2
0

digest_sspi.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 2014 - 2016, Steve Holme, <steve_holme@hotmail.com>.
  9. * Copyright (C) 2015 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  10. *
  11. * This software is licensed as described in the file COPYING, which
  12. * you should have received as part of this distribution. The terms
  13. * are also available at https://curl.se/docs/copyright.html.
  14. *
  15. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16. * copies of the Software, and permit persons to whom the Software is
  17. * furnished to do so, under the terms of the COPYING file.
  18. *
  19. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20. * KIND, either express or implied.
  21. *
  22. * SPDX-License-Identifier: curl
  23. *
  24. * RFC2831 DIGEST-MD5 authentication
  25. *
  26. ***************************************************************************/
  27. #include "curl_setup.h"
  28. #if defined(USE_WINDOWS_SSPI) && !defined(CURL_DISABLE_CRYPTO_AUTH)
  29. #include <curl/curl.h>
  30. #include "vauth/vauth.h"
  31. #include "vauth/digest.h"
  32. #include "urldata.h"
  33. #include "warnless.h"
  34. #include "curl_multibyte.h"
  35. #include "sendf.h"
  36. #include "strdup.h"
  37. #include "strcase.h"
  38. #include "strerror.h"
  39. /* The last #include files should be: */
  40. #include "curl_memory.h"
  41. #include "memdebug.h"
  42. /*
  43. * Curl_auth_is_digest_supported()
  44. *
  45. * This is used to evaluate if DIGEST is supported.
  46. *
  47. * Parameters: None
  48. *
  49. * Returns TRUE if DIGEST is supported by Windows SSPI.
  50. */
  51. bool Curl_auth_is_digest_supported(void)
  52. {
  53. PSecPkgInfo SecurityPackage;
  54. SECURITY_STATUS status;
  55. /* Query the security package for Digest */
  56. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
  57. &SecurityPackage);
  58. /* Release the package buffer as it is not required anymore */
  59. if(status == SEC_E_OK) {
  60. s_pSecFn->FreeContextBuffer(SecurityPackage);
  61. }
  62. return (status == SEC_E_OK ? TRUE : FALSE);
  63. }
  64. /*
  65. * Curl_auth_create_digest_md5_message()
  66. *
  67. * This is used to generate an already encoded DIGEST-MD5 response message
  68. * ready for sending to the recipient.
  69. *
  70. * Parameters:
  71. *
  72. * data [in] - The session handle.
  73. * chlg [in] - The challenge message.
  74. * userp [in] - The user name in the format User or Domain\User.
  75. * passwdp [in] - The user's password.
  76. * service [in] - The service type such as http, smtp, pop or imap.
  77. * out [out] - The result storage.
  78. *
  79. * Returns CURLE_OK on success.
  80. */
  81. CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
  82. const struct bufref *chlg,
  83. const char *userp,
  84. const char *passwdp,
  85. const char *service,
  86. struct bufref *out)
  87. {
  88. CURLcode result = CURLE_OK;
  89. TCHAR *spn = NULL;
  90. size_t token_max = 0;
  91. unsigned char *output_token = NULL;
  92. CredHandle credentials;
  93. CtxtHandle context;
  94. PSecPkgInfo SecurityPackage;
  95. SEC_WINNT_AUTH_IDENTITY identity;
  96. SEC_WINNT_AUTH_IDENTITY *p_identity;
  97. SecBuffer chlg_buf;
  98. SecBuffer resp_buf;
  99. SecBufferDesc chlg_desc;
  100. SecBufferDesc resp_desc;
  101. SECURITY_STATUS status;
  102. unsigned long attrs;
  103. TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
  104. /* Ensure we have a valid challenge message */
  105. if(!Curl_bufref_len(chlg)) {
  106. infof(data, "DIGEST-MD5 handshake failure (empty challenge message)");
  107. return CURLE_BAD_CONTENT_ENCODING;
  108. }
  109. /* Query the security package for DigestSSP */
