2012-05-30 21:52:52 +02:00
|
|
|
/***************************************************************************
|
|
|
|
* _ _ ____ _
|
|
|
|
* Project ___| | | | _ \| |
|
|
|
|
* / __| | | | |_) | |
|
|
|
|
* | (__| |_| | _ <| |___
|
|
|
|
* \___|\___/|_| \_\_____|
|
|
|
|
*
|
2014-01-03 00:35:29 +01:00
|
|
|
* Copyright (C) 2012 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
|
2012-05-30 21:52:52 +02:00
|
|
|
*
|
|
|
|
* This software is licensed as described in the file COPYING, which
|
|
|
|
* you should have received as part of this distribution. The terms
|
|
|
|
* are also available at http://curl.haxx.se/docs/copyright.html.
|
|
|
|
*
|
|
|
|
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
|
|
|
* copies of the Software, and permit persons to whom the Software is
|
|
|
|
* furnished to do so, under the terms of the COPYING file.
|
|
|
|
*
|
|
|
|
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
|
|
|
* KIND, either express or implied.
|
|
|
|
*
|
2012-06-03 18:21:49 +02:00
|
|
|
* RFC2195 CRAM-MD5 authentication
|
2012-06-04 11:53:18 +02:00
|
|
|
* RFC2831 DIGEST-MD5 authentication
|
2013-01-22 23:02:30 +01:00
|
|
|
* RFC4422 Simple Authentication and Security Layer (SASL)
|
2012-05-30 21:52:52 +02:00
|
|
|
* RFC4616 PLAIN authentication
|
2013-08-25 19:17:01 +02:00
|
|
|
* RFC6749 OAuth 2.0 Authorization Framework
|
2013-10-26 15:35:27 +02:00
|
|
|
* Draft LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
|
2012-05-30 21:52:52 +02:00
|
|
|
*
|
|
|
|
***************************************************************************/
|
|
|
|
|
2013-01-06 19:06:49 +01:00
|
|
|
#include "curl_setup.h"
|
2012-05-30 21:52:52 +02:00
|
|
|
|
|
|
|
#include <curl/curl.h>
|
2013-01-04 02:50:28 +01:00
|
|
|
#include "urldata.h"
|
2012-05-30 21:52:52 +02:00
|
|
|
|
|
|
|
#include "curl_base64.h"
|
2012-06-03 18:21:49 +02:00
|
|
|
#include "curl_md5.h"
|
2013-12-17 23:32:47 +01:00
|
|
|
#include "vtls/vtls.h"
|
2012-06-03 18:21:49 +02:00
|
|
|
#include "curl_hmac.h"
|
2012-06-02 12:07:58 +02:00
|
|
|
#include "curl_ntlm_msgs.h"
|
2012-05-30 21:52:52 +02:00
|
|
|
#include "curl_sasl.h"
|
2013-01-04 02:50:28 +01:00
|
|
|
#include "warnless.h"
|
2012-06-15 18:05:11 +02:00
|
|
|
#include "curl_memory.h"
|
2012-06-03 18:21:49 +02:00
|
|
|
|
2013-10-18 15:37:18 +02:00
|
|
|
#ifdef USE_NSS
|
2014-01-03 00:32:05 +01:00
|
|
|
#include "vtls/nssg.h" /* for Curl_nss_force_init() */
|
2013-10-18 15:37:18 +02:00
|
|
|
#endif
|
|
|
|
|
2012-06-03 18:21:49 +02:00
|
|
|
#define _MPRINTF_REPLACE /* use our functions only */
|
|
|
|
#include <curl/mprintf.h>
|
2012-05-30 21:52:52 +02:00
|
|
|
|
|
|
|
/* The last #include file should be: */
|
2013-01-04 02:50:28 +01:00
|
|
|
#include "memdebug.h"
|
2012-05-30 21:52:52 +02:00
|
|
|
|
2014-04-06 15:21:46 +02:00
|
|
|
#if !defined(CURL_DISABLE_CRYPTO_AUTH) && !defined(USE_WINDOWS_SSPI)
|
2012-06-04 11:53:18 +02:00
|
|
|
/* Retrieves the value for a corresponding key from the challenge string
|
|
|
|
* returns TRUE if the key could be found, FALSE if it does not exists
|
|
|
|
*/
|
2013-10-27 17:27:38 +01:00
|
|
|
static bool sasl_digest_get_key_value(const char *chlg,
|
2012-06-04 11:53:18 +02:00
|
|
|
const char *key,
|
|
|
|
char *value,
|
|
|
|
size_t max_val_len,
|
|
|
|
char end_char)
|
|
|
|
{
|
|
|
|
char *find_pos;
|
|
|
|
size_t i;
|
|
|
|
|
2013-10-27 17:27:38 +01:00
|
|
|
find_pos = strstr(chlg, key);
|
2012-06-04 11:53:18 +02:00
|
|
|
if(!find_pos)
|
|
|
|
return FALSE;
|
|
|
|
|
|
|
|
find_pos += strlen(key);
|
|
|
|
|
|
|
|
for(i = 0; *find_pos && *find_pos != end_char && i < max_val_len - 1; ++i)
|
|
|
|
value[i] = *find_pos++;
|
|
|
|
value[i] = '\0';
|
|
|
|
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2012-05-30 21:52:52 +02:00
|
|
|
/*
|
|
|
|
* Curl_sasl_create_plain_message()
|
|
|
|
*
|
2012-06-02 12:09:59 +02:00
|
|
|
* This is used to generate an already encoded PLAIN message ready
|
2012-05-30 21:52:52 +02:00
|
|
|
* for sending to the recipient.
