digest_sspi.c@ 92350

Last change on this file since 92350 was 85671, checked in by vboxsync, 4 years ago
Export out internal curl copy to make it a lot simpler to build VBox (OSE) on Windows. bugref:9814
Property svn:eol-style set to `native`
File size: 20.2 KB

Line
1	/***************************************************************************
2	* _ _ ____ _
3	* Project ___\| \| \| \| _ \\| \|
4	* / __\| \| \| \| \|_) \| \|
5	* \| (__\| \|_\| \| _ <\| \|___
6	* \___\|\___/\|_\| \_\_____\|
7	*
8	* Copyright (C) 2014 - 2016, Steve Holme, <[email protected]>.
9	* Copyright (C) 2015 - 2019, Daniel Stenberg, <[email protected]>, et al.
10	*
11	* This software is licensed as described in the file COPYING, which
12	* you should have received as part of this distribution. The terms
13	* are also available at https://curl.haxx.se/docs/copyright.html.
14	*
15	* You may opt to use, copy, modify, merge, publish, distribute and/or sell
16	* copies of the Software, and permit persons to whom the Software is
17	* furnished to do so, under the terms of the COPYING file.
18	*
19	* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20	* KIND, either express or implied.
21	*
22	* RFC2831 DIGEST-MD5 authentication
23	*
24	***************************************************************************/
25
26	#include "curl_setup.h"
27
28	#if defined(USE_WINDOWS_SSPI) && !defined(CURL_DISABLE_CRYPTO_AUTH)
29
30	#include <curl/curl.h>
31
32	#include "vauth/vauth.h"
33	#include "vauth/digest.h"
34	#include "urldata.h"
35	#include "curl_base64.h"
36	#include "warnless.h"
37	#include "curl_multibyte.h"
38	#include "sendf.h"
39	#include "strdup.h"
40	#include "strcase.h"
41
42	/* The last #include files should be: */
43	#include "curl_memory.h"
44	#include "memdebug.h"
45
46	/*
47	* Curl_auth_is_digest_supported()
48	*
49	* This is used to evaluate if DIGEST is supported.
50	*
51	* Parameters: None
52	*
53	* Returns TRUE if DIGEST is supported by Windows SSPI.
54	*/
55	bool Curl_auth_is_digest_supported(void)
56	{
57	PSecPkgInfo SecurityPackage;
58	SECURITY_STATUS status;
59
60	/* Query the security package for Digest */
61	status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
62	&SecurityPackage);
63
64	return (status == SEC_E_OK ? TRUE : FALSE);
65	}
66
67	/*
68	* Curl_auth_create_digest_md5_message()
69	*
70	* This is used to generate an already encoded DIGEST-MD5 response message
71	* ready for sending to the recipient.
72	*
73	* Parameters:
74	*
75	* data [in] - The session handle.
76	* chlg64 [in] - The base64 encoded challenge message.
77	* userp [in] - The user name in the format User or Domain\User.
78	* passwdp [in] - The user's password.
79	* service [in] - The service type such as http, smtp, pop or imap.
80	* outptr [in/out] - The address where a pointer to newly allocated memory
81	* holding the result will be stored upon completion.
82	* outlen [out] - The length of the output message.
83	*
84	* Returns CURLE_OK on success.
