krb5.c (25450B)
1 /* GSSAPI/krb5 support for FTP - loosely based on old krb4.c 2 * 3 * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan 4 * (Royal Institute of Technology, Stockholm, Sweden). 5 * Copyright (C) Daniel Stenberg 6 * All rights reserved. 7 * 8 * SPDX-License-Identifier: BSD-3-Clause 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 21 * 3. Neither the name of the Institute nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. */ 36 37 #include "curl_setup.h" 38 39 #if defined(HAVE_GSSAPI) && !defined(CURL_DISABLE_FTP) 40 41 #ifdef HAVE_NETDB_H 42 #include <netdb.h> 43 #endif 44 #ifdef HAVE_ARPA_INET_H 45 #include <arpa/inet.h> 46 #endif 47 48 #include "urldata.h" 49 #include "url.h" 50 #include "cfilters.h" 51 #include "cf-socket.h" 52 #include "curlx/base64.h" 53 #include "ftp.h" 54 #include "curl_gssapi.h" 55 #include "sendf.h" 56 #include "transfer.h" 57 #include "curl_krb5.h" 58 #include "curlx/warnless.h" 59 #include "strdup.h" 60 61 /* The last 3 #include files should be in this order */ 62 #include "curl_printf.h" 63 #include "curl_memory.h" 64 #include "memdebug.h" 65 66 #if defined(__GNUC__) && defined(__APPLE__) 67 #pragma GCC diagnostic push 68 #pragma GCC diagnostic ignored "-Wdeprecated-declarations" 69 #endif 70 71 static CURLcode ftpsend(struct Curl_easy *data, struct connectdata *conn, 72 const char *cmd) 73 { 74 size_t bytes_written; 75 #define SBUF_SIZE 1024 76 char s[SBUF_SIZE]; 77 size_t write_len; 78 char *sptr = s; 79 CURLcode result = CURLE_OK; 80 #ifdef HAVE_GSSAPI 81 unsigned char data_sec = conn->data_prot; 82 #endif 83 84 DEBUGASSERT(cmd); 85 86 write_len = strlen(cmd); 87 if(!write_len || write_len > (sizeof(s) -3)) 88 return CURLE_BAD_FUNCTION_ARGUMENT; 89 90 memcpy(&s, cmd, write_len); 91 strcpy(&s[write_len], "\r\n"); /* append a trailing CRLF */ 92 write_len += 2; 93 bytes_written = 0; 94 95 for(;;) { 96 #ifdef HAVE_GSSAPI 97 conn->data_prot = PROT_CMD; 98 #endif 99 result = Curl_xfer_send(data, sptr, write_len, FALSE, &bytes_written); 100 #ifdef HAVE_GSSAPI 101 DEBUGASSERT(data_sec > PROT_NONE && data_sec < PROT_LAST); 102 conn->data_prot = data_sec; 103 #endif 104 105 if(result) 106 break; 107 108 Curl_debug(data, CURLINFO_HEADER_OUT, sptr, bytes_written); 109 110 if(bytes_written != write_len) { 111 write_len -= bytes_written; 112 sptr += bytes_written; 113 } 114 else 115 break; 116 } 117 118 return result; 119 } 120 121 static int 122 krb5_init(void *app_data) 123 { 124 gss_ctx_id_t *context = app_data; 125 /* Make sure our context is initialized for krb5_end. */ 126 *context = GSS_C_NO_CONTEXT; 127 return 0; 128 } 129 130 static int 131 krb5_check_prot(void *app_data, int level) 132 { 133 (void)app_data; /* unused */ 134 if(level == PROT_CONFIDENTIAL) 135 return -1; 136 return 0; 137 } 138 139 static int 140 krb5_decode(void *app_data, void *buf, int len, 141 int level UNUSED_PARAM, 142 struct connectdata *conn UNUSED_PARAM) 143 { 144 gss_ctx_id_t *context = app_data; 145 OM_uint32 maj, min; 146 gss_buffer_desc