|
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
|
|
|
* data [in] - The session handle.
|
|
|
|
* userp [in] - The user name.
|
|
|
|
* passdwp [in] - The user's password.
|
|
|
|
* outptr [in/out] - The address where a pointer to newly allocated memory
|
|
|
|
* holding the result will be stored upon completion.
|
|
|
|
* outlen [out] - The length of the output message.
|
|
|
|
*
|
|
|
|
* Returns CURLE_OK on success.
|
|
|
|
*/
|
|
|
|
CURLcode Curl_sasl_create_plain_message(struct SessionHandle *data,
|
2013-03-21 23:21:22 +01:00
|
|
|
const char *userp,
|
|
|
|
const char *passwdp,
|
2012-05-30 21:52:52 +02:00
|
|
|
char **outptr, size_t *outlen)
|
|
|
|
{
|
2013-08-19 09:36:53 +02:00
|
|
|
CURLcode result;
|
|
|
|
char *plainauth;
|
2012-05-30 21:52:52 +02:00
|
|
|
size_t ulen;
|
|
|
|
size_t plen;
|
|
|
|
|
|
|
|
ulen = strlen(userp);
|
|
|
|
plen = strlen(passwdp);
|
|
|
|
|
2013-08-19 09:36:53 +02:00
|
|
|
plainauth = malloc(2 * ulen + plen + 2);
|
|
|
|
if(!plainauth) {
|
2012-05-30 21:52:52 +02:00
|
|
|
*outlen = 0;
|
|
|
|
*outptr = NULL;
|
2012-06-03 19:24:35 +02:00
|
|
|
return CURLE_OUT_OF_MEMORY;
|
2012-05-30 21:52:52 +02:00
|
|
|
}
|
|
|
|
|
2012-06-03 19:24:35 +02:00
|
|
|
/* Calculate the reply */
|
2012-05-30 21:52:52 +02:00
|
|
|
memcpy(plainauth, userp, ulen);
|
|
|
|
plainauth[ulen] = '\0';
|
|
|
|
memcpy(plainauth + ulen + 1, userp, ulen);
|
|
|
|
plainauth[2 * ulen + 1] = '\0';
|
|
|
|
memcpy(plainauth + 2 * ulen + 2, passwdp, plen);
|
|
|
|
|
2012-06-03 19:24:35 +02:00
|
|
|
/* Base64 encode the reply */
|
2013-08-19 09:36:53 +02:00
|
|
|
result = Curl_base64_encode(data, plainauth, 2 * ulen + plen + 2, outptr,
|
|
|
|
outlen);
|
|
|
|
Curl_safefree(plainauth);
|
|
|
|
return result;
|
2012-05-30 21:52:52 +02:00
|
|
|
}
|
2012-06-01 00:11:54 +02:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Curl_sasl_create_login_message()
|
|
|
|
*
|
2012-06-02 12:09:59 +02:00
|
|
|
* This is used to generate an already encoded LOGIN message containing the
|
2012-06-01 00:11:54 +02:00
|
|
|
* user name or password ready for sending to the recipient.
|
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
|
|
|
* data [in] - The session handle.
|
2012-06-02 15:03:55 +02:00
|
|
|
* valuep [in] - The user name or user's password.
|
2012-06-01 00:11:54 +02:00
|
|
|
* outptr [in/out] - The address where a pointer to newly allocated memory
|
|
|
|
* holding the result will be stored upon completion.
|
|
|
|
* outlen [out] - The length of the output message.
|
|
|
|
*
|
|
|
|
* Returns CURLE_OK on success.
