2N/A/*
2N/A * Copyright 2003 Sun Microsystems, Inc. All rights reserved.
2N/A * Use is subject to license terms.
2N/A */
2N/A#pragma ident "%Z%%M% %I% %E% SMI"
2N/A
2N/A/* Plain SASL plugin
2N/A * Rob Siemborski
2N/A * Tim Martin
2N/A * $Id: plain.c,v 1.61 2003/03/26 17:18:04 rjs3 Exp $
2N/A */
2N/A
2N/A/*
2N/A * Copyright (c) 1998-2003 Carnegie Mellon University. All rights reserved.
2N/A *
2N/A * Redistribution and use in source and binary forms, with or without
2N/A * modification, are permitted provided that the following conditions
2N/A * are met:
2N/A *
2N/A * 1. Redistributions of source code must retain the above copyright
2N/A * notice, this list of conditions and the following disclaimer.
2N/A *
2N/A * 2. Redistributions in binary form must reproduce the above copyright
2N/A * notice, this list of conditions and the following disclaimer in
2N/A * the documentation and/or other materials provided with the
2N/A * distribution.
2N/A *
2N/A * 3. The name "Carnegie Mellon University" must not be used to
2N/A * endorse or promote products derived from this software without
2N/A * prior written permission. For permission or any other legal
2N/A * details, please contact
2N/A * Office of Technology Transfer
2N/A * Carnegie Mellon University
2N/A * 5000 Forbes Avenue
2N/A * Pittsburgh, PA 15213-3890
2N/A * (412) 268-4387, fax: (412) 268-7395
2N/A * tech-transfer@andrew.cmu.edu
2N/A *
2N/A * 4. Redistributions of any form whatsoever must retain the following
2N/A * acknowledgment:
2N/A * "This product includes software developed by Computing Services
2N/A * at Carnegie Mellon University (http://www.cmu.edu/computing/)."
2N/A *
2N/A * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
2N/A * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
2N/A * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
2N/A * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
2N/A * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
2N/A * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
2N/A * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
2N/A */
2N/A
2N/A#include <config.h>
2N/A#include <stdio.h>
2N/A#include <string.h>
2N/A#include <sasl.h>
2N/A#include <saslplug.h>
2N/A
2N/A#include "plugin_common.h"
2N/A
2N/A#ifndef _SUN_SDK_
2N/A#ifdef WIN32
2N/A/* This must be after sasl.h */
2N/A# include "saslPLAIN.h"
2N/A#endif /* WIN32 */
2N/A#endif /* !_SUN_SDK_ */
2N/A
2N/A#ifdef macintosh
2N/A#include <sasl_plain_plugin_decl.h>
2N/A#endif
2N/A
2N/A/***************************** Common Section *****************************/
2N/A
2N/A#ifndef _SUN_SDK_
2N/Astatic const char plugin_id[] = "$Id: plain.c,v 1.61 2003/03/26 17:18:04 rjs3 Exp $";
2N/A#endif /* !_SUN_SDK_ */
2N/A
2N/A/***************************** Server Section *****************************/
2N/A
2N/Astatic int plain_server_mech_new(void *glob_context __attribute__((unused)),
2N/A sasl_server_params_t *sparams,
2N/A const char *challenge __attribute__((unused)),
2N/A unsigned challen __attribute__((unused)),
2N/A void **conn_context)
2N/A{
2N/A /* holds state are in */
2N/A if (!conn_context) {
2N/A PARAMERROR( sparams->utils );
2N/A return SASL_BADPARAM;
2N/A }
2N/A
2N/A *conn_context = NULL;
2N/A
2N/A return SASL_OK;
2N/A}
2N/A
2N/Astatic int plain_server_mech_step(void *conn_context __attribute__((unused)),
2N/A sasl_server_params_t *params,
2N/A const char *clientin,
2N/A unsigned clientinlen,
2N/A const char **serverout,
2N/A unsigned *serveroutlen,
2N/A sasl_out_params_t *oparams)
2N/A{
2N/A const char *author;
2N/A const char *authen;
2N/A const char *password;
2N/A size_t password_len;
2N/A unsigned lup=0;
2N/A int result;
2N/A char *passcopy;
2N/A
2N/A *serverout = NULL;
2N/A *serveroutlen = 0;
2N/A
2N/A /* should have received author-id NUL authen-id NUL password */
2N/A
2N/A /* get author */
2N/A author = clientin;
2N/A while ((lup < clientinlen) && (clientin[lup] != 0)) ++lup;
2N/A
2N/A if (lup >= clientinlen) {
2N/A#ifdef _SUN_SDK_
2N/A params->utils->log(params->utils->conn, SASL_LOG_ERR,
