xref: /titanic_41/usr/src/cmd/cmd-inet/usr.bin/ftp/auth.c (revision 6f45ec7b0b964c3be967c4880e8867ac1e7763a5)
1 /*
2  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 #pragma ident	"%Z%%M%	%I%	%E% SMI"
7 
8 /*
9  * Copyright (c) 1985, 1989 Regents of the University of California.
10  * All rights reserved.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *      This product includes software developed by the University of
23  *      California, Berkeley and its contributors.
24  * 4. Neither the name of the University nor the names of its contributors
25  *    may be used to endorse or promote products derived from this software
26  *    without specific prior written permission.
27  *
28  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
29  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
32  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38  * SUCH DAMAGE.
39  */
40 
41 #include "ftp_var.h"
42 #include <sys/types.h>
43 #include <gssapi/gssapi.h>
44 #include <gssapi/gssapi_ext.h>
45 
46 int	auth_type;	/* Authentication succeeded?  If so, what type? */
47 
48 char	*radix_error(int);
49 static void get_inet_addr_info(struct sockaddr_in6 *, gss_buffer_t);
50 
51 static char *radixN =
52 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
53 static char radix_pad = '=';
54 
55 /*
56  * authenticate the user, if auth_type is AUTHTYPE_NONE
57  *
58  * Returns:	0 if there is no auth type
59  *		1 if success
60  * 		2 if failure
61  */
62 
63 gss_OID		mechoid;
64 gss_ctx_id_t	gcontext;	/* global gss security context */
65 static		const char *gss_trials[] = { "ftp", "host" };
66 /* the number of elements in gss_trials array */
67 static const	int n_gss_trials = sizeof (gss_trials)/sizeof (char *);
68 char		*reply_parse;
69 
70 int
71 do_auth(void)
72 {
73 	int oldverbose = verbose;
74 	uchar_t *out_buf = NULL;
75 	size_t outlen;
76 	int i;
77 
78 	if (auth_type != AUTHTYPE_NONE)
79 	    return (1);		/* auth already succeeded */
80 
81 	/* Other auth types go here ... */
82 
83 	if (command("AUTH %s", "GSSAPI") == CONTINUE) {
84 	    OM_uint32 maj_stat, min_stat;
85 	    gss_name_t target_name;
86 	    gss_buffer_desc send_tok, recv_tok, *token_ptr;
87 	    gss_buffer_desc temp_buf;
88 	    char stbuf[FTPBUFSIZ];
89 	    int comcode, trial;
90 	    int req_flags;
91 	    struct gss_channel_bindings_struct chan;
92 
93 	    get_inet_addr_info(&myctladdr, &temp_buf);
94 	    chan.initiator_addrtype = GSS_C_AF_INET; /* OM_uint32  */
95 	    chan.initiator_address.length =  temp_buf.length;
96 	    chan.initiator_address.value = malloc(temp_buf.length);
97 	    memcpy(chan.initiator_address.value, temp_buf.value,
98 		temp_buf.length);
99 
100 	    get_inet_addr_info(&remctladdr, &temp_buf);
101 	    chan.acceptor_addrtype = GSS_C_AF_INET; /* OM_uint32 */
102 	    chan.acceptor_address.length = temp_buf.length;
103 	    chan.acceptor_address.value = malloc(temp_buf.length);
104 	    memcpy(chan.acceptor_address.value, temp_buf.value,
105 		temp_buf.length);
106 
107 	    chan.application_data.length = 0;
108 	    chan.application_data.value  = 0;
109 
110 	    if (verbose)
111 		(void) printf("GSSAPI accepted as authentication type\n");
112 
113 	    /* set the forward flag */
114 	    req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG;
115 
116 	    if (fflag)
117 		req_flags |= GSS_C_DELEG_FLAG;
118 
119 	    /* blob from gss-client */
120 	    for (trial = 0; trial < n_gss_trials; trial++) {
121 		/* ftp@hostname first, then host@hostname */
122 		/* the V5 GSSAPI binding canonicalizes this for us... */
123 		(void) snprintf(stbuf, FTPBUFSIZ, "%s@%s",
124 			gss_trials[trial], hostname);
125 		if (debug)
126 		    (void) fprintf(stderr,
127 			"Trying to authenticate to <%s>\n", stbuf);
128 
129 		send_tok.value = stbuf;
130 		send_tok.length = strlen(stbuf) + 1;
131 		maj_stat = gss_import_name(&min_stat, &send_tok,
132 			GSS_C_NT_HOSTBASED_SERVICE, &target_name);
133 
134 		if (maj_stat != GSS_S_COMPLETE) {
135 		    user_gss_error(maj_stat, min_stat, "parsing name");
136 		    (void) fprintf(stderr, "name parsed <%s>\n", stbuf);
137 		    continue;
138 		}
139 
140 		token_ptr = GSS_C_NO_BUFFER;
141 		gcontext = GSS_C_NO_CONTEXT; /* structure copy */
142 
143 		do {
144 		    if (debug)
145 			(void) fprintf(stderr,
146 				"calling gss_init_sec_context\n");
147 
