imap_gssapi.h

   1 /*@ S-nail - a mail user agent derived from Berkeley Mail.
   2  *@ Implementation of IMAP GSSAPI authentication according to RFC 1731.
   3  *
   4  * Copyright (c) 2000-2004 Gunnar Ritter, Freiburg i. Br., Germany.
   5  * Copyright (c) 2012 - 2014 Steffen (Daode) Nurpmeso <sdaoden@users.sf.net>.
   6  */
   7 /*
   8  * Copyright (c) 2004
   9  * Gunnar Ritter.  All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  * 3. All advertising materials mentioning features or use of this software
  20  *    must display the following acknowledgement:
  21  *    This product includes software developed by Gunnar Ritter
  22  *    and his contributors.
  23  * 4. Neither the name of Gunnar Ritter nor the names of his contributors
  24  *    may be used to endorse or promote products derived from this software
  25  *    without specific prior written permission.
  26  *
  27  * THIS SOFTWARE IS PROVIDED BY GUNNAR RITTER AND CONTRIBUTORS ``AS IS'' AND
  28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  30  * ARE DISCLAIMED.  IN NO EVENT SHALL GUNNAR RITTER OR CONTRIBUTORS BE LIABLE
  31  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  32  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  33  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  34  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  35  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  36  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  37  * SUCH DAMAGE.
  38  */
  39
  40 /*
  41  * Partially derived from sample code in:
  42  *
  43  * GSS-API Programming Guide
  44  * Part No: 816-1331-11
  45  * Sun Microsystems, Inc. 4150 Network Circle Santa Clara, CA 95054 U.S.A.
  46  *
  47  * (c) 2002 Sun Microsystems
  48  */
  49 /*
  50  * Copyright 1994 by OpenVision Technologies, Inc.
  51  *
  52  * Permission to use, copy, modify, distribute, and sell this software
  53  * and its documentation for any purpose is hereby granted without fee,
  54  * provided that the above copyright notice appears in all copies and
  55  * that both that copyright notice and this permission notice appear in
  56  * supporting documentation, and that the name of OpenVision not be used
  57  * in advertising or publicity pertaining to distribution of the software
  58  * without specific, written prior permission. OpenVision makes no
  59  * representations about the suitability of this software for any
  60  * purpose.  It is provided "as is" without express or implied warranty.
  61  *
  62  * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  63  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  64  * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  65  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
  66  * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
  67  * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  68  * PERFORMANCE OF THIS SOFTWARE.
  69  */
  70
  71 #ifdef HAVE_GSSAPI
  72 #ifndef GSSAPI_REG_INCLUDE
  73 # include <gssapi/gssapi.h>
  74 # ifdef GSSAPI_OLD_STYLE
  75 #  include <gssapi/gssapi_generic.h>
  76 #  define GSS_C_NT_HOSTBASED_SERVICE   gss_nt_service_name
  77 # endif
  78 #else
  79 # include <gssapi.h>
  80 #endif
  81
  82 static void imap_gss_error1(const char *s, OM_uint32 code, int typ);
  83 static void imap_gss_error(const char *s, OM_uint32 maj_stat,
  84                OM_uint32 min_stat);
  85
  86 static void
  87 imap_gss_error1(const char *s, OM_uint32 code, int typ)
