curl_sasl.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 2012 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * RFC2195 CRAM-MD5 authentication
  22. * RFC2617 Basic and Digest Access Authentication
  23. * RFC2831 DIGEST-MD5 authentication
  24. * RFC4422 Simple Authentication and Security Layer (SASL)
  25. * RFC4616 PLAIN authentication
  26. * RFC6749 OAuth 2.0 Authorization Framework
  27. * RFC7628 A Set of SASL Mechanisms for OAuth
  28. * Draft LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
  29. *
  30. ***************************************************************************/
  31. #include "curl_setup.h"
  32. #if !defined(CURL_DISABLE_IMAP) || !defined(CURL_DISABLE_SMTP) || \
  33. !defined(CURL_DISABLE_POP3)
  34. #include <curl/curl.h>
  35. #include "urldata.h"
  36. #include "curl_base64.h"
  37. #include "curl_md5.h"
  38. #include "vauth/vauth.h"
  39. #include "vtls/vtls.h"
  40. #include "curl_hmac.h"
  41. #include "curl_sasl.h"
  42. #include "warnless.h"
  43. #include "strtok.h"
  44. #include "sendf.h"
  45. #include "non-ascii.h" /* included for Curl_convert_... prototypes */
  46. /* The last 3 #include files should be in this order */
  47. #include "curl_printf.h"
  48. #include "curl_memory.h"
  49. #include "memdebug.h"
  50. /* Supported mechanisms */
  51. static const struct {
  52. const char *name; /* Name */
  53. size_t len; /* Name length */
  54. unsigned int bit; /* Flag bit */
  55. } mechtable[] = {
  56. { "LOGIN", 5, SASL_MECH_LOGIN },
  57. { "PLAIN", 5, SASL_MECH_PLAIN },
  58. { "CRAM-MD5", 8, SASL_MECH_CRAM_MD5 },
  59. { "DIGEST-MD5", 10, SASL_MECH_DIGEST_MD5 },
  60. { "GSSAPI", 6, SASL_MECH_GSSAPI },
  61. { "EXTERNAL", 8, SASL_MECH_EXTERNAL },
  62. { "NTLM", 4, SASL_MECH_NTLM },
  63. { "XOAUTH2", 7, SASL_MECH_XOAUTH2 },
  64. { "OAUTHBEARER", 11, SASL_MECH_OAUTHBEARER },
  65. { ZERO_NULL, 0, 0 }
  66. };
  67. /*
  68. * Curl_sasl_cleanup()
  69. *
  70. * This is used to cleanup any libraries or curl modules used by the sasl
  71. * functions.
  72. *
  73. * Parameters:
  74. *
  75. * conn [in] - The connection data.
  76. * authused [in] - The authentication mechanism used.
  77. */
  78. void Curl_sasl_cleanup(struct connectdata *conn, unsigned int authused)
  79. {
  80. #if defined(USE_KERBEROS5)
  81. /* Cleanup the gssapi structure */
  82. if(authused == SASL_MECH_GSSAPI) {
  83. Curl_auth_cleanup_gssapi(&conn->krb5);
  84. }
  85. #endif
  86. #if defined(USE_NTLM)
  87. /* Cleanup the NTLM structure */
  88. if(authused == SASL_MECH_NTLM) {
  89. Curl_auth_cleanup_ntlm(&conn->ntlm);
  90. }
  91. #endif
  92. #if !defined(USE_KERBEROS5) && !defined(USE_NTLM)
  93. /* Reserved for future use */
  94. (void)conn;
  95. (void)authused;
  96. #endif
  97. }
  98. /*
  99. * Curl_sasl_decode_mech()
  100. *
  101. * Convert a SASL mechanism name into a token.
  102. *
  103. * Parameters:
  104. *
  105. * ptr [in] - The mechanism string.
  106. * maxlen [in] - Maximum mechanism string length.
  107. * len [out] - If not NULL, effective name length.
  108. *
  109. * Returns the SASL mechanism token or 0 if no match.