148 		    if (mechstr && !mechoid &&
149 			__gss_mech_to_oid(mechstr, (gss_OID*)&mechoid) !=
150 			GSS_S_COMPLETE)
151 				(void) printf("do_auth: %s: not a valid "
152 					"security mechanism\n", mechstr);
153 
154 		    if (!mechoid)
155 			mechoid = GSS_C_NULL_OID;
156 
157 		    maj_stat = gss_init_sec_context(&min_stat,
158 				    GSS_C_NO_CREDENTIAL,
159 				    &gcontext,
160 				    target_name,
161 				    mechoid,
162 				    req_flags,
163 				    0,
164 				    &chan,	/* channel bindings */
165 				    token_ptr,
166 				    NULL,	/* ignore mech type */
167 				    &send_tok,
168 				    NULL,	/* ignore ret_flags */
169 				    NULL);	/* ignore time_rec */
170 
171 		    if (maj_stat != GSS_S_COMPLETE &&
172 			maj_stat != GSS_S_CONTINUE_NEEDED) {
173 
174 			/* return an error if this is NOT the ftp ticket */
175 			if (strcmp(gss_trials[trial], "ftp"))
176 				user_gss_error(maj_stat, min_stat,
177 					"initializing context");
178 
179 			(void) gss_release_name(&min_stat, &target_name);
180 			/* could just be that we missed on the service name */
181 			goto outer_loop;
182 
183 		    }
184 
185 		if (send_tok.length != 0) {
186 		    int len = send_tok.length;
187 		    reply_parse = "ADAT="; /* for command() later */
188 		    oldverbose = verbose;
189 		    verbose = (trial == n_gss_trials-1)?0:-1;
190 
191 		    outlen = ENCODELEN(send_tok.length);
192 		    out_buf = (uchar_t *)malloc(outlen);
193 		    if (out_buf == NULL) {
194 			(void) fprintf(stderr, "memory error allocating "
195 				"auth buffer\n");
196 			maj_stat = GSS_S_FAILURE;
197 			goto outer_loop;
198 		    }
199 		    auth_error = radix_encode(send_tok.value, out_buf,
200 			outlen, &len, 0);
201 
202 		    if (auth_error)  {
203 			(void) fprintf(stderr, "Base 64 encoding failed: %s\n",
204 				radix_error(auth_error));
205 		    } else if ((comcode = command("ADAT %s", out_buf))
206 			!= COMPLETE /* && comcode != 3 (335)*/) {
207 
208 			if (trial == n_gss_trials-1) {
209 			    (void) fprintf(stderr, "GSSAPI ADAT failed (%d)\n",
210 				comcode);
211 
212 			    /* force out of loop */
213 			    maj_stat = GSS_S_FAILURE;
214 			}
215 
216 			/*
217 			 * backoff to the v1 gssapi is still possible.
218 			 * Send a new AUTH command.  If that fails,
219 			 * terminate the loop
220 			 */
221 			if (command("AUTH %s", "GSSAPI") != CONTINUE) {
222 			    (void) fprintf(stderr,
223 				"GSSAPI ADAT failed, AUTH restart failed\n");
224 			    /* force out of loop */
225 			    maj_stat = GSS_S_FAILURE;
226 			}
227 
228 			goto outer_loop;
229 		    } else if (!reply_parse) {
230 			(void) fprintf(stderr,
231 			    "No authentication data received from server\n");
232 			if (maj_stat == GSS_S_COMPLETE) {
233 			    (void) fprintf(stderr,
234 				"...but no more was needed\n");
235 			    goto gss_complete_loop;
236 			} else {
237 			    user_gss_error(maj_stat, min_stat, "no reply.");
238 			    goto gss_complete_loop;
239 			}
240 		    } else if (auth_error = radix_encode((uchar_t *)
241 			reply_parse, out_buf, outlen, &i, 1)) {
242 			    (void) fprintf(stderr,
243 				"Base 64 decoding failed: %s\n",
244 				radix_error(auth_error));
245 		    } else {
246 			/* everything worked */
247 			token_ptr = &recv_tok;
248 			recv_tok.value = out_buf;
249 			recv_tok.length = i;
250 			continue;
251 		    } /* end if (auth_error) */
252 
253 /* get out of loop clean */
254 gss_complete_loop:
255 		    trial = n_gss_trials-1;
256 		    gss_release_buffer(&min_stat, &send_tok);
257 		    gss_release_name(&min_stat, &target_name);
258 		    goto outer_loop;
259 		} /* end if (send_tok.length != 0) */
260 
261 	    } while (maj_stat == GSS_S_CONTINUE_NEEDED);
262 
263 outer_loop:
264 	    if (maj_stat == GSS_S_COMPLETE)
265 		break;
266 
267 	    } /* end for loop */
268 
269 	    verbose = oldverbose;
270 	    if (out_buf != NULL)
271 		free(out_buf);
272 
273 	    if (maj_stat == GSS_S_COMPLETE) {
274 		(void) printf("GSSAPI authentication succeeded\n");
275 		reply_parse = NULL;
276 		auth_type = AUTHTYPE_GSSAPI;
277 		return (1);
278 	    } else {
279 		(void) fprintf(stderr, "GSSAPI authentication failed\n");
280 		reply_parse = NULL;
281 	    }
282 	} /* end if (command...) */
283 
284 	/* Other auth types go here ... */
285 
286 	return (0);
287 }
288 
289 /*
290  * Get the information for the channel structure.
