[164] | 1 | /* This source code was modified by Martin Hedenfalk <mhe@stacken.kth.se> for
|
---|
| 2 | * use in Curl. His latest changes were done 2000-09-18.
|
---|
| 3 | *
|
---|
| 4 | * It has since been patched and modified a lot by Daniel Stenberg
|
---|
| 5 | * <daniel@haxx.se> to make it better applied to curl conditions, and to make
|
---|
| 6 | * it not use globals, pollute name space and more. This source code awaits a
|
---|
| 7 | * rewrite to work around the paragraph 2 in the BSD licenses as explained
|
---|
| 8 | * below.
|
---|
| 9 | *
|
---|
| 10 | * Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan
|
---|
| 11 | * (Royal Institute of Technology, Stockholm, Sweden).
|
---|
| 12 | *
|
---|
| 13 | * Copyright (C) 2001 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
|
---|
| 14 | *
|
---|
| 15 | * All rights reserved.
|
---|
| 16 | *
|
---|
| 17 | * Redistribution and use in source and binary forms, with or without
|
---|
| 18 | * modification, are permitted provided that the following conditions
|
---|
| 19 | * are met:
|
---|
| 20 | *
|
---|
| 21 | * 1. Redistributions of source code must retain the above copyright
|
---|
| 22 | * notice, this list of conditions and the following disclaimer.
|
---|
| 23 | *
|
---|
| 24 | * 2. Redistributions in binary form must reproduce the above copyright
|
---|
| 25 | * notice, this list of conditions and the following disclaimer in the
|
---|
| 26 | * documentation and/or other materials provided with the distribution.
|
---|
| 27 | *
|
---|
| 28 | * 3. Neither the name of the Institute nor the names of its contributors
|
---|
| 29 | * may be used to endorse or promote products derived from this software
|
---|
| 30 | * without specific prior written permission.
|
---|
| 31 | *
|
---|
| 32 | * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
---|
| 33 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
---|
| 34 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
---|
| 35 | * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
---|
| 36 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
---|
| 37 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
---|
| 38 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
---|
| 39 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
---|
| 40 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
---|
| 41 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
---|
| 42 | * SUCH DAMAGE. */
|
---|
| 43 |
|
---|
| 44 | #include "curl_setup.h"
|
---|
| 45 |
|
---|
| 46 | #ifndef CURL_DISABLE_FTP
|
---|
| 47 | #ifdef HAVE_GSSAPI
|
---|
| 48 |
|
---|
| 49 | #ifdef HAVE_NETDB_H
|
---|
| 50 | #include <netdb.h>
|
---|
| 51 | #endif
|
---|
| 52 |
|
---|
| 53 | #ifdef HAVE_LIMITS_H
|
---|
| 54 | #include <limits.h>
|
---|
| 55 | #endif
|
---|
| 56 |
|
---|
| 57 | #include "urldata.h"
|
---|
| 58 | #include "curl_base64.h"
|
---|
| 59 | #include "curl_memory.h"
|
---|
| 60 | #include "curl_sec.h"
|
---|
| 61 | #include "ftp.h"
|
---|
| 62 | #include "sendf.h"
|
---|
| 63 | #include "rawstr.h"
|
---|
| 64 | #include "warnless.h"
|
---|
| 65 |
|
---|
| 66 | /* The last #include file should be: */
|
---|
| 67 | #include "memdebug.h"
|
---|
| 68 |
|
---|
| 69 | static const struct {
|
---|
| 70 | enum protection_level level;
|
---|
| 71 | const char *name;
|
---|
| 72 | } level_names[] = {
|
---|
| 73 | { PROT_CLEAR, "clear" },
|
---|
| 74 | { PROT_SAFE, "safe" },
|
---|
| 75 | { PROT_CONFIDENTIAL, "confidential" },
|
---|
| 76 | { PROT_PRIVATE, "private" }
|
---|
| 77 | };
|
---|
| 78 |
|
---|
| 79 | static enum protection_level
|
---|
| 80 | name_to_level(const char *name)
|
---|
| 81 | {
|
---|
| 82 | int i;
|
---|
| 83 | for(i = 0; i < (int)sizeof(level_names)/(int)sizeof(level_names[0]); i++)
|
---|
| 84 | if(checkprefix(name, level_names[i].name))
|
---|
| 85 | return level_names[i].level;
|
---|
| 86 | return PROT_NONE;
|
---|
| 87 | }
|
---|
| 88 |
|
---|
| 89 | /* Convert a protocol |level| to its char representation.
