17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * Copyright 2003 Sun Microsystems, Inc. All rights reserved.
37c478bd9Sstevel@tonic-gate * Use is subject to license terms.
47c478bd9Sstevel@tonic-gate */
57c478bd9Sstevel@tonic-gate
67c478bd9Sstevel@tonic-gate /* CRAM-MD5 SASL plugin
77c478bd9Sstevel@tonic-gate * Rob Siemborski
8*1da57d55SToomas Soome * Tim Martin
97c478bd9Sstevel@tonic-gate * $Id: cram.c,v 1.79 2003/02/18 18:27:37 rjs3 Exp $
107c478bd9Sstevel@tonic-gate */
11*1da57d55SToomas Soome /*
127c478bd9Sstevel@tonic-gate * Copyright (c) 1998-2003 Carnegie Mellon University. All rights reserved.
137c478bd9Sstevel@tonic-gate *
147c478bd9Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
157c478bd9Sstevel@tonic-gate * modification, are permitted provided that the following conditions
167c478bd9Sstevel@tonic-gate * are met:
177c478bd9Sstevel@tonic-gate *
187c478bd9Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
19*1da57d55SToomas Soome * notice, this list of conditions and the following disclaimer.
207c478bd9Sstevel@tonic-gate *
217c478bd9Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
227c478bd9Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in
237c478bd9Sstevel@tonic-gate * the documentation and/or other materials provided with the
247c478bd9Sstevel@tonic-gate * distribution.
257c478bd9Sstevel@tonic-gate *
267c478bd9Sstevel@tonic-gate * 3. The name "Carnegie Mellon University" must not be used to
277c478bd9Sstevel@tonic-gate * endorse or promote products derived from this software without
287c478bd9Sstevel@tonic-gate * prior written permission. For permission or any other legal
29*1da57d55SToomas Soome * details, please contact
307c478bd9Sstevel@tonic-gate * Office of Technology Transfer
317c478bd9Sstevel@tonic-gate * Carnegie Mellon University
327c478bd9Sstevel@tonic-gate * 5000 Forbes Avenue
337c478bd9Sstevel@tonic-gate * Pittsburgh, PA 15213-3890
347c478bd9Sstevel@tonic-gate * (412) 268-4387, fax: (412) 268-7395
357c478bd9Sstevel@tonic-gate * tech-transfer@andrew.cmu.edu
367c478bd9Sstevel@tonic-gate *
377c478bd9Sstevel@tonic-gate * 4. Redistributions of any form whatsoever must retain the following
387c478bd9Sstevel@tonic-gate * acknowledgment:
397c478bd9Sstevel@tonic-gate * "This product includes software developed by Computing Services
407c478bd9Sstevel@tonic-gate * at Carnegie Mellon University (http://www.cmu.edu/computing/)."
417c478bd9Sstevel@tonic-gate *
427c478bd9Sstevel@tonic-gate * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
437c478bd9Sstevel@tonic-gate * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
447c478bd9Sstevel@tonic-gate * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
457c478bd9Sstevel@tonic-gate * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
467c478bd9Sstevel@tonic-gate * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
477c478bd9Sstevel@tonic-gate * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
487c478bd9Sstevel@tonic-gate * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
497c478bd9Sstevel@tonic-gate */
507c478bd9Sstevel@tonic-gate
517c478bd9Sstevel@tonic-gate #include <config.h>
527c478bd9Sstevel@tonic-gate
537c478bd9Sstevel@tonic-gate #include <string.h>
547c478bd9Sstevel@tonic-gate #include <stdlib.h>
557c478bd9Sstevel@tonic-gate #include <stdio.h>
567c478bd9Sstevel@tonic-gate #ifndef macintosh
577c478bd9Sstevel@tonic-gate #include <sys/stat.h>
587c478bd9Sstevel@tonic-gate #endif
597c478bd9Sstevel@tonic-gate #include <fcntl.h>
607c478bd9Sstevel@tonic-gate
617c478bd9Sstevel@tonic-gate #include <sasl.h>
627c478bd9Sstevel@tonic-gate #include <saslplug.h>
637c478bd9Sstevel@tonic-gate #include <saslutil.h>
647c478bd9Sstevel@tonic-gate
657c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
667c478bd9Sstevel@tonic-gate #include <unistd.h>
677c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
687c478bd9Sstevel@tonic-gate
697c478bd9Sstevel@tonic-gate #include "plugin_common.h"
707c478bd9Sstevel@tonic-gate
717c478bd9Sstevel@tonic-gate #ifdef macintosh
727c478bd9Sstevel@tonic-gate #include <sasl_cram_plugin_decl.h>
737c478bd9Sstevel@tonic-gate #endif
747c478bd9Sstevel@tonic-gate
757c478bd9Sstevel@tonic-gate /***************************** Common Section *****************************/
767c478bd9Sstevel@tonic-gate
777c478bd9Sstevel@tonic-gate #ifndef _SUN_SDK_
787c478bd9Sstevel@tonic-gate static const char plugin_id[] = "$Id: cram.c,v 1.79 2003/02/18 18:27:37 rjs3 Exp $";
797c478bd9Sstevel@tonic-gate #endif /* !_SUN_SDK_ */
807c478bd9Sstevel@tonic-gate
817c478bd9Sstevel@tonic-gate /* convert a string of 8bit chars to it's representation in hex
827c478bd9Sstevel@tonic-gate * using lowercase letters
837c478bd9Sstevel@tonic-gate */
convert16(unsigned char * in,int inlen,const sasl_utils_t * utils)847c478bd9Sstevel@tonic-gate static char *convert16(unsigned char *in, int inlen, const sasl_utils_t *utils)
857c478bd9Sstevel@tonic-gate {
867c478bd9Sstevel@tonic-gate static char hex[]="0123456789abcdef";
877c478bd9Sstevel@tonic-gate int lup;
887c478bd9Sstevel@tonic-gate char *out;
897c478bd9Sstevel@tonic-gate
907c478bd9Sstevel@tonic-gate out = utils->malloc(inlen*2+1);
917c478bd9Sstevel@tonic-gate if (out == NULL) return NULL;
92*1da57d55SToomas Soome
937c478bd9Sstevel@tonic-gate for (lup=0; lup < inlen; lup++) {
947c478bd9Sstevel@tonic-gate out[lup*2] = hex[in[lup] >> 4];
957c478bd9Sstevel@tonic-gate out[lup*2+1] = hex[in[lup] & 15];
