X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/b1206957506a8d30e54c3d76c3ada5f247118666..1d28cc061677bd07d9bed48dd84bd5c590247043:/src/src/auths/spa.c diff --git a/src/src/auths/spa.c b/src/src/auths/spa.c index dc859674e..222ccea86 100644 --- a/src/src/auths/spa.c +++ b/src/src/auths/spa.c @@ -1,11 +1,11 @@ -/* $Cambridge: exim/src/src/auths/spa.c,v 1.2 2004/12/20 14:57:05 ph10 Exp $ */ - /************************************************* * Exim - an Internet mail transport agent * *************************************************/ -/* Copyright (c) University of Cambridge 1995 - 2004 */ +/* Copyright (c) University of Cambridge 1995 - 2018 */ +/* Copyright (c) The Exim Maintainers 2020 */ /* See the file NOTICE for conditions of use and distribution. */ +/* SPDX-License-Identifier: GPL-2.0-or-later */ /* This file, which provides support for Microsoft's Secure Password Authentication, was contributed by Marc Prud'hommeaux. Tom Kistner added SPA @@ -14,6 +14,7 @@ server support. I (PH) have only modified it in very trivial ways. References: http://www.innovation.ch/java/ntlm.html http://www.kuro5hin.org/story/2002/4/28/1436/66154 + http://download.microsoft.com/download/9/5/e/95ef66af-9026-4bb0-a41d-a4f81802d92c/%5bMS-SMTP%5d.pdf * It seems that some systems have existing but different definitions of some * of the following types. I received a complaint about "int16" causing @@ -25,8 +26,10 @@ References: * typedef unsigned uint32; * typedef unsigned char uint8; -07-August-2003: PH: Patched up the code to avoid assert bombouts for stupid - input data. Find appropriate comment by grepping for "PH". +07-August-2003: PH: Patched up the code to avoid assert bombouts for stupid + input data. Find appropriate comment by grepping for "PH". +16-October-2006: PH: Added a call to auth_check_serv_cond() at the end +05-June-2010: PP: handle SASL initial response */ @@ -45,13 +48,13 @@ References: optionlist auth_spa_options[] = { { "client_domain", opt_stringptr, - (void *)(offsetof(auth_spa_options_block, spa_domain)) }, + OPT_OFF(auth_spa_options_block, spa_domain) }, { "client_password", opt_stringptr, - (void *)(offsetof(auth_spa_options_block, spa_password)) }, + OPT_OFF(auth_spa_options_block, spa_password) }, { "client_username", opt_stringptr, - (void *)(offsetof(auth_spa_options_block, spa_username)) }, + OPT_OFF(auth_spa_options_block, spa_username) }, { "server_password", opt_stringptr, - (void *)(offsetof(auth_spa_options_block, spa_serverpassword)) } + OPT_OFF(auth_spa_options_block, spa_serverpassword) } }; /* Size of the options list. An extern variable has to be used so that its @@ -60,7 +63,7 @@ address can appear in the tables drtables.c. */ int auth_spa_options_count = sizeof(auth_spa_options)/sizeof(optionlist); -/* Default private options block for the contidion authentication method. */ +/* Default private options block for the condition authentication method. */ auth_spa_options_block auth_spa_option_defaults = { NULL, /* spa_password */ @@ -70,6 +73,19 @@ auth_spa_options_block auth_spa_option_defaults = { }; +#ifdef MACRO_PREDEF + +/* Dummy values */ +void auth_spa_init(auth_instance *ablock) {} +int auth_spa_server(auth_instance *ablock, uschar *data) {return 0;} +int auth_spa_client(auth_instance *ablock, void * sx, int timeout, + uschar *buffer, int buffsize) {return 0;} + +#else /*!MACRO_PREDEF*/ + + + + /************************************************* * Initialization entry point * *************************************************/ @@ -109,7 +125,7 @@ ablock->server = ob->spa_serverpassword != NULL; /* For interface, see auths/README */ -#define CVAL(buf,pos) (((unsigned char *)(buf))[pos]) +#define