digest_sspi.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Steve Holme, <steve_holme@hotmail.com>.
  9. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  10. *
  11. * This software is licensed as described in the file COPYING, which
  12. * you should have received as part of this distribution. The terms
  13. * are also available at https://curl.se/docs/copyright.html.
  14. *
  15. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16. * copies of the Software, and permit persons to whom the Software is
  17. * furnished to do so, under the terms of the COPYING file.
  18. *
  19. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20. * KIND, either express or implied.
  21. *
  22. * SPDX-License-Identifier: curl
  23. *
  24. * RFC2831 DIGEST-MD5 authentication
  25. *
  26. ***************************************************************************/
  27. #include "curl_setup.h"
  28. #if defined(USE_WINDOWS_SSPI) && !defined(CURL_DISABLE_DIGEST_AUTH)
  29. #include <curl/curl.h>
  30. #include "vauth/vauth.h"
  31. #include "vauth/digest.h"
  32. #include "urldata.h"
  33. #include "warnless.h"
  34. #include "curl_multibyte.h"
  35. #include "sendf.h"
  36. #include "strdup.h"
  37. #include "strcase.h"
  38. #include "strerror.h"
  39. /* The last #include files should be: */
  40. #include "curl_memory.h"
  41. #include "memdebug.h"
  42. /*
  43. * Curl_auth_is_digest_supported()
  44. *
  45. * This is used to evaluate if DIGEST is supported.
  46. *
  47. * Parameters: None
  48. *
  49. * Returns TRUE if DIGEST is supported by Windows SSPI.
  50. */
  51. bool Curl_auth_is_digest_supported(void)
  52. {
  53. PSecPkgInfo SecurityPackage;
  54. SECURITY_STATUS status;
  55. /* Query the security package for Digest */
  56. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
  57. &SecurityPackage);
  58. /* Release the package buffer as it is not required anymore */
  59. if(status == SEC_E_OK) {
  60. s_pSecFn->FreeContextBuffer(SecurityPackage);
  61. }
  62. return (status == SEC_E_OK ? TRUE : FALSE);
  63. }
  64. /*
  65. * Curl_auth_create_digest_md5_message()
  66. *
  67. * This is used to generate an already encoded DIGEST-MD5 response message
  68. * ready for sending to the recipient.
  69. *
  70. * Parameters:
  71. *
  72. * data [in] - The session handle.
  73. * chlg [in] - The challenge message.
  74. * userp [in] - The user name in the format User or Domain\User.
  75. * passwdp [in] - The user's password.
  76. * service [in] - The service type such as http, smtp, pop or imap.
  77. * out [out] - The result storage.
  78. *
  79. * Returns CURLE_OK on success.
  80. */
  81. CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
  82. const struct bufref *chlg,
  83. const char *userp,
  84. const char *passwdp,
  85. const char *service,
  86. struct bufref *out)
  87. {
  88. CURLcode result = CURLE_OK;
  89. TCHAR *spn = NULL;
  90. size_t token_max = 0;
  91. unsigned char *output_token = NULL;
  92. CredHandle credentials;
  93. CtxtHandle context;
  94. PSecPkgInfo SecurityPackage;
  95. SEC_WINNT_AUTH_IDENTITY identity;
  96. SEC_WINNT_AUTH_IDENTITY *p_identity;
  97. SecBuffer chlg_buf;
  98. SecBuffer resp_buf;
  99. SecBufferDesc chlg_desc;
  100. SecBufferDesc resp_desc;
  101. SECURITY_STATUS status;
  102. unsigned long attrs;
  103. TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
  104. /* Ensure we have a valid challenge message */
  105. if(!Curl_bufref_len(chlg)) {
  106. infof(data, "DIGEST-MD5 handshake failure (empty challenge message)");
  107. return CURLE_BAD_CONTENT_ENCODING;
  108. }
  109. /* Query the security package for DigestSSP */
  110. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
  111. &SecurityPackage);