  110. */
  111. unsigned int Curl_sasl_decode_mech(const char *ptr, size_t maxlen, size_t *len)
  112. {
  113. unsigned int i;
  114. char c;
  115. for(i = 0; mechtable[i].name; i++) {
  116. if(maxlen >= mechtable[i].len &&
  117. !memcmp(ptr, mechtable[i].name, mechtable[i].len)) {
  118. if(len)
  119. *len = mechtable[i].len;
  120. if(maxlen == mechtable[i].len)
  121. return mechtable[i].bit;
  122. c = ptr[mechtable[i].len];
  123. if(!ISUPPER(c) && !ISDIGIT(c) && c != '-' && c != '_')
  124. return mechtable[i].bit;
  125. }
  126. }
  127. return 0;
  128. }
  129. /*
  130. * Curl_sasl_parse_url_auth_option()
  131. *
  132. * Parse the URL login options.
  133. */
  134. CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl,
  135. const char *value, size_t len)
  136. {
  137. CURLcode result = CURLE_OK;
  138. size_t mechlen;
  139. if(!len)
  140. return CURLE_URL_MALFORMAT;
  141. if(sasl->resetprefs) {
  142. sasl->resetprefs = FALSE;
  143. sasl->prefmech = SASL_AUTH_NONE;
  144. }
  145. if(!strncmp(value, "*", len))
  146. sasl->prefmech = SASL_AUTH_DEFAULT;
  147. else {
  148. unsigned int mechbit = Curl_sasl_decode_mech(value, len, &mechlen);
  149. if(mechbit && mechlen == len)
  150. sasl->prefmech |= mechbit;
  151. else
  152. result = CURLE_URL_MALFORMAT;
  153. }
  154. return result;
  155. }
  156. /*
  157. * Curl_sasl_init()
  158. *
  159. * Initializes the SASL structure.
  160. */
  161. void Curl_sasl_init(struct SASL *sasl, const struct SASLproto *params)
  162. {
  163. sasl->params = params; /* Set protocol dependent parameters */
  164. sasl->state = SASL_STOP; /* Not yet running */
  165. sasl->authmechs = SASL_AUTH_NONE; /* No known authentication mechanism yet */
  166. sasl->prefmech = SASL_AUTH_DEFAULT; /* Prefer all mechanisms */
  167. sasl->authused = SASL_AUTH_NONE; /* No the authentication mechanism used */
  168. sasl->resetprefs = TRUE; /* Reset prefmech upon AUTH parsing. */
  169. sasl->mutual_auth = FALSE; /* No mutual authentication (GSSAPI only) */
  170. sasl->force_ir = FALSE; /* Respect external option */
  171. }
  172. /*
  173. * state()
  174. *
  175. * This is the ONLY way to change SASL state!
  176. */
  177. static void state(struct SASL *sasl, struct connectdata *conn,
  178. saslstate newstate)
  179. {
  180. #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
  181. /* for debug purposes */
  182. static const char * const names[]={
  183. "STOP",
  184. "PLAIN",
  185. "LOGIN",
  186. "LOGIN_PASSWD",
  187. "EXTERNAL",
  188. "CRAMMD5",
  189. "DIGESTMD5",
  190. "DIGESTMD5_RESP",
  191. "NTLM",
  192. "NTLM_TYPE2MSG",
  193. "GSSAPI",
  194. "GSSAPI_TOKEN",
  195. "GSSAPI_NO_DATA",
  196. "OAUTH2",
  197. "OAUTH2_RESP",
  198. "CANCEL",
  199. "FINAL",
  200. /* LAST */
  201. };
  202. if(sasl->state != newstate)
  203. infof(conn->data, "SASL %p state change from %s to %s\n",
  204. (void *)sasl, names[sasl->state], names[newstate]);
  205. #else
  206. (void) conn;
  207. #endif
  208. sasl->state = newstate;
  209. }
  210. /*
  211. * Curl_sasl_can_authenticate()
  212. *
  213. * Check if we have enough auth data and capabilities to authenticate.