|
---|
| 90 | We take an int to catch programming mistakes. */
|
---|
| 91 | static char level_to_char(int level) {
|
---|
| 92 | switch(level) {
|
---|
| 93 | case PROT_CLEAR:
|
---|
| 94 | return 'C';
|
---|
| 95 | case PROT_SAFE:
|
---|
| 96 | return 'S';
|
---|
| 97 | case PROT_CONFIDENTIAL:
|
---|
| 98 | return 'E';
|
---|
| 99 | case PROT_PRIVATE:
|
---|
| 100 | return 'P';
|
---|
| 101 | case PROT_CMD:
|
---|
| 102 | /* Fall through */
|
---|
| 103 | default:
|
---|
| 104 | /* Those 2 cases should not be reached! */
|
---|
| 105 | break;
|
---|
| 106 | }
|
---|
| 107 | DEBUGASSERT(0);
|
---|
| 108 | /* Default to the most secure alternative. */
|
---|
| 109 | return 'P';
|
---|
| 110 | }
|
---|
| 111 |
|
---|
| 112 | /* Send an FTP command defined by |message| and the optional arguments. The
|
---|
| 113 | function returns the ftp_code. If an error occurs, -1 is returned. */
|
---|
| 114 | static int ftp_send_command(struct connectdata *conn, const char *message, ...)
|
---|
| 115 | {
|
---|
| 116 | int ftp_code;
|
---|
| 117 | ssize_t nread=0;
|
---|
| 118 | va_list args;
|
---|
| 119 | char print_buffer[50];
|
---|
| 120 |
|
---|
| 121 | va_start(args, message);
|
---|
| 122 | vsnprintf(print_buffer, sizeof(print_buffer), message, args);
|
---|
| 123 | va_end(args);
|
---|
| 124 |
|
---|
| 125 | if(Curl_ftpsendf(conn, print_buffer)) {
|
---|
| 126 | ftp_code = -1;
|
---|
| 127 | }
|
---|
| 128 | else {
|
---|
| 129 | if(Curl_GetFTPResponse(&nread, conn, &ftp_code))
|
---|
| 130 | ftp_code = -1;
|
---|
| 131 | }
|
---|
| 132 |
|
---|
| 133 | (void)nread; /* Unused */
|
---|
| 134 | return ftp_code;
|
---|
| 135 | }
|
---|
| 136 |
|
---|
| 137 | /* Read |len| from the socket |fd| and store it in |to|. Return a CURLcode
|
---|
| 138 | saying whether an error occurred or CURLE_OK if |len| was read. */
|
---|
| 139 | static CURLcode
|
---|
| 140 | socket_read(curl_socket_t fd, void *to, size_t len)
|
---|
| 141 | {
|
---|
| 142 | char *to_p = to;
|
---|
| 143 | CURLcode result;
|
---|
| 144 | ssize_t nread;
|
---|
| 145 |
|
---|
| 146 | while(len > 0) {
|
---|
| 147 | result = Curl_read_plain(fd, to_p, len, &nread);
|
---|
| 148 | if(!result) {
|
---|
| 149 | len -= nread;
|
---|
| 150 | to_p += nread;
|
---|
| 151 | }
|
---|
| 152 | else {
|
---|
| 153 | /* FIXME: We are doing a busy wait */
|
---|
| 154 | if(result == CURLE_AGAIN)
|
---|
| 155 | continue;
|
---|
| 156 | return result;
|
---|
| 157 | }
|
---|
| 158 | }
|
---|
| 159 | return CURLE_OK;
|
---|
| 160 | }
|
---|
| 161 |
|
---|
| 162 |
|
---|
| 163 | /* Write |len| bytes from the buffer |to| to the socket |fd|. Return a
|
---|
| 164 | CURLcode saying whether an error occurred or CURLE_OK if |len| was
|
---|
| 165 | written. */
|
---|
| 166 | static CURLcode
|
---|
| 167 | socket_write(struct connectdata *conn, curl_socket_t fd, const void *to,
|
---|
| 168 | size_t len)
|
---|
| 169 | {
|
---|
| 170 | const char *to_p = to;
|
---|
| 171 | CURLcode result;
|
---|
| 172 | ssize_t written;
|
---|
| 173 |
|
---|
| 174 | while(len > 0) {
