Cross Reference: /dovecot/src/auth/mech-gssapi.c
mech-gssapi.c revision e03ec0b7b9d92551331bc509bcd86920544171d1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen/*
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen * GSSAPI Module
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen *
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen * Copyright (c) 2005 Jelmer Vernooij <jelmer@samba.org>
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen *
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen * Related standards:
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen * - draft-ietf-sasl-gssapi-03
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen * - RFC2222
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen *
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen * Some parts inspired by an older patch from Colin Walters
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen *
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen * This program is free software; you can redistribute it and/or modify
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen * it under the terms of the GNU Lesser General Public License as published
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen * by the Free Software Foundation; either version 2 of the License, or
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen * (at your option) any later version.
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen */
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#include "common.h"
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#include "mech.h"
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#include "passdb.h"
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#include "str.h"
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#include "str-sanitize.h"
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#include "buffer.h"
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#include "hex-binary.h"
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#include "safe-memset.h"
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#include "hostpid.h"
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#ifdef HAVE_GSSAPI
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#include <gssapi/gssapi.h>
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen/* Non-zero flags defined in RFC 2222 */
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenenum sasl_gssapi_qop {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen SASL_GSSAPI_QOP_UNSPECIFIED = 0x00,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen SASL_GSSAPI_QOP_AUTH_ONLY = 0x01,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen SASL_GSSAPI_QOP_AUTH_INT = 0x02,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen SASL_GSSAPI_QOP_AUTH_CONF = 0x04
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen};
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstruct gssapi_auth_request {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen struct auth_request auth_request;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_ctx_id_t gss_ctx;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_cred_id_t service_cred;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen enum {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_STATE_SEC_CONTEXT,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_STATE_WRAP,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_STATE_UNWRAP
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen } sasl_gssapi_state;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_name_t authn_name;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_name_t authz_name;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen pool_t pool;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen};
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstatic void auth_request_log_gss_error(struct auth_request *request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen OM_uint32 status_value, int status_type,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen const char *description)
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen{
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen OM_uint32 message_context = 0;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen OM_uint32 major_status, minor_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_buffer_desc status_string;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen do {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_display_status(&minor_status, status_value,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen status_type, GSS_C_NO_OID,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &message_context,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &status_string);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_error(request, "gssapi",
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "While %s: %s", description,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen str_sanitize(status_string.value, (size_t)-1));
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_release_buffer(&minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &status_string);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen } while (message_context != 0);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen}
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstatic struct auth_request *mech_gssapi_auth_new(void)
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen{
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen struct gssapi_auth_request *request;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen pool_t pool;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
e03ec0b7b9d92551331bc509bcd86920544171d1Timo Sirainen pool = pool_alloconly_create("gssapi_auth_request", 1024);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request = p_new(pool, struct gssapi_auth_request, 1);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->pool = pool;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->gss_ctx = GSS_C_NO_CONTEXT;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->auth_request.pool = pool;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return &request->auth_request;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen}
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstatic OM_uint32 obtain_service_credentials(struct auth_request *request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_cred_id_t *ret)
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen{
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen OM_uint32 major_status, minor_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen string_t *principal_name;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_buffer_desc inbuf;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_name_t gss_principal;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen principal_name = t_str_new(128);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen str_append(principal_name, t_str_lcase(request->service));
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen str_append_c(principal_name, '@');
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen str_append(principal_name, my_hostname);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_info(request, "gssapi",
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "Obtaining credentials for %s", str_c(principal_name));
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen inbuf.length = str_len(principal_name);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen inbuf.value = str_c_modifyable(principal_name);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_import_name(&minor_status, &inbuf,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_NT_HOSTBASED_SERVICE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &gss_principal);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen str_free(principal_name);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (GSS_ERROR(major_status)) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_gss_error(request, major_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_GSS_CODE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "importing principal name");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return major_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_acquire_cred(&minor_status, gss_principal, 0,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_NULL_OID_SET, GSS_C_ACCEPT,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen ret, NULL, NULL);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (GSS_ERROR(major_status)) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_gss_error(request, major_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_GSS_CODE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "acquiring service credentials");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_gss_error(request, minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_MECH_CODE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "acquiring service credentials");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return major_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_release_name(&minor_status, gss_principal);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return major_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen}
