aboutsummaryrefslogtreecommitdiffstats
Commit message (Expand)AuthorAgeFilesLines
...
* Make current.Eric S. Raymond1997-10-161-1/+3
* *** empty log message ***Eric S. Raymond1997-10-161-0/+1
* Try to fix IMAP-K4 yet again.Eric S. Raymond1997-10-161-5/+9
* Wolfgang Wander's patches.Eric S. Raymond1997-10-156-5/+26
* Ready to ship.Eric S. Raymond1997-10-141-1/+1
* Fix IMAP-K4.Eric S. Raymond1997-10-142-6/+7
* RF conformance.Eric S. Raymond1997-10-142-5/+11
* Use UDP for DNS queries to avoid diald problems.Eric S. Raymond1997-10-141-2/+12
* Ready to ship.Eric S. Raymond1997-10-132-2/+2
* Added envelope-skip feature.Eric S. Raymond1997-10-136-3/+40
* Correct the list.Eric S. Raymond1997-10-131-1/+1
* Fix ETRN mode.Eric S. Raymond1997-10-135-9/+19
* Fix bug in processing of multiple -S args.Eric S. Raymond1997-10-132-1/+2
* RFC reference cleanup.Eric S. Raymond1997-10-122-4/+5
* Update.Eric S. Raymond1997-10-111-6/+12
* Add helpful comment.Eric S. Raymond1997-10-111-0/+1
* Minor fix.Eric S. Raymond1997-10-111-1/+1
* We can print real entries now.Eric S. Raymond1997-10-101-15/+24
* E\verything fits in 640x480 now.Eric S. Raymond1997-10-101-46/+57
* Added qvirtual and invisible.Eric S. Raymond1997-10-101-1/+24
* Initial revisionEric S. Raymond1997-10-101-0/+929
* -Wall cleanup.Eric S. Raymond1997-10-105-14/+9
* Minor tweaks.Eric S. Raymond1997-10-104-3/+13
* Fixed the route bug.Eric S. Raymond1997-10-091-2/+5
* Handle RFC822 routes.Eric S. Raymond1997-10-091-0/+3
* Ooops.Eric S. Raymond1997-10-091-1/+1
* Added the --invisible option.Eric S. Raymond1997-10-089-37/+63
* = now optional.Eric S. Raymond1997-10-083-5/+8
* Fix the limit/repoll bug.Eric S. Raymond1997-10-082-1/+2
* Port fixes.Eric S. Raymond1997-10-084-7/+25
* We know how to make a release.Eric S. Raymond1997-10-061-1/+2
* Ready to ship.Eric S. Raymond1997-10-063-9/+8
* Better behavior on line hits.Eric S. Raymond1997-10-067-27/+88
* Fixed R4.Eric S. Raymond1997-10-061-5/+7
* Added new R4 on Yair's coredump.Eric S. Raymond1997-10-061-9/+26
* Don't parse the greeting line.Eric S. Raymond1997-10-061-1/+3
* We don't try to parse the greeting line any more.Eric S. Raymond1997-10-061-87/+10
* Silence killed!Eric S. Raymond1997-10-061-1/+4
* This is what I'm sending to Grek Stark.Eric S. Raymond1997-10-051-3/+4
* Fix the Kooijman bug.Eric S. Raymond1997-10-051-6/+10
* Enable conditioning out of POP3, IMAP, ETRN.Eric S. Raymond1997-10-049-6/+89
* Simplify life.Eric S. Raymond1997-10-041-1/+1
* Have dump_params notice when syslog is on.Eric S. Raymond1997-10-041-0/+4
* Announcement list.Eric S. Raymond1997-10-041-13/+18
* Length checking on tag generation.Eric S. Raymond1997-10-042-5/+17
* Fix groupnames bug.Eric S. Raymond1997-10-042-3/+7
* HP OpenMail.Eric S. Raymond1997-10-031-2/+15
* Typo fix.Eric S. Raymond1997-10-031-3/+3
* Minor corrections.Eric S. Raymond1997-10-031-16/+17
* Apply Wolf Schmidt's fixes to the RPA dialogue.Eric S. Raymond1997-10-021-35/+42
generated by cgit v1.2.3 (git 2.46.0) at 2026-04-17 10:02:39 +0000
