X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/dde3daac46f9cc3b35993e1c9a931b53645f1c1d..f1e05cc79778c693a1a2bad478ced44791922cce:/src/src/auths/heimdal_gssapi.c diff --git a/src/src/auths/heimdal_gssapi.c b/src/src/auths/heimdal_gssapi.c index ef0027484..9021509dd 100644 --- a/src/src/auths/heimdal_gssapi.c +++ b/src/src/auths/heimdal_gssapi.c @@ -7,8 +7,9 @@ /* Copyright (c) Twitter Inc 2012 Author: Phil Pennock */ +/* Copyright (c) Phil Pennock 2012 */ -/* Interface to Heimdal SASL library for GSSAPI authentication. */ +/* Interface to Heimdal library for GSSAPI authentication. */ /* Naming and rationale @@ -33,8 +34,9 @@ Without rename, we could add an option for GS2 support in the future. * heimdal sources and man-pages, plus http://www.h5l.org/manual/ * FreeBSD man-pages (very informative!) * http://www.ggf.org/documents/GFD.24.pdf confirming GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X - semantics, that found by browsing Heimdal source to find how to set the keytab - + semantics, that found by browsing Heimdal source to find how to set the keytab; however, + after multiple attempts I failed to get that to work and instead switched to + gsskrb5_register_acceptor_identity(). */ #include "../exim.h" @@ -50,9 +52,6 @@ static void dummy(int x) { dummy(x-1); } /* for the _init debugging */ #include -/* Because __gss_krb5_register_acceptor_identity_x_oid_desc is internal */ -#include - #include "heimdal_gssapi.h" /* Authenticator-specific options. */ @@ -61,8 +60,6 @@ optionlist auth_heimdal_gssapi_options[] = { (void *)(offsetof(auth_heimdal_gssapi_options_block, server_hostname)) }, { "server_keytab", opt_stringptr, (void *)(offsetof(auth_heimdal_gssapi_options_block, server_keytab)) }, - { "server_realm", opt_stringptr, - (void *)(offsetof(auth_heimdal_gssapi_options_block, server_realm)) }, { "server_service", opt_stringptr, (void *)(offsetof(auth_heimdal_gssapi_options_block, server_service)) } }; @@ -74,17 +71,11 @@ int auth_heimdal_gssapi_options_count = auth_heimdal_gssapi_options_block auth_heimdal_gssapi_option_defaults = { US"$primary_hostname", /* server_hostname */ NULL, /* server_keytab */ - NULL, /* server_realm */ US"smtp", /* server_service */ }; /* "Globals" for managing the heimdal_gssapi interface. */ -/* hack around unavailable __gss_krb5_register_acceptor_identity_x_oid_desc -OID: 1.2.752.43.13.5 -from heimdal lib/gssapi/krb5/external.c */ -gss_OID_desc exim_register_keytab_OID = {6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x05")}; - /* Utility functions */ static void exim_heimdal_error_debug(const char *, krb5_context, krb5_error_code); @@ -103,8 +94,8 @@ static int enable consistency checks to be done, or anything else that needs to be set up. */ -/* Heimdal provides a GSSAPI extension method (via an OID) for setting the -keytab; in the init, we mostly just use raw krb5 methods so that we can report +/* Heimdal provides a GSSAPI extension method for setting the keytab; +in the init, we mostly just use raw krb5 methods so that we can report the keytab contents, for -D+auth debugging. */ void @@ -238,6 +229,7 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) (auth_heimdal_gssapi_options_block *)(ablock->options_block); BOOL handled_empty_ir; uschar *store_reset_point; + uschar *keytab; uschar sasl_config[4]; uschar requested_qop; @@ -260,15 +252,13 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) /* Use a specific keytab, if specified */ if (ob->server_keytab) { - gbufdesc.value = (void *) string_sprintf("file:%s", expand_string(ob->server_keytab)); - gbufdesc.length = strlen(CS gbufdesc.value); - maj_stat = gss_set_sec_context_option(&min_stat, - &gcontext, /* create new security context */ - &exim_register_keytab_OID, /* GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X */ - &gbufdesc); + keytab = expand_string(ob->server_keytab); + maj_stat = gsskrb5_register_acceptor_identity(CCS keytab); if (GSS_ERROR(maj_stat)) return exim_gssapi_error_defer(store_reset_point, maj_stat, min_stat, - "registering keytab \"%s\"", CS gbufdesc.value); + "registering keytab \"%s\"", keytab); + HDEBUG(D_auth) + debug_printf("heimdal: using keytab \"%s\"\n", keytab); } /* Acquire our credentials */ @@ -286,6 +276,8 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) maj_stat = gss_release_name(&min_stat, &gserver); + HDEBUG(D_auth) debug_printf("heimdal: have server credentials.\n"); + /* Loop talking to client */ step = 0; from_client = initial_data; @@ -316,11 +308,13 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) error_out = auth_get_data(&from_client, US"", 0); if (error_out != OK) goto ERROR_OUT; + handled_empty_ir = TRUE; continue; } } /* We should now have the opening data from the client, base64-encoded. */ step += 1; + HDEBUG(D_auth) debug_printf("heimdal: have initial client data\n"); break; case 1: @@ -356,8 +350,12 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) gss_release_buffer(&min_stat, &gbufdesc_out); EmptyBuf(gbufdesc_out); } - if (maj_stat == GSS_S_COMPLETE) + if (maj_stat == GSS_S_COMPLETE) { step += 1; + HDEBUG(D_auth) debug_printf("heimdal: GSS complete\n"); + } else { + HDEBUG(D_auth) debug_printf("heimdal: need more data\n"); + } break; case 2: @@ -367,7 +365,7 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) 0x02 Integrity protection 0x04 Confidentiality protection - The remaining three octets are the maximum buffer size for wrappe + The remaining three octets are the maximum buffer size for wrapped content. */ sasl_config[0] = 0x01; /* Exim does not wrap/unwrap SASL layers after auth */ gbufdesc.value = (void *) sasl_config; @@ -386,6 +384,9 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) error_out = FAIL; goto ERROR_OUT; } + + HDEBUG(D_auth) debug_printf("heimdal SASL: requesting QOP with no security layers\n"); + error_out = auth_get_data(&from_client, gbufdesc_out.value, gbufdesc_out.length); if (error_out != OK) @@ -463,6 +464,12 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) auth_vars[0] = expand_nstring[1] = string_copyn(gbufdesc_out.value, gbufdesc_out.length); + HDEBUG(D_auth) + debug_printf("heimdal SASL: happy with client request\n" + " auth1 (verified GSSAPI display-name): \"%s\"\n" + " auth2 (unverified SASL requested authzid): \"%s\"\n", + auth_vars[0], auth_vars[1]); + step += 1; break;