* rewrite to work around the paragraph 2 in the BSD licenses as explained
* below.
*
- * Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1998, 1999, 2013 Kungliga Tekniska Högskolan
* (Royal Institute of Technology, Stockholm, Sweden).
*
- * Copyright (C) 2001 - 2010, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 2001 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* All rights reserved.
*
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE. */
-#include "setup.h"
+#include "curl_setup.h"
#ifndef CURL_DISABLE_FTP
-#if defined(HAVE_KRB4) || defined(HAVE_GSSAPI)
-
-#include <stdarg.h>
-#include <string.h>
+#ifdef HAVE_GSSAPI
#ifdef HAVE_NETDB_H
#include <netdb.h>
#endif
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
+#ifdef HAVE_LIMITS_H
+#include <limits.h>
#endif
#include "urldata.h"
#include "curl_base64.h"
#include "curl_memory.h"
-#include "krb4.h"
+#include "curl_sec.h"
#include "ftp.h"
#include "sendf.h"
#include "rawstr.h"
+#include "warnless.h"
/* The last #include file should be: */
#include "memdebug.h"
enum protection_level level;
const char *name;
} level_names[] = {
- { prot_clear, "clear" },
- { prot_safe, "safe" },
- { prot_confidential, "confidential" },
- { prot_private, "private" }
+ { PROT_CLEAR, "clear" },
+ { PROT_SAFE, "safe" },
+ { PROT_CONFIDENTIAL, "confidential" },
+ { PROT_PRIVATE, "private" }
};
static enum protection_level
for(i = 0; i < (int)sizeof(level_names)/(int)sizeof(level_names[0]); i++)
if(checkprefix(name, level_names[i].name))
return level_names[i].level;
- return (enum protection_level)-1;
+ return PROT_NONE;
}
/* Convert a protocol |level| to its char representation.
We take an int to catch programming mistakes. */
static char level_to_char(int level) {
switch(level) {
- case prot_clear:
+ case PROT_CLEAR:
return 'C';
- case prot_safe:
+ case PROT_SAFE:
return 'S';
- case prot_confidential:
+ case PROT_CONFIDENTIAL:
return 'E';
- case prot_private:
+ case PROT_PRIVATE:
return 'P';
- case prot_cmd:
+ case PROT_CMD:
/* Fall through */
default:
/* Those 2 cases should not be reached! */
}
static const struct Curl_sec_client_mech * const mechs[] = {
-#if defined(HAVE_GSSAPI)
+#ifdef HAVE_GSSAPI
&Curl_krb5_client_mech,
#endif
-#if defined(HAVE_KRB4)
- &Curl_krb4_client_mech,
-#endif
NULL
};
}
/* Read |len| from the socket |fd| and store it in |to|. Return a CURLcode
- saying whether an error occured or CURLE_OK if |len| was read. */
+ saying whether an error occurred or CURLE_OK if |len| was read. */
static CURLcode
socket_read(curl_socket_t fd, void *to, size_t len)
{
/* Write |len| bytes from the buffer |to| to the socket |fd|. Return a
- CURLcode saying whether an error occured or CURLE_OK if |len| was
+ CURLcode saying whether an error occurred or CURLE_OK if |len| was
written. */
static CURLcode
socket_write(struct connectdata *conn, curl_socket_t fd, const void *to,
static CURLcode read_data(struct connectdata *conn,
curl_socket_t fd,
- struct krb4buffer *buf)
+ struct krb5buffer *buf)
{
int len;
void* tmp;
CURLcode ret;
ret = socket_read(fd, &len, sizeof(len));
- if (ret != CURLE_OK)
+ if(ret != CURLE_OK)
return ret;
len = ntohl(len);
tmp = realloc(buf->data, len);
- if (tmp == NULL)
+ if(tmp == NULL)
return CURLE_OUT_OF_MEMORY;
+ buf->data = tmp;
ret = socket_read(fd, buf->data, len);
- if (ret != CURLE_OK)
+ if(ret != CURLE_OK)
return ret;
buf->size = conn->mech->decode(conn->app_data, buf->data, len,
conn->data_prot, conn);
}
static size_t
-buffer_read(struct krb4buffer *buf, void *data, size_t len)
+buffer_read(struct krb5buffer *buf, void *data, size_t len)
{
if(buf->size - buf->index < len)
len = buf->size - buf->index;
*err = CURLE_OK;
+ /* Handle clear text response. */
+ if(conn->sec_complete == 0 || conn->data_prot == PROT_CLEAR)
+ return read(fd, buffer, len);
+
if(conn->in_buffer.eof_flag) {
conn->in_buffer.eof_flag = 0;
return 0;
static void do_sec_send(struct connectdata *conn, curl_socket_t fd,
const char *from, int length)
{