|
|
|
|
*/
|
|
|
|
CURLcode Curl_sasl_create_login_message(struct SessionHandle *data,
|
2013-03-21 23:21:22 +01:00
|
|
|
const char *valuep, char **outptr,
|
2012-06-01 00:11:54 +02:00
|
|
|
size_t *outlen)
|
|
|
|
{
|
|
|
|
size_t vlen = strlen(valuep);
|
|
|
|
|
|
|
|
if(!vlen) {
|
2012-06-03 19:24:35 +02:00
|
|
|
/* Calculate an empty reply */
|
2012-06-01 00:11:54 +02:00
|
|
|
*outptr = strdup("=");
|
|
|
|
if(*outptr) {
|
|
|
|
*outlen = (size_t) 1;
|
|
|
|
return CURLE_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
*outlen = 0;
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
}
|
|
|
|
|
2012-06-03 19:24:35 +02:00
|
|
|
/* Base64 encode the value */
|
2012-06-01 00:11:54 +02:00
|
|
|
return Curl_base64_encode(data, valuep, vlen, outptr, outlen);
|
|
|
|
}
|
2012-06-02 12:07:58 +02:00
|
|
|
|
2012-06-03 18:21:49 +02:00
|
|
|
#ifndef CURL_DISABLE_CRYPTO_AUTH
|
2013-10-27 13:34:56 +01:00
|
|
|
/*
|
|
|
|
* Curl_sasl_decode_cram_md5_message()
|
|
|
|
*
|
|
|
|
* This is used to decode an already encoded CRAM-MD5 challenge message.
|
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
|
|
|
* chlg64 [in] - Pointer to the base64 encoded challenge message.
|
|
|
|
* outptr [in/out] - The address where a pointer to newly allocated memory
|
|
|
|
* holding the result will be stored upon completion.
|
|
|
|
* outlen [out] - The length of the output message.
|
|
|
|
*
|
|
|
|
* Returns CURLE_OK on success.
|
|
|
|
*/
|
|
|
|
CURLcode Curl_sasl_decode_cram_md5_message(const char *chlg64, char **outptr,
|
|
|
|
size_t *outlen)
|
|
|
|
{
|
|
|
|
CURLcode result = CURLE_OK;
|
|
|
|
size_t chlg64len = strlen(chlg64);
|
|
|
|
|
|
|
|
*outptr = NULL;
|
|
|
|
*outlen = 0;
|
|
|
|
|
|
|
|
/* Decode the challenge if necessary */
|
|
|
|
if(chlg64len && *chlg64 != '=')
|
|
|
|
result = Curl_base64_decode(chlg64, (unsigned char **) outptr, outlen);
|
|
|
|
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2012-06-03 18:21:49 +02:00
|
|
|
* Curl_sasl_create_cram_md5_message()
|
|
|
|
*
|
2012-06-04 11:49:55 +02:00
|
|
|
* This is used to generate an already encoded CRAM-MD5 response message ready
|
|
|
|
* for sending to the recipient.
|
2012-06-03 18:21:49 +02:00
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
|
|
|
* data [in] - The session handle.
|
2013-10-27 13:34:56 +01:00
|
|
|
* chlg [in] - The challenge.
|
2012-06-04 11:49:55 +02:00
|
|
|
* userp [in] - The user name.
|
2012-06-03 18:21:49 +02:00
|
|
|
* passdwp [in] - The user's password.
|
|
|
|
* outptr [in/out] - The address where a pointer to newly allocated memory
|
|
|
|
* holding the result will be stored upon completion.
|
|
|
|
* outlen [out] - The length of the output message.
|
|
|
|
*
|
|
|
|
* Returns CURLE_OK on success.