  88 {
  89    OM_uint32 maj_stat, min_stat;
  90    gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
  91    OM_uint32 msg_ctx = 0;
  92    NYD_ENTER;
  93
  94    do {
  95       maj_stat = gss_display_status(&min_stat, code, typ, GSS_C_NO_OID,
  96             &msg_ctx, &msg);
  97       if (maj_stat == GSS_S_COMPLETE) {
  98          fprintf(stderr, "GSS error: %s / %s\n", s, (char*)msg.value);
  99          if (msg.length != 0)
 100             gss_release_buffer(&min_stat, &msg);
 101       } else {
 102          fprintf(stderr, "GSS error: %s / unknown\n", s);
 103          break;
 104       }
 105    } while (msg_ctx);
 106    NYD_LEAVE;
 107 }
 108
 109 static void
 110 imap_gss_error(const char *s, OM_uint32 maj_stat, OM_uint32 min_stat)
 111 {
 112    NYD_ENTER;
 113    imap_gss_error1(s, maj_stat, GSS_C_GSS_CODE);
 114    imap_gss_error1(s, min_stat, GSS_C_MECH_CODE);
 115    NYD_LEAVE;
 116 }
 117
 118 static enum okay
 119 imap_gss(struct mailbox *mp, char *user)
 120 {
 121    char o[LINESIZE];
 122    struct str in, out;
 123    gss_buffer_desc send_tok, recv_tok, *token_ptr;
 124    gss_name_t target_name;
 125    gss_ctx_id_t gss_context;
 126    OM_uint32 maj_stat, min_stat, ret_flags;
 127    int conf_state;
 128    FILE *queuefp = NULL;
 129    char *server, *cp;
 130    enum okay ok = STOP;
 131    NYD_X;
 132
 133    if (user == NULL) {
 134       if ((user = getuser(NULL)) == NULL)
 135          return STOP;
 136       user = savestr(user);
 137    }
 138    {  size_t i = strlen(mp->mb_imap_account) +1;
 139       server = salloc(i);
 140       memcpy(server, mp->mb_imap_account, i);
 141    }
 142    if (!strncmp(server, "imap://", 7))
 143       server += 7;
 144    else if (!strncmp(server, "imaps://", 8))
 145       server += 8;
 146    if ((cp = UNCONST(last_at_before_slash(server))) != NULL)
 147       server = &cp[1];
 148    for (cp = server; *cp; cp++)
 149       *cp = lowerconv(*cp);
 150    send_tok.value = salloc(send_tok.length = strlen(server) + 6);
 151    snprintf(send_tok.value, send_tok.length, "imap@%s", server);
 152    maj_stat = gss_import_name(&min_stat, &send_tok, GSS_C_NT_HOSTBASED_SERVICE,
 153          &target_name);
 154    if (maj_stat != GSS_S_COMPLETE) {
 155       imap_gss_error(send_tok.value, maj_stat, min_stat);
 156       return STOP;
 157    }
 158    token_ptr = GSS_C_NO_BUFFER;
 159    gss_context = GSS_C_NO_CONTEXT;
 160    maj_stat = gss_init_sec_context(&min_stat,
 161          GSS_C_NO_CREDENTIAL,
 162          &gss_context,
 163          target_name,
 164          GSS_C_NO_OID,
 165          GSS_C_MUTUAL_FLAG|GSS_C_SEQUENCE_FLAG,
 166          0,
 167          GSS_C_NO_CHANNEL_BINDINGS,
 168          token_ptr,
 169          NULL,
 170          &send_tok,
 171          &ret_flags,
 172          NULL);
 173    if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
 174       imap_gss_error("initializing GSS context", maj_stat, min_stat);
 175       gss_release_name(&min_stat, &target_name);
 176       return STOP;
 177    }
 178    snprintf(o, sizeof o, "%s AUTHENTICATE GSSAPI\r\n", tag(1));
 179    IMAP_OUT(o, 0, return STOP);
 180    /*
 181     * No response data expected.
 182     */
 183    imap_answer(mp, 1);
 184    if (response_type != RESPONSE_CONT)
 185       return STOP;
 186    while (maj_stat == GSS_S_CONTINUE_NEEDED) {
 187       /*
 188        * Pass token obtained from first gss_init_sec_context() call.