967c478bd9Sstevel@tonic-gate }
977c478bd9Sstevel@tonic-gate
987c478bd9Sstevel@tonic-gate out[lup*2] = 0;
997c478bd9Sstevel@tonic-gate return out;
1007c478bd9Sstevel@tonic-gate }
1017c478bd9Sstevel@tonic-gate
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate /***************************** Server Section *****************************/
1047c478bd9Sstevel@tonic-gate
1057c478bd9Sstevel@tonic-gate typedef struct server_context {
1067c478bd9Sstevel@tonic-gate int state;
1077c478bd9Sstevel@tonic-gate
1087c478bd9Sstevel@tonic-gate char *challenge;
1097c478bd9Sstevel@tonic-gate } server_context_t;
1107c478bd9Sstevel@tonic-gate
1117c478bd9Sstevel@tonic-gate static int
crammd5_server_mech_new(void * glob_context,sasl_server_params_t * sparams,const char * challenge,unsigned challen,void ** conn_context)1127c478bd9Sstevel@tonic-gate crammd5_server_mech_new(void *glob_context __attribute__((unused)),
1137c478bd9Sstevel@tonic-gate sasl_server_params_t *sparams,
1147c478bd9Sstevel@tonic-gate const char *challenge __attribute__((unused)),
1157c478bd9Sstevel@tonic-gate unsigned challen __attribute__((unused)),
1167c478bd9Sstevel@tonic-gate void **conn_context)
1177c478bd9Sstevel@tonic-gate {
1187c478bd9Sstevel@tonic-gate server_context_t *text;
119*1da57d55SToomas Soome
1207c478bd9Sstevel@tonic-gate /* holds state are in */
1217c478bd9Sstevel@tonic-gate text = sparams->utils->malloc(sizeof(server_context_t));
1227c478bd9Sstevel@tonic-gate if (text == NULL) {
1237c478bd9Sstevel@tonic-gate MEMERROR( sparams->utils );
1247c478bd9Sstevel@tonic-gate return SASL_NOMEM;
1257c478bd9Sstevel@tonic-gate }
126*1da57d55SToomas Soome
1277c478bd9Sstevel@tonic-gate memset(text, 0, sizeof(server_context_t));
128*1da57d55SToomas Soome
1297c478bd9Sstevel@tonic-gate text->state = 1;
130*1da57d55SToomas Soome
1317c478bd9Sstevel@tonic-gate *conn_context = text;
132*1da57d55SToomas Soome
1337c478bd9Sstevel@tonic-gate return SASL_OK;
1347c478bd9Sstevel@tonic-gate }
1357c478bd9Sstevel@tonic-gate
1367c478bd9Sstevel@tonic-gate /*
1377c478bd9Sstevel@tonic-gate * Returns the current time (or part of it) in string form
1387c478bd9Sstevel@tonic-gate * maximum length=15
1397c478bd9Sstevel@tonic-gate */
gettime(sasl_server_params_t * sparams)1407c478bd9Sstevel@tonic-gate static char *gettime(sasl_server_params_t *sparams)
1417c478bd9Sstevel@tonic-gate {
1427c478bd9Sstevel@tonic-gate char *ret;
1437c478bd9Sstevel@tonic-gate time_t t;
144*1da57d55SToomas Soome
1457c478bd9Sstevel@tonic-gate t=time(NULL);
1467c478bd9Sstevel@tonic-gate ret= sparams->utils->malloc(15);
1477c478bd9Sstevel@tonic-gate if (ret==NULL) return NULL;
148*1da57d55SToomas Soome
1497c478bd9Sstevel@tonic-gate /* the bottom bits are really the only random ones so if
1507c478bd9Sstevel@tonic-gate we overflow we don't want to loose them */
1517c478bd9Sstevel@tonic-gate snprintf(ret,15,"%lu",t%(0xFFFFFF));
152*1da57d55SToomas Soome
1537c478bd9Sstevel@tonic-gate return ret;
1547c478bd9Sstevel@tonic-gate }
1557c478bd9Sstevel@tonic-gate
randomdigits(sasl_server_params_t * sparams)1567c478bd9Sstevel@tonic-gate static char *randomdigits(sasl_server_params_t *sparams)
1577c478bd9Sstevel@tonic-gate {
1587c478bd9Sstevel@tonic-gate unsigned int num;
1597c478bd9Sstevel@tonic-gate char *ret;
1607c478bd9Sstevel@tonic-gate unsigned char temp[5]; /* random 32-bit number */
161*1da57d55SToomas Soome
1627c478bd9Sstevel@tonic-gate #if defined _DEV_URANDOM && defined _SUN_SDK_
1637c478bd9Sstevel@tonic-gate {
1647c478bd9Sstevel@tonic-gate int fd = open(_DEV_URANDOM, O_RDONLY);
1657c478bd9Sstevel@tonic-gate int nread = 0;
1667c478bd9Sstevel@tonic-gate
167*1da57d55SToomas Soome if (fd != -1) {
168*1da57d55SToomas Soome nread = read(fd, temp, 4);
169*1da57d55SToomas Soome close(fd);
170*1da57d55SToomas Soome }
1717c478bd9Sstevel@tonic-gate if (nread != 4)
1727c478bd9Sstevel@tonic-gate sparams->utils->rand(sparams->utils->rpool,
1737c478bd9Sstevel@tonic-gate (char *) temp, 4);
1747c478bd9Sstevel@tonic-gate }
1757c478bd9Sstevel@tonic-gate #else
1767c478bd9Sstevel@tonic-gate sparams->utils->rand(sparams->utils->rpool,(char *) temp,4);
1777c478bd9Sstevel@tonic-gate #endif /* _DEV_URANDOM && _SUN_SDK_ */
1787c478bd9Sstevel@tonic-gate num=(temp[0] * 256 * 256 * 256) +
1797c478bd9Sstevel@tonic-gate (temp[1] * 256 * 256) +
1807c478bd9Sstevel@tonic-gate (temp[2] * 256) +
1817c478bd9Sstevel@tonic-gate (temp[3] );
182*1da57d55SToomas Soome
1837c478bd9Sstevel@tonic-gate ret = sparams->utils->malloc(15); /* there's no way an unsigned can be longer than this right? */
1847c478bd9Sstevel@tonic-gate if (ret == NULL) return NULL;
1857c478bd9Sstevel@tonic-gate sprintf(ret, "%u", num);
186*1da57d55SToomas Soome
1877c478bd9Sstevel@tonic-gate return ret;
1887c478bd9Sstevel@tonic-gate }
1897c478bd9Sstevel@tonic-gate
1907c478bd9Sstevel@tonic-gate static int
crammd5_server_mech_step1(server_context_t * text,sasl_server_params_t * sparams,const char * clientin,unsigned clientinlen,const char ** serverout,unsigned * serveroutlen,sasl_out_params_t * oparams)1917c478bd9Sstevel@tonic-gate crammd5_server_mech_step1(server_context_t *text,
1927c478bd9Sstevel@tonic-gate sasl_server_params_t *sparams,
1937c478bd9Sstevel@tonic-gate const char *clientin __attribute__((unused)),
1947c478bd9Sstevel@tonic-gate unsigned clientinlen,
1957c478bd9Sstevel@tonic-gate const char **serverout,
1967c478bd9Sstevel@tonic-gate unsigned *serveroutlen,