|
|
|
|
*/
|
|
|
|
CURLcode Curl_sasl_create_cram_md5_message(struct SessionHandle *data,
|
2013-10-27 13:34:56 +01:00
|
|
|
const char *chlg,
|
2013-03-21 23:21:22 +01:00
|
|
|
const char *userp,
|
|
|
|
const char *passwdp,
|
2012-06-03 18:21:49 +02:00
|
|
|
char **outptr, size_t *outlen)
|
|
|
|
{
|
|
|
|
CURLcode result = CURLE_OK;
|
|
|
|
size_t chlglen = 0;
|
|
|
|
HMAC_context *ctxt;
|
|
|
|
unsigned char digest[MD5_DIGEST_LEN];
|
2013-08-19 09:36:53 +02:00
|
|
|
char *response;
|
2012-06-03 18:21:49 +02:00
|
|
|
|
2013-10-27 13:34:56 +01:00
|
|
|
if(chlg)
|
|
|
|
chlglen = strlen(chlg);
|
2012-06-03 18:21:49 +02:00
|
|
|
|
|
|
|
/* Compute the digest using the password as the key */
|
|
|
|
ctxt = Curl_HMAC_init(Curl_HMAC_MD5,
|
|
|
|
(const unsigned char *) passwdp,
|
|
|
|
curlx_uztoui(strlen(passwdp)));
|
2013-10-27 13:34:56 +01:00
|
|
|
if(!ctxt)
|
2012-06-03 18:21:49 +02:00
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
|
|
|
|
/* Update the digest with the given challenge */
|
|
|
|
if(chlglen > 0)
|
2013-10-27 13:34:56 +01:00
|
|
|
Curl_HMAC_update(ctxt, (const unsigned char *) chlg,
|
|
|
|
curlx_uztoui(chlglen));
|
2012-06-03 18:21:49 +02:00
|
|
|
|
|
|
|
/* Finalise the digest */
|
|
|
|
Curl_HMAC_final(ctxt, digest);
|
|
|
|
|
2013-10-27 23:53:07 +01:00
|
|
|
/* Generate the response */
|
2013-08-19 09:36:53 +02:00
|
|
|
response = aprintf(
|
2012-06-03 18:21:49 +02:00
|
|
|
"%s %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
|
2012-06-04 11:49:55 +02:00
|
|
|
userp, digest[0], digest[1], digest[2], digest[3], digest[4],
|
2012-06-03 18:21:49 +02:00
|
|
|
digest[5], digest[6], digest[7], digest[8], digest[9], digest[10],
|
|
|
|
digest[11], digest[12], digest[13], digest[14], digest[15]);
|
2013-08-19 09:36:53 +02:00
|
|
|
if(!response)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
2012-06-03 18:21:49 +02:00
|
|
|
|
2013-10-27 23:53:07 +01:00
|
|
|
/* Base64 encode the response */
|
2013-08-19 09:36:53 +02:00
|
|
|
result = Curl_base64_encode(data, response, 0, outptr, outlen);
|
|
|
|
|
|
|
|
Curl_safefree(response);
|
2013-10-27 13:34:56 +01:00
|
|
|
|
2013-08-19 09:36:53 +02:00
|
|
|
return result;
|
2012-06-03 18:21:49 +02:00
|
|
|
}
|
2012-06-04 11:53:18 +02:00
|
|
|
|
2014-04-02 22:21:12 +02:00
|
|
|
#ifndef USE_WINDOWS_SSPI
|
2013-10-27 17:27:38 +01:00
|
|
|
/*
|
2014-04-02 21:53:43 +02:00
|
|
|
* sasl_decode_digest_md5_message()
|
2013-10-27 17:27:38 +01:00
|
|
|
*
|
2014-04-02 21:53:43 +02:00
|
|
|
* This is used internally to decode an already encoded DIGEST-MD5 challenge
|
|
|
|
* message into the seperate attributes.
|
2013-10-27 17:27:38 +01:00
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
2013-10-27 23:20:18 +01:00
|
|
|
* chlg64 [in] - Pointer to the base64 encoded challenge message.
|
2013-10-27 17:27:38 +01:00
|
|
|
* nonce [in/out] - The buffer where the nonce will be stored.
|
|
|
|
* nlen [in] - The length of the nonce buffer.
|
|
|
|
* realm [in/out] - The buffer where the realm will be stored.
|
|
|
|
* rlen [in] - The length of the realm buffer.
|
|
|
|
* alg [in/out] - The buffer where the algorithm will be stored.
|
|
|
|
* alen [in] - The length of the algorithm buffer.
|
|
|
|
*
|
|
|
|
* Returns CURLE_OK on success.
