1 | /***************************************************************************
|
---|
2 | * _ _ ____ _
|
---|
3 | * Project ___| | | | _ \| |
|
---|
4 | * / __| | | | |_) | |
|
---|
5 | * | (__| |_| | _ <| |___
|
---|
6 | * \___|\___/|_| \_\_____|
|
---|
7 | *
|
---|
8 | * Copyright (C) 2012 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
|
---|
9 | *
|
---|
10 | * This software is licensed as described in the file COPYING, which
|
---|
11 | * you should have received as part of this distribution. The terms
|
---|
12 | * are also available at https://curl.haxx.se/docs/copyright.html.
|
---|
13 | *
|
---|
14 | * You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
---|
15 | * copies of the Software, and permit persons to whom the Software is
|
---|
16 | * furnished to do so, under the terms of the COPYING file.
|
---|
17 | *
|
---|
18 | * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
---|
19 | * KIND, either express or implied.
|
---|
20 | *
|
---|
21 | * RFC2195 CRAM-MD5 authentication
|
---|
22 | * RFC2617 Basic and Digest Access Authentication
|
---|
23 | * RFC2831 DIGEST-MD5 authentication
|
---|
24 | * RFC4422 Simple Authentication and Security Layer (SASL)
|
---|
25 | * RFC4616 PLAIN authentication
|
---|
26 | * RFC6749 OAuth 2.0 Authorization Framework
|
---|
27 | * RFC7628 A Set of SASL Mechanisms for OAuth
|
---|
28 | * Draft LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
|
---|
29 | *
|
---|
30 | ***************************************************************************/
|
---|
31 |
|
---|
32 | #include "curl_setup.h"
|
---|
33 |
|
---|
34 | #include <curl/curl.h>
|
---|
35 | #include "urldata.h"
|
---|
36 |
|
---|
37 | #include "curl_base64.h"
|
---|
38 | #include "curl_md5.h"
|
---|
39 | #include "vtls/vtls.h"
|
---|
40 | #include "curl_hmac.h"
|
---|
41 | #include "curl_sasl.h"
|
---|
42 | #include "warnless.h"
|
---|
43 | #include "strtok.h"
|
---|
44 | #include "strequal.h"
|
---|
45 | #include "rawstr.h"
|
---|
46 | #include "sendf.h"
|
---|
47 | #include "non-ascii.h" /* included for Curl_convert_... prototypes */
|
---|
48 | #include "curl_printf.h"
|
---|
49 |
|
---|
50 | /* The last #include files should be: */
|
---|
51 | #include "curl_memory.h"
|
---|
52 | #include "memdebug.h"
|
---|
53 |
|
---|
54 | /* Supported mechanisms */
|
---|
55 | const struct {
|
---|
56 | const char *name; /* Name */
|
---|
57 | size_t len; /* Name length */
|
---|
58 | unsigned int bit; /* Flag bit */
|
---|
59 | } mechtable[] = {
|
---|
60 | { "LOGIN", 5, SASL_MECH_LOGIN },
|
---|
61 | { "PLAIN", 5, SASL_MECH_PLAIN },
|
---|
62 | { "CRAM-MD5", 8, SASL_MECH_CRAM_MD5 },
|
---|
63 | { "DIGEST-MD5", 10, SASL_MECH_DIGEST_MD5 },
|
---|
64 | { "GSSAPI", 6, SASL_MECH_GSSAPI },
|
---|
65 | { "EXTERNAL", 8, SASL_MECH_EXTERNAL },
|
---|
66 | { "NTLM", 4, SASL_MECH_NTLM },
|
---|
67 | { "XOAUTH2", 7, SASL_MECH_XOAUTH2 },
|
---|
68 | { "OAUTHBEARER", 11, SASL_MECH_OAUTHBEARER },
|
---|
69 | { ZERO_NULL, 0, 0 }
|
---|
70 | };
|
---|
71 |
|
---|
72 | #if !defined(CURL_DISABLE_CRYPTO_AUTH) && !defined(USE_WINDOWS_SSPI)
|
---|
73 | #define DIGEST_QOP_VALUE_AUTH (1 << 0)
|
---|
74 | #define DIGEST_QOP_VALUE_AUTH_INT (1 << 1)
|
---|
75 | #define DIGEST_QOP_VALUE_AUTH_CONF (1 << 2)
|
---|
76 |
|
---|
77 | #define DIGEST_QOP_VALUE_STRING_AUTH "auth"
|
---|
78 | #define DIGEST_QOP_VALUE_STRING_AUTH_INT "auth-int"
|
---|
79 | #define DIGEST_QOP_VALUE_STRING_AUTH_CONF "auth-conf"
|
---|
80 |
|
---|
81 | /* The CURL_OUTPUT_DIGEST_CONV macro below is for non-ASCII machines.
|
---|
82 | It converts digest text to ASCII so the MD5 will be correct for
|
---|
83 | what ultimately goes over the network.
|
---|
84 | */
|
---|
85 | #define CURL_OUTPUT_DIGEST_CONV(a, b) \
|
---|
86 | result = Curl_convert_to_network(a, (char *)b, strlen((const char*)b)); \
|
---|
87 | if(result) { \
|
---|
88 | free(b); \
|
---|
89 | return result; \
|
---|
90 | }
|
---|
91 |
|
---|
92 | #endif
|
---|
93 |
|
---|
94 | #if !defined(CURL_DISABLE_CRYPTO_AUTH)
|
---|
95 | /*
|
---|
96 | * Returns 0 on success and then the buffers are filled in fine.
|
---|
97 | *
|
---|
98 | * Non-zero means failure to parse.
|
---|
99 | */
|
---|
100 | int Curl_sasl_digest_get_pair(const char *str, char *value, char *content,
|
---|
101 | const char **endptr)
|
---|
102 | {
|
---|
103 | int c;
|
---|
104 | bool starts_with_quote = FALSE;
|
---|
105 | bool escape = FALSE;
|
---|
106 |
|
---|
107 | for(c = DIGEST_MAX_VALUE_LENGTH - 1; (*str && (*str != '=') && c--); )
|
---|
108 | *value++ = *str++;
|
---|
109 | *value = 0;
|
---|
110 |
|
---|
111 | if('=' != *str++)
|
---|
112 | /* eek, no match */
|
---|
113 | return 1;
|
---|
114 |
|
---|
115 | if('\"' == *str) {
|
---|
116 | /* this starts with a quote so it must end with one as well! */
|
---|
117 | str++;
|
---|
118 | starts_with_quote = TRUE;
|
---|
119 | }
|
---|
120 |
|
---|
121 | for(c = DIGEST_MAX_CONTENT_LENGTH - 1; *str && c--; str++) {
|
---|
122 | switch(*str) {
|
---|
123 | case '\\':
|
---|
124 | if(!escape) {
|
---|
125 | /* possibly the start of an escaped quote */
|
---|
126 | escape = TRUE;
|
---|
127 | *content++ = '\\'; /* even though this is an escape character, we still
|
---|
128 | store it as-is in the target buffer */
|
---|
129 | continue;
|
---|
130 | }
|
---|
131 | break;
|
---|
132 | case ',':
|
---|
133 | if(!starts_with_quote) {
|
---|
134 | /* this signals the end of the content if we didn't get a starting
|
---|
135 | quote and then we do "sloppy" parsing */
|
---|
136 | c = 0; /* the end */
|
---|
137 | continue;
|
---|
138 | }
|
---|
139 | break;
|
---|
140 | case '\r':
|
---|
141 | case '\n':
|
---|
142 | /* end of string */
|
---|
143 | c = 0;
|
---|
144 | continue;
|
---|
145 | case '\"':
|
---|
146 | if(!escape && starts_with_quote) {
|
---|
147 | /* end of string */
|
---|
148 | c = 0;
|
---|
149 | continue;
|
---|
150 | }
|
---|
151 | break;
|
---|
152 | }
|
---|
153 | escape = FALSE;
|
---|
154 | *content++ = *str;
|
---|
155 | }
|
---|
156 | *content = 0;
|
---|
157 |
|
---|
158 | *endptr = str;
|
---|
159 |
|
---|
160 | return 0; /* all is fine! */
|
---|
161 | }
|
---|
162 | #endif
|
---|
163 |
|
---|
164 | #if !defined(CURL_DISABLE_CRYPTO_AUTH) && !defined(USE_WINDOWS_SSPI)
|
---|
165 | /* Convert md5 chunk to RFC2617 (section 3.1.3) -suitable ascii string*/
|
---|
166 | static void sasl_digest_md5_to_ascii(unsigned char *source, /* 16 bytes */
|
---|
167 | unsigned char *dest) /* 33 bytes */
|
---|
168 | {
|
---|
169 | int i;
|
---|
170 | for(i = 0; i < 16; i++)
|
---|
171 | snprintf((char *)&dest[i*2], 3, "%02x", source[i]);
|
---|
172 | }
|
---|
173 |
|
---|
174 | /* Perform quoted-string escaping as described in RFC2616 and its errata */
|
---|
175 | static char *sasl_digest_string_quoted(const char *source)
|
---|
176 | {
|
---|
177 | char *dest, *d;
|
---|
178 | const char *s = source;
|
---|
179 | size_t n = 1; /* null terminator */
|
---|
180 |
|
---|
181 | /* Calculate size needed */
|
---|
182 | while(*s) {
|
---|
183 | ++n;
|
---|
184 | if(*s == '"' || *s == '\\') {
|
---|
185 | ++n;
|
---|
186 | }
|
---|
187 | ++s;
|
---|
188 | }
|
---|
189 |
|
---|
190 | dest = malloc(n);
|
---|
191 | if(dest) {
|
---|
192 | s = source;
|
---|
193 | d = dest;
|
---|
194 | while(*s) {
|
---|
195 | if(*s == '"' || *s == '\\') {
|
---|
196 | *d++ = '\\';
|
---|
197 | }
|
---|
198 | *d++ = *s++;
|
---|
199 | }
|
---|
200 | *d = 0;
|
---|
201 | }
|
---|
202 |
|
---|
203 | return dest;
|
---|
204 | }
|
---|
205 |
|
---|
206 | /* Retrieves the value for a corresponding key from the challenge string
|
---|
207 | * returns TRUE if the key could be found, FALSE if it does not exists
|
---|
208 | */
|
---|
209 | static bool sasl_digest_get_key_value(const char *chlg,
|
---|
210 | const char *key,
|
---|
211 | char *value,
|
---|
212 | size_t max_val_len,
|
---|
213 | char end_char)
|
---|
214 | {
|
---|
215 | char *find_pos;
|
---|
216 | size_t i;
|
---|
217 |
|
---|
218 | find_pos = strstr(chlg, key);
|
---|
219 | if(!find_pos)
|
---|
220 | return FALSE;
|
---|
221 |
|
---|
222 | find_pos += strlen(key);
|
---|
223 |
|
---|
224 | for(i = 0; *find_pos && *find_pos != end_char && i < max_val_len - 1; ++i)
|
---|
225 | value[i] = *find_pos++;
|
---|
226 | value[i] = '\0';
|
---|
227 |
|
---|
228 | return TRUE;
|
---|
229 | }
|
---|
230 |
|
---|
231 | static CURLcode sasl_digest_get_qop_values(const char *options, int *value)
|
---|
232 | {
|
---|
233 | char *tmp;
|
---|
234 | char *token;
|
---|
235 | char *tok_buf;
|
---|
236 |
|
---|
237 | /* Initialise the output */
|
---|
238 | *value = 0;
|
---|
239 |
|
---|
240 | /* Tokenise the list of qop values. Use a temporary clone of the buffer since
|
---|
241 | strtok_r() ruins it. */
|
---|
242 | tmp = strdup(options);
|
---|
243 | if(!tmp)
|
---|
244 | return CURLE_OUT_OF_MEMORY;
|
---|
245 |
|
---|
246 | token = strtok_r(tmp, ",", &tok_buf);
|
---|
247 | while(token != NULL) {
|
---|
248 | if(Curl_raw_equal(token, DIGEST_QOP_VALUE_STRING_AUTH))
|
---|
249 | *value |= DIGEST_QOP_VALUE_AUTH;
|
---|
250 | else if(Curl_raw_equal(token, DIGEST_QOP_VALUE_STRING_AUTH_INT))
|
---|
251 | *value |= DIGEST_QOP_VALUE_AUTH_INT;
|
---|
252 | else if(Curl_raw_equal(token, DIGEST_QOP_VALUE_STRING_AUTH_CONF))
|
---|
253 | *value |= DIGEST_QOP_VALUE_AUTH_CONF;
|
---|
254 |
|
---|
255 | token = strtok_r(NULL, ",", &tok_buf);
|
---|
256 | }
|
---|
257 |
|
---|
258 | free(tmp);
|
---|
259 |
|
---|
260 | return CURLE_OK;
|
---|
261 | }
|
---|
262 | #endif /* !CURL_DISABLE_CRYPTO_AUTH && !USE_WINDOWS_SSPI */
|
---|
263 |
|
---|
264 | #if !defined(USE_WINDOWS_SSPI)
|
---|
265 | /*
|
---|
266 | * Curl_sasl_build_spn()
|
---|
267 | *
|
---|
268 | * This is used to build a SPN string in the format service/instance.