1977c478bd9Sstevel@tonic-gate sasl_out_params_t *oparams __attribute__((unused)))
1987c478bd9Sstevel@tonic-gate {
1997c478bd9Sstevel@tonic-gate char *time, *randdigits;
200*1da57d55SToomas Soome
2017c478bd9Sstevel@tonic-gate /* we shouldn't have received anything */
2027c478bd9Sstevel@tonic-gate if (clientinlen != 0) {
2037c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
2047c478bd9Sstevel@tonic-gate sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR,
2057c478bd9Sstevel@tonic-gate "CRAM-MD5 does not accept inital data");
2067c478bd9Sstevel@tonic-gate #else
2077c478bd9Sstevel@tonic-gate SETERROR(sparams->utils, "CRAM-MD5 does not accpet inital data");
2087c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
2097c478bd9Sstevel@tonic-gate return SASL_BADPROT;
2107c478bd9Sstevel@tonic-gate }
211*1da57d55SToomas Soome
2127c478bd9Sstevel@tonic-gate /* get time and a random number for the nonce */
2137c478bd9Sstevel@tonic-gate time = gettime(sparams);
2147c478bd9Sstevel@tonic-gate randdigits = randomdigits(sparams);
2157c478bd9Sstevel@tonic-gate if ((time == NULL) || (randdigits == NULL)) {
2167c478bd9Sstevel@tonic-gate MEMERROR( sparams->utils );
2177c478bd9Sstevel@tonic-gate return SASL_NOMEM;
2187c478bd9Sstevel@tonic-gate }
219*1da57d55SToomas Soome
2207c478bd9Sstevel@tonic-gate /* allocate some space for the challenge */
2217c478bd9Sstevel@tonic-gate text->challenge = sparams->utils->malloc(200 + 1);
2227c478bd9Sstevel@tonic-gate if (text->challenge == NULL) {
2237c478bd9Sstevel@tonic-gate MEMERROR(sparams->utils);
2247c478bd9Sstevel@tonic-gate return SASL_NOMEM;
2257c478bd9Sstevel@tonic-gate }
226*1da57d55SToomas Soome
2277c478bd9Sstevel@tonic-gate /* create the challenge */
2287c478bd9Sstevel@tonic-gate snprintf(text->challenge, 200, "<%s.%s@%s>", randdigits, time,
2297c478bd9Sstevel@tonic-gate sparams->serverFQDN);
230*1da57d55SToomas Soome
2317c478bd9Sstevel@tonic-gate *serverout = text->challenge;
2327c478bd9Sstevel@tonic-gate *serveroutlen = strlen(text->challenge);
233*1da57d55SToomas Soome
2347c478bd9Sstevel@tonic-gate /* free stuff */
235*1da57d55SToomas Soome sparams->utils->free(time);
236*1da57d55SToomas Soome sparams->utils->free(randdigits);
237*1da57d55SToomas Soome
2387c478bd9Sstevel@tonic-gate text->state = 2;
239*1da57d55SToomas Soome
2407c478bd9Sstevel@tonic-gate return SASL_CONTINUE;
2417c478bd9Sstevel@tonic-gate }
242*1da57d55SToomas Soome
2437c478bd9Sstevel@tonic-gate static int
crammd5_server_mech_step2(server_context_t * text,sasl_server_params_t * sparams,const char * clientin,unsigned clientinlen,const char ** serverout,unsigned * serveroutlen,sasl_out_params_t * oparams)2447c478bd9Sstevel@tonic-gate crammd5_server_mech_step2(server_context_t *text,
2457c478bd9Sstevel@tonic-gate sasl_server_params_t *sparams,
2467c478bd9Sstevel@tonic-gate const char *clientin,
2477c478bd9Sstevel@tonic-gate unsigned clientinlen,
2487c478bd9Sstevel@tonic-gate const char **serverout __attribute__((unused)),
2497c478bd9Sstevel@tonic-gate unsigned *serveroutlen __attribute__((unused)),
2507c478bd9Sstevel@tonic-gate sasl_out_params_t *oparams)
2517c478bd9Sstevel@tonic-gate {
2527c478bd9Sstevel@tonic-gate char *userid = NULL;
2537c478bd9Sstevel@tonic-gate sasl_secret_t *sec = NULL;
2547c478bd9Sstevel@tonic-gate int pos, len;
2557c478bd9Sstevel@tonic-gate int result = SASL_FAIL;
2567c478bd9Sstevel@tonic-gate const char *password_request[] = { SASL_AUX_PASSWORD,
2577c478bd9Sstevel@tonic-gate "*cmusaslsecretCRAM-MD5",
2587c478bd9Sstevel@tonic-gate NULL };
2597c478bd9Sstevel@tonic-gate struct propval auxprop_values[3];
2607c478bd9Sstevel@tonic-gate HMAC_MD5_CTX tmphmac;
2617c478bd9Sstevel@tonic-gate HMAC_MD5_STATE md5state;
2627c478bd9Sstevel@tonic-gate int clear_md5state = 0;
2637c478bd9Sstevel@tonic-gate char *digest_str = NULL;
2647c478bd9Sstevel@tonic-gate UINT4 digest[4];
265*1da57d55SToomas Soome
2667c478bd9Sstevel@tonic-gate /* extract userid; everything before last space */
2677c478bd9Sstevel@tonic-gate pos = clientinlen-1;
2687c478bd9Sstevel@tonic-gate while ((pos > 0) && (clientin[pos] != ' ')) pos--;
269*1da57d55SToomas Soome
2707c478bd9Sstevel@tonic-gate if (pos <= 0) {
2717c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
2727c478bd9Sstevel@tonic-gate sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR,
2737c478bd9Sstevel@tonic-gate "need authentication name");
2747c478bd9Sstevel@tonic-gate #else
2757c478bd9Sstevel@tonic-gate SETERROR( sparams->utils,"need authentication name");
2767c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
2777c478bd9Sstevel@tonic-gate return SASL_BADPROT;
2787c478bd9Sstevel@tonic-gate }
279*1da57d55SToomas Soome
2807c478bd9Sstevel@tonic-gate userid = (char *) sparams->utils->malloc(pos+1);
2817c478bd9Sstevel@tonic-gate if (userid == NULL) {
2827c478bd9Sstevel@tonic-gate MEMERROR( sparams->utils);
2837c478bd9Sstevel@tonic-gate return SASL_NOMEM;
2847c478bd9Sstevel@tonic-gate }
285*1da57d55SToomas Soome
2867c478bd9Sstevel@tonic-gate /* copy authstr out */
2877c478bd9Sstevel@tonic-gate memcpy(userid, clientin, pos);
2887c478bd9Sstevel@tonic-gate userid[pos] = '\0';
289*1da57d55SToomas Soome
2907c478bd9Sstevel@tonic-gate result = sparams->utils->prop_request(sparams->propctx, password_request);
2917c478bd9Sstevel@tonic-gate if (result != SASL_OK) goto done;
292*1da57d55SToomas Soome
2937c478bd9Sstevel@tonic-gate /* this will trigger the getting of the aux properties */