  112. if(status != SEC_E_OK) {
  113. failf(data, "SSPI: couldn't get auth info");
  114. return CURLE_AUTH_ERROR;
  115. }
  116. token_max = SecurityPackage->cbMaxToken;
  117. /* Release the package buffer as it is not required anymore */
  118. s_pSecFn->FreeContextBuffer(SecurityPackage);
  119. /* Allocate our response buffer */
  120. output_token = malloc(token_max);
  121. if(!output_token)
  122. return CURLE_OUT_OF_MEMORY;
  123. /* Generate our SPN */
  124. spn = Curl_auth_build_spn(service, data->conn->host.name, NULL);
  125. if(!spn) {
  126. free(output_token);
  127. return CURLE_OUT_OF_MEMORY;
  128. }
  129. if(userp && *userp) {
  130. /* Populate our identity structure */
  131. result = Curl_create_sspi_identity(userp, passwdp, &identity);
  132. if(result) {
  133. free(spn);
  134. free(output_token);
  135. return result;
  136. }
  137. /* Allow proper cleanup of the identity structure */
  138. p_identity = &identity;
  139. }
  140. else
  141. /* Use the current Windows user */
  142. p_identity = NULL;
  143. /* Acquire our credentials handle */
  144. status = s_pSecFn->AcquireCredentialsHandle(NULL,
  145. (TCHAR *) TEXT(SP_NAME_DIGEST),
  146. SECPKG_CRED_OUTBOUND, NULL,
  147. p_identity, NULL, NULL,
  148. &credentials, &expiry);
  149. if(status != SEC_E_OK) {
  150. Curl_sspi_free_identity(p_identity);
  151. free(spn);
  152. free(output_token);
  153. return CURLE_LOGIN_DENIED;
  154. }
  155. /* Setup the challenge "input" security buffer */
  156. chlg_desc.ulVersion = SECBUFFER_VERSION;
  157. chlg_desc.cBuffers = 1;
  158. chlg_desc.pBuffers = &chlg_buf;
  159. chlg_buf.BufferType = SECBUFFER_TOKEN;
  160. chlg_buf.pvBuffer = (void *) Curl_bufref_ptr(chlg);
  161. chlg_buf.cbBuffer = curlx_uztoul(Curl_bufref_len(chlg));
  162. /* Setup the response "output" security buffer */
  163. resp_desc.ulVersion = SECBUFFER_VERSION;
  164. resp_desc.cBuffers = 1;
  165. resp_desc.pBuffers = &resp_buf;
  166. resp_buf.BufferType = SECBUFFER_TOKEN;
  167. resp_buf.pvBuffer = output_token;
  168. resp_buf.cbBuffer = curlx_uztoul(token_max);
  169. /* Generate our response message */
  170. status = s_pSecFn->InitializeSecurityContext(&credentials, NULL, spn,
  171. 0, 0, 0, &chlg_desc, 0,
  172. &context, &resp_desc, &attrs,
  173. &expiry);
  174. if(status == SEC_I_COMPLETE_NEEDED ||
  175. status == SEC_I_COMPLETE_AND_CONTINUE)
  176. s_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
  177. else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
  178. #if !defined(CURL_DISABLE_VERBOSE_STRINGS)
  179. char buffer[STRERROR_LEN];
  180. #endif
  181. s_pSecFn->FreeCredentialsHandle(&credentials);
  182. Curl_sspi_free_identity(p_identity);
  183. free(spn);
  184. free(output_token);
  185. if(status == SEC_E_INSUFFICIENT_MEMORY)
  186. return CURLE_OUT_OF_MEMORY;
  187. #if !defined(CURL_DISABLE_VERBOSE_STRINGS)
  188. infof(data, "schannel: InitializeSecurityContext failed: %s",
  189. Curl_sspi_strerror(status, buffer, sizeof(buffer)));
  190. #endif
  191. return CURLE_AUTH_ERROR;
  192. }
  193. /* Return the response. */
  194. Curl_bufref_set(out, output_token, resp_buf.cbBuffer, curl_free);
  195. /* Free our handles */
  196. s_pSecFn->DeleteSecurityContext(&context);
  197. s_pSecFn->FreeCredentialsHandle(&credentials);
  198. /* Free the identity structure */
  199. Curl_sspi_free_identity(p_identity);
  200. /* Free the SPN */
  201. free(spn);
  202. return result;
  203. }
  204. /*
  205. * Curl_override_sspi_http_realm()
  206. *
  207. * This is used to populate the domain in a SSPI identity structure
  208. * The realm is extracted from the challenge message and used as the
  209. * domain if it is not already explicitly set.