  110. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
  111. &SecurityPackage);
  112. if(status != SEC_E_OK) {
  113. failf(data, "SSPI: couldn't get auth info");
  114. return CURLE_AUTH_ERROR;
  115. }
  116. token_max = SecurityPackage->cbMaxToken;
  117. /* Release the package buffer as it is not required anymore */
  118. s_pSecFn->FreeContextBuffer(SecurityPackage);
  119. /* Allocate our response buffer */
  120. output_token = malloc(token_max);
  121. if(!output_token)
  122. return CURLE_OUT_OF_MEMORY;
  123. /* Generate our SPN */
  124. spn = Curl_auth_build_spn(service, data->conn->host.name, NULL);
  125. if(!spn) {
  126. free(output_token);
  127. return CURLE_OUT_OF_MEMORY;
  128. }
  129. if(userp && *userp) {
  130. /* Populate our identity structure */
  131. result = Curl_create_sspi_identity(userp, passwdp, &identity);
  132. if(result) {
  133. free(spn);
  134. free(output_token);
  135. return result;
  136. }
  137. /* Allow proper cleanup of the identity structure */
  138. p_identity = &identity;
  139. }
  140. else
  141. /* Use the current Windows user */
  142. p_identity = NULL;
  143. /* Acquire our credentials handle */
  144. status = s_pSecFn->AcquireCredentialsHandle(NULL,
  145. (TCHAR *) TEXT(SP_NAME_DIGEST),
  146. SECPKG_CRED_OUTBOUND, NULL,
  147. p_identity, NULL, NULL,
  148. &credentials, &expiry);
  149. if(status != SEC_E_OK) {
  150. Curl_sspi_free_identity(p_identity);
  151. free(spn);
  152. free(output_token);
  153. return CURLE_LOGIN_DENIED;
  154. }
  155. /* Setup the challenge "input" security buffer */
  156. chlg_desc.ulVersion = SECBUFFER_VERSION;
  157. chlg_desc.cBuffers = 1;
  158. chlg_desc.pBuffers = &chlg_buf;
  159. chlg_buf.BufferType = SECBUFFER_TOKEN;
  160. chlg_buf.pvBuffer = (void *) Curl_bufref_ptr(chlg);
  161. chlg_buf.cbBuffer = curlx_uztoul(Curl_bufref_len(chlg));
  162. /* Setup the response "output" security buffer */
  163. resp_desc.ulVersion = SECBUFFER_VERSION;
  164. resp_desc.cBuffers = 1;
  165. resp_desc.pBuffers = &resp_buf;
  166. resp_buf.BufferType = SECBUFFER_TOKEN;
  167. resp_buf.pvBuffer = output_token;
  168. resp_buf.cbBuffer = curlx_uztoul(token_max);
  169. /* Generate our response message */
  170. status = s_pSecFn->InitializeSecurityContext(&credentials, NULL, spn,
  171. 0, 0, 0, &chlg_desc, 0,
  172. &context, &resp_desc, &attrs,
  173. &expiry);
  174. if(status == SEC_I_COMPLETE_NEEDED ||
  175. status == SEC_I_COMPLETE_AND_CONTINUE)
  176. s_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
  177. else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
  178. #if !defined(CURL_DISABLE_VERBOSE_STRINGS)
  179. char buffer[STRERROR_LEN];
  180. #endif
  181. s_pSecFn->FreeCredentialsHandle(&credentials);
  182. Curl_sspi_free_identity(p_identity);
  183. free(spn);
  184. free(output_token);
  185. if(status == SEC_E_INSUFFICIENT_MEMORY)
  186. return CURLE_OUT_OF_MEMORY;
  187. infof(data, "schannel: InitializeSecurityContext failed: %s",
  188. Curl_sspi_strerror(status, buffer, sizeof(buffer)));
  189. return CURLE_AUTH_ERROR;
  190. }
  191. /* Return the response. */
  192. Curl_bufref_set(out, output_token, resp_buf.cbBuffer, curl_free);
  193. /* Free our handles */
  194. s_pSecFn->DeleteSecurityContext(&context);
  195. s_pSecFn->FreeCredentialsHandle(&credentials);
  196. /* Free the identity structure */
  197. Curl_sspi_free_identity(p_identity);
  198. /* Free the SPN */
  199. free(spn);
  200. return result;
  201. }
  202. /*
  203. * Curl_override_sspi_http_realm()
  204. *
  205. * This is used to populate the domain in a SSPI identity structure
  206. * The realm is extracted from the challenge message and used as the
  207. * domain if it is not already explicitly set.