enc, dec; 147 148 (void)level; 149 (void)conn; 150 151 enc.value = buf; 152 enc.length = len; 153 maj = gss_unwrap(&min, *context, &enc, &dec, NULL, NULL); 154 if(maj != GSS_S_COMPLETE) 155 return -1; 156 157 memcpy(buf, dec.value, dec.length); 158 len = curlx_uztosi(dec.length); 159 gss_release_buffer(&min, &dec); 160 161 return len; 162 } 163 164 static int 165 krb5_encode(void *app_data, const void *from, int length, int level, void **to) 166 { 167 gss_ctx_id_t *context = app_data; 168 gss_buffer_desc dec, enc; 169 OM_uint32 maj, min; 170 int state; 171 int len; 172 173 /* NOTE that the cast is safe, neither of the krb5, gnu gss and heimdal 174 * libraries modify the input buffer in gss_wrap() 175 */ 176 dec.value = CURL_UNCONST(from); 177 dec.length = (size_t)length; 178 maj = gss_wrap(&min, *context, 179 level == PROT_PRIVATE, 180 GSS_C_QOP_DEFAULT, 181 &dec, &state, &enc); 182 183 if(maj != GSS_S_COMPLETE) 184 return -1; 185 186 /* malloc a new buffer, in case gss_release_buffer does not work as 187 expected */ 188 *to = malloc(enc.length); 189 if(!*to) 190 return -1; 191 memcpy(*to, enc.value, enc.length); 192 len = curlx_uztosi(enc.length); 193 gss_release_buffer(&min, &enc); 194 return len; 195 } 196 197 static int 198 krb5_auth(void *app_data, struct Curl_easy *data, struct connectdata *conn) 199 { 200 int ret = AUTH_OK; 201 char *p; 202 const char *host = conn->host.name; 203 ssize_t nread; 204 curl_socklen_t l = sizeof(conn->local_addr); 205 CURLcode result; 206 const char *service = data->set.str[STRING_SERVICE_NAME] ? 207 data->set.str[STRING_SERVICE_NAME] : 208 "ftp"; 209 const char *srv_host = "host"; 210 gss_buffer_desc input_buffer, output_buffer, *gssresp; 211 gss_buffer_desc _gssresp = GSS_C_EMPTY_BUFFER; 212 OM_uint32 maj, min; 213 gss_name_t gssname; 214 gss_ctx_id_t *context = app_data; 215 struct gss_channel_bindings_struct chan; 216 size_t base64_sz = 0; 217 const struct Curl_sockaddr_ex *remote_addr = 218 Curl_conn_get_remote_addr(data, FIRSTSOCKET); 219 struct sockaddr_in *remote_in_addr = remote_addr ? 220 (struct sockaddr_in *)CURL_UNCONST(&remote_addr->curl_sa_addr) : NULL; 221 char *stringp; 222 struct ftp_conn *ftpc = Curl_conn_meta_get(conn, CURL_META_FTP_CONN); 223 224 if(!ftpc || !remote_in_addr) 225 return -2; 226 227 if(getsockname(conn->sock[FIRSTSOCKET], 228 (struct sockaddr *)&conn->local_addr, &l) < 0) 229 perror("getsockname()"); 230 231 chan.initiator_addrtype = GSS_C_AF_INET; 232 chan.initiator_address.length = l - 4; 233 chan.initiator_address.value = &conn->local_addr.sin_addr.s_addr; 234 chan.acceptor_addrtype = GSS_C_AF_INET; 235 chan.acceptor_address.length = l - 4; 236 chan.acceptor_address.value = &remote_in_addr->sin_addr.s_addr; 237 chan.application_data.length = 0; 238 chan.application_data.value = NULL; 239 240 /* this loop will execute twice (once for service, once for host) */ 241 for(;;) { 242 /* this really should not be repeated here, but cannot help it */ 243 if(service == srv_host) { 244 result = ftpsend(data, conn, "AUTH GSSAPI"); 245 if(result) 246 return -2; 247 248 if(Curl_GetFTPResponse(data, &nread, NULL)) 249 return -1; 250 else { 251 char *line = curlx_dyn_ptr(&ftpc->pp.recvbuf); 252 if(line[0] != '3') 253 return -1; 254 } 255 } 256 257 stringp = aprintf("%s@%s", service, host); 258 if(!stringp) 259 return -2; 260 261 input_buffer.value = stringp; 262 input_buffer.length = strlen(stringp); 263 maj = gss_import_name(&min, &input_buffer, GSS_C_NT_HOSTBASED_SERVICE, 264 &gssname); 265 free(stringp); 266 if(maj != GSS_S_COMPLETE) { 267 gss_release_name(&min, &gssname); 268 if(service == srv_host) { 269 failf(data, "Error importing service name %s@%s", service, host); 270 return AUTH_ERROR; 271 } 272 service = srv_host; 273 continue; 274 } 275 /* We pass NULL as |output_name_type| to avoid a leak. */ 276 gss_display_name(&min, gssname, &output_buffer, NULL); 277 infof(data, "Trying against %s", (char *)output_buffer.value); 278 gssresp = GSS_C_NO_BUFFER; 279 *context = GSS_C_NO_CONTEXT; 280 281 do { 282 /* Release the buffer at each iteration to avoid leaking: the first time 283 we are releasing the memory from gss_display_name. The last item is 284 taken care by a final gss_release_buffer. */ 285 gss_release_buffer(&min, &output_buffer); 286 ret = AUTH_OK; 287 maj = Curl_gss_init_sec_context(data, 288 &min, 289 context, 290 gssname, 291 &Curl_krb5_mech_oid, 292 &chan, 293 gssresp, 294 &output_buffer, 295 TRUE, 296 NULL); 297 298 if(gssresp) { 299 free(_gssresp.value); 300 gssresp = NULL; 301 } 302 303 if(GSS_ERROR(maj)) { 304 infof(data, "Error creating security context"); 305 ret = AUTH_ERROR; 306 break; 307 } 308 309 if(output_buffer.length) { 310 char *cmd; 311 312 result = curlx_base64_encode((char *)output_buffer.value, 313 output_buffer.length, &p, &base64_sz); 314 if(result) { 315 infof(data, "base64-encoding: %s", curl_easy_strerror(result)); 316 ret = AUTH_ERROR; 317 break; 318 } 319 320 cmd = aprintf("ADAT %s", p); 321 if(cmd) 322 result = ftpsend(data, conn, cmd); 323 else 324 result = CURLE_OUT_OF_MEMORY; 325 326 free(p); 327 free(cmd); 328 329 if(result) { 330 ret = -2; 331 break; 332 } 333 334 if(Curl_GetFTPResponse(data, &nread, NULL)) { 335 ret = -1; 336 break; 337 } 338 else { 339 size_t len = curlx_dyn_len(&ftpc->pp.recvbuf); 340 p = curlx_dyn_ptr(&ftpc->pp.recvbuf); 341 if((len < 4) || (p[0] != '2' && p[0] != '3')) { 342 infof(data, "Server did not accept auth data"); 343 ret = AUTH_ERROR; 344 break; 345 } 346 } 347 348 _gssresp.value = NULL; /* make sure it is initialized */ 349 _gssresp.length = 0; 350 p += 4; /* over '789 ' */ 351 p = strstr(p, "ADAT="); 352 if(p) { 353 unsigned char *outptr; 354 size_t outlen; 355 result = curlx_base64_decode(p + 5, &outptr, &outlen); 356 if(result) { 357 failf(data, "base64-decoding: %s", curl_easy_strerror(result)); 358 ret = AUTH_CONTINUE; 359 break; 360 } 361 _gssresp.value = outptr; 362 _gssresp.length = outlen; 363 } 364 365 gssresp = &_gssresp; 366 } 367 } while(maj == GSS_S_CONTINUE_NEEDED); 368 