|
---|
| 175 | result = Curl_write_plain(conn, fd, to_p, len, &written);
|
---|
| 176 | if(!result) {
|
---|
| 177 | len -= written;
|
---|
| 178 | to_p += written;
|
---|
| 179 | }
|
---|
| 180 | else {
|
---|
| 181 | /* FIXME: We are doing a busy wait */
|
---|
| 182 | if(result == CURLE_AGAIN)
|
---|
| 183 | continue;
|
---|
| 184 | return result;
|
---|
| 185 | }
|
---|
| 186 | }
|
---|
| 187 | return CURLE_OK;
|
---|
| 188 | }
|
---|
| 189 |
|
---|
| 190 | static CURLcode read_data(struct connectdata *conn,
|
---|
| 191 | curl_socket_t fd,
|
---|
| 192 | struct krb5buffer *buf)
|
---|
| 193 | {
|
---|
| 194 | int len;
|
---|
| 195 | void* tmp;
|
---|
| 196 | CURLcode result;
|
---|
| 197 |
|
---|
| 198 | result = socket_read(fd, &len, sizeof(len));
|
---|
| 199 | if(result)
|
---|
| 200 | return result;
|
---|
| 201 |
|
---|
| 202 | len = ntohl(len);
|
---|
| 203 | tmp = realloc(buf->data, len);
|
---|
| 204 | if(tmp == NULL)
|
---|
| 205 | return CURLE_OUT_OF_MEMORY;
|
---|
| 206 |
|
---|
| 207 | buf->data = tmp;
|
---|
| 208 | result = socket_read(fd, buf->data, len);
|
---|
| 209 | if(result)
|
---|
| 210 | return result;
|
---|
| 211 | buf->size = conn->mech->decode(conn->app_data, buf->data, len,
|
---|
| 212 | conn->data_prot, conn);
|
---|
| 213 | buf->index = 0;
|
---|
| 214 | return CURLE_OK;
|
---|
| 215 | }
|
---|
| 216 |
|
---|
| 217 | static size_t
|
---|
| 218 | buffer_read(struct krb5buffer *buf, void *data, size_t len)
|
---|
| 219 | {
|
---|
| 220 | if(buf->size - buf->index < len)
|
---|
| 221 | len = buf->size - buf->index;
|
---|
| 222 | memcpy(data, (char*)buf->data + buf->index, len);
|
---|
| 223 | buf->index += len;
|
---|
| 224 | return len;
|
---|
| 225 | }
|
---|
| 226 |
|
---|
| 227 | /* Matches Curl_recv signature */
|
---|
| 228 | static ssize_t sec_recv(struct connectdata *conn, int sockindex,
|
---|
| 229 | char *buffer, size_t len, CURLcode *err)
|
---|
| 230 | {
|
---|
| 231 | size_t bytes_read;
|
---|
| 232 | size_t total_read = 0;
|
---|
| 233 | curl_socket_t fd = conn->sock[sockindex];
|
---|
| 234 |
|
---|
| 235 | *err = CURLE_OK;
|
---|
| 236 |
|
---|
| 237 | /* Handle clear text response. */
|
---|
| 238 | if(conn->sec_complete == 0 || conn->data_prot == PROT_CLEAR)
|
---|
| 239 | return read(fd, buffer, len);
|
---|
| 240 |
|
---|
| 241 | if(conn->in_buffer.eof_flag) {
|
---|
| 242 | conn->in_buffer.eof_flag = 0;
|
---|
| 243 | return 0;
|
---|
| 244 | }
|
---|
| 245 |
|
---|
| 246 | bytes_read = buffer_read(&conn->in_buffer, buffer, len);
|
---|
| 247 | len -= bytes_read;
|
---|
| 248 | total_read += bytes_read;
|
---|
| 249 | buffer += bytes_read;
|
---|
| 250 |
|
---|
| 251 | while(len > 0) {
|
---|
| 252 | if(read_data(conn, fd, &conn->in_buffer))
|
---|
| 253 | return -1;
|
---|
| 254 | if(conn->in_buffer.size == 0) {
|
---|
| 255 | if(bytes_read > 0)
|
---|
| 256 | conn->in_buffer.eof_flag = 1;
|
---|
| 257 | return bytes_read;
|
---|
| 258 | }
|
---|
| 259 | bytes_read = buffer_read(&conn->in_buffer, buffer, len);
|
---|
| 260 | len -= bytes_read;