  214. */
  215. bool Curl_sasl_can_authenticate(struct SASL *sasl, struct connectdata *conn)
  216. {
  217. /* Have credentials been provided? */
  218. if(conn->bits.user_passwd)
  219. return TRUE;
  220. /* EXTERNAL can authenticate without a user name and/or password */
  221. if(sasl->authmechs & sasl->prefmech & SASL_MECH_EXTERNAL)
  222. return TRUE;
  223. return FALSE;
  224. }
  225. /*
  226. * Curl_sasl_start()
  227. *
  228. * Calculate the required login details for SASL authentication.
  229. */
  230. CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
  231. bool force_ir, saslprogress *progress)
  232. {
  233. CURLcode result = CURLE_OK;
  234. struct Curl_easy *data = conn->data;
  235. unsigned int enabledmechs;
  236. const char *mech = NULL;
  237. char *resp = NULL;
  238. size_t len = 0;
  239. saslstate state1 = SASL_STOP;
  240. saslstate state2 = SASL_FINAL;
  241. #ifndef CURL_DISABLE_PROXY
  242. const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
  243. conn->host.name;
  244. const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port;
  245. #else
  246. const char * const hostname = conn->host.name;
  247. const long int port = conn->remote_port;
  248. #endif
  249. #if defined(USE_KERBEROS5) || defined(USE_NTLM)
  250. const char *service = data->set.str[STRING_SERVICE_NAME] ?
  251. data->set.str[STRING_SERVICE_NAME] :
  252. sasl->params->service;
  253. #endif
  254. const char *oauth_bearer = data->set.str[STRING_BEARER];
  255. sasl->force_ir = force_ir; /* Latch for future use */
  256. sasl->authused = 0; /* No mechanism used yet */
  257. enabledmechs = sasl->authmechs & sasl->prefmech;
  258. *progress = SASL_IDLE;
  259. /* Calculate the supported authentication mechanism, by decreasing order of
  260. security, as well as the initial response where appropriate */
  261. if((enabledmechs & SASL_MECH_EXTERNAL) && !conn->passwd[0]) {
  262. mech = SASL_MECH_STRING_EXTERNAL;
  263. state1 = SASL_EXTERNAL;
  264. sasl->authused = SASL_MECH_EXTERNAL;
  265. if(force_ir || data->set.sasl_ir)
  266. result = Curl_auth_create_external_message(data, conn->user, &resp,
  267. &len);
  268. }
  269. else if(conn->bits.user_passwd) {
  270. #if defined(USE_KERBEROS5)
  271. if((enabledmechs & SASL_MECH_GSSAPI) && Curl_auth_is_gssapi_supported() &&
  272. Curl_auth_user_contains_domain(conn->user)) {
  273. sasl->mutual_auth = FALSE;
  274. mech = SASL_MECH_STRING_GSSAPI;
  275. state1 = SASL_GSSAPI;
  276. state2 = SASL_GSSAPI_TOKEN;
  277. sasl->authused = SASL_MECH_GSSAPI;
  278. if(force_ir || data->set.sasl_ir)
  279. result = Curl_auth_create_gssapi_user_message(data, conn->user,
  280. conn->passwd,
  281. service,
  282. data->conn->host.name,
  283. sasl->mutual_auth,
  284. NULL, &conn->krb5,
  285. &resp, &len);
  286. }
  287. else
  288. #endif
  289. #ifndef CURL_DISABLE_CRYPTO_AUTH
  290. if((enabledmechs & SASL_MECH_DIGEST_MD5) &&
  291. Curl_auth_is_digest_supported()) {
  292. mech = SASL_MECH_STRING_DIGEST_MD5;
  293. state1 = SASL_DIGESTMD5;
  294. sasl->authused = SASL_MECH_DIGEST_MD5;
  295. }
  296. else if(enabledmechs & SASL_MECH_CRAM_MD5) {
  297. mech = SASL_MECH_STRING_CRAM_MD5;
  298. state1 = SASL_CRAMMD5;
  299. sasl->authused = SASL_MECH_CRAM_MD5;
  300. }
  301. else
  302. #endif
  303. #ifdef USE_NTLM
  304. if((enabledmechs & SASL_MECH_NTLM) && Curl_auth_is_ntlm_supported()) {
  305. mech = SASL_MECH_STRING_NTLM;
  306. state1 = SASL_NTLM;
  307. state2 = SASL_NTLM_TYPE2MSG;
  308. sasl->authused = SASL_MECH_NTLM;
  309. if(force_ir || data->set.sasl_ir)
  310. result = Curl_auth_create_ntlm_type1_message(data,
  311. conn->user, conn->passwd,
  312. service,
  313. hostname,
  314. &conn->ntlm, &resp,
  315. &len);
  316. }
  317. else
  318. #endif
  319. if((enabledmechs & SASL_MECH_OAUTHBEARER) && oauth_bearer) {
  320. mech = SASL_MECH_STRING_OAUTHBEARER;
  321. state1 = SASL_OAUTH2;
  322. state2 = SASL_OAUTH2_RESP;
  323. sasl->authused = SASL_MECH_OAUTHBEARER;
  324. if(force_ir || data->set.sasl_ir)
  325. result = Curl_auth_create_oauth_bearer_message(data, conn->user,
  326. hostname,
  327. port,
  328. oauth_bearer,
  329. &resp, &len);
  330. }
  331. else if((enabledmechs & SASL_MECH_XOAUTH2) && oauth_bearer) {
  332. mech = SASL_MECH_STRING_XOAUTH2;
  333. state1 = SASL_OAUTH2;
  334. sasl->authused = SASL_MECH_XOAUTH2;
  335. if(force_ir || data->set.sasl_ir)
  336. result = Curl_auth_create_xoauth_bearer_message(data, conn->user,
  337. oauth_bearer,
  338. &resp, &len);
  339. }
  340. else if(enabledmechs & SASL_MECH_PLAIN) {
  341. mech = SASL_MECH_STRING_PLAIN;
  342. state1 = SASL_PLAIN;
  343. sasl->authused = SASL_MECH_PLAIN;
  344. if(force_ir || data->set.sasl_ir)
  345. result = Curl_auth_create_plain_message(data, conn->sasl_authzid,
  346. conn->user, conn->passwd,
  347. &resp, &len);
  348. }
  349. else if(enabledmechs & SASL_MECH_LOGIN) {
  350. mech = SASL_MECH_STRING_LOGIN;
  351. state1 = SASL_LOGIN;
  352. state2 = SASL_LOGIN_PASSWD;
  353. sasl->authused = SASL_MECH_LOGIN;
  354. if(force_ir || data->set.sasl_ir)
  355. result = Curl_auth_create_login_message(data, conn->user, &resp, &len);
  356. }
  357. }
  358. if(!result && mech) {
  359. if(resp && sasl->params->maxirlen &&
  360. strlen(mech) + len > sasl->params->maxirlen) {
  361. free(resp);
  362. resp = NULL;
  363. }
  364. result = sasl->params->sendauth(conn, mech, resp);
  365. if(!result) {
  366. *progress = SASL_INPROGRESS;
  367. state(sasl, conn, resp ? state2 : state1);
  368. }
  369. }
  370. free(resp);
  371. return result;
  372. }
  373. /*
  374. * Curl_sasl_continue()
  375. *
  376. * Continue the authentication.
  377. */
  378. CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn,
  379. int code, saslprogress *progress)
  380. {
  381. CURLcode result = CURLE_OK;
  382. struct Curl_easy *data = conn->data;
  383. saslstate newstate = SASL_FINAL;
  384. char *resp = NULL;
  385. #ifndef CURL_DISABLE_PROXY
  386. const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
  387. conn->host.name;
  388. const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port;
  389. #else
  390. const char * const hostname = conn->host.name;
  391. const long int port = conn->remote_port;
  392. #endif
  393. #if !defined(CURL_DISABLE_CRYPTO_AUTH)
  394. char *chlg = NULL;
  395. size_t chlglen = 0;
  396. #endif
  397. #if !defined(CURL_DISABLE_CRYPTO_AUTH) || defined(USE_KERBEROS5) || \
  398. defined(USE_NTLM)
  399. const char *service = data->set.str[STRING_SERVICE_NAME] ?