|
|
|
|
*/
|
2014-04-02 21:53:43 +02:00
|
|
|
static CURLcode sasl_decode_digest_md5_message(const char *chlg64,
|
|
|
|
char *nonce, size_t nlen,
|
|
|
|
char *realm, size_t rlen,
|
|
|
|
char *alg, size_t alen)
|
2013-10-27 17:27:38 +01:00
|
|
|
{
|
|
|
|
CURLcode result = CURLE_OK;
|
2013-11-03 13:25:07 +01:00
|
|
|
unsigned char *chlg = NULL;
|
2013-10-27 17:27:38 +01:00
|
|
|
size_t chlglen = 0;
|
|
|
|
size_t chlg64len = strlen(chlg64);
|
|
|
|
|
2014-04-06 14:29:29 +02:00
|
|
|
/* Decode the base-64 encoded challenge message */
|
2013-10-27 17:27:38 +01:00
|
|
|
if(chlg64len && *chlg64 != '=') {
|
2013-11-03 13:25:07 +01:00
|
|
|
result = Curl_base64_decode(chlg64, &chlg, &chlglen);
|
2013-10-27 17:27:38 +01:00
|
|
|
if(result)
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Ensure we have a valid challenge message */
|
|
|
|
if(!chlg)
|
|
|
|
return CURLE_BAD_CONTENT_ENCODING;
|
|
|
|
|
|
|
|
/* Retrieve nonce string from the challenge */
|
2013-11-03 13:25:07 +01:00
|
|
|
if(!sasl_digest_get_key_value((char *)chlg, "nonce=\"", nonce, nlen, '\"')) {
|
2013-10-27 17:27:38 +01:00
|
|
|
Curl_safefree(chlg);
|
|
|
|
return CURLE_BAD_CONTENT_ENCODING;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Retrieve realm string from the challenge */
|
2013-11-03 13:25:07 +01:00
|
|
|
if(!sasl_digest_get_key_value((char *)chlg, "realm=\"", realm, rlen, '\"')) {
|
2013-10-27 17:27:38 +01:00
|
|
|
/* Challenge does not have a realm, set empty string [RFC2831] page 6 */
|
|
|
|
strcpy(realm, "");
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Retrieve algorithm string from the challenge */
|
2013-11-03 13:25:07 +01:00
|
|
|
if(!sasl_digest_get_key_value((char *)chlg, "algorithm=", alg, alen, ',')) {
|
2013-10-27 17:27:38 +01:00
|
|
|
Curl_safefree(chlg);
|
|
|
|
return CURLE_BAD_CONTENT_ENCODING;
|
|
|
|
}
|
|
|
|
|
|
|
|
Curl_safefree(chlg);
|
|
|
|
|
|
|
|
return CURLE_OK;
|
|
|
|
}
|
|
|
|
|
2012-06-04 11:53:18 +02:00
|
|
|
/*
|
|
|
|
* Curl_sasl_create_digest_md5_message()
|
|
|
|
*
|
|
|
|
* This is used to generate an already encoded DIGEST-MD5 response message
|
|
|
|
* ready for sending to the recipient.
|
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
|
|
|
* data [in] - The session handle.
|
2014-04-02 21:53:43 +02:00
|
|
|
* chlg64 [in] - Pointer to the base64 encoded challenge message.
|
2012-06-04 11:53:18 +02:00
|
|
|
* userp [in] - The user name.
|
|
|
|
* passdwp [in] - The user's password.
|
2013-10-27 17:27:38 +01:00
|
|
|
* service [in] - The service type such as www, smtp, pop or imap.
|
2012-06-04 11:53:18 +02:00
|
|
|
* outptr [in/out] - The address where a pointer to newly allocated memory
|
|
|
|
* holding the result will be stored upon completion.
|
|
|
|
* outlen [out] - The length of the output message.
|
|
|
|
*
|
|
|
|
* Returns CURLE_OK on success.
|
|
|
|
*/
|
|
|
|
CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
|
2014-04-02 21:53:43 +02:00
|
|
|
const char *chlg64,
|
2013-03-21 23:21:22 +01:00
|
|
|
const char *userp,
|
|
|
|
const char *passwdp,
|
|
|
|
const char *service,
|
2012-06-04 11:53:18 +02:00
|
|
|
char **outptr, size_t *outlen)
|
|
|
|
{
|
2013-10-23 22:28:13 +02:00
|
|
|
#ifndef DEBUGBUILD
|
2012-06-04 11:53:18 +02:00
|
|
|
static const char table16[] = "0123456789abcdef";
|
2013-10-23 22:28:13 +02:00
|
|
|
#endif
|
2013-10-27 23:53:07 +01:00
|
|
|
CURLcode result = CURLE_OK;
|
2012-06-04 11:53:18 +02:00
|
|
|
size_t i;
|
|
|
|
MD5_context *ctxt;
|
2013-10-27 23:53:07 +01:00
|
|
|
char *response = NULL;
|
2012-06-04 11:53:18 +02:00
|
|
|
unsigned char digest[MD5_DIGEST_LEN];
|
|
|
|
char HA1_hex[2 * MD5_DIGEST_LEN + 1];
|
|
|
|
char HA2_hex[2 * MD5_DIGEST_LEN + 1];
|
|
|
|
char resp_hash_hex[2 * MD5_DIGEST_LEN + 1];
|
|
|
|
|
2014-04-02 21:53:43 +02:00
