Gavin Troy reported SEGV: partially revert [ac694bb]..
[s-mailx.git] / imap_gssapi.h
blob7c99d519614fee18685afc8956195244ad07497a
1 /*@ S-nail - a mail user agent derived from Berkeley Mail.
2 *@ Implementation of IMAP GSSAPI authentication according to RFC 1731.
4 * Copyright (c) 2000-2004 Gunnar Ritter, Freiburg i. Br., Germany.
5 * Copyright (c) 2012 - 2014 Steffen (Daode) Nurpmeso <sdaoden@users.sf.net>.
6 */
7 /*
8 * Copyright (c) 2004
9 * Gunnar Ritter. All rights reserved.
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 * 3. All advertising materials mentioning features or use of this software
20 * must display the following acknowledgement:
21 * This product includes software developed by Gunnar Ritter
22 * and his contributors.
23 * 4. Neither the name of Gunnar Ritter nor the names of his contributors
24 * may be used to endorse or promote products derived from this software
25 * without specific prior written permission.
27 * THIS SOFTWARE IS PROVIDED BY GUNNAR RITTER AND CONTRIBUTORS ``AS IS'' AND
28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30 * ARE DISCLAIMED. IN NO EVENT SHALL GUNNAR RITTER OR CONTRIBUTORS BE LIABLE
31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 * SUCH DAMAGE.
41 * Partially derived from sample code in:
43 * GSS-API Programming Guide
44 * Part No: 816-1331-11
45 * Sun Microsystems, Inc. 4150 Network Circle Santa Clara, CA 95054 U.S.A.
47 * (c) 2002 Sun Microsystems
50 * Copyright 1994 by OpenVision Technologies, Inc.
52 * Permission to use, copy, modify, distribute, and sell this software
53 * and its documentation for any purpose is hereby granted without fee,
54 * provided that the above copyright notice appears in all copies and
55 * that both that copyright notice and this permission notice appear in
56 * supporting documentation, and that the name of OpenVision not be used
57 * in advertising or publicity pertaining to distribution of the software
58 * without specific, written prior permission. OpenVision makes no
59 * representations about the suitability of this software for any
60 * purpose. It is provided "as is" without express or implied warranty.
62 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
63 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
64 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
65 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
66 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
67 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
68 * PERFORMANCE OF THIS SOFTWARE.
71 #ifdef HAVE_GSSAPI
72 #ifndef GSSAPI_REG_INCLUDE
73 # include <gssapi/gssapi.h>
74 # ifdef GSSAPI_OLD_STYLE
75 # include <gssapi/gssapi_generic.h>
76 # define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
77 # endif
78 #else
79 # include <gssapi.h>
80 #endif
82 static void imap_gss_error1(const char *s, OM_uint32 code, int typ);
83 static void imap_gss_error(const char *s, OM_uint32 maj_stat,
84 OM_uint32 min_stat);
86 static void
87 imap_gss_error1(const char *s, OM_uint32 code, int typ)
89 OM_uint32 maj_stat, min_stat;
90 gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
91 OM_uint32 msg_ctx = 0;
92 NYD_ENTER;
94 do {
95 maj_stat = gss_display_status(&min_stat, code, typ, GSS_C_NO_OID,
96 &msg_ctx, &msg);
97 if (maj_stat == GSS_S_COMPLETE) {
98 fprintf(stderr, "GSS error: %s / %s\n", s, (char*)msg.value);
99 if (msg.length != 0)
100 gss_release_buffer(&min_stat, &msg);
101 } else {
102 fprintf(stderr, "GSS error: %s / unknown\n", s);
103 break;
105 } while (msg_ctx);
106 NYD_LEAVE;
109 static void
110 imap_gss_error(const char *s, OM_uint32 maj_stat, OM_uint32 min_stat)
112 NYD_ENTER;
113 imap_gss_error1(s, maj_stat, GSS_C_GSS_CODE);
114 imap_gss_error1(s, min_stat, GSS_C_MECH_CODE);
115 NYD_LEAVE;
118 static enum okay
119 imap_gss(struct mailbox *mp, char *user)
121 char o[LINESIZE];
122 struct str in, out;
123 gss_buffer_desc send_tok, recv_tok, *token_ptr;
124 gss_name_t target_name;
125 gss_ctx_id_t gss_context;
126 OM_uint32 maj_stat, min_stat, ret_flags;
127 int conf_state;
128 FILE *queuefp = NULL;
129 char *server, *cp;
130 enum okay ok = STOP;
131 NYD_X;
133 if (user == NULL) {
134 if ((user = getuser(NULL)) == NULL)
135 return STOP;
136 user = savestr(user);
138 { size_t i = strlen(mp->mb_imap_account) +1;
139 server = salloc(i);
140 memcpy(server, mp->mb_imap_account, i);
142 if (!strncmp(server, "imap://", 7))
143 server += 7;
144 else if (!strncmp(server, "imaps://", 8))
145 server += 8;
146 if ((cp = UNCONST(last_at_before_slash(server))) != NULL)
147 server = &cp[1];
148 for (cp = server; *cp; cp++)
149 *cp = lowerconv(*cp);
150 send_tok.value = salloc(send_tok.length = strlen(server) + 6);
151 snprintf(send_tok.value, send_tok.length, "imap@%s", server);
152 maj_stat = gss_import_name(&min_stat, &send_tok, GSS_C_NT_HOSTBASED_SERVICE,
153 &target_name);
154 if (maj_stat != GSS_S_COMPLETE) {
155 imap_gss_error(send_tok.value, maj_stat, min_stat);
156 return STOP;
158 token_ptr = GSS_C_NO_BUFFER;
159 gss_context = GSS_C_NO_CONTEXT;
160 maj_stat = gss_init_sec_context(&min_stat,
161 GSS_C_NO_CREDENTIAL,
162 &gss_context,
163 target_name,
164 GSS_C_NO_OID,
165 GSS_C_MUTUAL_FLAG|GSS_C_SEQUENCE_FLAG,
167 GSS_C_NO_CHANNEL_BINDINGS,
168 token_ptr,
169 NULL,
170 &send_tok,
171 &ret_flags,
172 NULL);
173 if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
174 imap_gss_error("initializing GSS context", maj_stat, min_stat);
175 gss_release_name(&min_stat, &target_name);
176 return STOP;
178 snprintf(o, sizeof o, "%s AUTHENTICATE GSSAPI\r\n", tag(1));
179 IMAP_OUT(o, 0, return STOP);
181 * No response data expected.