85	*/
86	CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
87	const char *chlg64,
88	const char *userp,
89	const char *passwdp,
90	const char *service,
91	char *outptr, size_t outlen)
92	{
93	CURLcode result = CURLE_OK;
94	TCHAR *spn = NULL;
95	size_t chlglen = 0;
96	size_t token_max = 0;
97	unsigned char *input_token = NULL;
98	unsigned char *output_token = NULL;
99	CredHandle credentials;
100	CtxtHandle context;
101	PSecPkgInfo SecurityPackage;
102	SEC_WINNT_AUTH_IDENTITY identity;
103	SEC_WINNT_AUTH_IDENTITY *p_identity;
104	SecBuffer chlg_buf;
105	SecBuffer resp_buf;
106	SecBufferDesc chlg_desc;
107	SecBufferDesc resp_desc;
108	SECURITY_STATUS status;
109	unsigned long attrs;
110	TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
111
112	/* Decode the base-64 encoded challenge message */
113	if(strlen(chlg64) && *chlg64 != '=') {
114	result = Curl_base64_decode(chlg64, &input_token, &chlglen);
115	if(result)
116	return result;
117	}
118
119	/* Ensure we have a valid challenge message */
120	if(!input_token) {
121	infof(data, "DIGEST-MD5 handshake failure (empty challenge message)\n");
122
123	return CURLE_BAD_CONTENT_ENCODING;
124	}
125
126	/* Query the security package for DigestSSP */
127	status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
128	&SecurityPackage);
129	if(status != SEC_E_OK) {
130	free(input_token);
131
132	return CURLE_NOT_BUILT_IN;
133	}
134
135	token_max = SecurityPackage->cbMaxToken;
136
137	/* Release the package buffer as it is not required anymore */
138	s_pSecFn->FreeContextBuffer(SecurityPackage);
139
140	/* Allocate our response buffer */
141	output_token = malloc(token_max);
142	if(!output_token) {
143	free(input_token);
144
145	return CURLE_OUT_OF_MEMORY;
146	}
147
148	/* Generate our SPN */
149	spn = Curl_auth_build_spn(service, data->conn->host.name, NULL);
150	if(!spn) {
151	free(output_token);
152	free(input_token);
153
154	return CURLE_OUT_OF_MEMORY;
155	}
156
157	if(userp && *userp) {
158	/* Populate our identity structure */
159	result = Curl_create_sspi_identity(userp, passwdp, &identity);
160	if(result) {
161	free(spn);
162	free(output_token);
163	free(input_token);
164
165	return result;
166	}
167
168	/* Allow proper cleanup of the identity structure */
169	p_identity = &identity;
170	}
171	else
172	/* Use the current Windows user */
173	p_identity = NULL;
174
175	/* Acquire our credentials handle */
176	status = s_pSecFn->AcquireCredentialsHandle(NULL,
177	(TCHAR *) TEXT(SP_NAME_DIGEST),
178	SECPKG_CRED_OUTBOUND, NULL,
179	p_identity, NULL, NULL,
180	&credentials, &expiry);
181
182	if(status != SEC_E_OK) {
183	Curl_sspi_free_identity(p_identity);
184	free(spn);
185	free(output_token);
186	free(input_token);
187
188	return CURLE_LOGIN_DENIED;
189	}
190
191	/* Setup the challenge "input" security buffer */
192	chlg_desc.ulVersion = SECBUFFER_VERSION;
193	chlg_desc.cBuffers = 1;
194	chlg_desc.pBuffers = &chlg_buf;
195	chlg_buf.BufferType = SECBUFFER_TOKEN;
196	chlg_buf.pvBuffer = input_token;
197	chlg_buf.cbBuffer = curlx_uztoul(chlglen);
198
199	/* Setup the response "output" security buffer */
200	resp_desc.ulVersion = SECBUFFER_VERSION;
201	resp_desc.cBuffers = 1;
202	resp_desc.pBuffers = &resp_buf;
203	resp_buf.BufferType = SECBUFFER_TOKEN;
204	resp_buf.pvBuffer = output_token;
205	resp_buf.cbBuffer = curlx_uztoul(token_max);
206
207	/* Generate our response message */
208	status = s_pSecFn->InitializeSecurityContext(&credentials, NULL, spn,
209	0, 0, 0, &chlg_desc, 0,
210	&context, &resp_desc, &attrs,
211	&expiry);
212
213	if(status == SEC_I_COMPLETE_NEEDED \|\|
214	status == SEC_I_COMPLETE_AND_CONTINUE)
215	s_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
216	else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
217	s_pSecFn->FreeCredentialsHandle(&credentials);
218	Curl_sspi_free_identity(p_identity);
219	free(spn);
220	free(output_token);
221	free(input_token);
222
223	return CURLE_RECV_ERROR;
224	}
225
226	/* Base64 encode the response */
227	result = Curl_base64_encode(data, (char *) output_token, resp_buf.cbBuffer,
228	outptr, outlen);
229
230	/* Free our handles */
231	s_pSecFn->DeleteSecurityContext(&context);
232	s_pSecFn->FreeCredentialsHandle(&credentials);
233
234	/* Free the identity structure */
235	Curl_sspi_free_identity(p_identity);
236
237	/* Free the SPN */
238	free(spn);
239
240	/* Free the response buffer */
241	free(output_token);
242
243	/* Free the decoded challenge message */
244	free(input_token);
245
246	return result;
247	}
248
249	/*
250	* Curl_override_sspi_http_realm()
251	*
252	* This is used to populate the domain in a SSPI identity structure
253	* The realm is extracted from the challenge message and used as the
254	* domain if it is not already explicitly set.
