curl_sasl.c 24 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. * RFC2195 CRAM-MD5 authentication
  24. * RFC2617 Basic and Digest Access Authentication
  25. * RFC2831 DIGEST-MD5 authentication
  26. * RFC4422 Simple Authentication and Security Layer (SASL)
  27. * RFC4616 PLAIN authentication
  28. * RFC5802 SCRAM-SHA-1 authentication
  29. * RFC7677 SCRAM-SHA-256 authentication
  30. * RFC6749 OAuth 2.0 Authorization Framework
  31. * RFC7628 A Set of SASL Mechanisms for OAuth
  32. * Draft LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
  33. *
  34. ***************************************************************************/
  35. #include "curl_setup.h"
  36. #if !defined(CURL_DISABLE_IMAP) || !defined(CURL_DISABLE_SMTP) || \
  37. !defined(CURL_DISABLE_POP3) || \
  38. (!defined(CURL_DISABLE_LDAP) && defined(USE_OPENLDAP))
  39. #include <curl/curl.h>
  40. #include "urldata.h"
  41. #include "curl_base64.h"
  42. #include "curl_md5.h"
  43. #include "vauth/vauth.h"
  44. #include "cfilters.h"
  45. #include "vtls/vtls.h"
  46. #include "curl_hmac.h"
  47. #include "curl_sasl.h"
  48. #include "warnless.h"
  49. #include "strtok.h"
  50. #include "sendf.h"
  51. /* The last 3 #include files should be in this order */
  52. #include "curl_printf.h"
  53. #include "curl_memory.h"
  54. #include "memdebug.h"
  55. /* Supported mechanisms */
  56. static const struct {
  57. const char *name; /* Name */
  58. size_t len; /* Name length */
  59. unsigned short bit; /* Flag bit */
  60. } mechtable[] = {
  61. { "LOGIN", 5, SASL_MECH_LOGIN },
  62. { "PLAIN", 5, SASL_MECH_PLAIN },
  63. { "CRAM-MD5", 8, SASL_MECH_CRAM_MD5 },
  64. { "DIGEST-MD5", 10, SASL_MECH_DIGEST_MD5 },
  65. { "GSSAPI", 6, SASL_MECH_GSSAPI },
  66. { "EXTERNAL", 8, SASL_MECH_EXTERNAL },
  67. { "NTLM", 4, SASL_MECH_NTLM },
  68. { "XOAUTH2", 7, SASL_MECH_XOAUTH2 },
  69. { "OAUTHBEARER", 11, SASL_MECH_OAUTHBEARER },
  70. { "SCRAM-SHA-1", 11, SASL_MECH_SCRAM_SHA_1 },
  71. { "SCRAM-SHA-256",13, SASL_MECH_SCRAM_SHA_256 },
  72. { ZERO_NULL, 0, 0 }
  73. };
  74. /*
  75. * Curl_sasl_cleanup()
  76. *
  77. * This is used to cleanup any libraries or curl modules used by the sasl
  78. * functions.
  79. *
  80. * Parameters:
  81. *
  82. * conn [in] - The connection data.
  83. * authused [in] - The authentication mechanism used.
  84. */
  85. void Curl_sasl_cleanup(struct connectdata *conn, unsigned short authused)
  86. {
  87. (void)conn;
  88. (void)authused;
  89. #if defined(USE_KERBEROS5)
  90. /* Cleanup the gssapi structure */
  91. if(authused == SASL_MECH_GSSAPI) {
  92. Curl_auth_cleanup_gssapi(&conn->krb5);
  93. }
  94. #endif
  95. #if defined(USE_GSASL)
  96. /* Cleanup the GSASL structure */
  97. if(authused & (SASL_MECH_SCRAM_SHA_1 | SASL_MECH_SCRAM_SHA_256)) {
  98. Curl_auth_gsasl_cleanup(&conn->gsasl);
  99. }
  100. #endif
  101. #if defined(USE_NTLM)
  102. /* Cleanup the NTLM structure */
  103. if(authused == SASL_MECH_NTLM) {
  104. Curl_auth_cleanup_ntlm(&conn->ntlm);
  105. }
  106. #endif
  107. }
  108. /*
  109. * Curl_sasl_decode_mech()
  110. *
  111. * Convert a SASL mechanism name into a token.
