curl_sasl.c 24 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. * RFC2195 CRAM-MD5 authentication
  24. * RFC2617 Basic and Digest Access Authentication
  25. * RFC2831 DIGEST-MD5 authentication
  26. * RFC4422 Simple Authentication and Security Layer (SASL)
  27. * RFC4616 PLAIN authentication
  28. * RFC5802 SCRAM-SHA-1 authentication
  29. * RFC7677 SCRAM-SHA-256 authentication
  30. * RFC6749 OAuth 2.0 Authorization Framework
  31. * RFC7628 A Set of SASL Mechanisms for OAuth
  32. * Draft LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
  33. *
  34. ***************************************************************************/
  35. #include "curl_setup.h"
  36. #if !defined(CURL_DISABLE_IMAP) || !defined(CURL_DISABLE_SMTP) || \
  37. !defined(CURL_DISABLE_POP3) || \
  38. (!defined(CURL_DISABLE_LDAP) && defined(USE_OPENLDAP))
  39. #include <curl/curl.h>
  40. #include "urldata.h"
  41. #include "curl_base64.h"
  42. #include "curl_md5.h"
  43. #include "vauth/vauth.h"
  44. #include "cfilters.h"
  45. #include "vtls/vtls.h"
  46. #include "curl_hmac.h"
  47. #include "curl_sasl.h"
  48. #include "warnless.h"
  49. #include "strtok.h"
  50. #include "sendf.h"
  51. /* The last 3 #include files should be in this order */
  52. #include "curl_printf.h"
  53. #include "curl_memory.h"
  54. #include "memdebug.h"
  55. /* Supported mechanisms */
  56. static const struct {
  57. const char *name; /* Name */
  58. size_t len; /* Name length */
  59. unsigned short bit; /* Flag bit */
  60. } mechtable[] = {
  61. { "LOGIN", 5, SASL_MECH_LOGIN },
  62. { "PLAIN", 5, SASL_MECH_PLAIN },
  63. { "CRAM-MD5", 8, SASL_MECH_CRAM_MD5 },
  64. { "DIGEST-MD5", 10, SASL_MECH_DIGEST_MD5 },
  65. { "GSSAPI", 6, SASL_MECH_GSSAPI },
  66. { "EXTERNAL", 8, SASL_MECH_EXTERNAL },
  67. { "NTLM", 4, SASL_MECH_NTLM },
  68. { "XOAUTH2", 7, SASL_MECH_XOAUTH2 },
  69. { "OAUTHBEARER", 11, SASL_MECH_OAUTHBEARER },
  70. { "SCRAM-SHA-1", 11, SASL_MECH_SCRAM_SHA_1 },
  71. { "SCRAM-SHA-256",13, SASL_MECH_SCRAM_SHA_256 },
  72. { ZERO_NULL, 0, 0 }
  73. };
  74. /*
  75. * Curl_sasl_cleanup()
  76. *
  77. * This is used to cleanup any libraries or curl modules used by the sasl
  78. * functions.
  79. *
  80. * Parameters:
  81. *
  82. * conn [in] - The connection data.
  83. * authused [in] - The authentication mechanism used.
  84. */
  85. void Curl_sasl_cleanup(struct connectdata *conn, unsigned short authused)
  86. {
  87. (void)conn;
  88. (void)authused;
  89. #if defined(USE_KERBEROS5)
  90. /* Cleanup the gssapi structure */
  91. if(authused == SASL_MECH_GSSAPI) {
  92. Curl_auth_cleanup_gssapi(&conn->krb5);
  93. }
  94. #endif
  95. #if defined(USE_GSASL)
  96. /* Cleanup the GSASL structure */
  97. if(authused & (SASL_MECH_SCRAM_SHA_1 | SASL_MECH_SCRAM_SHA_256)) {
  98. Curl_auth_gsasl_cleanup(&conn->gsasl);
  99. }
  100. #endif
  101. #if defined(USE_NTLM)
  102. /* Cleanup the NTLM structure */
  103. if(authused == SASL_MECH_NTLM) {
  104. Curl_auth_cleanup_ntlm(&conn->ntlm);
  105. }
  106. #endif
  107. }
  108. /*
  109. * Curl_sasl_decode_mech()
  110. *
  111. * Convert a SASL mechanism name into a token.