|
---|
| 261 | total_read += bytes_read;
|
---|
| 262 | buffer += bytes_read;
|
---|
| 263 | }
|
---|
| 264 | /* FIXME: Check for overflow */
|
---|
| 265 | return total_read;
|
---|
| 266 | }
|
---|
| 267 |
|
---|
| 268 | /* Send |length| bytes from |from| to the |fd| socket taking care of encoding
|
---|
| 269 | and negociating with the server. |from| can be NULL. */
|
---|
| 270 | /* FIXME: We don't check for errors nor report any! */
|
---|
| 271 | static void do_sec_send(struct connectdata *conn, curl_socket_t fd,
|
---|
| 272 | const char *from, int length)
|
---|
| 273 | {
|
---|
| 274 | int bytes, htonl_bytes; /* 32-bit integers for htonl */
|
---|
| 275 | char *buffer = NULL;
|
---|
| 276 | char *cmd_buffer;
|
---|
| 277 | size_t cmd_size = 0;
|
---|
| 278 | CURLcode error;
|
---|
| 279 | enum protection_level prot_level = conn->data_prot;
|
---|
| 280 | bool iscmd = (prot_level == PROT_CMD)?TRUE:FALSE;
|
---|
| 281 |
|
---|
| 282 | DEBUGASSERT(prot_level > PROT_NONE && prot_level < PROT_LAST);
|
---|
| 283 |
|
---|
| 284 | if(iscmd) {
|
---|
| 285 | if(!strncmp(from, "PASS ", 5) || !strncmp(from, "ACCT ", 5))
|
---|
| 286 | prot_level = PROT_PRIVATE;
|
---|
| 287 | else
|
---|
| 288 | prot_level = conn->command_prot;
|
---|
| 289 | }
|
---|
| 290 | bytes = conn->mech->encode(conn->app_data, from, length, prot_level,
|
---|
| 291 | (void**)&buffer);
|
---|
| 292 | if(!buffer || bytes <= 0)
|
---|
| 293 | return; /* error */
|
---|
| 294 |
|
---|
| 295 | if(iscmd) {
|
---|
| 296 | error = Curl_base64_encode(conn->data, buffer, curlx_sitouz(bytes),
|
---|
| 297 | &cmd_buffer, &cmd_size);
|
---|
| 298 | if(error) {
|
---|
| 299 | free(buffer);
|
---|
| 300 | return; /* error */
|
---|
| 301 | }
|
---|
| 302 | if(cmd_size > 0) {
|
---|
| 303 | static const char *enc = "ENC ";
|
---|
| 304 | static const char *mic = "MIC ";
|
---|
| 305 | if(prot_level == PROT_PRIVATE)
|
---|
| 306 | socket_write(conn, fd, enc, 4);
|
---|
| 307 | else
|
---|
| 308 | socket_write(conn, fd, mic, 4);
|
---|
| 309 |
|
---|
| 310 | socket_write(conn, fd, cmd_buffer, cmd_size);
|
---|
| 311 | socket_write(conn, fd, "\r\n", 2);
|
---|
| 312 | infof(conn->data, "Send: %s%s\n", prot_level == PROT_PRIVATE?enc:mic,
|
---|
| 313 | cmd_buffer);
|
---|
| 314 | free(cmd_buffer);
|
---|
| 315 | }
|
---|
| 316 | }
|
---|
| 317 | else {
|
---|
| 318 | htonl_bytes = htonl(bytes);
|
---|
| 319 | socket_write(conn, fd, &htonl_bytes, sizeof(htonl_bytes));
|
---|
| 320 | socket_write(conn, fd, buffer, curlx_sitouz(bytes));
|
---|
| 321 | }
|
---|
| 322 | free(buffer);
|
---|
| 323 | }
|
---|
| 324 |
|
---|
| 325 | static ssize_t sec_write(struct connectdata *conn, curl_socket_t fd,
|
---|
| 326 | const char *buffer, size_t length)
|
---|
| 327 | {
|
---|
| 328 | ssize_t tx = 0, len = conn->buffer_size;
|
---|
| 329 |
|
---|
| 330 | len -= conn->mech->overhead(conn->app_data, conn->data_prot,
|
---|
| 331 | curlx_sztosi(len));
|
---|
| 332 | if(len <= 0)
|
---|
| 333 | len = length;
|
---|
| 334 | while(length) {
|
---|