  208. *
  209. * Parameters:
  210. *
  211. * chlg [in] - The challenge message.
  212. * identity [in/out] - The identity structure.
  213. *
  214. * Returns CURLE_OK on success.
  215. */
  216. CURLcode Curl_override_sspi_http_realm(const char *chlg,
  217. SEC_WINNT_AUTH_IDENTITY *identity)
  218. {
  219. xcharp_u domain, dup_domain;
  220. /* If domain is blank or unset, check challenge message for realm */
  221. if(!identity->Domain || !identity->DomainLength) {
  222. for(;;) {
  223. char value[DIGEST_MAX_VALUE_LENGTH];
  224. char content[DIGEST_MAX_CONTENT_LENGTH];
  225. /* Pass all additional spaces here */
  226. while(*chlg && ISBLANK(*chlg))
  227. chlg++;
  228. /* Extract a value=content pair */
  229. if(Curl_auth_digest_get_pair(chlg, value, content, &chlg)) {
  230. if(strcasecompare(value, "realm")) {
  231. /* Setup identity's domain and length */
  232. domain.tchar_ptr = curlx_convert_UTF8_to_tchar((char *) content);
  233. if(!domain.tchar_ptr)
  234. return CURLE_OUT_OF_MEMORY;
  235. dup_domain.tchar_ptr = _tcsdup(domain.tchar_ptr);
  236. if(!dup_domain.tchar_ptr) {
  237. curlx_unicodefree(domain.tchar_ptr);
  238. return CURLE_OUT_OF_MEMORY;
  239. }
  240. free(identity->Domain);
  241. identity->Domain = dup_domain.tbyte_ptr;
  242. identity->DomainLength = curlx_uztoul(_tcslen(dup_domain.tchar_ptr));
  243. dup_domain.tchar_ptr = NULL;
  244. curlx_unicodefree(domain.tchar_ptr);
  245. }
  246. else {
  247. /* Unknown specifier, ignore it! */
  248. }
  249. }
  250. else
  251. break; /* We're done here */
  252. /* Pass all additional spaces here */
  253. while(*chlg && ISBLANK(*chlg))
  254. chlg++;
  255. /* Allow the list to be comma-separated */
  256. if(',' == *chlg)
  257. chlg++;
  258. }
  259. }
  260. return CURLE_OK;
  261. }
  262. /*
  263. * Curl_auth_decode_digest_http_message()
  264. *
  265. * This is used to decode an HTTP DIGEST challenge message into the separate
  266. * attributes.
  267. *
  268. * Parameters:
  269. *
  270. * chlg [in] - The challenge message.
  271. * digest [in/out] - The digest data struct being used and modified.
  272. *
  273. * Returns CURLE_OK on success.
  274. */
  275. CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
  276. struct digestdata *digest)
  277. {
  278. size_t chlglen = strlen(chlg);
  279. /* We had an input token before so if there's another one now that means we
  280. provided bad credentials in the previous request or it's stale. */
  281. if(digest->input_token) {
  282. bool stale = false;
  283. const char *p = chlg;
  284. /* Check for the 'stale' directive */
  285. for(;;) {
  286. char value[DIGEST_MAX_VALUE_LENGTH];
  287. char content[DIGEST_MAX_CONTENT_LENGTH];
  288. while(*p && ISBLANK(*p))
  289. p++;
  290. if(!Curl_auth_digest_get_pair(p, value, content, &p))
  291. break;
  292. if(strcasecompare(value, "stale") &&
  293. strcasecompare(content, "true")) {
  294. stale = true;
  295. break;
  296. }
  297. while(*p && ISBLANK(*p))
  298. p++;
  299. if(',' == *p)
  300. p++;
  301. }
  302. if(stale)
  303. Curl_auth_digest_cleanup(digest);
  304. else
  305. return CURLE_LOGIN_DENIED;
  306. }
  307. /* Store the challenge for use later */
  308. digest->input_token = (BYTE *) Curl_memdup(chlg, chlglen + 1);
  309. if(!digest->input_token)
  310. return CURLE_OUT_OF_MEMORY;
  311. digest->input_token_len = chlglen;
  312. return CURLE_OK;
  313. }
  314. /*
  315. * Curl_auth_create_digest_http_message()
  316. *
  317. * This is used to generate an HTTP DIGEST response message ready for sending
  318. * to the recipient.