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstatic gss_name_t
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenimport_name(struct auth_request *request, void *str, size_t len)
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen{
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen OM_uint32 major_status, minor_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_buffer_desc name_buf;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_name_t name;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen name_buf.value = str;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen name_buf.length = len;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_import_name(&minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &name_buf,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_NO_OID,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &name);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (GSS_ERROR(major_status)) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_gss_error(request, major_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_GSS_CODE, "gss_import_name");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return GSS_C_NO_NAME;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return name;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen}
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstatic void gssapi_sec_context(struct gssapi_auth_request *request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_buffer_desc inbuf)
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen{
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen OM_uint32 major_status, minor_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_buffer_desc outbuf;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_accept_sec_context (
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &request->gss_ctx,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->service_cred,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &inbuf,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_NO_CHANNEL_BINDINGS,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &request->authn_name,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen NULL, /* mech_type */
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &outbuf,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen NULL, /* ret_flags */
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen NULL, /* time_rec */
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen NULL /* delegated_cred_handle */
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen );
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (GSS_ERROR(major_status)) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_gss_error(&request->auth_request, major_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_GSS_CODE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "processing incoming data");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_gss_error(&request->auth_request, minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_MECH_CODE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "processing incoming data");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_fail(&request->auth_request);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (major_status == GSS_S_COMPLETE) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->sasl_gssapi_state = GSS_STATE_WRAP;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_info(&request->auth_request, "gssapi",
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "security context state completed.");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen } else {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_info(&request->auth_request, "gssapi",
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "Processed incoming packet correctly, "
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "waiting for another.");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->auth_request.callback(&request->auth_request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen AUTH_CLIENT_RESULT_CONTINUE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen outbuf.value, outbuf.length);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_release_buffer(&minor_status, &outbuf);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen}
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstatic void gssapi_wrap(struct gssapi_auth_request *request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_buffer_desc inbuf)
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen{
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen OM_uint32 major_status, minor_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_buffer_desc outbuf;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen unsigned char ret[4];
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen /* The clients return data should be empty here */
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen /* Only authentication, no integrity or confidentiality
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen protection (yet?) */
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen ret[0] = (SASL_GSSAPI_QOP_UNSPECIFIED |
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen SASL_GSSAPI_QOP_AUTH_ONLY);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen ret[1] = 0xFF;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen ret[2] = 0xFF;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen ret[3] = 0xFF;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen inbuf.length = 4;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen inbuf.value = ret;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_wrap(&minor_status, request->gss_ctx, 0,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_QOP_DEFAULT, &inbuf, NULL, &outbuf);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (GSS_ERROR(major_status)) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_gss_error(&request->auth_request, major_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_GSS_CODE, "sending security layer negotiation");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_gss_error(&request->auth_request, minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_MECH_CODE, "sending security layer negotiation");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_fail(&request->auth_request);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_info(&request->auth_request, "gssapi",
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "Negotiated security layer");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->auth_request.callback(&request->auth_request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen AUTH_CLIENT_RESULT_CONTINUE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen outbuf.value, outbuf.length);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_release_buffer(&minor_status, &outbuf);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->sasl_gssapi_state = GSS_STATE_UNWRAP;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen}
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstatic void gssapi_unwrap(struct gssapi_auth_request *request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_buffer_desc inbuf)
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen{
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen OM_uint32 major_status, minor_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_buffer_desc outbuf;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen int equal_authn_authz = 0;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_unwrap(&minor_status, request->gss_ctx,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &inbuf, &outbuf, NULL, NULL);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (GSS_ERROR(major_status)) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_gss_error(&request->auth_request, major_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_GSS_CODE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "final negotiation: gss_unwrap");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_fail(&request->auth_request);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (outbuf.length <= 4) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_error(&request->auth_request, "gssapi",
