1 /*@ S-nail - a mail user agent derived from Berkeley Mail.
2 *@ Implementation of IMAP GSSAPI authentication according to RFC 1731.
3 *@ TODO GSSAPI should also be joined into "a VFS". TODO LEAKS (error path)
5 * Copyright (c) 2000-2004 Gunnar Ritter, Freiburg i. Br., Germany.
6 * Copyright (c) 2012 - 2014 Steffen (Daode) Nurpmeso <sdaoden@users.sf.net>.
9 * Copyright (c) 2004 Gunnar Ritter.
10 * All rights reserved.
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 3. All advertising materials mentioning features or use of this software
21 * must display the following acknowledgement:
22 * This product includes software developed by Gunnar Ritter
23 * and his contributors.
24 * 4. Neither the name of Gunnar Ritter nor the names of his contributors
25 * may be used to endorse or promote products derived from this software
26 * without specific prior written permission.
28 * THIS SOFTWARE IS PROVIDED BY GUNNAR RITTER AND CONTRIBUTORS ``AS IS'' AND
29 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31 * ARE DISCLAIMED. IN NO EVENT SHALL GUNNAR RITTER OR CONTRIBUTORS BE LIABLE
32 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
42 * Partially derived from sample code in:
44 * GSS-API Programming Guide
45 * Part No: 816-1331-11
46 * Sun Microsystems, Inc. 4150 Network Circle Santa Clara, CA 95054 U.S.A.
48 * (c) 2002 Sun Microsystems
51 * Copyright 1994 by OpenVision Technologies, Inc.
53 * Permission to use, copy, modify, distribute, and sell this software
54 * and its documentation for any purpose is hereby granted without fee,
55 * provided that the above copyright notice appears in all copies and
56 * that both that copyright notice and this permission notice appear in
57 * supporting documentation, and that the name of OpenVision not be used
58 * in advertising or publicity pertaining to distribution of the software
59 * without specific, written prior permission. OpenVision makes no
60 * representations about the suitability of this software for any
61 * purpose. It is provided "as is" without express or implied warranty.
63 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
64 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
65 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
66 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
67 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
68 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
69 * PERFORMANCE OF THIS SOFTWARE.
73 #ifndef GSSAPI_REG_INCLUDE
74 # include <gssapi/gssapi.h>
75 # ifdef GSSAPI_OLD_STYLE
76 # include <gssapi/gssapi_generic.h>
77 # define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
83 static void imap_gss_error1(const char *s
, OM_uint32 code
, int typ
);
84 static void imap_gss_error(const char *s
, OM_uint32 maj_stat
,
88 imap_gss_error1(const char *s
, OM_uint32 code
, int typ
)
90 OM_uint32 maj_stat
, min_stat
;
91 gss_buffer_desc msg
= GSS_C_EMPTY_BUFFER
;
92 OM_uint32 msg_ctx
= 0;
96 maj_stat
= gss_display_status(&min_stat
, code
, typ
, GSS_C_NO_OID
,
98 if (maj_stat
== GSS_S_COMPLETE
) {
99 fprintf(stderr
, "GSS error: %s / %s\n", s
, (char*)msg
.value
);
101 gss_release_buffer(&min_stat
, &msg
);
103 fprintf(stderr
, "GSS error: %s / unknown\n", s
);
111 imap_gss_error(const char *s
, OM_uint32 maj_stat
, OM_uint32 min_stat
)
114 imap_gss_error1(s
, maj_stat
, GSS_C_GSS_CODE
);
115 imap_gss_error1(s
, min_stat
, GSS_C_MECH_CODE
);
120 imap_gss(struct mailbox
*mp
, char *user
)
124 gss_buffer_desc send_tok
, recv_tok
, *token_ptr
;
125 gss_name_t target_name
;
126 gss_ctx_id_t gss_context
;
127 OM_uint32 maj_stat
, min_stat
, ret_flags
;
129 FILE *queuefp
= NULL
;
135 if ((user
= getuser(NULL
)) == NULL
)
137 user
= savestr(user
);
139 { size_t i
= strlen(mp
->mb_imap_account
) +1;
141 memcpy(server
, mp
->mb_imap_account
, i
);
143 if (!strncmp(server
, "imap://", 7))
145 else if (!strncmp(server
, "imaps://", 8))
147 if ((cp
= UNCONST(last_at_before_slash(server
))) != NULL
)
149 for (cp
= server
; *cp
; cp
++)
150 *cp
= lowerconv(*cp
);
151 send_tok
.value
= salloc(send_tok
.length
= strlen(server
) + 6);
152 snprintf(send_tok
.value
, send_tok
.length
, "imap@%s", server
);
153 maj_stat
= gss_import_name(&min_stat
, &send_tok
, GSS_C_NT_HOSTBASED_SERVICE
,
155 if (maj_stat
!= GSS_S_COMPLETE
) {
156 imap_gss_error(send_tok
.value
, maj_stat
, min_stat
);
159 token_ptr
= GSS_C_NO_BUFFER
;
160 gss_context
= GSS_C_NO_CONTEXT
;
161 maj_stat
= gss_init_sec_context(&min_stat
,
166 GSS_C_MUTUAL_FLAG
|GSS_C_SEQUENCE_FLAG
,
168 GSS_C_NO_CHANNEL_BINDINGS
,
174 if (maj_stat
!= GSS_S_COMPLETE
&& maj_stat
!= GSS_S_CONTINUE_NEEDED
) {
175 imap_gss_error("initializing GSS context", maj_stat
, min_stat
);
176 gss_release_name(&min_stat
, &target_name
);
179 snprintf(o
, sizeof o
, "%s AUTHENTICATE GSSAPI\r\n", tag(1));
180 IMAP_OUT(o
, 0, return STOP
);
182 * No response data expected.