369 gss_release_name(&min, &gssname); 370 gss_release_buffer(&min, &output_buffer); 371 372 if(gssresp) 373 free(_gssresp.value); 374 375 if(ret == AUTH_OK || service == srv_host) 376 break; 377 378 service = srv_host; 379 } 380 return ret; 381 } 382 383 static void krb5_end(void *app_data) 384 { 385 OM_uint32 min; 386 gss_ctx_id_t *context = app_data; 387 if(*context != GSS_C_NO_CONTEXT) { 388 OM_uint32 maj = Curl_gss_delete_sec_context(&min, context, 389 GSS_C_NO_BUFFER); 390 (void)maj; 391 DEBUGASSERT(maj == GSS_S_COMPLETE); 392 } 393 } 394 395 static const struct Curl_sec_client_mech Curl_krb5_client_mech = { 396 "GSSAPI", 397 sizeof(gss_ctx_id_t), 398 krb5_init, 399 krb5_auth, 400 krb5_end, 401 krb5_check_prot, 402 403 krb5_encode, 404 krb5_decode 405 }; 406 407 static const struct { 408 unsigned char level; 409 const char *name; 410 } level_names[] = { 411 { PROT_CLEAR, "clear" }, 412 { PROT_SAFE, "safe" }, 413 { PROT_CONFIDENTIAL, "confidential" }, 414 { PROT_PRIVATE, "private" } 415 }; 416 417 static unsigned char name_to_level(const char *name) 418 { 419 int i; 420 for(i = 0; i < (int)sizeof(level_names)/(int)sizeof(level_names[0]); i++) 421 if(curl_strequal(name, level_names[i].name)) 422 return level_names[i].level; 423 return PROT_NONE; 424 } 425 426 /* Convert a protocol |level| to its char representation. 427 We take an int to catch programming mistakes. */ 428 static char level_to_char(int level) 429 { 430 switch(level) { 431 case PROT_CLEAR: 432 return 'C'; 433 case PROT_SAFE: 434 return 'S'; 435 case PROT_CONFIDENTIAL: 436 return 'E'; 437 case PROT_PRIVATE: 438 return 'P'; 439 case PROT_CMD: 440 default: 441 /* Those 2 cases should not be reached! */ 442 break; 443 } 444 DEBUGASSERT(0); 445 /* Default to the most secure alternative. */ 446 return 'P'; 447 } 448 449 /* Send an FTP command defined by |message| and the optional arguments. The 450 function returns the ftp_code. If an error occurs, -1 is returned. */ 451 static int ftp_send_command(struct Curl_easy *data, const char *message, ...) 452 CURL_PRINTF(2, 3); 453 454 static int ftp_send_command(struct Curl_easy *data, const char *message, ...) 455 { 456 int ftp_code; 457 ssize_t nread = 0; 458 va_list args; 459 char print_buffer[50]; 460 461 va_start(args, message); 462 mvsnprintf(print_buffer, sizeof(print_buffer), message, args); 463 va_end(args); 464 465 if(ftpsend(data, data->conn, print_buffer)) { 466 ftp_code = -1; 467 } 468 else { 469 if(Curl_GetFTPResponse(data, &nread, &ftp_code)) 470 ftp_code = -1; 471 } 472 473 (void)nread; /* Unused */ 474 return ftp_code; 475 } 476 477 /* Read |len| from the socket |fd| and store it in |to|. Return a CURLcode 478 saying whether an error occurred or CURLE_OK if |len| was read. */ 479 static CURLcode 480 socket_read(struct Curl_easy *data, int sockindex, void *to, size_t len) 481 { 482 char *to_p = to; 483 CURLcode result; 484 size_t nread = 0; 485 486 while(len > 0) { 487 result = Curl_conn_recv(data, sockindex, to_p, len, &nread); 488 if(result == CURLE_AGAIN) 489 continue; 490 if(result) 491 return result; 492 if(nread > len) 493 return CURLE_RECV_ERROR; 494 len -= nread; 495 to_p += nread; 496 } 497 return CURLE_OK; 498 } 499 500 501 /* Write |len| bytes from the buffer |to| to the socket |fd|. Return a 502 CURLcode saying whether an error occurred or CURLE_OK if |len| was 503 written. */ 504 static CURLcode 505 socket_write(struct Curl_easy *data, int sockindex, const void *to, 506 size_t len) 507 { 508 const char *to_p = to; 509 CURLcode result; 510 size_t written; 511 512 while(len > 0) { 513 result = Curl_conn_send(data, sockindex, to_p, len, FALSE, &written); 514 if(!result && written > 0) { 515 len -= written; 516 to_p += written; 517 } 518 else { 519 if(result == CURLE_AGAIN) 520 continue; 521 return result; 522 } 523 } 524 return CURLE_OK; 525 } 526 527 static CURLcode krb5_read_data(struct Curl_easy *data, int sockindex, 528 struct krb5buffer *buf) 529 { 530 struct connectdata *conn = data->conn; 531 int len; 532 CURLcode result; 533 int nread; 534 535 result = socket_read(data, sockindex, &len, sizeof(len)); 536 if(result) 537 return result; 538 539 if(len) { 540 len = (int)ntohl((uint32_t)len); 541 if(len > CURL_MAX_INPUT_LENGTH) 542 return CURLE_TOO_LARGE; 543 544 curlx_dyn_reset(&buf->buf); 545 } 546 else 547 return CURLE_RECV_ERROR; 548 549 do { 550 char buffer[1024]; 551 nread = CURLMIN(len, (int)sizeof(buffer)); 552 result = socket_read(data, sockindex, buffer, (size_t)nread); 553 if(result) 554 return result; 555 result = curlx_dyn_addn(&buf->buf, buffer, nread); 556 if(result) 557 return result; 558 len -= nread; 559 } while(len); 560 /* this decodes the dynbuf *in place* */ 561 nread = conn->mech->decode(conn->app_data, 562 curlx_dyn_ptr(&buf->buf), 563 len, conn->data_prot, conn); 564 if(nread < 0) 565 return CURLE_RECV_ERROR; 566 curlx_dyn_setlen(&buf->buf, nread); 567 buf->index = 0; 568 return CURLE_OK; 569 } 570 571 static size_t 572 buffer_read(struct krb5buffer *buf, void *data, size_t len) 573 { 574 size_t size = curlx_dyn_len(&buf->buf); 575 if(size - buf->index < len) 576 len = size - buf->index; 577 memcpy(data, curlx_dyn_ptr(&buf->buf) + buf->index, len); 578 buf->index += len; 579 return len; 580 } 581 582 /* Matches Curl_recv signature */ 583 static CURLcode sec_recv(struct Curl_easy *data, int sockindex, 584 char *buffer, size_t len, size_t *pnread) 585 { 586 struct connectdata *conn = data->conn; 587 CURLcode result = CURLE_OK; 588 size_t bytes_read; 589 590 /* Handle clear text response. */ 591 if(conn->sec_complete == 0 || conn->data_prot == PROT_CLEAR) 592 return Curl_conn_recv(data, sockindex, buffer, len, pnread); 593 594 if(conn->in_buffer.eof_flag) { 595 conn->in_buffer.eof_flag = 0; 596 *pnread = 0; 597 return CURLE_OK; 598 } 599 600 bytes_read = buffer_read(&conn->in_buffer, buffer, len); 601 buffer += bytes_read; 602 len -= bytes_read; 603 *pnread += bytes_read; 604 605 while(len > 0) { 606 result = krb5_read_data(data, sockindex, &conn->in_buffer); 607 if(result) 