1 /* GSSAPI/krb5 support for FTP - loosely based on old krb4.c
2 *
3 * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
4 * (Royal Institute of Technology, Stockholm, Sweden).
5 * Copyright (c) 2004 - 2020 Daniel Stenberg
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE. */
34
35 #include "curl_setup.h"
36
37 #if defined(HAVE_GSSAPI) && !defined(CURL_DISABLE_FTP)
38
39 #ifdef HAVE_NETDB_H
40 #include <netdb.h>
41 #endif
42
43 #include "urldata.h"
44 #include "curl_base64.h"
45 #include "ftp.h"
46 #include "curl_gssapi.h"
47 #include "sendf.h"
48 #include "curl_krb5.h"
49 #include "warnless.h"
50 #include "non-ascii.h"
51 #include "strcase.h"
52 #include "strdup.h"
53
54 /* The last 3 #include files should be in this order */
55 #include "curl_printf.h"
56 #include "curl_memory.h"
57 #include "memdebug.h"
58
ftpsend(struct connectdata * conn,const char * cmd)59 static CURLcode ftpsend(struct connectdata *conn, const char *cmd)
60 {
61 ssize_t bytes_written;
62 #define SBUF_SIZE 1024
63 char s[SBUF_SIZE];
64 size_t write_len;
65 char *sptr = s;
66 CURLcode result = CURLE_OK;
67 #ifdef HAVE_GSSAPI
68 enum protection_level data_sec = conn->data_prot;
69 #endif
70
71 if(!cmd)
72 return CURLE_BAD_FUNCTION_ARGUMENT;
73
74 write_len = strlen(cmd);
75 if(!write_len || write_len > (sizeof(s) -3))
76 return CURLE_BAD_FUNCTION_ARGUMENT;
77
78 memcpy(&s, cmd, write_len);
79 strcpy(&s[write_len], "\r\n"); /* append a trailing CRLF */
80 write_len += 2;
81 bytes_written = 0;
82
83 result = Curl_convert_to_network(conn->data, s, write_len);
84 /* Curl_convert_to_network calls failf if unsuccessful */
85 if(result)
86 return result;
87
88 for(;;) {
89 #ifdef HAVE_GSSAPI
90 conn->data_prot = PROT_CMD;
91 #endif
92 result = Curl_write(conn, conn->sock[FIRSTSOCKET], sptr, write_len,
93 &bytes_written);
94 #ifdef HAVE_GSSAPI
95 DEBUGASSERT(data_sec > PROT_NONE && data_sec < PROT_LAST);
96 conn->data_prot = data_sec;
97 #endif
98
99 if(result)
100 break;
101
102 if(conn->data->set.verbose)
103 Curl_debug(conn->data, CURLINFO_HEADER_OUT, sptr, (size_t)bytes_written);
104
105 if(bytes_written != (ssize_t)write_len) {
106 write_len -= bytes_written;
107 sptr += bytes_written;
108 }
109 else
110 break;
111 }
112
113 return result;
114 }
115
116 static int
krb5_init(void * app_data)117 krb5_init(void *app_data)
118 {
119 gss_ctx_id_t *context = app_data;
120 /* Make sure our context is initialized for krb5_end. */
121 *context = GSS_C_NO_CONTEXT;
122 return 0;
123 }
124
125 static int
krb5_check_prot(void * app_data,int level)126 krb5_check_prot(void *app_data, int level)
127 {
128 (void)app_data; /* unused */
129 if(level == PROT_CONFIDENTIAL)
130 return -1;
131 return 0;
132 }
133
134 static int
krb5_decode(void * app_data,void * buf,int len,int level UNUSED_PARAM,struct connectdata * conn UNUSED_PARAM)135 krb5_decode(void *app_data, void *buf, int len,
136 int level UNUSED_PARAM,
137 struct connectdata *conn UNUSED_PARAM)
138 {
139 gss_ctx_id_t *context = app_data;
140 OM_uint32 maj, min;
141 gss_buffer_desc enc, dec;
142
143 (void)level;
144 (void)conn;
145
146 enc.value = buf;
147 enc.length = len;
148 maj = gss_unwrap(&min, *context, &enc, &dec, NULL, NULL);
149 if(maj != GSS_S_COMPLETE) {
150 if(len >= 4)
151 strcpy(buf, "599 ");
152 return -1;
153 }
154
155 memcpy(buf, dec.value, dec.length);
156 len = curlx_uztosi(dec.length);
157 gss_release_buffer(&min, &dec);
158
159 return len;
160 }
161
162 static int
