1 /***************************************************************************
3 * Project ___| | | | _ \| |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
8 * Copyright (C) 2012 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at https://curl.haxx.se/docs/copyright.html.
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
21 * RFC2195 CRAM-MD5 authentication
22 * RFC2617 Basic and Digest Access Authentication
23 * RFC2831 DIGEST-MD5 authentication
24 * RFC4422 Simple Authentication and Security Layer (SASL)
25 * RFC4616 PLAIN authentication
26 * RFC6749 OAuth 2.0 Authorization Framework
27 * RFC7628 A Set of SASL Mechanisms for OAuth
28 * Draft LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
30 ***************************************************************************/
32 #include "curl_setup.h"
34 #include <curl/curl.h>
37 #include "curl_base64.h"
39 #include "vauth/vauth.h"
40 #include "vtls/vtls.h"
41 #include "curl_hmac.h"
42 #include "curl_sasl.h"
48 #include "non-ascii.h" /* included for Curl_convert_... prototypes */
49 /* The last 3 #include files should be in this order */
50 #include "curl_printf.h"
51 #include "curl_memory.h"
54 /* Supported mechanisms */
56 const char *name; /* Name */
57 size_t len; /* Name length */
58 unsigned int bit; /* Flag bit */
60 { "LOGIN", 5, SASL_MECH_LOGIN },
61 { "PLAIN", 5, SASL_MECH_PLAIN },
62 { "CRAM-MD5", 8, SASL_MECH_CRAM_MD5 },
63 { "DIGEST-MD5", 10, SASL_MECH_DIGEST_MD5 },
64 { "GSSAPI", 6, SASL_MECH_GSSAPI },
65 { "EXTERNAL", 8, SASL_MECH_EXTERNAL },
66 { "NTLM", 4, SASL_MECH_NTLM },
67 { "XOAUTH2", 7, SASL_MECH_XOAUTH2 },
68 { "OAUTHBEARER", 11, SASL_MECH_OAUTHBEARER },
75 * This is used to cleanup any libraries or curl modules used by the sasl
80 * conn [in] - The connection data.
81 * authused [in] - The authentication mechanism used.
83 void Curl_sasl_cleanup(struct connectdata *conn, unsigned int authused)
85 #if defined(USE_KERBEROS5)
86 /* Cleanup the gssapi structure */
87 if(authused == SASL_MECH_GSSAPI) {
88 Curl_auth_gssapi_cleanup(&conn->krb5);
93 /* Cleanup the NTLM structure */
94 if(authused == SASL_MECH_NTLM) {
95 Curl_auth_ntlm_cleanup(&conn->ntlm);
99 #if !defined(USE_KERBEROS5) && !defined(USE_NTLM)
100 /* Reserved for future use */
107 * Curl_sasl_decode_mech()
109 * Convert a SASL mechanism name into a token.
113 * ptr [in] - The mechanism string.
114 * maxlen [in] - Maximum mechanism string length.
115 * len [out] - If not NULL, effective name length.
117 * Returns the SASL mechanism token or 0 if no match.
119 unsigned int Curl_sasl_decode_mech(const char *ptr, size_t maxlen, size_t *len)
124 for(i = 0; mechtable[i].name; i++) {
125 if(maxlen >= mechtable[i].len &&
126 !memcmp(ptr, mechtable[i].name, mechtable[i].len)) {
128 *len = mechtable[i].len;
130 if(maxlen == mechtable[i].len)
131 return mechtable[i].bit;
133 c = ptr[mechtable[i].len];
134 if(!ISUPPER(c) && !ISDIGIT(c) && c != '-' && c != '_')
135 return mechtable[i].bit;
143 * Curl_sasl_parse_url_auth_option()
145 * Parse the URL login options.
147 CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl,
148 const char *value, size_t len)
150 CURLcode result = CURLE_OK;
151 unsigned int mechbit;
155 return CURLE_URL_MALFORMAT;
157 if(sasl->resetprefs) {
158 sasl->resetprefs = FALSE;
159 sasl->prefmech = SASL_AUTH_NONE;
162 if(strnequal(value, "*", len))
163 sasl->prefmech = SASL_AUTH_DEFAULT;
165 mechbit = Curl_sasl_decode_mech(value, len, &mechlen);
166 if(mechbit && mechlen == len)
167 sasl->prefmech |= mechbit;
169 result = CURLE_URL_MALFORMAT;
178 * Initializes the SASL structure.