608 return result; 609 if(curlx_dyn_len(&conn->in_buffer.buf) == 0) { 610 if(*pnread > 0) 611 conn->in_buffer.eof_flag = 1; 612 return result; 613 } 614 bytes_read = buffer_read(&conn->in_buffer, buffer, len); 615 buffer += bytes_read; 616 len -= bytes_read; 617 *pnread += bytes_read; 618 } 619 return result; 620 } 621 622 /* Send |length| bytes from |from| to the |sockindex| socket taking care of 623 encoding and negotiating with the server. |from| can be NULL. */ 624 static void do_sec_send(struct Curl_easy *data, struct connectdata *conn, 625 int sockindex, const char *from, size_t length) 626 { 627 int bytes, htonl_bytes; /* 32-bit integers for htonl */ 628 char *buffer = NULL; 629 char *cmd_buffer; 630 size_t cmd_size = 0; 631 CURLcode error; 632 enum protection_level prot_level = conn->data_prot; 633 bool iscmd = (prot_level == PROT_CMD); 634 635 DEBUGASSERT(prot_level > PROT_NONE && prot_level < PROT_LAST); 636 637 if(iscmd) { 638 if(!strncmp(from, "PASS ", 5) || !strncmp(from, "ACCT ", 5)) 639 prot_level = PROT_PRIVATE; 640 else 641 prot_level = conn->command_prot; 642 } 643 bytes = conn->mech->encode(conn->app_data, from, (int)length, 644 (int)prot_level, (void **)&buffer); 645 if(!buffer || bytes <= 0) 646 return; /* error */ 647 648 if(iscmd) { 649 error = curlx_base64_encode(buffer, curlx_sitouz(bytes), 650 &cmd_buffer, &cmd_size); 651 if(error) { 652 free(buffer); 653 return; /* error */ 654 } 655 if(cmd_size > 0) { 656 static const char *enc = "ENC "; 657 static const char *mic = "MIC "; 658 if(prot_level == PROT_PRIVATE) 659 socket_write(data, sockindex, enc, 4); 660 else 661 socket_write(data, sockindex, mic, 4); 662 663 socket_write(data, sockindex, cmd_buffer, cmd_size); 664 socket_write(data, sockindex, "\r\n", 2); 665 infof(data, "Send: %s%s", prot_level == PROT_PRIVATE ? enc : mic, 666 cmd_buffer); 667 free(cmd_buffer); 668 } 669 } 670 else { 671 htonl_bytes = (int)htonl((OM_uint32)bytes); 672 socket_write(data, sockindex, &htonl_bytes, sizeof(htonl_bytes)); 673 socket_write(data, sockindex, buffer, curlx_sitouz(bytes)); 674 } 675 free(buffer); 676 } 677 678 static CURLcode sec_write(struct Curl_easy *data, int sockindex, 679 const char *buffer, size_t length, 680 size_t *pnwritten) 681 { 682 struct connectdata *conn = data->conn; 683 size_t len = conn->buffer_size; 684 685 *pnwritten = 0; 686 if(len <= 0) 687 len = length; 688 while(length) { 689 if(length < len) 690 len = length; 691 692 /* WTF: this ignores all errors writing to the socket */ 693 do_sec_send(data, conn, sockindex, buffer, len); 694 length -= len; 695 buffer += len; 696 *pnwritten += len; 697 } 698 return CURLE_OK; 699 } 700 701 /* Matches Curl_send signature */ 702 static CURLcode sec_send(struct Curl_easy *data, int sockindex, 703 const void *buffer, size_t len, bool eos, 704 size_t *pnwritten) 705 { 706 (void)eos; /* unused */ 707 return sec_write(data, sockindex, buffer, len, pnwritten); 708 } 709 710 int Curl_sec_read_msg(struct Curl_easy *data, struct connectdata *conn, 