  400. data->set.str[STRING_SERVICE_NAME] :
  401. sasl->params->service;
  402. char *serverdata;
  403. #endif
  404. size_t len = 0;
  405. const char *oauth_bearer = data->set.str[STRING_BEARER];
  406. *progress = SASL_INPROGRESS;
  407. if(sasl->state == SASL_FINAL) {
  408. if(code != sasl->params->finalcode)
  409. result = CURLE_LOGIN_DENIED;
  410. *progress = SASL_DONE;
  411. state(sasl, conn, SASL_STOP);
  412. return result;
  413. }
  414. if(sasl->state != SASL_CANCEL && sasl->state != SASL_OAUTH2_RESP &&
  415. code != sasl->params->contcode) {
  416. *progress = SASL_DONE;
  417. state(sasl, conn, SASL_STOP);
  418. return CURLE_LOGIN_DENIED;
  419. }
  420. switch(sasl->state) {
  421. case SASL_STOP:
  422. *progress = SASL_DONE;
  423. return result;
  424. case SASL_PLAIN:
  425. result = Curl_auth_create_plain_message(data, conn->sasl_authzid,
  426. conn->user, conn->passwd,
  427. &resp, &len);
  428. break;
  429. case SASL_LOGIN:
  430. result = Curl_auth_create_login_message(data, conn->user, &resp, &len);
  431. newstate = SASL_LOGIN_PASSWD;
  432. break;
  433. case SASL_LOGIN_PASSWD:
  434. result = Curl_auth_create_login_message(data, conn->passwd, &resp, &len);
  435. break;
  436. case SASL_EXTERNAL:
  437. result = Curl_auth_create_external_message(data, conn->user, &resp, &len);
  438. break;
  439. #ifndef CURL_DISABLE_CRYPTO_AUTH
  440. case SASL_CRAMMD5:
  441. sasl->params->getmessage(data->state.buffer, &serverdata);
  442. result = Curl_auth_decode_cram_md5_message(serverdata, &chlg, &chlglen);
  443. if(!result)
  444. result = Curl_auth_create_cram_md5_message(data, chlg, conn->user,
  445. conn->passwd, &resp, &len);
  446. free(chlg);
  447. break;
  448. case SASL_DIGESTMD5:
  449. sasl->params->getmessage(data->state.buffer, &serverdata);
  450. result = Curl_auth_create_digest_md5_message(data, serverdata,
  451. conn->user, conn->passwd,
  452. service,
  453. &resp, &len);
  454. newstate = SASL_DIGESTMD5_RESP;
  455. break;
  456. case SASL_DIGESTMD5_RESP:
  457. resp = strdup("");
  458. if(!resp)
  459. result = CURLE_OUT_OF_MEMORY;
  460. break;
  461. #endif
  462. #ifdef USE_NTLM
  463. case SASL_NTLM:
  464. /* Create the type-1 message */
  465. result = Curl_auth_create_ntlm_type1_message(data,
  466. conn->user, conn->passwd,
  467. service, hostname,
  468. &conn->ntlm, &resp, &len);
  469. newstate = SASL_NTLM_TYPE2MSG;
  470. break;
  471. case SASL_NTLM_TYPE2MSG:
  472. /* Decode the type-2 message */
  473. sasl->params->getmessage(data->state.buffer, &serverdata);
  474. result = Curl_auth_decode_ntlm_type2_message(data, serverdata,
  475. &conn->ntlm);
  476. if(!result)
  477. result = Curl_auth_create_ntlm_type3_message(data, conn->user,
  478. conn->passwd, &conn->ntlm,
  479. &resp, &len);
  480. break;
  481. #endif
  482. #if defined(USE_KERBEROS5)
  483. case SASL_GSSAPI:
  484. result = Curl_auth_create_gssapi_user_message(data, conn->user,
  485. conn->passwd,
  486. service,
  487. data->conn->host.name,
  488. sasl->mutual_auth, NULL,
  489. &conn->krb5,
  490. &resp, &len);
  491. newstate = SASL_GSSAPI_TOKEN;
  492. break;
  493. case SASL_GSSAPI_TOKEN:
  494. sasl->params->getmessage(data->state.buffer, &serverdata);
  495. if(sasl->mutual_auth) {
  496. /* Decode the user token challenge and create the optional response
  497. message */
  498. result = Curl_auth_create_gssapi_user_message(data, NULL, NULL,
  499. NULL, NULL,
  500. sasl->mutual_auth,
  501. serverdata, &conn->krb5,
  502. &resp, &len);
  503. newstate = SASL_GSSAPI_NO_DATA;
  504. }
  505. else
  506. /* Decode the security challenge and create the response message */
  507. result = Curl_auth_create_gssapi_security_message(data, serverdata,
  508. &conn->krb5,
  509. &resp, &len);
  510. break;
  511. case SASL_GSSAPI_NO_DATA:
  512. sasl->params->getmessage(data->state.buffer, &serverdata);
  513. /* Decode the security challenge and create the response message */
  514. result = Curl_auth_create_gssapi_security_message(data, serverdata,
  515. &conn->krb5,
  516. &resp, &len);
  517. break;
  518. #endif
  519. case SASL_OAUTH2:
  520. /* Create the authorisation message */
  521. if(sasl->authused == SASL_MECH_OAUTHBEARER) {
  522. result = Curl_auth_create_oauth_bearer_message(data, conn->user,
  523. hostname,
  524. port,
  525. oauth_bearer,
  526. &resp, &len);
  527. /* Failures maybe sent by the server as continuations for OAUTHBEARER */
  528. newstate = SASL_OAUTH2_RESP;
  529. }
  530. else
  531. result = Curl_auth_create_xoauth_bearer_message(data, conn->user,
  532. oauth_bearer,
  533. &resp, &len);
  534. break;
  535. case SASL_OAUTH2_RESP:
  536. /* The continuation is optional so check the response code */
  537. if(code == sasl->params->finalcode) {
  538. /* Final response was received so we are done */
  539. *progress = SASL_DONE;
  540. state(sasl, conn, SASL_STOP);
  541. return result;
  542. }
  543. else if(code == sasl->params->contcode) {
  544. /* Acknowledge the continuation by sending a 0x01 response base64
  545. encoded */
  546. resp = strdup("AQ==");
  547. if(!resp)
  548. result = CURLE_OUT_OF_MEMORY;
  549. break;
  550. }
  551. else {
  552. *progress = SASL_DONE;
  553. state(sasl, conn, SASL_STOP);
  554. return CURLE_LOGIN_DENIED;
  555. }
  556. case SASL_CANCEL:
  557. /* Remove the offending mechanism from the supported list */
  558. sasl->authmechs ^= sasl->authused;
  559. /* Start an alternative SASL authentication */
  560. result = Curl_sasl_start(sasl, conn, sasl->force_ir, progress);
  561. newstate = sasl->state; /* Use state from Curl_sasl_start() */
  562. break;
  563. default:
  564. failf(data, "Unsupported SASL authentication mechanism");
  565. result = CURLE_UNSUPPORTED_PROTOCOL; /* Should not happen */
  566. break;
  567. }
  568. switch(result) {
  569. case CURLE_BAD_CONTENT_ENCODING:
  570. /* Cancel dialog */
  571. result = sasl->params->sendcont(conn, "*");
  572. newstate = SASL_CANCEL;
  573. break;
  574. case CURLE_OK:
  575. if(resp)
  576. result = sasl->params->sendcont(conn, resp);
  577. break;
  578. default:
  579. newstate = SASL_STOP; /* Stop on error */
  580. *progress = SASL_DONE;
  581. break;
  582. }
  583. free(resp);
  584. state(sasl, conn, newstate);
  585. return result;
  586. }
  587. #endif /* protocols are enabled that use SASL */