CVAL(buf,pos) ((US (buf))[pos]) #define PVAL(buf,pos) ((unsigned)CVAL(buf,pos)) #define SVAL(buf,pos) (PVAL(buf,pos)|PVAL(buf,(pos)+1)<<8) #define IVAL(buf,pos) (SVAL(buf,pos)|SVAL(buf,(pos)+2)<<16) @@ -125,45 +141,38 @@ SPAAuthChallenge challenge; SPAAuthResponse response; SPAAuthResponse *responseptr = &response; uschar msgbuf[2048]; -uschar *clearpass; +uschar *clearpass, *s; +unsigned off; -/* send a 334, MS Exchange style, and grab the client's request */ +/* send a 334, MS Exchange style, and grab the client's request, +unless we already have it via an initial response. */ -if (auth_get_no64_data(&data, US"NTLM supported") != OK) - { - /* something borked */ +if (!*data && auth_get_no64_data(&data, US"NTLM supported") != OK) return FAIL; - } -if (spa_base64_to_bits((char *)(&request), (const char *)(data)) < 0) +if (spa_base64_to_bits(CS &request, sizeof(request), CCS data) < 0) { DEBUG(D_auth) debug_printf("auth_spa_server(): bad base64 data in " - "request: %s\n", data); + "request: %s\n", data); return FAIL; } /* create a challenge and send it back */ -spa_build_auth_challenge(&request,&challenge); -spa_bits_to_base64 (msgbuf, (unsigned char*)&challenge, - spa_request_length(&challenge)); +spa_build_auth_challenge(&request, &challenge); +spa_bits_to_base64(msgbuf, US &challenge, spa_request_length(&challenge)); if (auth_get_no64_data(&data, msgbuf) != OK) - { - /* something borked */ return FAIL; - } /* dump client response */ -if (spa_base64_to_bits((char *)(&response), (const char *)(data)) < 0) +if (spa_base64_to_bits(CS &response, sizeof(response), CCS data) < 0) { DEBUG(D_auth) debug_printf("auth_spa_server(): bad base64 data in " - "response: %s\n", data); + "response: %s\n", data); return FAIL; } -/* get username and put it in $1 */ - /*************************************************************** PH 07-Aug-2003: The original code here was this: @@ -180,9 +189,19 @@ that causes failure if the size of msgbuf is exceeded. ****/ { int i; - char *p = ((char*)responseptr) + IVAL(&responseptr->uUser.offset,0); + char * p; int len = SVAL(&responseptr->uUser.len,0)/2; + if ( (off = IVAL(&responseptr->uUser.offset,0)) >= sizeof(SPAAuthResponse) + || len >= sizeof(responseptr->buffer)/2 + || (p = (CS responseptr) + off) + len*2 >= CS (responseptr+1) + ) + { + DEBUG(D_auth) + debug_printf("auth_spa_server(): bad uUser spec in response\n"); + return FAIL; + } + if (len + 1 >= sizeof(msgbuf)) return FAIL; for (i = 0; i < len; ++i) { @@ -194,16 +213,21 @@ that causes failure if the size of msgbuf is exceeded. ****/ /***************************************************************/ -expand_nstring[1] = msgbuf; +/* Put the username in $auth1 and $1. The former is now the preferred variable; +the latter is the original variable. These have to be out of stack memory, and +need to be available once known even if not authenticated, for error messages +(server_set_id, which only makes it to authenticated_id if we return OK) */ + +auth_vars[0] = expand_nstring[1] = string_copy(msgbuf); expand_nlength[1] = Ustrlen(msgbuf); expand_nmax = 1; +debug_print_string(ablock->server_debug_string); /* customized debug */ + /* look up password */ -clearpass = expand_string(ob->spa_serverpassword); -if (clearpass == NULL) - { - if (expand_string_forcedfail) +if (!