X-Git-Url: http://git.madism.org/?p=apps%2Fmadmutt.git;a=blobdiff_plain;f=imap%2Fauth_gss.c;h=8fe099cf24d02b88c899e8da88d7323b67ce14c9;hp=e5f1bce1a4021ea53cdc2866d24ef4be2401907b;hb=23e6291cb5d5b4cd2008403d8b628007fd75ff23;hpb=7f7a0be369840b290248e5b0302beb447fa1b3cd diff --git a/imap/auth_gss.c b/imap/auth_gss.c index e5f1bce..8fe099c 100644 --- a/imap/auth_gss.c +++ b/imap/auth_gss.c @@ -18,7 +18,6 @@ #include "auth.h" #include -#include "lib/debug.h" #include @@ -37,7 +36,7 @@ #define GSS_AUTH_P_PRIVACY 4 /* imap_auth_gss: AUTH=GSSAPI support. */ -imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) +imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method __attribute__ ((unused))) { gss_buffer_desc request_buf, send_token; gss_buffer_t sec_token; @@ -64,18 +63,9 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) maj_stat = gss_import_name (&min_stat, &request_buf, gss_nt_service_name, &target_name); if (maj_stat != GSS_S_COMPLETE) { - debug_print (2, ("Couldn't get service name for [%s]\n", buf1)); return IMAP_AUTH_UNAVAIL; } -#ifdef DEBUG - else if (DebugLevel >= 2) { - maj_stat = gss_display_name (&min_stat, target_name, &request_buf, - &mech_name); - debug_print (2, ("Using service name [%s]\n", - (char *) request_buf.value)); - maj_stat = gss_release_buffer (&min_stat, &request_buf); - } -#endif + /* Acquire initial credentials - without a TGT GSSAPI is UNAVAIL */ sec_token = GSS_C_NO_BUFFER; context = GSS_C_NO_CONTEXT; @@ -88,7 +78,6 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) &send_token, (unsigned int *) &cflags, NULL); if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) { - debug_print (1, ("Error acquiring credentials - no TGT?\n")); gss_release_name (&min_stat, &target_name); return IMAP_AUTH_UNAVAIL; @@ -105,17 +94,15 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) while (rc == IMAP_CMD_CONTINUE); if (rc != IMAP_CMD_RESPOND) { - debug_print (2, ("Invalid response from server: %s\n", buf1)); gss_release_name (&min_stat, &target_name); goto bail; } /* now start the security context initialisation loop... */ - debug_print (2, ("Sending credentials\n")); mutt_to_base64 ((unsigned char *) buf1, send_token.value, send_token.length, sizeof (buf1) - 2); gss_release_buffer (&min_stat, &send_token); - str_cat (buf1, sizeof (buf1), "\r\n"); + m_strcat(buf1, sizeof(buf1), "\r\n"); mutt_socket_write (idata->conn, buf1); while (maj_stat == GSS_S_CONTINUE_NEEDED) { @@ -125,7 +112,6 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) while (rc == IMAP_CMD_CONTINUE); if (rc != IMAP_CMD_RESPOND) { - debug_print (1, ("Error receiving server response.\n")); gss_release_name (&min_stat, &target_name); goto bail; } @@ -142,7 +128,6 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) NULL, &send_token, (unsigned int *) &cflags, NULL); if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) { - debug_print (1, ("Error exchanging credentials\n")); gss_release_name (&min_stat, &target_name); goto err_abort_cmd; @@ -150,7 +135,7 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) mutt_to_base64 ((unsigned char *) buf1, send_token.value, send_token.length, sizeof (buf1) - 2); gss_release_buffer (&min_stat, &send_token); - str_cat (buf1, sizeof (buf1), "\r\n"); + m_strcat(buf1, sizeof(buf1), "\r\n"); mutt_socket_write (idata->conn, buf1); } @@ -162,7 +147,6 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) while (rc == IMAP_CMD_CONTINUE); if (rc != IMAP_CMD_RESPOND) { - debug_print (1, ("Error receiving server response.\n")); goto bail; } request_buf.length = mutt_from_base64 (buf2, idata->cmd.buf + 2); @@ -171,16 +155,13 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) maj_stat = gss_unwrap (&min_stat, context, &request_buf, &send_token, &cflags, &quality); if (maj_stat != GSS_S_COMPLETE) { - debug_print (2, ("Couldn't unwrap security level data\n")); gss_release_buffer (&min_stat, &send_token); goto err_abort_cmd; } - debug_print (2, ("Credential exchange complete\n")); /* first octet is security levels supported. We want NONE */ server_conf_flags = ((char *) send_token.value)[0]; if (!(((char *) send_token.value)[0] & GSS_AUTH_P_NONE)) { - debug_print (2, ("Server requires integrity or privacy\n")); gss_release_buffer (&min_stat, &send_token); goto err_abort_cmd; } @@ -189,11 +170,6 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) ((char *) send_token.value)[0] = 0; buf_size = ntohl (*((long *) send_token.value)); gss_release_buffer (&min_stat, &send_token); - debug_print (2, ("Unwrapped security level flags: %c%c%c\n", - server_conf_flags & GSS_AUTH_P_NONE ? 'N' : '-', - server_conf_flags & GSS_AUTH_P_INTEGRITY ? 'I' : '-', - server_conf_flags & GSS_AUTH_P_PRIVACY ? 'P' : '-')); - debug_print (2, ("Maximum GSS token size is %ld\n", buf_size)); /* agree to terms (hack!) */ buf_size = htonl (buf_size); /* not relevant without integrity/privacy */ @@ -206,14 +182,12 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) maj_stat = gss_wrap (&min_stat, context, 0, GSS_C_QOP_DEFAULT, &request_buf, &cflags, &send_token); if (maj_stat != GSS_S_COMPLETE) { - debug_print (2, ("Error creating login request\n")); goto err_abort_cmd; } mutt_to_base64 ((unsigned char *) buf1, send_token.value, send_token.length, sizeof (buf1) - 2); - debug_print (2, ("Requesting authorisation as %s\n", idata->conn->account.user)); - str_cat (buf1, sizeof (buf1), "\r\n"); + m_strcat(buf1, sizeof(buf1), "\r\n"); mutt_socket_write (idata->conn, buf1); /* Joy of victory or agony of defeat? */ @@ -221,15 +195,11 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method) rc = imap_cmd_step (idata); while (rc == IMAP_CMD_CONTINUE); if (rc == IMAP_CMD_RESPOND) { - debug_print (1, ("Unexpected server continuation request.\n")); goto err_abort_cmd; } if (imap_code (idata->cmd.buf)) { /* flush the security context */ - debug_print (2, ("Releasing GSS credentials\n")); maj_stat = gss_delete_sec_context (&min_stat, &context, &send_token); - if (maj_stat != GSS_S_COMPLETE) - debug_print (1, ("Error releasing credentials\n")); /* send_token may contain a notification to the server to flush * credentials. RFC 1731 doesn't specify what to do, and since this