diff options
| -rw-r--r-- | kerberos.c | 271 |
1 files changed, 271 insertions, 0 deletions
diff --git a/kerberos.c b/kerberos.c new file mode 100644 index 00000000..5ebbf1d6 --- /dev/null +++ b/kerberos.c @@ -0,0 +1,271 @@ +/* + * kerberos.c -- Kerberos authentication (see RFC 1731). + * + * For license terms, see the file COPYING in this directory. + */ +#include "config.h" +#include <stdio.h> +#include <string.h> +#include <ctype.h> +#if defined(STDC_HEADERS) +#include <stdlib.h> +#endif +#include "fetchmail.h" +#include "socket.h" + +#include "i18n.h" + +#ifdef KERBEROS_V4 + +# ifdef KERBEROS_V5 +# include <kerberosIV/des.h> +# include <kerberosIV/krb.h> +# else +# if defined (__bsdi__) +# include <des.h> +# define krb_get_err_text(e) (krb_err_txt[e]) +# endif +# if defined(__NetBSD__) || (__FreeBSD__) || defined(__linux__) +# define krb_get_err_text(e) (krb_err_txt[e]) +# endif +# include <krb.h> +# endif + +#if SIZEOF_INT == 4 +typedef int int32; +#elif SIZEOF_SHORT == 4 +typedef short int32; +#elif SIZEOF_LONG == 4 +typedef long int32; +#else +#error Cannot deduce a 32-bit-type +#endif + +int do_rfc1731(int sock, char *command, char *truename) +/* authenticate as per RFC1731 -- note 32-bit integer requirement here */ +{ + int result = 0, len; + char buf1[4096], buf2[4096]; + union { + int32 cint; + char cstr[4]; + } challenge1, challenge2; + char srvinst[INST_SZ]; + char *p; + char srvrealm[REALM_SZ]; + KTEXT_ST authenticator; + CREDENTIALS credentials; + char tktuser[MAX_K_NAME_SZ+1+INST_SZ+1+REALM_SZ+1]; + char tktinst[INST_SZ]; + char tktrealm[REALM_SZ]; + des_cblock session; + des_key_schedule schedule; + + gen_send(sock, "%s KERBEROS_V4", command); + + /* The data encoded in the first ready response contains a random + * 32-bit number in network byte order. The client should respond + * with a Kerberos ticket and an authenticator for the principal + * "imap.hostname@realm", where "hostname" is the first component + * of the host name of the server with all letters in lower case + * and where "realm" is the Kerberos realm of the server. The + * encrypted checksum field included within the Kerberos + * authenticator should contain the server provided 32-bit number + * in network byte order. + */ + + if (result = gen_recv(sock, buf1, sizeof buf1)) { + return result; + } + + len = from64tobits(challenge1.cstr, buf1); + if (len < 0) { + report(stderr, _("could not decode initial BASE64 challenge\n")); + return PS_AUTHFAIL; + } + + /* this patch by Dan Root <dar@thekeep.org> solves an endianess + * problem. */ + { + char tmp[4]; + + *(int *)tmp = ntohl(*(int *) challenge1.cstr); + memcpy(challenge1.cstr, tmp, sizeof(tmp)); + } + + /* Client responds with a Kerberos ticket and an authenticator for + * the principal "imap.hostname@realm" where "hostname" is the + * first component of the host name of the server with all letters + * in lower case and where "realm" is the Kerberos realm of the + * server. The encrypted checksum field included within the + * Kerberos authenticator should contain the server-provided + * 32-bit number in network byte order. + */ + + strncpy(srvinst, truename, (sizeof srvinst)-1); + srvinst[(sizeof srvinst)-1] = '\0'; + for (p = srvinst; *p; p++) { + if (isupper(*p)) { + *p = tolower(*p); + } + } + + strncpy(srvrealm, (char *)krb_realmofhost(srvinst), (sizeof srvrealm)-1); + srvrealm[(sizeof srvrealm)-1] = '\0'; + if (p = strchr(srvinst, '.')) { + *p = '\0'; + } + + result = krb_mk_req(&authenticator, "imap", srvinst, srvrealm, 0); + if (result) { + report(stderr, "krb_mq_req: %s\n", krb_get_err_text(result)); + return PS_AUTHFAIL; + } + + result = krb_get_cred("imap", srvinst, srvrealm, &credentials); + if (result) { + report(stderr, "krb_get_cred: %s\n", krb_get_err_text(result)); + return PS_AUTHFAIL; + } + + memcpy(session, credentials.session, sizeof session); + memset(&credentials, 0, sizeof credentials); + des_key_sched(session, schedule); + + result = krb_get_tf_fullname(TKT_FILE, tktuser, tktinst, tktrealm); + if (result) { + report(stderr, "krb_get_tf_fullname: %s\n", krb_get_err_text(result)); + return PS_AUTHFAIL; + } + +#ifdef __UNUSED__ + /* + * Andrew H. Chatham <andrew.chatham@duke.edu> alleges that this check + * is not necessary and has consistently been messing him up. + */ + if (strcmp(tktuser, user) != 