  319. *
  320. * Parameters:
  321. *
  322. * data [in] - The session handle.
  323. * userp [in] - The user name in the format User or Domain\User.
  324. * passwdp [in] - The user's password.
  325. * request [in] - The HTTP request.
  326. * uripath [in] - The path of the HTTP uri.
  327. * digest [in/out] - The digest data struct being used and modified.
  328. * outptr [in/out] - The address where a pointer to newly allocated memory
  329. * holding the result will be stored upon completion.
  330. * outlen [out] - The length of the output message.
  331. *
  332. * Returns CURLE_OK on success.
  333. */
  334. CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
  335. const char *userp,
  336. const char *passwdp,
  337. const unsigned char *request,
  338. const unsigned char *uripath,
  339. struct digestdata *digest,
  340. char **outptr, size_t *outlen)
  341. {
  342. size_t token_max;
  343. char *resp;
  344. BYTE *output_token;
  345. size_t output_token_len = 0;
  346. PSecPkgInfo SecurityPackage;
  347. SecBuffer chlg_buf[5];
  348. SecBufferDesc chlg_desc;
  349. SECURITY_STATUS status;
  350. (void) data;
  351. /* Query the security package for DigestSSP */
  352. status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
  353. &SecurityPackage);
  354. if(status != SEC_E_OK) {
  355. failf(data, "SSPI: couldn't get auth info");
  356. return CURLE_AUTH_ERROR;
  357. }
  358. token_max = SecurityPackage->cbMaxToken;
  359. /* Release the package buffer as it is not required anymore */
  360. s_pSecFn->FreeContextBuffer(SecurityPackage);
  361. /* Allocate the output buffer according to the max token size as indicated
  362. by the security package */
  363. output_token = malloc(token_max);
  364. if(!output_token) {
  365. return CURLE_OUT_OF_MEMORY;
  366. }
  367. /* If the user/passwd that was used to make the identity for http_context
  368. has changed then delete that context. */
  369. if((userp && !digest->user) || (!userp && digest->user) ||
  370. (passwdp && !digest->passwd) || (!passwdp && digest->passwd) ||
  371. (userp && digest->user && Curl_timestrcmp(userp, digest->user)) ||
  372. (passwdp && digest->passwd && Curl_timestrcmp(passwdp, digest->passwd))) {
  373. if(digest->http_context) {
  374. s_pSecFn->DeleteSecurityContext(digest->http_context);
  375. Curl_safefree(digest->http_context);
  376. }
  377. Curl_safefree(digest->user);
  378. Curl_safefree(digest->passwd);
  379. }
  380. if(digest->http_context) {
  381. chlg_desc.ulVersion = SECBUFFER_VERSION;
  382. chlg_desc.cBuffers = 5;
  383. chlg_desc.pBuffers = chlg_buf;
  384. chlg_buf[0].BufferType = SECBUFFER_TOKEN;
  385. chlg_buf[0].pvBuffer = NULL;
  386. chlg_buf[0].cbBuffer = 0;
  387. chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;
  388. chlg_buf[1].pvBuffer = (void *) request;
  389. chlg_buf[1].cbBuffer = curlx_uztoul(strlen((const char *) request));
  390. chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;
  391. chlg_buf[2].pvBuffer = (void *) uripath;
  392. chlg_buf[2].cbBuffer = curlx_uztoul(strlen((const char *) uripath));
  393. chlg_buf[3].BufferType = SECBUFFER_PKG_PARAMS;
  394. chlg_buf[3].pvBuffer = NULL;
