krb4.c revision 55682
1188943Sthompsa/* 2188943Sthompsa * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska H�gskolan 3188943Sthompsa * (Royal Institute of Technology, Stockholm, Sweden). 4188943Sthompsa * All rights reserved. 5188943Sthompsa * 6188943Sthompsa * Redistribution and use in source and binary forms, with or without 7188943Sthompsa * modification, are permitted provided that the following conditions 8188943Sthompsa * are met: 9188943Sthompsa * 10188943Sthompsa * 1. Redistributions of source code must retain the above copyright 11188943Sthompsa * notice, this list of conditions and the following disclaimer. 12188943Sthompsa * 13188943Sthompsa * 2. Redistributions in binary form must reproduce the above copyright 14188943Sthompsa * notice, this list of conditions and the following disclaimer in the 15188943Sthompsa * documentation and/or other materials provided with the distribution. 16188943Sthompsa * 17188943Sthompsa * 3. Neither the name of the Institute nor the names of its contributors 18188943Sthompsa * may be used to endorse or promote products derived from this software 19188943Sthompsa * without specific prior written permission. 20188943Sthompsa * 21188943Sthompsa * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22188943Sthompsa * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23188943Sthompsa * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24188943Sthompsa * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25188943Sthompsa * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26188943Sthompsa * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27188943Sthompsa * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28319182Sngie * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29188943Sthompsa * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30188943Sthompsa * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31188943Sthompsa * SUCH DAMAGE. 32188943Sthompsa */ 33188943Sthompsa 34188943Sthompsa#ifdef FTP_SERVER 35188943Sthompsa#include "ftpd_locl.h" 36188943Sthompsa#else 37#include "ftp_locl.h" 38#endif 39#include <krb.h> 40 41RCSID("$Id: krb4.c,v 1.37 1999/12/06 17:10:13 assar Exp $"); 42 43#ifdef FTP_SERVER 44#define LOCAL_ADDR ctrl_addr 45#define REMOTE_ADDR his_addr 46#else 47#define LOCAL_ADDR myctladdr 48#define REMOTE_ADDR hisctladdr 49#endif 50 51extern struct sockaddr *LOCAL_ADDR, *REMOTE_ADDR; 52 53struct krb4_data { 54 des_cblock key; 55 des_key_schedule schedule; 56 char name[ANAME_SZ]; 57 char instance[INST_SZ]; 58 char realm[REALM_SZ]; 59}; 60 61static int 62krb4_check_prot(void *app_data, int level) 63{ 64 if(level == prot_confidential) 65 return -1; 66 return 0; 67} 68 69static int 70krb4_decode(void *app_data, void *buf, int len, int level) 71{ 72 MSG_DAT m; 73 int e; 74 struct krb4_data *d = app_data; 75 76 if(level == prot_safe) 77 e = krb_rd_safe(buf, len, &d->key, 78 (struct sockaddr_in *)REMOTE_ADDR, 79 (struct sockaddr_in *)LOCAL_ADDR, &m); 80 else 81 e = krb_rd_priv(buf, len, d->schedule, &d->key, 82 (struct sockaddr_in *)REMOTE_ADDR, 83 (struct sockaddr_in *)LOCAL_ADDR, &m); 84 if(e){ 85 syslog(LOG_ERR, "krb4_decode: %s", krb_get_err_text(e)); 86 return -1; 87 } 88 memmove(buf, m.app_data, m.app_length); 89 return m.app_length; 90} 91 92static int 93krb4_overhead(void *app_data, int level, int len) 94{ 95 return 31; 96} 97 98static int 99krb4_encode(void *app_data, void *from, int length, int level, void **to) 100{ 101 struct krb4_data *d = app_data; 102 *to = malloc(length + 31); 103 if(level == prot_safe) 104 return krb_mk_safe(from, *to, length, &d->key, 105 (struct sockaddr_in *)LOCAL_ADDR, 106 (struct sockaddr_in *)REMOTE_ADDR); 107 else if(level == prot_private) 108 return krb_mk_priv(from, *to, length, d->schedule, &d->key, 109 (struct sockaddr_in *)LOCAL_ADDR, 110 (struct sockaddr_in *)REMOTE_ADDR); 111 else 112 return -1; 113} 114 115#ifdef FTP_SERVER 116 117static int 118krb4_adat(void *app_data, void *buf, size_t len) 119{ 120 KTEXT_ST tkt; 121 AUTH_DAT auth_dat; 122 char *p; 123 int kerror; 124 u_int32_t cs; 125 char msg[35]; /* size of encrypted block */ 126 int tmp_len; 127 struct krb4_data *d = app_data; 128 char inst[INST_SZ]; 129 struct sockaddr_in *his_addr_sin = (struct sockaddr_in *)his_addr; 130 131 memcpy(tkt.dat, buf, len); 132 tkt.length = len; 133 134 k_getsockinst(0, inst, sizeof(inst)); 135 kerror = krb_rd_req(&tkt, "ftp", inst, 136 his_addr_sin->sin_addr.s_addr, &auth_dat, ""); 137 if(kerror == RD_AP_UNDEC){ 138 k_getsockinst(0, inst, sizeof(inst)); 139 kerror = krb_rd_req(&tkt, "rcmd", inst, 140 his_addr_sin->sin_addr.s_addr, &auth_dat, ""); 141 } 142 143 if(kerror){ 144 reply(535, "Error reading request: %s.", krb_get_err_text(kerror)); 145 return -1; 146 } 147 148 memcpy(d->key, auth_dat.session, sizeof(d->key)); 149 des_set_key(&d->key, d->schedule); 150 151 strlcpy(d->name, auth_dat.pname, sizeof(d->name)); 152 strlcpy(d->instance, auth_dat.pinst, sizeof(d->instance)); 153 strlcpy(d->realm, auth_dat.prealm, sizeof(d->instance)); 154 155 cs = auth_dat.checksum + 1; 156 { 157 unsigned char tmp[4]; 158 KRB_PUT_INT(cs, tmp, 4, sizeof(tmp)); 159 tmp_len = krb_mk_safe(tmp, msg, 4, &d->key, 160 (struct sockaddr_in *)LOCAL_ADDR, 161 (struct sockaddr_in *)REMOTE_ADDR); 162 } 163 if(tmp_len < 0){ 164 reply(535, "Error creating reply: %s.", strerror(errno)); 165 return -1; 166 } 167 len = tmp_len; 168 if(base64_encode(msg, len, &p) < 0) { 169 reply(535, "Out of memory base64-encoding."); 170 return -1; 171 } 172 reply(235, "ADAT=%s", p); 173 sec_complete = 1; 174 free(p); 175 return 0; 176} 177 178static int 179krb4_userok(void *app_data, char *user) 180{ 181 struct krb4_data *d = app_data; 182 return krb_kuserok(d->name, d->instance, d->realm, user); 183} 184 185struct sec_server_mech krb4_server_mech = { 186 "KERBEROS_V4", 187 sizeof(struct krb4_data), 188 NULL, /* init */ 189 NULL, /* end */ 190 krb4_check_prot, 191 krb4_overhead, 192 krb4_encode, 193 krb4_decode, 194 /* */ 195 NULL, 196 krb4_adat, 197 NULL, /* pbsz */ 198 NULL, /* ccc */ 199 krb4_userok 200}; 201 202#else /* FTP_SERVER */ 203 204static int 205mk_auth(struct krb4_data *d, KTEXT adat, 206 char *service, char *host, int checksum) 207{ 208 int ret; 209 CREDENTIALS cred; 210 char sname[SNAME_SZ], inst[INST_SZ], realm[REALM_SZ]; 211 212 strlcpy(sname, service, sizeof(sname)); 213 strlcpy(inst, krb_get_phost(host), sizeof(inst)); 214 strlcpy(realm, krb_realmofhost(host), sizeof(realm)); 215 ret = krb_mk_req(adat, sname, inst, realm, checksum); 216 if(ret) 217 return ret; 218 strlcpy(sname, service, sizeof(sname)); 219 strlcpy(inst, krb_get_phost(host), sizeof(inst)); 220 strlcpy(realm, krb_realmofhost(host), sizeof(realm)); 221 ret = krb_get_cred(sname, inst, realm, &cred); 222 memmove(&d->key, &cred.session, sizeof(des_cblock)); 223 des_key_sched(&d->key, d->schedule); 224 memset(&cred, 0, sizeof(cred)); 225 return ret; 226} 227 228static int 229krb4_auth(void *app_data, char *host) 230{ 231 int ret; 232 char *p; 233 int len; 234 KTEXT_ST adat; 235 MSG_DAT msg_data; 236 int checksum; 237 u_int32_t cs; 238 struct krb4_data *d = app_data; 239 struct sockaddr_in *localaddr = (struct sockaddr_in *)LOCAL_ADDR; 240 struct sockaddr_in *remoteaddr = (struct sockaddr_in *)REMOTE_ADDR; 241 242 checksum = getpid(); 243 ret = mk_auth(d, &adat, "ftp", host, checksum); 244 if(ret == KDC_PR_UNKNOWN) 245 ret = mk_auth(d, &adat, "rcmd", host, checksum); 246 if(ret){ 247 printf("%s\n", krb_get_err_text(ret)); 248 return AUTH_CONTINUE; 249 } 250 251#ifdef HAVE_KRB_GET_OUR_IP_FOR_REALM 252 if (krb_get_config_bool("nat_in_use")) { 253 struct in_addr natAddr; 254 255 if (krb_get_our_ip_for_realm(krb_realmofhost(host), 256 &natAddr) != KSUCCESS 257 && krb_get_our_ip_for_realm(NULL, &natAddr) != KSUCCESS) 258 printf("Can't get address for realm %s\n", 259 krb_realmofhost(host)); 260 else { 261 if (natAddr.s_addr != localaddr->sin_addr.s_addr) { 262 printf("Using NAT IP address (%s) for kerberos 4\n", 263 inet_ntoa(natAddr)); 264 localaddr->sin_addr = natAddr; 265 266 /* 267 * This not the best place to do this, but it 268 * is here we know that (probably) NAT is in 269 * use! 270 */ 271 272 passivemode = 1; 273 printf("Setting: Passive mode on.\n"); 274 } 275 } 276 } 277#endif 278 279 printf("Local address is %s\n", inet_ntoa(localaddr->sin_addr)); 280 printf("Remote address is %s\n", inet_ntoa(remoteaddr->sin_addr)); 281 282 if(base64_encode(adat.dat, adat.length, &p) < 0) { 283 printf("Out of memory base64-encoding.\n"); 284 return AUTH_CONTINUE; 285 } 286 ret = command("ADAT %s", p); 287 free(p); 288 289 if(ret != COMPLETE){ 290 printf("Server didn't accept auth data.\n"); 291 return AUTH_ERROR; 292 } 293 294 p = strstr(reply_string, "ADAT="); 295 if(!p){ 296 printf("Remote host didn't send adat reply.\n"); 297 return AUTH_ERROR; 298 } 299 p += 5; 300 len = base64_decode(p, adat.dat); 301 if(len < 0){ 302 printf("Failed to decode base64 from server.\n"); 303 return AUTH_ERROR; 304 } 305 adat.length = len; 306 ret = krb_rd_safe(adat.dat, adat.length, &d->key, 307 (struct sockaddr_in *)hisctladdr, 308 (struct sockaddr_in *)myctladdr, &msg_data); 309 if(ret){ 310 printf("Error reading reply from server: %s.\n", 311 krb_get_err_text(ret)); 312 return AUTH_ERROR; 313 } 314 krb_get_int(msg_data.app_data, &cs, 4, 0); 315 if(cs - checksum != 1){ 316 printf("Bad checksum returned from server.\n"); 317 return AUTH_ERROR; 318 } 319 return AUTH_OK; 320} 321 322struct sec_client_mech krb4_client_mech = { 323 "KERBEROS_V4", 324 sizeof(struct krb4_data), 325 NULL, /* init */ 326 krb4_auth, 327 NULL, /* end */ 328 krb4_check_prot, 329 krb4_overhead, 330 krb4_encode, 331 krb4_decode 332}; 333 334#endif /* FTP_SERVER */ 335