Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 1 | /*************************************************************************** |
| 2 | * _ _ ____ _ |
| 3 | * Project ___| | | | _ \| | |
| 4 | * / __| | | | |_) | | |
| 5 | * | (__| |_| | _ <| |___ |
| 6 | * \___|\___/|_| \_\_____| |
| 7 | * |
Elliott Hughes | cac3980 | 2018-04-27 16:19:43 -0700 | [diff] [blame] | 8 | * Copyright (C) 2012 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al. |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 9 | * |
| 10 | * This software is licensed as described in the file COPYING, which |
| 11 | * you should have received as part of this distribution. The terms |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 12 | * are also available at https://curl.haxx.se/docs/copyright.html. |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 13 | * |
| 14 | * You may opt to use, copy, modify, merge, publish, distribute and/or sell |
| 15 | * copies of the Software, and permit persons to whom the Software is |
| 16 | * furnished to do so, under the terms of the COPYING file. |
| 17 | * |
| 18 | * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY |
| 19 | * KIND, either express or implied. |
| 20 | * |
| 21 | * RFC2195 CRAM-MD5 authentication |
| 22 | * RFC2617 Basic and Digest Access Authentication |
| 23 | * RFC2831 DIGEST-MD5 authentication |
| 24 | * RFC4422 Simple Authentication and Security Layer (SASL) |
| 25 | * RFC4616 PLAIN authentication |
| 26 | * RFC6749 OAuth 2.0 Authorization Framework |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 27 | * RFC7628 A Set of SASL Mechanisms for OAuth |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 28 | * Draft LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt> |
| 29 | * |
| 30 | ***************************************************************************/ |
| 31 | |
| 32 | #include "curl_setup.h" |
| 33 | |
| 34 | #include <curl/curl.h> |
| 35 | #include "urldata.h" |
| 36 | |
| 37 | #include "curl_base64.h" |
| 38 | #include "curl_md5.h" |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 39 | #include "vauth/vauth.h" |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 40 | #include "vtls/vtls.h" |
| 41 | #include "curl_hmac.h" |
| 42 | #include "curl_sasl.h" |
| 43 | #include "warnless.h" |
| 44 | #include "strtok.h" |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 45 | #include "sendf.h" |
| 46 | #include "non-ascii.h" /* included for Curl_convert_... prototypes */ |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 47 | /* The last 3 #include files should be in this order */ |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 48 | #include "curl_printf.h" |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 49 | #include "curl_memory.h" |
| 50 | #include "memdebug.h" |
| 51 | |
| 52 | /* Supported mechanisms */ |
Elliott Hughes | 82be86d | 2017-09-20 17:00:17 -0700 | [diff] [blame] | 53 | static const struct { |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 54 | const char *name; /* Name */ |
| 55 | size_t len; /* Name length */ |
| 56 | unsigned int bit; /* Flag bit */ |
| 57 | } mechtable[] = { |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 58 | { "LOGIN", 5, SASL_MECH_LOGIN }, |
| 59 | { "PLAIN", 5, SASL_MECH_PLAIN }, |
| 60 | { "CRAM-MD5", 8, SASL_MECH_CRAM_MD5 }, |
| 61 | { "DIGEST-MD5", 10, SASL_MECH_DIGEST_MD5 }, |
| 62 | { "GSSAPI", 6, SASL_MECH_GSSAPI }, |
| 63 | { "EXTERNAL", 8, SASL_MECH_EXTERNAL }, |
| 64 | { "NTLM", 4, SASL_MECH_NTLM }, |
| 65 | { "XOAUTH2", 7, SASL_MECH_XOAUTH2 }, |
| 66 | { "OAUTHBEARER", 11, SASL_MECH_OAUTHBEARER }, |
| 67 | { ZERO_NULL, 0, 0 } |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 68 | }; |
| 69 | |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 70 | /* |
| 71 | * Curl_sasl_cleanup() |
| 72 | * |
| 73 | * This is used to cleanup any libraries or curl modules used by the sasl |
| 74 | * functions. |
| 75 | * |
| 76 | * Parameters: |
| 77 | * |
| 78 | * conn [in] - The connection data. |
| 79 | * authused [in] - The authentication mechanism used. |