krb5_overhead(void * app_data,int level,int len)163 krb5_overhead(void *app_data, int level, int len)
164 {
165 /* no arguments are used */
166 (void)app_data;
167 (void)level;
168 (void)len;
169 return 0;
170 }
171
172 static int
krb5_encode(void * app_data,const void * from,int length,int level,void ** to)173 krb5_encode(void *app_data, const void *from, int length, int level, void **to)
174 {
175 gss_ctx_id_t *context = app_data;
176 gss_buffer_desc dec, enc;
177 OM_uint32 maj, min;
178 int state;
179 int len;
180
181 /* NOTE that the cast is safe, neither of the krb5, gnu gss and heimdal
182 * libraries modify the input buffer in gss_wrap()
183 */
184 dec.value = (void *)from;
185 dec.length = length;
186 maj = gss_wrap(&min, *context,
187 level == PROT_PRIVATE,
188 GSS_C_QOP_DEFAULT,
189 &dec, &state, &enc);
190
191 if(maj != GSS_S_COMPLETE)
192 return -1;
193
194 /* malloc a new buffer, in case gss_release_buffer doesn't work as
195 expected */
196 *to = malloc(enc.length);
197 if(!*to)
198 return -1;
199 memcpy(*to, enc.value, enc.length);
200 len = curlx_uztosi(enc.length);
201 gss_release_buffer(&min, &enc);
202 return len;
203 }
204
205 static int
krb5_auth(void * app_data,struct connectdata * conn)206 krb5_auth(void *app_data, struct connectdata *conn)
207 {
208 int ret = AUTH_OK;
209 char *p;
210 const char *host = conn->host.name;
211 ssize_t nread;
212 curl_socklen_t l = sizeof(conn->local_addr);
213 struct Curl_easy *data = conn->data;
214 CURLcode result;
215 const char *service = data->set.str[STRING_SERVICE_NAME] ?
216 data->set.str[STRING_SERVICE_NAME] :
217 "ftp";
218 const char *srv_host = "host";
219 gss_buffer_desc input_buffer, output_buffer, _gssresp, *gssresp;
220 OM_uint32 maj, min;
221 gss_name_t gssname;
222 gss_ctx_id_t *context = app_data;
223 struct gss_channel_bindings_struct chan;
224 size_t base64_sz = 0;
225 struct sockaddr_in **remote_addr =
226 (struct sockaddr_in **)&conn->ip_addr->ai_addr;
227 char *stringp;
228
229 if(getsockname(conn->sock[FIRSTSOCKET],
230 (struct sockaddr *)&conn->local_addr, &l) < 0)
231 perror("getsockname()");
232
233 chan.initiator_addrtype = GSS_C_AF_INET;
234 chan.initiator_address.length = l - 4;
235 chan.initiator_address.value = &conn->local_addr.sin_addr.s_addr;
236 chan.acceptor_addrtype = GSS_C_AF_INET;
237 chan.acceptor_address.length = l - 4;
238 chan.acceptor_address.value = &(*remote_addr)->sin_addr.s_addr;
239 chan.application_data.length = 0;
240 chan.application_data.value = NULL;
241
242 /* this loop will execute twice (once for service, once for host) */
243 for(;;) {
244 /* this really shouldn't be repeated here, but can't help it */
245 if(service == srv_host) {
246 result = ftpsend(conn, "AUTH GSSAPI");
247 if(result)
248 return -2;
249
250 if(Curl_GetFTPResponse(&nread, conn, NULL))
251 return -1;
252
253 if(data->state.buffer[0] != '3')
254 return -1;
255 }
256
257 stringp = aprintf("%s@%s", service, host);
258 if(!stringp)
259 return -2;
260
261 input_buffer.value = stringp;
262 input_buffer.length = strlen(stringp);
263 maj = gss_import_name(&min, &input_buffer, GSS_C_NT_HOSTBASED_SERVICE,
264 &gssname);
265 free(stringp);
266 if(maj != GSS_S_COMPLETE) {
267 gss_release_name(&min, &gssname);
268 if(service == srv_host) {
269 failf(data, "Error importing service name %s@%s", service, host);
270 return AUTH_ERROR;
271 }
272 service = srv_host;
273 continue;
274 }
275 /* We pass NULL as |output_name_type| to avoid a leak. */