2947c478bd9Sstevel@tonic-gate result = sparams->canon_user(sparams->utils->conn,
2957c478bd9Sstevel@tonic-gate userid, 0, SASL_CU_AUTHID | SASL_CU_AUTHZID,
2967c478bd9Sstevel@tonic-gate oparams);
2977c478bd9Sstevel@tonic-gate if (result != SASL_OK) goto done;
298*1da57d55SToomas Soome
2997c478bd9Sstevel@tonic-gate result = sparams->utils->prop_getnames(sparams->propctx,
3007c478bd9Sstevel@tonic-gate password_request,
3017c478bd9Sstevel@tonic-gate auxprop_values);
3027c478bd9Sstevel@tonic-gate if (result < 0 ||
3037c478bd9Sstevel@tonic-gate ((!auxprop_values[0].name || !auxprop_values[0].values) &&
3047c478bd9Sstevel@tonic-gate (!auxprop_values[1].name || !auxprop_values[1].values))) {
3057c478bd9Sstevel@tonic-gate /* We didn't find this username */
3067c478bd9Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
3077c478bd9Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn,0,
3087c478bd9Sstevel@tonic-gate gettext("no secret in database"));
3097c478bd9Sstevel@tonic-gate #else
3107c478bd9Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn,0,
3117c478bd9Sstevel@tonic-gate "no secret in database");
3127c478bd9Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
3137c478bd9Sstevel@tonic-gate result = SASL_NOUSER;
3147c478bd9Sstevel@tonic-gate goto done;
3157c478bd9Sstevel@tonic-gate }
316*1da57d55SToomas Soome
3177c478bd9Sstevel@tonic-gate if (auxprop_values[0].name && auxprop_values[0].values) {
3187c478bd9Sstevel@tonic-gate len = strlen(auxprop_values[0].values[0]);
3197c478bd9Sstevel@tonic-gate if (len == 0) {
3207c478bd9Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
3217c478bd9Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn,0,
3227c478bd9Sstevel@tonic-gate gettext("empty secret"));
3237c478bd9Sstevel@tonic-gate #else
3247c478bd9Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn,0,
3257c478bd9Sstevel@tonic-gate "empty secret");
3267c478bd9Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
3277c478bd9Sstevel@tonic-gate result = SASL_FAIL;
3287c478bd9Sstevel@tonic-gate goto done;
3297c478bd9Sstevel@tonic-gate }
330*1da57d55SToomas Soome
3317c478bd9Sstevel@tonic-gate sec = sparams->utils->malloc(sizeof(sasl_secret_t) + len);
3327c478bd9Sstevel@tonic-gate if (!sec) goto done;
333*1da57d55SToomas Soome
3347c478bd9Sstevel@tonic-gate sec->len = len;
3357c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
336*1da57d55SToomas Soome strncpy((char *)sec->data, auxprop_values[0].values[0], len + 1);
3377c478bd9Sstevel@tonic-gate #else
338*1da57d55SToomas Soome strncpy(sec->data, auxprop_values[0].values[0], len + 1);
3397c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
340*1da57d55SToomas Soome
3417c478bd9Sstevel@tonic-gate clear_md5state = 1;
3427c478bd9Sstevel@tonic-gate /* Do precalculation on plaintext secret */
3437c478bd9Sstevel@tonic-gate sparams->utils->hmac_md5_precalc(&md5state, /* OUT */
3447c478bd9Sstevel@tonic-gate sec->data,
3457c478bd9Sstevel@tonic-gate sec->len);
3467c478bd9Sstevel@tonic-gate } else if (auxprop_values[1].name && auxprop_values[1].values) {
3477c478bd9Sstevel@tonic-gate /* We have a precomputed secret */
3487c478bd9Sstevel@tonic-gate memcpy(&md5state, auxprop_values[1].values[0],
3497c478bd9Sstevel@tonic-gate sizeof(HMAC_MD5_STATE));
3507c478bd9Sstevel@tonic-gate } else {
3517c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
3527c478bd9Sstevel@tonic-gate sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR,
3537c478bd9Sstevel@tonic-gate "Have neither type of secret");
3547c478bd9Sstevel@tonic-gate #else
3557c478bd9Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn, 0,
3567c478bd9Sstevel@tonic-gate "Have neither type of secret");
3577c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
3587c478bd9Sstevel@tonic-gate return SASL_FAIL;
3597c478bd9Sstevel@tonic-gate }
360*1da57d55SToomas Soome
3617c478bd9Sstevel@tonic-gate /* ok this is annoying:
3627c478bd9Sstevel@tonic-gate so we have this half-way hmac transform instead of the plaintext
3637c478bd9Sstevel@tonic-gate that means we half to:
3647c478bd9Sstevel@tonic-gate -import it back into a md5 context
365*1da57d55SToomas Soome -do an md5update with the nonce
3667c478bd9Sstevel@tonic-gate -finalize it
3677c478bd9Sstevel@tonic-gate */
3687c478bd9Sstevel@tonic-gate sparams->utils->hmac_md5_import(&tmphmac, (HMAC_MD5_STATE *) &md5state);
3697c478bd9Sstevel@tonic-gate sparams->utils->MD5Update(&(tmphmac.ictx),
3707c478bd9Sstevel@tonic-gate (const unsigned char *) text->challenge,
3717c478bd9Sstevel@tonic-gate strlen(text->challenge));
3727c478bd9Sstevel@tonic-gate sparams->utils->hmac_md5_final((unsigned char *) &digest, &tmphmac);
373*1da57d55SToomas Soome
3747c478bd9Sstevel@tonic-gate /* convert to base 16 with lower case letters */
3757c478bd9Sstevel@tonic-gate digest_str = convert16((unsigned char *) digest, 16, sparams->utils);
376*1da57d55SToomas Soome
377*1da57d55SToomas Soome /* if same then verified
3787c478bd9Sstevel@tonic-gate * - we know digest_str is null terminated but clientin might not be
3797c478bd9Sstevel@tonic-gate */
3807c478bd9Sstevel@tonic-gate if (strncmp(digest_str, clientin+pos+1, strlen(digest_str)) != 0) {
3817c478bd9Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
3827c478bd9Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn, 0,
3837c478bd9Sstevel@tonic-gate gettext("incorrect digest response"));
3847c478bd9Sstevel@tonic-gate #else
3857c478bd9Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn, 0,