255	*
256	* Parameters:
257	*
258	* chlg [in] - The challenge message.
259	* identity [in/out] - The identity structure.
260	*
261	* Returns CURLE_OK on success.
262	*/
263	CURLcode Curl_override_sspi_http_realm(const char *chlg,
264	SEC_WINNT_AUTH_IDENTITY *identity)
265	{
266	xcharp_u domain, dup_domain;
267
268	/* If domain is blank or unset, check challenge message for realm */
269	if(!identity->Domain \|\| !identity->DomainLength) {
270	for(;;) {
271	char value[DIGEST_MAX_VALUE_LENGTH];
272	char content[DIGEST_MAX_CONTENT_LENGTH];
273
274	/* Pass all additional spaces here */
275	while(chlg && ISSPACE(chlg))
276	chlg++;
277
278	/* Extract a value=content pair */
279	if(Curl_auth_digest_get_pair(chlg, value, content, &chlg)) {
280	if(strcasecompare(value, "realm")) {
281
282	/* Setup identity's domain and length */
283	domain.tchar_ptr = Curl_convert_UTF8_to_tchar((char *) content);
284	if(!domain.tchar_ptr)
285	return CURLE_OUT_OF_MEMORY;
286
287	dup_domain.tchar_ptr = _tcsdup(domain.tchar_ptr);
288	if(!dup_domain.tchar_ptr) {
289	Curl_unicodefree(domain.tchar_ptr);
290	return CURLE_OUT_OF_MEMORY;
291	}
292
293	free(identity->Domain);
294	identity->Domain = dup_domain.tbyte_ptr;
295	identity->DomainLength = curlx_uztoul(_tcslen(dup_domain.tchar_ptr));
296	dup_domain.tchar_ptr = NULL;
297
298	Curl_unicodefree(domain.tchar_ptr);
299	}
300	else {
301	/* Unknown specifier, ignore it! */
302	}
303	}
304	else
305	break; /* We're done here */
306
307	/* Pass all additional spaces here */
308	while(chlg && ISSPACE(chlg))
309	chlg++;
310
311	/* Allow the list to be comma-separated */
312	if(',' == *chlg)
313	chlg++;
314	}
315	}
316
317	return CURLE_OK;
318	}
319
320	/*
321	* Curl_auth_decode_digest_http_message()
322	*
323	* This is used to decode a HTTP DIGEST challenge message into the separate
324	* attributes.
325	*
326	* Parameters:
327	*
328	* chlg [in] - The challenge message.
329	* digest [in/out] - The digest data struct being used and modified.
330	*
331	* Returns CURLE_OK on success.
