2 * Copyright notice from original mutt:
3 * Copyright (C) 1999-2000 Brendan Cully <brendan@kublai.com>
5 * This file is part of mutt-ng, see http://www.muttng.org/.
6 * It's licensed under the GNU General Public License,
7 * please see the file GPL in the top level source directory.
10 /* GSS login/authentication code */
17 #include "imap_private.h"
22 #include <netinet/in.h>
25 # include <gssapi/gssapi.h>
26 # define gss_nt_service_name GSS_C_NT_HOSTBASED_SERVICE
28 # include <gssapi/gssapi.h>
29 # include <gssapi/gssapi_generic.h>
32 #define GSS_BUFSIZE 8192
34 #define GSS_AUTH_P_NONE 1
35 #define GSS_AUTH_P_INTEGRITY 2
36 #define GSS_AUTH_P_PRIVACY 4
38 /* imap_auth_gss: AUTH=GSSAPI support. */
39 imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method)
41 gss_buffer_desc request_buf, send_token;
42 gss_buffer_t sec_token;
43 gss_name_t target_name;
48 OM_uint32 maj_stat, min_stat;
49 char buf1[GSS_BUFSIZE], buf2[GSS_BUFSIZE], server_conf_flags;
50 unsigned long buf_size;
53 if (!mutt_bit_isset (idata->capabilities, AGSSAPI))
54 return IMAP_AUTH_UNAVAIL;
56 if (mutt_account_getuser (&idata->conn->account))
57 return IMAP_AUTH_FAILURE;
59 /* get an IMAP service ticket for the server */
60 snprintf (buf1, sizeof (buf1), "imap@%s", idata->conn->account.host);
61 request_buf.value = buf1;
62 request_buf.length = mutt_strlen (buf1) + 1;
63 maj_stat = gss_import_name (&min_stat, &request_buf, gss_nt_service_name,
65 if (maj_stat != GSS_S_COMPLETE) {
66 dprint (2, (debugfile, "Couldn't get service name for [%s]\n", buf1));
67 return IMAP_AUTH_UNAVAIL;
70 else if (debuglevel >= 2) {
71 maj_stat = gss_display_name (&min_stat, target_name, &request_buf,
73 dprint (2, (debugfile, "Using service name [%s]\n",
74 (char *) request_buf.value));
75 maj_stat = gss_release_buffer (&min_stat, &request_buf);
78 /* Acquire initial credentials - without a TGT GSSAPI is UNAVAIL */
79 sec_token = GSS_C_NO_BUFFER;
80 context = GSS_C_NO_CONTEXT;
83 maj_stat = gss_init_sec_context (&min_stat, GSS_C_NO_CREDENTIAL, &context,
84 target_name, GSS_C_NO_OID,
85 GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG, 0,
86 GSS_C_NO_CHANNEL_BINDINGS, sec_token, NULL,
87 &send_token, (unsigned int *) &cflags,
89 if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
90 dprint (1, (debugfile, "Error acquiring credentials - no TGT?\n"));
91 gss_release_name (&min_stat, &target_name);
93 return IMAP_AUTH_UNAVAIL;
97 mutt_message _("Authenticating (GSSAPI)...");
99 imap_cmd_start (idata, "AUTHENTICATE GSSAPI");
101 /* expect a null continuation response ("+") */
103 rc = imap_cmd_step (idata);
104 while (rc == IMAP_CMD_CONTINUE);
106 if (rc != IMAP_CMD_RESPOND) {
107 dprint (2, (debugfile, "Invalid response from server: %s\n", buf1));
108 gss_release_name (&min_stat, &target_name);
112 /* now start the security context initialisation loop... */
113 dprint (2, (debugfile, "Sending credentials\n"));
114 mutt_to_base64 ((unsigned char *) buf1, send_token.value, send_token.length,
116 gss_release_buffer (&min_stat, &send_token);
117 safe_strcat (buf1, sizeof (buf1), "\r\n");
118 mutt_socket_write (idata->conn, buf1);
120 while (maj_stat == GSS_S_CONTINUE_NEEDED) {
121 /* Read server data */
123 rc = imap_cmd_step (idata);
124 while (rc == IMAP_CMD_CONTINUE);
126 if (rc != IMAP_CMD_RESPOND) {
127 dprint (1, (debugfile, "Error receiving server response.\n"));
128 gss_release_name (&min_stat, &target_name);
132 request_buf.length = mutt_from_base64 (buf2, idata->cmd.buf + 2);
133 request_buf.value = buf2;
134 sec_token = &request_buf;
136 /* Write client data */
137 maj_stat = gss_init_sec_context (&min_stat, GSS_C_NO_CREDENTIAL, &context,
138 target_name, GSS_C_NO_OID,
139 GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG,
140 0, GSS_C_NO_CHANNEL_BINDINGS, sec_token,
142 (unsigned int *) &cflags, NULL);