  112. *
  113. * Parameters:
  114. *
  115. * ptr [in] - The mechanism string.
  116. * maxlen [in] - Maximum mechanism string length.
  117. * len [out] - If not NULL, effective name length.
  118. *
  119. * Returns the SASL mechanism token or 0 if no match.
  120. */
  121. unsigned short Curl_sasl_decode_mech(const char *ptr, size_t maxlen,
  122. size_t *len)
  123. {
  124. unsigned int i;
  125. char c;
  126. for(i = 0; mechtable[i].name; i++) {
  127. if(maxlen >= mechtable[i].len &&
  128. !memcmp(ptr, mechtable[i].name, mechtable[i].len)) {
  129. if(len)
  130. *len = mechtable[i].len;
  131. if(maxlen == mechtable[i].len)
  132. return mechtable[i].bit;
  133. c = ptr[mechtable[i].len];
  134. if(!ISUPPER(c) && !ISDIGIT(c) && c != '-' && c != '_')
  135. return mechtable[i].bit;
  136. }
  137. }
  138. return 0;
  139. }
  140. /*
  141. * Curl_sasl_parse_url_auth_option()
  142. *
  143. * Parse the URL login options.
  144. */
  145. CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl,
  146. const char *value, size_t len)
  147. {
  148. CURLcode result = CURLE_OK;
  149. size_t mechlen;
  150. if(!len)
  151. return CURLE_URL_MALFORMAT;
  152. if(sasl->resetprefs) {
  153. sasl->resetprefs = FALSE;
  154. sasl->prefmech = SASL_AUTH_NONE;
  155. }
  156. if(!strncmp(value, "*", len))
  157. sasl->prefmech = SASL_AUTH_DEFAULT;
  158. else {
  159. unsigned short mechbit = Curl_sasl_decode_mech(value, len, &mechlen);
  160. if(mechbit && mechlen == len)
  161. sasl->prefmech |= mechbit;
  162. else
  163. result = CURLE_URL_MALFORMAT;
  164. }
  165. return result;
  166. }
  167. /*
  168. * Curl_sasl_init()
  169. *
  170. * Initializes the SASL structure.
  171. */
  172. void Curl_sasl_init(struct SASL *sasl, struct Curl_easy *data,
  173. const struct SASLproto *params)
  174. {
  175. unsigned long auth = data->set.httpauth;
  176. sasl->params = params; /* Set protocol dependent parameters */
  177. sasl->state = SASL_STOP; /* Not yet running */
  178. sasl->curmech = NULL; /* No mechanism yet. */
  179. sasl->authmechs = SASL_AUTH_NONE; /* No known authentication mechanism yet */
  180. sasl->prefmech = params->defmechs; /* Default preferred mechanisms */
  181. sasl->authused = SASL_AUTH_NONE; /* The authentication mechanism used */
  182. sasl->resetprefs = TRUE; /* Reset prefmech upon AUTH parsing. */
  183. sasl->mutual_auth = FALSE; /* No mutual authentication (GSSAPI only) */
  184. sasl->force_ir = FALSE; /* Respect external option */
  185. if(auth != CURLAUTH_BASIC) {
  186. sasl->resetprefs = FALSE;
  187. sasl->prefmech = SASL_AUTH_NONE;
  188. if(auth & CURLAUTH_BASIC)
  189. sasl->prefmech |= SASL_MECH_PLAIN | SASL_MECH_LOGIN;
  190. if(auth & CURLAUTH_DIGEST)
  191. sasl->prefmech |= SASL_MECH_DIGEST_MD5;
  192. if(auth & CURLAUTH_NTLM)
  193. sasl->prefmech |= SASL_MECH_NTLM;
  194. if(auth & CURLAUTH_BEARER)
  195. sasl->prefmech |= SASL_MECH_OAUTHBEARER | SASL_MECH_XOAUTH2;
  196. if(auth & CURLAUTH_GSSAPI)
  197. sasl->prefmech |= SASL_MECH_GSSAPI;
  198. }
  199. }
  200. /*
  201. * sasl_state()
  202. *
  203. * This is the ONLY way to change SASL state!
