obs-imap-gssapi.h

   1 /*@ S-nail - a mail user agent derived from Berkeley Mail.
   2  *@ Implementation of IMAP GSS-API authentication according to RFC 1731.
   3  *@ TODO GSS-API should also be joined into "a VFS".  TODO LEAKS (error path)
   4  *
   5  * Copyright (c) 2000-2004 Gunnar Ritter, Freiburg i. Br., Germany.
   6  * Copyright (c) 2012 - 2017 Steffen (Daode) Nurpmeso <sdaoden@users.sf.net>.
   7  */
   8 /*
   9  * Copyright (c) 2004 Gunnar Ritter.
  10  * All rights reserved.
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  * 3. All advertising materials mentioning features or use of this software
  21  *    must display the following acknowledgement:
  22  *    This product includes software developed by Gunnar Ritter
  23  *    and his contributors.
  24  * 4. Neither the name of Gunnar Ritter nor the names of his contributors
  25  *    may be used to endorse or promote products derived from this software
  26  *    without specific prior written permission.
  27  *
  28  * THIS SOFTWARE IS PROVIDED BY GUNNAR RITTER AND CONTRIBUTORS ``AS IS'' AND
  29  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  30  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  31  * ARE DISCLAIMED.  IN NO EVENT SHALL GUNNAR RITTER OR CONTRIBUTORS BE LIABLE
  32  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  33  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  34  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  35  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  36  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  37  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  38  * SUCH DAMAGE.
  39  */
  40
  41 /*
  42  * Partially derived from sample code in:
  43  *
  44  * GSS-API Programming Guide
  45  * Part No: 816-1331-11
  46  * Sun Microsystems, Inc. 4150 Network Circle Santa Clara, CA 95054 U.S.A.
  47  *
  48  * (c) 2002 Sun Microsystems
  49  */
  50 /*
  51  * Copyright 1994 by OpenVision Technologies, Inc.
  52  *
  53  * Permission to use, copy, modify, distribute, and sell this software
  54  * and its documentation for any purpose is hereby granted without fee,
  55  * provided that the above copyright notice appears in all copies and
  56  * that both that copyright notice and this permission notice appear in
  57  * supporting documentation, and that the name of OpenVision not be used
  58  * in advertising or publicity pertaining to distribution of the software
  59  * without specific, written prior permission. OpenVision makes no
  60  * representations about the suitability of this software for any
  61  * purpose.  It is provided "as is" without express or implied warranty.
  62  *
  63  * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  64  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  65  * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  66  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
  67  * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
  68  * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  69  * PERFORMANCE OF THIS SOFTWARE.
  70  */
  71
  72 #ifdef HAVE_GSSAPI
  73 #ifndef GSSAPI_REG_INCLUDE
  74 # include <gssapi/gssapi.h>
  75 # ifdef GSSAPI_OLD_STYLE
  76 #  include <gssapi/gssapi_generic.h>
  77 #  define GSS_C_NT_HOSTBASED_SERVICE   gss_nt_service_name
  78 #  define NAIL_DEFINED_GCC_C_NT_HOSTBASED_SERVICE
  79 # endif
  80 #else
  81 # include <gssapi.h>
  82 #endif
  83
  84 static void _imap_gssapi_error1(const char *s, OM_uint32 code, int typ);
  85 static void _imap_gssapi_error(const char *s, OM_uint32 maj_stat,
  86                OM_uint32 min_stat);