276 gss_display_name(&min, gssname, &output_buffer, NULL);
277 Curl_infof(data, "Trying against %s\n", output_buffer.value);
278 gssresp = GSS_C_NO_BUFFER;
279 *context = GSS_C_NO_CONTEXT;
280
281 do {
282 /* Release the buffer at each iteration to avoid leaking: the first time
283 we are releasing the memory from gss_display_name. The last item is
284 taken care by a final gss_release_buffer. */
285 gss_release_buffer(&min, &output_buffer);
286 ret = AUTH_OK;
287 maj = Curl_gss_init_sec_context(data,
288 &min,
289 context,
290 gssname,
291 &Curl_krb5_mech_oid,
292 &chan,
293 gssresp,
294 &output_buffer,
295 TRUE,
296 NULL);
297
298 if(gssresp) {
299 free(_gssresp.value);
300 gssresp = NULL;
301 }
302
303 if(GSS_ERROR(maj)) {
304 Curl_infof(data, "Error creating security context\n");
305 ret = AUTH_ERROR;
306 break;
307 }
308
309 if(output_buffer.length != 0) {
310 char *cmd;
311
312 result = Curl_base64_encode(data, (char *)output_buffer.value,
313 output_buffer.length, &p, &base64_sz);
314 if(result) {
315 Curl_infof(data, "base64-encoding: %s\n",
316 curl_easy_strerror(result));
317 ret = AUTH_ERROR;
318 break;
319 }
320
321 cmd = aprintf("ADAT %s", p);
322 if(cmd)
323 result = ftpsend(conn, cmd);
324 else
325 result = CURLE_OUT_OF_MEMORY;
326
327 free(p);
328 free(cmd);
329
330 if(result) {
331 ret = -2;
332 break;
333 }
334
335 if(Curl_GetFTPResponse(&nread, conn, NULL)) {
336 ret = -1;
337 break;
338 }
339
340 if(data->state.buffer[0] != '2' && data->state.buffer[0] != '3') {
341 Curl_infof(data, "Server didn't accept auth data\n");
342 ret = AUTH_ERROR;
343 break;
344 }
345
346 _gssresp.value = NULL; /* make sure it is initialized */
347 p = data->state.buffer + 4;
348 p = strstr(p, "ADAT=");
349 if(p) {
350 result = Curl_base64_decode(p + 5,
351 (unsigned char **)&_gssresp.value,
352 &_gssresp.length);
353 if(result) {
354 failf(data, "base64-decoding: %s", curl_easy_strerror(result));
355 ret = AUTH_CONTINUE;
356 break;
357 }
358 }
359
360 gssresp = &_gssresp;
361 }
362 } while(maj == GSS_S_CONTINUE_NEEDED);
363
364 gss_release_name(&min, &gssname);
365 gss_release_buffer(&min, &output_buffer);
366
367 if(gssresp)
368 free(_gssresp.value);
369
370 if(ret == AUTH_OK || service == srv_host)
371 return ret;
372
373 service = srv_host;
374 }
375 return ret;
376 }
377
krb5_end(void * app_data)378 static void krb5_end(void *app_data)
379 {
380 OM_uint32 min;
381 gss_ctx_id_t *context = app_data;
382 if(*context != GSS_C_NO_CONTEXT) {
383 OM_uint32 maj = gss_delete_sec_context(&min, context, GSS_C_NO_BUFFER);
384 (void)maj;
385 DEBUGASSERT(maj == GSS_S_COMPLETE);
386 }
387 }
388
389 static struct Curl_sec_client_mech Curl_krb5_client_mech = {
390 "GSSAPI",
391 sizeof(gss_ctx_id_t),
392 krb5_init,
393 krb5_auth,
394 krb5_end,
395 krb5_check_prot,
396 krb5_overhead,
397 krb5_encode,
398 krb5_decode
399 };
400
401 static const struct {
402 enum protection_level level;
403 const char *name;
404 } level_names[] = {
405 { PROT_CLEAR, "clear" },
406 { PROT_SAFE, "safe" },
407 { PROT_CONFIDENTIAL, "confidential" },
408 { PROT_PRIVATE, "private" }
409 };
410
411 static enum protection_level
name_to_level(const char * name)412 name_to_level(const char *name)
413 {
414 int i;
415 for(i = 0; i < (int)sizeof(level_names)/(int)sizeof(level_names[0]); i++)
416 if(checkprefix(name, level_names[i].name))
417 return level_names[i].level;
418 return PROT_NONE;
419 }
420
421 /* Convert a protocol |level| to its char representation.