| 335 | if(length < (size_t)len)
|
---|
| 336 | len = length;
|
---|
| 337 |
|
---|
| 338 | do_sec_send(conn, fd, buffer, curlx_sztosi(len));
|
---|
| 339 | length -= len;
|
---|
| 340 | buffer += len;
|
---|
| 341 | tx += len;
|
---|
| 342 | }
|
---|
| 343 | return tx;
|
---|
| 344 | }
|
---|
| 345 |
|
---|
| 346 | /* Matches Curl_send signature */
|
---|
| 347 | static ssize_t sec_send(struct connectdata *conn, int sockindex,
|
---|
| 348 | const void *buffer, size_t len, CURLcode *err)
|
---|
| 349 | {
|
---|
| 350 | curl_socket_t fd = conn->sock[sockindex];
|
---|
| 351 | *err = CURLE_OK;
|
---|
| 352 | return sec_write(conn, fd, buffer, len);
|
---|
| 353 | }
|
---|
| 354 |
|
---|
| 355 | int Curl_sec_read_msg(struct connectdata *conn, char *buffer,
|
---|
| 356 | enum protection_level level)
|
---|
| 357 | {
|
---|
| 358 | /* decoded_len should be size_t or ssize_t but conn->mech->decode returns an
|
---|
| 359 | int */
|
---|
| 360 | int decoded_len;
|
---|
| 361 | char *buf;
|
---|
| 362 | int ret_code = 0;
|
---|
| 363 | size_t decoded_sz = 0;
|
---|
| 364 | CURLcode error;
|
---|
| 365 |
|
---|
| 366 | DEBUGASSERT(level > PROT_NONE && level < PROT_LAST);
|
---|
| 367 |
|
---|
| 368 | error = Curl_base64_decode(buffer + 4, (unsigned char **)&buf, &decoded_sz);
|
---|
| 369 | if(error || decoded_sz == 0)
|
---|
| 370 | return -1;
|
---|
| 371 |
|
---|
| 372 | if(decoded_sz > (size_t)INT_MAX) {
|
---|
| 373 | free(buf);
|
---|
| 374 | return -1;
|
---|
| 375 | }
|
---|
| 376 | decoded_len = curlx_uztosi(decoded_sz);
|
---|
| 377 |
|
---|
| 378 | decoded_len = conn->mech->decode(conn->app_data, buf, decoded_len,
|
---|
| 379 | level, conn);
|
---|
| 380 | if(decoded_len <= 0) {
|
---|
| 381 | free(buf);
|
---|
| 382 | return -1;
|
---|
| 383 | }
|
---|
| 384 |
|
---|
| 385 | if(conn->data->set.verbose) {
|
---|
| 386 | buf[decoded_len] = '\n';
|
---|
| 387 | Curl_debug(conn->data, CURLINFO_HEADER_IN, buf, decoded_len + 1, conn);
|
---|
| 388 | }
|
---|
| 389 |
|
---|
| 390 | buf[decoded_len] = '\0';
|
---|
| 391 | if(decoded_len <= 3)
|
---|
| 392 | /* suspiciously short */
|
---|
| 393 | return 0;
|
---|
| 394 |
|
---|
| 395 | if(buf[3] != '-')
|
---|
| 396 | /* safe to ignore return code */
|
---|
| 397 | (void)sscanf(buf, "%d", &ret_code);
|
---|
| 398 |
|
---|
| 399 | if(buf[decoded_len - 1] == '\n')
|
---|
| 400 | buf[decoded_len - 1] = '\0';
|
---|
| 401 | /* FIXME: Is |buffer| length always greater than |decoded_len|? */
|
---|
| 402 | strcpy(buffer, buf);
|
---|
| 403 | free(buf);
|
---|
| 404 | return ret_code;
|
---|
| 405 | }
|
---|
| 406 |
|
---|
| 407 | /* FIXME: The error code returned here is never checked. */
|
---|
| 408 | static int sec_set_protection_level(struct connectdata *conn)
|
---|
| 409 | {
|
---|
| 410 | int code;
|
---|
| 411 | char* pbsz;
|
---|
| 412 | static unsigned int buffer_size = 1 << 20; /* 1048576 */
|
---|
| 413 | enum protection_level level = conn->request_data_prot;
|
---|
| 414 |
|
---|
| 415 | DEBUGASSERT(level > PROT_NONE && level < PROT_LAST);