143 if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
144 dprint (1, (debugfile, "Error exchanging credentials\n"));
145 gss_release_name (&min_stat, &target_name);
149 mutt_to_base64 ((unsigned char *) buf1, send_token.value,
150 send_token.length, sizeof (buf1) - 2);
151 gss_release_buffer (&min_stat, &send_token);
152 safe_strcat (buf1, sizeof (buf1), "\r\n");
153 mutt_socket_write (idata->conn, buf1);
156 gss_release_name (&min_stat, &target_name);
158 /* get security flags and buffer size */
160 rc = imap_cmd_step (idata);
161 while (rc == IMAP_CMD_CONTINUE);
163 if (rc != IMAP_CMD_RESPOND) {
164 dprint (1, (debugfile, "Error receiving server response.\n"));
167 request_buf.length = mutt_from_base64 (buf2, idata->cmd.buf + 2);
168 request_buf.value = buf2;
170 maj_stat = gss_unwrap (&min_stat, context, &request_buf, &send_token,
172 if (maj_stat != GSS_S_COMPLETE) {
173 dprint (2, (debugfile, "Couldn't unwrap security level data\n"));
174 gss_release_buffer (&min_stat, &send_token);
177 dprint (2, (debugfile, "Credential exchange complete\n"));
179 /* first octet is security levels supported. We want NONE */
180 server_conf_flags = ((char *) send_token.value)[0];
181 if (!(((char *) send_token.value)[0] & GSS_AUTH_P_NONE)) {
182 dprint (2, (debugfile, "Server requires integrity or privacy\n"));
183 gss_release_buffer (&min_stat, &send_token);
187 /* we don't care about buffer size if we don't wrap content. But here it is */
188 ((char *) send_token.value)[0] = 0;
189 buf_size = ntohl (*((long *) send_token.value));
190 gss_release_buffer (&min_stat, &send_token);
191 dprint (2, (debugfile, "Unwrapped security level flags: %c%c%c\n",
192 server_conf_flags & GSS_AUTH_P_NONE ? 'N' : '-',
193 server_conf_flags & GSS_AUTH_P_INTEGRITY ? 'I' : '-',
194 server_conf_flags & GSS_AUTH_P_PRIVACY ? 'P' : '-'));
195 dprint (2, (debugfile, "Maximum GSS token size is %ld\n", buf_size));
197 /* agree to terms (hack!) */
198 buf_size = htonl (buf_size); /* not relevant without integrity/privacy */
199 memcpy (buf1, &buf_size, 4);
200 buf1[0] = GSS_AUTH_P_NONE;
201 /* server decides if principal can log in as user */
202 strncpy (buf1 + 4, idata->conn->account.user, sizeof (buf1) - 4);
203 request_buf.value = buf1;
204 request_buf.length = 4 + mutt_strlen (idata->conn->account.user) + 1;
205 maj_stat = gss_wrap (&min_stat, context, 0, GSS_C_QOP_DEFAULT, &request_buf,
206 &cflags, &send_token);
207 if (maj_stat != GSS_S_COMPLETE) {
208 dprint (2, (debugfile, "Error creating login request\n"));
212 mutt_to_base64 ((unsigned char *) buf1, send_token.value, send_token.length,
214 dprint (2, (debugfile, "Requesting authorisation as %s\n",
215 idata->conn->account.user));
216 safe_strcat (buf1, sizeof (buf1), "\r\n");
217 mutt_socket_write (idata->conn, buf1);
219 /* Joy of victory or agony of defeat? */
221 rc = imap_cmd_step (idata);
222 while (rc == IMAP_CMD_CONTINUE);
223 if (rc == IMAP_CMD_RESPOND) {
224 dprint (1, (debugfile, "Unexpected server continuation request.\n"));
227 if (imap_code (idata->cmd.buf)) {
228 /* flush the security context */
229 dprint (2, (debugfile, "Releasing GSS credentials\n"));
230 maj_stat = gss_delete_sec_context (&min_stat, &context, &send_token);
231 if (maj_stat != GSS_S_COMPLETE)
232 dprint (1, (debugfile, "Error releasing credentials\n"));
234 /* send_token may contain a notification to the server to flush
235 * credentials. RFC 1731 doesn't specify what to do, and since this
236 * support is only for authentication, we'll assume the server knows
237 * enough to flush its own credentials */
238 gss_release_buffer (&min_stat, &send_token);
240 return IMAP_AUTH_SUCCESS;
246 mutt_socket_write (idata->conn, "*\r\n");
248 rc = imap_cmd_step (idata);
249 while (rc == IMAP_CMD_CONTINUE);
252 mutt_error _("GSSAPI authentication failed.");
254 return IMAP_AUTH_FAILURE;