  210. *
  211. * Parameters:
  212. *
  213. * chlg [in] - The challenge message.
  214. * identity [in/out] - The identity structure.
  215. *
  216. * Returns CURLE_OK on success.
  217. */
  218. CURLcode Curl_override_sspi_http_realm(const char *chlg,
  219. SEC_WINNT_AUTH_IDENTITY *identity)
  220. {
  221. xcharp_u domain, dup_domain;
  222. /* If domain is blank or unset, check challenge message for realm */
  223. if(!identity->Domain || !identity->DomainLength) {
  224. for(;;) {
  225. char value[DIGEST_MAX_VALUE_LENGTH];
  226. char content[DIGEST_MAX_CONTENT_LENGTH];
  227. /* Pass all additional spaces here */
  228. while(*chlg && ISBLANK(*chlg))
  229. chlg++;
  230. /* Extract a value=content pair */
  231. if(Curl_auth_digest_get_pair(chlg, value, content, &chlg)) {
  232. if(strcasecompare(value, "realm")) {
  233. /* Setup identity's domain and length */
  234. domain.tchar_ptr = curlx_convert_UTF8_to_tchar((char *) content);
  235. if(!domain.tchar_ptr)
  236. return CURLE_OUT_OF_MEMORY;
  237. dup_domain.tchar_ptr = _tcsdup(domain.tchar_ptr);
  238. if(!dup_domain.tchar_ptr) {
  239. curlx_unicodefree(domain.tchar_ptr);
  240. return CURLE_OUT_OF_MEMORY;
  241. }
  242. free(identity->Domain);
  243. identity->Domain = dup_domain.tbyte_ptr;
  244. identity->DomainLength = curlx_uztoul(_tcslen(dup_domain.tchar_ptr));
  245. dup_domain.tchar_ptr = NULL;
  246. curlx_unicodefree(domain.tchar_ptr);
  247. }
  248. else {
  249. /* Unknown specifier, ignore it! */
  250. }
  251. }
  252. else
  253. break; /* We're done here */
  254. /* Pass all additional spaces here */
  255. while(*chlg && ISBLANK(*chlg))
  256. chlg++;
  257. /* Allow the list to be comma-separated */
  258. if(',' == *chlg)
  259. chlg++;
  260. }
  261. }
  262. return CURLE_OK;
  263. }
  264. /*
  265. * Curl_auth_decode_digest_http_message()
  266. *
  267. * This is used to decode an HTTP DIGEST challenge message into the separate
  268. * attributes.
  269. *
  270. * Parameters:
  271. *
  272. * chlg [in] - The challenge message.
  273. * digest [in/out] - The digest data struct being used and modified.
  274. *
  275. * Returns CURLE_OK on success.
  276. */
  277. CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
  278. struct digestdata *digest)
  279. {
  280. size_t chlglen = strlen(chlg);
  281. /* We had an input token before so if there's another one now that means we
  282. provided bad credentials in the previous request or it's stale. */
  283. if(digest->input_token) {
  284. bool stale = false;
  285. const char *p = chlg;
  286. /* Check for the 'stale' directive */
  287. for(;;) {
  288. char value[DIGEST_MAX_VALUE_LENGTH];
  289. char content[DIGEST_MAX_CONTENT_LENGTH];
  290. while(*p && ISBLANK(*p))
  291. p++;
  292. if(!Curl_auth_digest_get_pair(p, value, content, &p))
  293. break;
  294. if(strcasecompare(value, "stale") &&
  295. strcasecompare(content, "true")) {
  296. stale = true;
  297. break;
  298. }
  299. while(*p && ISBLANK(*p))
  300. p++;
  301. if(',' == *p)
  302. p++;
  303. }
  304. if(stale)
  305. Curl_auth_digest_cleanup(digest);
  306. else
  307. return CURLE_LOGIN_DENIED;
  308. }
  309. /* Store the challenge for use later */
  310. digest->input_token = (BYTE *) Curl_memdup(chlg, chlglen + 1);
  311. if(!digest->input_token)
  312. return CURLE_OUT_OF_MEMORY;
  313. digest->input_token_len = chlglen;
  314. return CURLE_OK;
  315. }
  316. /*
  317. * Curl_auth_create_digest_http_message()
  318. *
  319. * This is used to generate an HTTP DIGEST response message ready for sending
  320. * to the recipient.
  321. *
  322. * Parameters:
  323. *
  324. * data [in] - The session handle.
  325. * userp [in] - The user name in the format User or Domain\User.
  326. * passwdp [in] - The user's password.
  327. * request [in] - The HTTP request.
  328. * uripath [in] - The path of the HTTP uri.
  329. * digest [in/out] - The digest data struct being used and modified.
  330. * outptr [in/out] - The address where a pointer to newly allocated memory
  331. * holding the result will be stored upon completion.
  332. * outlen [out] - The length of the output message.
  333. *
  334. * Returns CURLE_OK on success.
  335. */
  336. CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
  337. const char *userp,
  338. const char *passwdp,
  339. const unsigned char *request,
  340. const unsigned char *uripath,
  341. struct digestdata *digest,
  342. char **outptr, size_t *outlen)
  343. {
  344. size_t token_max;
  345. char *resp;
  346. BYTE *output_token;
  347. size_t output_token_len = 0;
  348. PSecPkgInfo SecurityPackage;
  349. SecBuffer chlg_buf[5];
  350. SecBufferDesc chlg_desc;
  351. SECURITY_STATUS status;
  352. (void) data;
  353. /* Query the security package for DigestSSP */
  354. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
  355. &SecurityPackage);
  356. if(status != SEC_E_OK) {
  357. failf(data, "SSPI: couldn't get auth info");
  358. return CURLE_AUTH_ERROR;
  359. }
  360. token_max = SecurityPackage->cbMaxToken;
  361. /* Release the package buffer as it is not required anymore */
  362. s_pSecFn->FreeContextBuffer(SecurityPackage);
  363. /* Allocate the output buffer according to the max token size as indicated
  364. by the security package */
  365. output_token = malloc(token_max);
  366. if(!output_token) {
  367. return CURLE_OUT_OF_MEMORY;
  368. }
  369. /* If the user/passwd that was used to make the identity for http_context
  370. has changed then delete that context. */
  371. if((userp && !digest->user) || (!userp && digest->user) ||
  372. (passwdp && !digest->passwd) || (!passwdp && digest->passwd) ||
  373. (userp && digest->user && Curl_timestrcmp(userp, digest->user)) ||
  374. (passwdp && digest->passwd && Curl_timestrcmp(passwdp, digest->passwd))) {
  375. if(digest->http_context) {
  376. s_pSecFn->DeleteSecurityContext(digest->http_context);
  377. Curl_safefree(digest->http_context);
  378. }
  379. Curl_safefree(digest->user);
  380. Curl_safefree(digest->passwd);
  381. }
  382. if(digest->http_context) {
  383. chlg_desc.ulVersion = SECBUFFER_VERSION;
  384. chlg_desc.cBuffers = 5;
  385. chlg_desc.pBuffers = chlg_buf;
  386. chlg_buf[0].BufferType = SECBUFFER_TOKEN;
  387. chlg_buf[0].pvBuffer = NULL;
  388. chlg_buf[0].cbBuffer = 0;
  389. chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;
  390. chlg_buf[1].pvBuffer = (void *) request;
  391. chlg_buf[1].cbBuffer = curlx_uztoul(strlen((const char *) request));
  392. chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;
  393. chlg_buf[2].pvBuffer = (void *) uripath;
  394. chlg_buf[2].cbBuffer = curlx_uztoul(strlen((const char *) uripath));
  395. chlg_buf[3].BufferType = SECBUFFER_PKG_PARAMS;
  396. chlg_buf[3].pvBuffer = NULL;
  397. chlg_buf[3].cbBuffer = 0;
  398. chlg_buf[4].BufferType = SECBUFFER_PADDING;
  399. chlg_buf[4].pvBuffer = output_token;
  400. chlg_buf[4].cbBuffer = curlx_uztoul(token_max);
  401. status = s_pSecFn->MakeSignature(digest->http_context, 0, &chlg_desc, 0);
  402. if(status == SEC_E_OK)
  403. output_token_len = chlg_buf[4].cbBuffer;
  404. else { /* delete the context so a new one can be made */
  405. infof(data, "digest_sspi: MakeSignature failed, error 0x%08lx",
  406. (long)status);
  407. s_pSecFn->DeleteSecurityContext(digest->http_context);
  408. Curl_safefree(digest->http_context);
  409. }
  410. }
  411. if(!digest->http_context) {
  412. CredHandle credentials;
  413. SEC_WINNT_AUTH_IDENTITY identity;
  414. SEC_WINNT_AUTH_IDENTITY *p_identity;
  415. SecBuffer resp_buf;
  416. SecBufferDesc resp_desc;
  417. unsigned long attrs;
  418. TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
  419. TCHAR *spn;
  420. /* free the copy of user/passwd used to make the previous identity */
  421. Curl_safefree(digest->user);
  422. Curl_safefree(digest->passwd);
  423. if(userp && *userp) {
  424. /* Populate our identity structure */
  425. if(Curl_create_sspi_identity(userp, passwdp, &identity)) {
  426. free(output_token);
  427. return CURLE_OUT_OF_MEMORY;
  428. }
  429. /* Populate our identity domain */
  430. if(Curl_override_sspi_http_realm((const char *) digest->input_token,
  431. &identity)) {
  432. free(output_token);
  433. return CURLE_OUT_OF_MEMORY;
  434. }
  435. /* Allow proper cleanup of the identity structure */
  436. p_identity = &identity;
  437. }
  438. else
  439. /* Use the current Windows user */
  440. p_identity = NULL;
  441. if(userp) {
  442. digest->user = strdup(userp);
  443. if(!digest->user) {
  444. free(output_token);
  445. return CURLE_OUT_OF_MEMORY;
  446. }
  447. }
  448. if(passwdp) {
  449. digest->passwd = strdup(passwdp);
  450. if(!digest->passwd) {
  451. free(output_token);
  452. Curl_safefree(digest->user);
  453. return CURLE_OUT_OF_MEMORY;
  454. }
  455. }
  456. /* Acquire our credentials handle */
  457. status = s_pSecFn->AcquireCredentialsHandle(NULL,
  458. (TCHAR *) TEXT(SP_NAME_DIGEST),
  459. SECPKG_CRED_OUTBOUND, NULL,
  460. p_identity, NULL, NULL,
  461. &credentials, &expiry);
  462. if(status != SEC_E_OK) {
  463. Curl_sspi_free_identity(p_identity);
  464. free(output_token);
  465. return CURLE_LOGIN_DENIED;
  466. }
  467. /* Setup the challenge "input" security buffer if present */
  468. chlg_desc.ulVersion = SECBUFFER_VERSION;
  469. chlg_desc.cBuffers = 3;
  470. chlg_desc.pBuffers = chlg_buf;
  471. chlg_buf[0].BufferType = SECBUFFER_TOKEN;
  472. chlg_buf[0].pvBuffer = digest->input_token;
  473. chlg_buf[0].cbBuffer = curlx_uztoul(digest->input_token_len);
  474. chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;
  475. chlg_buf[1].pvBuffer = (void *) request;
  476. chlg_buf[1].cbBuffer = curlx_uztoul(strlen((const char *) request));
  477. chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;
  478. chlg_buf[2].pvBuffer = NULL;
  479. chlg_buf[2].cbBuffer = 0;
  480. /* Setup the response "output" security buffer */
  481. resp_desc.ulVersion = SECBUFFER_VERSION;
  482. resp_desc.cBuffers = 1;
  483. resp_desc.pBuffers = &resp_buf;
  484. resp_buf.BufferType = SECBUFFER_TOKEN;
  485. resp_buf.pvBuffer = output_token;
  486. resp_buf.cbBuffer = curlx_uztoul(token_max);
  487. spn = curlx_convert_UTF8_to_tchar((char *) uripath);
  488. if(!spn) {
  489. s_pSecFn->FreeCredentialsHandle(&credentials);
  490. Curl_sspi_free_identity(p_identity);
  491. free(output_token);
  492. return CURLE_OUT_OF_MEMORY;
  493. }
  494. /* Allocate our new context handle */
  495. digest->http_context = calloc(1, sizeof(CtxtHandle));
  496. if(!digest->http_context)
  497. return CURLE_OUT_OF_MEMORY;
  498. /* Generate our response message */
  499. status = s_pSecFn->InitializeSecurityContext(&credentials, NULL,
  500. spn,
  501. ISC_REQ_USE_HTTP_STYLE, 0, 0,
  502. &chlg_desc, 0,
  503. digest->http_context,
  504. &resp_desc, &attrs, &expiry);
  505. curlx_unicodefree(spn);
  506. if(status == SEC_I_COMPLETE_NEEDED ||
  507. status == SEC_I_COMPLETE_AND_CONTINUE)
  508. s_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
  509. else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
  510. #if !defined(CURL_DISABLE_VERBOSE_STRINGS)
  511. char buffer[STRERROR_LEN];
  512. #endif
  513. s_pSecFn->FreeCredentialsHandle(&credentials);
  514. Curl_sspi_free_identity(p_identity);
  515. free(output_token);
  516. Curl_safefree(digest->http_context);
  517. if(status == SEC_E_INSUFFICIENT_MEMORY)
  518. return CURLE_OUT_OF_MEMORY;
  519. #if !defined(CURL_DISABLE_VERBOSE_STRINGS)
  520. infof(data, "schannel: InitializeSecurityContext failed: %s",
  521. Curl_sspi_strerror(status, buffer, sizeof(buffer)));
  522. #endif
  523. return CURLE_AUTH_ERROR;
  524. }
  525. output_token_len = resp_buf.cbBuffer;
  526. s_pSecFn->FreeCredentialsHandle(&credentials);
  527. Curl_sspi_free_identity(p_identity);
  528. }
  529. resp = malloc(output_token_len + 1);
  530. if(!resp) {
  531. free(output_token);
  532. return CURLE_OUT_OF_MEMORY;
  533. }
  534. /* Copy the generated response */
  535. memcpy(resp, output_token, output_token_len);
  536. resp[output_token_len] = 0;
  537. /* Return the response */
  538. *outptr = resp;
  539. *outlen = output_token_len;
  540. /* Free the response buffer */
  541. free(output_token);
  542. return CURLE_OK;
  543. }
  544. /*
  545. * Curl_auth_digest_cleanup()
  546. *
  547. * This is used to clean up the digest specific data.
  548. *
  549. * Parameters:
  550. *
  551. * digest [in/out] - The digest data struct being cleaned up.
  552. *
  553. */
  554. void Curl_auth_digest_cleanup(struct digestdata *digest)
  555. {
  556. /* Free the input token */
  557. Curl_safefree(digest->input_token);
  558. /* Reset any variables */
  559. digest->input_token_len = 0;
  560. /* Delete security context */
  561. if(digest->http_context) {
  562. s_pSecFn->DeleteSecurityContext(digest->http_context);
  563. Curl_safefree(digest->http_context);
  564. }
  565. /* Free the copy of user/passwd used to make the identity for http_context */
  566. Curl_safefree(digest->user);
  567. Curl_safefree(digest->passwd);
  568. }
  569. #endif /* USE_WINDOWS_SSPI && !CURL_DISABLE_DIGEST_AUTH */