0) { + report(stderr, + _("principal %s in ticket does not match -u %s\n"), tktuser, + user); + return PS_AUTHFAIL; + } +#endif /* __UNUSED__ */ + + if (tktinst[0]) { + report(stderr, + _("non-null instance (%s) might cause strange behavior\n"), + tktinst); + strcat(tktuser, "."); + strcat(tktuser, tktinst); + } + + if (strcmp(tktrealm, srvrealm) != 0) { + strcat(tktuser, "@"); + strcat(tktuser, tktrealm); + } + + result = krb_mk_req(&authenticator, "imap", srvinst, srvrealm, + challenge1.cint); + if (result) { + report(stderr, "krb_mq_req: %s\n", krb_get_err_text(result)); + return PS_AUTHFAIL; + } + + to64frombits(buf1, authenticator.dat, authenticator.length); + if (outlevel >= O_MONITOR) { + report(stdout, "IMAP> %s\n", buf1); + } + strcat(buf1, "\r\n"); + SockWrite(sock, buf1, strlen(buf1)); + + /* Upon decrypting and verifying the ticket and authenticator, the + * server should verify that the contained checksum field equals + * the original server provided random 32-bit number. Should the + * verification be successful, the server must add one to the + * checksum and construct 8 octets of data, with the first four + * octets containing the incremented checksum in network byte + * order, the fifth octet containing a bit-mask specifying the + * protection mechanisms supported by the server, and the sixth + * through eighth octets containing, in network byte order, the + * maximum cipher-text buffer size the server is able to receive. + * The server must encrypt the 8 octets of data in the session key + * and issue that encrypted data in a second ready response. The + * client should consider the server authenticated if the first + * four octets the un-encrypted data is equal to one plus the + * checksum it previously sent. + */ + + if (result = gen_recv(sock, buf1, sizeof buf1)) + return result; + + /* The client must construct data with the first four octets + * containing the original server-issued checksum in network byte + * order, the fifth octet containing the bit-mask specifying the + * selected protection mechanism, the sixth through eighth octets + * containing in network byte order the maximum cipher-text buffer + * size the client is able to receive, and the following octets + * containing a user name string. The client must then append + * from one to eight octets so that the length of the data is a + * multiple of eight octets. The client must then PCBC encrypt the + * data with the session key and respond to the second ready + * response with the encrypted data. The server decrypts the data + * and verifies the contained checksum. The username field + * identifies the user for whom subsequent IMAP operations are to + * be performed; the server must verify that the principal + * identified in the Kerberos ticket is authorized to connect as + * that user. After these verifications, the authentication + * process is complete. + */ + + len = from64tobits(buf2, buf1); + if (len < 0) { + report(stderr, _("could not decode BASE64 ready response\n")); + return PS_AUTHFAIL; + } + + des_ecb_encrypt((des_cblock *)buf2, (des_cblock *)buf2, schedule, 0); + memcpy(challenge2.cstr, buf2, 4); + if (ntohl(challenge2.cint) != challenge1.cint + 1) { + report(stderr, _("challenge mismatch\n")); + return PS_AUTHFAIL; + } + + memset(authenticator.dat, 0, sizeof authenticator.dat); + + result = htonl(challenge1.cint); + memcpy(authenticator.dat, &result, sizeof result); + + /* The protection mechanisms and their corresponding bit-masks are as + * follows: + * + * 1 No protection mechanism + * 2 Integrity (krb_mk_safe) protection + * 4 Privacy (krb_mk_priv) protection + */ + authenticator.dat[4] = 1; + + len = strlen(tktuser); + strncpy(authenticator.dat+8, tktuser, len); + authenticator.length = len + 8 + 1; + while (authenticator.length & 7) { + authenticator.length++; + } + des_pcbc_encrypt((des_cblock *)authenticator.dat, + (des_cblock *)authenticator.dat, authenticator.length, schedule, + &session, 1); + + to64frombits(buf1, authenticator.dat, authenticator.length); + + /* ship down the response, accept the server's error/ok indication */ + suppress_tags = TRUE; + result = gen_transact(sock, buf1, strlen(buf1)); + suppress_tags = FALSE; + if (result) + return(result); + else + return(PS_SUCCESS); +} +#endif /* KERBEROS_V4 */ + +/* kerberos.c ends here */ + |