183 imap_answer(mp, 1);
184 if (response_type != RESPONSE_CONT)
185 return STOP;
186 while (maj_stat == GSS_S_CONTINUE_NEEDED) {
188 * Pass token obtained from first gss_init_sec_context() call.
190 b64_encode_buf(&out, send_tok.value, send_tok.length,
191 B64_SALLOC | B64_CRLF);
192 gss_release_buffer(&min_stat, &send_tok);
193 IMAP_OUT(out.s, 0, return STOP);
194 imap_answer(mp, 1);
195 if (response_type != RESPONSE_CONT)
196 return STOP;
197 out.s = NULL;
198 in.s = responded_text;
199 in.l = strlen(responded_text);
200 b64_decode(&out, &in, NULL);
201 recv_tok.value = out.s;
202 recv_tok.length = out.l;
203 token_ptr = &recv_tok;
204 maj_stat = gss_init_sec_context(&min_stat,
205 GSS_C_NO_CREDENTIAL,
206 &gss_context,
207 target_name,
208 GSS_C_NO_OID,
209 GSS_C_MUTUAL_FLAG|GSS_C_SEQUENCE_FLAG,
211 GSS_C_NO_CHANNEL_BINDINGS,
212 token_ptr,
213 NULL,
214 &send_tok,
215 &ret_flags,
216 NULL);
217 if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
218 imap_gss_error("initializing context", maj_stat, min_stat);
219 gss_release_name(&min_stat, &target_name);
220 return STOP;
222 free(out.s);
225 * Pass token obtained from second gss_init_sec_context() call.
227 gss_release_name(&min_stat, &target_name);
228 b64_encode_buf(&out, send_tok.value, send_tok.length, B64_SALLOC | B64_CRLF);
229 gss_release_buffer(&min_stat, &send_tok);
230 IMAP_OUT(out.s, 0, return STOP);
232 * First octet: bit-mask with protection mechanisms.
233 * Second to fourth octet: maximum message size in network byte order.
235 * This code currently does not care about the values.
237 imap_answer(mp, 1);
238 if (response_type != RESPONSE_CONT)
239 return STOP;
240 out.s = NULL;
241 in.s = responded_text;
242 in.l = strlen(responded_text);
243 b64_decode(&out, &in, NULL);
244 recv_tok.value = out.s;
245 recv_tok.length = out.l;
246 maj_stat = gss_unwrap(&min_stat, gss_context, &recv_tok, &send_tok,
247 &conf_state, NULL);
248 free(out.s);
249 if (maj_stat != GSS_S_COMPLETE) {
250 imap_gss_error("unwrapping data", maj_stat, min_stat);
251 return STOP;
254 * First octet: bit-mask with protection mechanisms (1 = no protection
255 * mechanism).
256 * Second to fourth octet: maximum message size in network byte order.
257 * Fifth and following octets: user name string.
259 o[0] = 1;
260 o[1] = 0;
261 o[2] = o[3] = (char)0377;
262 snprintf(&o[4], sizeof o - 4, "%s", user);
263 send_tok.value = o;
264 send_tok.length = strlen(&o[4]) + 5;
265 maj_stat = gss_wrap(&min_stat, gss_context, 0, GSS_C_QOP_DEFAULT, &send_tok,
266 &conf_state, &recv_tok);
267 if (maj_stat != GSS_S_COMPLETE) {
268 imap_gss_error("wrapping data", maj_stat, min_stat);
269 return STOP;
271 b64_encode_buf(&out, recv_tok.value, recv_tok.length, B64_SALLOC | B64_CRLF);
272 IMAP_OUT(out.s, MB_COMD, return STOP);
273 while (mp->mb_active & MB_COMD)
274 ok = imap_answer(mp, 1);
275 gss_delete_sec_context(&min_stat, &gss_context, &recv_tok);
276 gss_release_buffer(&min_stat, &recv_tok);
277 return ok;
279 #endif /* HAVE_GSSAPI */
281 /* vim:set fenc=utf-8:s-it-mode */