|
---|
| 416 |
|
---|
| 417 | if(!conn->sec_complete) {
|
---|
| 418 | infof(conn->data, "Trying to change the protection level after the"
|
---|
| 419 | "completion of the data exchange.\n");
|
---|
| 420 | return -1;
|
---|
| 421 | }
|
---|
| 422 |
|
---|
| 423 | /* Bail out if we try to set up the same level */
|
---|
| 424 | if(conn->data_prot == level)
|
---|
| 425 | return 0;
|
---|
| 426 |
|
---|
| 427 | if(level) {
|
---|
| 428 | code = ftp_send_command(conn, "PBSZ %u", buffer_size);
|
---|
| 429 | if(code < 0)
|
---|
| 430 | return -1;
|
---|
| 431 |
|
---|
| 432 | if(code/100 != 2) {
|
---|
| 433 | failf(conn->data, "Failed to set the protection's buffer size.");
|
---|
| 434 | return -1;
|
---|
| 435 | }
|
---|
| 436 | conn->buffer_size = buffer_size;
|
---|
| 437 |
|
---|
| 438 | pbsz = strstr(conn->data->state.buffer, "PBSZ=");
|
---|
| 439 | if(pbsz) {
|
---|
| 440 | /* ignore return code, use default value if it fails */
|
---|
| 441 | (void)sscanf(pbsz, "PBSZ=%u", &buffer_size);
|
---|
| 442 | if(buffer_size < conn->buffer_size)
|
---|
| 443 | conn->buffer_size = buffer_size;
|
---|
| 444 | }
|
---|
| 445 | }
|
---|
| 446 |
|
---|
| 447 | /* Now try to negiociate the protection level. */
|
---|
| 448 | code = ftp_send_command(conn, "PROT %c", level_to_char(level));
|
---|
| 449 |
|
---|
| 450 | if(code < 0)
|
---|
| 451 | return -1;
|
---|
| 452 |
|
---|
| 453 | if(code/100 != 2) {
|
---|
| 454 | failf(conn->data, "Failed to set the protection level.");
|
---|
| 455 | return -1;
|
---|
| 456 | }
|
---|
| 457 |
|
---|
| 458 | conn->data_prot = level;
|
---|
| 459 | if(level == PROT_PRIVATE)
|
---|
| 460 | conn->command_prot = level;
|
---|
| 461 |
|
---|
| 462 | return 0;
|
---|
| 463 | }
|
---|
| 464 |
|
---|
| 465 | int
|
---|
| 466 | Curl_sec_request_prot(struct connectdata *conn, const char *level)
|
---|
| 467 | {
|
---|
| 468 | enum protection_level l = name_to_level(level);
|
---|
| 469 | if(l == PROT_NONE)
|
---|
| 470 | return -1;
|
---|
| 471 | DEBUGASSERT(l > PROT_NONE && l < PROT_LAST);
|
---|
| 472 | conn->request_data_prot = l;
|
---|
| 473 | return 0;
|
---|
| 474 | }
|
---|
| 475 |
|
---|
| 476 | static CURLcode choose_mech(struct connectdata *conn)
|
---|
| 477 | {
|
---|
| 478 | int ret;
|
---|
| 479 | struct SessionHandle *data = conn->data;
|
---|
| 480 | void *tmp_allocation;
|
---|
| 481 | const struct Curl_sec_client_mech *mech = &Curl_krb5_client_mech;
|
---|
| 482 |
|
---|
| 483 | tmp_allocation = realloc(conn->app_data, mech->size);
|
---|
| 484 | if(tmp_allocation == NULL) {
|
---|
| 485 | failf(data, "Failed realloc of size %u", mech->size);
|
---|
| 486 | mech = NULL;
|
---|
| 487 | return CURLE_OUT_OF_MEMORY;
|
---|
| 488 | }
|
---|
| 489 | conn->app_data = tmp_allocation;
|
---|
| 490 |
|
---|
| 491 | if(mech->init) {
|
---|
| 492 | ret = mech->init(conn->app_data);
|
---|
| 493 | if(ret) {
|
---|
| 494 | infof(data, "Failed initialization for %s. Skipping it.\n",
|
---|
| 495 | mech->name);
|
---|
| 496 | return CURLE_FAILED_INIT;
|
---|
| 497 | }
