct krb4_data *d = app_data;
 102     *to = malloc(length + 31);
 103     if(level == prot_safe)
 104         return krb_mk_safe(from, *to, length, &d->key,
 105                            (struct sockaddr_in *)LOCAL_ADDR,
 106                            (struct sockaddr_in *)REMOTE_ADDR);
 107     else if(level == prot_private)
 108         return krb_mk_priv(from, *to, length, d->schedule, &d->key,
 109                            (struct sockaddr_in *)LOCAL_ADDR,
 110                            (struct sockaddr_in *)REMOTE_ADDR);
 111     else
 112         return -1;
 113 }
 114
 115 #ifdef FTP_SERVER
 116
 117 static int
 118 krb4_adat(void *app_data, void *buf, size_t len)
 119 {
 120     KTEXT_ST tkt;
 121     AUTH_DAT auth_dat;
 122     char *p;
 123     int kerror;
 124     u_int32_t cs;
 125     char msg[35]; /* size of encrypted block */
 126     int tmp_len;
 127     struct krb4_data *d = app_data;
 128     char inst[INST_SZ];
 129     struct sockaddr_in *his_addr_sin = (struct sockaddr_in *)his_addr;
 130
 131     memcpy(tkt.dat, buf, len);
 132     tkt.length = len;
 133
 134     k_getsockinst(0, inst, sizeof(inst));
 135     kerror = krb_rd_req(&tkt, "ftp", inst,
 136                         his_addr_sin->sin_addr.s_addr, &auth_dat, "");
 137     if(kerror == RD_AP_UNDEC){
 138         k_getsockinst(0, inst, sizeof(inst));
 139         kerror = krb_rd_req(&tkt, "rcmd", inst,
 140                             his_addr_sin->sin_addr.s_addr, &auth_dat, "");
 141     }
 142
 143     if(kerror){
 144         reply(535, "Error reading request: %s.", krb_get_err_text(kerror));
 145         return -1;
 146     }
 147
 148     memcpy(d->key, auth_dat.session, sizeof(d->key));
 149     des_set_key(&d->key, d->schedule);
 150
 151     strlcpy(d->name, auth_dat.pname, sizeof(d->name));
 152     strlcpy(d->instance, auth_dat.pinst, sizeof(d->instance));
 153     strlcpy(d->realm, auth_dat.prealm, sizeof(d->instance));
 154
 155     cs = auth_dat.checksum + 1;
 156     {
 157         unsigned char tmp[4];
 158         KRB_PUT_INT(cs, tmp, 4, sizeof(tmp));
 159         tmp_len = krb_mk_safe(tmp, msg, 4, &d->key,
 160                               (struct sockaddr_in *)LOCAL_ADDR,
 161                               (struct sockaddr_in *)REMOTE_ADDR);
 162     }
 163     if(tmp_len < 0){
 164         reply(535, "Error creating reply: %s.", strerror(errno));
 165         return -1;
 166     }
 167     len = tmp_len;
 168     if(base64_encode(msg, len, &p) < 0) {
 169         reply(535, "Out of memory base64-encoding.");
 170         return -1;
 171     }
 172     reply(235, "ADAT=%s", p);
 173     sec_complete = 1;
 174     free(p);
 175     return 0;
 176 }
 177
 178 static int
 179 krb4_userok(void *app_data, char *user)
 180 {
 181     struct krb4_data *d = app_data;
 182     return krb_kuserok(d->name, d->instance, d->realm, user);
 183 }
 184
 185 struct sec_server_mech krb4_server_mech = {
 186     "KERBEROS_V4",
 187     sizeof(struct krb4_data),
 188     NULL, /* init */
 189     NULL, /* end */
 190     krb4_check_prot,
 191     krb4_overhead,
 192     krb4_encode,
 193     krb4_decode,
 194     /* */
 195     NULL,
 196     krb4_adat,
 197     NULL, /* pbsz */
 198     NULL, /* ccc */
 199     krb4_userok
 200 };
 201
 202 #else /* FTP_SERVER */
 203
 204 static int
 205 krb4_init(void *app_data)
 206 {
 207    return !use_kerberos;
 208 }
 209
 210 static int
 211 mk_auth(struct krb4_data *d, KTEXT adat,
 212         char *service, char *host, int checksum)
 213 {
 214     int ret;
 215     CREDENTIALS cred;
 216     char sname[SNAME_SZ], inst[INST_SZ], realm[REALM_SZ];
 217
 218     strlcpy(sname, service, sizeof(sname));
 219     strlcpy(inst, krb_get_phost(host), sizeof(inst));
 220     strlcpy(realm, krb_realmofhost(host), sizeof(realm));
 221     ret = krb_mk_req(adat, sname, inst, realm, checksum);
 222     if(ret)
 223         return ret;