291  */
292 void
293 get_inet_addr_info(struct sockaddr_in6 *in_ipaddr, gss_buffer_t in_buffer)
294 {
295 	size_t length;
296 	char *value;
297 
298 	if (in_ipaddr == NULL) {
299 		in_buffer->length = 0;
300 		in_buffer->value = NULL;
301 		return;
302 	}
303 
304 	/* get the initiator address.value and address.length */
305 
306 	if (in_ipaddr->sin6_family == AF_INET6) {
307 		struct in_addr in_ipv4addr;
308 		struct sockaddr_in6 *sin6 =
309 			(struct sockaddr_in6 *)in_ipaddr;
310 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
311 			IN6_V4MAPPED_TO_INADDR(&sin6->sin6_addr,
312 				&in_ipv4addr);
313 			in_buffer->length = length = sizeof (struct in_addr);
314 			in_buffer->value = value = malloc(length);
315 			memcpy(value, &in_ipv4addr, length);
316 		} else {
317 			in_buffer->length = length = sizeof (struct in6_addr);
318 			in_buffer->value = value = malloc(length);
319 			memcpy(value, &(sin6->sin6_addr.s6_addr),
320 				length);
321 		}
322 	} else {
323 		in_buffer->length = length = sizeof (struct in_addr);
324 		in_buffer->value = value = malloc(in_buffer->length);
325 		memcpy(value,
326 			&((struct sockaddr_in *)(in_ipaddr))->sin_addr,
327 			length);
328 	}
329 }
330 
331 int
332 radix_encode(uchar_t *inbuf, uchar_t *outbuf, size_t buflen,
333 	int *outlen, int decode)
334 {
335 	int i, j, D;
336 	char *p;
337 	uchar_t c;
338 
339 	if (decode) {
340 		for (i = j = 0;
341 		    inbuf[i] && inbuf[i] != radix_pad && (j < buflen);
342 		    i++) {
343 		    if ((p = strchr(radixN, inbuf[i])) == NULL)
344 			return (1);
345 		    D = p - radixN;
346 		    switch (i&3) {
347 			case 0:
348 			    outbuf[j] = D<<2;
349 			    break;
350 			case 1:
351 			    outbuf[j++] |= D>>4;
352 			    outbuf[j] = (D&15)<<4;
353 			    break;
354 			case 2:
355 			    outbuf[j++] |= D>>2;
356 			    outbuf[j] = (D&3)<<6;
357 			    break;
358 			case 3:
359 			    outbuf[j++] |= D;
360 		    }
361 		}
362 		if (j == buflen && (inbuf[i] && inbuf[i] != radix_pad)) {
363 			return (4);
364 		}
365 		switch (i&3) {
366 			case 1: return (3);
367 			case 2: if (D&15)
368 					return (3);
369 				if (strcmp((char *)&inbuf[i], "=="))
370 					return (2);
371 				break;
372 			case 3: if (D&3)
373 					return (3);
374 				if (strcmp((char *)&inbuf[i], "="))
375 					return (2);
376 		}
377 		*outlen = j;
378 	} else {
379 		for (i = j = 0; i < *outlen && j < buflen; i++)
380 		    switch (i%3) {
381 			case 0:
382 			    outbuf[j++] = radixN[inbuf[i]>>2];
383 			    c = (inbuf[i]&3)<<4;
384 			    break;
385 			case 1:
386 			    outbuf[j++] = radixN[c|inbuf[i]>>4];
387 			    c = (inbuf[i]&15)<<2;
388 			    break;
389 			case 2:
390 			    outbuf[j++] = radixN[c|inbuf[i]>>6];
391 			    outbuf[j++] = radixN[inbuf[i]&63];
392 			    c = 0;
393 		    }
394 		if (j == buflen && i < *outlen) {
395 			return (4);
396 		}
397 		if (i%3)
398 			outbuf[j++] = radixN[c];
399 		switch (i%3) {
400 			case 1:
401 				outbuf[j++] = radix_pad;
402 				/* FALLTHROUGH */
403 			case 2:
404 				outbuf[j++] = radix_pad;
405 				break;
406 		}
407 		outbuf[*outlen = j] = '\0';
408 	}
409 	return (0);
410 }
411 
412 char *
413 radix_error(int e)
414 {
415 	switch (e) {
416 	    case 0:  return ("Success");
417 	    case 1:  return ("Bad character in encoding");
418 	    case 2:  return ("Encoding not properly padded");
419 	    case 3:  return ("Decoded # of bits not a multiple of 8");
420 	    case 4:  return ("Buffer size error");
421 	    default: return ("Unknown error");
422 	}
423 }
424