|
---|
| 498 | }
|
---|
| 499 |
|
---|
| 500 | infof(data, "Trying mechanism %s...\n", mech->name);
|
---|
| 501 | ret = ftp_send_command(conn, "AUTH %s", mech->name);
|
---|
| 502 | if(ret < 0)
|
---|
| 503 | /* FIXME: This error is too generic but it is OK for now. */
|
---|
| 504 | return CURLE_COULDNT_CONNECT;
|
---|
| 505 |
|
---|
| 506 | if(ret/100 != 3) {
|
---|
| 507 | switch(ret) {
|
---|
| 508 | case 504:
|
---|
| 509 | infof(data, "Mechanism %s is not supported by the server (server "
|
---|
| 510 | "returned ftp code: 504).\n", mech->name);
|
---|
| 511 | break;
|
---|
| 512 | case 534:
|
---|
| 513 | infof(data, "Mechanism %s was rejected by the server (server returned "
|
---|
| 514 | "ftp code: 534).\n", mech->name);
|
---|
| 515 | break;
|
---|
| 516 | default:
|
---|
| 517 | if(ret/100 == 5) {
|
---|
| 518 | infof(data, "server does not support the security extensions\n");
|
---|
| 519 | return CURLE_USE_SSL_FAILED;
|
---|
| 520 | }
|
---|
| 521 | break;
|
---|
| 522 | }
|
---|
| 523 | return CURLE_LOGIN_DENIED;
|
---|
| 524 | }
|
---|
| 525 |
|
---|
| 526 | /* Authenticate */
|
---|
| 527 | ret = mech->auth(conn->app_data, conn);
|
---|
| 528 |
|
---|
| 529 | if(ret != AUTH_CONTINUE) {
|
---|
| 530 | if(ret != AUTH_OK) {
|
---|
| 531 | /* Mechanism has dumped the error to stderr, don't error here. */
|
---|
| 532 | return -1;
|
---|
| 533 | }
|
---|
| 534 | DEBUGASSERT(ret == AUTH_OK);
|
---|
| 535 |
|
---|
| 536 | conn->mech = mech;
|
---|
| 537 | conn->sec_complete = 1;
|
---|
| 538 | conn->recv[FIRSTSOCKET] = sec_recv;
|
---|
| 539 | conn->send[FIRSTSOCKET] = sec_send;
|
---|
| 540 | conn->recv[SECONDARYSOCKET] = sec_recv;
|
---|
| 541 | conn->send[SECONDARYSOCKET] = sec_send;
|
---|
| 542 | conn->command_prot = PROT_SAFE;
|
---|
| 543 | /* Set the requested protection level */
|
---|
| 544 | /* BLOCKING */
|
---|
| 545 | (void)sec_set_protection_level(conn);
|
---|
| 546 | }
|
---|
| 547 |
|
---|
| 548 | return CURLE_OK;
|
---|
| 549 | }
|
---|
| 550 |
|
---|
| 551 | CURLcode
|
---|
| 552 | Curl_sec_login(struct connectdata *conn)
|
---|
| 553 | {
|
---|
| 554 | return choose_mech(conn);
|
---|
| 555 | }
|
---|
| 556 |
|
---|
| 557 |
|
---|
| 558 | void
|
---|
| 559 | Curl_sec_end(struct connectdata *conn)
|
---|
| 560 | {
|
---|
| 561 | if(conn->mech != NULL && conn->mech->end)
|
---|
| 562 | conn->mech->end(conn->app_data);
|
---|
| 563 | free(conn->app_data);
|
---|
| 564 | conn->app_data = NULL;
|
---|
| 565 | if(conn->in_buffer.data) {
|
---|
| 566 | free(conn->in_buffer.data);
|
---|
| 567 | conn->in_buffer.data = NULL;
|
---|
| 568 | conn->in_buffer.size = 0;
|
---|
| 569 | conn->in_buffer.index = 0;
|
---|
| 570 | /* FIXME: Is this really needed? */
|
---|
| 571 | conn->in_buffer.eof_flag = 0;
|
---|
| 572 | }
|
---|
| 573 | conn->sec_complete = 0;
|
---|
| 574 | conn->data_prot = PROT_CLEAR;
|
---|
| 575 | conn->mech = NULL;
|
---|
| 576 | }
|
---|
| 577 |
|
---|
| 578 | #endif /* HAVE_GSSAPI */
|
---|
| 579 |
|
---|
| 580 | #endif /* CURL_DISABLE_FTP */
|
---|