| 80 | */ |
| 81 | void Curl_sasl_cleanup(struct connectdata *conn, unsigned int authused) |
| 82 | { |
| 83 | #if defined(USE_KERBEROS5) |
| 84 | /* Cleanup the gssapi structure */ |
| 85 | if(authused == SASL_MECH_GSSAPI) { |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 86 | Curl_auth_gssapi_cleanup(&conn->krb5); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 87 | } |
| 88 | #endif |
| 89 | |
| 90 | #if defined(USE_NTLM) |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 91 | /* Cleanup the NTLM structure */ |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 92 | if(authused == SASL_MECH_NTLM) { |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 93 | Curl_auth_ntlm_cleanup(&conn->ntlm); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 94 | } |
| 95 | #endif |
| 96 | |
| 97 | #if !defined(USE_KERBEROS5) && !defined(USE_NTLM) |
| 98 | /* Reserved for future use */ |
| 99 | (void)conn; |
| 100 | (void)authused; |
| 101 | #endif |
| 102 | } |
| 103 | |
| 104 | /* |
| 105 | * Curl_sasl_decode_mech() |
| 106 | * |
| 107 | * Convert a SASL mechanism name into a token. |
| 108 | * |
| 109 | * Parameters: |
| 110 | * |
| 111 | * ptr [in] - The mechanism string. |
| 112 | * maxlen [in] - Maximum mechanism string length. |
| 113 | * len [out] - If not NULL, effective name length. |
| 114 | * |
| 115 | * Returns the SASL mechanism token or 0 if no match. |
| 116 | */ |
| 117 | unsigned int Curl_sasl_decode_mech(const char *ptr, size_t maxlen, size_t *len) |
| 118 | { |
| 119 | unsigned int i; |
| 120 | char c; |
| 121 | |
| 122 | for(i = 0; mechtable[i].name; i++) { |
| 123 | if(maxlen >= mechtable[i].len && |
| 124 | !memcmp(ptr, mechtable[i].name, mechtable[i].len)) { |
| 125 | if(len) |
| 126 | *len = mechtable[i].len; |
| 127 | |
| 128 | if(maxlen == mechtable[i].len) |
| 129 | return mechtable[i].bit; |
| 130 | |
| 131 | c = ptr[mechtable[i].len]; |
| 132 | if(!ISUPPER(c) && !ISDIGIT(c) && c != '-' && c != '_') |
| 133 | return mechtable[i].bit; |
| 134 | } |
| 135 | } |
| 136 | |
| 137 | return 0; |
| 138 | } |
| 139 | |
| 140 | /* |
| 141 | * Curl_sasl_parse_url_auth_option() |
| 142 | * |
| 143 | * Parse the URL login options. |
| 144 | */ |
| 145 | CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl, |
| 146 | const char *value, size_t len) |
| 147 | { |
| 148 | CURLcode result = CURLE_OK; |
| 149 | unsigned int mechbit; |
| 150 | size_t mechlen; |
| 151 | |
| 152 | if(!len) |
| 153 | return CURLE_URL_MALFORMAT; |
| 154 | |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 155 | if(sasl->resetprefs) { |
| 156 | sasl->resetprefs = FALSE; |
| 157 | sasl->prefmech = SASL_AUTH_NONE; |
| 158 | } |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 159 | |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 160 | if(!strncmp(value, "*", len)) |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 161 | sasl->prefmech = SASL_AUTH_DEFAULT; |
| 162 | else { |
| 163 | mechbit = Curl_sasl_decode_mech(value, len, &mechlen); |
| 164 | if(mechbit && mechlen == len) |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 165 | sasl->prefmech |= mechbit; |
| 166 | else |
| 167 | result = CURLE_URL_MALFORMAT; |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 168 | } |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 169 | |
| 170 | return result; |
| 171 | } |
| 172 | |
| 173 | /* |
| 174 | * Curl_sasl_init() |
| 175 | * |
| 176 | * Initializes the SASL structure. |
| 177 | */ |
| 178 | void Curl_sasl_init(struct SASL *sasl, const struct SASLproto *params) |
| 179 | { |
| 180 | sasl->params = params; /* Set protocol dependent parameters */ |
| 181 | sasl->state = SASL_STOP; /* Not yet running */ |
| 182 | sasl->authmechs = SASL_AUTH_NONE; /* No known authentication mechanism yet */ |
| 183 | sasl->prefmech = SASL_AUTH_DEFAULT; /* Prefer all mechanisms */ |
| 184 | sasl->authused = SASL_AUTH_NONE; /* No the authentication mechanism used */ |
| 185 | sasl->resetprefs = TRUE; /* Reset prefmech upon AUTH parsing. */ |