|
---|
269 | *
|
---|
270 | * Parameters:
|
---|
271 | *
|
---|
272 | * service [in] - The service type such as www, smtp, pop or imap.
|
---|
273 | * instance [in] - The host name or realm.
|
---|
274 | *
|
---|
275 | * Returns a pointer to the newly allocated SPN.
|
---|
276 | */
|
---|
277 | char *Curl_sasl_build_spn(const char *service, const char *instance)
|
---|
278 | {
|
---|
279 | /* Generate and return our SPN */
|
---|
280 | return aprintf("%s/%s", service, instance);
|
---|
281 | }
|
---|
282 | #endif
|
---|
283 |
|
---|
284 | /*
|
---|
285 | * sasl_create_plain_message()
|
---|
286 | *
|
---|
287 | * This is used to generate an already encoded PLAIN message ready
|
---|
288 | * for sending to the recipient.
|
---|
289 | *
|
---|
290 | * Parameters:
|
---|
291 | *
|
---|
292 | * data [in] - The session handle.
|
---|
293 | * userp [in] - The user name.
|
---|
294 | * passdwp [in] - The user's password.
|
---|
295 | * outptr [in/out] - The address where a pointer to newly allocated memory
|
---|
296 | * holding the result will be stored upon completion.
|
---|
297 | * outlen [out] - The length of the output message.
|
---|
298 | *
|
---|
299 | * Returns CURLE_OK on success.
|
---|
300 | */
|
---|
301 | static CURLcode sasl_create_plain_message(struct SessionHandle *data,
|
---|
302 | const char *userp,
|
---|
303 | const char *passwdp,
|
---|
304 | char **outptr, size_t *outlen)
|
---|
305 | {
|
---|
306 | CURLcode result;
|
---|
307 | char *plainauth;
|
---|
308 | size_t ulen;
|
---|
309 | size_t plen;
|
---|
310 |
|
---|
311 | ulen = strlen(userp);
|
---|
312 | plen = strlen(passwdp);
|
---|
313 |
|
---|
314 | plainauth = malloc(2 * ulen + plen + 2);
|
---|
315 | if(!plainauth) {
|
---|
316 | *outlen = 0;
|
---|
317 | *outptr = NULL;
|
---|
318 | return CURLE_OUT_OF_MEMORY;
|
---|
319 | }
|
---|
320 |
|
---|
321 | /* Calculate the reply */
|
---|
322 | memcpy(plainauth, userp, ulen);
|
---|
323 | plainauth[ulen] = '\0';
|
---|
324 | memcpy(plainauth + ulen + 1, userp, ulen);
|
---|
325 | plainauth[2 * ulen + 1] = '\0';
|
---|
326 | memcpy(plainauth + 2 * ulen + 2, passwdp, plen);
|
---|
327 |
|
---|
328 | /* Base64 encode the reply */
|
---|
329 | result = Curl_base64_encode(data, plainauth, 2 * ulen + plen + 2, outptr,
|
---|
330 | outlen);
|
---|
331 | free(plainauth);
|
---|
332 | return result;
|
---|
333 | }
|
---|
334 |
|
---|
335 | /*
|
---|
336 | * sasl_create_login_message()
|
---|
337 | *
|
---|
338 | * This is used to generate an already encoded LOGIN message containing the
|
---|
339 | * user name or password ready for sending to the recipient.
|
---|
340 | *
|
---|
341 | * Parameters:
|
---|
342 | *
|
---|
343 | * data [in] - The session handle.
|
---|
344 | * valuep [in] - The user name or user's password.
|
---|
345 | * outptr [in/out] - The address where a pointer to newly allocated memory
|
---|
346 | * holding the result will be stored upon completion.
|
---|
347 | * outlen [out] - The length of the output message.
|
---|
348 | *
|
---|
349 | * Returns CURLE_OK on success.
|
---|
350 | */
|
---|
351 | static CURLcode sasl_create_login_message(struct SessionHandle *data,
|
---|
352 | const char *valuep, char **outptr,
|
---|
353 | size_t *outlen)
|
---|
354 | {
|
---|
355 | size_t vlen = strlen(valuep);
|
---|
356 |
|
---|
357 | if(!vlen) {
|
---|
358 | /* Calculate an empty reply */
|
---|
359 | *outptr = strdup("=");
|
---|
360 | if(*outptr) {
|
---|
361 | *outlen = (size_t) 1;
|
---|
362 | return CURLE_OK;
|
---|
363 | }
|
---|
364 |
|
---|
365 | *outlen = 0;
|
---|
366 | return CURLE_OUT_OF_MEMORY;
|
---|
367 | }
|
---|
368 |
|
---|
369 | /* Base64 encode the value */
|
---|
370 | return Curl_base64_encode(data, valuep, vlen, outptr, outlen);
|
---|
371 | }
|
---|
372 |
|
---|
373 | /*
|
---|
374 | * sasl_create_external_message()
|
---|
375 | *
|
---|
376 | * This is used to generate an already encoded EXTERNAL message containing
|
---|
377 | * the user name ready for sending to the recipient.
|
---|
378 | *
|
---|
379 | * Parameters:
|
---|
380 | *
|
---|
381 | * data [in] - The session handle.
|
---|
382 | * user [in] - The user name.
|
---|
383 | * outptr [in/out] - The address where a pointer to newly allocated memory
|
---|
384 | * holding the result will be stored upon completion.
|
---|
385 | * outlen [out] - The length of the output message.
|
---|
386 | *
|
---|
387 | * Returns CURLE_OK on success.
|
---|
388 | */
|
---|
389 | static CURLcode sasl_create_external_message(struct SessionHandle *data,
|
---|
390 | const char *user, char **outptr,
|
---|
391 | size_t *outlen)
|
---|
392 | {
|
---|
393 | /* This is the same formatting as the login message. */
|
---|
394 | return sasl_create_login_message(data, user, outptr, outlen);
|
---|
395 | }
|
---|
396 |
|
---|
397 | #ifndef CURL_DISABLE_CRYPTO_AUTH
|
---|
398 | /*
|
---|
399 | * sasl_decode_cram_md5_message()
|
---|
400 | *
|
---|
401 | * This is used to decode an already encoded CRAM-MD5 challenge message.
|
---|
402 | *
|
---|
403 | * Parameters:
|
---|
404 | *
|
---|
405 | * chlg64 [in] - The base64 encoded challenge message.
|
---|
406 | * outptr [in/out] - The address where a pointer to newly allocated memory
|
---|
407 | * holding the result will be stored upon completion.
|
---|
408 | * outlen [out] - The length of the output message.
|
---|
409 | *
|
---|
410 | * Returns CURLE_OK on success.
|
---|
411 | */
|
---|
412 | static CURLcode sasl_decode_cram_md5_message(const char *chlg64, char **outptr,
|
---|
413 | size_t *outlen)
|
---|
414 | {
|
---|
415 | CURLcode result = CURLE_OK;
|
---|
416 | size_t chlg64len = strlen(chlg64);
|
---|
417 |
|
---|
418 | *outptr = NULL;
|
---|
419 | *outlen = 0;
|
---|
420 |
|
---|
421 | /* Decode the challenge if necessary */
|
---|
422 | if(chlg64len && *chlg64 != '=')
|
---|
423 | result = Curl_base64_decode(chlg64, (unsigned char **) outptr, outlen);
|
---|
424 |
|
---|
425 | return result;
|
---|
426 | }
|
---|
427 |
|
---|
428 | /*
|
---|
429 | * sasl_create_cram_md5_message()
|
---|
430 | *
|
---|
431 | * This is used to generate an already encoded CRAM-MD5 response message ready
|
---|
432 | * for sending to the recipient.
|
---|
433 | *
|
---|
434 | * Parameters:
|
---|
435 | *
|
---|
436 | * data [in] - The session handle.
|
---|
437 | * chlg [in] - The challenge.
|
---|
438 | * userp [in] - The user name.
|
---|
439 | * passdwp [in] - The user's password.
|
---|
440 | * outptr [in/out] - The address where a pointer to newly allocated memory
|
---|
441 | * holding the result will be stored upon completion.
|
---|
442 | * outlen [out] - The length of the output message.
|
---|
443 | *
|
---|
444 | * Returns CURLE_OK on success.