  204. */
  205. static void sasl_state(struct SASL *sasl, struct Curl_easy *data,
  206. saslstate newstate)
  207. {
  208. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  209. /* for debug purposes */
  210. static const char * const names[]={
  211. "STOP",
  212. "PLAIN",
  213. "LOGIN",
  214. "LOGIN_PASSWD",
  215. "EXTERNAL",
  216. "CRAMMD5",
  217. "DIGESTMD5",
  218. "DIGESTMD5_RESP",
  219. "NTLM",
  220. "NTLM_TYPE2MSG",
  221. "GSSAPI",
  222. "GSSAPI_TOKEN",
  223. "GSSAPI_NO_DATA",
  224. "OAUTH2",
  225. "OAUTH2_RESP",
  226. "GSASL",
  227. "CANCEL",
  228. "FINAL",
  229. /* LAST */
  230. };
  231. if(sasl->state != newstate)
  232. infof(data, "SASL %p state change from %s to %s",
  233. (void *)sasl, names[sasl->state], names[newstate]);
  234. #else
  235. (void) data;
  236. #endif
  237. sasl->state = newstate;
  238. }
  239. /* Get the SASL server message and convert it to binary. */
  240. static CURLcode get_server_message(struct SASL *sasl, struct Curl_easy *data,
  241. struct bufref *out)
  242. {
  243. CURLcode result = CURLE_OK;
  244. result = sasl->params->getmessage(data, out);
  245. if(!result && (sasl->params->flags & SASL_FLAG_BASE64)) {
  246. unsigned char *msg;
  247. size_t msglen;
  248. const char *serverdata = (const char *) Curl_bufref_ptr(out);
  249. if(!*serverdata || *serverdata == '=')
  250. Curl_bufref_set(out, NULL, 0, NULL);
  251. else {
  252. result = Curl_base64_decode(serverdata, &msg, &msglen);
  253. if(!result)
  254. Curl_bufref_set(out, msg, msglen, curl_free);
  255. }
  256. }
  257. return result;
  258. }
  259. /* Encode the outgoing SASL message. */
  260. static CURLcode build_message(struct SASL *sasl, struct bufref *msg)
  261. {
  262. CURLcode result = CURLE_OK;
  263. if(sasl->params->flags & SASL_FLAG_BASE64) {
  264. if(!Curl_bufref_ptr(msg)) /* Empty message. */
  265. Curl_bufref_set(msg, "", 0, NULL);
  266. else if(!Curl_bufref_len(msg)) /* Explicit empty response. */
  267. Curl_bufref_set(msg, "=", 1, NULL);
  268. else {
  269. char *base64;
  270. size_t base64len;
  271. result = Curl_base64_encode((const char *) Curl_bufref_ptr(msg),
  272. Curl_bufref_len(msg), &base64, &base64len);
  273. if(!result)
  274. Curl_bufref_set(msg, base64, base64len, curl_free);
  275. }
  276. }
  277. return result;
  278. }
  279. /*
  280. * Curl_sasl_can_authenticate()
  281. *
  282. * Check if we have enough auth data and capabilities to authenticate.
  283. */
  284. bool Curl_sasl_can_authenticate(struct SASL *sasl, struct Curl_easy *data)
  285. {
  286. /* Have credentials been provided? */
  287. if(data->state.aptr.user)
  288. return TRUE;
  289. /* EXTERNAL can authenticate without a user name and/or password */
  290. if(sasl->authmechs & sasl->prefmech & SASL_MECH_EXTERNAL)
  291. return TRUE;
  292. return FALSE;
  293. }
  294. /*
  295. * Curl_sasl_start()
  296. *
  297. * Calculate the required login details for SASL authentication.
  298. */
  299. CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
  300. bool force_ir, saslprogress *progress)
  301. {
  302. CURLcode result = CURLE_OK;
  303. struct connectdata *conn = data->conn;
  304. unsigned short enabledmechs;
  305. const char *mech = NULL;
  306. struct bufref resp;
  307. saslstate state1 = SASL_STOP;
  308. saslstate state2 = SASL_FINAL;
  309. const char *hostname, *disp_hostname;
  310. int port;
  311. #if defined(USE_KERBEROS5) || defined(USE_NTLM)
  312. const char *service = data->set.str[STRING_SERVICE_NAME] ?
