1/***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) 2012 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
9 *
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at https://curl.haxx.se/docs/copyright.html.
13 *
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
17 *
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
20 *
21 * RFC2195 CRAM-MD5 authentication
22 * RFC2617 Basic and Digest Access Authentication
23 * RFC2831 DIGEST-MD5 authentication
24 * RFC4422 Simple Authentication and Security Layer (SASL)
25 * RFC4616 PLAIN authentication
26 * RFC6749 OAuth 2.0 Authorization Framework
27 * RFC7628 A Set of SASL Mechanisms for OAuth
28 * Draft LOGIN SASL Mechanism <draft-murchison-sasl-login-00.txt>
29 *
30 ***************************************************************************/
31
32#include "curl_setup.h"
33
34#if !defined(CURL_DISABLE_IMAP) || !defined(CURL_DISABLE_SMTP) || \
35 !defined(CURL_DISABLE_POP3)
36
37#include <curl/curl.h>
38#include "urldata.h"
39
40#include "curl_base64.h"
41#include "curl_md5.h"
42#include "vauth/vauth.h"
43#include "vtls/vtls.h"
44#include "curl_hmac.h"
45#include "curl_sasl.h"
46#include "warnless.h"
47#include "strtok.h"
48#include "sendf.h"
49#include "non-ascii.h" /* included for Curl_convert_... prototypes */
50/* The last 3 #include files should be in this order */
51#include "curl_printf.h"
52#include "curl_memory.h"
53#include "memdebug.h"
54
55/* Supported mechanisms */
56static const struct {
57 const char *name; /* Name */
58 size_t len; /* Name length */
59 unsigned int bit; /* Flag bit */
60} mechtable[] = {
61 { "LOGIN", 5, SASL_MECH_LOGIN },
62 { "PLAIN", 5, SASL_MECH_PLAIN },
63 { "CRAM-MD5", 8, SASL_MECH_CRAM_MD5 },
64 { "DIGEST-MD5", 10, SASL_MECH_DIGEST_MD5 },
65 { "GSSAPI", 6, SASL_MECH_GSSAPI },
66 { "EXTERNAL", 8, SASL_MECH_EXTERNAL },
67 { "NTLM", 4, SASL_MECH_NTLM },
68 { "XOAUTH2", 7, SASL_MECH_XOAUTH2 },
69 { "OAUTHBEARER", 11, SASL_MECH_OAUTHBEARER },
70 { ZERO_NULL, 0, 0 }
71};
72
73/*
74 * Curl_sasl_cleanup()
75 *
76 * This is used to cleanup any libraries or curl modules used by the sasl
77 * functions.
78 *
79 * Parameters:
80 *
81 * conn [in] - The connection data.
82 * authused [in] - The authentication mechanism used.
83 */
84void Curl_sasl_cleanup(struct connectdata *conn, unsigned int authused)
85{
86#if defined(USE_KERBEROS5)
87 /* Cleanup the gssapi structure */
88 if(authused == SASL_MECH_GSSAPI) {
89 Curl_auth_cleanup_gssapi(&conn->krb5);
90 }
91#endif
92
93#if defined(USE_NTLM)
94 /* Cleanup the NTLM structure */
95 if(authused == SASL_MECH_NTLM) {
96 Curl_auth_cleanup_ntlm(&conn->ntlm);
97 }
98#endif
99
100#if !defined(USE_KERBEROS5) && !defined(USE_NTLM)
101 /* Reserved for future use */
102 (void)conn;
103 (void)authused;
104#endif
105}
106
107/*
108 * Curl_sasl_decode_mech()
109 *
110 * Convert a SASL mechanism name into a token.
111 *
112 * Parameters:
113 *
114 * ptr [in] - The mechanism string.
115 * maxlen [in] - Maximum mechanism string length.
116 * len [out] - If not NULL, effective name length.
117 *
118 * Returns the SASL mechanism token or 0 if no match.
119 */
120unsigned int Curl_sasl_decode_mech(const char *ptr, size_t maxlen, size_t *len)
121{
122 unsigned int i;
123 char c;
124
125 for(i = 0; mechtable[i].name; i++) {
126 if(maxlen >= mechtable[i].len &&
127 !memcmp(ptr, mechtable[i].name, mechtable[i].len)) {
128 if(len)
129 *len = mechtable[i].len;
130
131 if(maxlen == mechtable[i].len)
132 return mechtable[i].bit;
133
134 c = ptr[mechtable[i].len];
135 if(!ISUPPER(c) && !ISDIGIT(c) && c != '-' && c != '_')
136 return mechtable[i].bit;
137 }
138 }
139
140 return 0;
141}
142
143/*
144 * Curl_sasl_parse_url_auth_option()
145 *
146 * Parse the URL login options.