|
|
|
char nonce[64];
|
|
|
|
char realm[128];
|
|
|
|
char algorithm[64];
|
2012-06-04 11:53:18 +02:00
|
|
|
char nonceCount[] = "00000001";
|
|
|
|
char cnonce[] = "12345678"; /* will be changed */
|
|
|
|
char method[] = "AUTHENTICATE";
|
|
|
|
char qop[] = "auth";
|
2012-06-04 21:22:06 +02:00
|
|
|
char uri[128];
|
2012-06-04 11:53:18 +02:00
|
|
|
|
2014-04-02 21:53:43 +02:00
|
|
|
/* Decode the challange message */
|
|
|
|
result = sasl_decode_digest_md5_message(chlg64, nonce, sizeof(nonce),
|
|
|
|
realm, sizeof(realm),
|
|
|
|
algorithm, sizeof(algorithm));
|
|
|
|
if(result)
|
|
|
|
return result;
|
|
|
|
|
|
|
|
/* We only support md5 sessions */
|
|
|
|
if(strcmp(algorithm, "md5-sess") != 0)
|
|
|
|
return CURLE_BAD_CONTENT_ENCODING;
|
|
|
|
|
2013-10-23 19:29:29 +02:00
|
|
|
#ifndef DEBUGBUILD
|
2012-06-04 11:53:18 +02:00
|
|
|
/* Generate 64 bits of random data */
|
|
|
|
for(i = 0; i < 8; i++)
|
2013-06-24 22:24:35 +02:00
|
|
|
cnonce[i] = table16[Curl_rand(data)%16];
|
2013-10-23 19:29:29 +02:00
|
|
|
#endif
|
2012-06-04 11:53:18 +02:00
|
|
|
|
|
|
|
/* So far so good, now calculate A1 and H(A1) according to RFC 2831 */
|
|
|
|
ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
|
|
|
|
if(!ctxt)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) userp,
|
|
|
|
curlx_uztoui(strlen(userp)));
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) realm,
|
|
|
|
curlx_uztoui(strlen(realm)));
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) passwdp,
|
|
|
|
curlx_uztoui(strlen(passwdp)));
|
|
|
|
Curl_MD5_final(ctxt, digest);
|
|
|
|
|
|
|
|
ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
|
|
|
|
if(!ctxt)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) digest, MD5_DIGEST_LEN);
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) nonce,
|
|
|
|
curlx_uztoui(strlen(nonce)));
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) cnonce,
|
|
|
|
curlx_uztoui(strlen(cnonce)));
|
|
|
|
Curl_MD5_final(ctxt, digest);
|
|
|
|
|
|
|
|
/* Convert calculated 16 octet hex into 32 bytes string */
|
|
|
|
for(i = 0; i < MD5_DIGEST_LEN; i++)
|
|
|
|
snprintf(&HA1_hex[2 * i], 3, "%02x", digest[i]);
|
|
|
|
|
2012-06-04 21:22:06 +02:00
|
|
|
/* Prepare the URL string */
|
2013-01-30 23:22:27 +01:00
|
|
|
snprintf(uri, sizeof(uri), "%s/%s", service, realm);
|
2012-06-04 11:53:18 +02:00
|
|
|
|
|
|
|
/* Calculate H(A2) */
|
|
|
|
ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
|
|
|
|
if(!ctxt)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) method,
|
|
|
|
curlx_uztoui(strlen(method)));
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) uri,
|
|
|
|
curlx_uztoui(strlen(uri)));
|
|
|
|
Curl_MD5_final(ctxt, digest);
|
|
|
|
|
|
|
|
for(i = 0; i < MD5_DIGEST_LEN; i++)
|
|
|
|
snprintf(&HA2_hex[2 * i], 3, "%02x", digest[i]);
|
|
|
|
|
|
|
|
/* Now calculate the response hash */
|
|
|
|
ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
|
|
|
|
if(!ctxt)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) HA1_hex, 2 * MD5_DIGEST_LEN);
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) nonce,
|
|
|
|
curlx_uztoui(strlen(nonce)));
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
|
|
|
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) nonceCount,
|
|
|
|
curlx_uztoui(strlen(nonceCount)));
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) cnonce,
|
|
|
|
curlx_uztoui(strlen(cnonce)));
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) qop,
|
|
|
|
curlx_uztoui(strlen(qop)));
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
|
|
|
|
|
|
|
|
Curl_MD5_update(ctxt, (const unsigned char *) HA2_hex, 2 * MD5_DIGEST_LEN);
|
|
|
|
Curl_MD5_final(ctxt, digest);
|
|
|
|
|
|
|
|
for(i = 0; i < MD5_DIGEST_LEN; i++)
|
|
|
|
snprintf(&resp_hash_hex[2 * i], 3, "%02x", digest[i]);
