1 /*************************************************************************** 2 * _ _ ____ _ 3 * Project ___| | | | _ \| | 4 * / __| | | | |_) | | 5 * | (__| |_| | _ <| |___ 6 * \___|\___/|_| \_\_____| 7 * 8 * Copyright (C) 2012 - 2017, Daniel Stenberg, <daniel (at) haxx.se>, et al. 9 * 10 * This software is licensed as described in the file COPYING, which 11 * you should have received as part of this distribution. The terms 12 * are also available at https://curl.haxx.se/docs/copyright.html. 13 * 14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell 15 * copies of the Software, and permit persons to whom the Software is 16 * furnished to do so, under the terms of the COPYING file. 17 * 18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 19 * KIND, either express or implied. 20 * 21 * RFC2195 CRAM-MD5 authentication 22 * RFC2617 Basic and Digest Access Authentication 23 * RFC2831 DIGEST-MD5 authentication 24 * RFC4422 Simple Authentication and Security Layer (SASL) 25 * RFC4616 PLAIN authentication 26 * RFC6749 OAuth 2.0 Authorization Framework 27 * RFC7628 A Set of SASL Mechanisms for OAuth 28 * Draft LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt> 29 * 30 ***************************************************************************/ 31 32 #include "curl_setup.h" 33 34 #include <curl/curl.h> 35 #include "urldata.h" 36 37 #include "curl_base64.h" 38 #include "curl_md5.h" 39 #include "vauth/vauth.h" 40 #include "vtls/vtls.h" 41 #include "curl_hmac.h" 42 #include "curl_sasl.h" 43 #include "warnless.h" 44 #include "strtok.h" 45 #include "sendf.h" 46 #include "non-ascii.h" /* included for Curl_convert_... prototypes */ 47 /* The last 3 #include files should be in this order */ 48 #include "curl_printf.h" 49 #include "curl_memory.h" 50 #include "memdebug.h" 51 52 /* Supported mechanisms */ 53 static const struct { 54 const char *name; /* Name */ 55 size_t len; /* Name length */ 56 unsigned int bit; /* Flag bit */ 57 } mechtable[] = { 58 { "LOGIN", 5, SASL_MECH_LOGIN }, 59 { "PLAIN", 5, SASL_MECH_PLAIN }, 60 { "CRAM-MD5", 8, SASL_MECH_CRAM_MD5 }, 61 { "DIGEST-MD5", 10, SASL_MECH_DIGEST_MD5 }, 62 { "GSSAPI", 6, SASL_MECH_GSSAPI }, 63 { "EXTERNAL", 8, SASL_MECH_EXTERNAL }, 64 { "NTLM", 4, SASL_MECH_NTLM }, 65 { "XOAUTH2", 7, SASL_MECH_XOAUTH2 }, 66 { "OAUTHBEARER", 11, SASL_MECH_OAUTHBEARER }, 67 { ZERO_NULL, 0, 0 } 68 }; 69 70 /* 71 * Curl_sasl_cleanup() 72 * 73 * This is used to cleanup any libraries or curl modules used by the sasl 74 * functions. 75 * 76 * Parameters: 77 * 78 * conn [in] - The connection data. 79 * authused [in] - The authentication mechanism used. 80 */ 81 void Curl_sasl_cleanup(struct connectdata *conn, unsigned int authused) 82 { 83 #if defined(USE_KERBEROS5) 84 /* Cleanup the gssapi structure */ 85 if(authused == SASL_MECH_GSSAPI) { 86 Curl_auth_gssapi_cleanup(&conn->krb5); 87 } 88 #endif 89 90 #if defined(USE_NTLM) 91 /* Cleanup the NTLM structure */ 92 if(authused == SASL_MECH_NTLM) { 93 Curl_auth_ntlm_cleanup(&conn->ntlm); 94 } 95 #endif 96 97 #if !defined(USE_KERBEROS5) && !defined(USE_NTLM) 98 /* Reserved for future use */ 99 (void)conn; 100 (void)authused; 101 #endif 102 } 103 104 /* 105 * Curl_sasl_decode_mech() 106 * 107 * Convert a SASL mechanism name into a token. 108 * 109 * Parameters: 110 * 111 * ptr [in] - The mechanism string. 112 * maxlen [in] - Maximum mechanism string length. 113 * len [out] - If not NULL, effective name length. 114 * 115 * Returns the SASL mechanism token or 0 if no match. 116 */ 117 unsigned int Curl_sasl_decode_mech(const char *ptr, size_t maxlen, size_t *len) 118 { 119 unsigned int i; 120 char c; 121 122 for(i = 0; mechtable[i].name; i++) { 123 if(maxlen >= mechtable[i].len && 124 !memcmp(ptr, mechtable[i].name, mechtable[i].len)) { 125 if(len) 126 *len = mechtable[i].len; 127 128 if(maxlen == mechtable[i].len) 129 return mechtable[i].bit; 130 131 c = ptr[mechtable[i].len]; 132 if(!ISUPPER(c) && !ISDIGIT(c) && c != '-' && c != '_') 133 return mechtable[i].bit; 134 } 135 } 136 137 return 0; 138 } 139 140 /* 141 * Curl_sasl_parse_url_auth_option() 142 * 143 * Parse the URL login options. 144 */ 145 CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl, 146 const char *value, size_t len) 147 { 148 CURLcode result = CURLE_OK; 149 unsigned int mechbit; 150 size_t mechlen; 151 152 if(!len) 153 return CURLE_URL_MALFORMAT; 154 155 if(sasl->resetprefs) { 156 sasl->resetprefs = FALSE; 157 sasl->prefmech = SASL_AUTH_NONE; 158 } 159 160 if(!strncmp(value, "*", len)) 161 sasl->prefmech = SASL_AUTH_DEFAULT; 162 else { 163 mechbit = Curl_sasl_decode_mech(value, len, &mechlen); 164 if(mechbit && mechlen == len) 165 sasl->prefmech |= mechbit; 166 else 167 result = CURLE_URL_MALFORMAT; 168 } 169 170 return result; 171 } 172 173 /* 174 * Curl_sasl_init() 175 * 176 * Initializes the SASL structure. 177 */ 178 void Curl_sasl_init(struct SASL *sasl, const struct SASLproto *params) 179 { 180 sasl->params = params; /* Set protocol dependent parameters */ 181 sasl->state = SASL_STOP; /* Not yet running */ 182 sasl->authmechs = SASL_AUTH_NONE; /* No known authentication mechanism yet */ 183 sasl->prefmech = SASL_AUTH_DEFAULT; /* Prefer all mechanisms */ 184 sasl->authused = SASL_AUTH_NONE; /* No the authentication mechanism used */ 185 sasl->resetprefs = TRUE; /* Reset prefmech upon AUTH parsing. */ 186 sasl->mutual_auth = FALSE; /* No mutual authentication (GSSAPI only) */ 187 sasl->force_ir = FALSE; /* Respect external option */ 188 } 189 190 /* 191 * state() 192 * 193 * This is the ONLY way to change SASL state! 194 */ 195 static void state(struct SASL *sasl, struct connectdata *conn, 196 saslstate newstate) 197 { 198 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS) 199 /* for debug purposes */ 200 static const char * const names[]={ 201 "STOP", 202 "PLAIN", 203 "LOGIN", 204 "LOGIN_PASSWD", 205 "EXTERNAL", 206 "CRAMMD5", 207 "DIGESTMD5", 208 "DIGESTMD5_RESP", 209 "NTLM", 210 "NTLM_TYPE2MSG", 211 "GSSAPI", 212 "GSSAPI_TOKEN", 213 "GSSAPI_NO_DATA", 214 "OAUTH2", 215 "OAUTH2_RESP", 216 "CANCEL", 217 "FINAL", 218 /* LAST */ 219 }; 220 221 if(sasl->state != newstate) 222 infof(conn->data, "SASL %p state change from %s to %s\n", 223 (void *)sasl, names[sasl->state], names[newstate]); 224 #else 225 (void) conn; 226 #endif 227 228 sasl->state = newstate; 229 } 230 231 /* 232 * Curl_sasl_can_authenticate() 233 * 234 * Check if we have enough auth data and capabilities to authenticate. 235 */ 236 bool Curl_sasl_can_authenticate(struct SASL *sasl, struct connectdata *conn) 237 { 238 /* Have credentials been provided? */ 239 if(conn->bits.user_passwd) 240 return TRUE; 241 242 /* EXTERNAL can authenticate without a user name and/or password */ 243 if(sasl->authmechs & sasl->prefmech & SASL_MECH_EXTERNAL) 244 return TRUE; 245 246 return FALSE; 247 } 248 249 /* 250 * Curl_sasl_start() 251 * 252 * Calculate the required login details for SASL authentication. 253 */ 254 CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn, 255 bool force_ir, saslprogress *progress) 256 { 257 CURLcode result = CURLE_OK; 258 struct Curl_easy *data = conn->data; 259 unsigned int enabledmechs; 260 const char *mech = NULL; 261 char *resp = NULL; 262 size_t len = 0; 263 saslstate state1 = SASL_STOP; 264 saslstate state2 = SASL_FINAL; 265 const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name : 266 conn->host.name; 267 const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port; 268 #if defined(USE_KERBEROS5) 269 const char *service = data->set.str[STRING_SERVICE_NAME] ? 270 data->set.str[STRING_SERVICE_NAME] : 271 sasl->params->service; 272 #endif 273 274 sasl->force_ir = force_ir; /* Latch for future use */ 275 sasl->authused = 0; /* No mechanism used yet */ 276 enabledmechs = sasl->authmechs & sasl->prefmech; 277 *progress = SASL_IDLE; 278 279 /* Calculate the supported authentication mechanism, by decreasing order of 280 security, as well as the initial response where appropriate */ 281 if((enabledmechs & SASL_MECH_EXTERNAL) && !conn->passwd[0]) { 282 mech = SASL_MECH_STRING_EXTERNAL; 283 state1 = SASL_EXTERNAL; 284 sasl->authused = SASL_MECH_EXTERNAL; 285 286 if(force_ir || data->set.sasl_ir) 287 result = Curl_auth_create_external_message(data, conn->user, &resp, 288 &len); 289 } 290 else if(conn->bits.user_passwd) { 291 #if defined(USE_KERBEROS5) 292 if((enabledmechs & SASL_MECH_GSSAPI) && Curl_auth_is_gssapi_supported() && 293 Curl_auth_user_contains_domain(conn->user)) { 294 sasl->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */ 295 mech = SASL_MECH_STRING_GSSAPI; 296 state1 = SASL_GSSAPI; 297 state2 = SASL_GSSAPI_TOKEN; 298 sasl->authused = SASL_MECH_GSSAPI; 299 300 if(force_ir || data->set.sasl_ir) 301 result = Curl_auth_create_gssapi_user_message(data, conn->user, 302 conn->passwd, 303 service, 304 data->easy_conn-> 305 host.name, 306 sasl->mutual_auth, 307 NULL, &conn->krb5, 308 &resp, &len); 309 } 310 else 311 #endif 312 #ifndef CURL_DISABLE_CRYPTO_AUTH 313 if((enabledmechs & SASL_MECH_DIGEST_MD5) && 314 Curl_auth_is_digest_supported()) { 315 mech = SASL_MECH_STRING_DIGEST_MD5; 316 state1 = SASL_DIGESTMD5; 317 sasl->authused = SASL_MECH_DIGEST_MD5; 318 } 319 else if(enabledmechs & SASL_MECH_CRAM_MD5) { 320 mech = SASL_MECH_STRING_CRAM_MD5; 321 state1 = SASL_CRAMMD5; 322 sasl->authused = SASL_MECH_CRAM_MD5; 323 } 324 else 325 #endif 326 #ifdef USE_NTLM 327 if((enabledmechs & SASL_MECH_NTLM) && Curl_auth_is_ntlm_supported()) { 328 mech = SASL_MECH_STRING_NTLM; 329 state1 = SASL_NTLM; 330 state2 = SASL_NTLM_TYPE2MSG; 331 sasl->authused = SASL_MECH_NTLM; 332 333 if(force_ir || data->set.sasl_ir) 334 result = Curl_auth_create_ntlm_type1_message(data, 335 conn->user, conn->passwd, 336 &conn->ntlm, &resp, &len); 337 } 338 else 339 #endif 340 if((enabledmechs & SASL_MECH_OAUTHBEARER) && conn->oauth_bearer) { 341 mech = SASL_MECH_STRING_OAUTHBEARER; 342 state1 = SASL_OAUTH2; 343 state2 = SASL_OAUTH2_RESP; 344 sasl->authused = SASL_MECH_OAUTHBEARER; 345 346 if(force_ir || data->set.sasl_ir) 347 result = Curl_auth_create_oauth_bearer_message(data, conn->user, 348 hostname, 349 port, 350 conn->oauth_bearer, 351 &resp, &len); 352 } 353 else if((enabledmechs & SASL_MECH_XOAUTH2) && conn->oauth_bearer) { 354 mech = SASL_MECH_STRING_XOAUTH2; 355 state1 = SASL_OAUTH2; 356 sasl->authused = SASL_MECH_XOAUTH2; 357 358 if(force_ir || data->set.sasl_ir) 359 result = Curl_auth_create_oauth_bearer_message(data, conn->user, 360 NULL, 0, 361 conn->oauth_bearer, 362 &resp, &len); 363 } 364 else if(enabledmechs & SASL_MECH_LOGIN) { 365 mech = SASL_MECH_STRING_LOGIN; 366 state1 = SASL_LOGIN; 367 state2 = SASL_LOGIN_PASSWD; 368 sasl->authused = SASL_MECH_LOGIN; 369 370 if(force_ir || data->set.sasl_ir) 371 result = Curl_auth_create_login_message(data, conn->user, &resp, &len); 372 } 373 else if(enabledmechs & SASL_MECH_PLAIN) { 374 mech = SASL_MECH_STRING_PLAIN; 375 state1 = SASL_PLAIN; 376 sasl->authused = SASL_MECH_PLAIN; 377 378 if(force_ir || data->set.sasl_ir) 379 result = Curl_auth_create_plain_message(data, conn->user, conn->passwd, 380 &resp, &len); 381 } 382 } 383 384 if(!result && mech) { 385 if(resp && sasl->params->maxirlen && 386 strlen(mech) + len > sasl->params->maxirlen) { 387 free(resp); 388 resp = NULL; 389 } 390 391 result = sasl->params->sendauth(conn, mech, resp); 392 if(!result) { 393 *progress = SASL_INPROGRESS; 394 state(sasl, conn, resp ? state2 : state1); 395 } 396 } 397 398 free(resp); 399 400 return result; 401 } 402 403 /* 404 * Curl_sasl_continue() 405 * 406 * Continue the authentication. 407 */ 408 CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn, 409 int code, saslprogress *progress) 410 { 411 CURLcode result = CURLE_OK; 412 struct Curl_easy *data = conn->data; 413 saslstate newstate = SASL_FINAL; 414 char *resp = NULL; 415 const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name : 416 conn->host.name; 417 const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port; 418 #if !defined(CURL_DISABLE_CRYPTO_AUTH) 419 char *chlg = NULL; 420 size_t chlglen = 0; 421 #endif 422 #if !defined(CURL_DISABLE_CRYPTO_AUTH) || defined(USE_KERBEROS5) 423 const char *service = data->set.str[STRING_SERVICE_NAME] ? 424 data->set.str[STRING_SERVICE_NAME] : 425 sasl->params->service; 426 #endif 427 #if !defined(CURL_DISABLE_CRYPTO_AUTH) || defined(USE_KERBEROS5) || \ 428 defined(USE_NTLM) 429 char *serverdata; 430 #endif 431 size_t len = 0; 432 433 *progress = SASL_INPROGRESS; 434 435 if(sasl->state == SASL_FINAL) { 436 if(code != sasl->params->finalcode) 437 result = CURLE_LOGIN_DENIED; 438 *progress = SASL_DONE; 439 state(sasl, conn, SASL_STOP); 440 return result; 441 } 442 443 if(sasl->state != SASL_CANCEL && sasl->state != SASL_OAUTH2_RESP && 444 code != sasl->params->contcode) { 445 *progress = SASL_DONE; 446 state(sasl, conn, SASL_STOP); 447 return CURLE_LOGIN_DENIED; 448 } 449 450 switch(sasl->state) { 451 case SASL_STOP: 452 *progress = SASL_DONE; 453 return result; 454 case SASL_PLAIN: 455 result = Curl_auth_create_plain_message(data, conn->user, conn->passwd, 456 &resp, 457 &len); 458 break; 459 case SASL_LOGIN: 460 result = Curl_auth_create_login_message(data, conn->user, &resp, &len); 461 newstate = SASL_LOGIN_PASSWD; 462 break; 463 case SASL_LOGIN_PASSWD: 464 result = Curl_auth_create_login_message(data, conn->passwd, &resp, &len); 465 break; 466 case SASL_EXTERNAL: 467 result = Curl_auth_create_external_message(data, conn->user, &resp, &len); 468 break; 469 470 #ifndef CURL_DISABLE_CRYPTO_AUTH 471 case SASL_CRAMMD5: 472 sasl->params->getmessage(data->state.buffer, &serverdata); 473 result = Curl_auth_decode_cram_md5_message(serverdata, &chlg, &chlglen); 474 if(!result) 475 result = Curl_auth_create_cram_md5_message(data, chlg, conn->user, 476 conn->passwd, &resp, &len); 477 free(chlg); 478 break; 479 case SASL_DIGESTMD5: 480 sasl->params->getmessage(data->state.buffer, &serverdata); 481 result = Curl_auth_create_digest_md5_message(data, serverdata, 482 conn->user, conn->passwd, 483 service, 484 &resp, &len); 485 newstate = SASL_DIGESTMD5_RESP; 486 break; 487 case SASL_DIGESTMD5_RESP: 488 resp = strdup(""); 489 if(!resp) 490 result = CURLE_OUT_OF_MEMORY; 491 break; 492 #endif 493 494 #ifdef USE_NTLM 495 case SASL_NTLM: 496 /* Create the type-1 message */ 497 result = Curl_auth_create_ntlm_type1_message(data, 498 conn->user, conn->passwd, 499 &conn->ntlm, &resp, &len); 500 newstate = SASL_NTLM_TYPE2MSG; 501 break; 502 case SASL_NTLM_TYPE2MSG: 503 /* Decode the type-2 message */ 504 sasl->params->getmessage(data->state.buffer, &serverdata); 505 result = Curl_auth_decode_ntlm_type2_message(data, serverdata, 506 &conn->ntlm); 507 if(!result) 508 result = Curl_auth_create_ntlm_type3_message(data, conn->user, 509 conn->passwd, &conn->ntlm, 510 &resp, &len); 511 break; 512 #endif 513 514 #if defined(USE_KERBEROS5) 515 case SASL_GSSAPI: 516 result = Curl_auth_create_gssapi_user_message(data, conn->user, 517 conn->passwd, 518 service, 519 data->easy_conn->host.name, 520 sasl->mutual_auth, NULL, 521 &conn->krb5, 522 &resp, &len); 