  313. data->set.str[STRING_SERVICE_NAME] :
  314. sasl->params->service;
  315. #endif
  316. const char *oauth_bearer = data->set.str[STRING_BEARER];
  317. struct bufref nullmsg;
  318. Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
  319. Curl_bufref_init(&nullmsg);
  320. Curl_bufref_init(&resp);
  321. sasl->force_ir = force_ir; /* Latch for future use */
  322. sasl->authused = 0; /* No mechanism used yet */
  323. enabledmechs = sasl->authmechs & sasl->prefmech;
  324. *progress = SASL_IDLE;
  325. /* Calculate the supported authentication mechanism, by decreasing order of
  326. security, as well as the initial response where appropriate */
  327. if((enabledmechs & SASL_MECH_EXTERNAL) && !conn->passwd[0]) {
  328. mech = SASL_MECH_STRING_EXTERNAL;
  329. state1 = SASL_EXTERNAL;
  330. sasl->authused = SASL_MECH_EXTERNAL;
  331. if(force_ir || data->set.sasl_ir)
  332. result = Curl_auth_create_external_message(conn->user, &resp);
  333. }
  334. else if(data->state.aptr.user) {
  335. #if defined(USE_KERBEROS5)
  336. if((enabledmechs & SASL_MECH_GSSAPI) && Curl_auth_is_gssapi_supported() &&
  337. Curl_auth_user_contains_domain(conn->user)) {
  338. sasl->mutual_auth = FALSE;
  339. mech = SASL_MECH_STRING_GSSAPI;
  340. state1 = SASL_GSSAPI;
  341. state2 = SASL_GSSAPI_TOKEN;
  342. sasl->authused = SASL_MECH_GSSAPI;
  343. if(force_ir || data->set.sasl_ir)
  344. result = Curl_auth_create_gssapi_user_message(data, conn->user,
  345. conn->passwd,
  346. service,
  347. conn->host.name,
  348. sasl->mutual_auth,
  349. NULL, &conn->krb5,
  350. &resp);
  351. }
  352. else
  353. #endif
  354. #ifdef USE_GSASL
  355. if((enabledmechs & SASL_MECH_SCRAM_SHA_256) &&
  356. Curl_auth_gsasl_is_supported(data, SASL_MECH_STRING_SCRAM_SHA_256,
  357. &conn->gsasl)) {
  358. mech = SASL_MECH_STRING_SCRAM_SHA_256;
  359. sasl->authused = SASL_MECH_SCRAM_SHA_256;
  360. state1 = SASL_GSASL;
  361. state2 = SASL_GSASL;
  362. result = Curl_auth_gsasl_start(data, conn->user,
  363. conn->passwd, &conn->gsasl);
  364. if(result == CURLE_OK && (force_ir || data->set.sasl_ir))
  365. result = Curl_auth_gsasl_token(data, &nullmsg, &conn->gsasl, &resp);
  366. }
  367. else if((enabledmechs & SASL_MECH_SCRAM_SHA_1) &&
  368. Curl_auth_gsasl_is_supported(data, SASL_MECH_STRING_SCRAM_SHA_1,
  369. &conn->gsasl)) {
  370. mech = SASL_MECH_STRING_SCRAM_SHA_1;
  371. sasl->authused = SASL_MECH_SCRAM_SHA_1;
  372. state1 = SASL_GSASL;
  373. state2 = SASL_GSASL;
  374. result = Curl_auth_gsasl_start(data, conn->user,
  375. conn->passwd, &conn->gsasl);
  376. if(result == CURLE_OK && (force_ir || data->set.sasl_ir))
  377. result = Curl_auth_gsasl_token(data, &nullmsg, &conn->gsasl, &resp);
  378. }
  379. else
  380. #endif
  381. #ifndef CURL_DISABLE_DIGEST_AUTH
  382. if((enabledmechs & SASL_MECH_DIGEST_MD5) &&
  383. Curl_auth_is_digest_supported()) {
  384. mech = SASL_MECH_STRING_DIGEST_MD5;
  385. state1 = SASL_DIGESTMD5;
  386. sasl->authused = SASL_MECH_DIGEST_MD5;
  387. }
  388. else if(enabledmechs & SASL_MECH_CRAM_MD5) {
  389. mech = SASL_MECH_STRING_CRAM_MD5;