  112. *
  113. * Parameters:
  114. *
  115. * ptr [in] - The mechanism string.
  116. * maxlen [in] - Maximum mechanism string length.
  117. * len [out] - If not NULL, effective name length.
  118. *
  119. * Returns the SASL mechanism token or 0 if no match.
  120. */
  121. unsigned short Curl_sasl_decode_mech(const char *ptr, size_t maxlen,
  122. size_t *len)
  123. {
  124. unsigned int i;
  125. char c;
  126. for(i = 0; mechtable[i].name; i++) {
  127. if(maxlen >= mechtable[i].len &&
  128. !memcmp(ptr, mechtable[i].name, mechtable[i].len)) {
  129. if(len)
  130. *len = mechtable[i].len;
  131. if(maxlen == mechtable[i].len)
  132. return mechtable[i].bit;
  133. c = ptr[mechtable[i].len];
  134. if(!ISUPPER(c) && !ISDIGIT(c) && c != '-' && c != '_')
  135. return mechtable[i].bit;
  136. }
  137. }
  138. return 0;
  139. }
  140. /*
  141. * Curl_sasl_parse_url_auth_option()
  142. *
  143. * Parse the URL login options.
  144. */
  145. CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl,
  146. const char *value, size_t len)
  147. {
  148. CURLcode result = CURLE_OK;
  149. size_t mechlen;
  150. if(!len)
  151. return CURLE_URL_MALFORMAT;
  152. if(sasl->resetprefs) {
  153. sasl->resetprefs = FALSE;
  154. sasl->prefmech = SASL_AUTH_NONE;
  155. }
  156. if(!strncmp(value, "*", len))
  157. sasl->prefmech = SASL_AUTH_DEFAULT;
  158. else {
  159. unsigned short mechbit = Curl_sasl_decode_mech(value, len, &mechlen);
  160. if(mechbit && mechlen == len)
  161. sasl->prefmech |= mechbit;
  162. else
  163. result = CURLE_URL_MALFORMAT;
  164. }
  165. return result;
  166. }
  167. /*
  168. * Curl_sasl_init()
  169. *
  170. * Initializes the SASL structure.
  171. */
  172. void Curl_sasl_init(struct SASL *sasl, struct Curl_easy *data,
  173. const struct SASLproto *params)
  174. {
  175. unsigned long auth = data->set.httpauth;
  176. sasl->params = params; /* Set protocol dependent parameters */
  177. sasl->state = SASL_STOP; /* Not yet running */
  178. sasl->curmech = NULL; /* No mechanism yet. */
  179. sasl->authmechs = SASL_AUTH_NONE; /* No known authentication mechanism yet */
  180. sasl->prefmech = params->defmechs; /* Default preferred mechanisms */
  181. sasl->authused = SASL_AUTH_NONE; /* The authentication mechanism used */
  182. sasl->resetprefs = TRUE; /* Reset prefmech upon AUTH parsing. */
  183. sasl->mutual_auth = FALSE; /* No mutual authentication (GSSAPI only) */
  184. sasl->force_ir = FALSE; /* Respect external option */
  185. if(auth != CURLAUTH_BASIC) {
  186. unsigned short mechs = SASL_AUTH_NONE;
  187. /* If some usable http authentication options have been set, determine
  188. new defaults from them. */
  189. if(auth & CURLAUTH_BASIC)
  190. mechs |= SASL_MECH_PLAIN | SASL_MECH_LOGIN;
  191. if(auth & CURLAUTH_DIGEST)
  192. mechs |= SASL_MECH_DIGEST_MD5;
  193. if(auth & CURLAUTH_NTLM)
  194. mechs |= SASL_MECH_NTLM;
  195. if(auth & CURLAUTH_BEARER)
  196. mechs |= SASL_MECH_OAUTHBEARER | SASL_MECH_XOAUTH2;
  197. if(auth & CURLAUTH_GSSAPI)
  198. mechs |= SASL_MECH_GSSAPI;
  199. if(mechs != SASL_AUTH_NONE)
  200. sasl->prefmech = mechs;
  201. }
  202. }
  203. /*
  204. * sasl_state()
  205. *
  206. * This is the ONLY way to change SASL state!