|
---|
445 | */
|
---|
446 | static CURLcode sasl_create_cram_md5_message(struct SessionHandle *data,
|
---|
447 | const char *chlg,
|
---|
448 | const char *userp,
|
---|
449 | const char *passwdp,
|
---|
450 | char **outptr, size_t *outlen)
|
---|
451 | {
|
---|
452 | CURLcode result = CURLE_OK;
|
---|
453 | size_t chlglen = 0;
|
---|
454 | HMAC_context *ctxt;
|
---|
455 | unsigned char digest[MD5_DIGEST_LEN];
|
---|
456 | char *response;
|
---|
457 |
|
---|
458 | if(chlg)
|
---|
459 | chlglen = strlen(chlg);
|
---|
460 |
|
---|
461 | /* Compute the digest using the password as the key */
|
---|
462 | ctxt = Curl_HMAC_init(Curl_HMAC_MD5,
|
---|
463 | (const unsigned char *) passwdp,
|
---|
464 | curlx_uztoui(strlen(passwdp)));
|
---|
465 | if(!ctxt)
|
---|
466 | return CURLE_OUT_OF_MEMORY;
|
---|
467 |
|
---|
468 | /* Update the digest with the given challenge */
|
---|
469 | if(chlglen > 0)
|
---|
470 | Curl_HMAC_update(ctxt, (const unsigned char *) chlg,
|
---|
471 | curlx_uztoui(chlglen));
|
---|
472 |
|
---|
473 | /* Finalise the digest */
|
---|
474 | Curl_HMAC_final(ctxt, digest);
|
---|
475 |
|
---|
476 | /* Generate the response */
|
---|
477 | response = aprintf(
|
---|
478 | "%s %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
|
---|
479 | userp, digest[0], digest[1], digest[2], digest[3], digest[4],
|
---|
480 | digest[5], digest[6], digest[7], digest[8], digest[9], digest[10],
|
---|
481 | digest[11], digest[12], digest[13], digest[14], digest[15]);
|
---|
482 | if(!response)
|
---|
483 | return CURLE_OUT_OF_MEMORY;
|
---|
484 |
|
---|
485 | /* Base64 encode the response */
|
---|
486 | result = Curl_base64_encode(data, response, 0, outptr, outlen);
|
---|
487 |
|
---|
488 | free(response);
|
---|
489 |
|
---|
490 | return result;
|
---|
491 | }
|
---|
492 |
|
---|
493 | #ifndef USE_WINDOWS_SSPI
|
---|
494 | /*
|
---|
495 | * sasl_decode_digest_md5_message()
|
---|
496 | *
|
---|
497 | * This is used internally to decode an already encoded DIGEST-MD5 challenge
|
---|
498 | * message into the seperate attributes.
|
---|
499 | *
|
---|
500 | * Parameters:
|
---|
501 | *
|
---|
502 | * chlg64 [in] - The base64 encoded challenge message.
|
---|
503 | * nonce [in/out] - The buffer where the nonce will be stored.
|
---|
504 | * nlen [in] - The length of the nonce buffer.
|
---|
505 | * realm [in/out] - The buffer where the realm will be stored.
|
---|
506 | * rlen [in] - The length of the realm buffer.
|
---|
507 | * alg [in/out] - The buffer where the algorithm will be stored.
|
---|
508 | * alen [in] - The length of the algorithm buffer.
|
---|
509 | * qop [in/out] - The buffer where the qop-options will be stored.
|
---|
510 | * qlen [in] - The length of the qop buffer.
|
---|
511 | *
|
---|
512 | * Returns CURLE_OK on success.
|
---|
513 | */
|
---|
514 | static CURLcode sasl_decode_digest_md5_message(const char *chlg64,
|
---|
515 | char *nonce, size_t nlen,
|
---|
516 | char *realm, size_t rlen,
|
---|
517 | char *alg, size_t alen,
|
---|
518 | char *qop, size_t qlen)
|
---|
519 | {
|
---|
520 | CURLcode result = CURLE_OK;
|
---|
521 | unsigned char *chlg = NULL;
|
---|
522 | size_t chlglen = 0;
|
---|
523 | size_t chlg64len = strlen(chlg64);
|
---|
524 |
|
---|
525 | /* Decode the base-64 encoded challenge message */
|
---|
526 | if(chlg64len && *chlg64 != '=') {
|
---|
527 | result = Curl_base64_decode(chlg64, &chlg, &chlglen);
|
---|
528 | if(result)
|
---|
529 | return result;
|
---|
530 | }
|
---|
531 |
|
---|
532 | /* Ensure we have a valid challenge message */
|
---|
533 | if(!chlg)
|
---|
534 | return CURLE_BAD_CONTENT_ENCODING;
|
---|
535 |
|
---|
536 | /* Retrieve nonce string from the challenge */
|
---|
537 | if(!sasl_digest_get_key_value((char *)chlg, "nonce=\"", nonce, nlen, '\"')) {
|
---|
538 | free(chlg);
|
---|
539 | return CURLE_BAD_CONTENT_ENCODING;
|
---|
540 | }
|
---|
541 |
|
---|
542 | /* Retrieve realm string from the challenge */
|
---|
543 | if(!sasl_digest_get_key_value((char *)chlg, "realm=\"", realm, rlen, '\"')) {
|
---|
544 | /* Challenge does not have a realm, set empty string [RFC2831] page 6 */
|
---|
545 | strcpy(realm, "");
|
---|
546 | }
|
---|
547 |
|
---|
548 | /* Retrieve algorithm string from the challenge */
|
---|
549 | if(!sasl_digest_get_key_value((char *)chlg, "algorithm=", alg, alen, ',')) {
|
---|
550 | free(chlg);
|
---|
551 | return CURLE_BAD_CONTENT_ENCODING;
|
---|
552 | }
|
---|
553 |
|
---|
554 | /* Retrieve qop-options string from the challenge */
|
---|
555 | if(!sasl_digest_get_key_value((char *)chlg, "qop=\"", qop, qlen, '\"')) {
|
---|
556 | free(chlg);
|
---|
557 | return CURLE_BAD_CONTENT_ENCODING;
|
---|
558 | }
|
---|
559 |
|
---|
560 | free(chlg);
|
---|
561 |
|
---|
562 | return CURLE_OK;
|
---|
563 | }
|
---|
564 |
|
---|
565 | /*
|
---|
566 | * Curl_sasl_create_digest_md5_message()
|
---|
567 | *
|
---|
568 | * This is used to generate an already encoded DIGEST-MD5 response message
|
---|
569 | * ready for sending to the recipient.
|
---|
570 | *
|
---|
571 | * Parameters:
|
---|
572 | *
|
---|
573 | * data [in] - The session handle.
|
---|
574 | * chlg64 [in] - The base64 encoded challenge message.
|
---|
575 | * userp [in] - The user name.
|
---|
576 | * passdwp [in] - The user's password.
|
---|
577 | * service [in] - The service type such as www, smtp, pop or imap.
|
---|
578 | * outptr [in/out] - The address where a pointer to newly allocated memory
|
---|
579 | * holding the result will be stored upon completion.
|
---|
580 | * outlen [out] - The length of the output message.
|
---|
581 | *
|
---|
582 | * Returns CURLE_OK on success.
|
---|
583 | */
|
---|
584 | CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
|
---|
585 | const char *chlg64,
|
---|
586 | const char *userp,
|
---|
587 | const char *passwdp,
|
---|
588 | const char *service,
|
---|
589 | char **outptr, size_t *outlen)
|
---|
590 | {
|
---|
591 | CURLcode result = CURLE_OK;
|
---|
592 | size_t i;
|
---|
593 | MD5_context *ctxt;
|
---|
594 | char *response = NULL;
|
---|
595 | unsigned char digest[MD5_DIGEST_LEN];
|
---|
596 | char HA1_hex[2 * MD5_DIGEST_LEN + 1];
|
---|
597 | char HA2_hex[2 * MD5_DIGEST_LEN + 1];
|
---|
598 | char resp_hash_hex[2 * MD5_DIGEST_LEN + 1];
|
---|
599 | char nonce[64];
|
---|
600 | char realm[128];
|
---|
601 | char algorithm[64];
|
---|
602 | char qop_options[64];
|
---|
603 | int qop_values;
|
---|
604 | char cnonce[33];
|
---|
605 | unsigned int entropy[4];
|
---|
606 | char nonceCount[] = "00000001";
|
---|
607 | char method[] = "AUTHENTICATE";
|
---|
608 | char qop[] = DIGEST_QOP_VALUE_STRING_AUTH;
|
---|
609 | char *spn = NULL;
|
---|
610 |
|
---|
611 | /* Decode the challange message */
|
---|
612 | result = sasl_decode_digest_md5_message(chlg64, nonce, sizeof(nonce),
|
---|
613 | realm, sizeof(realm),
|
---|
614 | algorithm, sizeof(algorithm),
|
---|
615 | qop_options, sizeof(qop_options));
|
---|
616 | if(result)
|
---|
617 | return result;
|
---|
618 |
|
---|
619 | /* We only support md5 sessions */
|
---|
620 | if(strcmp(algorithm, "md5-sess") != 0)
|
---|
621 | return CURLE_BAD_CONTENT_ENCODING;
|
---|
622 |
|
---|
623 | /* Get the qop-values from the qop-options */
|
---|
624 | result = sasl_digest_get_qop_values(qop_options, &qop_values);
|
---|
625 | if(result)
|
---|
626 | return result;
|
---|
627 |
|
---|
628 | /* We only support auth quality-of-protection */
|
---|
629 | if(!(qop_values & DIGEST_QOP_VALUE_AUTH))
|
---|
630 | return CURLE_BAD_CONTENT_ENCODING;
|
---|
631 |
|
---|
632 | /* Generate 16 bytes of random data */
|
---|
633 | entropy[0] = Curl_rand(data);
|
---|
634 | entropy[1] = Curl_rand(data);
|
---|
635 | entropy[2] = Curl_rand(data);
|
---|
636 | entropy[3] = Curl_rand(data);
|
---|
637 |
|
---|
638 | /* Convert the random data into a 32 byte hex string */
|
---|
639 | snprintf(cnonce, sizeof(cnonce), "%08x%08x%08x%08x",
|
---|
640 | entropy[0], entropy[1], entropy[2], entropy[3]);
|
---|
641 |
|
---|
642 | /* So far so good, now calculate A1 and H(A1) according to RFC 2831 */
|
---|
643 | ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
|
---|
644 | if(!ctxt)
|
---|
645 | return CURLE_OUT_OF_MEMORY;
|
---|
646 |
|
---|
647 | Curl_MD5_update(ctxt, (const unsigned char *) userp,
|
---|
648 | curlx_uztoui(strlen(userp)));
|
---|
649 | Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
---|
650 | Curl_MD5_update(ctxt, (const unsigned char *) realm,
|
---|
651 | curlx_uztoui(strlen(realm)));
|
---|
652 | Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
---|
653 | Curl_MD5_update(ctxt, (const unsigned char *) passwdp,
|
---|
654 | curlx_uztoui(strlen(passwdp)));
|
---|
655 | Curl_MD5_final(ctxt, digest);
|
---|
656 |
|
---|
657 | ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
|
---|
658 | if(!ctxt)
|
---|
659 | return CURLE_OUT_OF_MEMORY;
|
---|
660 |