  390. state1 = SASL_CRAMMD5;
  391. sasl->authused = SASL_MECH_CRAM_MD5;
  392. }
  393. else
  394. #endif
  395. #ifdef USE_NTLM
  396. if((enabledmechs & SASL_MECH_NTLM) && Curl_auth_is_ntlm_supported()) {
  397. mech = SASL_MECH_STRING_NTLM;
  398. state1 = SASL_NTLM;
  399. state2 = SASL_NTLM_TYPE2MSG;
  400. sasl->authused = SASL_MECH_NTLM;
  401. if(force_ir || data->set.sasl_ir)
  402. result = Curl_auth_create_ntlm_type1_message(data,
  403. conn->user, conn->passwd,
  404. service,
  405. hostname,
  406. &conn->ntlm, &resp);
  407. }
  408. else
  409. #endif
  410. if((enabledmechs & SASL_MECH_OAUTHBEARER) && oauth_bearer) {
  411. mech = SASL_MECH_STRING_OAUTHBEARER;
  412. state1 = SASL_OAUTH2;
  413. state2 = SASL_OAUTH2_RESP;
  414. sasl->authused = SASL_MECH_OAUTHBEARER;
  415. if(force_ir || data->set.sasl_ir)
  416. result = Curl_auth_create_oauth_bearer_message(conn->user,
  417. hostname,
  418. port,
  419. oauth_bearer,
  420. &resp);
  421. }
  422. else if((enabledmechs & SASL_MECH_XOAUTH2) && oauth_bearer) {
  423. mech = SASL_MECH_STRING_XOAUTH2;
  424. state1 = SASL_OAUTH2;
  425. sasl->authused = SASL_MECH_XOAUTH2;
  426. if(force_ir || data->set.sasl_ir)
  427. result = Curl_auth_create_xoauth_bearer_message(conn->user,
  428. oauth_bearer,
  429. &resp);
  430. }
  431. else if(enabledmechs & SASL_MECH_PLAIN) {
  432. mech = SASL_MECH_STRING_PLAIN;
  433. state1 = SASL_PLAIN;
  434. sasl->authused = SASL_MECH_PLAIN;
  435. if(force_ir || data->set.sasl_ir)
  436. result = Curl_auth_create_plain_message(conn->sasl_authzid,
  437. conn->user, conn->passwd,
  438. &resp);
  439. }
  440. else if(enabledmechs & SASL_MECH_LOGIN) {
  441. mech = SASL_MECH_STRING_LOGIN;
  442. state1 = SASL_LOGIN;
  443. state2 = SASL_LOGIN_PASSWD;
  444. sasl->authused = SASL_MECH_LOGIN;
  445. if(force_ir || data->set.sasl_ir)
  446. result = Curl_auth_create_login_message(conn->user, &resp);
  447. }
  448. }
  449. if(!result && mech) {
  450. sasl->curmech = mech;
  451. if(Curl_bufref_ptr(&resp))
  452. result = build_message(sasl, &resp);
  453. if(sasl->params->maxirlen &&
  454. strlen(mech) + Curl_bufref_len(&resp) > sasl->params->maxirlen)
  455. Curl_bufref_free(&resp);
  456. if(!result)
  457. result = sasl->params->sendauth(data, mech, &resp);
  458. if(!result) {
  459. *progress = SASL_INPROGRESS;
  460. sasl_state(sasl, data, Curl_bufref_ptr(&resp) ? state2 : state1);
  461. }
  462. }
  463. Curl_bufref_free(&resp);
  464. return result;
  465. }
  466. /*
  467. * Curl_sasl_continue()
  468. *
  469. * Continue the authentication.
  470. */
  471. CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
  472. int code, saslprogress *progress)
  473. {
  474. CURLcode result = CURLE_OK;
  475. struct connectdata *conn = data->conn;
  476. saslstate newstate = SASL_FINAL;
  477. struct bufref resp;
  478. const char *hostname, *disp_hostname;
  479. int port;
  480. #if defined(USE_KERBEROS5) || defined(USE_NTLM) \
  481. || !defined(CURL_DISABLE_DIGEST_AUTH)
  482. const char *service = data->set.str[STRING_SERVICE_NAME] ?
