1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Twitter Inc 2012 */
10 /* Interface to GNU SASL library for generic authentication. */
14 GNU SASL does not provide authentication data itself, so we have to expose
15 that decision to configuration. For some mechanisms, we need to act much
16 like plaintext. For others, we only need to be able to provide some
17 evaluated data on demand. There's no abstracted way (ie, without hardcoding
18 knowledge of authenticators here) to know which need what properties; we
19 can't query a session or the library for "we will need these for mechanism X".
21 So: we always require server_condition, even if sometimes it will just be
22 set as "yes". We do provide a number of other hooks, which might not make
23 sense in all contexts. For some, we can do checks at init time.
29 /* dummy function to satisfy compilers when we link in an "empty" file. */
30 static void dummy(int x
) { dummy(x
-1); }
34 #include "gsasl_exim.h"
36 /* Authenticator-specific options. */
37 /* I did have server_*_condition options for various mechanisms, but since
38 we only ever handle one mechanism at a time, I didn't see the point in keeping
39 that. In case someone sees a point, I've left the condition_check() API
41 optionlist auth_gsasl_options
[] = {
42 { "server_channelbinding", opt_bool
,
43 (void *)(offsetof(auth_gsasl_options_block
, server_channelbinding
)) },
44 { "server_hostname", opt_stringptr
,
45 (void *)(offsetof(auth_gsasl_options_block
, server_hostname
)) },
46 { "server_mech", opt_stringptr
,
47 (void *)(offsetof(auth_gsasl_options_block
, server_mech
)) },
48 { "server_password", opt_stringptr
,
49 (void *)(offsetof(auth_gsasl_options_block
, server_password
)) },
50 { "server_realm", opt_stringptr
,
51 (void *)(offsetof(auth_gsasl_options_block
, server_realm
)) },
52 { "server_scram_iter", opt_stringptr
,
53 (void *)(offsetof(auth_gsasl_options_block
, server_scram_iter
)) },
54 { "server_scram_salt", opt_stringptr
,
55 (void *)(offsetof(auth_gsasl_options_block
, server_scram_salt
)) },
56 { "server_service", opt_stringptr
,
57 (void *)(offsetof(auth_gsasl_options_block
, server_service
)) }
59 /* GSASL_SCRAM_SALTED_PASSWORD documented only for client, so not implementing
60 hooks to avoid cleartext passwords in the Exim server. */
62 int auth_gsasl_options_count
=
63 sizeof(auth_gsasl_options
)/sizeof(optionlist
);
65 /* Defaults for the authenticator-specific options. */
66 auth_gsasl_options_block auth_gsasl_option_defaults
= {
67 US
"smtp", /* server_service */
68 US
"$primary_hostname", /* server_hostname */
69 NULL
, /* server_realm */
70 NULL
, /* server_mech */
71 NULL
, /* server_password */
72 NULL
, /* server_scram_iter */
73 NULL
, /* server_scram_salt */
74 FALSE
/* server_channelbinding */
77 /* "Globals" for managing the gsasl interface. */
79 static Gsasl
*gsasl_ctx
= NULL
;
81 main_callback(Gsasl
*ctx
, Gsasl_session
*sctx
, Gsasl_property prop
);
83 server_callback(Gsasl
*ctx
, Gsasl_session
*sctx
, Gsasl_property prop
, auth_instance
*ablock
);
85 client_callback(Gsasl