185 if (response_type
!= RESPONSE_CONT
)
187 while (maj_stat
== GSS_S_CONTINUE_NEEDED
) {
189 * Pass token obtained from first gss_init_sec_context() call.
191 b64_encode_buf(&out
, send_tok
.value
, send_tok
.length
,
192 B64_SALLOC
| B64_CRLF
);
193 gss_release_buffer(&min_stat
, &send_tok
);
194 IMAP_OUT(out
.s
, 0, return STOP
);
196 if (response_type
!= RESPONSE_CONT
)
199 in
.s
= responded_text
;
200 in
.l
= strlen(responded_text
);
201 b64_decode(&out
, &in
, NULL
);
202 recv_tok
.value
= out
.s
;
203 recv_tok
.length
= out
.l
;
204 token_ptr
= &recv_tok
;
205 maj_stat
= gss_init_sec_context(&min_stat
,
210 GSS_C_MUTUAL_FLAG
|GSS_C_SEQUENCE_FLAG
,
212 GSS_C_NO_CHANNEL_BINDINGS
,
219 if (maj_stat
!= GSS_S_COMPLETE
&& maj_stat
!= GSS_S_CONTINUE_NEEDED
) {
220 imap_gss_error("initializing context", maj_stat
, min_stat
);
221 gss_release_name(&min_stat
, &target_name
);
226 * Pass token obtained from second gss_init_sec_context() call.
228 gss_release_name(&min_stat
, &target_name
);
229 b64_encode_buf(&out
, send_tok
.value
, send_tok
.length
, B64_SALLOC
| B64_CRLF
);
230 gss_release_buffer(&min_stat
, &send_tok
);
231 IMAP_OUT(out
.s
, 0, return STOP
);
233 * First octet: bit-mask with protection mechanisms.
234 * Second to fourth octet: maximum message size in network byte order.
236 * This code currently does not care about the values.
239 if (response_type
!= RESPONSE_CONT
)
242 in
.s
= responded_text
;
243 in
.l
= strlen(responded_text
);
244 b64_decode(&out
, &in
, NULL
);
245 recv_tok
.value
= out
.s
;
246 recv_tok
.length
= out
.l
;
247 maj_stat
= gss_unwrap(&min_stat
, gss_context
, &recv_tok
, &send_tok
,
250 if (maj_stat
!= GSS_S_COMPLETE
) {
251 imap_gss_error("unwrapping data", maj_stat
, min_stat
);
255 * First octet: bit-mask with protection mechanisms (1 = no protection
257 * Second to fourth octet: maximum message size in network byte order.
258 * Fifth and following octets: user name string.
262 o
[2] = o
[3] = (char)0377;
263 snprintf(&o
[4], sizeof o
- 4, "%s", user
);
265 send_tok
.length
= strlen(&o
[4]) + 5;
266 maj_stat
= gss_wrap(&min_stat
, gss_context
, 0, GSS_C_QOP_DEFAULT
, &send_tok
,
267 &conf_state
, &recv_tok
);
268 if (maj_stat
!= GSS_S_COMPLETE
) {
269 imap_gss_error("wrapping data", maj_stat
, min_stat
);
272 b64_encode_buf(&out
, recv_tok
.value
, recv_tok
.length
, B64_SALLOC
| B64_CRLF
);
273 IMAP_OUT(out
.s
, MB_COMD
, return STOP
);
274 while (mp
->mb_active
& MB_COMD
)
275 ok
= imap_answer(mp
, 1);
276 gss_delete_sec_context(&min_stat
, &gss_context
, &recv_tok
);
277 gss_release_buffer(&min_stat
, &recv_tok
);
281 # undef GSS_C_NT_HOSTBASED_SERVICE
282 #endif /* HAVE_GSSAPI */
284 /* vim:set fenc=utf-8:s-it-mode */