  87 static char * _imap_gssapi_last_at_before_slash(char const *sp);
  88
  89 static void
  90 _imap_gssapi_error1(const char *s, OM_uint32 code, int typ)
  91 {
  92    OM_uint32 maj_stat, min_stat;
  93    gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
  94    OM_uint32 msg_ctx = 0;
  95    NYD_ENTER;
  96
  97    do {
  98       maj_stat = gss_display_status(&min_stat, code, typ, GSS_C_NO_OID,
  99             &msg_ctx, &msg);
 100       if (maj_stat == GSS_S_COMPLETE) {
 101          fprintf(stderr, "GSS error: %s / %s\n", s, (char*)msg.value);
 102          if (msg.length != 0)
 103             gss_release_buffer(&min_stat, &msg);
 104       } else {
 105          fprintf(stderr, "GSS error: %s / unknown\n", s);
 106          break;
 107       }
 108    } while (msg_ctx);
 109    NYD_LEAVE;
 110 }
 111
 112 static void
 113 _imap_gssapi_error(const char *s, OM_uint32 maj_stat, OM_uint32 min_stat)
 114 {
 115    NYD_ENTER;
 116    _imap_gssapi_error1(s, maj_stat, GSS_C_GSS_CODE);
 117    _imap_gssapi_error1(s, min_stat, GSS_C_MECH_CODE);
 118    NYD_LEAVE;
 119 }
 120
 121 static char *
 122 _imap_gssapi_last_at_before_slash(char const *sp)
 123 {
 124    char const *cp;
 125    char c;
 126    NYD_ENTER;
 127
 128    for (cp = sp; (c = *cp) != '\0'; ++cp)
 129       if (c == '/')
 130          break;
 131    while (cp > sp && *--cp != '@')
 132       ;
 133    if (*cp != '@')
 134       cp = NULL;
 135    NYD_LEAVE;
 136    return n_UNCONST(cp);
 137 }
 138
 139 static enum okay
 140 _imap_gssapi(struct mailbox *mp, struct ccred *ccred)
 141 {
 142    char o[LINESIZE];
 143    struct str in, out;
 144    gss_buffer_desc send_tok, recv_tok, *token_ptr;
 145    gss_name_t target_name;
 146    gss_ctx_id_t gss_context;
 147    OM_uint32 maj_stat, min_stat, ret_flags;
 148    int conf_state;
 149    FILE *queuefp = NULL;
 150    char *server, *cp;
 151    enum okay ok = STOP;
 152    NYD_X;
 153
 154    {  size_t i = strlen(mp->mb_imap_account) +1;
 155       server = salloc(i);
 156       memcpy(server, mp->mb_imap_account, i);
 157    }
 158    if (!strncmp(server, "imap://", 7))
 159       server += 7;
 160    else if (!strncmp(server, "imaps://", 8))
 161       server += 8;
 162    if ((cp = _imap_gssapi_last_at_before_slash(server)) != NULL)
 163       server = &cp[1];
 164    for (cp = server; *cp; cp++)
 165       *cp = lowerconv(*cp);
 166    send_tok.value = salloc(send_tok.length = strlen(server) + 6);
 167    snprintf(send_tok.value, send_tok.length, "imap@%s", server);
 168    maj_stat = gss_import_name(&min_stat, &send_tok, GSS_C_NT_HOSTBASED_SERVICE,
 169          &target_name);
 170    if (maj_stat != GSS_S_COMPLETE) {
 171       _imap_gssapi_error(send_tok.value, maj_stat, min_stat);
 172       goto j_leave;
 173    }
 174
 175    token_ptr = GSS_C_NO_BUFFER;
 176    gss_context = GSS_C_NO_CONTEXT;
 177    maj_stat = gss_init_sec_context(&min_stat,
 178          GSS_C_NO_CREDENTIAL,
 179          &gss_context,
 180          target_name,
 181          GSS_C_NO_OID,
 182          GSS_C_MUTUAL_FLAG|GSS_C_SEQUENCE_FLAG,
 183          0,
 184          GSS_C_NO_CHANNEL_BINDINGS,
 185          token_ptr,
 186          NULL,
 187          &send_tok,
 188          &ret_flags,
 189          NULL);
 190    if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
 191       _imap_gssapi_error("initializing GSS context", maj_stat, min_stat);
 192       gss_release_name(&min_stat, &target_name);
 193       goto j_leave;
 194    }
 195    snprintf(o, sizeof o, "%s AUTHENTICATE GSSAPI\r\n", tag(1));
 196    IMAP_OUT(o, 0, goto jleave);
 197    /*
 198     * No response data expected.
 199     */
 200    imap_answer(mp, 1);
 201    if (response_type != RESPONSE_CONT)
 202       goto jleave;
 203    while (maj_stat == GSS_S_CONTINUE_NEEDED) {
 204       /* Pass token obtained from first gss_init_sec_context() call. */
 205       if(b64_encode_buf(&out, send_tok.value, send_tok.length,
 206             B64_SALLOC | B64_CRLF) == NULL){
 207          gss_release_buffer(&min_stat, &send_tok);
 208          goto jleave;
 209       }
 210       gss_release_buffer(&min_stat, &send_tok);
 211       IMAP_OUT(out.s, 0, goto jleave);
 212       imap_answer(mp, 1);
 213       if (response_type != RESPONSE_CONT)
 214          goto jleave;
 215       out.s = NULL;
 216       in.s = responded_text;
 217       in.l = strlen(responded_text);
 218       if(!b64_decode(&out, &in))
 219          goto jebase64;
 220       recv_tok.value = out.s;
 221       recv_tok.length = out.l;
 222       token_ptr = &recv_tok;
 223       maj_stat = gss_init_sec_context(&min_stat,
 224             GSS_C_NO_CREDENTIAL,
 225             &gss_context,
 226             target_name,
 227             GSS_C_NO_OID,
 228             GSS_C_MUTUAL_FLAG|GSS_C_SEQUENCE_FLAG,
 229             0,
 230             GSS_C_NO_CHANNEL_BINDINGS,
 231             token_ptr,
 232             NULL,
 233             &send_tok,
 234             &ret_flags,
 235             NULL);
 236       free(out.s);
 237       if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
 238          _imap_gssapi_error("initializing context", maj_stat, min_stat);
 239          gss_release_name(&min_stat, &target_name);
 240          goto jleave;
 241       }
 242    }
 243    /*
 244     * Pass token obtained from second gss_init_sec_context() call.
 245     */
 246    gss_release_name(&min_stat, &target_name);
 247    if(b64_encode_buf(&out, send_tok.value, send_tok.length,
 248          B64_SALLOC | B64_CRLF) == NULL){
 249       gss_release_buffer(&min_stat, &send_tok);
 250       goto jleave;
 251    }
 252    gss_release_buffer(&min_stat, &send_tok);
 253    IMAP_OUT(out.s, 0, goto jleave);
 254
 255    /*
 256     * First octet: bit-mask with protection mechanisms.
 257     * Second to fourth octet: maximum message size in network byte order.
 258     *
 259     * This code currently does not care about the values.
 260     */
 261    imap_answer(mp, 1);
 262    if (response_type != RESPONSE_CONT)
 263       goto jleave;
 264    out.s = NULL;
 265    in.s = responded_text;
 266    in.l = strlen(responded_text);
 267    if(!b64_decode(&out, &in)){
 268 jebase64:
 269       if(out.s != NULL)
 270          free(out.s);
 271       n_err(_("Invalid base64 encoding from GSSAPI server\n"));
 272       goto jleave;
 273    }
 274    recv_tok.value = out.s;
 275    recv_tok.length = out.l;
 276    maj_stat = gss_unwrap(&min_stat, gss_context, &recv_tok, &send_tok,
 277          &conf_state, NULL);
 278    free(out.s);
 279    if (maj_stat != GSS_S_COMPLETE) {
 280       _imap_gssapi_error("unwrapping data", maj_stat, min_stat);
 281       goto jleave;
 282    }
 283    /*
 284     * First octet: bit-mask with protection mechanisms (1 = no protection
 285     *    mechanism).
 286     * Second to fourth octet: maximum message size in network byte order.
 287     * Fifth and following octets: user name string.
 288     */
 289    o[0] = 1;
 290    o[1] = 0;
 291    o[2] = o[3] = (char)0377;
 292    snprintf(&o[4], sizeof o - 4, "%s", ccred->cc_user.s);
 293    send_tok.value = o;
 294    send_tok.length = strlen(&o[4]) + 5;
 295    maj_stat = gss_wrap(&min_stat, gss_context, 0, GSS_C_QOP_DEFAULT, &send_tok,
 296          &conf_state, &recv_tok);
 297    if (maj_stat != GSS_S_COMPLETE) {
 298       _imap_gssapi_error("wrapping data", maj_stat, min_stat);
 299       goto jleave;
 300    }
 301    if(b64_encode_buf(&out, recv_tok.value, recv_tok.length,
 302          B64_SALLOC | B64_CRLF) == NULL)
 303       goto jleave;
 304    IMAP_OUT(out.s, MB_COMD, goto jleave);
 305
 306    while (mp->mb_active & MB_COMD)
 307       ok = imap_answer(mp, 1);
 308 jleave:
 309    gss_delete_sec_context(&min_stat, &gss_context, &recv_tok);
 310    gss_release_buffer(&min_stat, &recv_tok);
 311 j_leave:
 312    return ok;
 313 }
 314
 315 # ifdef NAIL_DEFINED_GCC_C_NT_HOSTBASED_SERVICE
 316 #  undef GSS_C_NT_HOSTBASED_SERVICE
 317 # endif
 318 #endif /* HAVE_GSSAPI */
 319
 320 /* s-it-mode */