147 */
148CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl,
149 const char *value, size_t len)
150{
151 CURLcode result = CURLE_OK;
152 size_t mechlen;
153
154 if(!len)
155 return CURLE_URL_MALFORMAT;
156
157 if(sasl->resetprefs) {
158 sasl->resetprefs = FALSE;
159 sasl->prefmech = SASL_AUTH_NONE;
160 }
161
162 if(!strncmp(value, "*", len))
163 sasl->prefmech = SASL_AUTH_DEFAULT;
164 else {
165 unsigned int mechbit = Curl_sasl_decode_mech(value, len, &mechlen);
166 if(mechbit && mechlen == len)
167 sasl->prefmech |= mechbit;
168 else
169 result = CURLE_URL_MALFORMAT;
170 }
171
172 return result;
173}
174
175/*
176 * Curl_sasl_init()
177 *
178 * Initializes the SASL structure.
179 */
180void Curl_sasl_init(struct SASL *sasl, const struct SASLproto *params)
181{
182 sasl->params = params; /* Set protocol dependent parameters */
183 sasl->state = SASL_STOP; /* Not yet running */
184 sasl->authmechs = SASL_AUTH_NONE; /* No known authentication mechanism yet */
185 sasl->prefmech = SASL_AUTH_DEFAULT; /* Prefer all mechanisms */
186 sasl->authused = SASL_AUTH_NONE; /* No the authentication mechanism used */
187 sasl->resetprefs = TRUE; /* Reset prefmech upon AUTH parsing. */
188 sasl->mutual_auth = FALSE; /* No mutual authentication (GSSAPI only) */
189 sasl->force_ir = FALSE; /* Respect external option */
190}
191
192/*
193 * state()
194 *
195 * This is the ONLY way to change SASL state!
196 */
197static void state(struct SASL *sasl, struct connectdata *conn,
198 saslstate newstate)
199{
200#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
201 /* for debug purposes */
202 static const char * const names[]={
203 "STOP",
204 "PLAIN",
205 "LOGIN",
206 "LOGIN_PASSWD",
207 "EXTERNAL",
208 "CRAMMD5",
209 "DIGESTMD5",
210 "DIGESTMD5_RESP",
211 "NTLM",
212 "NTLM_TYPE2MSG",
213 "GSSAPI",
214 "GSSAPI_TOKEN",
215 "GSSAPI_NO_DATA",
216 "OAUTH2",
217 "OAUTH2_RESP",
218 "CANCEL",
219 "FINAL",
220 /* LAST */
221 };
222
223 if(sasl->state != newstate)
224 infof(conn->data, "SASL %p state change from %s to %s\n",
225 (void *)sasl, names[sasl->state], names[newstate]);
226#else
227 (void) conn;
228#endif
229
230 sasl->state = newstate;
231}
232
233/*
234 * Curl_sasl_can_authenticate()
235 *
236 * Check if we have enough auth data and capabilities to authenticate.
237 */
238bool Curl_sasl_can_authenticate(struct SASL *sasl, struct connectdata *conn)
239{
240 /* Have credentials been provided? */
241 if(conn->bits.user_passwd)
242 return TRUE;
243
244 /* EXTERNAL can authenticate without a user name and/or password */
245 if(sasl->authmechs & sasl->prefmech & SASL_MECH_EXTERNAL)
246 return TRUE;
247
248 return FALSE;
249}
250
251/*
252 * Curl_sasl_start()
253 *
254 * Calculate the required login details for SASL authentication.
255 */
256CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
257 bool force_ir, saslprogress *progress)
258{
259 CURLcode result = CURLE_OK;
260 struct Curl_easy *data = conn->data;
261 unsigned int enabledmechs;
262 const char *mech = NULL;
263 char *resp = NULL;
264 size_t len = 0;
265 saslstate state1 = SASL_STOP;
266 saslstate state2 = SASL_FINAL;
267 const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
268 conn->host.name;
269 const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port;
270#if defined(USE_KERBEROS5) || defined(USE_NTLM)
271 const char *service = data->set.str[STRING_SERVICE_NAME] ?