  483. data->set.str[STRING_SERVICE_NAME] :
  484. sasl->params->service;
  485. #endif
  486. const char *oauth_bearer = data->set.str[STRING_BEARER];
  487. struct bufref serverdata;
  488. Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
  489. Curl_bufref_init(&serverdata);
  490. Curl_bufref_init(&resp);
  491. *progress = SASL_INPROGRESS;
  492. if(sasl->state == SASL_FINAL) {
  493. if(code != sasl->params->finalcode)
  494. result = CURLE_LOGIN_DENIED;
  495. *progress = SASL_DONE;
  496. sasl_state(sasl, data, SASL_STOP);
  497. return result;
  498. }
  499. if(sasl->state != SASL_CANCEL && sasl->state != SASL_OAUTH2_RESP &&
  500. code != sasl->params->contcode) {
  501. *progress = SASL_DONE;
  502. sasl_state(sasl, data, SASL_STOP);
  503. return CURLE_LOGIN_DENIED;
  504. }
  505. switch(sasl->state) {
  506. case SASL_STOP:
  507. *progress = SASL_DONE;
  508. return result;
  509. case SASL_PLAIN:
  510. result = Curl_auth_create_plain_message(conn->sasl_authzid,
  511. conn->user, conn->passwd, &resp);
  512. break;
  513. case SASL_LOGIN:
  514. result = Curl_auth_create_login_message(conn->user, &resp);
  515. newstate = SASL_LOGIN_PASSWD;
  516. break;
  517. case SASL_LOGIN_PASSWD:
  518. result = Curl_auth_create_login_message(conn->passwd, &resp);
  519. break;
  520. case SASL_EXTERNAL:
  521. result = Curl_auth_create_external_message(conn->user, &resp);
  522. break;
  523. #ifdef USE_GSASL
  524. case SASL_GSASL:
  525. result = get_server_message(sasl, data, &serverdata);
  526. if(!result)
  527. result = Curl_auth_gsasl_token(data, &serverdata, &conn->gsasl, &resp);
  528. if(!result && Curl_bufref_len(&resp) > 0)
  529. newstate = SASL_GSASL;
  530. break;
  531. #endif
  532. #ifndef CURL_DISABLE_DIGEST_AUTH
  533. case SASL_CRAMMD5:
  534. result = get_server_message(sasl, data, &serverdata);
  535. if(!result)
  536. result = Curl_auth_create_cram_md5_message(&serverdata, conn->user,
  537. conn->passwd, &resp);
  538. break;
  539. case SASL_DIGESTMD5:
  540. result = get_server_message(sasl, data, &serverdata);
  541. if(!result)
  542. result = Curl_auth_create_digest_md5_message(data, &serverdata,
  543. conn->user, conn->passwd,
  544. service, &resp);
  545. if(!result && (sasl->params->flags & SASL_FLAG_BASE64))
  546. newstate = SASL_DIGESTMD5_RESP;
  547. break;
  548. case SASL_DIGESTMD5_RESP:
  549. /* Keep response NULL to output an empty line. */
  550. break;
  551. #endif
  552. #ifdef USE_NTLM
  553. case SASL_NTLM:
  554. /* Create the type-1 message */
  555. result = Curl_auth_create_ntlm_type1_message(data,
  556. conn->user, conn->passwd,
  557. service, hostname,
  558. &conn->ntlm, &resp);
  559. newstate = SASL_NTLM_TYPE2MSG;
  560. break;
  561. case SASL_NTLM_TYPE2MSG:
  562. /* Decode the type-2 message */
  563. result = get_server_message(sasl, data, &serverdata);
  564. if(!result)
  565. result = Curl_auth_decode_ntlm_type2_message(data, &serverdata,
  566. &conn->ntlm);
  567. if(!result)
  568. result = Curl_auth_create_ntlm_type3_message(data, conn->user,
  569. conn->passwd, &conn->ntlm,
  570. &resp);
  571. break;
  572. #endif
  573. #if defined(USE_KERBEROS5)
  574. case SASL_GSSAPI:
  575. result = Curl_auth_create_gssapi_user_message(data, conn->user,
  576. conn->passwd,
  577. service,
  578. conn->host.name,
  579. sasl->mutual_auth, NULL,
