Ensure reproducable environment..
[s-mailx.git] / smtp_gssapi.h
blobca339cf5c8656a181b1c31090a3d8aa43e8320b7
1 /*@ S-nail - a mail user agent derived from Berkeley Mail.
2 *@ Implementation of SMTP GSS-API authentication according to RFC 4954.
3 *@ TODO GSS-API should also be joined into "a VFS". TODO LEAKS (error path)
5 * Copyright (c) 2014 - 2015 Steffen (Daode) Nurpmeso <sdaoden@users.sf.net>.
6 */
8 /* Derived from `imap_gssapi.h', which is:
10 * Copyright (c) 2004 Gunnar Ritter.
11 * All rights reserved.
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. All advertising materials mentioning features or use of this software
22 * must display the following acknowledgement:
23 * This product includes software developed by Gunnar Ritter
24 * and his contributors.
25 * 4. Neither the name of Gunnar Ritter nor the names of his contributors
26 * may be used to endorse or promote products derived from this software
27 * without specific prior written permission.
29 * THIS SOFTWARE IS PROVIDED BY GUNNAR RITTER AND CONTRIBUTORS ``AS IS'' AND
30 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
31 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
32 * ARE DISCLAIMED. IN NO EVENT SHALL GUNNAR RITTER OR CONTRIBUTORS BE LIABLE
33 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
34 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
35 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
36 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
37 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
38 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 * SUCH DAMAGE.
42 * Partially derived from sample code in:
44 * GSS-API Programming Guide
45 * Part No: 816-1331-11
46 * Sun Microsystems, Inc. 4150 Network Circle Santa Clara, CA 95054 U.S.A.
48 * (c) 2002 Sun Microsystems
51 * Copyright 1994 by OpenVision Technologies, Inc.
53 * Permission to use, copy, modify, distribute, and sell this software
54 * and its documentation for any purpose is hereby granted without fee,
55 * provided that the above copyright notice appears in all copies and
56 * that both that copyright notice and this permission notice appear in
57 * supporting documentation, and that the name of OpenVision not be used
58 * in advertising or publicity pertaining to distribution of the software
59 * without specific, written prior permission. OpenVision makes no
60 * representations about the suitability of this software for any
61 * purpose. It is provided "as is" without express or implied warranty.
63 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
64 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
65 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
66 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
67 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
68 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
69 * PERFORMANCE OF THIS SOFTWARE.
72 #ifdef HAVE_GSSAPI
73 #ifndef GSSAPI_REG_INCLUDE
74 # include <gssapi/gssapi.h>
75 # ifdef GSSAPI_OLD_STYLE
76 # include <gssapi/gssapi_generic.h>
77 # define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
78 # define NAIL_DEFINED_GCC_C_NT_HOSTBASED_SERVICE
79 # endif
80 #else
81 # include <gssapi.h>
82 #endif
84 static void _smtp_gssapi_error1(char const *s, OM_uint32 code, int typ);
85 static void _smtp_gssapi_error(char const *s, OM_uint32 maj_stat,
86 OM_uint32 min_stat);
88 static void
89 _smtp_gssapi_error1(char const *s, OM_uint32 code, int typ)
91 OM_uint32 maj_stat, min_stat;
92 gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
93 OM_uint32 msg_ctx = 0;
94 NYD_ENTER;
96 do {
97 maj_stat = gss_display_status(&min_stat, code, typ, GSS_C_NO_OID,
98 &msg_ctx, &msg);
99 if (maj_stat == GSS_S_COMPLETE) {
100 n_err(_("GSS error: %s / %s\n"), s, (char*)msg.value);
101 if (msg.length != 0)
102 gss_release_buffer(&min_stat, &msg);
103 } else {
104 n_err(_("GSS error: %s / unknown\n"), s);
105 break;
107 } while (msg_ctx);
108 NYD_LEAVE;
111 static void
112 _smtp_gssapi_error(char const *s, OM_uint32 maj_stat, OM_uint32 min_stat)
114 NYD_ENTER;
115 _smtp_gssapi_error1(s, maj_stat, GSS_C_GSS_CODE);
116 _smtp_gssapi_error1(s, min_stat, GSS_C_MECH_CODE);