422 We take an int to catch programming mistakes. */
level_to_char(int level)423 static char level_to_char(int level)
424 {
425 switch(level) {
426 case PROT_CLEAR:
427 return 'C';
428 case PROT_SAFE:
429 return 'S';
430 case PROT_CONFIDENTIAL:
431 return 'E';
432 case PROT_PRIVATE:
433 return 'P';
434 case PROT_CMD:
435 /* Fall through */
436 default:
437 /* Those 2 cases should not be reached! */
438 break;
439 }
440 DEBUGASSERT(0);
441 /* Default to the most secure alternative. */
442 return 'P';
443 }
444
445 /* Send an FTP command defined by |message| and the optional arguments. The
446 function returns the ftp_code. If an error occurs, -1 is returned. */
ftp_send_command(struct connectdata * conn,const char * message,...)447 static int ftp_send_command(struct connectdata *conn, const char *message, ...)
448 {
449 int ftp_code;
450 ssize_t nread = 0;
451 va_list args;
452 char print_buffer[50];
453
454 va_start(args, message);
455 mvsnprintf(print_buffer, sizeof(print_buffer), message, args);
456 va_end(args);
457
458 if(ftpsend(conn, print_buffer)) {
459 ftp_code = -1;
460 }
461 else {
462 if(Curl_GetFTPResponse(&nread, conn, &ftp_code))
463 ftp_code = -1;
464 }
465
466 (void)nread; /* Unused */
467 return ftp_code;
468 }
469
470 /* Read |len| from the socket |fd| and store it in |to|. Return a CURLcode
471 saying whether an error occurred or CURLE_OK if |len| was read. */
472 static CURLcode
socket_read(curl_socket_t fd,void * to,size_t len)473 socket_read(curl_socket_t fd, void *to, size_t len)
474 {
475 char *to_p = to;
476 CURLcode result;
477 ssize_t nread = 0;
478
479 while(len > 0) {
480 result = Curl_read_plain(fd, to_p, len, &nread);
481 if(!result) {
482 len -= nread;
483 to_p += nread;
484 }
485 else {
486 if(result == CURLE_AGAIN)
487 continue;
488 return result;
489 }
490 }
491 return CURLE_OK;
492 }
493
494
495 /* Write |len| bytes from the buffer |to| to the socket |fd|. Return a
496 CURLcode saying whether an error occurred or CURLE_OK if |len| was
497 written. */
498 static CURLcode
socket_write(struct connectdata * conn,curl_socket_t fd,const void * to,size_t len)499 socket_write(struct connectdata *conn, curl_socket_t fd, const void *to,
500 size_t len)
501 {
502 const char *to_p = to;
503 CURLcode result;
504 ssize_t written;
505
506 while(len > 0) {
507 result = Curl_write_plain(conn, fd, to_p, len, &written);
508 if(!result) {
509 len -= written;
510 to_p += written;
511 }
512 else {
513 if(result == CURLE_AGAIN)
514 continue;
515 return result;
516 }
517 }
518 return CURLE_OK;
519 }
520
read_data(struct connectdata * conn,curl_socket_t fd,struct krb5buffer * buf)521 static CURLcode read_data(struct connectdata *conn,
522 curl_socket_t fd,
523 struct krb5buffer *buf)
524 {
525 int len;
526 CURLcode result;
527
528 result = socket_read(fd, &len, sizeof(len));
529 if(result)
530 return result;
531
532 if(len) {
533 /* only realloc if there was a length */
534 len = ntohl(len);
535 buf->data = Curl_saferealloc(buf->data, len);
536 }
537 if(!len || !buf->data)
538 return CURLE_OUT_OF_MEMORY;
539
540 result = socket_read(fd, buf->data, len);
541 if(result)
542 return result;
543 buf->size = conn->mech->decode(conn->app_data, buf->data, len,
544 conn->data_prot, conn);
545 buf->index = 0;
546 return CURLE_OK;
547 }
548
549 static size_t
buffer_read(struct krb5buffer * buf,void * data,size_t len)550 buffer_read(struct krb5buffer *buf, void *data, size_t len)