  580. &conn->krb5,
  581. &resp);
  582. newstate = SASL_GSSAPI_TOKEN;
  583. break;
  584. case SASL_GSSAPI_TOKEN:
  585. result = get_server_message(sasl, data, &serverdata);
  586. if(!result) {
  587. if(sasl->mutual_auth) {
  588. /* Decode the user token challenge and create the optional response
  589. message */
  590. result = Curl_auth_create_gssapi_user_message(data, NULL, NULL,
  591. NULL, NULL,
  592. sasl->mutual_auth,
  593. &serverdata,
  594. &conn->krb5,
  595. &resp);
  596. newstate = SASL_GSSAPI_NO_DATA;
  597. }
  598. else
  599. /* Decode the security challenge and create the response message */
  600. result = Curl_auth_create_gssapi_security_message(data,
  601. conn->sasl_authzid,
  602. &serverdata,
  603. &conn->krb5,
  604. &resp);
  605. }
  606. break;
  607. case SASL_GSSAPI_NO_DATA:
  608. /* Decode the security challenge and create the response message */
  609. result = get_server_message(sasl, data, &serverdata);
  610. if(!result)
  611. result = Curl_auth_create_gssapi_security_message(data,
  612. conn->sasl_authzid,
  613. &serverdata,
  614. &conn->krb5,
  615. &resp);
  616. break;
  617. #endif
  618. case SASL_OAUTH2:
  619. /* Create the authorization message */
  620. if(sasl->authused == SASL_MECH_OAUTHBEARER) {
  621. result = Curl_auth_create_oauth_bearer_message(conn->user,
  622. hostname,
  623. port,
  624. oauth_bearer,
  625. &resp);
  626. /* Failures maybe sent by the server as continuations for OAUTHBEARER */
  627. newstate = SASL_OAUTH2_RESP;
  628. }
  629. else
  630. result = Curl_auth_create_xoauth_bearer_message(conn->user,
  631. oauth_bearer,
  632. &resp);
  633. break;
  634. case SASL_OAUTH2_RESP:
  635. /* The continuation is optional so check the response code */
  636. if(code == sasl->params->finalcode) {
  637. /* Final response was received so we are done */
  638. *progress = SASL_DONE;
  639. sasl_state(sasl, data, SASL_STOP);
  640. return result;
  641. }
  642. else if(code == sasl->params->contcode) {
  643. /* Acknowledge the continuation by sending a 0x01 response. */
  644. Curl_bufref_set(&resp, "\x01", 1, NULL);
  645. break;
  646. }
  647. else {
  648. *progress = SASL_DONE;
  649. sasl_state(sasl, data, SASL_STOP);
  650. return CURLE_LOGIN_DENIED;
  651. }
  652. case SASL_CANCEL:
  653. /* Remove the offending mechanism from the supported list */
  654. sasl->authmechs ^= sasl->authused;
  655. /* Start an alternative SASL authentication */
  656. return Curl_sasl_start(sasl, data, sasl->force_ir, progress);
  657. default:
  658. failf(data, "Unsupported SASL authentication mechanism");
  659. result = CURLE_UNSUPPORTED_PROTOCOL; /* Should not happen */
  660. break;
  661. }
  662. Curl_bufref_free(&serverdata);
  663. switch(result) {
  664. case CURLE_BAD_CONTENT_ENCODING:
  665. /* Cancel dialog */
  666. result = sasl->params->cancelauth(data, sasl->curmech);
  667. newstate = SASL_CANCEL;
  668. break;
  669. case CURLE_OK:
  670. result = build_message(sasl, &resp);
  671. if(!result)
  672. result = sasl->params->contauth(data, sasl->curmech, &resp);
  673. break;
  674. default:
  675. newstate = SASL_STOP; /* Stop on error */
  676. *progress = SASL_DONE;
  677. break;
  678. }
  679. Curl_bufref_free(&resp);
  680. sasl_state(sasl, data, newstate);
  681. return result;
  682. }
  683. #endif /* protocols are enabled that use SASL */