 224     strlcpy(sname, service, sizeof(sname));
 225     strlcpy(inst, krb_get_phost(host), sizeof(inst));
 226     strlcpy(realm, krb_realmofhost(host), sizeof(realm));
 227     ret = krb_get_cred(sname, inst, realm, &cred);
 228     memmove(&d->key, &cred.session, sizeof(des_cblock));
 229     des_key_sched(&d->key, d->schedule);
 230     memset(&cred, 0, sizeof(cred));
 231     return ret;
 232 }
 233
 234 static int
 235 krb4_auth(void *app_data, char *host)
 236 {
 237     int ret;
 238     char *p;
 239     int len;
 240     KTEXT_ST adat;
 241     MSG_DAT msg_data;
 242     int checksum;
 243     u_int32_t cs;
 244     struct krb4_data *d = app_data;
 245     struct sockaddr_in *localaddr  = (struct sockaddr_in *)LOCAL_ADDR;
 246     struct sockaddr_in *remoteaddr = (struct sockaddr_in *)REMOTE_ADDR;
 247
 248     checksum = getpid();
 249     ret = mk_auth(d, &adat, "ftp", host, checksum);
 250     if(ret == KDC_PR_UNKNOWN)
 251         ret = mk_auth(d, &adat, "rcmd", host, checksum);
 252     if(ret){
 253         printf("%s\n", krb_get_err_text(ret));
 254         return AUTH_CONTINUE;
 255     }
 256
 257 #ifdef HAVE_KRB_GET_OUR_IP_FOR_REALM
 258     if (krb_get_config_bool("nat_in_use")) {
 259       struct in_addr natAddr;
 260
 261       if (krb_get_our_ip_for_realm(krb_realmofhost(host),
 262                                    &natAddr) != KSUCCESS
 263           && krb_get_our_ip_for_realm(NULL, &natAddr) != KSUCCESS)
 264         printf("Can't get address for realm %s\n",
 265                krb_realmofhost(host));
 266       else {
 267         if (natAddr.s_addr != localaddr->sin_addr.s_addr) {
 268           printf("Using NAT IP address (%s) for kerberos 4\n",
 269                  inet_ntoa(natAddr));
 270           localaddr->sin_addr = natAddr;
 271
 272           /*
 273            * This not the best place to do this, but it
 274            * is here we know that (probably) NAT is in
 275            * use!
 276            */
 277
 278           passivemode = 1;
 279           printf("Setting: Passive mode on.\n");
 280         }
 281       }
 282     }
 283 #endif
 284
 285     printf("Local address is %s\n", inet_ntoa(localaddr->sin_addr));
 286     printf("Remote address is %s\n", inet_ntoa(remoteaddr->sin_addr));
 287
 288    if(base64_encode(adat.dat, adat.length, &p) < 0) {
 289         printf("Out of memory base64-encoding.\n");
 290         return AUTH_CONTINUE;
 291     }
 292     ret = command("ADAT %s", p);
 293     free(p);
 294
 295     if(ret != COMPLETE){
 296         printf("Server didn't accept auth data.\n");
 297         return AUTH_ERROR;
 298     }
 299
 300     p = strstr(reply_string, "ADAT=");
 301     if(!p){
 302         printf("Remote host didn't send adat reply.\n");
 303         return AUTH_ERROR;
 304     }
 305     p += 5;
 306     len = base64_decode(p, adat.dat);
 307     if(len < 0){
 308         printf("Failed to decode base64 from server.\n");
 309         return AUTH_ERROR;
 310     }
 311     adat.length = len;
 312     ret = krb_rd_safe(adat.dat, adat.length, &d->key,
 313                       (struct sockaddr_in *)hisctladdr,
 314                       (struct sockaddr_in *)myctladdr, &msg_data);
 315     if(ret){
 316         printf("Error reading reply from server: %s.\n",
 317                krb_get_err_text(ret));
 318         return AUTH_ERROR;
 319     }
 320     krb_get_int(msg_data.app_data, &cs, 4, 0);
 321     if(cs - checksum != 1){
 322         printf("Bad checksum returned from server.\n");
 323         return AUTH_ERROR;
 324     }
 325     return AUTH_OK;
 326 }
 327
 328 struct sec_client_mech krb4_client_mech = {
 329     "KERBEROS_V4",
 330     sizeof(struct krb4_data),
 331     krb4_init, /* init */
 332     krb4_auth,
 333     NULL, /* end */
 334     krb4_check_prot,
 335     krb4_overhead,
 336     krb4_encode,
 337     krb4_decode
 338 };
 339
 340 #endif /* FTP_SERVER */