| 186 | sasl->mutual_auth = FALSE; /* No mutual authentication (GSSAPI only) */ |
| 187 | sasl->force_ir = FALSE; /* Respect external option */ |
| 188 | } |
| 189 | |
| 190 | /* |
| 191 | * state() |
| 192 | * |
| 193 | * This is the ONLY way to change SASL state! |
| 194 | */ |
| 195 | static void state(struct SASL *sasl, struct connectdata *conn, |
| 196 | saslstate newstate) |
| 197 | { |
| 198 | #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS) |
| 199 | /* for debug purposes */ |
| 200 | static const char * const names[]={ |
| 201 | "STOP", |
| 202 | "PLAIN", |
| 203 | "LOGIN", |
| 204 | "LOGIN_PASSWD", |
| 205 | "EXTERNAL", |
| 206 | "CRAMMD5", |
| 207 | "DIGESTMD5", |
| 208 | "DIGESTMD5_RESP", |
| 209 | "NTLM", |
| 210 | "NTLM_TYPE2MSG", |
| 211 | "GSSAPI", |
| 212 | "GSSAPI_TOKEN", |
| 213 | "GSSAPI_NO_DATA", |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 214 | "OAUTH2", |
| 215 | "OAUTH2_RESP", |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 216 | "CANCEL", |
| 217 | "FINAL", |
| 218 | /* LAST */ |
| 219 | }; |
| 220 | |
| 221 | if(sasl->state != newstate) |
| 222 | infof(conn->data, "SASL %p state change from %s to %s\n", |
| 223 | (void *)sasl, names[sasl->state], names[newstate]); |
| 224 | #else |
| 225 | (void) conn; |
| 226 | #endif |
| 227 | |
| 228 | sasl->state = newstate; |
| 229 | } |
| 230 | |
| 231 | /* |
| 232 | * Curl_sasl_can_authenticate() |
| 233 | * |
| 234 | * Check if we have enough auth data and capabilities to authenticate. |
| 235 | */ |
| 236 | bool Curl_sasl_can_authenticate(struct SASL *sasl, struct connectdata *conn) |
| 237 | { |
| 238 | /* Have credentials been provided? */ |
| 239 | if(conn->bits.user_passwd) |
| 240 | return TRUE; |
| 241 | |
| 242 | /* EXTERNAL can authenticate without a user name and/or password */ |
| 243 | if(sasl->authmechs & sasl->prefmech & SASL_MECH_EXTERNAL) |
| 244 | return TRUE; |
| 245 | |
| 246 | return FALSE; |
| 247 | } |
| 248 | |
| 249 | /* |
| 250 | * Curl_sasl_start() |
| 251 | * |
| 252 | * Calculate the required login details for SASL authentication. |
| 253 | */ |
| 254 | CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn, |
| 255 | bool force_ir, saslprogress *progress) |
| 256 | { |
| 257 | CURLcode result = CURLE_OK; |
Alex Deymo | e3149cc | 2016-10-05 11:18:42 -0700 | [diff] [blame] | 258 | struct Curl_easy *data = conn->data; |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 259 | unsigned int enabledmechs; |
| 260 | const char *mech = NULL; |
| 261 | char *resp = NULL; |
| 262 | size_t len = 0; |
| 263 | saslstate state1 = SASL_STOP; |
| 264 | saslstate state2 = SASL_FINAL; |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 265 | const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name : |
| 266 | conn->host.name; |
| 267 | const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port; |
Elliott Hughes | 1ef06ba | 2018-05-30 15:43:58 -0700 | [diff] [blame] | 268 | #if defined(USE_KERBEROS5) || defined(USE_NTLM) |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 269 | const char *service = data->set.str[STRING_SERVICE_NAME] ? |
| 270 | data->set.str[STRING_SERVICE_NAME] : |
| 271 | sasl->params->service; |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 272 | #endif |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 273 | |
| 274 | sasl->force_ir = force_ir; /* Latch for future use */ |
| 275 | sasl->authused = 0; /* No mechanism used yet */ |
| 276 | enabledmechs = sasl->authmechs & sasl->prefmech; |
| 277 | *progress = SASL_IDLE; |
| 278 | |
| 279 | /* Calculate the supported authentication mechanism, by decreasing order of |
| 280 | security, as well as the initial response where appropriate */ |
| 281 | if((enabledmechs & SASL_MECH_EXTERNAL) && !conn->passwd[0]) { |
| 282 | mech = SASL_MECH_STRING_EXTERNAL; |
| 283 | state1 = SASL_EXTERNAL; |
| 284 | sasl->authused = SASL_MECH_EXTERNAL; |
| 285 | |
| 286 | if(force_ir || data->set.sasl_ir) |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 287 | result = Curl_auth_create_external_message(data, conn->user, &resp, |