|
|
|
|
|
2013-10-27 23:53:07 +01:00
|
|
|
/* Generate the response */
|
|
|
|
response = aprintf("username=\"%s\",realm=\"%s\",nonce=\"%s\","
|
|
|
|
"cnonce=\"%s\",nc=\"%s\",digest-uri=\"%s\",response=%s",
|
|
|
|
userp, realm, nonce,
|
|
|
|
cnonce, nonceCount, uri, resp_hash_hex);
|
|
|
|
if(!response)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
2012-06-04 11:53:18 +02:00
|
|
|
|
2013-10-27 23:53:07 +01:00
|
|
|
/* Base64 encode the response */
|
|
|
|
result = Curl_base64_encode(data, response, 0, outptr, outlen);
|
|
|
|
|
|
|
|
Curl_safefree(response);
|
|
|
|
|
|
|
|
return result;
|
2012-06-04 11:53:18 +02:00
|
|
|
}
|
2014-04-02 22:21:12 +02:00
|
|
|
#endif /* USE_WINDOWS_SSPI */
|
|
|
|
|
|
|
|
#endif /* CURL_DISABLE_CRYPTO_AUTH */
|
2012-06-03 18:21:49 +02:00
|
|
|
|
2012-06-02 12:07:58 +02:00
|
|
|
#ifdef USE_NTLM
|
|
|
|
/*
|
|
|
|
* Curl_sasl_create_ntlm_type1_message()
|
|
|
|
*
|
|
|
|
* This is used to generate an already encoded NTLM type-1 message ready for
|
|
|
|
* sending to the recipient.
|
|
|
|
*
|
|
|
|
* Note: This is a simple wrapper of the NTLM function which means that any
|
|
|
|
* SASL based protocols don't have to include the NTLM functions directly.
|
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
|
|
|
* userp [in] - The user name in the format User or Domain\User.
|
|
|
|
* passdwp [in] - The user's password.
|
|
|
|
* ntlm [in/out] - The ntlm data struct being used and modified.
|
|
|
|
* outptr [in/out] - The address where a pointer to newly allocated memory
|
|
|
|
* holding the result will be stored upon completion.
|
|
|
|
* outlen [out] - The length of the output message.
|
|
|
|
*
|
|
|
|
* Returns CURLE_OK on success.
|
|
|
|
*/
|
|
|
|
CURLcode Curl_sasl_create_ntlm_type1_message(const char *userp,
|
|
|
|
const char *passwdp,
|
|
|
|
struct ntlmdata *ntlm,
|
|
|
|
char **outptr, size_t *outlen)
|
|
|
|
{
|
2013-10-27 23:20:18 +01:00
|
|
|
return Curl_ntlm_create_type1_message(userp, passwdp, ntlm, outptr, outlen);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Curl_sasl_decode_ntlm_type2_message()
|
|
|
|
*
|
|
|
|
* This is used to decode an already encoded NTLM type-2 message.
|
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
|
|
|
* data [in] - Pointer to session handle.
|
|
|
|
* type2msg [in] - Pointer to the base64 encoded type-2 message.
|
|
|
|
* ntlm [in/out] - The ntlm data struct being used and modified.
|
|
|
|
*
|
|
|
|
* Returns CURLE_OK on success.
|
|
|
|
*/
|
|
|
|
CURLcode Curl_sasl_decode_ntlm_type2_message(struct SessionHandle *data,
|
|
|
|
const char *type2msg,
|
|
|
|
struct ntlmdata *ntlm)
|
|
|
|
{
|
|
|
|
#ifdef USE_NSS
|
|
|
|
CURLcode result;
|
|
|
|
|
|
|
|
/* make sure the crypto backend is initialized */
|
|
|
|
result = Curl_nss_force_init(data);
|
|
|
|
if(result)
|
|
|
|
return result;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
return Curl_ntlm_decode_type2_message(data, type2msg, ntlm);
|
2012-06-02 12:07:58 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2012-06-04 23:25:45 +02:00
|
|
|
* Curl_sasl_create_ntlm_type3_message()
|
2012-06-02 12:07:58 +02:00
|
|
|
*
|
2012-06-04 23:25:45 +02:00
|
|
|
* This is used to generate an already encoded NTLM type-3 message ready for
|
|
|
|
* sending to the recipient.
|
2012-06-02 12:07:58 +02:00
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
|
|
|
* data [in] - Pointer to session handle.
|
|
|
|
* userp [in] - The user name in the format User or Domain\User.
|
|
|
|
* passdwp [in] - The user's password.
|
|
|
|
* ntlm [in/out] - The ntlm data struct being used and modified.
|
|
|
|
* outptr [in/out] - The address where a pointer to newly allocated memory
|
|
|
|
* holding the result will be stored upon completion.