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "Invalid response length");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_fail(&request->auth_request);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->authz_name = import_name(&request->auth_request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen (unsigned char *)outbuf.value + 4,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen outbuf.length - 4);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if ((request->authn_name == GSS_C_NO_NAME) ||
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen (request->authz_name == GSS_C_NO_NAME)) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen /* XXX (pod): is this check necessary? */
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_error(&request->auth_request, "gssapi",
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "one of authn_name or authz_name not determined");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_fail(&request->auth_request);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_compare_name(&minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->authn_name,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->authz_name,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &equal_authn_authz);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (equal_authn_authz == 0) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_log_error(&request->auth_request, "gssapi",
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "authn_name and authz_name differ: not supported");
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_fail(&request->auth_request);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->auth_request.user =
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen p_strndup(request->auth_request.pool,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen (unsigned char *)outbuf.value + 4,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen outbuf.length - 4);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_success(&request->auth_request, NULL, 0);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen}
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstatic void
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenmech_gssapi_auth_continue(struct auth_request *request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen const unsigned char *data, size_t data_size)
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen{
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen struct gssapi_auth_request *gssapi_request =
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen (struct gssapi_auth_request *)request;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gss_buffer_desc inbuf;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen inbuf.value = (void *)data;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen inbuf.length = data_size;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen switch (gssapi_request->sasl_gssapi_state) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen case GSS_STATE_SEC_CONTEXT:
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gssapi_sec_context(gssapi_request, inbuf);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen break;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen case GSS_STATE_WRAP:
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gssapi_wrap(gssapi_request, inbuf);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen break;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen case GSS_STATE_UNWRAP:
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gssapi_unwrap(gssapi_request, inbuf);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen break;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen}
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstatic void
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenmech_gssapi_auth_initial(struct auth_request *request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen const unsigned char *data, size_t data_size)
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen{
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen OM_uint32 major_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen struct gssapi_auth_request *gssapi_request =
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen (struct gssapi_auth_request *)request;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status =
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen obtain_service_credentials(request,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &gssapi_request->service_cred);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (GSS_ERROR(major_status)) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen auth_request_internal_failure(request);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen return;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gssapi_request->authn_name = GSS_C_NO_NAME;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gssapi_request->authz_name = GSS_C_NO_NAME;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen gssapi_request->sasl_gssapi_state = GSS_STATE_SEC_CONTEXT;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen if (data_size == 0) {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen /* The client should go first */
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen request->callback(request, AUTH_CLIENT_RESULT_CONTINUE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen NULL, 0);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen } else {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen mech_gssapi_auth_continue(request, data, data_size);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen }
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen}
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenstatic void
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenmech_gssapi_auth_free(struct auth_request *request)
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen{
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen OM_uint32 major_status, minor_status;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen struct gssapi_auth_request *gssapi_request =
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen (struct gssapi_auth_request *)request;
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_delete_sec_context(&minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &gssapi_request->gss_ctx,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen GSS_C_NO_BUFFER);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_release_cred(&minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &gssapi_request->service_cred);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_release_name(&minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &gssapi_request->authn_name);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen major_status = gss_release_name(&minor_status,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen &gssapi_request->authz_name);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen pool_unref(request->pool);
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen}
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainenconst struct mech_module mech_gssapi = {
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen "GSSAPI",
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen MEMBER(flags) 0,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen MEMBER(need_passdb) FALSE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen MEMBER(passdb_need_plain) FALSE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen MEMBER(passdb_need_credentials) FALSE,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen mech_gssapi_auth_new,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen mech_gssapi_auth_initial,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen mech_gssapi_auth_continue,
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen mech_gssapi_auth_free
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen};
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen
0469ed17dafcc56589ce00960a23f4f06817dfb5Timo Sirainen#endif