|
---|
661 | Curl_MD5_update(ctxt, (const unsigned char *) digest, MD5_DIGEST_LEN);
|
---|
662 | Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
---|
663 | Curl_MD5_update(ctxt, (const unsigned char *) nonce,
|
---|
664 | curlx_uztoui(strlen(nonce)));
|
---|
665 | Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
---|
666 | Curl_MD5_update(ctxt, (const unsigned char *) cnonce,
|
---|
667 | curlx_uztoui(strlen(cnonce)));
|
---|
668 | Curl_MD5_final(ctxt, digest);
|
---|
669 |
|
---|
670 | /* Convert calculated 16 octet hex into 32 bytes string */
|
---|
671 | for(i = 0; i < MD5_DIGEST_LEN; i++)
|
---|
672 | snprintf(&HA1_hex[2 * i], 3, "%02x", digest[i]);
|
---|
673 |
|
---|
674 | /* Generate our SPN */
|
---|
675 | spn = Curl_sasl_build_spn(service, realm);
|
---|
676 | if(!spn)
|
---|
677 | return CURLE_OUT_OF_MEMORY;
|
---|
678 |
|
---|
679 | /* Calculate H(A2) */
|
---|
680 | ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
|
---|
681 | if(!ctxt) {
|
---|
682 | free(spn);
|
---|
683 |
|
---|
684 | return CURLE_OUT_OF_MEMORY;
|
---|
685 | }
|
---|
686 |
|
---|
687 | Curl_MD5_update(ctxt, (const unsigned char *) method,
|
---|
688 | curlx_uztoui(strlen(method)));
|
---|
689 | Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
---|
690 | Curl_MD5_update(ctxt, (const unsigned char *) spn,
|
---|
691 | curlx_uztoui(strlen(spn)));
|
---|
692 | Curl_MD5_final(ctxt, digest);
|
---|
693 |
|
---|
694 | for(i = 0; i < MD5_DIGEST_LEN; i++)
|
---|
695 | snprintf(&HA2_hex[2 * i], 3, "%02x", digest[i]);
|
---|
696 |
|
---|
697 | /* Now calculate the response hash */
|
---|
698 | ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
|
---|
699 | if(!ctxt) {
|
---|
700 | free(spn);
|
---|
701 |
|
---|
702 | return CURLE_OUT_OF_MEMORY;
|
---|
703 | }
|
---|
704 |
|
---|
705 | Curl_MD5_update(ctxt, (const unsigned char *) HA1_hex, 2 * MD5_DIGEST_LEN);
|
---|
706 | Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
---|
707 | Curl_MD5_update(ctxt, (const unsigned char *) nonce,
|
---|
708 | curlx_uztoui(strlen(nonce)));
|
---|
709 | Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
---|
710 |
|
---|
711 | Curl_MD5_update(ctxt, (const unsigned char *) nonceCount,
|
---|
712 | curlx_uztoui(strlen(nonceCount)));
|
---|
713 | Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
---|
714 | Curl_MD5_update(ctxt, (const unsigned char *) cnonce,
|
---|
715 | curlx_uztoui(strlen(cnonce)));
|
---|
716 | Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
---|
717 | Curl_MD5_update(ctxt, (const unsigned char *) qop,
|
---|
718 | curlx_uztoui(strlen(qop)));
|
---|
719 | Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
---|
720 |
|
---|
721 | Curl_MD5_update(ctxt, (const unsigned char *) HA2_hex, 2 * MD5_DIGEST_LEN);
|
---|
722 | Curl_MD5_final(ctxt, digest);
|
---|
723 |
|
---|
724 | for(i = 0; i < MD5_DIGEST_LEN; i++)
|
---|
725 | snprintf(&resp_hash_hex[2 * i], 3, "%02x", digest[i]);
|
---|
726 |
|
---|
727 | /* Generate the response */
|
---|
728 | response = aprintf("username=\"%s\",realm=\"%s\",nonce=\"%s\","
|
---|
729 | "cnonce=\"%s\",nc=\"%s\",digest-uri=\"%s\",response=%s,"
|
---|
730 | "qop=%s",
|
---|
731 | userp, realm, nonce,
|
---|
732 | cnonce, nonceCount, spn, resp_hash_hex, qop);
|
---|
733 | free(spn);
|
---|
734 | if(!response)
|
---|
735 | return CURLE_OUT_OF_MEMORY;
|
---|
736 |
|
---|
737 | /* Base64 encode the response */
|
---|
738 | result = Curl_base64_encode(data, response, 0, outptr, outlen);
|
---|
739 |
|
---|
740 | free(response);
|
---|
741 |
|
---|
742 | return result;
|
---|
743 | }
|
---|
744 |
|
---|
745 | /*
|
---|
746 | * Curl_sasl_decode_digest_http_message()
|
---|
747 | *
|
---|
748 | * This is used to decode a HTTP DIGEST challenge message into the seperate
|
---|
749 | * attributes.
|
---|
750 | *
|
---|
751 | * Parameters:
|
---|
752 | *
|
---|
753 | * chlg [in] - The challenge message.
|
---|
754 | * digest [in/out] - The digest data struct being used and modified.
|
---|
755 | *
|
---|
756 | * Returns CURLE_OK on success.
|
---|
757 | */
|
---|
758 | CURLcode Curl_sasl_decode_digest_http_message(const char *chlg,
|
---|
759 | struct digestdata *digest)
|
---|
760 | {
|
---|
761 | bool before = FALSE; /* got a nonce before */
|
---|
762 | bool foundAuth = FALSE;
|
---|
763 | bool foundAuthInt = FALSE;
|
---|
764 | char *token = NULL;
|
---|
765 | char *tmp = NULL;
|
---|
766 |
|
---|
767 | /* If we already have received a nonce, keep that in mind */
|
---|
768 | if(digest->nonce)
|
---|
769 | before = TRUE;
|
---|
770 |
|
---|
771 | /* Clean up any former leftovers and initialise to defaults */
|
---|
772 | Curl_sasl_digest_cleanup(digest);
|
---|
773 |
|
---|
774 | for(;;) {
|
---|
775 | char value[DIGEST_MAX_VALUE_LENGTH];
|
---|
776 | char content[DIGEST_MAX_CONTENT_LENGTH];
|
---|
777 |
|
---|
778 | /* Pass all additional spaces here */
|
---|
779 | while(*chlg && ISSPACE(*chlg))
|
---|
780 | chlg++;
|
---|
781 |
|
---|
782 | /* Extract a value=content pair */
|
---|
783 | if(!Curl_sasl_digest_get_pair(chlg, value, content, &chlg)) {
|
---|
784 | if(Curl_raw_equal(value, "nonce")) {
|
---|
785 | digest->nonce = strdup(content);
|
---|
786 | if(!digest->nonce)
|
---|
787 | return CURLE_OUT_OF_MEMORY;
|
---|
788 | }
|
---|
789 | else if(Curl_raw_equal(value, "stale")) {
|
---|
790 | if(Curl_raw_equal(content, "true")) {
|
---|
791 | digest->stale = TRUE;
|
---|
792 | digest->nc = 1; /* we make a new nonce now */
|
---|
793 | }
|
---|
794 | }
|
---|
795 | else if(Curl_raw_equal(value, "realm")) {
|
---|
796 | digest->realm = strdup(content);
|
---|
797 | if(!digest->realm)
|
---|
798 | return CURLE_OUT_OF_MEMORY;
|
---|
799 | }
|
---|
800 | else if(Curl_raw_equal(value, "opaque")) {
|
---|
801 | digest->opaque = strdup(content);
|
---|
802 | if(!digest->opaque)
|
---|
803 | return CURLE_OUT_OF_MEMORY;
|
---|
804 | }
|
---|
805 | else if(Curl_raw_equal(value, "qop")) {
|
---|
806 | char *tok_buf;
|
---|
807 | /* Tokenize the list and choose auth if possible, use a temporary
|
---|
808 | clone of the buffer since strtok_r() ruins it */
|
---|
809 | tmp = strdup(content);
|
---|
810 | if(!tmp)
|
---|
811 | return CURLE_OUT_OF_MEMORY;
|
---|
812 |
|
---|
813 | token = strtok_r(tmp, ",", &tok_buf);
|
---|
814 | while(token != NULL) {
|
---|
815 | if(Curl_raw_equal(token, DIGEST_QOP_VALUE_STRING_AUTH)) {
|
---|
816 | foundAuth = TRUE;
|
---|
817 | }
|
---|
818 | else if(Curl_raw_equal(token, DIGEST_QOP_VALUE_STRING_AUTH_INT)) {
|
---|
819 | foundAuthInt = TRUE;
|
---|
820 | }
|
---|
821 | token = strtok_r(NULL, ",", &tok_buf);
|
---|
822 | }
|
---|
823 |
|
---|
824 | free(tmp);
|
---|
825 |
|
---|
826 | /* Select only auth or auth-int. Otherwise, ignore */
|
---|
827 | if(foundAuth) {
|
---|
828 | digest->qop = strdup(DIGEST_QOP_VALUE_STRING_AUTH);
|
---|
829 | if(!digest->qop)
|
---|
830 | return CURLE_OUT_OF_MEMORY;
|
---|
831 | }
|
---|
832 | else if(foundAuthInt) {
|
---|
833 | digest->qop = strdup(DIGEST_QOP_VALUE_STRING_AUTH_INT);
|
---|
834 | if(!digest->qop)
|
---|
835 | return CURLE_OUT_OF_MEMORY;
|
---|
836 | }
|
---|
837 | }
|
---|
838 | else if(Curl_raw_equal(value, "algorithm")) {
|
---|
839 | digest->algorithm = strdup(content);
|
---|
840 | if(!digest->algorithm)
|
---|
841 | return CURLE_OUT_OF_MEMORY;
|
---|
842 |
|
---|
843 | if(Curl_raw_equal(content, "MD5-sess"))
|
---|
844 | digest->algo = CURLDIGESTALGO_MD5SESS;
|
---|
845 | else if(Curl_raw_equal(content, "MD5"))
|
---|
846 | digest->algo = CURLDIGESTALGO_MD5;
|
---|
847 | else
|
---|
848 | return CURLE_BAD_CONTENT_ENCODING;
|
---|
849 | }
|
---|
850 | else {
|
---|
851 | /* unknown specifier, ignore it! */
|
---|
852 | }
|
---|
853 | }
|
---|
854 | else
|
---|
855 | break; /* we're done here */
|
---|
856 |
|
---|
857 | /* Pass all additional spaces here */
|
---|
858 | while(*chlg && ISSPACE(*chlg))
|
---|
859 | chlg++;
|
---|
860 |
|
---|
861 | /* Allow the list to be comma-separated */
|
---|
862 | if(',' == *chlg)
|
---|
863 | chlg++;
|
---|
864 | }
|
---|
865 |
|
---|
866 | /* We had a nonce since before, and we got another one now without
|
---|
867 | 'stale=true'. This means we provided bad credentials in the previous
|
---|
868 | request */
|
---|
869 | if(before && !digest->stale)
|
---|
870 | return CURLE_BAD_CONTENT_ENCODING;
|
---|
871 |
|
---|
872 | /* We got this header without a nonce, that's a bad Digest line! */
|
---|
873 | if(!digest->nonce)
|
---|
874 | return CURLE_BAD_CONTENT_ENCODING;
|
---|
875 |
|
---|
876 | return CURLE_OK;
|
---|
877 | }
|
---|
878 |
|
---|
879 | /*
|
---|
880 | * Curl_sasl_create_digest_http_message()
|
---|
881 | *
|
---|
882 | * This is used to generate a HTTP DIGEST response message ready for sending
|
---|
883 | * to the recipient.
|
---|
884 | *
|
---|
885 | * Parameters:
|
---|
886 | *
|
---|
887 | * data [in] - The session handle.