|
|
|
|
* outlen [out] - The length of the output message.
|
|
|
|
*
|
|
|
|
* Returns CURLE_OK on success.
|
|
|
|
*/
|
2012-06-04 23:25:45 +02:00
|
|
|
CURLcode Curl_sasl_create_ntlm_type3_message(struct SessionHandle *data,
|
2012-06-02 12:07:58 +02:00
|
|
|
const char *userp,
|
|
|
|
const char *passwdp,
|
|
|
|
struct ntlmdata *ntlm,
|
|
|
|
char **outptr, size_t *outlen)
|
|
|
|
{
|
2013-10-27 23:20:18 +01:00
|
|
|
return Curl_ntlm_create_type3_message(data, userp, passwdp, ntlm, outptr,
|
|
|
|
outlen);
|
2012-06-02 12:07:58 +02:00
|
|
|
}
|
|
|
|
#endif /* USE_NTLM */
|
|
|
|
|
2013-08-25 19:17:01 +02:00
|
|
|
/*
|
|
|
|
* Curl_sasl_create_xoauth2_message()
|
|
|
|
*
|
2013-10-30 21:56:38 +01:00
|
|
|
* This is used to generate an already encoded OAuth 2.0 message ready for
|
|
|
|
* sending to the recipient.
|
2013-08-25 19:17:01 +02:00
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
|
|
|
* data [in] - The session handle.
|
|
|
|
* user [in] - The user name.
|
2013-10-30 21:56:38 +01:00
|
|
|
* bearer [in] - The bearer token.
|
2013-08-25 19:17:01 +02:00
|
|
|
* outptr [in/out] - The address where a pointer to newly allocated memory
|
|
|
|
* holding the result will be stored upon completion.
|
|
|
|
* outlen [out] - The length of the output message.
|
|
|
|
*
|
|
|
|
* Returns CURLE_OK on success.
|
|
|
|
*/
|
|
|
|
CURLcode Curl_sasl_create_xoauth2_message(struct SessionHandle *data,
|
|
|
|
const char *user,
|
|
|
|
const char *bearer,
|
|
|
|
char **outptr, size_t *outlen)
|
|
|
|
{
|
2013-10-24 01:16:59 +02:00
|
|
|
CURLcode result = CURLE_OK;
|
2013-10-30 21:56:38 +01:00
|
|
|
char *xoauth = NULL;
|
2013-08-25 19:17:01 +02:00
|
|
|
|
2013-10-30 21:56:38 +01:00
|
|
|
/* Generate the message */
|
2013-08-25 19:17:01 +02:00
|
|
|
xoauth = aprintf("user=%s\1auth=Bearer %s\1\1", user, bearer);
|
|
|
|
if(!xoauth)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
|
|
|
|
/* Base64 encode the reply */
|
2013-10-30 21:56:38 +01:00
|
|
|
result = Curl_base64_encode(data, xoauth, strlen(xoauth), outptr, outlen);
|
2013-10-24 01:16:59 +02:00
|
|
|
|
|
|
|
Curl_safefree(xoauth);
|
|
|
|
|
|
|
|
return result;
|
2013-08-25 19:17:01 +02:00
|
|
|
}
|
|
|
|
|
2012-06-02 12:07:58 +02:00
|
|
|
/*
|
|
|
|
* Curl_sasl_cleanup()
|
|
|
|
*
|
|
|
|
* This is used to cleanup any libraries or curl modules used by the sasl
|
|
|
|
* functions.
|
|
|
|
*
|
|
|
|
* Parameters:
|
|
|
|
*
|
|
|
|
* conn [in] - Pointer to the connection data.
|
|
|
|
* authused [in] - The authentication mechanism used.
|
|
|
|
*/
|
|
|
|
void Curl_sasl_cleanup(struct connectdata *conn, unsigned int authused)
|
|
|
|
{
|
|
|
|
#ifdef USE_NTLM
|
|
|
|
/* Cleanup the ntlm structure */
|
2012-06-08 20:52:28 +02:00
|
|
|
if(authused == SASL_MECH_NTLM) {
|
2012-06-02 12:07:58 +02:00
|
|
|
Curl_ntlm_sspi_cleanup(&conn->ntlm);
|
|
|
|
}
|
2012-06-03 01:00:34 +02:00
|
|
|
(void)conn;
|
2012-06-02 12:07:58 +02:00
|
|
|
#else
|
|
|
|
/* Reserved for future use */
|
|
|
|
(void)conn;
|
|
|
|
(void)authused;
|
|
|
|
#endif
|
2012-06-03 01:00:34 +02:00
|
|
|
}
|