  395. chlg_buf[3].cbBuffer = 0;
  396. chlg_buf[4].BufferType = SECBUFFER_PADDING;
  397. chlg_buf[4].pvBuffer = output_token;
  398. chlg_buf[4].cbBuffer = curlx_uztoul(token_max);
  399. status = s_pSecFn->MakeSignature(digest->http_context, 0, &chlg_desc, 0);
  400. if(status == SEC_E_OK)
  401. output_token_len = chlg_buf[4].cbBuffer;
  402. else { /* delete the context so a new one can be made */
  403. infof(data, "digest_sspi: MakeSignature failed, error 0x%08lx",
  404. (long)status);
  405. s_pSecFn->DeleteSecurityContext(digest->http_context);
  406. Curl_safefree(digest->http_context);
  407. }
  408. }
  409. if(!digest->http_context) {
  410. CredHandle credentials;
  411. SEC_WINNT_AUTH_IDENTITY identity;
  412. SEC_WINNT_AUTH_IDENTITY *p_identity;
  413. SecBuffer resp_buf;
  414. SecBufferDesc resp_desc;
  415. unsigned long attrs;
  416. TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
  417. TCHAR *spn;
  418. /* free the copy of user/passwd used to make the previous identity */
  419. Curl_safefree(digest->user);
  420. Curl_safefree(digest->passwd);
  421. if(userp && *userp) {
  422. /* Populate our identity structure */
  423. if(Curl_create_sspi_identity(userp, passwdp, &identity)) {
  424. free(output_token);
  425. return CURLE_OUT_OF_MEMORY;
  426. }
  427. /* Populate our identity domain */
  428. if(Curl_override_sspi_http_realm((const char *) digest->input_token,
  429. &identity)) {
  430. free(output_token);
  431. return CURLE_OUT_OF_MEMORY;
  432. }
  433. /* Allow proper cleanup of the identity structure */
  434. p_identity = &identity;
  435. }
  436. else
  437. /* Use the current Windows user */
  438. p_identity = NULL;
  439. if(userp) {
  440. digest->user = strdup(userp);
  441. if(!digest->user) {
  442. free(output_token);
  443. return CURLE_OUT_OF_MEMORY;
  444. }
  445. }
  446. if(passwdp) {
  447. digest->passwd = strdup(passwdp);
  448. if(!digest->passwd) {
  449. free(output_token);
  450. Curl_safefree(digest->user);
  451. return CURLE_OUT_OF_MEMORY;
  452. }
  453. }
  454. /* Acquire our credentials handle */
  455. status = s_pSecFn->AcquireCredentialsHandle(NULL,
  456. (TCHAR *) TEXT(SP_NAME_DIGEST),
  457. SECPKG_CRED_OUTBOUND, NULL,
  458. p_identity, NULL, NULL,
  459. &credentials, &expiry);
  460. if(status != SEC_E_OK) {
  461. Curl_sspi_free_identity(p_identity);
  462. free(output_token);
  463. return CURLE_LOGIN_DENIED;
  464. }
  465. /* Setup the challenge "input" security buffer if present */
  466. chlg_desc.ulVersion = SECBUFFER_VERSION;
  467. chlg_desc.cBuffers = 3;
  468. chlg_desc.pBuffers = chlg_buf;
  469. chlg_buf[0].BufferType = SECBUFFER_TOKEN;
  470. chlg_buf[0].pvBuffer = digest->input_token;
  471. chlg_buf[0].cbBuffer = curlx_uztoul(digest->input_token_len);
  472. chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;
  473. chlg_buf[1].pvBuffer = (void *) request;
  474. chlg_buf[1].cbBuffer = curlx_uztoul(strlen((const char *) request));
  475. chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;
  476. chlg_buf[2].pvBuffer = NULL;
  477. chlg_buf[2].cbBuffer = 0;
  478. /* Setup the response "output" security buffer */