3867c478bd9Sstevel@tonic-gate "incorrect digest response");
3877c478bd9Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
3887c478bd9Sstevel@tonic-gate result = SASL_BADAUTH;
3897c478bd9Sstevel@tonic-gate goto done;
3907c478bd9Sstevel@tonic-gate }
391*1da57d55SToomas Soome
3927c478bd9Sstevel@tonic-gate /* set oparams */
3937c478bd9Sstevel@tonic-gate oparams->doneflag = 1;
3947c478bd9Sstevel@tonic-gate oparams->mech_ssf = 0;
3957c478bd9Sstevel@tonic-gate oparams->maxoutbuf = 0;
3967c478bd9Sstevel@tonic-gate oparams->encode_context = NULL;
3977c478bd9Sstevel@tonic-gate oparams->encode = NULL;
3987c478bd9Sstevel@tonic-gate oparams->decode_context = NULL;
3997c478bd9Sstevel@tonic-gate oparams->decode = NULL;
4007c478bd9Sstevel@tonic-gate oparams->param_version = 0;
401*1da57d55SToomas Soome
4027c478bd9Sstevel@tonic-gate result = SASL_OK;
403*1da57d55SToomas Soome
4047c478bd9Sstevel@tonic-gate done:
4057c478bd9Sstevel@tonic-gate if (userid) sparams->utils->free(userid);
4067c478bd9Sstevel@tonic-gate if (sec) _plug_free_secret(sparams->utils, &sec);
4077c478bd9Sstevel@tonic-gate
4087c478bd9Sstevel@tonic-gate if (digest_str) sparams->utils->free(digest_str);
4097c478bd9Sstevel@tonic-gate if (clear_md5state) memset(&md5state, 0, sizeof(md5state));
410*1da57d55SToomas Soome
4117c478bd9Sstevel@tonic-gate return result;
4127c478bd9Sstevel@tonic-gate }
4137c478bd9Sstevel@tonic-gate
crammd5_server_mech_step(void * conn_context,sasl_server_params_t * sparams,const char * clientin,unsigned clientinlen,const char ** serverout,unsigned * serveroutlen,sasl_out_params_t * oparams)4147c478bd9Sstevel@tonic-gate static int crammd5_server_mech_step(void *conn_context,
4157c478bd9Sstevel@tonic-gate sasl_server_params_t *sparams,
4167c478bd9Sstevel@tonic-gate const char *clientin,
4177c478bd9Sstevel@tonic-gate unsigned clientinlen,
4187c478bd9Sstevel@tonic-gate const char **serverout,
4197c478bd9Sstevel@tonic-gate unsigned *serveroutlen,
4207c478bd9Sstevel@tonic-gate sasl_out_params_t *oparams)
4217c478bd9Sstevel@tonic-gate {
4227c478bd9Sstevel@tonic-gate server_context_t *text = (server_context_t *) conn_context;
423*1da57d55SToomas Soome
4247c478bd9Sstevel@tonic-gate *serverout = NULL;
4257c478bd9Sstevel@tonic-gate *serveroutlen = 0;
426*1da57d55SToomas Soome
4277c478bd9Sstevel@tonic-gate /* this should be well more than is ever needed */
4287c478bd9Sstevel@tonic-gate if (clientinlen > 1024) {
4297c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
4307c478bd9Sstevel@tonic-gate sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR,
4317c478bd9Sstevel@tonic-gate "CRAM-MD5 input longer than 1024 bytes");
4327c478bd9Sstevel@tonic-gate #else
4337c478bd9Sstevel@tonic-gate SETERROR(sparams->utils, "CRAM-MD5 input longer than 1024 bytes");
4347c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
4357c478bd9Sstevel@tonic-gate return SASL_BADPROT;
4367c478bd9Sstevel@tonic-gate }
437*1da57d55SToomas Soome
4387c478bd9Sstevel@tonic-gate switch (text->state) {
4397c478bd9Sstevel@tonic-gate
4407c478bd9Sstevel@tonic-gate case 1:
4417c478bd9Sstevel@tonic-gate return crammd5_server_mech_step1(text, sparams,
4427c478bd9Sstevel@tonic-gate clientin, clientinlen,
4437c478bd9Sstevel@tonic-gate serverout, serveroutlen,
4447c478bd9Sstevel@tonic-gate oparams);
4457c478bd9Sstevel@tonic-gate
4467c478bd9Sstevel@tonic-gate case 2:
4477c478bd9Sstevel@tonic-gate return crammd5_server_mech_step2(text, sparams,
4487c478bd9Sstevel@tonic-gate clientin, clientinlen,
4497c478bd9Sstevel@tonic-gate serverout, serveroutlen,
4507c478bd9Sstevel@tonic-gate oparams);
4517c478bd9Sstevel@tonic-gate
4527c478bd9Sstevel@tonic-gate default: /* should never get here */
4537c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
4547c478bd9Sstevel@tonic-gate sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR,
4557c478bd9Sstevel@tonic-gate "Invalid CRAM-MD5 server step %d", text->state);
4567c478bd9Sstevel@tonic-gate #else
4577c478bd9Sstevel@tonic-gate sparams->utils->log(NULL, SASL_LOG_ERR,
4587c478bd9Sstevel@tonic-gate "Invalid CRAM-MD5 server step %d\n", text->state);
4597c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
4607c478bd9Sstevel@tonic-gate return SASL_FAIL;
4617c478bd9Sstevel@tonic-gate }
462*1da57d55SToomas Soome
4637c478bd9Sstevel@tonic-gate #ifndef _SUN_SDK_
4647c478bd9Sstevel@tonic-gate return SASL_FAIL; /* should never get here */
4657c478bd9Sstevel@tonic-gate #endif /* !_SUN_SDK_ */
4667c478bd9Sstevel@tonic-gate }
4677c478bd9Sstevel@tonic-gate
crammd5_server_mech_dispose(void * conn_context,const sasl_utils_t * utils)4687c478bd9Sstevel@tonic-gate static void crammd5_server_mech_dispose(void *conn_context,
4697c478bd9Sstevel@tonic-gate const sasl_utils_t *utils)
4707c478bd9Sstevel@tonic-gate {
4717c478bd9Sstevel@tonic-gate server_context_t *text = (server_context_t *) conn_context;
472*1da57d55SToomas Soome
4737c478bd9Sstevel@tonic-gate if (!text) return;
474*1da57d55SToomas Soome
4757c478bd9Sstevel@tonic-gate if (text->challenge) _plug_free_string(utils,&(text->challenge));
476*1da57d55SToomas Soome
4777c478bd9Sstevel@tonic-gate utils->free(text);
4787c478bd9Sstevel@tonic-gate }
4797c478bd9Sstevel@tonic-gate
480*1da57d55SToomas Soome static sasl_server_plug_t crammd5_server_plugins[] =
4817c478bd9Sstevel@tonic-gate {
4827c478bd9Sstevel@tonic-gate {
4837c478bd9Sstevel@tonic-gate "CRAM-MD5", /* mech_name */
4847c478bd9Sstevel@tonic-gate 0, /* max_ssf */