- size_t bytes;
- size_t htonl_bytes;
- char *buffer;
+ int bytes, htonl_bytes; /* 32-bit integers for htonl */
+ char *buffer = NULL;
char *cmd_buffer;
+ size_t cmd_size = 0;
+ CURLcode error;
enum protection_level prot_level = conn->data_prot;
- bool iscmd = prot_level == prot_cmd;
+ bool iscmd = (prot_level == PROT_CMD)?TRUE:FALSE;
+
+ DEBUGASSERT(prot_level > PROT_NONE && prot_level < PROT_LAST);
if(iscmd) {
if(!strncmp(from, "PASS ", 5) || !strncmp(from, "ACCT ", 5))
- prot_level = prot_private;
+ prot_level = PROT_PRIVATE;
else
prot_level = conn->command_prot;
}
bytes = conn->mech->encode(conn->app_data, from, length, prot_level,
(void**)&buffer, conn);
+ if(!buffer || bytes <= 0)
+ return; /* error */
+
if(iscmd) {
- bytes = Curl_base64_encode(conn->data, buffer, bytes, &cmd_buffer);
- if(bytes > 0) {
+ error = Curl_base64_encode(conn->data, buffer, curlx_sitouz(bytes),
+ &cmd_buffer, &cmd_size);
+ if(error) {
+ free(buffer);
+ return; /* error */
+ }
+ if(cmd_size > 0) {
static const char *enc = "ENC ";
static const char *mic = "MIC ";
- if(prot_level == prot_private)
+ if(prot_level == PROT_PRIVATE)
socket_write(conn, fd, enc, 4);
else
socket_write(conn, fd, mic, 4);
- socket_write(conn, fd, cmd_buffer, bytes);
+ socket_write(conn, fd, cmd_buffer, cmd_size);
socket_write(conn, fd, "\r\n", 2);
- infof(conn->data, "Send: %s%s", prot_level == prot_private?enc:mic,
+ infof(conn->data, "Send: %s%s\n", prot_level == PROT_PRIVATE?enc:mic,
cmd_buffer);
free(cmd_buffer);
}
else {
htonl_bytes = htonl(bytes);
socket_write(conn, fd, &htonl_bytes, sizeof(htonl_bytes));
- socket_write(conn, fd, buffer, bytes);
+ socket_write(conn, fd, buffer, curlx_sitouz(bytes));
}
free(buffer);
}
const char *buffer, size_t length)
{
/* FIXME: Check for overflow */
- ssize_t len = conn->buffer_size;
- int tx = 0;
+ ssize_t tx = 0, len = conn->buffer_size;
- len -= conn->mech->overhead(conn->app_data, conn->data_prot, len);
+ len -= conn->mech->overhead(conn->app_data, conn->data_prot,
+ curlx_sztosi(len));
if(len <= 0)
len = length;
while(length) {
/* FIXME: Check for overflow. */
len = length;
}
- do_sec_send(conn, fd, buffer, len);
+ do_sec_send(conn, fd, buffer, curlx_sztosi(len));
length -= len;
buffer += len;
tx += len;
return tx;
}
-/* FIXME: fd should be a curl_socket_t */
-int Curl_sec_fflush_fd(struct connectdata *conn, int fd)
-{
- if(conn->data_prot == prot_clear)
- return 0;
-
- /* Force a flush by trying to send no data */
- do_sec_send(conn, fd, NULL, 0);
- return 0;
-}
-
/* Matches Curl_send signature */
static ssize_t sec_send(struct connectdata *conn, int sockindex,
const void *buffer, size_t len, CURLcode *err)
return sec_write(conn, fd, buffer, len);
}
-/* FIXME: |level| should not be an int but a struct protection_level */
-int Curl_sec_read_msg(struct connectdata *conn, char *buffer, int level)
+int Curl_sec_read_msg(struct connectdata *conn, char *buffer,
+ enum protection_level level)
{
/* decoded_len should be size_t or ssize_t but conn->mech->decode returns an
int */
int decoded_len;
char *buf;
int ret_code;
+ size_t decoded_sz = 0;
+ CURLcode error;
- decoded_len = Curl_base64_decode(buffer + 4, (unsigned char **)&buf);
- if(decoded_len <= 0) {
+ DEBUGASSERT(level > PROT_NONE && level < PROT_LAST);
+
+ error = Curl_base64_decode(buffer + 4, (unsigned char **)&buf, &decoded_sz);
+ if(error || decoded_sz == 0)
+ return -1;
+
+ if(decoded_sz > (size_t)INT_MAX) {
free(buf);
return -1;
}
+ decoded_len = curlx_uztosi(decoded_sz);
decoded_len = conn->mech->decode(conn->app_data, buf, decoded_len,
level, conn);
return ret_code;
}
-enum protection_level
-Curl_set_command_prot(struct connectdata *conn, enum protection_level level)
-{
- enum protection_level old = conn->command_prot;
- conn->command_prot = level;
- return old;
-}
-
/* FIXME: The error code returned here is never checked. */
-int Curl_sec_set_protection_level(struct connectdata *conn)
+static int sec_set_protection_level(struct connectdata *conn)
{
int code;