180 void Curl_sasl_init(struct SASL *sasl, const struct SASLproto *params)
182 sasl->params = params; /* Set protocol dependent parameters */
183 sasl->state = SASL_STOP; /* Not yet running */
184 sasl->authmechs = SASL_AUTH_NONE; /* No known authentication mechanism yet */
185 sasl->prefmech = SASL_AUTH_DEFAULT; /* Prefer all mechanisms */
186 sasl->authused = SASL_AUTH_NONE; /* No the authentication mechanism used */
187 sasl->resetprefs = TRUE; /* Reset prefmech upon AUTH parsing. */
188 sasl->mutual_auth = FALSE; /* No mutual authentication (GSSAPI only) */
189 sasl->force_ir = FALSE; /* Respect external option */
195 * This is the ONLY way to change SASL state!
197 static void state(struct SASL *sasl, struct connectdata *conn,
200 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
201 /* for debug purposes */
202 static const char * const names[]={
223 if(sasl->state != newstate)
224 infof(conn->data, "SASL %p state change from %s to %s\n",
225 (void *)sasl, names[sasl->state], names[newstate]);
230 sasl->state = newstate;
234 * Curl_sasl_can_authenticate()
236 * Check if we have enough auth data and capabilities to authenticate.
238 bool Curl_sasl_can_authenticate(struct SASL *sasl, struct connectdata *conn)
240 /* Have credentials been provided? */
241 if(conn->bits.user_passwd)
244 /* EXTERNAL can authenticate without a user name and/or password */
245 if(sasl->authmechs & sasl->prefmech & SASL_MECH_EXTERNAL)
254 * Calculate the required login details for SASL authentication.
256 CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
257 bool force_ir, saslprogress *progress)
259 CURLcode result = CURLE_OK;
260 struct Curl_easy *data = conn->data;
261 unsigned int enabledmechs;
262 const char *mech = NULL;
265 saslstate state1 = SASL_STOP;
266 saslstate state2 = SASL_FINAL;
267 #if defined(USE_KERBEROS5)
268 const char* service = data->set.str[STRING_SERVICE_NAME] ?
269 data->set.str[STRING_SERVICE_NAME] :
270 sasl->params->service;
273 sasl->force_ir = force_ir; /* Latch for future use */
274 sasl->authused = 0; /* No mechanism used yet */
275 enabledmechs = sasl->authmechs & sasl->prefmech;
276 *progress = SASL_IDLE;
278 /* Calculate the supported authentication mechanism, by decreasing order of
279 security, as well as the initial response where appropriate */
280 if((enabledmechs & SASL_MECH_EXTERNAL) && !conn->passwd[0]) {
281 mech = SASL_MECH_STRING_EXTERNAL;
282 state1 = SASL_EXTERNAL;
283 sasl->authused = SASL_MECH_EXTERNAL;
285 if(force_ir || data->set.sasl_ir)
286 result = Curl_auth_create_external_message(data, conn->user, &resp,
289 else if(conn->bits.user_passwd) {
290 #if defined(USE_KERBEROS5)
291 if((enabledmechs & SASL_MECH_GSSAPI) && Curl_auth_is_gssapi_supported() &&
292 Curl_auth_user_contains_domain(conn->user)) {
293 sasl->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */
294 mech = SASL_MECH_STRING_GSSAPI;
295 state1 = SASL_GSSAPI;
296 state2 = SASL_GSSAPI_TOKEN;
297 sasl->authused = SASL_MECH_GSSAPI;
299 if(force_ir || data->set.sasl_ir)
300 result = Curl_auth_create_gssapi_user_message(data, conn->user,
311 #ifndef CURL_DISABLE_CRYPTO_AUTH
312 if((enabledmechs & SASL_MECH_DIGEST_MD5) &&
313 Curl_auth_is_digest_supported()) {
314 mech = SASL_MECH_STRING_DIGEST_MD5;
315 state1 = SASL_DIGESTMD5;
316 sasl->authused = SASL_MECH_DIGEST_MD5;
318 else if(enabledmechs & SASL_MECH_CRAM_MD5) {
319 mech = SASL_MECH_STRING_CRAM_MD5;
320 state1 = SASL_CRAMMD5;
321 sasl->authused = SASL_MECH_CRAM_MD5;
326 if((enabledmechs & SASL_MECH_NTLM) && Curl_auth_is_ntlm_supported()) {
327 mech = SASL_MECH_STRING_NTLM;
329 state2 = SASL_NTLM_TYPE2MSG;
330 sasl->authused = SASL_MECH_NTLM;
332 if(force_ir || data->set.sasl_ir)
333 result = Curl_auth_create_ntlm_type1_message(conn->user, conn->passwd,
334 &conn->ntlm, &resp, &len);
338 if((enabledmechs & SASL_MECH_OAUTHBEARER) && conn->oauth_bearer) {
339 mech = SASL_MECH_STRING_OAUTHBEARER;
340 state1 = SASL_OAUTH2;
341 state2 = SASL_OAUTH2_RESP;
342 sasl->authused = SASL_MECH_OAUTHBEARER;
344 if(force_ir || data->set.sasl_ir)
345 result = Curl_auth_create_oauth_bearer_message(data, conn->user,
351 else if((enabledmechs & SASL_MECH_XOAUTH2) && conn->oauth_bearer) {
352 mech = SASL_MECH_STRING_XOAUTH2;
353 state1 = SASL_OAUTH2;
354 sasl->authused = SASL_MECH_XOAUTH2;
356 if(force_ir || data->set.sasl_ir)
357 result = Curl_auth_create_oauth_bearer_message(data, conn->user,
362 else if(enabledmechs & SASL_MECH_LOGIN) {
363 mech = SASL_MECH_STRING_LOGIN;
365 state2 = SASL_LOGIN_PASSWD;
366 sasl->authused = SASL_MECH_LOGIN;
368 if(force_ir || data->set.sasl_ir)
369 result = Curl_auth_create_login_message(data, conn->user, &resp, &len);
371 else if(enabledmechs & SASL_MECH_PLAIN) {
372 mech = SASL_MECH_STRING_PLAIN;
374 sasl->authused = SASL_MECH_PLAIN;
376 if(force_ir || data->set.sasl_ir)
377 result = Curl_auth_create_plain_message(data, conn->user, conn->passwd,
382 if(!result && mech) {
383 if(resp && sasl->params->maxirlen &&
384 strlen(mech) + len > sasl->params->maxirlen) {
389 result = sasl->params->sendauth(conn, mech, resp);
391 *progress = SASL_INPROGRESS;
392 state(sasl, conn, resp ? state2 : state1);
402 * Curl_sasl_continue()
404 * Continue the authentication.
406 CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn,
407 int code, saslprogress *progress)
409 CURLcode result = CURLE_OK;
410 struct Curl_easy *data = conn->data;
411 saslstate newstate = SASL_FINAL;
413 #if !defined(CURL_DISABLE_CRYPTO_AUTH)
418 #if !defined(CURL_DISABLE_CRYPTO_AUTH) || defined(USE_KERBEROS5)
419 const char *service = data->set.str[STRING_SERVICE_NAME] ?