| 288 | &len); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 289 | } |
| 290 | else if(conn->bits.user_passwd) { |
| 291 | #if defined(USE_KERBEROS5) |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 292 | if((enabledmechs & SASL_MECH_GSSAPI) && Curl_auth_is_gssapi_supported() && |
| 293 | Curl_auth_user_contains_domain(conn->user)) { |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 294 | sasl->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */ |
| 295 | mech = SASL_MECH_STRING_GSSAPI; |
| 296 | state1 = SASL_GSSAPI; |
| 297 | state2 = SASL_GSSAPI_TOKEN; |
| 298 | sasl->authused = SASL_MECH_GSSAPI; |
| 299 | |
| 300 | if(force_ir || data->set.sasl_ir) |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 301 | result = Curl_auth_create_gssapi_user_message(data, conn->user, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 302 | conn->passwd, |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 303 | service, |
| 304 | data->easy_conn-> |
| 305 | host.name, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 306 | sasl->mutual_auth, |
| 307 | NULL, &conn->krb5, |
| 308 | &resp, &len); |
| 309 | } |
| 310 | else |
| 311 | #endif |
| 312 | #ifndef CURL_DISABLE_CRYPTO_AUTH |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 313 | if((enabledmechs & SASL_MECH_DIGEST_MD5) && |
| 314 | Curl_auth_is_digest_supported()) { |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 315 | mech = SASL_MECH_STRING_DIGEST_MD5; |
| 316 | state1 = SASL_DIGESTMD5; |
| 317 | sasl->authused = SASL_MECH_DIGEST_MD5; |
| 318 | } |
| 319 | else if(enabledmechs & SASL_MECH_CRAM_MD5) { |
| 320 | mech = SASL_MECH_STRING_CRAM_MD5; |
| 321 | state1 = SASL_CRAMMD5; |
| 322 | sasl->authused = SASL_MECH_CRAM_MD5; |
| 323 | } |
| 324 | else |
| 325 | #endif |
| 326 | #ifdef USE_NTLM |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 327 | if((enabledmechs & SASL_MECH_NTLM) && Curl_auth_is_ntlm_supported()) { |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 328 | mech = SASL_MECH_STRING_NTLM; |
| 329 | state1 = SASL_NTLM; |
| 330 | state2 = SASL_NTLM_TYPE2MSG; |
| 331 | sasl->authused = SASL_MECH_NTLM; |
| 332 | |
| 333 | if(force_ir || data->set.sasl_ir) |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 334 | result = Curl_auth_create_ntlm_type1_message(data, |
| 335 | conn->user, conn->passwd, |
Elliott Hughes | 1ef06ba | 2018-05-30 15:43:58 -0700 | [diff] [blame] | 336 | service, |
| 337 | hostname, |
| 338 | &conn->ntlm, &resp, |
| 339 | &len); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 340 | } |
| 341 | else |
| 342 | #endif |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 343 | if((enabledmechs & SASL_MECH_OAUTHBEARER) && conn->oauth_bearer) { |
| 344 | mech = SASL_MECH_STRING_OAUTHBEARER; |
| 345 | state1 = SASL_OAUTH2; |
| 346 | state2 = SASL_OAUTH2_RESP; |
| 347 | sasl->authused = SASL_MECH_OAUTHBEARER; |
| 348 | |
| 349 | if(force_ir || data->set.sasl_ir) |
| 350 | result = Curl_auth_create_oauth_bearer_message(data, conn->user, |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 351 | hostname, |
| 352 | port, |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 353 | conn->oauth_bearer, |
| 354 | &resp, &len); |
| 355 | } |
| 356 | else if((enabledmechs & SASL_MECH_XOAUTH2) && conn->oauth_bearer) { |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 357 | mech = SASL_MECH_STRING_XOAUTH2; |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 358 | state1 = SASL_OAUTH2; |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 359 | sasl->authused = SASL_MECH_XOAUTH2; |
| 360 | |
| 361 | if(force_ir || data->set.sasl_ir) |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 362 | result = Curl_auth_create_oauth_bearer_message(data, conn->user, |
| 363 | NULL, 0, |
| 364 | conn->oauth_bearer, |
| 365 | &resp, &len); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 366 | } |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 367 | else if(enabledmechs & SASL_MECH_PLAIN) { |
| 368 | mech = SASL_MECH_STRING_PLAIN; |
| 369 | state1 = SASL_PLAIN; |