"p">]; } challenge1, challenge2; char srvinst[INST_SZ]; char *p; char srvrealm[REALM_SZ]; KTEXT_ST authenticator; CREDENTIALS credentials; char tktuser[MAX_K_NAME_SZ+1+INST_SZ+1+REALM_SZ+1]; char tktinst[INST_SZ]; char tktrealm[REALM_SZ]; des_cblock session; des_key_schedule schedule; gen_send(sock, "%s KERBEROS_V4", command); /* The data encoded in the first ready response contains a random * 32-bit number in network byte order. The client should respond * with a Kerberos ticket and an authenticator for the principal * "imap.hostname@realm", where "hostname" is the first component * of the host name of the server with all letters in lower case * and where "realm" is the Kerberos realm of the server. The * encrypted checksum field included within the Kerberos * authenticator should contain the server provided 32-bit number * in network byte order. */ if ((result = gen_recv(sock, buf1, sizeof buf1)) != 0) { return result; } len = from64tobits(challenge1.cstr, buf1, sizeof(challenge1.cstr)); if (len < 0) { report(stderr, GT_("could not decode initial BASE64 challenge\n")); return PS_AUTHFAIL; } /* this patch by Dan Root <dar@thekeep.org> solves an endianess * problem. */ { char tmp[4]; *(int *)tmp = ntohl(*(int *) challenge1.cstr); memcpy(challenge1.cstr, tmp, sizeof(tmp)); } /* Client responds with a Kerberos ticket and an authenticator for * the principal "imap.hostname@realm" where "hostname" is the * first component of the host name of the server with all letters * in lower case and where "realm" is the Kerberos realm of the * server. The encrypted checksum field included within the * Kerberos authenticator should contain the server-provided * 32-bit number in network byte order. */ strncpy(srvinst, truename, (sizeof srvinst)-1); srvinst[(sizeof srvinst)-1] = '\0'; for (p = srvinst; *p; p++) { if (isupper((unsigned char)*p)) { *p = tolower((unsigned char)*p); } } strncpy(srvrealm, (char *)krb_realmofhost(srvinst), (sizeof srvrealm)-1); srvrealm[(sizeof srvrealm)-1] = '\0'; if ((p = strchr(srvinst, '.')) != NULL) { *p = '\0'; } result = krb_mk_req(&authenticator, "imap", srvinst, srvrealm, 0); if (result) { report(stderr, "krb_mq_req: %s\n", krb_get_err_text(result)); return PS_AUTHFAIL; } result = krb_get_cred("imap", srvinst, srvrealm, &credentials); if (result) { report(stderr, "krb_get_cred: %s\n", krb_get_err_text(result)); return PS_AUTHFAIL; } memcpy(session, credentials.session, sizeof session); memset(&credentials, 0, sizeof credentials); des_key_sched(&session, schedule); result = krb_get_tf_fullname(TKT_FILE, tktuser, tktinst, tktrealm); if (result) { report(stderr, "krb_get_tf_fullname: %s\n", krb_get_err_text(result)); return PS_AUTHFAIL; } #ifdef __UNUSED__ /* * Andrew H. Chatham <andrew.chatham@duke.edu> alleges that this check * is not necessary and has consistently been messing him up. */ if (strcmp(tktuser, user) != 0) { report(stderr, GT_("principal %s in ticket does not match -u %s\n"), tktuser, user); return PS_AUTHFAIL; } #endif /* __UNUSED__ */ if (tktinst[0]) { report(stderr, GT_("non-null instance (%s) might cause strange behavior\n"), tktinst); strlcat(tktuser, ".", sizeof(tktuser)); strlcat(tktuser, tktinst, sizeof(tktuser)); } if (strcmp(tktrealm, srvrealm) != 0) { strlcat(tktuser, "@", sizeof(tktuser)); strlcat(tktuser, tktrealm, sizeof(tktuser)); } result = krb_mk_req(&authenticator, "imap", srvinst, srvrealm, challenge1.cint); if (result) { report(stderr, "krb_mq_req: %s\n", krb_get_err_text(result)); return PS_AUTHFAIL; } to64frombits(buf1, authenticator.dat, authenticator.length); if (outlevel >= O_MONITOR) { report(stdout, "IMAP> %s\n", buf1); } strcat(buf1, "\r\n"); SockWrite(sock, buf1, strlen(buf1)); /* Upon decrypting and verifying the ticket and authenticator, the * server should verify that the contained checksum field equals * the original server provided random 32-bit number. Should the * verification be successful, the server must add one to the * checksum and construct 8 octets of data, with the first four * octets containing the incremented checksum in network byte * order, the fifth octet containing a bit-mask specifying the * protection mechanisms supported by the server, and the sixth * through eighth octets containing, in network byte order, the * maximum cipher-text buffer size the server is able to receive. * The server must encrypt the 8 octets of data in the session key * and issue that encrypted data in a second ready response. The * client should consider the server authenticated if the first * four octets the un-encrypted data is equal to one plus the * checksum it previously sent. */ if ((result = gen_recv(sock, buf1, sizeof buf1)) != 0) return result; /* The client must construct data with the first four octets * containing the original server-issued checksum in network byte * order, the fifth octet containing the bit-mask specifying the * selected protection mechanism, the sixth through eighth octets * containing in network byte order the maximum cipher-text buffer * size the client is able to receive, and the following octets * containing a user name string. The client must then append * from one to eight octets so that the length of the data is a * multiple of eight octets. The client must then PCBC encrypt the * data with the session key and respond to the second ready * response with the encrypted data. The server decrypts the data * and verifies the contained checksum. The username field * identifies the user for whom subsequent IMAP operations are to * be performed; the server must verify that the principal * identified in the Kerberos ticket is authorized to connect as * that user. After these verifications, the authentication * process is complete. */ len = from64tobits(buf2, buf1, sizeof(buf2)); if (len < 0) { report(stderr, GT_("could not decode BASE64 ready response\n")); return PS_AUTHFAIL; } des_ecb_encrypt((des_cblock *)buf2, (des_cblock *)buf2, schedule, 0); memcpy(challenge2.cstr, buf2, 4); if ((int32)ntohl(challenge2.cint) != challenge1.cint + 1) { report(stderr, GT_("challenge mismatch\n")); return PS_AUTHFAIL; } memset(authenticator.dat, 0, sizeof authenticator.dat); result = htonl(challenge1.cint); memcpy(authenticator.dat, &result, sizeof result); /* The protection mechanisms and their corresponding bit-masks are as * follows: * * 1 No protection mechanism * 2 Integrity (krb_mk_safe) protection * 4 Privacy (krb_mk_priv) protection */ authenticator.dat[4] = 1; len = strlen(tktuser); strncpy((char *)authenticator.dat+8, tktuser, len); authenticator.length = len + 8 + 1; while (authenticator.length & 7) { authenticator.length++; } des_pcbc_encrypt((const unsigned char *)authenticator.dat, (unsigned char *)authenticator.dat, authenticator.length, schedule, &session, 1); to64frombits(buf1, authenticator.dat, authenticator.length); /* ship down the response, accept the server's error/ok indication */ suppress_tags = TRUE; result = gen_transact(sock, "%s", buf1); suppress_tags = FALSE; if (result) return(result); else return(PS_SUCCESS); } #endif /* KERBEROS_V4 */ /* kerberos.c ends here */
generated by cgit v1.2.3 (git 2.46.0) at 2026-04-17 10:02:39 +0000