272 data->set.str[STRING_SERVICE_NAME] :
273 sasl->params->service;
274#endif
275
276 sasl->force_ir = force_ir; /* Latch for future use */
277 sasl->authused = 0; /* No mechanism used yet */
278 enabledmechs = sasl->authmechs & sasl->prefmech;
279 *progress = SASL_IDLE;
280
281 /* Calculate the supported authentication mechanism, by decreasing order of
282 security, as well as the initial response where appropriate */
283 if((enabledmechs & SASL_MECH_EXTERNAL) && !conn->passwd[0]) {
284 mech = SASL_MECH_STRING_EXTERNAL;
285 state1 = SASL_EXTERNAL;
286 sasl->authused = SASL_MECH_EXTERNAL;
287
288 if(force_ir || data->set.sasl_ir)
289 result = Curl_auth_create_external_message(data, conn->user, &resp,
290 &len);
291 }
292 else if(conn->bits.user_passwd) {
293#if defined(USE_KERBEROS5)
294 if((enabledmechs & SASL_MECH_GSSAPI) && Curl_auth_is_gssapi_supported() &&
295 Curl_auth_user_contains_domain(conn->user)) {
296 sasl->mutual_auth = FALSE;
297 mech = SASL_MECH_STRING_GSSAPI;
298 state1 = SASL_GSSAPI;
299 state2 = SASL_GSSAPI_TOKEN;
300 sasl->authused = SASL_MECH_GSSAPI;
301
302 if(force_ir || data->set.sasl_ir)
303 result = Curl_auth_create_gssapi_user_message(data, conn->user,
304 conn->passwd,
305 service,
306 data->conn->host.name,
307 sasl->mutual_auth,
308 NULL, &conn->krb5,
309 &resp, &len);
310 }
311 else
312#endif
313#ifndef CURL_DISABLE_CRYPTO_AUTH
314 if((enabledmechs & SASL_MECH_DIGEST_MD5) &&
315 Curl_auth_is_digest_supported()) {
316 mech = SASL_MECH_STRING_DIGEST_MD5;
317 state1 = SASL_DIGESTMD5;
318 sasl->authused = SASL_MECH_DIGEST_MD5;
319 }
320 else if(enabledmechs & SASL_MECH_CRAM_MD5) {
321 mech = SASL_MECH_STRING_CRAM_MD5;
322 state1 = SASL_CRAMMD5;
323 sasl->authused = SASL_MECH_CRAM_MD5;
324 }
325 else
326#endif
327#ifdef USE_NTLM
328 if((enabledmechs & SASL_MECH_NTLM) && Curl_auth_is_ntlm_supported()) {
329 mech = SASL_MECH_STRING_NTLM;
330 state1 = SASL_NTLM;
331 state2 = SASL_NTLM_TYPE2MSG;
332 sasl->authused = SASL_MECH_NTLM;
333
334 if(force_ir || data->set.sasl_ir)
335 result = Curl_auth_create_ntlm_type1_message(data,
336 conn->user, conn->passwd,
337 service,
338 hostname,
339 &conn->ntlm, &resp,
340 &len);
341 }
342 else
343#endif
344 if((enabledmechs & SASL_MECH_OAUTHBEARER) && conn->oauth_bearer) {
345 mech = SASL_MECH_STRING_OAUTHBEARER;
346 state1 = SASL_OAUTH2;
347 state2 = SASL_OAUTH2_RESP;
348 sasl->authused = SASL_MECH_OAUTHBEARER;
349
350 if(force_ir || data->set.sasl_ir)
351 result = Curl_auth_create_oauth_bearer_message(data, conn->user,
352 hostname,
353 port,
354 conn->oauth_bearer,
355 &resp, &len);
356 }
357 else if((enabledmechs & SASL_MECH_XOAUTH2) && conn->oauth_bearer) {
358 mech = SASL_MECH_STRING_XOAUTH2;
359 state1 = SASL_OAUTH2;
360 sasl->authused = SASL_MECH_XOAUTH2;
361
362 if(force_ir || data->set.sasl_ir)
363 result = Curl_auth_create_xoauth_bearer_message(data, conn->user,
364 conn->oauth_bearer,
365 &resp, &len);
366 }
367 else if(enabledmechs & SASL_MECH_PLAIN) {
368 mech = SASL_MECH_STRING_PLAIN;
369 state1 = SASL_PLAIN;
370 sasl->authused = SASL_MECH_PLAIN;
371
372 if(force_ir || data->set.sasl_ir)
373 result = Curl_auth_create_plain_message(data, conn->sasl_authzid,
374 conn->user, conn->passwd,
375 &resp, &len);
376 }
377 else if(enabledmechs & SASL_MECH_LOGIN) {
378 mech = SASL_MECH_STRING_LOGIN;
379 state1 = SASL_LOGIN;
380 state2 = SASL_LOGIN_PASSWD;
381 sasl->authused = SASL_MECH_LOGIN;
382
383 if(force_ir || data->set.sasl_ir)
384 result = Curl_auth_create_login_message(data, conn->user, &resp, &len);
385 }
386 }
387
388 if(!result && mech) {
389 if(resp && sasl->params->maxirlen &&
390 strlen(mech) + len > sasl->params->maxirlen) {
391 free(resp);
392 resp = NULL;
393 }
394
395 result = sasl->params->sendauth(conn, mech, resp);
396 if(!result) {
397 *progress = SASL_INPROGRESS;
398 state(sasl, conn, resp ? state2 : state1);
399 }
400 }
401
402 free(resp);
403
404 return result;
405}
406
407/*
408 * Curl_sasl_continue()
409 *
410 * Continue the authentication.