420 data->set.str[STRING_SERVICE_NAME] :
421 sasl->params->service;
425 *progress = SASL_INPROGRESS;
427 if(sasl->state == SASL_FINAL) {
428 if(code != sasl->params->finalcode)
429 result = CURLE_LOGIN_DENIED;
430 *progress = SASL_DONE;
431 state(sasl, conn, SASL_STOP);
435 if(sasl->state != SASL_CANCEL && sasl->state != SASL_OAUTH2_RESP &&
436 code != sasl->params->contcode) {
437 *progress = SASL_DONE;
438 state(sasl, conn, SASL_STOP);
439 return CURLE_LOGIN_DENIED;
442 switch(sasl->state) {
444 *progress = SASL_DONE;
447 result = Curl_auth_create_plain_message(data, conn->user, conn->passwd,
452 result = Curl_auth_create_login_message(data, conn->user, &resp, &len);
453 newstate = SASL_LOGIN_PASSWD;
455 case SASL_LOGIN_PASSWD:
456 result = Curl_auth_create_login_message(data, conn->passwd, &resp, &len);
459 result = Curl_auth_create_external_message(data, conn->user, &resp, &len);
462 #ifndef CURL_DISABLE_CRYPTO_AUTH
464 sasl->params->getmessage(data->state.buffer, &serverdata);
465 result = Curl_auth_decode_cram_md5_message(serverdata, &chlg, &chlglen);
467 result = Curl_auth_create_cram_md5_message(data, chlg, conn->user,
468 conn->passwd, &resp, &len);
472 sasl->params->getmessage(data->state.buffer, &serverdata);
473 result = Curl_auth_create_digest_md5_message(data, serverdata,
474 conn->user, conn->passwd,
477 newstate = SASL_DIGESTMD5_RESP;
479 case SASL_DIGESTMD5_RESP:
482 result = CURLE_OUT_OF_MEMORY;
488 /* Create the type-1 message */
489 result = Curl_auth_create_ntlm_type1_message(conn->user, conn->passwd,
490 &conn->ntlm, &resp, &len);
491 newstate = SASL_NTLM_TYPE2MSG;
493 case SASL_NTLM_TYPE2MSG:
494 /* Decode the type-2 message */
495 sasl->params->getmessage(data->state.buffer, &serverdata);
496 result = Curl_auth_decode_ntlm_type2_message(data, serverdata,
499 result = Curl_auth_create_ntlm_type3_message(data, conn->user,
500 conn->passwd, &conn->ntlm,
505 #if defined(USE_KERBEROS5)
507 result = Curl_auth_create_gssapi_user_message(data, conn->user,
510 data->easy_conn->host.name,
511 sasl->mutual_auth, NULL,
514 newstate = SASL_GSSAPI_TOKEN;
516 case SASL_GSSAPI_TOKEN:
517 sasl->params->getmessage(data->state.buffer, &serverdata);
518 if(sasl->mutual_auth) {
519 /* Decode the user token challenge and create the optional response
521 result = Curl_auth_create_gssapi_user_message(data, NULL, NULL,
524 serverdata, &conn->krb5,
526 newstate = SASL_GSSAPI_NO_DATA;
529 /* Decode the security challenge and create the response message */
530 result = Curl_auth_create_gssapi_security_message(data, serverdata,
534 case SASL_GSSAPI_NO_DATA:
535 sasl->params->getmessage(data->state.buffer, &serverdata);
536 /* Decode the security challenge and create the response message */
537 result = Curl_auth_create_gssapi_security_message(data, serverdata,
544 /* Create the authorisation message */
545 if(sasl->authused == SASL_MECH_OAUTHBEARER) {
546 result = Curl_auth_create_oauth_bearer_message(data, conn->user,
552 /* Failures maybe sent by the server as continuations for OAUTHBEARER */
553 newstate = SASL_OAUTH2_RESP;
556 result = Curl_auth_create_oauth_bearer_message(data, conn->user,
562 case SASL_OAUTH2_RESP:
563 /* The continuation is optional so check the response code */
564 if(code == sasl->params->finalcode) {
565 /* Final response was received so we are done */
566 *progress = SASL_DONE;
567 state(sasl, conn, SASL_STOP);
570 else if(code == sasl->params->contcode) {
571 /* Acknowledge the continuation by sending a 0x01 response base64
573 resp = strdup("AQ==");
575 result = CURLE_OUT_OF_MEMORY;
579 *progress = SASL_DONE;
580 state(sasl, conn, SASL_STOP);
581 return CURLE_LOGIN_DENIED;
585 /* Remove the offending mechanism from the supported list */
586 sasl->authmechs ^= sasl->authused;
588 /* Start an alternative SASL authentication */
589 result = Curl_sasl_start(sasl, conn, sasl->force_ir, progress);
590 newstate = sasl->state; /* Use state from Curl_sasl_start() */
593 failf(data, "Unsupported SASL authentication mechanism");
594 result = CURLE_UNSUPPORTED_PROTOCOL; /* Should not happen */
599 case CURLE_BAD_CONTENT_ENCODING:
601 result = sasl->params->sendcont(conn, "*");
602 newstate = SASL_CANCEL;
606 result = sasl->params->sendcont(conn, resp);
609 newstate = SASL_STOP; /* Stop on error */
610 *progress = SASL_DONE;
616 state(sasl, conn, newstate);