  207. */
  208. static void sasl_state(struct SASL *sasl, struct Curl_easy *data,
  209. saslstate newstate)
  210. {
  211. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  212. /* for debug purposes */
  213. static const char * const names[]={
  214. "STOP",
  215. "PLAIN",
  216. "LOGIN",
  217. "LOGIN_PASSWD",
  218. "EXTERNAL",
  219. "CRAMMD5",
  220. "DIGESTMD5",
  221. "DIGESTMD5_RESP",
  222. "NTLM",
  223. "NTLM_TYPE2MSG",
  224. "GSSAPI",
  225. "GSSAPI_TOKEN",
  226. "GSSAPI_NO_DATA",
  227. "OAUTH2",
  228. "OAUTH2_RESP",
  229. "GSASL",
  230. "CANCEL",
  231. "FINAL",
  232. /* LAST */
  233. };
  234. if(sasl->state != newstate)
  235. infof(data, "SASL %p state change from %s to %s",
  236. (void *)sasl, names[sasl->state], names[newstate]);
  237. #else
  238. (void) data;
  239. #endif
  240. sasl->state = newstate;
  241. }
  242. #if defined(USE_NTLM) || defined(USE_GSASL) || defined(USE_KERBEROS5) || \
  243. !defined(CURL_DISABLE_DIGEST_AUTH)
  244. /* Get the SASL server message and convert it to binary. */
  245. static CURLcode get_server_message(struct SASL *sasl, struct Curl_easy *data,
  246. struct bufref *out)
  247. {
  248. CURLcode result = CURLE_OK;
  249. result = sasl->params->getmessage(data, out);
  250. if(!result && (sasl->params->flags & SASL_FLAG_BASE64)) {
  251. unsigned char *msg;
  252. size_t msglen;
  253. const char *serverdata = (const char *) Curl_bufref_ptr(out);
  254. if(!*serverdata || *serverdata == '=')
  255. Curl_bufref_set(out, NULL, 0, NULL);
  256. else {
  257. result = Curl_base64_decode(serverdata, &msg, &msglen);
  258. if(!result)
  259. Curl_bufref_set(out, msg, msglen, curl_free);
  260. }
  261. }
  262. return result;
  263. }
  264. #endif
  265. /* Encode the outgoing SASL message. */
  266. static CURLcode build_message(struct SASL *sasl, struct bufref *msg)
  267. {
  268. CURLcode result = CURLE_OK;
  269. if(sasl->params->flags & SASL_FLAG_BASE64) {
  270. if(!Curl_bufref_ptr(msg)) /* Empty message. */
  271. Curl_bufref_set(msg, "", 0, NULL);
  272. else if(!Curl_bufref_len(msg)) /* Explicit empty response. */
  273. Curl_bufref_set(msg, "=", 1, NULL);
  274. else {
  275. char *base64;
  276. size_t base64len;
  277. result = Curl_base64_encode((const char *) Curl_bufref_ptr(msg),
  278. Curl_bufref_len(msg), &base64, &base64len);
  279. if(!result)
  280. Curl_bufref_set(msg, base64, base64len, curl_free);
  281. }
  282. }
  283. return result;
  284. }
  285. /*
  286. * Curl_sasl_can_authenticate()
  287. *
  288. * Check if we have enough auth data and capabilities to authenticate.
  289. */
  290. bool Curl_sasl_can_authenticate(struct SASL *sasl, struct Curl_easy *data)
  291. {
  292. /* Have credentials been provided? */
  293. if(data->state.aptr.user)
  294. return TRUE;
  295. /* EXTERNAL can authenticate without a user name and/or password */
  296. if(sasl->authmechs & sasl->prefmech & SASL_MECH_EXTERNAL)
  297. return TRUE;
  298. return FALSE;
  299. }
  300. /*
  301. * Curl_sasl_start()
  302. *
  303. * Calculate the required login details for SASL authentication.
  304. */
  305. CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
  306. bool force_ir, saslprogress *progress)
  307. {
  308. CURLcode result = CURLE_OK;
  309. struct connectdata *conn = data->conn;
  310. unsigned short enabledmechs;
  311. const char *mech = NULL;
  312. struct bufref resp;
  313. saslstate state1 = SASL_STOP;
  314. saslstate state2 = SASL_FINAL;
  315. const char *hostname, *disp_hostname;
  316. int port;
  317. #if defined(USE_KERBEROS5) || defined(USE_NTLM)
  318. const char *service = data->set.str[STRING_SERVICE_NAME] ?