411 */
412CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn,
413 int code, saslprogress *progress)
414{
415 CURLcode result = CURLE_OK;
416 struct Curl_easy *data = conn->data;
417 saslstate newstate = SASL_FINAL;
418 char *resp = NULL;
419 const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
420 conn->host.name;
421 const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port;
422#if !defined(CURL_DISABLE_CRYPTO_AUTH)
423 char *chlg = NULL;
424 size_t chlglen = 0;
425#endif
426#if !defined(CURL_DISABLE_CRYPTO_AUTH) || defined(USE_KERBEROS5) || \
427 defined(USE_NTLM)
428 const char *service = data->set.str[STRING_SERVICE_NAME] ?
429 data->set.str[STRING_SERVICE_NAME] :
430 sasl->params->service;
431 char *serverdata;
432#endif
433 size_t len = 0;
434
435 *progress = SASL_INPROGRESS;
436
437 if(sasl->state == SASL_FINAL) {
438 if(code != sasl->params->finalcode)
439 result = CURLE_LOGIN_DENIED;
440 *progress = SASL_DONE;
441 state(sasl, conn, SASL_STOP);
442 return result;
443 }
444
445 if(sasl->state != SASL_CANCEL && sasl->state != SASL_OAUTH2_RESP &&
446 code != sasl->params->contcode) {
447 *progress = SASL_DONE;
448 state(sasl, conn, SASL_STOP);
449 return CURLE_LOGIN_DENIED;
450 }
451
452 switch(sasl->state) {
453 case SASL_STOP:
454 *progress = SASL_DONE;
455 return result;
456 case SASL_PLAIN:
457 result = Curl_auth_create_plain_message(data, conn->sasl_authzid,
458 conn->user, conn->passwd,
459 &resp, &len);
460 break;
461 case SASL_LOGIN:
462 result = Curl_auth_create_login_message(data, conn->user, &resp, &len);
463 newstate = SASL_LOGIN_PASSWD;
464 break;
465 case SASL_LOGIN_PASSWD:
466 result = Curl_auth_create_login_message(data, conn->passwd, &resp, &len);
467 break;
468 case SASL_EXTERNAL:
469 result = Curl_auth_create_external_message(data, conn->user, &resp, &len);
470 break;
471
472#ifndef CURL_DISABLE_CRYPTO_AUTH
473 case SASL_CRAMMD5:
474 sasl->params->getmessage(data->state.buffer, &serverdata);
475 result = Curl_auth_decode_cram_md5_message(serverdata, &chlg, &chlglen);
476 if(!result)
477 result = Curl_auth_create_cram_md5_message(data, chlg, conn->user,
478 conn->passwd, &resp, &len);
479 free(chlg);
480 break;
481 case SASL_DIGESTMD5:
482 sasl->params->getmessage(data->state.buffer, &serverdata);
483 result = Curl_auth_create_digest_md5_message(data, serverdata,
484 conn->user, conn->passwd,
485 service,
486 &resp, &len);
487 newstate = SASL_DIGESTMD5_RESP;
488 break;
489 case SASL_DIGESTMD5_RESP:
490 resp = strdup("");
491 if(!resp)
492 result = CURLE_OUT_OF_MEMORY;
493 break;
494#endif
495
496#ifdef USE_NTLM
497 case SASL_NTLM:
498 /* Create the type-1 message */
499 result = Curl_auth_create_ntlm_type1_message(data,
500 conn->user, conn->passwd,
501 service, hostname,
502 &conn->ntlm, &resp, &len);
503 newstate = SASL_NTLM_TYPE2MSG;
504 break;
505 case SASL_NTLM_TYPE2MSG:
506 /* Decode the type-2 message */
507 sasl->params->getmessage(data->state.buffer, &serverdata);
508 result = Curl_auth_decode_ntlm_type2_message(data, serverdata,
509 &conn->ntlm);
510 if(!result)
511 result = Curl_auth_create_ntlm_type3_message(data, conn->user,
512 conn->passwd, &conn->ntlm,
513 &resp, &len);
514 break;
515#endif
516
517#if defined(USE_KERBEROS5)
518 case SASL_GSSAPI:
519 result = Curl_auth_create_gssapi_user_message(data, conn->user,
520 conn->passwd,
521 service,
522 data->conn->host.name,
523 sasl->mutual_auth, NULL,
524 &conn->krb5,
525 &resp, &len);
526 newstate = SASL_GSSAPI_TOKEN;
527 break;
528 case SASL_GSSAPI_TOKEN:
529 sasl->params->getmessage(data->state.buffer, &serverdata);
530 if(sasl->mutual_auth) {
531 /* Decode the user token challenge and create the optional response
532 message */
533 result = Curl_auth_create_gssapi_user_message(data, NULL, NULL,
534 NULL, NULL,
535 sasl->mutual_auth,
536 serverdata, &conn->krb5,
537 &resp, &len);
538 newstate = SASL_GSSAPI_NO_DATA;
539 }
540 else
541 /* Decode the security challenge and create the response message */
542 result = Curl_auth_create_gssapi_security_message(data, serverdata,
543 &conn->krb5,
544 &resp, &len);
545 break;
546 case SASL_GSSAPI_NO_DATA:
547 sasl->params->getmessage(data->state.buffer, &serverdata);
548 /* Decode the security challenge and create the response message */
549 result = Curl_auth_create_gssapi_security_message(data, serverdata,
550 &conn->krb5,
551 &resp, &len);
552 break;
553#endif
554
555 case SASL_OAUTH2:
556 /* Create the authorisation message */
557 if(sasl->authused == SASL_MECH_OAUTHBEARER) {
558 result = Curl_auth_create_oauth_bearer_message(data, conn->user,
559 hostname,
560 port,
561 conn->oauth_bearer,
562 &resp, &len);
563
564 /* Failures maybe sent by the server as continuations for OAUTHBEARER */
565 newstate = SASL_OAUTH2_RESP;
566 }
567 else
568 result = Curl_auth_create_xoauth_bearer_message(data, conn->user,
569 conn->oauth_bearer,
570 &resp, &len);
571 break;
572
573 case SASL_OAUTH2_RESP:
574 /* The continuation is optional so check the response code */
575 if(code == sasl->params->finalcode) {
576 /* Final response was received so we are done */
577 *progress = SASL_DONE;
578 state(sasl, conn, SASL_STOP);
579 return result;
580 }
581 else if(code == sasl->params->contcode) {
582 /* Acknowledge the continuation by sending a 0x01 response base64
583 encoded */
584 resp = strdup("AQ==");
585 if(!resp)
586 result = CURLE_OUT_OF_MEMORY;
587 break;
588 }
589 else {
590 *progress = SASL_DONE;
591 state(sasl, conn, SASL_STOP);
592 return CURLE_LOGIN_DENIED;
593 }
594
595 case SASL_CANCEL:
596 /* Remove the offending mechanism from the supported list */
597 sasl->authmechs ^= sasl->authused;
598
599 /* Start an alternative SASL authentication */
600 result = Curl_sasl_start(sasl, conn, sasl->force_ir, progress);
601 newstate = sasl->state; /* Use state from Curl_sasl_start() */
602 break;
603 default:
604 failf(data, "Unsupported SASL authentication mechanism");
605 result = CURLE_UNSUPPORTED_PROTOCOL; /* Should not happen */
606 break;
607 }
608
609 switch(result) {
610 case CURLE_BAD_CONTENT_ENCODING:
611 /* Cancel dialog */
612 result = sasl->params->sendcont(conn, "*");
613 newstate = SASL_CANCEL;
614 break;
615 case CURLE_OK:
616 if(resp)
617 result = sasl->params->sendcont(conn, resp);
618 break;
619 default:
620 newstate = SASL_STOP; /* Stop on error */
621 *progress = SASL_DONE;
622 break;
623 }
624
625 free(resp);
626
627 state(sasl, conn, newstate);
628
629 return result;
630}
631#endif /* protocols are enabled that use SASL */
632