 189        */
 190       b64_encode_buf(&out, send_tok.value, send_tok.length,
 191          B64_SALLOC | B64_CRLF);
 192       gss_release_buffer(&min_stat, &send_tok);
 193       IMAP_OUT(out.s, 0, return STOP);
 194       imap_answer(mp, 1);
 195       if (response_type != RESPONSE_CONT)
 196          return STOP;
 197       out.s = NULL;
 198       in.s = responded_text;
 199       in.l = strlen(responded_text);
 200       b64_decode(&out, &in, NULL);
 201       recv_tok.value = out.s;
 202       recv_tok.length = out.l;
 203       token_ptr = &recv_tok;
 204       maj_stat = gss_init_sec_context(&min_stat,
 205             GSS_C_NO_CREDENTIAL,
 206             &gss_context,
 207             target_name,
 208             GSS_C_NO_OID,
 209             GSS_C_MUTUAL_FLAG|GSS_C_SEQUENCE_FLAG,
 210             0,
 211             GSS_C_NO_CHANNEL_BINDINGS,
 212             token_ptr,
 213             NULL,
 214             &send_tok,
 215             &ret_flags,
 216             NULL);
 217       if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
 218          imap_gss_error("initializing context", maj_stat, min_stat);
 219          gss_release_name(&min_stat, &target_name);
 220          return STOP;
 221       }
 222       free(out.s);
 223    }
 224    /*
 225     * Pass token obtained from second gss_init_sec_context() call.
 226     */
 227    gss_release_name(&min_stat, &target_name);
 228    b64_encode_buf(&out, send_tok.value, send_tok.length, B64_SALLOC | B64_CRLF);
 229    gss_release_buffer(&min_stat, &send_tok);
 230    IMAP_OUT(out.s, 0, return STOP);
 231    /*
 232     * First octet: bit-mask with protection mechanisms.
 233     * Second to fourth octet: maximum message size in network byte order.
 234     *
 235     * This code currently does not care about the values.
 236     */
 237    imap_answer(mp, 1);
 238    if (response_type != RESPONSE_CONT)
 239       return STOP;
 240    out.s = NULL;
 241    in.s = responded_text;
 242    in.l = strlen(responded_text);
 243    b64_decode(&out, &in, NULL);
 244    recv_tok.value = out.s;
 245    recv_tok.length = out.l;
 246    maj_stat = gss_unwrap(&min_stat, gss_context, &recv_tok, &send_tok,
 247          &conf_state, NULL);
 248    free(out.s);
 249    if (maj_stat != GSS_S_COMPLETE) {
 250       imap_gss_error("unwrapping data", maj_stat, min_stat);
 251       return STOP;
 252    }
 253    /*
 254     * First octet: bit-mask with protection mechanisms (1 = no protection
 255     *    mechanism).
 256     * Second to fourth octet: maximum message size in network byte order.
 257     * Fifth and following octets: user name string.
 258     */
 259    o[0] = 1;
 260    o[1] = 0;
 261    o[2] = o[3] = (char)0377;
 262    snprintf(&o[4], sizeof o - 4, "%s", user);
 263    send_tok.value = o;
 264    send_tok.length = strlen(&o[4]) + 5;
 265    maj_stat = gss_wrap(&min_stat, gss_context, 0, GSS_C_QOP_DEFAULT, &send_tok,
 266          &conf_state, &recv_tok);
 267    if (maj_stat != GSS_S_COMPLETE) {
 268       imap_gss_error("wrapping data", maj_stat, min_stat);
 269       return STOP;
 270    }
 271    b64_encode_buf(&out, recv_tok.value, recv_tok.length, B64_SALLOC | B64_CRLF);
 272    IMAP_OUT(out.s, MB_COMD, return STOP);
 273    while (mp->mb_active & MB_COMD)
 274       ok = imap_answer(mp, 1);
 275    gss_delete_sec_context(&min_stat, &gss_context, &recv_tok);
 276    gss_release_buffer(&min_stat, &recv_tok);
 277    return ok;
 278 }
 279 #endif /* HAVE_GSSAPI */
 280
 281 /* vim:set fenc=utf-8:s-it-mode */