551 {
552 if(buf->size - buf->index < len)
553 len = buf->size - buf->index;
554 memcpy(data, (char *)buf->data + buf->index, len);
555 buf->index += len;
556 return len;
557 }
558
559 /* Matches Curl_recv signature */
sec_recv(struct connectdata * conn,int sockindex,char * buffer,size_t len,CURLcode * err)560 static ssize_t sec_recv(struct connectdata *conn, int sockindex,
561 char *buffer, size_t len, CURLcode *err)
562 {
563 size_t bytes_read;
564 size_t total_read = 0;
565 curl_socket_t fd = conn->sock[sockindex];
566
567 *err = CURLE_OK;
568
569 /* Handle clear text response. */
570 if(conn->sec_complete == 0 || conn->data_prot == PROT_CLEAR)
571 return sread(fd, buffer, len);
572
573 if(conn->in_buffer.eof_flag) {
574 conn->in_buffer.eof_flag = 0;
575 return 0;
576 }
577
578 bytes_read = buffer_read(&conn->in_buffer, buffer, len);
579 len -= bytes_read;
580 total_read += bytes_read;
581 buffer += bytes_read;
582
583 while(len > 0) {
584 if(read_data(conn, fd, &conn->in_buffer))
585 return -1;
586 if(conn->in_buffer.size == 0) {
587 if(bytes_read > 0)
588 conn->in_buffer.eof_flag = 1;
589 return bytes_read;
590 }
591 bytes_read = buffer_read(&conn->in_buffer, buffer, len);
592 len -= bytes_read;
593 total_read += bytes_read;
594 buffer += bytes_read;
595 }
596 return total_read;
597 }
598
599 /* Send |length| bytes from |from| to the |fd| socket taking care of encoding
600 and negotiating with the server. |from| can be NULL. */
do_sec_send(struct connectdata * conn,curl_socket_t fd,const char * from,int length)601 static void do_sec_send(struct connectdata *conn, curl_socket_t fd,
602 const char *from, int length)
603 {
604 int bytes, htonl_bytes; /* 32-bit integers for htonl */
605 char *buffer = NULL;
606 char *cmd_buffer;
607 size_t cmd_size = 0;
608 CURLcode error;
609 enum protection_level prot_level = conn->data_prot;
610 bool iscmd = (prot_level == PROT_CMD)?TRUE:FALSE;
611
612 DEBUGASSERT(prot_level > PROT_NONE && prot_level < PROT_LAST);
613
614 if(iscmd) {
615 if(!strncmp(from, "PASS ", 5) || !strncmp(from, "ACCT ", 5))
616 prot_level = PROT_PRIVATE;
617 else
618 prot_level = conn->command_prot;
619 }
620 bytes = conn->mech->encode(conn->app_data, from, length, prot_level,
621 (void **)&buffer);
622 if(!buffer || bytes <= 0)
623 return; /* error */
624
625 if(iscmd) {
626 error = Curl_base64_encode(conn->data, buffer, curlx_sitouz(bytes),
627 &cmd_buffer, &cmd_size);
628 if(error) {
629 free(buffer);
630 return; /* error */
631 }
632 if(cmd_size > 0) {
633 static const char *enc = "ENC ";
634 static const char *mic = "MIC ";
635 if(prot_level == PROT_PRIVATE)
636 socket_write(conn, fd, enc, 4);
637 else
638 socket_write(conn, fd, mic, 4);
639
640 socket_write(conn, fd, cmd_buffer, cmd_size);
641 socket_write(conn, fd, "\r\n", 2);
642 infof(conn->data, "Send: %s%s\n", prot_level == PROT_PRIVATE?enc:mic,
643 cmd_buffer);
644 free(cmd_buffer);
645 }
646 }
647 else {
648 htonl_bytes = htonl(bytes);
649 socket_write(conn, fd, &htonl_bytes, sizeof(htonl_bytes));
650 socket_write(conn, fd, buffer, curlx_sitouz(bytes));
651 }
652 free(buffer);
653 }
654
sec_write(struct connectdata * conn,curl_socket_t fd,const char * buffer,size_t length)655 static ssize_t sec_write(struct connectdata *conn, curl_socket_t fd,
656 const char *buffer, size_t length)
657 {
658 ssize_t tx = 0, len = conn->buffer_size;
659
660 len -= conn->mech->overhead(conn->app_data, conn->data_prot,
661 curlx_sztosi(len));
662 if(len <= 0)
663 len = length;
664 while(length) {
665 if(length < (size_t)len)
666 len = length;
667
668 do_sec_send(conn, fd, buffer, curlx_sztosi(len));
669 length -= len;
670 buffer += len;
671 tx += len;
672 }
673 return tx;
674 }
675
676 /* Matches Curl_send signature */
sec_send(struct connectdata * conn,int sockindex,const void * buffer,size_t len,CURLcode * err)677 static ssize_t sec_send(struct connectdata *conn, int sockindex,
678 const void *buffer, size_t len, CURLcode *err)
679 {
680 curl_socket_t fd = conn->sock[sockindex];
681 *err = CURLE_OK;
682 return sec_write(conn, fd, buffer, len);
683 }
684
Curl_sec_read_msg(struct connectdata * conn,char * buffer,enum protection_level level)685 int Curl_sec_read_msg(struct connectdata *conn, char *buffer,
686 enum protection_level level)
687 {
688 /* decoded_len should be size_t or ssize_t but conn->mech->decode returns an
689 int */
690 int decoded_len;
691 char *buf;
692 int ret_code = 0;
693 size_t decoded_sz = 0;
694 CURLcode error;
695
696 if(!conn->mech)
697 /* not inititalized, return error */
698 return -1;
699
700 DEBUGASSERT(level > PROT_NONE && level < PROT_LAST);
701
702 error = Curl_base64_decode(buffer + 4, (unsigned char **)&buf, &decoded_sz);
703 if(error || decoded_sz == 0)
704 return -1;
705
706 if(decoded_sz > (size_t)INT_MAX) {
707 free(buf);
708 return -1;
709 }
710 decoded_len = curlx_uztosi(decoded_sz);
711
712 decoded_len = conn->mech->decode(conn->app_data, buf, decoded_len,
713 level, conn);
714 if(decoded_len <= 0) {
715 free(buf);
716 return -1;
717 }
718
719 if(conn->data->set.verbose) {
720 buf[decoded_len] = '\n';
721 Curl_debug(conn->data, CURLINFO_HEADER_IN, buf, decoded_len + 1);
722 }
723
724 buf[decoded_len] = '\0';
725 if(decoded_len <= 3)
726 /* suspiciously short */
727 return 0;
728
729 if(buf[3] != '-')
730 /* safe to ignore return code */
731 (void)sscanf(buf, "%d", &ret_code);
732
733 if(buf[decoded_len - 1] == '\n')
734 buf[decoded_len - 1] = '\0';
735 strcpy(buffer, buf);
736 free(buf);
737 return ret_code;
738 }
739
sec_set_protection_level(struct connectdata * conn)740 static int sec_set_protection_level(struct connectdata *conn)
741 {
742 int code;
743 enum protection_level level = conn->request_data_prot;
744
745 DEBUGASSERT(level > PROT_NONE && level < PROT_LAST);
746
747 if(!conn->sec_complete) {
748 infof(conn->data, "Trying to change the protection level after the"
749 " completion of the data exchange.\n");
750 return -1;
751 }
752
753 /* Bail out if we try to set up the same level */
754 if(conn->data_prot == level)
755 return 0;
756
757 if(level) {
758 char *pbsz;
759 static unsigned int buffer_size = 1 << 20; /* 1048576 */
760
761 code = ftp_send_command(conn, "PBSZ %u", buffer_size);
762 if(code < 0)
763 return -1;
764
765 if(code/100 != 2) {
766 failf(conn->data, "Failed to set the protection's buffer size.");
767 return -1;
768 }
769 conn->buffer_size = buffer_size;
770
771 pbsz = strstr(conn->data->state.buffer, "PBSZ=");
772 if(pbsz) {
773 /* ignore return code, use default value if it fails */
774 (void)sscanf(pbsz, "PBSZ=%u", &buffer_size);
775 if(buffer_size < conn->buffer_size)
776 conn->buffer_size = buffer_size;
777 }
778 }
779
780 /* Now try to negiociate the protection level. */
781 code = ftp_send_command(conn, "PROT %c", level_to_char(level));
782
783 if(code < 0)
784 return -1;
785
786 if(code/100 != 2) {
787 failf(conn->data, "Failed to set the protection level.");
788 return -1;
789 }
790
791 conn->data_prot = level;
792 if(level == PROT_PRIVATE)
793 conn->command_prot = level;
794
795 return 0;
796 }
797
798 int
Curl_sec_request_prot(struct connectdata * conn,const char * level)799 Curl_sec_request_prot(struct connectdata *conn, const char *level)
800 {
801 enum protection_level l = name_to_level(level);
802 if(l == PROT_NONE)
803 return -1;
804 DEBUGASSERT(l > PROT_NONE && l < PROT_LAST);
805 conn->request_data_prot = l;
806 return 0;
807 }
808
choose_mech(struct connectdata * conn)809 static CURLcode choose_mech(struct connectdata *conn)
810 {
811 int ret;
812 struct Curl_easy *data = conn->data;
813 void *tmp_allocation;
814 const struct Curl_sec_client_mech *mech = &Curl_krb5_client_mech;
815
816 tmp_allocation = realloc(conn->app_data, mech->size);
817 if(tmp_allocation == NULL) {
818 failf(data, "Failed realloc of size %zu", mech->size);
819 mech = NULL;
820 return CURLE_OUT_OF_MEMORY;
821 }
822 conn->app_data = tmp_allocation;
823
824 if(mech->init) {
825 ret = mech->init(conn->app_data);
826 if(ret) {
827 infof(data, "Failed initialization for %s. Skipping it.\n",
828 mech->name);
829 return CURLE_FAILED_INIT;
830 }
831 }
832
833 infof(data, "Trying mechanism %s...\n", mech->name);
834 ret = ftp_send_command(conn, "AUTH %s", mech->name);
835 if(ret < 0)
836 return CURLE_COULDNT_CONNECT;
837
838 if(ret/100 != 3) {
839 switch(ret) {
840 case 504:
841 infof(data, "Mechanism %s is not supported by the server (server "
842 "returned ftp code: 504).\n", mech->name);
843 break;
844 case 534:
845 infof(data, "Mechanism %s was rejected by the server (server returned "
846 "ftp code: 534).\n", mech->name);
847 break;
848 default:
849 if(ret/100 == 5) {
850 infof(data, "server does not support the security extensions\n");
851 return CURLE_USE_SSL_FAILED;
852 }
853 break;
854 }
855 return CURLE_LOGIN_DENIED;
856 }
857
858 /* Authenticate */
859 ret = mech->auth(conn->app_data, conn);
860
861 if(ret != AUTH_CONTINUE) {
862 if(ret != AUTH_OK) {
863 /* Mechanism has dumped the error to stderr, don't error here. */
864 return CURLE_USE_SSL_FAILED;
865 }
866 DEBUGASSERT(ret == AUTH_OK);
867
868 conn->mech = mech;
869 conn->sec_complete = 1;
870 conn->recv[FIRSTSOCKET] = sec_recv;
871 conn->send[FIRSTSOCKET] = sec_send;
872 conn->recv[SECONDARYSOCKET] = sec_recv;
873 conn->send[SECONDARYSOCKET] = sec_send;
874 conn->command_prot = PROT_SAFE;
875 /* Set the requested protection level */
876 /* BLOCKING */
877 (void)sec_set_protection_level(conn);
878 }
879
880 return CURLE_OK;
881 }
882
883 CURLcode
Curl_sec_login(struct connectdata * conn)884 Curl_sec_login(struct connectdata *conn)
885 {
886 return choose_mech(conn);
887 }
888
889
890 void
Curl_sec_end(struct connectdata * conn)891 Curl_sec_end(struct connectdata *conn)
892 {
893 if(conn->mech != NULL && conn->mech->end)
894 conn->mech->end(conn->app_data);
895 free(conn->app_data);
896 conn->app_data = NULL;
897 if(conn->in_buffer.data) {
898 free(conn->in_buffer.data);
899 conn->in_buffer.data = NULL;
900 conn->in_buffer.size = 0;
901 conn->in_buffer.index = 0;
902 conn->in_buffer.eof_flag = 0;
903 }
904 conn->sec_complete = 0;
905 conn->data_prot = PROT_CLEAR;
906 conn->mech = NULL;
907 }
908
909 #endif /* HAVE_GSSAPI && !CURL_DISABLE_FTP */
910