332	*/
333	CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
334	struct digestdata *digest)
335	{
336	size_t chlglen = strlen(chlg);
337
338	/* We had an input token before so if there's another one now that means we
339	provided bad credentials in the previous request or it's stale. */
340	if(digest->input_token) {
341	bool stale = false;
342	const char *p = chlg;
343
344	/* Check for the 'stale' directive */
345	for(;;) {
346	char value[DIGEST_MAX_VALUE_LENGTH];
347	char content[DIGEST_MAX_CONTENT_LENGTH];
348
349	while(p && ISSPACE(p))
350	p++;
351
352	if(!Curl_auth_digest_get_pair(p, value, content, &p))
353	break;
354
355	if(strcasecompare(value, "stale") &&
356	strcasecompare(content, "true")) {
357	stale = true;
358	break;
359	}
360
361	while(p && ISSPACE(p))
362	p++;
363
364	if(',' == *p)
365	p++;
366	}
367
368	if(stale)
369	Curl_auth_digest_cleanup(digest);
370	else
371	return CURLE_LOGIN_DENIED;
372	}
373
374	/* Store the challenge for use later */
375	digest->input_token = (BYTE *) Curl_memdup(chlg, chlglen + 1);
376	if(!digest->input_token)
377	return CURLE_OUT_OF_MEMORY;
378
379	digest->input_token_len = chlglen;
380
381	return CURLE_OK;
382	}
383
384	/*
385	* Curl_auth_create_digest_http_message()
386	*
387	* This is used to generate a HTTP DIGEST response message ready for sending
388	* to the recipient.
389	*
390	* Parameters:
391	*
392	* data [in] - The session handle.
393	* userp [in] - The user name in the format User or Domain\User.
394	* passwdp [in] - The user's password.
395	* request [in] - The HTTP request.
396	* uripath [in] - The path of the HTTP uri.
397	* digest [in/out] - The digest data struct being used and modified.
398	* outptr [in/out] - The address where a pointer to newly allocated memory
399	* holding the result will be stored upon completion.
400	* outlen [out] - The length of the output message.
401	*
402	* Returns CURLE_OK on success.
403	*/
404	CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
405	const char *userp,
406	const char *passwdp,
407	const unsigned char *request,
408	const unsigned char *uripath,
409	struct digestdata *digest,
410	char *outptr, size_t outlen)
411	{
412	size_t token_max;
413	char *resp;
414	BYTE *output_token;
415	size_t output_token_len = 0;
416	PSecPkgInfo SecurityPackage;
417	SecBuffer chlg_buf[5];
418	SecBufferDesc chlg_desc;
419	SECURITY_STATUS status;
420
421	(void) data;
422
423	/* Query the security package for DigestSSP */
424	status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
425	&SecurityPackage);
426	if(status != SEC_E_OK)
427	return CURLE_NOT_BUILT_IN;
428
429	token_max = SecurityPackage->cbMaxToken;
430
431	/* Release the package buffer as it is not required anymore */
432	s_pSecFn->FreeContextBuffer(SecurityPackage);
433
434	/* Allocate the output buffer according to the max token size as indicated
435	by the security package */
436	output_token = malloc(token_max);
437	if(!output_token) {
438	return CURLE_OUT_OF_MEMORY;
439	}
440
441	/* If the user/passwd that was used to make the identity for http_context
442	has changed then delete that context. */
443	if((userp && !digest->user) \|\| (!userp && digest->user) \|\|
444	(passwdp && !digest->passwd) \|\| (!passwdp && digest->passwd) \|\|
445	(userp && digest->user && strcmp(userp, digest->user)) \|\|
446	(passwdp && digest->passwd && strcmp(passwdp, digest->passwd))) {