|
---|
888 | * userp [in] - The user name.
|
---|
889 | * passdwp [in] - The user's password.
|
---|
890 | * request [in] - The HTTP request.
|
---|
891 | * uripath [in] - The path of the HTTP uri.
|
---|
892 | * digest [in/out] - The digest data struct being used and modified.
|
---|
893 | * outptr [in/out] - The address where a pointer to newly allocated memory
|
---|
894 | * holding the result will be stored upon completion.
|
---|
895 | * outlen [out] - The length of the output message.
|
---|
896 | *
|
---|
897 | * Returns CURLE_OK on success.
|
---|
898 | */
|
---|
899 | CURLcode Curl_sasl_create_digest_http_message(struct SessionHandle *data,
|
---|
900 | const char *userp,
|
---|
901 | const char *passwdp,
|
---|
902 | const unsigned char *request,
|
---|
903 | const unsigned char *uripath,
|
---|
904 | struct digestdata *digest,
|
---|
905 | char **outptr, size_t *outlen)
|
---|
906 | {
|
---|
907 | CURLcode result;
|
---|
908 | unsigned char md5buf[16]; /* 16 bytes/128 bits */
|
---|
909 | unsigned char request_digest[33];
|
---|
910 | unsigned char *md5this;
|
---|
911 | unsigned char ha1[33];/* 32 digits and 1 zero byte */
|
---|
912 | unsigned char ha2[33];/* 32 digits and 1 zero byte */
|
---|
913 | char cnoncebuf[33];
|
---|
914 | char *cnonce = NULL;
|
---|
915 | size_t cnonce_sz = 0;
|
---|
916 | char *userp_quoted;
|
---|
917 | char *response = NULL;
|
---|
918 | char *tmp = NULL;
|
---|
919 |
|
---|
920 | if(!digest->nc)
|
---|
921 | digest->nc = 1;
|
---|
922 |
|
---|
923 | if(!digest->cnonce) {
|
---|
924 | snprintf(cnoncebuf, sizeof(cnoncebuf), "%08x%08x%08x%08x",
|
---|
925 | Curl_rand(data), Curl_rand(data),
|
---|
926 | Curl_rand(data), Curl_rand(data));
|
---|
927 |
|
---|
928 | result = Curl_base64_encode(data, cnoncebuf, strlen(cnoncebuf),
|
---|
929 | &cnonce, &cnonce_sz);
|
---|
930 | if(result)
|
---|
931 | return result;
|
---|
932 |
|
---|
933 | digest->cnonce = cnonce;
|
---|
934 | }
|
---|
935 |
|
---|
936 | /*
|
---|
937 | if the algorithm is "MD5" or unspecified (which then defaults to MD5):
|
---|
938 |
|
---|
939 | A1 = unq(username-value) ":" unq(realm-value) ":" passwd
|
---|
940 |
|
---|
941 | if the algorithm is "MD5-sess" then:
|
---|
942 |
|
---|
943 | A1 = H( unq(username-value) ":" unq(realm-value) ":" passwd )
|
---|
944 | ":" unq(nonce-value) ":" unq(cnonce-value)
|
---|
945 | */
|
---|
946 |
|
---|
947 | md5this = (unsigned char *)
|
---|
948 | aprintf("%s:%s:%s", userp, digest->realm, passwdp);
|
---|
949 | if(!md5this)
|
---|
950 | return CURLE_OUT_OF_MEMORY;
|
---|
951 |
|
---|
952 | CURL_OUTPUT_DIGEST_CONV(data, md5this); /* convert on non-ASCII machines */
|
---|
953 | Curl_md5it(md5buf, md5this);
|
---|
954 | free(md5this);
|
---|
955 | sasl_digest_md5_to_ascii(md5buf, ha1);
|
---|
956 |
|
---|
957 | if(digest->algo == CURLDIGESTALGO_MD5SESS) {
|
---|
958 | /* nonce and cnonce are OUTSIDE the hash */
|
---|
959 | tmp = aprintf("%s:%s:%s", ha1, digest->nonce, digest->cnonce);
|
---|
960 | if(!tmp)
|
---|
961 | return CURLE_OUT_OF_MEMORY;
|
---|
962 |
|
---|
963 | CURL_OUTPUT_DIGEST_CONV(data, tmp); /* convert on non-ASCII machines */
|
---|
964 | Curl_md5it(md5buf, (unsigned char *)tmp);
|
---|
965 | free(tmp);
|
---|
966 | sasl_digest_md5_to_ascii(md5buf, ha1);
|
---|
967 | }
|
---|
968 |
|
---|
969 | /*
|
---|
970 | If the "qop" directive's value is "auth" or is unspecified, then A2 is:
|
---|
971 |
|
---|
972 | A2 = Method ":" digest-uri-value
|
---|
973 |
|
---|
974 | If the "qop" value is "auth-int", then A2 is:
|
---|
975 |
|
---|
976 | A2 = Method ":" digest-uri-value ":" H(entity-body)
|
---|
977 |
|
---|
978 | (The "Method" value is the HTTP request method as specified in section
|
---|
979 | 5.1.1 of RFC 2616)
|
---|
980 | */
|
---|
981 |
|
---|
982 | md5this = (unsigned char *)aprintf("%s:%s", request, uripath);
|
---|
983 |
|
---|
984 | if(digest->qop && Curl_raw_equal(digest->qop, "auth-int")) {
|
---|
985 | /* We don't support auth-int for PUT or POST at the moment.
|
---|
986 | TODO: replace md5 of empty string with entity-body for PUT/POST */
|
---|
987 | unsigned char *md5this2 = (unsigned char *)
|
---|
988 | aprintf("%s:%s", md5this, "d41d8cd98f00b204e9800998ecf8427e");
|
---|
989 | free(md5this);
|
---|
990 | md5this = md5this2;
|
---|
991 | }
|
---|
992 |
|
---|
993 | if(!md5this)
|
---|
994 | return CURLE_OUT_OF_MEMORY;
|
---|
995 |
|
---|
996 | CURL_OUTPUT_DIGEST_CONV(data, md5this); /* convert on non-ASCII machines */
|
---|
997 | Curl_md5it(md5buf, md5this);
|
---|
998 | free(md5this);
|
---|
999 | sasl_digest_md5_to_ascii(md5buf, ha2);
|
---|
1000 |
|
---|
1001 | if(digest->qop) {
|
---|
1002 | md5this = (unsigned char *)aprintf("%s:%s:%08x:%s:%s:%s",
|
---|
1003 | ha1,
|
---|
1004 | digest->nonce,
|
---|
1005 | digest->nc,
|
---|
1006 | digest->cnonce,
|
---|
1007 | digest->qop,
|
---|
1008 | ha2);
|
---|
1009 | }
|
---|
1010 | else {
|
---|
1011 | md5this = (unsigned char *)aprintf("%s:%s:%s",
|
---|
1012 | ha1,
|
---|
1013 | digest->nonce,
|
---|
1014 | ha2);
|
---|
1015 | }
|
---|
1016 |
|
---|
1017 | if(!md5this)
|
---|
1018 | return CURLE_OUT_OF_MEMORY;
|
---|
1019 |
|
---|
1020 | CURL_OUTPUT_DIGEST_CONV(data, md5this); /* convert on non-ASCII machines */
|
---|
1021 | Curl_md5it(md5buf, md5this);
|
---|
1022 | free(md5this);
|
---|
1023 | sasl_digest_md5_to_ascii(md5buf, request_digest);
|
---|
1024 |
|
---|
1025 | /* for test case 64 (snooped from a Mozilla 1.3a request)
|
---|
1026 |
|
---|
1027 | Authorization: Digest username="testuser", realm="testrealm", \
|
---|
1028 | nonce="1053604145", uri="/64", response="c55f7f30d83d774a3d2dcacf725abaca"
|
---|
1029 |
|
---|
1030 | Digest parameters are all quoted strings. Username which is provided by
|
---|
1031 | the user will need double quotes and backslashes within it escaped. For
|
---|
1032 | the other fields, this shouldn't be an issue. realm, nonce, and opaque
|
---|
1033 | are copied as is from the server, escapes and all. cnonce is generated
|
---|
1034 | with web-safe characters. uri is already percent encoded. nc is 8 hex
|
---|
1035 | characters. algorithm and qop with standard values only contain web-safe
|
---|
1036 | chracters.
|
---|
1037 | */
|
---|
1038 | userp_quoted = sasl_digest_string_quoted(userp);
|
---|
1039 | if(!userp_quoted)
|
---|
1040 | return CURLE_OUT_OF_MEMORY;
|
---|
1041 |
|
---|
1042 | if(digest->qop) {
|
---|
1043 | response = aprintf("username=\"%s\", "
|
---|
1044 | "realm=\"%s\", "
|
---|
1045 | "nonce=\"%s\", "
|
---|
1046 | "uri=\"%s\", "
|
---|
1047 | "cnonce=\"%s\", "
|
---|
1048 | "nc=%08x, "
|
---|
1049 | "qop=%s, "
|
---|
1050 | "response=\"%s\"",
|
---|
1051 | userp_quoted,
|
---|
1052 | digest->realm,
|
---|
1053 | digest->nonce,
|
---|
1054 | uripath,
|
---|
1055 | digest->cnonce,
|
---|
1056 | digest->nc,
|
---|
1057 | digest->qop,
|
---|
1058 | request_digest);
|
---|
1059 |
|
---|
1060 | if(Curl_raw_equal(digest->qop, "auth"))
|
---|
1061 | digest->nc++; /* The nc (from RFC) has to be a 8 hex digit number 0
|
---|
1062 | padded which tells to the server how many times you are
|
---|
1063 | using the same nonce in the qop=auth mode */
|
---|
1064 | }
|
---|
1065 | else {
|
---|
1066 | response = aprintf("username=\"%s\", "
|
---|
1067 | "realm=\"%s\", "
|
---|
1068 | "nonce=\"%s\", "
|
---|
1069 | "uri=\"%s\", "
|
---|
1070 | "response=\"%s\"",
|
---|
1071 | userp_quoted,
|
---|
1072 | digest->realm,
|
---|
1073 | digest->nonce,
|
---|
1074 | uripath,
|
---|
1075 | request_digest);
|
---|
1076 | }
|
---|
1077 | free(userp_quoted);
|
---|
1078 | if(!response)
|
---|
1079 | return CURLE_OUT_OF_MEMORY;
|
---|
1080 |
|
---|
1081 | /* Add the optional fields */
|
---|
1082 | if(digest->opaque) {
|
---|
1083 | /* Append the opaque */
|
---|
1084 | tmp = aprintf("%s, opaque=\"%s\"", response, digest->opaque);
|
---|
1085 | free(response);
|
---|
1086 | if(!tmp)
|
---|
1087 | return CURLE_OUT_OF_MEMORY;
|
---|
1088 |
|
---|
1089 | response = tmp;
|
---|
1090 | }
|
---|
1091 |
|
---|
1092 | if(digest->algorithm) {
|
---|
1093 | /* Append the algorithm */
|
---|
1094 | tmp = aprintf("%s, algorithm=\"%s\"", response, digest->algorithm);
|
---|
1095 | free(response);
|
---|
1096 | if(!tmp)
|
---|
1097 | return CURLE_OUT_OF_MEMORY;
|
---|
1098 |
|
---|
1099 | response = tmp;
|
---|
1100 | }
|
---|
1101 |
|
---|
1102 | /* Return the output */
|
---|
1103 | *outptr = response;
|
---|
1104 | *outlen = strlen(response);
|
---|
1105 |
|
---|
1106 | return CURLE_OK;
|
---|
1107 | }
|
---|
1108 |
|
---|
1109 | /*
|
---|
1110 | * Curl_sasl_digest_cleanup()
|
---|
1111 | *
|
---|
1112 | * This is used to clean up the digest specific data.
|
---|
1113 | *
|
---|
1114 | * Parameters:
|
---|
1115 | *
|
---|
1116 | * digest [in/out] - The digest data struct being cleaned up.
|
---|
1117 | *
|
---|
1118 | */
|
---|
1119 | void Curl_sasl_digest_cleanup(struct digestdata *digest)
|
---|
1120 | {
|
---|
1121 | Curl_safefree(digest->nonce);
|
---|
1122 | Curl_safefree(digest->cnonce);
|
---|
1123 | Curl_safefree(digest->realm);
|
---|
1124 | Curl_safefree(digest->opaque);
|
---|
1125 | Curl_safefree(digest->qop);
|
---|
1126 | Curl_safefree(digest->algorithm);
|
---|
1127 |
|
---|
1128 | digest->nc = 0;
|
---|
1129 | digest->algo = CURLDIGESTALGO_MD5; /* default algorithm */
|
---|
1130 | digest->stale = FALSE; /* default means normal, not stale */
|
---|
1131 | }
|
---|
1132 | #endif /* !USE_WINDOWS_SSPI */
|
---|
1133 |
|
---|
1134 | #endif /* CURL_DISABLE_CRYPTO_AUTH */
|
---|
1135 |
|
---|
1136 | #if defined(USE_NTLM) && !defined(USE_WINDOWS_SSPI)
|
---|
1137 | /*
|
---|
1138 | * Curl_sasl_ntlm_cleanup()
|
---|
1139 | *
|
---|
1140 | * This is used to clean up the ntlm specific data.
|
---|
1141 | *
|
---|
1142 | * Parameters:
|
---|
1143 | *
|
---|
1144 | * ntlm [in/out] - The ntlm data struct being cleaned up.
|
---|
1145 | *
|
---|
1146 | */
|
---|
1147 | void Curl_sasl_ntlm_cleanup(struct ntlmdata *ntlm)
|
---|
1148 | {
|
---|
1149 | /* Free the target info */
|
---|
1150 | Curl_safefree(ntlm->target_info);
|
---|
1151 |
|
---|
1152 | /* Reset any variables */
|
---|
1153 | ntlm->target_info_len = 0;
|
---|
1154 | }
|
---|
1155 | #endif /* USE_NTLM && !USE_WINDOWS_SSPI*/
|
---|
1156 |
|
---|
1157 | /*
|
---|
1158 | * sasl_create_oauth_bearer_message()
|
---|
1159 | *
|
---|
1160 | * This is used to generate an already encoded OAuth 2.0 message ready for
|
---|
1161 | * sending to the recipient.
|
---|
1162 | *
|
---|
1163 | * Parameters:
|
---|
1164 | *
|
---|
1165 | * data [in] - The session handle.
|
---|
1166 | * user [in] - The user name.
|
---|
1167 | * host [in] - The host name (for OAUTHBEARER).
|
---|
1168 | * port [in] - The port (for OAUTHBEARER when not Port 80).
|
---|
1169 | * bearer [in] - The bearer token.
|
---|
1170 | * outptr [in/out] - The address where a pointer to newly allocated memory
|
---|
1171 | * holding the result will be stored upon completion.
|
---|
1172 | * outlen [out] - The length of the output message.
|
---|
1173 | *
|
---|
1174 | * Returns CURLE_OK on success.
|
---|
1175 | */
|
---|
1176 | static CURLcode sasl_create_oauth_bearer_message(struct SessionHandle *data,
|
---|
1177 | const char *user,
|
---|
1178 | const char *host,
|
---|
1179 | const long port,
|
---|
1180 | const char *bearer,
|
---|
1181 | char **outptr, size_t *outlen)
|
---|
1182 | {
|
---|
1183 | CURLcode result = CURLE_OK;
|
---|
1184 | char *oauth = NULL;
|
---|
1185 |
|
---|
1186 | /* Generate the message */
|
---|
1187 | if(host == NULL && (port == 0 || port == 80))
|
---|
1188 | oauth = aprintf("user=%s\1auth=Bearer %s\1\1", user, bearer);
|
---|
1189 | else if(port == 0 || port == 80)
|
---|
1190 | oauth = aprintf("user=%s\1host=%s\1auth=Bearer %s\1\1", user, host,
|
---|
1191 | bearer);
|
---|
1192 | else
|
---|
1193 | oauth = aprintf("user=%s\1host=%s\1port=%ld\1auth=Bearer %s\1\1", user,
|
---|
1194 | host, port, bearer);
|
---|
1195 | if(!oauth)
|
---|
1196 | return CURLE_OUT_OF_MEMORY;
|
---|
1197 |
|
---|
1198 | /* Base64 encode the reply */
|
---|
1199 | result = Curl_base64_encode(data, oauth, strlen(oauth), outptr, outlen);
|
---|
1200 |
|
---|
1201 | free(oauth);
|
---|
1202 |
|
---|
1203 | return result;
|
---|
1204 | }
|
---|
1205 |
|
---|
1206 | /*
|
---|
1207 | * Curl_sasl_cleanup()
|
---|
1208 | *
|
---|
1209 | * This is used to cleanup any libraries or curl modules used by the sasl
|
---|
1210 | * functions.
|
---|
1211 | *
|
---|
1212 | * Parameters:
|
---|
1213 | *
|
---|
1214 | * conn [in] - The connection data.
|
---|
1215 | * authused [in] - The authentication mechanism used.
|
---|
1216 | */
|
---|
1217 | void Curl_sasl_cleanup(struct connectdata *conn, unsigned int authused)
|
---|
1218 | {
|
---|
1219 | #if defined(USE_KERBEROS5)
|
---|
1220 | /* Cleanup the gssapi structure */
|
---|
1221 | if(authused == SASL_MECH_GSSAPI) {
|
---|
1222 | Curl_sasl_gssapi_cleanup(&conn->krb5);
|
---|
1223 | }
|
---|
1224 | #endif
|
---|
1225 |
|
---|
1226 | #if defined(USE_NTLM)
|
---|
1227 | /* Cleanup the ntlm structure */
|
---|
1228 | if(authused == SASL_MECH_NTLM) {
|
---|
1229 | Curl_sasl_ntlm_cleanup(&conn->ntlm);
|
---|
1230 | }
|
---|
1231 | #endif
|
---|
1232 |
|
---|
1233 | #if !defined(USE_KERBEROS5) && !defined(USE_NTLM)
|
---|
1234 | /* Reserved for future use */
|
---|
1235 | (void)conn;
|
---|
1236 | (void)authused;
|
---|
1237 | #endif
|
---|
1238 | }
|
---|
1239 |
|
---|
1240 | /*
|
---|
1241 | * Curl_sasl_decode_mech()
|
---|
1242 | *
|
---|
1243 | * Convert a SASL mechanism name into a token.
|
---|
1244 | *
|
---|
1245 | * Parameters:
|
---|
1246 | *
|
---|
1247 | * ptr [in] - The mechanism string.
|
---|
1248 | * maxlen [in] - Maximum mechanism string length.
|
---|
1249 | * len [out] - If not NULL, effective name length.
|
---|
1250 | *
|
---|
1251 | * Returns the SASL mechanism token or 0 if no match.
|
---|
1252 | */
|
---|
1253 | unsigned int Curl_sasl_decode_mech(const char *ptr, size_t maxlen, size_t *len)
|
---|
1254 | {
|
---|
1255 | unsigned int i;
|
---|
1256 | char c;
|
---|
1257 |
|
---|
1258 | for(i = 0; mechtable[i].name; i++) {
|
---|
1259 | if(maxlen >= mechtable[i].len &&
|
---|
1260 | !memcmp(ptr, mechtable[i].name, mechtable[i].len)) {
|
---|
1261 | if(len)
|
---|
1262 | *len = mechtable[i].len;
|
---|
1263 |
|
---|
1264 | if(maxlen == mechtable[i].len)
|
---|
1265 | return mechtable[i].bit;
|
---|
1266 |
|
---|
1267 | c = ptr[mechtable[i].len];
|
---|
1268 | if(!ISUPPER(c) && !ISDIGIT(c) && c != '-' && c != '_')
|
---|
1269 | return mechtable[i].bit;
|
---|
1270 | }
|
---|
1271 | }
|
---|
1272 |
|
---|
1273 | return 0;
|
---|
1274 | }
|
---|
1275 |
|
---|
1276 | /*
|
---|
1277 | * Curl_sasl_parse_url_auth_option()
|
---|
1278 | *
|
---|
1279 | * Parse the URL login options.
|
---|
1280 | */
|
---|
1281 | CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl,
|
---|
1282 | const char *value, size_t len)
|
---|
1283 | {
|
---|
1284 | CURLcode result = CURLE_OK;
|
---|
1285 | unsigned int mechbit;
|
---|
1286 | size_t mechlen;
|
---|
1287 |
|
---|
1288 | if(!len)
|
---|
1289 | return CURLE_URL_MALFORMAT;
|
---|
1290 |
|
---|
1291 | if(sasl->resetprefs) {
|
---|
1292 | sasl->resetprefs = FALSE;
|
---|
1293 | sasl->prefmech = SASL_AUTH_NONE;
|
---|
1294 | }
|
---|
1295 |
|
---|
1296 | if(strnequal(value, "*", len))
|
---|
1297 | sasl->prefmech = SASL_AUTH_DEFAULT;
|
---|
1298 | else if((mechbit = Curl_sasl_decode_mech(value, len, &mechlen)) &&
|
---|
1299 | mechlen == len)
|
---|
1300 | sasl->prefmech |= mechbit;
|
---|
1301 | else
|
---|
1302 | result = CURLE_URL_MALFORMAT;
|
---|
1303 |
|
---|
1304 | return result;
|
---|
1305 | }
|
---|
1306 |
|
---|
1307 | /*
|
---|
1308 | * Curl_sasl_init()
|
---|
1309 | *
|
---|
1310 | * Initializes the SASL structure.
|
---|
1311 | */
|
---|
1312 | void Curl_sasl_init(struct SASL *sasl, const struct SASLproto *params)
|
---|
1313 | {
|
---|
1314 | sasl->params = params; /* Set protocol dependent parameters */
|
---|
1315 | sasl->state = SASL_STOP; /* Not yet running */
|
---|
1316 | sasl->authmechs = SASL_AUTH_NONE; /* No known authentication mechanism yet */
|
---|
1317 | sasl->prefmech = SASL_AUTH_DEFAULT; /* Prefer all mechanisms */
|
---|
1318 | sasl->authused = SASL_AUTH_NONE; /* No the authentication mechanism used */
|
---|
1319 | sasl->resetprefs = TRUE; /* Reset prefmech upon AUTH parsing. */
|
---|
1320 | sasl->mutual_auth = FALSE; /* No mutual authentication (GSSAPI only) */
|
---|
1321 | sasl->force_ir = FALSE; /* Respect external option */
|
---|
1322 | }
|
---|
1323 |
|
---|
1324 | /*
|
---|
1325 | * state()
|
---|
1326 | *
|
---|
1327 | * This is the ONLY way to change SASL state!
|
---|
1328 | */
|
---|
1329 | static void state(struct SASL *sasl, struct connectdata *conn,
|
---|
1330 | saslstate newstate)
|
---|
1331 | {
|
---|
1332 | #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
|
---|
1333 | /* for debug purposes */
|
---|
1334 | static const char * const names[]={
|
---|
1335 | "STOP",
|
---|
1336 | "PLAIN",
|
---|
1337 | "LOGIN",
|
---|
1338 | "LOGIN_PASSWD",
|
---|
1339 | "EXTERNAL",
|
---|
1340 | "CRAMMD5",
|
---|
1341 | "DIGESTMD5",
|
---|
1342 | "DIGESTMD5_RESP",
|
---|
1343 | "NTLM",
|
---|
1344 | "NTLM_TYPE2MSG",
|
---|
1345 | "GSSAPI",
|
---|
1346 | "GSSAPI_TOKEN",
|
---|
1347 | "GSSAPI_NO_DATA",
|
---|
1348 | "OAUTH2",
|
---|
1349 | "OAUTH2_RESP",
|
---|
1350 | "CANCEL",
|
---|
1351 | "FINAL",
|
---|
1352 | /* LAST */
|
---|
1353 | };
|
---|
1354 |
|
---|
1355 | if(sasl->state != newstate)
|
---|
1356 | infof(conn->data, "SASL %p state change from %s to %s\n",
|
---|
1357 | (void *)sasl, names[sasl->state], names[newstate]);
|
---|
1358 | #else
|
---|
1359 | (void) conn;
|
---|
1360 | #endif
|
---|
1361 |
|
---|
1362 | sasl->state = newstate;
|
---|
1363 | }
|
---|
1364 |
|
---|
1365 | /*
|
---|
1366 | * Curl_sasl_can_authenticate()
|
---|
1367 | *
|
---|
1368 | * Check if we have enough auth data and capabilities to authenticate.
|
---|
1369 | */
|
---|
1370 | bool Curl_sasl_can_authenticate(struct SASL *sasl, struct connectdata *conn)
|
---|
1371 | {
|
---|
1372 | /* Have credentials been provided? */
|
---|
1373 | if(conn->bits.user_passwd)
|
---|
1374 | return TRUE;
|
---|
1375 |
|
---|
1376 | /* EXTERNAL can authenticate without a user name and/or password */
|
---|
1377 | if(sasl->authmechs & sasl->prefmech & SASL_MECH_EXTERNAL)
|
---|
1378 | return TRUE;
|
---|
1379 |
|
---|
1380 | return FALSE;
|
---|
1381 | }
|
---|
1382 |
|
---|
1383 | /*
|
---|
1384 | * Curl_sasl_start()
|
---|
1385 | *
|
---|
1386 | * Calculate the required login details for SASL authentication.
|
---|
1387 | */
|
---|
1388 | CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
|
---|
1389 | bool force_ir, saslprogress *progress)
|
---|
1390 | {
|
---|
1391 | CURLcode result = CURLE_OK;
|
---|
1392 | struct SessionHandle *data = conn->data;
|
---|
1393 | unsigned int enabledmechs;
|
---|
1394 | const char *mech = NULL;
|
---|
1395 | char *resp = NULL;
|
---|
1396 | size_t len = 0;
|
---|
1397 | saslstate state1 = SASL_STOP;
|
---|
1398 | saslstate state2 = SASL_FINAL;
|
---|
1399 |
|
---|
1400 | sasl->force_ir = force_ir; /* Latch for future use */
|
---|
1401 | sasl->authused = 0; /* No mechanism used yet */
|
---|
1402 | enabledmechs = sasl->authmechs & sasl->prefmech;
|
---|
1403 | *progress = SASL_IDLE;
|
---|
1404 |
|
---|
1405 | /* Calculate the supported authentication mechanism, by decreasing order of
|
---|
1406 | security, as well as the initial response where appropriate */
|
---|
1407 | if((enabledmechs & SASL_MECH_EXTERNAL) && !conn->passwd[0]) {
|
---|
1408 | mech = SASL_MECH_STRING_EXTERNAL;
|
---|
1409 | state1 = SASL_EXTERNAL;
|
---|
1410 | sasl->authused = SASL_MECH_EXTERNAL;
|
---|
1411 |
|
---|
1412 | if(force_ir || data->set.sasl_ir)
|
---|
1413 | result = sasl_create_external_message(data, conn->user, &resp, &len);
|
---|
1414 | }
|
---|
1415 | else if(conn->bits.user_passwd) {
|
---|
1416 | #if defined(USE_KERBEROS5)
|
---|
1417 | if(enabledmechs & SASL_MECH_GSSAPI) {
|
---|
1418 | sasl->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */
|
---|
1419 | mech = SASL_MECH_STRING_GSSAPI;
|
---|
1420 | state1 = SASL_GSSAPI;
|
---|
1421 | state2 = SASL_GSSAPI_TOKEN;
|
---|
1422 | sasl->authused = SASL_MECH_GSSAPI;
|
---|
1423 |
|
---|
1424 | if(force_ir || data->set.sasl_ir)
|
---|
1425 | result = Curl_sasl_create_gssapi_user_message(data, conn->user,
|
---|
1426 | conn->passwd,
|
---|
1427 | sasl->params->service,
|
---|
1428 | sasl->mutual_auth,
|
---|
1429 | NULL, &conn->krb5,
|
---|
1430 | &resp, &len);
|
---|
1431 | }
|
---|
1432 | else
|
---|
1433 | #endif
|
---|
1434 | #ifndef CURL_DISABLE_CRYPTO_AUTH
|
---|
1435 | if(enabledmechs & SASL_MECH_DIGEST_MD5) {
|
---|
1436 | mech = SASL_MECH_STRING_DIGEST_MD5;
|
---|
1437 | state1 = SASL_DIGESTMD5;
|
---|
1438 | sasl->authused = SASL_MECH_DIGEST_MD5;
|
---|
1439 | }
|
---|
1440 | else if(enabledmechs & SASL_MECH_CRAM_MD5) {
|
---|
1441 | mech = SASL_MECH_STRING_CRAM_MD5;
|
---|
1442 | state1 = SASL_CRAMMD5;
|
---|
1443 | sasl->authused = SASL_MECH_CRAM_MD5;
|
---|
1444 | }
|
---|
1445 | else
|
---|
1446 | #endif
|
---|
1447 | #ifdef USE_NTLM
|
---|
1448 | if(enabledmechs & SASL_MECH_NTLM) {
|
---|
1449 | mech = SASL_MECH_STRING_NTLM;
|
---|
1450 | state1 = SASL_NTLM;
|
---|
1451 | state2 = SASL_NTLM_TYPE2MSG;
|
---|
1452 | sasl->authused = SASL_MECH_NTLM;
|
---|
1453 |
|
---|
1454 | if(force_ir || data->set.sasl_ir)
|
---|
1455 | result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd,
|
---|
1456 | &conn->ntlm, &resp, &len);
|
---|
1457 | }
|
---|
1458 | else
|
---|
1459 | #endif
|
---|
1460 | if((enabledmechs & SASL_MECH_OAUTHBEARER) && conn->oauth_bearer) {
|
---|
1461 | mech = SASL_MECH_STRING_OAUTHBEARER;
|
---|
1462 | state1 = SASL_OAUTH2;
|
---|
1463 | state2 = SASL_OAUTH2_RESP;
|
---|
1464 | sasl->authused = SASL_MECH_OAUTHBEARER;
|
---|
1465 |
|
---|
1466 | if(force_ir || data->set.sasl_ir)
|
---|
1467 | result = sasl_create_oauth_bearer_message(data, conn->user,
|
---|
1468 | conn->host.name,
|
---|
1469 | conn->port,
|
---|
1470 | conn->oauth_bearer,
|
---|
1471 | &resp, &len);
|
---|
1472 | }
|
---|
1473 | else if((enabledmechs & SASL_MECH_XOAUTH2) && conn->oauth_bearer) {
|
---|
1474 | mech = SASL_MECH_STRING_XOAUTH2;
|
---|
1475 | state1 = SASL_OAUTH2;
|
---|
1476 | sasl->authused = SASL_MECH_XOAUTH2;
|
---|
1477 |
|
---|
1478 | if(force_ir || data->set.sasl_ir)
|
---|
1479 | result = sasl_create_oauth_bearer_message(data, conn->user,
|
---|
1480 | NULL, 0,
|
---|
1481 | conn->oauth_bearer,
|
---|
1482 | &resp, &len);
|
---|
1483 | }
|
---|
1484 | else if(enabledmechs & SASL_MECH_LOGIN) {
|
---|
1485 | mech = SASL_MECH_STRING_LOGIN;
|
---|
1486 | state1 = SASL_LOGIN;
|
---|
1487 | state2 = SASL_LOGIN_PASSWD;
|
---|
1488 | sasl->authused = SASL_MECH_LOGIN;
|
---|
1489 |
|
---|
1490 | if(force_ir || data->set.sasl_ir)
|
---|
1491 | result = sasl_create_login_message(data, conn->user, &resp, &len);
|
---|
1492 | }
|
---|
1493 | else if(enabledmechs & SASL_MECH_PLAIN) {
|
---|
1494 | mech = SASL_MECH_STRING_PLAIN;
|
---|
1495 | state1 = SASL_PLAIN;
|
---|
1496 | sasl->authused = SASL_MECH_PLAIN;
|
---|
1497 |
|
---|
1498 | if(force_ir || data->set.sasl_ir)
|
---|
1499 | result = sasl_create_plain_message(data, conn->user, conn->passwd,
|
---|
1500 | &resp, &len);
|
---|
1501 | }
|
---|
1502 | }
|
---|
1503 |
|
---|
1504 | if(!result) {
|
---|
1505 | if(resp && sasl->params->maxirlen &&
|
---|
1506 | strlen(mech) + len > sasl->params->maxirlen) {
|
---|
1507 | free(resp);
|
---|
1508 | resp = NULL;
|
---|
1509 | }
|
---|
1510 |
|
---|
1511 | if(mech) {
|
---|
1512 | result = sasl->params->sendauth(conn, mech, resp);
|
---|
1513 | if(!result) {
|
---|
1514 | *progress = SASL_INPROGRESS;
|
---|
1515 | state(sasl, conn, resp? state2: state1);
|
---|
1516 | }
|
---|
1517 | }
|
---|
1518 | }
|
---|
1519 |
|
---|
1520 | free(resp);
|
---|
1521 |
|
---|
1522 | return result;
|
---|
1523 | }
|
---|
1524 |
|
---|
1525 | /*
|
---|
1526 | * Curl_sasl_continue()
|
---|
1527 | *
|
---|
1528 | * Continue the authentication.
|
---|
1529 | */
|
---|
1530 | CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn,
|
---|
1531 | int code, saslprogress *progress)
|
---|
1532 | {
|
---|
1533 | CURLcode result = CURLE_OK;
|
---|
1534 | struct SessionHandle *data = conn->data;
|
---|
1535 | saslstate newstate = SASL_FINAL;
|
---|
1536 | char *resp = NULL;
|
---|
1537 | #if !defined(CURL_DISABLE_CRYPTO_AUTH)
|
---|
1538 | char *serverdata;
|
---|
1539 | char *chlg = NULL;
|
---|
1540 | size_t chlglen = 0;
|
---|
1541 | #endif
|
---|
1542 | size_t len = 0;
|
---|
1543 |
|
---|
1544 | *progress = SASL_INPROGRESS;
|
---|
1545 |
|
---|
1546 | if(sasl->state == SASL_FINAL) {
|
---|
1547 | if(code != sasl->params->finalcode)
|
---|
1548 | result = CURLE_LOGIN_DENIED;
|
---|
1549 | *progress = SASL_DONE;
|
---|
1550 | state(sasl, conn, SASL_STOP);
|
---|
1551 | return result;
|
---|
1552 | }
|
---|
1553 |
|
---|
1554 | if(sasl->state != SASL_CANCEL && sasl->state != SASL_OAUTH2_RESP &&
|
---|
1555 | code != sasl->params->contcode) {
|
---|
1556 | *progress = SASL_DONE;
|
---|
1557 | state(sasl, conn, SASL_STOP);
|
---|
1558 | return CURLE_LOGIN_DENIED;
|
---|
1559 | }
|
---|
1560 |
|
---|
1561 | switch(sasl->state) {
|
---|
1562 | case SASL_STOP:
|
---|
1563 | *progress = SASL_DONE;
|
---|
1564 | return result;
|
---|
1565 | case SASL_PLAIN:
|
---|
1566 | result = sasl_create_plain_message(data, conn->user, conn->passwd, &resp,
|
---|
1567 | &len);
|
---|
1568 | break;
|
---|
1569 | case SASL_LOGIN:
|
---|
1570 | result = sasl_create_login_message(data, conn->user, &resp, &len);
|
---|
1571 | newstate = SASL_LOGIN_PASSWD;
|
---|
1572 | break;
|
---|
1573 | case SASL_LOGIN_PASSWD:
|
---|
1574 | result = sasl_create_login_message(data, conn->passwd, &resp, &len);
|
---|
1575 | break;
|
---|
1576 | case SASL_EXTERNAL:
|
---|
1577 | result = sasl_create_external_message(data, conn->user, &resp, &len);
|
---|
1578 | break;
|
---|
1579 |
|
---|
1580 | #ifndef CURL_DISABLE_CRYPTO_AUTH
|
---|
1581 | case SASL_CRAMMD5:
|
---|
1582 | sasl->params->getmessage(data->state.buffer, &serverdata);
|
---|
1583 | result = sasl_decode_cram_md5_message(serverdata, &chlg, &chlglen);
|
---|
1584 | if(!result)
|
---|
1585 | result = sasl_create_cram_md5_message(data, chlg, conn->user,
|
---|
1586 | conn->passwd, &resp, &len);
|
---|
1587 | free(chlg);
|
---|
1588 | break;
|
---|
1589 | case SASL_DIGESTMD5:
|
---|
1590 | sasl->params->getmessage(data->state.buffer, &serverdata);
|
---|
1591 | result = Curl_sasl_create_digest_md5_message(data, serverdata,
|
---|
1592 | conn->user, conn->passwd,
|
---|
1593 | sasl->params->service,
|
---|
1594 | &resp, &len);
|
---|
1595 | newstate = SASL_DIGESTMD5_RESP;
|
---|
1596 | break;
|
---|
1597 | case SASL_DIGESTMD5_RESP:
|
---|
1598 | if(!(resp = strdup("")))
|
---|
1599 | result = CURLE_OUT_OF_MEMORY;
|
---|
1600 | break;
|
---|
1601 | #endif
|
---|
1602 |
|
---|
1603 | #ifdef USE_NTLM
|
---|
1604 | case SASL_NTLM:
|
---|
1605 | /* Create the type-1 message */
|
---|
1606 | result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd,
|
---|
1607 | &conn->ntlm, &resp, &len);
|
---|
1608 | newstate = SASL_NTLM_TYPE2MSG;
|
---|
1609 | break;
|
---|
1610 | case SASL_NTLM_TYPE2MSG:
|
---|
1611 | /* Decode the type-2 message */
|
---|
1612 | sasl->params->getmessage(data->state.buffer, &serverdata);
|
---|
1613 | result = Curl_sasl_decode_ntlm_type2_message(data, serverdata,
|
---|
1614 | &conn->ntlm);
|
---|
1615 | if(!result)
|
---|
1616 | result = Curl_sasl_create_ntlm_type3_message(data, conn->user,
|
---|
1617 | conn->passwd, &conn->ntlm,
|
---|
1618 | &resp, &len);
|
---|
1619 | break;
|
---|
1620 | #endif
|
---|
1621 |
|
---|
1622 | #if defined(USE_KERBEROS5)
|
---|
1623 | case SASL_GSSAPI:
|
---|
1624 | result = Curl_sasl_create_gssapi_user_message(data, conn->user,
|
---|
1625 | conn->passwd,
|
---|
1626 | sasl->params->service,
|
---|
1627 | sasl->mutual_auth, NULL,
|
---|
1628 | &conn->krb5,
|
---|
1629 | &resp, &len);
|
---|
1630 | newstate = SASL_GSSAPI_TOKEN;
|
---|
1631 | break;
|
---|
1632 | case SASL_GSSAPI_TOKEN:
|
---|
1633 | sasl->params->getmessage(data->state.buffer, &serverdata);
|
---|
1634 | if(sasl->mutual_auth) {
|
---|
1635 | /* Decode the user token challenge and create the optional response
|
---|
1636 | message */
|
---|
1637 | result = Curl_sasl_create_gssapi_user_message(data, NULL, NULL, NULL,
|
---|
1638 | sasl->mutual_auth,
|
---|
1639 | serverdata, &conn->krb5,
|
---|
1640 | &resp, &len);
|
---|
1641 | newstate = SASL_GSSAPI_NO_DATA;
|
---|
1642 | }
|
---|
1643 | else
|
---|
1644 | /* Decode the security challenge and create the response message */
|
---|
1645 | result = Curl_sasl_create_gssapi_security_message(data, serverdata,
|
---|
1646 | &conn->krb5,
|
---|
1647 | &resp, &len);
|
---|
1648 | break;
|
---|
1649 | case SASL_GSSAPI_NO_DATA:
|
---|
1650 | sasl->params->getmessage(data->state.buffer, &serverdata);
|
---|
1651 | /* Decode the security challenge and create the response message */
|
---|
1652 | result = Curl_sasl_create_gssapi_security_message(data, serverdata,
|
---|
1653 | &conn->krb5,
|
---|
1654 | &resp, &len);
|
---|
1655 | break;
|
---|
1656 | #endif
|
---|
1657 |
|
---|
1658 | case SASL_OAUTH2:
|
---|
1659 | /* Create the authorisation message */
|
---|
1660 | if(sasl->authused == SASL_MECH_OAUTHBEARER) {
|
---|
1661 | result = sasl_create_oauth_bearer_message(data, conn->user,
|
---|
1662 | conn->host.name,
|
---|
1663 | conn->port,
|
---|
1664 | conn->oauth_bearer,
|
---|
1665 | &resp, &len);
|
---|
1666 |
|
---|
1667 | /* Failures maybe sent by the server as continuations for OAUTHBEARER */
|
---|
1668 | newstate = SASL_OAUTH2_RESP;
|
---|
1669 | }
|
---|
1670 | else
|
---|
1671 | result = sasl_create_oauth_bearer_message(data, conn->user,
|
---|
1672 | NULL, 0,
|
---|
1673 | conn->oauth_bearer,
|
---|
1674 | &resp, &len);
|
---|
1675 | break;
|
---|
1676 |
|
---|
1677 | case SASL_OAUTH2_RESP:
|
---|
1678 | /* The continuation is optional so check the response code */
|
---|
1679 | if(code == sasl->params->finalcode) {
|
---|
1680 | /* Final response was received so we are done */
|
---|
1681 | *progress = SASL_DONE;
|
---|
1682 | state(sasl, conn, SASL_STOP);
|
---|
1683 | return result;
|
---|
1684 | }
|
---|
1685 | else if(code == sasl->params->contcode) {
|
---|
1686 | /* Acknowledge the continuation by sending a 0x01 response base64
|
---|
1687 | encoded */
|
---|
1688 | resp = strdup("AQ==");
|
---|
1689 | if(!resp)
|
---|
1690 | result = CURLE_OUT_OF_MEMORY;
|
---|
1691 | break;
|
---|
1692 | }
|
---|
1693 | else {
|
---|
1694 | *progress = SASL_DONE;
|
---|
1695 | state(sasl, conn, SASL_STOP);
|
---|
1696 | return CURLE_LOGIN_DENIED;
|
---|
1697 | }
|
---|
1698 |
|
---|
1699 | case SASL_CANCEL:
|
---|
1700 | /* Remove the offending mechanism from the supported list */
|
---|
1701 | sasl->authmechs ^= sasl->authused;
|
---|
1702 |
|
---|
1703 | /* Start an alternative SASL authentication */
|
---|
1704 | result = Curl_sasl_start(sasl, conn, sasl->force_ir, progress);
|
---|
1705 | newstate = sasl->state; /* Use state from Curl_sasl_start() */
|
---|
1706 | break;
|
---|
1707 | default:
|
---|
1708 | failf(data, "Unsupported SASL authentication mechanism");
|
---|
1709 | result = CURLE_UNSUPPORTED_PROTOCOL; /* Should not happen */
|
---|
1710 | break;
|
---|
1711 | }
|
---|
1712 |
|
---|
1713 | switch(result) {
|
---|
1714 | case CURLE_BAD_CONTENT_ENCODING:
|
---|
1715 | /* Cancel dialog */
|
---|
1716 | result = sasl->params->sendcont(conn, "*");
|
---|
1717 | newstate = SASL_CANCEL;
|
---|
1718 | break;
|
---|
1719 | case CURLE_OK:
|
---|
1720 | if(resp)
|
---|
1721 | result = sasl->params->sendcont(conn, resp);
|
---|
1722 | break;
|
---|
1723 | default:
|
---|
1724 | newstate = SASL_STOP; /* Stop on error */
|
---|
1725 | *progress = SASL_DONE;
|
---|
1726 | break;
|
---|
1727 | }
|
---|
1728 |
|
---|
1729 | free(resp);
|
---|
1730 |
|
---|
1731 | state(sasl, conn, newstate);
|
---|
1732 |
|
---|
1733 | return result;
|
---|
1734 | }
|
---|