4857c478bd9Sstevel@tonic-gate SASL_SEC_NOPLAINTEXT
4867c478bd9Sstevel@tonic-gate | SASL_SEC_NOANONYMOUS, /* security_flags */
4877c478bd9Sstevel@tonic-gate SASL_FEAT_SERVER_FIRST, /* features */
4887c478bd9Sstevel@tonic-gate NULL, /* glob_context */
4897c478bd9Sstevel@tonic-gate &crammd5_server_mech_new, /* mech_new */
4907c478bd9Sstevel@tonic-gate &crammd5_server_mech_step, /* mech_step */
4917c478bd9Sstevel@tonic-gate &crammd5_server_mech_dispose, /* mech_dispose */
4927c478bd9Sstevel@tonic-gate NULL, /* mech_free */
4937c478bd9Sstevel@tonic-gate NULL, /* setpass */
4947c478bd9Sstevel@tonic-gate NULL, /* user_query */
4957c478bd9Sstevel@tonic-gate NULL, /* idle */
4967c478bd9Sstevel@tonic-gate NULL, /* mech avail */
4977c478bd9Sstevel@tonic-gate NULL /* spare */
4987c478bd9Sstevel@tonic-gate }
4997c478bd9Sstevel@tonic-gate };
5007c478bd9Sstevel@tonic-gate
crammd5_server_plug_init(const sasl_utils_t * utils,int maxversion,int * out_version,sasl_server_plug_t ** pluglist,int * plugcount)5017c478bd9Sstevel@tonic-gate int crammd5_server_plug_init(const sasl_utils_t *utils,
5027c478bd9Sstevel@tonic-gate int maxversion,
5037c478bd9Sstevel@tonic-gate int *out_version,
5047c478bd9Sstevel@tonic-gate sasl_server_plug_t **pluglist,
5057c478bd9Sstevel@tonic-gate int *plugcount)
5067c478bd9Sstevel@tonic-gate {
5077c478bd9Sstevel@tonic-gate if (maxversion < SASL_SERVER_PLUG_VERSION) {
5087c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
5097c478bd9Sstevel@tonic-gate utils->log(NULL, SASL_LOG_ERR, "CRAM version mismatch");
5107c478bd9Sstevel@tonic-gate #else
5117c478bd9Sstevel@tonic-gate SETERROR( utils, "CRAM version mismatch");
5127c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
5137c478bd9Sstevel@tonic-gate return SASL_BADVERS;
5147c478bd9Sstevel@tonic-gate }
515*1da57d55SToomas Soome
5167c478bd9Sstevel@tonic-gate *out_version = SASL_SERVER_PLUG_VERSION;
5177c478bd9Sstevel@tonic-gate *pluglist = crammd5_server_plugins;
518*1da57d55SToomas Soome *plugcount = 1;
519*1da57d55SToomas Soome
5207c478bd9Sstevel@tonic-gate return SASL_OK;
5217c478bd9Sstevel@tonic-gate }
5227c478bd9Sstevel@tonic-gate
5237c478bd9Sstevel@tonic-gate /***************************** Client Section *****************************/
5247c478bd9Sstevel@tonic-gate
5257c478bd9Sstevel@tonic-gate typedef struct client_context {
5267c478bd9Sstevel@tonic-gate char *out_buf;
5277c478bd9Sstevel@tonic-gate unsigned out_buf_len;
5287c478bd9Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
5297c478bd9Sstevel@tonic-gate void *h;
5307c478bd9Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
5317c478bd9Sstevel@tonic-gate } client_context_t;
5327c478bd9Sstevel@tonic-gate
crammd5_client_mech_new(void * glob_context,sasl_client_params_t * params,void ** conn_context)533*1da57d55SToomas Soome static int crammd5_client_mech_new(void *glob_context __attribute__((unused)),
5347c478bd9Sstevel@tonic-gate sasl_client_params_t *params,
5357c478bd9Sstevel@tonic-gate void **conn_context)
5367c478bd9Sstevel@tonic-gate {
5377c478bd9Sstevel@tonic-gate client_context_t *text;
538*1da57d55SToomas Soome
5397c478bd9Sstevel@tonic-gate /* holds state are in */
5407c478bd9Sstevel@tonic-gate text = params->utils->malloc(sizeof(client_context_t));
5417c478bd9Sstevel@tonic-gate if (text == NULL) {
5427c478bd9Sstevel@tonic-gate MEMERROR(params->utils);
5437c478bd9Sstevel@tonic-gate return SASL_NOMEM;
5447c478bd9Sstevel@tonic-gate }
545*1da57d55SToomas Soome
5467c478bd9Sstevel@tonic-gate memset(text, 0, sizeof(client_context_t));
5477c478bd9Sstevel@tonic-gate
5487c478bd9Sstevel@tonic-gate *conn_context = text;
549*1da57d55SToomas Soome
5507c478bd9Sstevel@tonic-gate return SASL_OK;
5517c478bd9Sstevel@tonic-gate }
5527c478bd9Sstevel@tonic-gate
make_hashed(sasl_secret_t * sec,char * nonce,int noncelen,const sasl_utils_t * utils)553*1da57d55SToomas Soome static char *make_hashed(sasl_secret_t *sec, char *nonce, int noncelen,
5547c478bd9Sstevel@tonic-gate const sasl_utils_t *utils)
5557c478bd9Sstevel@tonic-gate {
5567c478bd9Sstevel@tonic-gate char secret[65];
557*1da57d55SToomas Soome unsigned char digest[24];
5587c478bd9Sstevel@tonic-gate int lup;
5597c478bd9Sstevel@tonic-gate char *in16;
560*1da57d55SToomas Soome
5617c478bd9Sstevel@tonic-gate if (sec == NULL) return NULL;
562*1da57d55SToomas Soome
5637c478bd9Sstevel@tonic-gate if (sec->len < 64) {
5647c478bd9Sstevel@tonic-gate memcpy(secret, sec->data, sec->len);
565*1da57d55SToomas Soome
5667c478bd9Sstevel@tonic-gate /* fill in rest with 0's */
5677c478bd9Sstevel@tonic-gate for (lup= sec->len; lup < 64; lup++)
5687c478bd9Sstevel@tonic-gate secret[lup]='\0';
569*1da57d55SToomas Soome
5707c478bd9Sstevel@tonic-gate } else {
5717c478bd9Sstevel@tonic-gate memcpy(secret, sec->data, 64);
5727c478bd9Sstevel@tonic-gate }
573*1da57d55SToomas Soome
5747c478bd9Sstevel@tonic-gate /* do the hmac md5 hash output 128 bits */
5757c478bd9Sstevel@tonic-gate utils->hmac_md5((unsigned char *) nonce, noncelen,
5767c478bd9Sstevel@tonic-gate (unsigned char *) secret, 64, digest);
577*1da57d55SToomas Soome
5787c478bd9Sstevel@tonic-gate /* convert that to hex form */
5797c478bd9Sstevel@tonic-gate in16 = convert16(digest, 16, utils);
5807c478bd9Sstevel@tonic-gate if (in16 == NULL) return NULL;
581*1da57d55SToomas Soome
5827c478bd9Sstevel@tonic-gate return in16;
5837c478bd9Sstevel@tonic-gate }
5847c478bd9Sstevel@tonic-gate
crammd5_client_mech_step(void * conn_context,sasl_client_params_t * params,const char * serverin,unsigned serverinlen,sasl_interact_t ** prompt_need,const char ** clientout,unsigned * clientoutlen,sasl_out_params_t * oparams)5857c478bd9Sstevel@tonic-gate static int crammd5_client_mech_step(void *conn_context,
5867c478bd9Sstevel@tonic-gate sasl_client_params_t *params,
5877c478bd9Sstevel@tonic-gate const char *serverin,
5887c478bd9Sstevel@tonic-gate unsigned serverinlen,
5897c478bd9Sstevel@tonic-gate sasl_interact_t **prompt_need,
5907c478bd9Sstevel@tonic-gate const char **clientout,
5917c478bd9Sstevel@tonic-gate unsigned *clientoutlen,
5927c478bd9Sstevel@tonic-gate sasl_out_params_t *oparams)
5937c478bd9Sstevel@tonic-gate {
5947c478bd9Sstevel@tonic-gate client_context_t *text = (client_context_t *) conn_context;
5957c478bd9Sstevel@tonic-gate const char *authid;
5967c478bd9Sstevel@tonic-gate sasl_secret_t *password = NULL;
5977c478bd9Sstevel@tonic-gate unsigned int free_password = 0; /* set if we need to free password */
5987c478bd9Sstevel@tonic-gate int auth_result = SASL_OK;
5997c478bd9Sstevel@tonic-gate int pass_result = SASL_OK;
6007c478bd9Sstevel@tonic-gate int result;
6017c478bd9Sstevel@tonic-gate int maxsize;
6027c478bd9Sstevel@tonic-gate char *in16 = NULL;
6037c478bd9Sstevel@tonic-gate
6047c478bd9Sstevel@tonic-gate *clientout = NULL;
6057c478bd9Sstevel@tonic-gate *clientoutlen = 0;
606*1da57d55SToomas Soome
6077c478bd9Sstevel@tonic-gate /* First check for absurd lengths */
6087c478bd9Sstevel@tonic-gate if (serverinlen > 1024) {
6097c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
6107c478bd9Sstevel@tonic-gate params->utils->log(params->utils->conn, SASL_LOG_ERR,
6117c478bd9Sstevel@tonic-gate "CRAM-MD5 input longer than 1024 bytes");
6127c478bd9Sstevel@tonic-gate #else
6137c478bd9Sstevel@tonic-gate params->utils->seterror(params->utils->conn, 0,
6147c478bd9Sstevel@tonic-gate "CRAM-MD5 input longer than 1024 bytes");
6157c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
6167c478bd9Sstevel@tonic-gate return SASL_BADPROT;
6177c478bd9Sstevel@tonic-gate }
618*1da57d55SToomas Soome
6197c478bd9Sstevel@tonic-gate /* check if sec layer strong enough */
6207c478bd9Sstevel@tonic-gate if (params->props.min_ssf > params->external_ssf) {
6217c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
6227c478bd9Sstevel@tonic-gate params->utils->log(params->utils->conn, SASL_LOG_ERR,
6237c478bd9Sstevel@tonic-gate "SSF requested of CRAM-MD5 plugin");
6247c478bd9Sstevel@tonic-gate #else
6257c478bd9Sstevel@tonic-gate SETERROR( params->utils, "SSF requested of CRAM-MD5 plugin");
6267c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
6277c478bd9Sstevel@tonic-gate return SASL_TOOWEAK;
6287c478bd9Sstevel@tonic-gate }
629*1da57d55SToomas Soome
6307c478bd9Sstevel@tonic-gate /* try to get the userid */
6317c478bd9Sstevel@tonic-gate if (oparams->authid == NULL) {
6327c478bd9Sstevel@tonic-gate auth_result=_plug_get_authid(params->utils, &authid, prompt_need);
633*1da57d55SToomas Soome
6347c478bd9Sstevel@tonic-gate if ((auth_result != SASL_OK) && (auth_result != SASL_INTERACT))
6357c478bd9Sstevel@tonic-gate return auth_result;
6367c478bd9Sstevel@tonic-gate }
637*1da57d55SToomas Soome
6387c478bd9Sstevel@tonic-gate /* try to get the password */
6397c478bd9Sstevel@tonic-gate if (password == NULL) {
6407c478bd9Sstevel@tonic-gate pass_result=_plug_get_password(params->utils, &password,
6417c478bd9Sstevel@tonic-gate &free_password, prompt_need);
642*1da57d55SToomas Soome
6437c478bd9Sstevel@tonic-gate if ((pass_result != SASL_OK) && (pass_result != SASL_INTERACT))
6447c478bd9Sstevel@tonic-gate return pass_result;
6457c478bd9Sstevel@tonic-gate }
646*1da57d55SToomas Soome
6477c478bd9Sstevel@tonic-gate /* free prompts we got */
6487c478bd9Sstevel@tonic-gate if (prompt_need && *prompt_need) {
6497c478bd9Sstevel@tonic-gate params->utils->free(*prompt_need);
6507c478bd9Sstevel@tonic-gate *prompt_need = NULL;
6517c478bd9Sstevel@tonic-gate }
652*1da57d55SToomas Soome
6537c478bd9Sstevel@tonic-gate /* if there are prompts not filled in */
6547c478bd9Sstevel@tonic-gate if ((auth_result == SASL_INTERACT) || (pass_result == SASL_INTERACT)) {
6557c478bd9Sstevel@tonic-gate /* make the prompt list */
6567c478bd9Sstevel@tonic-gate result =
6577c478bd9Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
6587c478bd9Sstevel@tonic-gate _plug_make_prompts(params->utils, &text->h, prompt_need,
6597c478bd9Sstevel@tonic-gate NULL, NULL,
6607c478bd9Sstevel@tonic-gate auth_result == SASL_INTERACT ?
6617c478bd9Sstevel@tonic-gate convert_prompt(params->utils, &text->h,
6627c478bd9Sstevel@tonic-gate gettext("Please enter your authentication name"))
6637c478bd9Sstevel@tonic-gate : NULL, NULL,
6647c478bd9Sstevel@tonic-gate pass_result == SASL_INTERACT ?
6657c478bd9Sstevel@tonic-gate convert_prompt(params->utils, &text->h,
6667c478bd9Sstevel@tonic-gate gettext("Please enter your password"))
6677c478bd9Sstevel@tonic-gate : NULL, NULL,
6687c478bd9Sstevel@tonic-gate NULL, NULL, NULL,
6697c478bd9Sstevel@tonic-gate NULL, NULL, NULL);
6707c478bd9Sstevel@tonic-gate #else
6717c478bd9Sstevel@tonic-gate _plug_make_prompts(params->utils, prompt_need,
6727c478bd9Sstevel@tonic-gate NULL, NULL,
6737c478bd9Sstevel@tonic-gate auth_result == SASL_INTERACT ?
6747c478bd9Sstevel@tonic-gate "Please enter your authentication name" : NULL,
6757c478bd9Sstevel@tonic-gate NULL,
6767c478bd9Sstevel@tonic-gate pass_result == SASL_INTERACT ?