447	if(digest->http_context) {
448	s_pSecFn->DeleteSecurityContext(digest->http_context);
449	Curl_safefree(digest->http_context);
450	}
451	Curl_safefree(digest->user);
452	Curl_safefree(digest->passwd);
453	}
454
455	if(digest->http_context) {
456	chlg_desc.ulVersion = SECBUFFER_VERSION;
457	chlg_desc.cBuffers = 5;
458	chlg_desc.pBuffers = chlg_buf;
459	chlg_buf[0].BufferType = SECBUFFER_TOKEN;
460	chlg_buf[0].pvBuffer = NULL;
461	chlg_buf[0].cbBuffer = 0;
462	chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;
463	chlg_buf[1].pvBuffer = (void *) request;
464	chlg_buf[1].cbBuffer = curlx_uztoul(strlen((const char *) request));
465	chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;
466	chlg_buf[2].pvBuffer = (void *) uripath;
467	chlg_buf[2].cbBuffer = curlx_uztoul(strlen((const char *) uripath));
468	chlg_buf[3].BufferType = SECBUFFER_PKG_PARAMS;
469	chlg_buf[3].pvBuffer = NULL;
470	chlg_buf[3].cbBuffer = 0;
471	chlg_buf[4].BufferType = SECBUFFER_PADDING;
472	chlg_buf[4].pvBuffer = output_token;
473	chlg_buf[4].cbBuffer = curlx_uztoul(token_max);
474
475	status = s_pSecFn->MakeSignature(digest->http_context, 0, &chlg_desc, 0);
476	if(status == SEC_E_OK)
477	output_token_len = chlg_buf[4].cbBuffer;
478	else { /* delete the context so a new one can be made */
479	infof(data, "digest_sspi: MakeSignature failed, error 0x%08lx\n",
480	(long)status);
481	s_pSecFn->DeleteSecurityContext(digest->http_context);
482	Curl_safefree(digest->http_context);
483	}
484	}
485
486	if(!digest->http_context) {
487	CredHandle credentials;
488	SEC_WINNT_AUTH_IDENTITY identity;
489	SEC_WINNT_AUTH_IDENTITY *p_identity;
490	SecBuffer resp_buf;
491	SecBufferDesc resp_desc;
492	unsigned long attrs;
493	TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
494	TCHAR *spn;
495
496	/* free the copy of user/passwd used to make the previous identity */
497	Curl_safefree(digest->user);
498	Curl_safefree(digest->passwd);
499
500	if(userp && *userp) {
501	/* Populate our identity structure */
502	if(Curl_create_sspi_identity(userp, passwdp, &identity)) {
503	free(output_token);
504	return CURLE_OUT_OF_MEMORY;
505	}
506
507	/* Populate our identity domain */
508	if(Curl_override_sspi_http_realm((const char *) digest->input_token,
509	&identity)) {
510	free(output_token);
511	return CURLE_OUT_OF_MEMORY;
512	}
513
514	/* Allow proper cleanup of the identity structure */
515	p_identity = &identity;
516	}
517	else
518	/* Use the current Windows user */
519	p_identity = NULL;
520
521	if(userp) {
522	digest->user = strdup(userp);
523
524	if(!digest->user) {
525	free(output_token);
526	return CURLE_OUT_OF_MEMORY;
527	}
528	}
529
530	if(passwdp) {
531	digest->passwd = strdup(passwdp);
532
533	if(!digest->passwd) {
534	free(output_token);
535	Curl_safefree(digest->user);
536	return CURLE_OUT_OF_MEMORY;
537	}
538	}
539
540	/* Acquire our credentials handle */
541	status = s_pSecFn->AcquireCredentialsHandle(NULL,
542	(TCHAR *) TEXT(SP_NAME_DIGEST),
543	SECPKG_CRED_OUTBOUND, NULL,
544	p_identity, NULL, NULL,
545	&credentials, &expiry);
546	if(status != SEC_E_OK) {
547	Curl_sspi_free_identity(p_identity);
548	free(output_token);
549
550	return CURLE_LOGIN_DENIED;
551	}
552
553	/* Setup the challenge "input" security buffer if present */
554	chlg_desc.ulVersion = SECBUFFER_VERSION;
555	chlg_desc.cBuffers = 3;
556	chlg_desc.pBuffers = chlg_buf;