523 newstate = SASL_GSSAPI_TOKEN; 524 break; 525 case SASL_GSSAPI_TOKEN: 526 sasl->params->getmessage(data->state.buffer, &serverdata); 527 if(sasl->mutual_auth) { 528 /* Decode the user token challenge and create the optional response 529 message */ 530 result = Curl_auth_create_gssapi_user_message(data, NULL, NULL, 531 NULL, NULL, 532 sasl->mutual_auth, 533 serverdata, &conn->krb5, 534 &resp, &len); 535 newstate = SASL_GSSAPI_NO_DATA; 536 } 537 else 538 /* Decode the security challenge and create the response message */ 539 result = Curl_auth_create_gssapi_security_message(data, serverdata, 540 &conn->krb5, 541 &resp, &len); 542 break; 543 case SASL_GSSAPI_NO_DATA: 544 sasl->params->getmessage(data->state.buffer, &serverdata); 545 /* Decode the security challenge and create the response message */ 546 result = Curl_auth_create_gssapi_security_message(data, serverdata, 547 &conn->krb5, 548 &resp, &len); 549 break; 550 #endif 551 552 case SASL_OAUTH2: 553 /* Create the authorisation message */ 554 if(sasl->authused == SASL_MECH_OAUTHBEARER) { 555 result = Curl_auth_create_oauth_bearer_message(data, conn->user, 556 hostname, 557 port, 558 conn->oauth_bearer, 559 &resp, &len); 560 561 /* Failures maybe sent by the server as continuations for OAUTHBEARER */ 562 newstate = SASL_OAUTH2_RESP; 563 } 564 else 565 result = Curl_auth_create_oauth_bearer_message(data, conn->user, 566 NULL, 0, 567 conn->oauth_bearer, 568 &resp, &len); 569 break; 570 571 case SASL_OAUTH2_RESP: 572 /* The continuation is optional so check the response code */ 573 if(code == sasl->params->finalcode) { 574 /* Final response was received so we are done */ 575 *progress = SASL_DONE; 576 state(sasl, conn, SASL_STOP); 577 return result; 578 } 579 else if(code == sasl->params->contcode) { 580 /* Acknowledge the continuation by sending a 0x01 response base64 581 encoded */ 582 resp = strdup("AQ=="); 583 if(!resp) 584 result = CURLE_OUT_OF_MEMORY; 585 break; 586 } 587 else { 588 *progress = SASL_DONE; 589 state(sasl, conn, SASL_STOP); 590 return CURLE_LOGIN_DENIED; 591 } 592 593 case SASL_CANCEL: 594 /* Remove the offending mechanism from the supported list */ 595 sasl->authmechs ^= sasl->authused; 596 597 /* Start an alternative SASL authentication */ 598 result = Curl_sasl_start(sasl, conn, sasl->force_ir, progress); 599 newstate = sasl->state; /* Use state from Curl_sasl_start() */ 600 break; 601 default: 602 failf(data, "Unsupported SASL authentication mechanism"); 603 result = CURLE_UNSUPPORTED_PROTOCOL; /* Should not happen */ 604 break; 605 } 606 607 switch(result) { 608 case CURLE_BAD_CONTENT_ENCODING: 609 /* Cancel dialog */ 610 result = sasl->params->sendcont(conn, "*"); 611 newstate = SASL_CANCEL; 612 break; 613 case CURLE_OK: 614 if(resp) 615 result = sasl->params->sendcont(conn, resp); 616 break; 617 default: 618 newstate = SASL_STOP; /* Stop on error */ 619 *progress = SASL_DONE; 620 break; 621 } 622 623 free(resp); 624 625 state(sasl, conn, newstate); 626 627 return result; 628 } 629