711 char *buffer, enum protection_level level) 712 { 713 /* decoded_len should be size_t or ssize_t but conn->mech->decode returns an 714 int */ 715 int decoded_len; 716 char *buf; 717 int ret_code = 0; 718 size_t decoded_sz = 0; 719 CURLcode error; 720 721 (void) data; 722 723 if(!conn->mech) 724 /* not initialized, return error */ 725 return -1; 726 727 DEBUGASSERT(level > PROT_NONE && level < PROT_LAST); 728 729 error = curlx_base64_decode(buffer + 4, (unsigned char **)&buf, &decoded_sz); 730 if(error || decoded_sz == 0) 731 return -1; 732 733 if(decoded_sz > (size_t)INT_MAX) { 734 free(buf); 735 return -1; 736 } 737 decoded_len = curlx_uztosi(decoded_sz); 738 739 decoded_len = conn->mech->decode(conn->app_data, buf, decoded_len, 740 (int)level, conn); 741 if(decoded_len <= 0) { 742 free(buf); 743 return -1; 744 } 745 746 { 747 buf[decoded_len] = '\n'; 748 Curl_debug(data, CURLINFO_HEADER_IN, buf, decoded_len + 1); 749 } 750 751 buf[decoded_len] = '\0'; 752 if(decoded_len <= 3) 753 /* suspiciously short */ 754 return 0; 755 756 if(buf[3] != '-') 757 ret_code = atoi(buf); 758 759 if(buf[decoded_len - 1] == '\n') 760 buf[decoded_len - 1] = '\0'; 761 strcpy(buffer, buf); 762 free(buf); 763 return ret_code; 764 } 765 766 static int sec_set_protection_level(struct Curl_easy *data) 767 { 768 int code; 769 struct connectdata *conn = data->conn; 770 unsigned char level = conn->request_data_prot; 771 772 DEBUGASSERT(level > PROT_NONE && level < PROT_LAST); 773 774 if(!conn->sec_complete) { 775 infof(data, "Trying to change the protection level after the" 776 " completion of the data exchange."); 777 return -1; 778 } 779 780 /* Bail out if we try to set up the same level */ 781 if(conn->data_prot == level) 782 return 0; 783 784 if(level) { 785 char *pbsz; 786 unsigned int buffer_size = 1 << 20; /* 1048576 */ 787 struct ftp_conn *ftpc = Curl_conn_meta_get(conn, CURL_META_FTP_CONN); 788 char *line; 789 790 if(!ftpc) 791 return -2; 792 793 code = ftp_send_command(data, "PBSZ %u", buffer_size); 794 if(code < 0) 795 return -1; 796 797 if(code/100 != 2) { 798 failf(data, "Failed to set the protection's buffer size."); 799 return -1; 800 } 801 conn->buffer_size = buffer_size; 802 803 line = curlx_dyn_ptr(&ftpc->pp.recvbuf); 804 pbsz = strstr(line, "PBSZ="); 805 if(pbsz) { 806 /* stick to default value if the check fails */ 807 if(ISDIGIT(pbsz[5])) 808 buffer_size = (unsigned int)atoi(&pbsz[5]); 809 if(buffer_size < conn->buffer_size) 810 conn->buffer_size = buffer_size; 811 } 812 } 813 814 /* Now try to negotiate the protection level. */ 815 code = ftp_send_command(data, "PROT %c", level_to_char(level)); 816 817 if(code < 0) 818 return -1; 819 820 if(code/100 != 2) { 821 failf(data, "Failed to set the protection level."); 822 return -1; 823 } 824 825 conn->data_prot = level; 826 if(level == PROT_PRIVATE) 827 conn->command_prot = level; 828 829 return 0; 830 } 831 832 int 833 Curl_sec_request_prot(struct connectdata *conn, const char *level) 834 { 835 unsigned char l = name_to_level(level); 836 if(l == PROT_NONE) 837 return -1; 838 DEBUGASSERT(l > PROT_NONE && l < PROT_LAST); 839 conn->request_data_prot = l; 840 return 0; 841 } 842 843 static CURLcode choose_mech(struct Curl_easy *data, struct connectdata *conn) 844 { 845 int ret; 846 void *tmp_allocation; 847 const struct Curl_sec_client_mech *mech = &Curl_krb5_client_mech; 848 849 tmp_allocation = realloc(conn->app_data, mech->size); 850 if(!tmp_allocation) { 851 failf(data, "Failed realloc of size %zu", mech->size); 852 mech = NULL; 853 return CURLE_OUT_OF_MEMORY; 854 } 855 conn->app_data = tmp_allocation; 856 857 if(mech->init) { 858 ret = mech->init(conn->app_data); 859 if(ret) { 860 infof(data, "Failed initialization for %s. Skipping it.", 861 mech->name); 862 return CURLE_FAILED_INIT; 863 } 864 } 865 866 infof(data, "Trying mechanism %s...", mech->name); 867 ret = ftp_send_command(data, "AUTH %s", mech->name); 868 if(ret < 0) 869 return CURLE_COULDNT_CONNECT; 870 871 if(ret/100 != 3) { 872 switch(ret) { 873 case 504: 874 infof(data, "Mechanism %s is not supported by the server (server " 875 "returned ftp code: 504).", mech->name); 876 break; 877 case 534: 878 infof(data, "Mechanism %s was rejected by the server (server returned " 879 "ftp code: 534).", mech->name); 880 break; 881 default: 882 if(ret/100 == 5) { 883 infof(data, "server does not support the security extensions"); 884 return CURLE_USE_SSL_FAILED; 885 } 886 break; 887 } 888 return CURLE_LOGIN_DENIED; 889 } 890 891 /* Authenticate */ 892 ret = mech->auth(conn->app_data, data, conn); 893 894 if(ret != AUTH_CONTINUE) { 895 if(ret != AUTH_OK) { 896 /* Mechanism has dumped the error to stderr, do not error here. */ 897 return CURLE_USE_SSL_FAILED; 898 } 899 DEBUGASSERT(ret == AUTH_OK); 900 901 conn->mech = mech; 902 conn->sec_complete = 1; 903 conn->recv[FIRSTSOCKET] = sec_recv; 904 conn->send[FIRSTSOCKET] = sec_send; 905 conn->recv[SECONDARYSOCKET] = sec_recv; 906 conn->send[SECONDARYSOCKET] = sec_send; 907 conn->command_prot = PROT_SAFE; 908 /* Set the requested protection level */ 909 /* BLOCKING */ 910 (void)sec_set_protection_level(data); 911 } 912 913 return CURLE_OK; 914 } 915 916 CURLcode 917 Curl_sec_login(struct Curl_easy *data, struct connectdata *conn) 918 { 919 return choose_mech(data, conn); 920 } 921 922 void 923 Curl_sec_conn_init(struct connectdata *conn) 924 { 925 curlx_dyn_init(&conn->in_buffer.buf, CURL_MAX_INPUT_LENGTH); 926 conn->in_buffer.index = 0; 927 conn->in_buffer.eof_flag = 0; 928 } 929 930 void 931 Curl_sec_conn_destroy(struct connectdata *conn) 932 { 933 if(conn->mech && conn->mech->end) 934 conn->mech->end(conn->app_data); 935 Curl_safefree(conn->app_data); 936 curlx_dyn_free(&conn->in_buffer.buf); 937 conn->in_buffer.index = 0; 938 conn->in_buffer.eof_flag = 0; 939 conn->sec_complete = 0; 940 conn->data_prot = PROT_CLEAR; 941 conn->mech = NULL; 942 } 943 944 #if defined(__GNUC__) && defined(__APPLE__) 945 #pragma GCC diagnostic pop 946 #endif 947 948 #endif /* HAVE_GSSAPI && !CURL_DISABLE_FTP */