557	chlg_buf[0].BufferType = SECBUFFER_TOKEN;
558	chlg_buf[0].pvBuffer = digest->input_token;
559	chlg_buf[0].cbBuffer = curlx_uztoul(digest->input_token_len);
560	chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;
561	chlg_buf[1].pvBuffer = (void *) request;
562	chlg_buf[1].cbBuffer = curlx_uztoul(strlen((const char *) request));
563	chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;
564	chlg_buf[2].pvBuffer = NULL;
565	chlg_buf[2].cbBuffer = 0;
566
567	/* Setup the response "output" security buffer */
568	resp_desc.ulVersion = SECBUFFER_VERSION;
569	resp_desc.cBuffers = 1;
570	resp_desc.pBuffers = &resp_buf;
571	resp_buf.BufferType = SECBUFFER_TOKEN;
572	resp_buf.pvBuffer = output_token;
573	resp_buf.cbBuffer = curlx_uztoul(token_max);
574
575	spn = Curl_convert_UTF8_to_tchar((char *) uripath);
576	if(!spn) {
577	s_pSecFn->FreeCredentialsHandle(&credentials);
578
579	Curl_sspi_free_identity(p_identity);
580	free(output_token);
581
582	return CURLE_OUT_OF_MEMORY;
583	}
584
585	/* Allocate our new context handle */
586	digest->http_context = calloc(1, sizeof(CtxtHandle));
587	if(!digest->http_context)
588	return CURLE_OUT_OF_MEMORY;
589
590	/* Generate our response message */
591	status = s_pSecFn->InitializeSecurityContext(&credentials, NULL,
592	spn,
593	ISC_REQ_USE_HTTP_STYLE, 0, 0,
594	&chlg_desc, 0,
595	digest->http_context,
596	&resp_desc, &attrs, &expiry);
597	Curl_unicodefree(spn);
598
599	if(status == SEC_I_COMPLETE_NEEDED \|\|
600	status == SEC_I_COMPLETE_AND_CONTINUE)
601	s_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
602	else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
603	s_pSecFn->FreeCredentialsHandle(&credentials);
604
605	Curl_sspi_free_identity(p_identity);
606	free(output_token);
607
608	Curl_safefree(digest->http_context);
609
610	return CURLE_OUT_OF_MEMORY;
611	}
612
613	output_token_len = resp_buf.cbBuffer;
614
615	s_pSecFn->FreeCredentialsHandle(&credentials);
616	Curl_sspi_free_identity(p_identity);
617	}
618
619	resp = malloc(output_token_len + 1);
620	if(!resp) {
621	free(output_token);
622
623	return CURLE_OUT_OF_MEMORY;
624	}
625
626	/* Copy the generated response */
627	memcpy(resp, output_token, output_token_len);
628	resp[output_token_len] = 0;
629
630	/* Return the response */
631	*outptr = resp;
632	*outlen = output_token_len;
633
634	/* Free the response buffer */
635	free(output_token);
636
637	return CURLE_OK;
638	}
639
640	/*
641	* Curl_auth_digest_cleanup()
642	*
643	* This is used to clean up the digest specific data.
644	*
645	* Parameters:
646	*
647	* digest [in/out] - The digest data struct being cleaned up.
648	*
649	*/
650	void Curl_auth_digest_cleanup(struct digestdata *digest)
651	{
652	/* Free the input token */
653	Curl_safefree(digest->input_token);
654
655	/* Reset any variables */
656	digest->input_token_len = 0;
657
658	/* Delete security context */
659	if(digest->http_context) {
660	s_pSecFn->DeleteSecurityContext(digest->http_context);
661	Curl_safefree(digest->http_context);
662	}
663
664	/* Free the copy of user/passwd used to make the identity for http_context */
665	Curl_safefree(digest->user);
666	Curl_safefree(digest->passwd);
667	}
668
669	#endif /* USE_WINDOWS_SSPI && !CURL_DISABLE_CRYPTO_AUTH */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/curl-7.64.0/lib/vauth/digest_sspi.c@ 92350

Download in other formats: