krb4.c revision 178825
1/* 2 * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#ifdef FTP_SERVER 35#include "ftpd_locl.h" 36#else 37#include "ftp_locl.h" 38#endif 39#include <krb.h> 40 41RCSID("$Id: krb4.c 17450 2006-05-05 11:11:43Z lha $"); 42 43#ifdef FTP_SERVER 44#define LOCAL_ADDR ctrl_addr 45#define REMOTE_ADDR his_addr 46#else 47#define LOCAL_ADDR myctladdr 48#define REMOTE_ADDR hisctladdr 49#endif 50 51extern struct sockaddr *LOCAL_ADDR, *REMOTE_ADDR; 52 53struct krb4_data { 54 des_cblock key; 55 des_key_schedule schedule; 56 char name[ANAME_SZ]; 57 char instance[INST_SZ]; 58 char realm[REALM_SZ]; 59}; 60 61static int 62krb4_check_prot(void *app_data, int level) 63{ 64 if(level == prot_confidential) 65 return -1; 66 return 0; 67} 68 69static int 70krb4_decode(void *app_data, void *buf, int len, int level) 71{ 72 MSG_DAT m; 73 int e; 74 struct krb4_data *d = app_data; 75 76 if(level == prot_safe) 77 e = krb_rd_safe(buf, len, &d->key, 78 (struct sockaddr_in *)REMOTE_ADDR, 79 (struct sockaddr_in *)LOCAL_ADDR, &m); 80 else 81 e = krb_rd_priv(buf, len, d->schedule, &d->key, 82 (struct sockaddr_in *)REMOTE_ADDR, 83 (struct sockaddr_in *)LOCAL_ADDR, &m); 84 if(e){ 85 syslog(LOG_ERR, "krb4_decode: %s", krb_get_err_text(e)); 86 return -1; 87 } 88 memmove(buf, m.app_data, m.app_length); 89 return m.app_length; 90} 91 92static int 93krb4_overhead(void *app_data, int level, int len) 94{ 95 return 31; 96} 97 98static int 99krb4_encode(void *app_data, void *from, int length, int level, void **to) 100{ 101 struct krb4_data *d = app_data; 102 *to = malloc(length + 31); 103 if(level == prot_safe) 104 return krb_mk_safe(from, *to, length, &d->key, 105 (struct sockaddr_in *)LOCAL_ADDR, 106 (struct sockaddr_in *)REMOTE_ADDR); 107 else if(level == prot_private) 108 return krb_mk_priv(from, *to, length, d->schedule, &d->key, 109 (struct sockaddr_in *)LOCAL_ADDR, 110 (struct sockaddr_in *)REMOTE_ADDR); 111 else 112 return -1; 113} 114 115#ifdef FTP_SERVER 116 117static int 118krb4_adat(void *app_data, void *buf, size_t len) 119{ 120 KTEXT_ST tkt; 121 AUTH_DAT auth_dat; 122 char *p; 123 int kerror; 124 uint32_t cs; 125 char msg[35]; /* size of encrypted block */ 126 int tmp_len; 127 struct krb4_data *d = app_data; 128 char inst[INST_SZ]; 129 struct sockaddr_in *his_addr_sin = (struct sockaddr_in *)his_addr; 130 131 memcpy(tkt.dat, buf, len); 132 tkt.length = len; 133 134 k_getsockinst(0, inst, sizeof(inst)); 135 kerror = krb_rd_req(&tkt, "ftp", inst, 136 his_addr_sin->sin_addr.s_addr, &auth_dat, ""); 137 if(kerror == RD_AP_UNDEC){ 138 k_getsockinst(0, inst, sizeof(inst)); 139 kerror = krb_rd_req(&tkt, "rcmd", inst, 140 his_addr_sin->sin_addr.s_addr, &auth_dat, ""); 141 } 142 143 if(kerror){ 144 reply(535, "Error reading request: %s.", krb_get_err_text(kerror)); 145 return -1; 146 } 147 148 memcpy(d->key, auth_dat.session, sizeof(d->key)); 149 des_set_key(&d->key, d->schedule); 150 151 strlcpy(d->name, auth_dat.pname, sizeof(d->name)); 152 strlcpy(d->instance, auth_dat.pinst, sizeof(d->instance)); 153 strlcpy(d->realm, auth_dat.prealm, sizeof(d->instance)); 154 155 cs = auth_dat.checksum + 1; 156 { 157 unsigned char tmp[4]; 158 KRB_PUT_INT(cs, tmp, 4, sizeof(tmp)); 159 tmp_len = krb_mk_safe(tmp, msg, 4, &d->key, 160 (struct sockaddr_in *)LOCAL_ADDR, 161 (struct sockaddr_in *)REMOTE_ADDR); 162 } 163 if(tmp_len < 0){ 164 reply(535, "Error creating reply: %s.", strerror(errno)); 165 return -1; 166 } 167 len = tmp_len; 168 if(base64_encode(msg, len, &p) < 0) { 169 reply(535, "Out of memory base64-encoding."); 170 return -1; 171 } 172 reply(235, "ADAT=%s", p); 173 sec_complete = 1; 174 free(p); 175 return 0; 176} 177 178static int 179krb4_userok(void *app_data, char *user) 180{ 181 struct krb4_data *d = app_data; 182 return krb_kuserok(d->name, d->instance, d->realm, user); 183} 184 185struct sec_server_mech krb4_server_mech = { 186 "KERBEROS_V4", 187 sizeof(struct krb4_data), 188 NULL, /* init */ 189 NULL, /* end */ 190 krb4_check_prot, 191 krb4_overhead, 192 krb4_encode, 193 krb4_decode, 194 /* */ 195 NULL, 196 krb4_adat, 197 NULL, /* pbsz */ 198 NULL, /* ccc */ 199 krb4_userok 200}; 201 202#else /* FTP_SERVER */ 203 204static int 205krb4_init(void *app_data) 206{ 207 return !use_kerberos; 208} 209 210static int 211mk_auth(struct krb4_data *d, KTEXT adat, 212 char *service, char *host, int checksum) 213{ 214 int ret; 215 CREDENTIALS cred; 216 char sname[SNAME_SZ], inst[INST_SZ], realm[REALM_SZ]; 217 218 strlcpy(sname, service, sizeof(sname)); 219 strlcpy(inst, krb_get_phost(host), sizeof(inst)); 220 strlcpy(realm, krb_realmofhost(host), sizeof(realm)); 221 ret = krb_mk_req(adat, sname, inst, realm, checksum); 222 if(ret) 223 return ret; 224 strlcpy(sname, service, sizeof(sname)); 225 strlcpy(inst, krb_get_phost(host), sizeof(inst)); 226 strlcpy(realm, krb_realmofhost(host), sizeof(realm)); 227 ret = krb_get_cred(sname, inst, realm, &cred); 228 memmove(&d->key, &cred.session, sizeof(des_cblock)); 229 des_key_sched(&d->key, d->schedule); 230 memset(&cred, 0, sizeof(cred)); 231 return ret; 232} 233 234static int 235krb4_auth(void *app_data, char *host) 236{ 237 int ret; 238 char *p; 239 int len; 240 KTEXT_ST adat; 241 MSG_DAT msg_data; 242 int checksum; 243 uint32_t cs; 244 struct krb4_data *d = app_data; 245 struct sockaddr_in *localaddr = (struct sockaddr_in *)LOCAL_ADDR; 246 struct sockaddr_in *remoteaddr = (struct sockaddr_in *)REMOTE_ADDR; 247 248 checksum = getpid(); 249 ret = mk_auth(d, &adat, "ftp", host, checksum); 250 if(ret == KDC_PR_UNKNOWN) 251 ret = mk_auth(d, &adat, "rcmd", host, checksum); 252 if(ret){ 253 printf("%s\n", krb_get_err_text(ret)); 254 return AUTH_CONTINUE; 255 } 256 257#ifdef HAVE_KRB_GET_OUR_IP_FOR_REALM 258 if (krb_get_config_bool("nat_in_use")) { 259 struct in_addr natAddr; 260 261 if (krb_get_our_ip_for_realm(krb_realmofhost(host), 262 &natAddr) != KSUCCESS 263 && krb_get_our_ip_for_realm(NULL, &natAddr) != KSUCCESS) 264 printf("Can't get address for realm %s\n", 265 krb_realmofhost(host)); 266 else { 267 if (natAddr.s_addr != localaddr->sin_addr.s_addr) { 268 printf("Using NAT IP address (%s) for kerberos 4\n", 269 inet_ntoa(natAddr)); 270 localaddr->sin_addr = natAddr; 271 272 /* 273 * This not the best place to do this, but it 274 * is here we know that (probably) NAT is in 275 * use! 276 */ 277 278 passivemode = 1; 279 printf("Setting: Passive mode on.\n"); 280 } 281 } 282 } 283#endif 284 285 printf("Local address is %s\n", inet_ntoa(localaddr->sin_addr)); 286 printf("Remote address is %s\n", inet_ntoa(remoteaddr->sin_addr)); 287 288 if(base64_encode(adat.dat, adat.length, &p) < 0) { 289 printf("Out of memory base64-encoding.\n"); 290 return AUTH_CONTINUE; 291 } 292 ret = command("ADAT %s", p); 293 free(p); 294 295 if(ret != COMPLETE){ 296 printf("Server didn't accept auth data.\n"); 297 return AUTH_ERROR; 298 } 299 300 p = strstr(reply_string, "ADAT="); 301 if(!p){ 302 printf("Remote host didn't send adat reply.\n"); 303 return AUTH_ERROR; 304 } 305 p += 5; 306 len = base64_decode(p, adat.dat); 307 if(len < 0){ 308 printf("Failed to decode base64 from server.\n"); 309 return AUTH_ERROR; 310 } 311 adat.length = len; 312 ret = krb_rd_safe(adat.dat, adat.length, &d->key, 313 (struct sockaddr_in *)hisctladdr, 314 (struct sockaddr_in *)myctladdr, &msg_data); 315 if(ret){ 316 printf("Error reading reply from server: %s.\n", 317 krb_get_err_text(ret)); 318 return AUTH_ERROR; 319 } 320 krb_get_int(msg_data.app_data, &cs, 4, 0); 321 if(cs - checksum != 1){ 322 printf("Bad checksum returned from server.\n"); 323 return AUTH_ERROR; 324 } 325 return AUTH_OK; 326} 327 328struct sec_client_mech krb4_client_mech = { 329 "KERBEROS_V4", 330 sizeof(struct krb4_data), 331 krb4_init, /* init */ 332 krb4_auth, 333 NULL, /* end */ 334 krb4_check_prot, 335 krb4_overhead, 336 krb4_encode, 337 krb4_decode 338}; 339 340#endif /* FTP_SERVER */ 341