*ctx
, Gsasl_session
*sctx
, Gsasl_property prop
, auth_instance
*ablock
);
87 static BOOL sasl_error_should_defer
= FALSE
;
88 static Gsasl_property callback_loop
= 0;
89 static BOOL checked_server_condition
= FALSE
;
91 enum { CURRENTLY_SERVER
= 1, CURRENTLY_CLIENT
= 2 };
93 struct callback_exim_state
{
94 auth_instance
*ablock
;
99 /*************************************************
100 * Initialization entry point *
101 *************************************************/
103 /* Called for each instance, after its options have been read, to
104 enable consistency checks to be done, or anything else that needs
108 auth_gsasl_init(auth_instance
*ablock
)
112 auth_gsasl_options_block
*ob
=
113 (auth_gsasl_options_block
*)(ablock
->options_block
);
115 /* As per existing Cyrus glue, use the authenticator's public name as
116 the default for the mechanism name; we don't handle multiple mechanisms
117 in one authenticator, but the same driver can be used multiple times. */
119 if (ob
->server_mech
== NULL
)
120 ob
->server_mech
= string_copy(ablock
->public_name
);
122 /* Can get multiple session contexts from one library context, so just
123 initialise the once. */
124 if (gsasl_ctx
== NULL
) {
125 rc
= gsasl_init(&gsasl_ctx
);
126 if (rc
!= GSASL_OK
) {
127 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s authenticator: "
128 "couldn't initialise GNU SASL library: %s (%s)",
129 ablock
->name
, gsasl_strerror_name(rc
), gsasl_strerror(rc
));
131 gsasl_callback_set(gsasl_ctx
, main_callback
);
134 /* We don't need this except to log it for debugging. */
135 rc
= gsasl_server_mechlist(gsasl_ctx
, &p
);
137 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s authenticator: "
138 "failed to retrieve list of mechanisms: %s (%s)",
139 ablock
->name
, gsasl_strerror_name(rc
), gsasl_strerror(rc
));
140 HDEBUG(D_auth
) debug_printf("GNU SASL supports: %s\n", p
);
142 supported
= gsasl_client_support_p(gsasl_ctx
, (const char *)ob
->server_mech
);
144 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s authenticator: "
145 "GNU SASL does not support mechanism \"%s\"",
146 ablock
->name
, ob
->server_mech
);
148 if ((ablock
->server_condition
== NULL
) &&
149 (strcmpic(ob
->server_mech
, US
"EXTERNAL") ||
150 strcmpic(ob
->server_mech
, US
"ANONYMOUS") ||
151 strcmpic(ob
->server_mech
, US
"PLAIN") ||
152 strcmpic(ob
->server_mech
, US
"LOGIN")))
153 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s authenticator: "
154 "Need server_condition for %s mechanism",
155 ablock
->name
, ob
->server_mech
);
157 /* At present, for mechanisms we don't panic on absence of server_condition;
158 need to figure out the most generically correct approach to deciding when
159 it's critical and when it isn't. Eg, for simple validation (PLAIN mechanism,
160 etc) it clearly is critical.
162 So don't activate without server_condition, this might be relaxed in the future.
164 if (ablock
->server_condition
!= NULL
) ablock
->server
= TRUE
;
165 ablock
->client
= FALSE
;
169 /* GNU SASL uses one top-level callback, registered at library level.