(clearpass = expand_string(ob->spa_serverpassword))) + if (f.expand_string_forcedfail) { DEBUG(D_auth) debug_printf("auth_spa_server(): forced failure while " "expanding spa_serverpassword\n"); @@ -215,20 +239,27 @@ if (clearpass == NULL) "spa_serverpassword: %s\n", expand_string_message); return DEFER; } - } /* create local hash copy */ -spa_smb_encrypt (clearpass, challenge.challengeData, lmRespData); -spa_smb_nt_encrypt (clearpass, challenge.challengeData, ntRespData); +spa_smb_encrypt(clearpass, challenge.challengeData, lmRespData); +spa_smb_nt_encrypt(clearpass, challenge.challengeData, ntRespData); /* compare NT hash (LM may not be available) */ -if (memcmp(ntRespData, - ((unsigned char*)responseptr)+IVAL(&responseptr->ntResponse.offset,0), - 24) == 0) - /* success. we have a winner. */ - return OK; +off = IVAL(&responseptr->ntResponse.offset,0); +if (off >= sizeof(SPAAuthResponse) - 24) + { + DEBUG(D_auth) + debug_printf("auth_spa_server(): bad ntRespData spec in response\n"); + return FAIL; + } +s = (US responseptr) + off; + +if (memcmp(ntRespData, s, 24) == 0) + return auth_check_serv_cond(ablock); /* success. we have a winner. */ + + /* Expand server_condition as an authorization check (PH) */ return FAIL; } @@ -243,113 +274,104 @@ return FAIL; int auth_spa_client( auth_instance *ablock, /* authenticator block */ - smtp_inblock *inblock, /* connection inblock */ - smtp_outblock *outblock, /* connection outblock */ + void * sx, /* connection */ int timeout, /* command timeout */ uschar *buffer, /* buffer for reading response */ int buffsize) /* size of buffer */ { - auth_spa_options_block *ob = - (auth_spa_options_block *)(ablock->options_block); - SPAAuthRequest request; - SPAAuthChallenge challenge; - SPAAuthResponse response; - char msgbuf[2048]; - char *domain = NULL; - char *username, *password; - - /* Code added by PH to expand the options */ - - username = CS expand_string(ob->spa_username); - if (username == NULL) - { - if (expand_string_forcedfail) return CANCELLED; - string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " - "authenticator: %s", ob->spa_username, ablock->name, - expand_string_message); - return ERROR; - } - - password = CS expand_string(ob->spa_password); - if (password == NULL) - { - if (expand_string_forcedfail) return CANCELLED; - string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " - "authenticator: %s", ob->spa_password, ablock->name, - expand_string_message); - return ERROR; - } - - if (ob->spa_domain != NULL) - { - domain = CS expand_string(ob->spa_domain); - if (domain == NULL) - { - if (expand_string_forcedfail) return CANCELLED; - string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " - "authenticator: %s", ob->spa_domain, ablock->name, - expand_string_message); - return ERROR; - } - } - - /* Original code */ - - if (smtp_write_command(outblock, FALSE, "AUTH %s\r\n", - ablock->public_name) < 0) - return FAIL_SEND; - - /* wait for the 3XX OK message */ - if (!smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout)) - return FAIL; - - DSPA("\n\n%s authenticator: using domain %s\n\n", - ablock->name, domain); - - spa_build_auth_request (&request, CS username, domain); - spa_bits_to_base64 (US msgbuf, (unsigned char*)&request, - spa_request_length(&request)); - - DSPA("\n\n%s authenticator: sending request (%s)\n\n", ablock->name, - msgbuf); - - /* send the encrypted password */ - if (smtp_write_command(outblock, FALSE, "%s\r\n", msgbuf) < 0) - return FAIL_SEND; - - /* wait for the auth challenge */ - if (!smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout)) - return FAIL; - - /* convert the challenge into the challenge struct */ - DSPA("\n\n%s authenticator: challenge (%s)\n\n", - ablock->name, buffer + 4); - spa_base64_to_bits ((char *)(&challenge), (const char *)(buffer + 4)); - - spa_build_auth_response (&challenge, &response, - CS username, CS password); - spa_bits_to_base64 (US msgbuf, (unsigned char*)&response, - spa_request_length(&response)); - DSPA("\n\n%s authenticator: challenge response (%s)\n\n", ablock->name, - msgbuf); - - /* send the