char* pbsz;
static unsigned int buffer_size = 1 << 20; /* 1048576 */
enum protection_level level = conn->request_data_prot;
+ DEBUGASSERT(level > PROT_NONE && level < PROT_LAST);
+
if(!conn->sec_complete) {
infof(conn->data, "Trying to change the protection level after the"
- "completion of the data exchange.");
+ "completion of the data exchange.\n");
return -1;
}
return 0;
if(level) {
- code = ftp_send_command(conn, "PSBZ %u", buffer_size);
+ code = ftp_send_command(conn, "PBSZ %u", buffer_size);
if(code < 0)
return -1;
}
conn->data_prot = level;
- if(level == prot_private)
+ if(level == PROT_PRIVATE)
conn->command_prot = level;
return 0;
int
Curl_sec_request_prot(struct connectdata *conn, const char *level)
{
- int l = name_to_level(level);
- if(l == -1)
+ enum protection_level l = name_to_level(level);
+ if(l == PROT_NONE)
return -1;
- conn->request_data_prot = (enum protection_level)l;
+ DEBUGASSERT(l > PROT_NONE && l < PROT_LAST);
+ conn->request_data_prot = l;
return 0;
}
/* We have no mechanism with a NULL name but keep this check */
DEBUGASSERT(mech_name != NULL);
if(mech_name == NULL) {
- infof(data, "Skipping mechanism with empty name (%p)", mech);
+ infof(data, "Skipping mechanism with empty name (%p)\n", (void *)mech);
continue;
}
tmp_allocation = realloc(conn->app_data, (*mech)->size);
conn->app_data = tmp_allocation;
if((*mech)->init) {
- ret = (*mech)->init(conn);
+ ret = (*mech)->init(conn->app_data);
if(ret != 0) {
- infof(data, "Failed initialization for %s. Skipping it.", mech_name);
+ infof(data, "Failed initialization for %s. Skipping it.\n", mech_name);
continue;
}
}
- infof(data, "Trying mechanism %s...", mech_name);
+ infof(data, "Trying mechanism %s...\n", mech_name);
ret = ftp_send_command(conn, "AUTH %s", mech_name);
if(ret < 0)
/* FIXME: This error is too generic but it is OK for now. */
switch(ret) {
case 504:
infof(data, "Mechanism %s is not supported by the server (server "
- "returned ftp code: 504).", mech_name);
+ "returned ftp code: 504).\n", mech_name);
break;
case 534:
infof(data, "Mechanism %s was rejected by the server (server returned "
- "ftp code: 534).", mech_name);
+ "ftp code: 534).\n", mech_name);
break;
default:
if(ret/100 == 5) {
- infof(data, "The server does not support the security extensions.");
+ infof(data, "server does not support the security extensions\n");
return CURLE_USE_SSL_FAILED;
}
break;
conn->mech = *mech;
conn->sec_complete = 1;
- if (conn->data_prot != prot_clear) {
- conn->recv[FIRSTSOCKET] = sec_recv;
- conn->send[FIRSTSOCKET] = sec_send;
- conn->recv[SECONDARYSOCKET] = sec_recv;
- conn->send[SECONDARYSOCKET] = sec_send;
- }
- conn->command_prot = prot_safe;
+ conn->recv[FIRSTSOCKET] = sec_recv;
+ conn->send[FIRSTSOCKET] = sec_send;
+ conn->recv[SECONDARYSOCKET] = sec_recv;
+ conn->send[SECONDARYSOCKET] = sec_send;
+ conn->command_prot = PROT_SAFE;
/* Set the requested protection level */
/* BLOCKING */
- Curl_sec_set_protection_level(conn);
+ (void)sec_set_protection_level(conn);
break;
}
return mech != NULL ? CURLE_OK : CURLE_FAILED_INIT;
}
-int
+CURLcode
Curl_sec_login(struct connectdata *conn)
{
- CURLcode code = choose_mech(conn);
- return code == CURLE_OK;
+ return choose_mech(conn);
}
void
Curl_sec_end(struct connectdata *conn)
{
- if(conn->mech != NULL) {
- if(conn->mech->end)
- conn->mech->end(conn->app_data);
+ if(conn->mech != NULL && conn->mech->end)
+ conn->mech->end(conn->app_data);
+ if(conn->app_data) {
free(conn->app_data);
conn->app_data = NULL;
}
+ if(conn->in_buffer.data) {
+ free(conn->in_buffer.data);
+ conn->in_buffer.data = NULL;
+ conn->in_buffer.size = 0;
+ conn->in_buffer.index = 0;
+ /* FIXME: Is this really needed? */
+ conn->in_buffer.eof_flag = 0;
+ }
conn->sec_complete = 0;
- conn->data_prot = (enum protection_level)0;
+ conn->data_prot = PROT_CLEAR;
conn->mech = NULL;
}
-#endif /* HAVE_KRB4 || HAVE_GSSAPI */
+#endif /* HAVE_GSSAPI */
#endif /* CURL_DISABLE_FTP */
projects / platform / upstream / curl.git / blobdiff