170 We dispatch to client and server functions instead. */
173 main_callback(Gsasl
*ctx
, Gsasl_session
*sctx
, Gsasl_property prop
)
176 struct callback_exim_state
*cb_state
=
177 (struct callback_exim_state
*)gsasl_session_hook_get(sctx
);
179 HDEBUG(D_auth
) debug_printf("Callback entered, prop=%d (loop prop=%d)\n",
180 prop
, callback_loop
);
182 if (cb_state
== NULL
) {
183 HDEBUG(D_auth
) debug_printf(" not from our server/client processing.\n");
184 return GSASL_NO_CALLBACK
;
187 if (callback_loop
> 0) {
188 /* Most likely is that we were asked for property foo, and to
189 expand the string we asked for property bar to put into an auth
190 variable, but property bar is not supplied for this mechanism. */
192 debug_printf("Loop, asked for property %d while handling property %d\n",
193 prop
, callback_loop
);
194 return GSASL_NO_CALLBACK
;
196 callback_loop
= prop
;
198 if (cb_state
->currently
== CURRENTLY_CLIENT
)
199 rc
= client_callback(ctx
, sctx
, prop
, cb_state
->ablock
);
200 else if (cb_state
->currently
== CURRENTLY_SERVER
)
201 rc
= server_callback(ctx
, sctx
, prop
, cb_state
->ablock
);
203 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s authenticator: "
204 "unhandled callback state, bug in Exim", cb_state
->ablock
->name
);
213 /*************************************************
214 * Server entry point *
215 *************************************************/
217 /* For interface, see auths/README */
220 auth_gsasl_server(auth_instance
*ablock
, uschar
*initial_data
)
223 char *to_send
, *received
;
224 Gsasl_session
*sctx
= NULL
;
225 auth_gsasl_options_block
*ob
=
226 (auth_gsasl_options_block
*)(ablock
->options_block
);
227 struct callback_exim_state cb_state
;
228 int rc
, auth_result
, exim_error
, exim_error_override
;
231 debug_printf("GNU SASL: initialising session for %s, mechanism %s.\n",
232 ablock
->name
, ob
->server_mech
);
234 rc
= gsasl_server_start(gsasl_ctx
, (const char *)ob
->server_mech
, &sctx
);
235 if (rc
!= GSASL_OK
) {
236 auth_defer_msg
= string_sprintf("GNU SASL: session start failure: %s (%s)",
237 gsasl_strerror_name(rc
), gsasl_strerror(rc
));
238 HDEBUG(D_auth
) debug_printf("%s\n", auth_defer_msg
);
241 /* Hereafter: gsasl_finish(sctx) please */
243 gsasl_session_hook_set(sctx
, (void *)ablock
);
244 cb_state
.ablock
= ablock
;
245 cb_state
.currently
= CURRENTLY_SERVER
;
246 gsasl_session_hook_set(sctx
, (void *)&cb_state
);
248 tmps
= CS
expand_string(ob
->server_service
);
249 gsasl_property_set(sctx
, GSASL_SERVICE
, tmps
);
250 tmps
= CS
expand_string(ob
->server_hostname
);
251 gsasl_property_set(sctx
, GSASL_HOSTNAME
, tmps
);
252 if (ob
->server_realm
) {
253 tmps
= CS
expand_string(ob
->server_realm
);
255 gsasl_property_set(sctx
, GSASL_REALM
, tmps
);
258 /* We don't support protection layers. */
259 gsasl_property_set(sctx
, GSASL_QOPS
, "qop-auth");
261 if (tls_channelbinding_b64
) {
262 /* Some auth mechanisms can ensure that both sides are talking withing the
263 same security context; for TLS, this means that even if a bad certificate
264 has been accepted, they remain MitM-proof because both sides must be within
265 the same negotiated session; if someone is terminating one sesson and
266 proxying data on within a second, authentication will fail.
268 We might not have this available, depending upon TLS implementation,
269 ciphersuite, phase of moon ...
271 If we do, it results in extra SASL mechanisms being available; here,
272 Exim's one-mechanism-per-authenticator potentially causes problems.
273 It depends upon how GNU SASL will implement the PLUS variants of GS2
274 and whether it automatically mandates a switch to the bound PLUS
275 if the data is available. Since default-on, despite being more secure,
276 would then result in mechanism name changes on a library update, we
277 have little choice but to default it off and let the admin choose to
280 if (ob
->server_channelbinding
) {
281 HDEBUG(D_auth
) debug_printf("Auth %s: Enabling channel-binding\n",
283 gsasl_property_set(sctx
, GSASL_CB_TLS_UNIQUE
,
284 (const char *) tls_channelbinding_b64
);
287 debug_printf("Auth %s: Not enabling channel-binding (data available)\n",
292 debug_printf("Auth %s: no channel-binding data available\n",
297 checked_server_condition
= FALSE
;
299 received
= CS initial_data
;
301 exim_error
= exim_error_override
= OK
;
304 rc
= gsasl_step64(sctx
, received
, &to_send
);
308 goto STOP_INTERACTION
;
310 case GSASL_NEEDS_MORE
:
313 case GSASL_AUTHENTICATION_ERROR
:
314 case GSASL_INTEGRITY_ERROR
:
315 case GSASL_NO_AUTHID
:
316 case GSASL_NO_ANONYMOUS_TOKEN
:
317 case GSASL_NO_AUTHZID
:
318 case GSASL_NO_PASSWORD
:
319 case GSASL_NO_PASSCODE
:
321 case GSASL_BASE64_ERROR
:
322 HDEBUG(D_auth
) debug_printf("GNU SASL permanent error: %s (%s)\n",
323 gsasl_strerror_name(rc
), gsasl_strerror(rc
));
324 log_write(0, LOG_REJECT
, "%s authenticator (%s):\n "
325 "GNU SASL permanent failure: %s (%s)",
326 ablock
->name
, ob
->server_mech
,
327 gsasl_strerror_name(rc
), gsasl_strerror(rc
));
328 if (rc
== GSASL_BASE64_ERROR
)
329 exim_error_override
= BAD64
;
330 goto STOP_INTERACTION
;
333 auth_defer_msg
= string_sprintf("GNU SASL temporary error: %s (%s)",
334 gsasl_strerror_name(rc
), gsasl_strerror(rc
));
335 HDEBUG(D_auth
) debug_printf("%s\n", auth_defer_msg
);
336 exim_error_override
= DEFER
;
337 goto STOP_INTERACTION
;
341 auth_get_no64_data((uschar
**)&received
, (uschar
*)to_send
);
343 break; /* handles * cancelled check */
345 } while (rc
== GSASL_NEEDS_MORE
);
352 /* Can return: OK DEFER FAIL CANCELLED BAD64 UNEXPECTED */
354 if (exim_error
!= OK
)
357 if (auth_result
!= GSASL_OK
) {
358 HDEBUG(D_auth
) debug_printf("authentication returned %s (%s)\n",
359 gsasl_strerror_name(auth_result
), gsasl_strerror(auth_result
));
360 if (exim_error_override
!= OK
)
361 return exim_error_override
; /* might be DEFER */
362 if (sasl_error_should_defer
) /* overriding auth failure SASL error */
367 /* Auth succeeded, check server_condition unless already done in callback */
368 return checked_server_condition
? OK
: auth_check_serv_cond(ablock
);
371 /* returns the GSASL status of expanding the Exim string given */
373 condition_check(auth_instance
*ablock
, uschar
*label
, uschar
*condition_string
)
377 exim_rc
= auth_check_some_cond(ablock
, label
, condition_string
, FAIL
);
381 } else if (exim_rc
== DEFER
) {
382 sasl_error_should_defer
= TRUE
;
383 return GSASL_AUTHENTICATION_ERROR
;
384 } else if (exim_rc
== FAIL
) {
385 return GSASL_AUTHENTICATION_ERROR
;
388 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s authenticator: "
389 "Unhandled return from checking %s: %d",
390 ablock
->name
, label
, exim_rc
);
392 return GSASL_AUTHENTICATION_ERROR
;
396 server_callback(Gsasl
*ctx
, Gsasl_session
*sctx
, Gsasl_property prop
, auth_instance
*ablock
)
400 int cbrc
= GSASL_NO_CALLBACK
;
402 auth_gsasl_options_block
*ob
=
403 (auth_gsasl_options_block
*)(ablock
->options_block
);
406 debug_printf("GNU SASL callback %d for %s/%s as server\n",
407 prop
, ablock
->name
, ablock
->public_name
);
409 for (i
= 0; i
< AUTH_VARS
; i
++) auth_vars
[i
] = NULL
;
413 case GSASL_VALIDATE_SIMPLE
:
414 /* GSASL_AUTHID, GSASL_AUTHZID, and GSASL_PASSWORD */
415 propval
= (uschar
*) gsasl_property_get(sctx
, GSASL_AUTHID
);
416 auth_vars
[0] = expand_nstring
[1] = propval
? propval
: US
"";
417 propval
= (uschar
*) gsasl_property_get(sctx
, GSASL_AUTHZID
);
418 auth_vars
[1] = expand_nstring
[2] = propval
? propval
: US
"";
419 propval
= (uschar
*) gsasl_property_get(sctx
, GSASL_PASSWORD
);
420 auth_vars
[2] = expand_nstring
[3] = propval
? propval
: US
"";
422 for (i
= 1; i
<= 3; ++i
)
423 expand_nlength
[i
] = Ustrlen(expand_nstring
[i
]);
425 cbrc
= condition_check(ablock
, US
"server_condition", ablock
->server_condition
);
426 checked_server_condition
= TRUE
;
429 case GSASL_VALIDATE_EXTERNAL
:
430 if (ablock
->server_condition
== NULL
) {
431 HDEBUG(D_auth
) debug_printf("No server_condition supplied, to validate EXTERNAL.\n");
432 cbrc
= GSASL_AUTHENTICATION_ERROR
;
435 propval
= (uschar
*) gsasl_property_get(sctx
, GSASL_AUTHZID
);
436 /* We always set $auth1, even if only to empty string. */
437 auth_vars
[0] = expand_nstring
[1] = propval
? propval
: US
"";
438 expand_nlength
[1] = Ustrlen(expand_nstring
[1]);
441 cbrc
= condition_check(ablock
,
442 US
"server_condition (EXTERNAL)", ablock
->server_condition
);
443 checked_server_condition
= TRUE
;
446 case GSASL_VALIDATE_ANONYMOUS
:
447 if (ablock
->server_condition
== NULL
) {
448 HDEBUG(D_auth
) debug_printf("No server_condition supplied, to validate ANONYMOUS.\n");
449 cbrc
= GSASL_AUTHENTICATION_ERROR
;
452 propval
= (uschar
*) gsasl_property_get(sctx
, GSASL_ANONYMOUS_TOKEN
);
453 /* We always set $auth1, even if only to empty string. */
454 auth_vars
[0] = expand_nstring
[1] = propval
? propval
: US
"";
455 expand_nlength
[1] = Ustrlen(expand_nstring
[1]);
458 cbrc
= condition_check(ablock
,
459 US
"server_condition (ANONYMOUS)", ablock
->server_condition
);
460 checked_server_condition
= TRUE
;
463 case GSASL_VALIDATE_GSSAPI
:
464 /* GSASL_AUTHZID and GSASL_GSSAPI_DISPLAY_NAME */
465 propval
= (uschar
*) gsasl_property_get(sctx
, GSASL_AUTHZID
);
466 auth_vars
[0] = expand_nstring
[1] = propval
? propval
: US
"";
467 propval
= (uschar
*) gsasl_property_get(sctx
, GSASL_GSSAPI_DISPLAY_NAME
);
468 auth_vars
[1] = expand_nstring
[2] = propval
? propval
: US
"";
470 for (i
= 1; i
<= 2; ++i
)
471 expand_nlength
[i
] = Ustrlen(expand_nstring
[i
]);
473 /* In this one case, it perhaps makes sense to default back open?
474 But for consistency, let's just mandate server_condition here too. */
475 cbrc
= condition_check(ablock
,
476 US
"server_condition (GSSAPI family)", ablock
->server_condition
);
477 checked_server_condition
= TRUE
;
481 /* DIGEST-MD5: GSASL_AUTHID, GSASL_AUTHZID and GSASL_REALM
482 CRAM-MD5: GSASL_AUTHID
483 PLAIN: GSASL_AUTHID and GSASL_AUTHZID
486 if (ob
->server_scram_iter
) {
487 tmps
= CS
expand_string(ob
->server_scram_iter
);
488 gsasl_property_set(sctx
, GSASL_SCRAM_ITER
, tmps
);
490 if (ob
->server_scram_salt
) {
491 tmps
= CS
expand_string(ob
->server_scram_salt
);
492 gsasl_property_set(sctx
, GSASL_SCRAM_SALT
, tmps
);
494 /* Asking for GSASL_AUTHZID will probably call back into us.
495 Do we really want to hardcode limits per mechanism? What happens when
496 a new mechanism is added to the library. It *shouldn't* result in us
497 needing to add more glue, since avoiding that is a large part of the
499 propval
= (uschar
*) gsasl_property_get(sctx
, GSASL_AUTHID
);
500 auth_vars
[0] = expand_nstring
[1] = propval
? propval
: US
"";
501 propval
= (uschar
*) gsasl_property_get(sctx
, GSASL_AUTHZID
);
502 auth_vars
[1] = expand_nstring
[2] = propval
? propval
: US
"";
503 propval
= (uschar
*) gsasl_property_get(sctx
, GSASL_REALM
);
504 auth_vars
[2] = expand_nstring
[3] = propval
? propval
: US
"";
506 for (i
= 1; i
<= 3; ++i
)
507 expand_nlength
[i
] = Ustrlen(expand_nstring
[i
]);
509 tmps
= CS
expand_string(ob
->server_password
);
511 sasl_error_should_defer
= expand_string_forcedfail
? FALSE
: TRUE
;
512 HDEBUG(D_auth
) debug_printf("server_password expansion failed, so "
513 "can't tell GNU SASL library the password for %s\n", auth_vars
[0]);
514 return GSASL_AUTHENTICATION_ERROR
;
516 gsasl_property_set(sctx
, GSASL_PASSWORD
, tmps
);
517 /* This is inadequate; don't think Exim's store stacks are geared
518 for memory wiping, so expanding strings will leave stuff laying around.
519 But no need to compound the problem, so get rid of the one we can. */
520 memset(tmps
, '\0', strlen(tmps
));
525 HDEBUG(D_auth
) debug_printf("Unrecognised callback: %d\n", prop
);
526 cbrc
= GSASL_NO_CALLBACK
;
529 HDEBUG(D_auth
) debug_printf("Returning %s (%s)\n",
530 gsasl_strerror_name(cbrc
), gsasl_strerror(cbrc
));
536 /*************************************************
537 * Client entry point *
538 *************************************************/
540 /* For interface, see auths/README */
544 auth_instance
*ablock
, /* authenticator block */
545 smtp_inblock
*inblock
, /* connection inblock */
546 smtp_outblock
*outblock
, /* connection outblock */
547 int timeout
, /* command timeout */
548 uschar
*buffer
, /* buffer for reading response */
549 int buffsize
) /* size of buffer */
552 debug_printf("Client side NOT IMPLEMENTED: you should not see this!\n");
553 /* NOT IMPLEMENTED */
558 client_callback(Gsasl
*ctx
, Gsasl_session
*sctx
, Gsasl_property prop
, auth_instance
*ablock
)
560 int cbrc
= GSASL_NO_CALLBACK
;
562 debug_printf("GNU SASL callback %d for %s/%s as client\n",
563 prop
, ablock
->name
, ablock
->public_name
);
566 debug_printf("Client side NOT IMPLEMENTED: you should not see this!\n");
571 /*************************************************
573 *************************************************/
576 auth_gsasl_version_report(FILE *f
)
579 runtime
= gsasl_check_version(NULL
);
580 fprintf(f
, "Library version: GNU SASL: Compile: %s\n"
582 GSASL_VERSION
, runtime
);
585 #endif /* AUTH_GSASL */
587 /* End of gsasl_exim.c */