| 370 | sasl->authused = SASL_MECH_PLAIN; |
| 371 | |
| 372 | if(force_ir || data->set.sasl_ir) |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 373 | result = Curl_auth_create_plain_message(data, conn->user, conn->passwd, |
| 374 | &resp, &len); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 375 | } |
Elliott Hughes | cac3980 | 2018-04-27 16:19:43 -0700 | [diff] [blame] | 376 | else if(enabledmechs & SASL_MECH_LOGIN) { |
| 377 | mech = SASL_MECH_STRING_LOGIN; |
| 378 | state1 = SASL_LOGIN; |
| 379 | state2 = SASL_LOGIN_PASSWD; |
| 380 | sasl->authused = SASL_MECH_LOGIN; |
| 381 | |
| 382 | if(force_ir || data->set.sasl_ir) |
| 383 | result = Curl_auth_create_login_message(data, conn->user, &resp, &len); |
| 384 | } |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 385 | } |
| 386 | |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 387 | if(!result && mech) { |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 388 | if(resp && sasl->params->maxirlen && |
| 389 | strlen(mech) + len > sasl->params->maxirlen) { |
| 390 | free(resp); |
| 391 | resp = NULL; |
| 392 | } |
| 393 | |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 394 | result = sasl->params->sendauth(conn, mech, resp); |
| 395 | if(!result) { |
| 396 | *progress = SASL_INPROGRESS; |
| 397 | state(sasl, conn, resp ? state2 : state1); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 398 | } |
| 399 | } |
| 400 | |
| 401 | free(resp); |
| 402 | |
| 403 | return result; |
| 404 | } |
| 405 | |
| 406 | /* |
| 407 | * Curl_sasl_continue() |
| 408 | * |
| 409 | * Continue the authentication. |
| 410 | */ |
| 411 | CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn, |
| 412 | int code, saslprogress *progress) |
| 413 | { |
| 414 | CURLcode result = CURLE_OK; |
Alex Deymo | e3149cc | 2016-10-05 11:18:42 -0700 | [diff] [blame] | 415 | struct Curl_easy *data = conn->data; |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 416 | saslstate newstate = SASL_FINAL; |
| 417 | char *resp = NULL; |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 418 | const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name : |
| 419 | conn->host.name; |
| 420 | const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port; |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 421 | #if !defined(CURL_DISABLE_CRYPTO_AUTH) |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 422 | char *chlg = NULL; |
| 423 | size_t chlglen = 0; |
| 424 | #endif |
Elliott Hughes | 1ef06ba | 2018-05-30 15:43:58 -0700 | [diff] [blame] | 425 | #if !defined(CURL_DISABLE_CRYPTO_AUTH) || defined(USE_KERBEROS5) || \ |
| 426 | defined(USE_NTLM) |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 427 | const char *service = data->set.str[STRING_SERVICE_NAME] ? |
| 428 | data->set.str[STRING_SERVICE_NAME] : |
| 429 | sasl->params->service; |
Elliott Hughes | 82be86d | 2017-09-20 17:00:17 -0700 | [diff] [blame] | 430 | char *serverdata; |
| 431 | #endif |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 432 | size_t len = 0; |
| 433 | |
| 434 | *progress = SASL_INPROGRESS; |
| 435 | |
| 436 | if(sasl->state == SASL_FINAL) { |
| 437 | if(code != sasl->params->finalcode) |
| 438 | result = CURLE_LOGIN_DENIED; |
| 439 | *progress = SASL_DONE; |
| 440 | state(sasl, conn, SASL_STOP); |
| 441 | return result; |
| 442 | } |
| 443 | |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 444 | if(sasl->state != SASL_CANCEL && sasl->state != SASL_OAUTH2_RESP && |
| 445 | code != sasl->params->contcode) { |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 446 | *progress = SASL_DONE; |
| 447 | state(sasl, conn, SASL_STOP); |
| 448 | return CURLE_LOGIN_DENIED; |
| 449 | } |
| 450 | |
| 451 | switch(sasl->state) { |
| 452 | case SASL_STOP: |
| 453 | *progress = SASL_DONE; |
| 454 | return result; |
| 455 | case SASL_PLAIN: |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 456 | result = Curl_auth_create_plain_message(data, conn->user, conn->passwd, |
| 457 | &resp, |
| 458 | &len); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 459 | break; |