6777c478bd9Sstevel@tonic-gate "Please enter your password" : NULL, NULL,
6787c478bd9Sstevel@tonic-gate NULL, NULL, NULL,
6797c478bd9Sstevel@tonic-gate NULL, NULL, NULL);
6807c478bd9Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
6817c478bd9Sstevel@tonic-gate if (result != SASL_OK) goto cleanup;
682*1da57d55SToomas Soome
6837c478bd9Sstevel@tonic-gate return SASL_INTERACT;
6847c478bd9Sstevel@tonic-gate }
685*1da57d55SToomas Soome
6867c478bd9Sstevel@tonic-gate if (!password) {
6877c478bd9Sstevel@tonic-gate PARAMERROR(params->utils);
6887c478bd9Sstevel@tonic-gate return SASL_BADPARAM;
6897c478bd9Sstevel@tonic-gate }
690*1da57d55SToomas Soome
6917c478bd9Sstevel@tonic-gate result = params->canon_user(params->utils->conn, authid, 0,
6927c478bd9Sstevel@tonic-gate SASL_CU_AUTHID | SASL_CU_AUTHZID, oparams);
6937c478bd9Sstevel@tonic-gate if (result != SASL_OK) goto cleanup;
694*1da57d55SToomas Soome
6957c478bd9Sstevel@tonic-gate /*
6967c478bd9Sstevel@tonic-gate * username SP digest (keyed md5 where key is passwd)
6977c478bd9Sstevel@tonic-gate */
698*1da57d55SToomas Soome
6997c478bd9Sstevel@tonic-gate in16 = make_hashed(password, (char *) serverin, serverinlen,
7007c478bd9Sstevel@tonic-gate params->utils);
701*1da57d55SToomas Soome
7027c478bd9Sstevel@tonic-gate if (in16 == NULL) {
7037c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
7047c478bd9Sstevel@tonic-gate params->utils->log(params->utils->conn, SASL_LOG_ERR,
7057c478bd9Sstevel@tonic-gate "make_hashed failed");
7067c478bd9Sstevel@tonic-gate #else
7077c478bd9Sstevel@tonic-gate SETERROR(params->utils, "whoops, make_hashed failed us this time");
7087c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
7097c478bd9Sstevel@tonic-gate result = SASL_FAIL;
7107c478bd9Sstevel@tonic-gate goto cleanup;
7117c478bd9Sstevel@tonic-gate }
712*1da57d55SToomas Soome
7137c478bd9Sstevel@tonic-gate maxsize = 32+1+strlen(oparams->authid)+30;
7147c478bd9Sstevel@tonic-gate result = _plug_buf_alloc(params->utils, &(text->out_buf),
7157c478bd9Sstevel@tonic-gate &(text->out_buf_len), maxsize);
7167c478bd9Sstevel@tonic-gate if (result != SASL_OK) goto cleanup;
717*1da57d55SToomas Soome
7187c478bd9Sstevel@tonic-gate snprintf(text->out_buf, maxsize, "%s %s", oparams->authid, in16);
719*1da57d55SToomas Soome
7207c478bd9Sstevel@tonic-gate *clientout = text->out_buf;
7217c478bd9Sstevel@tonic-gate *clientoutlen = strlen(*clientout);
722*1da57d55SToomas Soome
7237c478bd9Sstevel@tonic-gate /* set oparams */
7247c478bd9Sstevel@tonic-gate oparams->doneflag = 1;
7257c478bd9Sstevel@tonic-gate oparams->mech_ssf = 0;
7267c478bd9Sstevel@tonic-gate oparams->maxoutbuf = 0;
7277c478bd9Sstevel@tonic-gate oparams->encode_context = NULL;
7287c478bd9Sstevel@tonic-gate oparams->encode = NULL;
7297c478bd9Sstevel@tonic-gate oparams->decode_context = NULL;
7307c478bd9Sstevel@tonic-gate oparams->decode = NULL;
7317c478bd9Sstevel@tonic-gate oparams->param_version = 0;
732*1da57d55SToomas Soome
7337c478bd9Sstevel@tonic-gate result = SASL_OK;
7347c478bd9Sstevel@tonic-gate
7357c478bd9Sstevel@tonic-gate cleanup:
7367c478bd9Sstevel@tonic-gate /* get rid of private information */
7377c478bd9Sstevel@tonic-gate if (in16) _plug_free_string(params->utils, &in16);
738*1da57d55SToomas Soome
7397c478bd9Sstevel@tonic-gate /* get rid of all sensitive info */
7407c478bd9Sstevel@tonic-gate if (free_password) _plug_free_secret(params-> utils, &password);
7417c478bd9Sstevel@tonic-gate
7427c478bd9Sstevel@tonic-gate return result;
7437c478bd9Sstevel@tonic-gate }
7447c478bd9Sstevel@tonic-gate
crammd5_client_mech_dispose(void * conn_context,const sasl_utils_t * utils)7457c478bd9Sstevel@tonic-gate static void crammd5_client_mech_dispose(void *conn_context,
7467c478bd9Sstevel@tonic-gate const sasl_utils_t *utils)
7477c478bd9Sstevel@tonic-gate {
7487c478bd9Sstevel@tonic-gate client_context_t *text = (client_context_t *) conn_context;
749*1da57d55SToomas Soome
7507c478bd9Sstevel@tonic-gate if (!text) return;
751*1da57d55SToomas Soome
7527c478bd9Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
7537c478bd9Sstevel@tonic-gate convert_prompt(utils, &text->h, NULL);
7547c478bd9Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
7557c478bd9Sstevel@tonic-gate if (text->out_buf) utils->free(text->out_buf);
756*1da57d55SToomas Soome
7577c478bd9Sstevel@tonic-gate utils->free(text);
7587c478bd9Sstevel@tonic-gate }
7597c478bd9Sstevel@tonic-gate
760*1da57d55SToomas Soome static sasl_client_plug_t crammd5_client_plugins[] =
7617c478bd9Sstevel@tonic-gate {
7627c478bd9Sstevel@tonic-gate {
7637c478bd9Sstevel@tonic-gate "CRAM-MD5", /* mech_name */
7647c478bd9Sstevel@tonic-gate 0, /* max_ssf */
7657c478bd9Sstevel@tonic-gate SASL_SEC_NOPLAINTEXT
7667c478bd9Sstevel@tonic-gate | SASL_SEC_NOANONYMOUS, /* security_flags */
7677c478bd9Sstevel@tonic-gate SASL_FEAT_SERVER_FIRST, /* features */
7687c478bd9Sstevel@tonic-gate NULL, /* required_prompts */
7697c478bd9Sstevel@tonic-gate NULL, /* glob_context */
7707c478bd9Sstevel@tonic-gate &crammd5_client_mech_new, /* mech_new */
7717c478bd9Sstevel@tonic-gate &crammd5_client_mech_step, /* mech_step */
7727c478bd9Sstevel@tonic-gate &crammd5_client_mech_dispose, /* mech_dispose */
7737c478bd9Sstevel@tonic-gate NULL, /* mech_free */
7747c478bd9Sstevel@tonic-gate NULL, /* idle */
7757c478bd9Sstevel@tonic-gate NULL, /* spare */
7767c478bd9Sstevel@tonic-gate NULL /* spare */
7777c478bd9Sstevel@tonic-gate }
7787c478bd9Sstevel@tonic-gate };
7797c478bd9Sstevel@tonic-gate
crammd5_client_plug_init(const sasl_utils_t * utils,int maxversion,int * out_version,sasl_client_plug_t ** pluglist,int * plugcount)7807c478bd9Sstevel@tonic-gate int crammd5_client_plug_init(const sasl_utils_t *utils,
7817c478bd9Sstevel@tonic-gate int maxversion,
7827c478bd9Sstevel@tonic-gate int *out_version,
7837c478bd9Sstevel@tonic-gate sasl_client_plug_t **pluglist,
7847c478bd9Sstevel@tonic-gate int *plugcount)
7857c478bd9Sstevel@tonic-gate {
7867c478bd9Sstevel@tonic-gate if (maxversion < SASL_CLIENT_PLUG_VERSION) {
7877c478bd9Sstevel@tonic-gate #ifdef _SUN_SDK_
7887c478bd9Sstevel@tonic-gate utils->log(NULL, SASL_LOG_ERR, "CRAM version mismatch");
7897c478bd9Sstevel@tonic-gate #else
7907c478bd9Sstevel@tonic-gate SETERROR( utils, "CRAM version mismatch");
7917c478bd9Sstevel@tonic-gate #endif /* _SUN_SDK_ */
7927c478bd9Sstevel@tonic-gate return SASL_BADVERS;
7937c478bd9Sstevel@tonic-gate }
794*1da57d55SToomas Soome
7957c478bd9Sstevel@tonic-gate *out_version = SASL_CLIENT_PLUG_VERSION;
7967c478bd9Sstevel@tonic-gate *pluglist = crammd5_client_plugins;
7977c478bd9Sstevel@tonic-gate *plugcount = 1;
798*1da57d55SToomas Soome
7997c478bd9Sstevel@tonic-gate return SASL_OK;
8007c478bd9Sstevel@tonic-gate }
801