  319. data->set.str[STRING_SERVICE_NAME] :
  320. sasl->params->service;
  321. #endif
  322. const char *oauth_bearer = data->set.str[STRING_BEARER];
  323. struct bufref nullmsg;
  324. Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
  325. Curl_bufref_init(&nullmsg);
  326. Curl_bufref_init(&resp);
  327. sasl->force_ir = force_ir; /* Latch for future use */
  328. sasl->authused = 0; /* No mechanism used yet */
  329. enabledmechs = sasl->authmechs & sasl->prefmech;
  330. *progress = SASL_IDLE;
  331. /* Calculate the supported authentication mechanism, by decreasing order of
  332. security, as well as the initial response where appropriate */
  333. if((enabledmechs & SASL_MECH_EXTERNAL) && !conn->passwd[0]) {
  334. mech = SASL_MECH_STRING_EXTERNAL;
  335. state1 = SASL_EXTERNAL;
  336. sasl->authused = SASL_MECH_EXTERNAL;
  337. if(force_ir || data->set.sasl_ir)
  338. Curl_auth_create_external_message(conn->user, &resp);
  339. }
  340. else if(data->state.aptr.user) {
  341. #if defined(USE_KERBEROS5)
  342. if((enabledmechs & SASL_MECH_GSSAPI) && Curl_auth_is_gssapi_supported() &&
  343. Curl_auth_user_contains_domain(conn->user)) {
  344. sasl->mutual_auth = FALSE;
  345. mech = SASL_MECH_STRING_GSSAPI;
  346. state1 = SASL_GSSAPI;
  347. state2 = SASL_GSSAPI_TOKEN;
  348. sasl->authused = SASL_MECH_GSSAPI;
  349. if(force_ir || data->set.sasl_ir)
  350. result = Curl_auth_create_gssapi_user_message(data, conn->user,
  351. conn->passwd,
  352. service,
  353. conn->host.name,
  354. sasl->mutual_auth,
  355. NULL, &conn->krb5,
  356. &resp);
  357. }
  358. else
  359. #endif
  360. #ifdef USE_GSASL
  361. if((enabledmechs & SASL_MECH_SCRAM_SHA_256) &&
  362. Curl_auth_gsasl_is_supported(data, SASL_MECH_STRING_SCRAM_SHA_256,
  363. &conn->gsasl)) {
  364. mech = SASL_MECH_STRING_SCRAM_SHA_256;
  365. sasl->authused = SASL_MECH_SCRAM_SHA_256;
  366. state1 = SASL_GSASL;
  367. state2 = SASL_GSASL;
  368. result = Curl_auth_gsasl_start(data, conn->user,
  369. conn->passwd, &conn->gsasl);
  370. if(result == CURLE_OK && (force_ir || data->set.sasl_ir))
  371. result = Curl_auth_gsasl_token(data, &nullmsg, &conn->gsasl, &resp);
  372. }
  373. else if((enabledmechs & SASL_MECH_SCRAM_SHA_1) &&
  374. Curl_auth_gsasl_is_supported(data, SASL_MECH_STRING_SCRAM_SHA_1,
  375. &conn->gsasl)) {
  376. mech = SASL_MECH_STRING_SCRAM_SHA_1;
  377. sasl->authused = SASL_MECH_SCRAM_SHA_1;
  378. state1 = SASL_GSASL;
  379. state2 = SASL_GSASL;
  380. result = Curl_auth_gsasl_start(data, conn->user,
  381. conn->passwd, &conn->gsasl);
  382. if(result == CURLE_OK && (force_ir || data->set.sasl_ir))
  383. result = Curl_auth_gsasl_token(data, &nullmsg, &conn->gsasl, &resp);
  384. }
  385. else
  386. #endif
  387. #ifndef CURL_DISABLE_DIGEST_AUTH
  388. if((enabledmechs & SASL_MECH_DIGEST_MD5) &&
  389. Curl_auth_is_digest_supported()) {
  390. mech = SASL_MECH_STRING_DIGEST_MD5;
  391. state1 = SASL_DIGESTMD5;
  392. sasl->authused = SASL_MECH_DIGEST_MD5;
  393. }
  394. else if(enabledmechs & SASL_MECH_CRAM_MD5) {
  395. mech = SASL_MECH_STRING_CRAM_MD5;
  396. state1 = SASL_CRAMMD5;
  397. sasl->authused = SASL_MECH_CRAM_MD5;
  398. }
  399. else
  400. #endif
  401. #ifdef USE_NTLM
  402. if((enabledmechs & SASL_MECH_NTLM) && Curl_auth_is_ntlm_supported()) {
  403. mech = SASL_MECH_STRING_NTLM;
  404. state1 = SASL_NTLM;
  405. state2 = SASL_NTLM_TYPE2MSG;
  406. sasl->authused = SASL_MECH_NTLM;
  407. if(force_ir || data->set.sasl_ir)
  408. result = Curl_auth_create_ntlm_type1_message(data,
  409. conn->user, conn->passwd,
  410. service,
  411. hostname,
  412. &conn->ntlm, &resp);
  413. }
  414. else
  415. #endif
  416. if((enabledmechs & SASL_MECH_OAUTHBEARER) && oauth_bearer) {
  417. mech = SASL_MECH_STRING_OAUTHBEARER;
  418. state1 = SASL_OAUTH2;
  419. state2 = SASL_OAUTH2_RESP;
  420. sasl->authused = SASL_MECH_OAUTHBEARER;
  421. if(force_ir || data->set.sasl_ir)
  422. result = Curl_auth_create_oauth_bearer_message(conn->user,
  423. hostname,
  424. port,
  425. oauth_bearer,
  426. &resp);
  427. }
  428. else if((enabledmechs & SASL_MECH_XOAUTH2) && oauth_bearer) {
  429. mech = SASL_MECH_STRING_XOAUTH2;
  430. state1 = SASL_OAUTH2;
  431. sasl->authused = SASL_MECH_XOAUTH2;
  432. if(force_ir || data->set.sasl_ir)
  433. result = Curl_auth_create_xoauth_bearer_message(conn->user,
  434. oauth_bearer,
  435. &resp);
  436. }
  437. else if(enabledmechs & SASL_MECH_PLAIN) {
  438. mech = SASL_MECH_STRING_PLAIN;
  439. state1 = SASL_PLAIN;
  440. sasl->authused = SASL_MECH_PLAIN;
  441. if(force_ir || data->set.sasl_ir)
  442. result = Curl_auth_create_plain_message(conn->sasl_authzid,
  443. conn->user, conn->passwd,
  444. &resp);
  445. }
  446. else if(enabledmechs & SASL_MECH_LOGIN) {
  447. mech = SASL_MECH_STRING_LOGIN;
  448. state1 = SASL_LOGIN;
  449. state2 = SASL_LOGIN_PASSWD;
  450. sasl->authused = SASL_MECH_LOGIN;
  451. if(force_ir || data->set.sasl_ir)
  452. Curl_auth_create_login_message(conn->user, &resp);
  453. }
  454. }
  455. if(!result && mech) {
  456. sasl->curmech = mech;
  457. if(Curl_bufref_ptr(&resp))
  458. result = build_message(sasl, &resp);
  459. if(sasl->params->maxirlen &&
  460. strlen(mech) + Curl_bufref_len(&resp) > sasl->params->maxirlen)
  461. Curl_bufref_free(&resp);
  462. if(!result)
  463. result = sasl->params->sendauth(data, mech, &resp);
  464. if(!result) {
  465. *progress = SASL_INPROGRESS;
  466. sasl_state(sasl, data, Curl_bufref_ptr(&resp) ? state2 : state1);
  467. }
  468. }
  469. Curl_bufref_free(&resp);
  470. return result;
  471. }
  472. /*
  473. * Curl_sasl_continue()
  474. *
  475. * Continue the authentication.
  476. */
  477. CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
  478. int code, saslprogress *progress)
  479. {
  480. CURLcode result = CURLE_OK;
  481. struct connectdata *conn = data->conn;
  482. saslstate newstate = SASL_FINAL;
  483. struct bufref resp;
  484. const char *hostname, *disp_hostname;
  485. int port;
  486. #if defined(USE_KERBEROS5) || defined(USE_NTLM) \
  487. || !defined(CURL_DISABLE_DIGEST_AUTH)
  488. const char *service = data->set.str[STRING_SERVICE_NAME] ?
  489. data->set.str[STRING_SERVICE_NAME] :
  490. sasl->params->service;
  491. #endif
  492. const char *oauth_bearer = data->set.str[STRING_BEARER];
  493. struct bufref serverdata;
  494. Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
  495. Curl_bufref_init(&serverdata);
  496. Curl_bufref_init(&resp);
  497. *progress = SASL_INPROGRESS;
  498. if(sasl->state == SASL_FINAL) {
  499. if(code != sasl->params->finalcode)
  500. result = CURLE_LOGIN_DENIED;
  501. *progress = SASL_DONE;
  502. sasl_state(sasl, data, SASL_STOP);
  503. return result;
  504. }
  505. if(sasl->state != SASL_CANCEL && sasl->state != SASL_OAUTH2_RESP &&
  506. code != sasl->params->contcode) {
  507. *progress = SASL_DONE;
  508. sasl_state(sasl, data, SASL_STOP);
  509. return CURLE_LOGIN_DENIED;
  510. }
  511. switch(sasl->state) {
  512. case SASL_STOP:
  513. *progress = SASL_DONE;
  514. return result;
  515. case SASL_PLAIN:
  516. result = Curl_auth_create_plain_message(conn->sasl_authzid,
  517. conn->user, conn->passwd, &resp);
  518. break;
  519. case SASL_LOGIN:
  520. Curl_auth_create_login_message(conn->user, &resp);
  521. newstate = SASL_LOGIN_PASSWD;
  522. break;
  523. case SASL_LOGIN_PASSWD:
  524. Curl_auth_create_login_message(conn->passwd, &resp);
  525. break;
  526. case SASL_EXTERNAL:
  527. Curl_auth_create_external_message(conn->user, &resp);
  528. break;
  529. #ifdef USE_GSASL
  530. case SASL_GSASL:
  531. result = get_server_message(sasl, data, &serverdata);
  532. if(!result)
  533. result = Curl_auth_gsasl_token(data, &serverdata, &conn->gsasl, &resp);
  534. if(!result && Curl_bufref_len(&resp) > 0)
  535. newstate = SASL_GSASL;
  536. break;
  537. #endif
  538. #ifndef CURL_DISABLE_DIGEST_AUTH
  539. case SASL_CRAMMD5:
  540. result = get_server_message(sasl, data, &serverdata);
  541. if(!result)
  542. result = Curl_auth_create_cram_md5_message(&serverdata, conn->user,
  543. conn->passwd, &resp);
  544. break;
  545. case SASL_DIGESTMD5:
  546. result = get_server_message(sasl, data, &serverdata);
  547. if(!result)
  548. result = Curl_auth_create_digest_md5_message(data, &serverdata,
  549. conn->user, conn->passwd,
  550. service, &resp);
  551. if(!result && (sasl->params->flags & SASL_FLAG_BASE64))
  552. newstate = SASL_DIGESTMD5_RESP;
  553. break;
  554. case SASL_DIGESTMD5_RESP:
  555. /* Keep response NULL to output an empty line. */
  556. break;
  557. #endif
  558. #ifdef USE_NTLM
  559. case SASL_NTLM:
  560. /* Create the type-1 message */
  561. result = Curl_auth_create_ntlm_type1_message(data,
  562. conn->user, conn->passwd,
  563. service, hostname,
  564. &conn->ntlm, &resp);
  565. newstate = SASL_NTLM_TYPE2MSG;
  566. break;
  567. case SASL_NTLM_TYPE2MSG:
  568. /* Decode the type-2 message */
  569. result = get_server_message(sasl, data, &serverdata);
  570. if(!result)
  571. result = Curl_auth_decode_ntlm_type2_message(data, &serverdata,
  572. &conn->ntlm);
  573. if(!result)
  574. result = Curl_auth_create_ntlm_type3_message(data, conn->user,
  575. conn->passwd, &conn->ntlm,
  576. &resp);
  577. break;
  578. #endif
  579. #if defined(USE_KERBEROS5)
  580. case SASL_GSSAPI:
  581. result = Curl_auth_create_gssapi_user_message(data, conn->user,
  582. conn->passwd,
  583. service,
  584. conn->host.name,
  585. sasl->mutual_auth, NULL,
  586. &conn->krb5,
  587. &resp);
  588. newstate = SASL_GSSAPI_TOKEN;
  589. break;
  590. case SASL_GSSAPI_TOKEN:
  591. result = get_server_message(sasl, data, &serverdata);
  592. if(!result) {
  593. if(sasl->mutual_auth) {
  594. /* Decode the user token challenge and create the optional response
  595. message */
  596. result = Curl_auth_create_gssapi_user_message(data, NULL, NULL,
  597. NULL, NULL,
  598. sasl->mutual_auth,
  599. &serverdata,
  600. &conn->krb5,
  601. &resp);
  602. newstate = SASL_GSSAPI_NO_DATA;
  603. }
  604. else
  605. /* Decode the security challenge and create the response message */
  606. result = Curl_auth_create_gssapi_security_message(data,
  607. conn->sasl_authzid,
  608. &serverdata,
  609. &conn->krb5,
  610. &resp);
  611. }
  612. break;
  613. case SASL_GSSAPI_NO_DATA:
  614. /* Decode the security challenge and create the response message */
  615. result = get_server_message(sasl, data, &serverdata);
  616. if(!result)
  617. result = Curl_auth_create_gssapi_security_message(data,
  618. conn->sasl_authzid,
  619. &serverdata,
  620. &conn->krb5,
  621. &resp);
  622. break;
  623. #endif
  624. case SASL_OAUTH2:
  625. /* Create the authorization message */
  626. if(sasl->authused == SASL_MECH_OAUTHBEARER) {
  627. result = Curl_auth_create_oauth_bearer_message(conn->user,
  628. hostname,
  629. port,
  630. oauth_bearer,
  631. &resp);
  632. /* Failures maybe sent by the server as continuations for OAUTHBEARER */
  633. newstate = SASL_OAUTH2_RESP;
  634. }
  635. else
  636. result = Curl_auth_create_xoauth_bearer_message(conn->user,
  637. oauth_bearer,
  638. &resp);
  639. break;
  640. case SASL_OAUTH2_RESP:
  641. /* The continuation is optional so check the response code */
  642. if(code == sasl->params->finalcode) {
  643. /* Final response was received so we are done */
  644. *progress = SASL_DONE;
  645. sasl_state(sasl, data, SASL_STOP);
  646. return result;
  647. }
  648. else if(code == sasl->params->contcode) {
  649. /* Acknowledge the continuation by sending a 0x01 response. */
  650. Curl_bufref_set(&resp, "\x01", 1, NULL);
  651. break;
  652. }
  653. else {
  654. *progress = SASL_DONE;
  655. sasl_state(sasl, data, SASL_STOP);
  656. return CURLE_LOGIN_DENIED;
  657. }
  658. case SASL_CANCEL:
  659. /* Remove the offending mechanism from the supported list */
  660. sasl->authmechs ^= sasl->authused;
  661. /* Start an alternative SASL authentication */
  662. return Curl_sasl_start(sasl, data, sasl->force_ir, progress);
  663. default:
  664. failf(data, "Unsupported SASL authentication mechanism");
  665. result = CURLE_UNSUPPORTED_PROTOCOL; /* Should not happen */
  666. break;
  667. }
  668. Curl_bufref_free(&serverdata);
  669. switch(result) {
  670. case CURLE_BAD_CONTENT_ENCODING:
  671. /* Cancel dialog */
  672. result = sasl->params->cancelauth(data, sasl->curmech);
  673. newstate = SASL_CANCEL;
  674. break;
  675. case CURLE_OK:
  676. result = build_message(sasl, &resp);
  677. if(!result)
  678. result = sasl->params->contauth(data, sasl->curmech, &resp);
  679. break;
  680. default:
  681. newstate = SASL_STOP; /* Stop on error */
  682. *progress = SASL_DONE;
  683. break;
  684. }
  685. Curl_bufref_free(&resp);
  686. sasl_state(sasl, data, newstate);
  687. return result;
  688. }
  689. #endif /* protocols are enabled that use SASL */