challenge response */ - if (smtp_write_command(outblock, FALSE, "%s\r\n", msgbuf) < 0) - return FAIL_SEND; - - /* If we receive a success response from the server, authentication - has succeeded. There may be more data to send, but is there any point - in provoking an error here? */ - if (smtp_read_response(inblock, US buffer, buffsize, '2', timeout)) - return OK; - - /* Not a success response. If errno != 0 there is some kind of transmission - error. Otherwise, check the response code in the buffer. If it starts with - '3', more data is expected. */ - if (errno != 0 || buffer[0] != '3') - return FAIL; - - return FAIL; +auth_spa_options_block *ob = + (auth_spa_options_block *)(ablock->options_block); +SPAAuthRequest request; +SPAAuthChallenge challenge; +SPAAuthResponse response; +char msgbuf[2048]; +char *domain = NULL; +char *username, *password; + +/* Code added by PH to expand the options */ + +*buffer = 0; /* Default no message when cancelled */ + +if (!(username = CS expand_string(ob->spa_username))) + { + if (f.expand_string_forcedfail) return CANCELLED; + string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " + "authenticator: %s", ob->spa_username, ablock->name, + expand_string_message); + return ERROR; + } + +if (!(password = CS expand_string(ob->spa_password))) + { + if (f.expand_string_forcedfail) return CANCELLED; + string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " + "authenticator: %s", ob->spa_password, ablock->name, + expand_string_message); + return ERROR; + } + +if (ob->spa_domain) + if (!(domain = CS expand_string(ob->spa_domain))) + { + if (f.expand_string_forcedfail) return CANCELLED; + string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " + "authenticator: %s", ob->spa_domain, ablock->name, + expand_string_message); + return ERROR; + } + +/* Original code */ + +if (smtp_write_command(sx, SCMD_FLUSH, "AUTH %s\r\n", ablock->public_name) < 0) + return FAIL_SEND; + +/* wait for the 3XX OK message */ +if (!smtp_read_response(sx, US buffer, buffsize, '3', timeout)) + return FAIL; + +DSPA("\n\n%s authenticator: using domain %s\n\n", ablock->name, domain); + +spa_build_auth_request(&request, CS username, domain); +spa_bits_to_base64(US msgbuf, US &request, spa_request_length(&request)); + +DSPA("\n\n%s authenticator: sending request (%s)\n\n", ablock->name, msgbuf); + +/* send the encrypted password */ +if (smtp_write_command(sx, SCMD_FLUSH, "%s\r\n", msgbuf) < 0) + return FAIL_SEND; + +/* wait for the auth challenge */ +if (!smtp_read_response(sx, US buffer, buffsize, '3', timeout)) + return FAIL; + +/* convert the challenge into the challenge struct */ +DSPA("\n\n%s authenticator: challenge (%s)\n\n", ablock->name, buffer + 4); +spa_base64_to_bits(CS (&challenge), sizeof(challenge), CCS (buffer + 4)); + +spa_build_auth_response(&challenge, &response, CS username, CS password); +spa_bits_to_base64(US msgbuf, US &response, spa_request_length(&response)); +DSPA("\n\n%s authenticator: challenge response (%s)\n\n", ablock->name, msgbuf); + +/* send the challenge response */ +if (smtp_write_command(sx, SCMD_FLUSH, "%s\r\n", msgbuf) < 0) + return FAIL_SEND; + +/* If we receive a success response from the server, authentication +has succeeded. There may be more data to send, but is there any point +in provoking an error here? */ + +if (smtp_read_response(sx, US buffer, buffsize, '2', timeout)) + return OK; + +/* Not a success response. If errno != 0 there is some kind of transmission +error. Otherwise, check the response code in the buffer. If it starts with +'3', more data is expected. */ + +if (errno != 0 || buffer[0] != '3') + return FAIL; + +return FAIL; } +#endif /*!MACRO_PREDEF*/ /* End of spa.c */