| 460 | case SASL_LOGIN: |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 461 | result = Curl_auth_create_login_message(data, conn->user, &resp, &len); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 462 | newstate = SASL_LOGIN_PASSWD; |
| 463 | break; |
| 464 | case SASL_LOGIN_PASSWD: |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 465 | result = Curl_auth_create_login_message(data, conn->passwd, &resp, &len); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 466 | break; |
| 467 | case SASL_EXTERNAL: |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 468 | result = Curl_auth_create_external_message(data, conn->user, &resp, &len); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 469 | break; |
| 470 | |
| 471 | #ifndef CURL_DISABLE_CRYPTO_AUTH |
| 472 | case SASL_CRAMMD5: |
| 473 | sasl->params->getmessage(data->state.buffer, &serverdata); |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 474 | result = Curl_auth_decode_cram_md5_message(serverdata, &chlg, &chlglen); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 475 | if(!result) |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 476 | result = Curl_auth_create_cram_md5_message(data, chlg, conn->user, |
| 477 | conn->passwd, &resp, &len); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 478 | free(chlg); |
| 479 | break; |
| 480 | case SASL_DIGESTMD5: |
| 481 | sasl->params->getmessage(data->state.buffer, &serverdata); |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 482 | result = Curl_auth_create_digest_md5_message(data, serverdata, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 483 | conn->user, conn->passwd, |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 484 | service, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 485 | &resp, &len); |
| 486 | newstate = SASL_DIGESTMD5_RESP; |
| 487 | break; |
| 488 | case SASL_DIGESTMD5_RESP: |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 489 | resp = strdup(""); |
| 490 | if(!resp) |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 491 | result = CURLE_OUT_OF_MEMORY; |
| 492 | break; |
| 493 | #endif |
| 494 | |
| 495 | #ifdef USE_NTLM |
| 496 | case SASL_NTLM: |
| 497 | /* Create the type-1 message */ |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 498 | result = Curl_auth_create_ntlm_type1_message(data, |
| 499 | conn->user, conn->passwd, |
Elliott Hughes | 1ef06ba | 2018-05-30 15:43:58 -0700 | [diff] [blame] | 500 | service, hostname, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 501 | &conn->ntlm, &resp, &len); |
| 502 | newstate = SASL_NTLM_TYPE2MSG; |
| 503 | break; |
| 504 | case SASL_NTLM_TYPE2MSG: |
| 505 | /* Decode the type-2 message */ |
| 506 | sasl->params->getmessage(data->state.buffer, &serverdata); |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 507 | result = Curl_auth_decode_ntlm_type2_message(data, serverdata, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 508 | &conn->ntlm); |
| 509 | if(!result) |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 510 | result = Curl_auth_create_ntlm_type3_message(data, conn->user, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 511 | conn->passwd, &conn->ntlm, |
| 512 | &resp, &len); |
| 513 | break; |
| 514 | #endif |
| 515 | |
| 516 | #if defined(USE_KERBEROS5) |
| 517 | case SASL_GSSAPI: |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 518 | result = Curl_auth_create_gssapi_user_message(data, conn->user, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 519 | conn->passwd, |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 520 | service, |
| 521 | data->easy_conn->host.name, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 522 | sasl->mutual_auth, NULL, |
| 523 | &conn->krb5, |
| 524 | &resp, &len); |
| 525 | newstate = SASL_GSSAPI_TOKEN; |
| 526 | break; |
| 527 | case SASL_GSSAPI_TOKEN: |
| 528 | sasl->params->getmessage(data->state.buffer, &serverdata); |
| 529 | if(sasl->mutual_auth) { |
| 530 | /* Decode the user token challenge and create the optional response |