  479. resp_desc.ulVersion = SECBUFFER_VERSION;
  480. resp_desc.cBuffers = 1;
  481. resp_desc.pBuffers = &resp_buf;
  482. resp_buf.BufferType = SECBUFFER_TOKEN;
  483. resp_buf.pvBuffer = output_token;
  484. resp_buf.cbBuffer = curlx_uztoul(token_max);
  485. spn = curlx_convert_UTF8_to_tchar((char *) uripath);
  486. if(!spn) {
  487. s_pSecFn->FreeCredentialsHandle(&credentials);
  488. Curl_sspi_free_identity(p_identity);
  489. free(output_token);
  490. return CURLE_OUT_OF_MEMORY;
  491. }
  492. /* Allocate our new context handle */
  493. digest->http_context = calloc(1, sizeof(CtxtHandle));
  494. if(!digest->http_context)
  495. return CURLE_OUT_OF_MEMORY;
  496. /* Generate our response message */
  497. status = s_pSecFn->InitializeSecurityContext(&credentials, NULL,
  498. spn,
  499. ISC_REQ_USE_HTTP_STYLE, 0, 0,
  500. &chlg_desc, 0,
  501. digest->http_context,
  502. &resp_desc, &attrs, &expiry);
  503. curlx_unicodefree(spn);
  504. if(status == SEC_I_COMPLETE_NEEDED ||
  505. status == SEC_I_COMPLETE_AND_CONTINUE)
  506. s_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
  507. else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
  508. #if !defined(CURL_DISABLE_VERBOSE_STRINGS)
  509. char buffer[STRERROR_LEN];
  510. #endif
  511. s_pSecFn->FreeCredentialsHandle(&credentials);
  512. Curl_sspi_free_identity(p_identity);
  513. free(output_token);
  514. Curl_safefree(digest->http_context);
  515. if(status == SEC_E_INSUFFICIENT_MEMORY)
  516. return CURLE_OUT_OF_MEMORY;
  517. infof(data, "schannel: InitializeSecurityContext failed: %s",
  518. Curl_sspi_strerror(status, buffer, sizeof(buffer)));
  519. return CURLE_AUTH_ERROR;
  520. }
  521. output_token_len = resp_buf.cbBuffer;
  522. s_pSecFn->FreeCredentialsHandle(&credentials);
  523. Curl_sspi_free_identity(p_identity);
  524. }
  525. resp = malloc(output_token_len + 1);
  526. if(!resp) {
  527. free(output_token);
  528. return CURLE_OUT_OF_MEMORY;
  529. }
  530. /* Copy the generated response */
  531. memcpy(resp, output_token, output_token_len);
  532. resp[output_token_len] = 0;
  533. /* Return the response */
  534. *outptr = resp;
  535. *outlen = output_token_len;
  536. /* Free the response buffer */
  537. free(output_token);
  538. return CURLE_OK;
  539. }
  540. /*
  541. * Curl_auth_digest_cleanup()
  542. *
  543. * This is used to clean up the digest specific data.
  544. *
  545. * Parameters:
  546. *
  547. * digest [in/out] - The digest data struct being cleaned up.
  548. *
  549. */
  550. void Curl_auth_digest_cleanup(struct digestdata *digest)
  551. {
  552. /* Free the input token */
  553. Curl_safefree(digest->input_token);
  554. /* Reset any variables */
  555. digest->input_token_len = 0;
  556. /* Delete security context */
  557. if(digest->http_context) {
  558. s_pSecFn->DeleteSecurityContext(digest->http_context);
  559. Curl_safefree(digest->http_context);
  560. }
  561. /* Free the copy of user/passwd used to make the identity for http_context */
  562. Curl_safefree(digest->user);
  563. Curl_safefree(digest->passwd);
  564. }
  565. #endif /* USE_WINDOWS_SSPI && !CURL_DISABLE_CRYPTO_AUTH */