1 /***************************************************************************
3 * Project ___| | | | _ \| |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
8 * Copyright (C) 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at http://curl.haxx.se/docs/copyright.html.
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
21 * RFC2831 DIGEST-MD5 authentication
22 * RFC4422 Simple Authentication and Security Layer (SASL)
24 ***************************************************************************/
26 #include "curl_setup.h"
28 #if defined(USE_WINDOWS_SSPI) && !defined(CURL_DISABLE_CRYPTO_AUTH)
30 #include <curl/curl.h>
32 #include "curl_sasl.h"
34 #include "curl_base64.h"
36 #include "curl_memory.h"
38 #define _MPRINTF_REPLACE /* use our functions only */
39 #include <curl/mprintf.h>
41 /* The last #include file should be: */
45 * Curl_sasl_create_digest_md5_message()
47 * This is used to generate an already encoded DIGEST-MD5 response message
48 * ready for sending to the recipient.
52 * data [in] - The session handle.
53 * chlg64 [in] - Pointer to the base64 encoded challenge message.
54 * userp [in] - The user name.
55 * passdwp [in] - The user's password.
56 * service [in] - The service type such as www, smtp, pop or imap.
57 * outptr [in/out] - The address where a pointer to newly allocated memory
58 * holding the result will be stored upon completion.
59 * outlen [out] - The length of the output message.
61 * Returns CURLE_OK on success.
63 CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
68 char **outptr, size_t *outlen)
70 CURLcode result = CURLE_OK;
73 unsigned char *chlg = NULL;
74 unsigned char resp[1024];
77 PSecPkgInfo SecurityPackage;
78 SEC_WINNT_AUTH_IDENTITY identity;
81 SecBufferDesc chlg_desc;
82 SecBufferDesc resp_desc;
83 SECURITY_STATUS status;
85 TimeStamp tsDummy; /* For Windows 9x compatibility of SSPI calls */
87 /* Decode the base-64 encoded challenge message */
88 if(strlen(chlg64) && *chlg64 != '=') {
89 result = Curl_base64_decode(chlg64, &chlg, &chlglen);
94 /* Ensure we have a valid challenge message */
96 return CURLE_BAD_CONTENT_ENCODING;
98 /* Ensure we have some login credientials as DigestSSP cannot use the current
99 Windows user like NTLMSSP can */
100 if(!userp || !*userp) {
102 return CURLE_LOGIN_DENIED;
105 /* Query the security package for DigestSSP */
106 status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT("WDigest"),
108 if(status != SEC_E_OK) {
110 return CURLE_NOT_BUILT_IN;
113 /* Calculate our SPN */
114 spn = aprintf("%s/%s", service, data->easy_conn->host.name);
116 return CURLE_OUT_OF_MEMORY;
118 /* Populate our identity structure */
119 result = Curl_create_sspi_identity(userp, passwdp, &identity);
127 /* Acquire our credientials handle */
128 status = s_pSecFn->AcquireCredentialsHandle(NULL,
129 (TCHAR *) TEXT("WDigest"),
130 SECPKG_CRED_OUTBOUND, NULL,
131 &identity, NULL, NULL,
134 if(status != SEC_E_OK) {
135 Curl_sspi_free_identity(&identity);
139 return CURLE_OUT_OF_MEMORY;
142 /* Setup the challenge "input" security buffer */
143 chlg_desc.ulVersion = SECBUFFER_VERSION;
144 chlg_desc.cBuffers = 1;
145 chlg_desc.pBuffers = &chlg_buf;
146 chlg_buf.BufferType = SECBUFFER_TOKEN;
147 chlg_buf.pvBuffer = chlg;
148 chlg_buf.cbBuffer = curlx_uztoul(chlglen);
150 /* Setup the response "output" security buffer */
151 resp_desc.ulVersion = SECBUFFER_VERSION;
152 resp_desc.cBuffers = 1;
153 resp_desc.pBuffers = &resp_buf;
154 resp_buf.BufferType = SECBUFFER_TOKEN;
155 resp_buf.pvBuffer = resp;
156 resp_buf.cbBuffer = sizeof(resp);
158 /* Generate our challenge-response message */
159 status = s_pSecFn->InitializeSecurityContext(&handle,
168 if(status == SEC_I_COMPLETE_AND_CONTINUE ||
169 status == SEC_I_CONTINUE_NEEDED)
170 s_pSecFn->CompleteAuthToken(&handle, &resp_desc);
171 else if(status != SEC_E_OK) {
172 s_pSecFn->FreeCredentialsHandle(&handle);
173 Curl_sspi_free_identity(&identity);
177 return CURLE_RECV_ERROR;
180 /* Base64 encode the response */
181 result = Curl_base64_encode(data, (char *)resp, resp_buf.cbBuffer, outptr,
184 /* Free our handles */
185 s_pSecFn->DeleteSecurityContext(&ctx);
186 s_pSecFn->FreeCredentialsHandle(&handle);
188 /* Free the identity structure */
189 Curl_sspi_free_identity(&identity);
194 /* Free the decoeded challenge message */
200 #endif /* USE_WINDOWS_SSPI && !CURL_DISABLE_CRYPTO_AUTH */