| 531 | message */ |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 532 | result = Curl_auth_create_gssapi_user_message(data, NULL, NULL, |
| 533 | NULL, NULL, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 534 | sasl->mutual_auth, |
| 535 | serverdata, &conn->krb5, |
| 536 | &resp, &len); |
| 537 | newstate = SASL_GSSAPI_NO_DATA; |
| 538 | } |
| 539 | else |
| 540 | /* Decode the security challenge and create the response message */ |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 541 | result = Curl_auth_create_gssapi_security_message(data, serverdata, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 542 | &conn->krb5, |
| 543 | &resp, &len); |
| 544 | break; |
| 545 | case SASL_GSSAPI_NO_DATA: |
| 546 | sasl->params->getmessage(data->state.buffer, &serverdata); |
| 547 | /* Decode the security challenge and create the response message */ |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 548 | result = Curl_auth_create_gssapi_security_message(data, serverdata, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 549 | &conn->krb5, |
| 550 | &resp, &len); |
| 551 | break; |
| 552 | #endif |
| 553 | |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 554 | case SASL_OAUTH2: |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 555 | /* Create the authorisation message */ |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 556 | if(sasl->authused == SASL_MECH_OAUTHBEARER) { |
| 557 | result = Curl_auth_create_oauth_bearer_message(data, conn->user, |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 558 | hostname, |
| 559 | port, |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 560 | conn->oauth_bearer, |
| 561 | &resp, &len); |
| 562 | |
| 563 | /* Failures maybe sent by the server as continuations for OAUTHBEARER */ |
| 564 | newstate = SASL_OAUTH2_RESP; |
| 565 | } |
| 566 | else |
| 567 | result = Curl_auth_create_oauth_bearer_message(data, conn->user, |
| 568 | NULL, 0, |
| 569 | conn->oauth_bearer, |
| 570 | &resp, &len); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 571 | break; |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 572 | |
| 573 | case SASL_OAUTH2_RESP: |
| 574 | /* The continuation is optional so check the response code */ |
| 575 | if(code == sasl->params->finalcode) { |
| 576 | /* Final response was received so we are done */ |
| 577 | *progress = SASL_DONE; |
| 578 | state(sasl, conn, SASL_STOP); |
| 579 | return result; |
| 580 | } |
| 581 | else if(code == sasl->params->contcode) { |
| 582 | /* Acknowledge the continuation by sending a 0x01 response base64 |
| 583 | encoded */ |
| 584 | resp = strdup("AQ=="); |
| 585 | if(!resp) |
| 586 | result = CURLE_OUT_OF_MEMORY; |
| 587 | break; |
| 588 | } |
| 589 | else { |
| 590 | *progress = SASL_DONE; |
| 591 | state(sasl, conn, SASL_STOP); |
| 592 | return CURLE_LOGIN_DENIED; |
| 593 | } |
| 594 | |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 595 | case SASL_CANCEL: |
| 596 | /* Remove the offending mechanism from the supported list */ |
| 597 | sasl->authmechs ^= sasl->authused; |
| 598 | |
| 599 | /* Start an alternative SASL authentication */ |
| 600 | result = Curl_sasl_start(sasl, conn, sasl->force_ir, progress); |
| 601 | newstate = sasl->state; /* Use state from Curl_sasl_start() */ |
| 602 | break; |
| 603 | default: |
| 604 | failf(data, "Unsupported SASL authentication mechanism"); |
| 605 | result = CURLE_UNSUPPORTED_PROTOCOL; /* Should not happen */ |
| 606 | break; |
| 607 | } |
| 608 | |
| 609 | switch(result) { |
| 610 | case CURLE_BAD_CONTENT_ENCODING: |
| 611 | /* Cancel dialog */ |
| 612 | result = sasl->params->sendcont(conn, "*"); |
| 613 | newstate = SASL_CANCEL; |
| 614 | break; |
| 615 | case CURLE_OK: |
| 616 | if(resp) |
| 617 | result = sasl->params->sendcont(conn, resp); |
| 618 | break; |
| 619 | default: |
| 620 | newstate = SASL_STOP; /* Stop on error */ |
| 621 | *progress = SASL_DONE; |
| 622 | break; |
| 623 | } |
| 624 | |
| 625 | free(resp); |
| 626 | |
| 627 | state(sasl, conn, newstate); |
| 628 | |
| 629 | return result; |
| 630 | } |