117 NYD_LEAVE;
120 static bool_t
121 _smtp_gssapi(struct sock *sp, struct sendbundle *sbp, struct smtp_line *slp)
123 struct str in, out;
124 gss_buffer_desc send_tok, recv_tok, *token_ptr;
125 gss_name_t target_name;
126 gss_ctx_id_t gss_context;
127 OM_uint32 maj_stat, min_stat, ret_flags;
128 int conf_state;
129 bool_t ok = FAL0;
130 NYD_ENTER;
132 send_tok.value = salloc(send_tok.length = sbp->sb_url.url_host.l + 5 +1);
133 memcpy(send_tok.value, "smtp@", 5);
134 memcpy((char*)send_tok.value + 5, sbp->sb_url.url_host.s,
135 sbp->sb_url.url_host.l +1);
137 maj_stat = gss_import_name(&min_stat, &send_tok, GSS_C_NT_HOSTBASED_SERVICE,
138 &target_name);
139 if (maj_stat != GSS_S_COMPLETE) {
140 _smtp_gssapi_error(send_tok.value, maj_stat, min_stat);
141 goto jleave;
144 token_ptr = GSS_C_NO_BUFFER;
145 gss_context = GSS_C_NO_CONTEXT;
146 maj_stat = gss_init_sec_context(&min_stat,
147 GSS_C_NO_CREDENTIAL,
148 &gss_context,
149 target_name,
150 GSS_C_NO_OID,
151 GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG,
153 GSS_C_NO_CHANNEL_BINDINGS,
154 token_ptr,
155 NULL,
156 &send_tok,
157 &ret_flags,
158 NULL);
159 if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
160 _smtp_gssapi_error("initializing GSS context", maj_stat, min_stat);
161 gss_release_name(&min_stat, &target_name);
162 goto jleave;
165 _OUT(NETLINE("AUTH GSSAPI"));
166 _ANSWER(3, FAL0, FAL0);
167 while (maj_stat == GSS_S_CONTINUE_NEEDED) {
168 /* Pass token obtained from first gss_init_sec_context() call */
169 b64_encode_buf(&out, send_tok.value, send_tok.length,
170 B64_SALLOC | B64_CRLF);
171 gss_release_buffer(&min_stat, &send_tok);
172 _OUT(out.s);
173 _ANSWER(3, FAL0, TRU1);
175 out.s = NULL;
176 in.s = slp->dat;
177 in.l = slp->datlen;
178 b64_decode(&out, &in, NULL);
179 recv_tok.value = out.s;
180 recv_tok.length = out.l;
181 token_ptr = &recv_tok;
182 maj_stat = gss_init_sec_context(&min_stat,
183 GSS_C_NO_CREDENTIAL,
184 &gss_context,
185 target_name,
186 GSS_C_NO_OID,
187 GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG,
189 GSS_C_NO_CHANNEL_BINDINGS,
190 token_ptr,
191 NULL,
192 &send_tok,
193 &ret_flags,
194 NULL);
195 free(out.s);
196 if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
197 _smtp_gssapi_error("initializing context", maj_stat, min_stat);
198 gss_release_name(&min_stat, &target_name);
199 goto jleave;
203 /* Pass token obtained from second gss_init_sec_context() call */
204 gss_release_name(&min_stat, &target_name);
205 b64_encode_buf(&out, send_tok.value, send_tok.length, B64_SALLOC | B64_CRLF);
206 gss_release_buffer(&min_stat, &send_tok);
207 _OUT(out.s);
209 _ANSWER(3, FAL0, TRU1);
210 out.s = NULL;
211 in.s = slp->dat;
212 in.l = slp->datlen;
213 b64_decode(&out, &in, NULL);
214 recv_tok.value = out.s;
215 recv_tok.length = out.l;
216 maj_stat = gss_unwrap(&min_stat, gss_context, &recv_tok, &send_tok,
217 &conf_state, NULL);
218 free(out.s);
219 if (maj_stat != GSS_S_COMPLETE) {
220 _smtp_gssapi_error("unwrapping data", maj_stat, min_stat);
221 goto jleave;
224 /* First octet: bit-mask with protection mechanisms (1 = no protection
225 * mechanism).
226 * Second to fourth octet: maximum message size in network byte order.
227 * Fifth and following octets: user name string */
228 in.s = salloc(send_tok.length = 4 + sbp->sb_ccred.cc_user.l +1);
229 memcpy(in.s + 4, sbp->sb_ccred.cc_user.s, sbp->sb_ccred.cc_user.l +1);
230 in.s[0] = 1;
231 in.s[1] = 0;
232 in.s[2] = in.s[3] = (char)0xFF;
233 send_tok.value = in.s;
234 maj_stat = gss_wrap(&min_stat, gss_context, 0, GSS_C_QOP_DEFAULT, &send_tok,
235 &conf_state, &recv_tok);
236 if (maj_stat != GSS_S_COMPLETE) {
237 _smtp_gssapi_error("wrapping data", maj_stat, min_stat);
238 goto jleave;
241 b64_encode_buf(&out, recv_tok.value, recv_tok.length, B64_SALLOC | B64_CRLF);
242 _OUT(out.s);
243 _ANSWER(2, FAL0, FAL0);
244 gss_delete_sec_context(&min_stat, &gss_context, &recv_tok);
245 gss_release_buffer(&min_stat, &recv_tok);
247 ok = TRU1;
248 jleave:
249 NYD_LEAVE;
250 return ok;
253 # ifdef NAIL_DEFINED_GCC_C_NT_HOSTBASED_SERVICE
254 # undef GSS_C_NT_HOSTBASED_SERVICE
255 # endif
256 #endif /* HAVE_GSSAPI */
258 /* s-it-mode */