2N/A "Can only find author (no password)");
2N/A#else
2N/A SETERROR(params->utils, "Can only find author (no password)");
2N/A#endif /* _SUN_SDK_ */
2N/A return SASL_BADPROT;
2N/A }
2N/A
2N/A /* get authen */
2N/A ++lup;
2N/A authen = clientin + lup;
2N/A while ((lup < clientinlen) && (clientin[lup] != 0)) ++lup;
2N/A
2N/A if (lup >= clientinlen) {
2N/A#ifdef _SUN_SDK_
2N/A params->utils->log(params->utils->conn, SASL_LOG_ERR,
2N/A "Can only find author/en (no password)");
2N/A#else
2N/A params->utils->seterror(params->utils->conn, 0,
2N/A "Can only find author/en (no password)");
2N/A#endif /* _SUN_SDK_ */
2N/A return SASL_BADPROT;
2N/A }
2N/A
2N/A /* get password */
2N/A lup++;
2N/A password = clientin + lup;
2N/A while ((lup < clientinlen) && (clientin[lup] != 0)) ++lup;
2N/A
2N/A password_len = clientin + lup - password;
2N/A
2N/A if (lup != clientinlen) {
2N/A#ifdef _SUN_SDK_
2N/A params->utils->log(params->utils->conn, SASL_LOG_ERR,
2N/A "Got more data than we were expecting in the PLAIN plugin");
2N/A#else
2N/A SETERROR(params->utils,
2N/A "Got more data than we were expecting in the PLAIN plugin\n");
2N/A#endif /* _SUN_SDK_ */
2N/A return SASL_BADPROT;
2N/A }
2N/A
2N/A /* this kinda sucks. we need password to be null terminated
2N/A but we can't assume there is an allocated byte at the end
2N/A of password so we have to copy it */
2N/A passcopy = params->utils->malloc(password_len + 1);
2N/A if (passcopy == NULL) {
2N/A MEMERROR(params->utils);
2N/A return SASL_NOMEM;
2N/A }
2N/A
2N/A strncpy(passcopy, password, password_len);
2N/A passcopy[password_len] = '\0';
2N/A
2N/A /* Canonicalize userid first, so that password verification is only
2N/A * against the canonical id */
2N/A if (!author || !*author)
2N/A author = authen;
2N/A
2N/A result = params->canon_user(params->utils->conn,
2N/A authen, 0, SASL_CU_AUTHID, oparams);
2N/A if (result != SASL_OK) {
2N/A _plug_free_string(params->utils, &passcopy);
2N/A return result;
2N/A }
2N/A
2N/A /* verify password - return sasl_ok on success*/
2N/A result = params->utils->checkpass(params->utils->conn,
2N/A oparams->authid, oparams->alen,
2N/A passcopy, password_len);
2N/A
2N/A _plug_free_string(params->utils, &passcopy);
2N/A
2N/A if (result != SASL_OK) {
2N/A#ifdef _INTEGRATED_SOLARIS_
2N/A params->utils->seterror(params->utils->conn, 0,
2N/A gettext("Password verification failed"));
2N/A#else
2N/A params->utils->seterror(params->utils->conn, 0,
2N/A "Password verification failed");
2N/A#endif /* _INTEGRATED_SOLARIS_ */
2N/A return result;
2N/A }
2N/A
2N/A /* Canonicalize and store the authorization ID */
2N/A /* We need to do this after calling verify_user just in case verify_user
2N/A * needed to get auxprops itself */
2N/A result = params->canon_user(params->utils->conn,
2N/A author, 0, SASL_CU_AUTHZID, oparams);
2N/A if (result != SASL_OK) return result;
2N/A
2N/A /* Transition? */
2N/A if (params->transition) {
2N/A params->transition(params->utils->conn, password, password_len);
2N/A }
2N/A
2N/A /* set oparams */
2N/A oparams->doneflag = 1;
2N/A oparams->mech_ssf = 0;
2N/A oparams->maxoutbuf = 0;
2N/A oparams->encode_context = NULL;
2N/A oparams->encode = NULL;
2N/A oparams->decode_context = NULL;
2N/A oparams->decode = NULL;
2N/A oparams->param_version = 0;
2N/A
2N/A return SASL_OK;
2N/A}
2N/A
2N/Astatic sasl_server_plug_t plain_server_plugins[] =
2N/A{
2N/A {
2N/A "PLAIN", /* mech_name */
2N/A 0, /* max_ssf */
2N/A SASL_SEC_NOANONYMOUS, /* security_flags */
2N/A SASL_FEAT_WANT_CLIENT_FIRST
2N/A | SASL_FEAT_ALLOWS_PROXY, /* features */
2N/A NULL, /* glob_context */
2N/A &plain_server_mech_new, /* mech_new */
2N/A &plain_server_mech_step, /* mech_step */
2N/A NULL, /* mech_dispose */
2N/A NULL, /* mech_free */
2N/A NULL, /* setpass */
2N/A NULL, /* user_query */
2N/A NULL, /* idle */
2N/A NULL, /* mech_avail */
2N/A NULL /* spare */
2N/A }
2N/A};
2N/A
2N/Aint plain_server_plug_init(const sasl_utils_t *utils,
2N/A int maxversion,
2N/A int *out_version,
2N/A sasl_server_plug_t **pluglist,
2N/A int *plugcount)
2N/A{
2N/A if (maxversion < SASL_SERVER_PLUG_VERSION) {
2N/A SETERROR(utils, "PLAIN version mismatch");
2N/A return SASL_BADVERS;
2N/A }
2N/A
2N/A *out_version = SASL_SERVER_PLUG_VERSION;
2N/A *pluglist = plain_server_plugins;
2N/A *plugcount = 1;
2N/A
2N/A return SASL_OK;
2N/A}
2N/A
2N/A/***************************** Client Section *****************************/
2N/A
2N/Atypedef struct client_context {
2N/A char *out_buf;
2N/A unsigned out_buf_len;
2N/A#ifdef _INTEGRATED_SOLARIS_
2N/A void *h;
2N/A#endif /* _INTEGRATED_SOLARIS_ */
2N/A} client_context_t;
2N/A
2N/Astatic int plain_client_mech_new(void *glob_context __attribute__((unused)),
2N/A sasl_client_params_t *params,
2N/A void **conn_context)
2N/A{
2N/A client_context_t *text;
2N/A
2N/A /* holds state are in */
2N/A text = params->utils->malloc(sizeof(client_context_t));
2N/A if (text == NULL) {
2N/A MEMERROR( params->utils );
2N/A return SASL_NOMEM;
2N/A }
2N/A
2N/A memset(text, 0, sizeof(client_context_t));
2N/A
2N/A *conn_context = text;
2N/A
2N/A return SASL_OK;
2N/A}
2N/A
2N/Astatic int plain_client_mech_step(void *conn_context,
2N/A sasl_client_params_t *params,
2N/A const char *serverin __attribute__((unused)),
2N/A unsigned serverinlen __attribute__((unused)),
2N/A sasl_interact_t **prompt_need,
2N/A const char **clientout,
2N/A unsigned *clientoutlen,
2N/A sasl_out_params_t *oparams)
2N/A{
2N/A client_context_t *text = (client_context_t *) conn_context;
2N/A const char *user = NULL, *authid = NULL;
2N/A sasl_secret_t *password = NULL;
2N/A unsigned int free_password = 0; /* set if we need to free password */
2N/A int user_result = SASL_OK;
2N/A int auth_result = SASL_OK;
2N/A int pass_result = SASL_OK;
2N/A int result;
2N/A
2N/A *clientout = NULL;
2N/A *clientoutlen = 0;
2N/A
2N/A /* doesn't really matter how the server responds */
2N/A
2N/A /* check if sec layer strong enough */
2N/A if (params->props.min_ssf > params->external_ssf) {
2N/A#ifdef _INTEGRATED_SOLARIS_
2N/A SETERROR( params->utils, gettext("SSF requested of PLAIN plugin"));
2N/A#else
2N/A SETERROR( params->utils, "SSF requested of PLAIN plugin");
2N/A#endif /* _INTEGRATED_SOLARIS_ */
2N/A return SASL_TOOWEAK;
2N/A }
2N/A
2N/A /* try to get the authid */
2N/A if (oparams->authid == NULL) {
2N/A auth_result = _plug_get_authid(params->utils, &authid, prompt_need);
2N/A
2N/A if ((auth_result != SASL_OK) && (auth_result != SASL_INTERACT))
2N/A return auth_result;
2N/A }
2N/A
2N/A /* try to get the userid */
2N/A if (oparams->user == NULL) {
2N/A user_result = _plug_get_userid(params->utils, &user, prompt_need);
2N/A
2N/A if ((user_result != SASL_OK) && (user_result != SASL_INTERACT))
2N/A return user_result;
2N/A }
2N/A
2N/A /* try to get the password */
2N/A if (password == NULL) {
2N/A pass_result = _plug_get_password(params->utils, &password,
2N/A &free_password, prompt_need);
2N/A
2N/A if ((pass_result != SASL_OK) && (pass_result != SASL_INTERACT))
2N/A return pass_result;
2N/A }
2N/A
2N/A /* free prompts we got */
2N/A if (prompt_need && *prompt_need) {
2N/A params->utils->free(*prompt_need);
2N/A *prompt_need = NULL;
2N/A }
2N/A
2N/A /* if there are prompts not filled in */
2N/A if ((user_result == SASL_INTERACT) || (auth_result == SASL_INTERACT) ||
2N/A (pass_result == SASL_INTERACT)) {
2N/A /* make the prompt list */
2N/A result =
2N/A#ifdef _INTEGRATED_SOLARIS_
2N/A _plug_make_prompts(params->utils, &text->h, prompt_need,
2N/A user_result == SASL_INTERACT ?
2N/A convert_prompt(params->utils, &text->h,
2N/A gettext("Please enter your authorization name"))
2N/A : NULL,
2N/A NULL,
2N/A auth_result == SASL_INTERACT ?
2N/A convert_prompt(params->utils, &text->h,
2N/A gettext("Please enter your authentication name"))
2N/A : NULL,
2N/A NULL,
2N/A pass_result == SASL_INTERACT ?
2N/A convert_prompt(params->utils, &text->h,
2N/A gettext("Please enter your password")) : NULL,
2N/A NULL,
2N/A NULL, NULL, NULL,
2N/A NULL, NULL, NULL);
2N/A#else
2N/A _plug_make_prompts(params->utils, prompt_need,
2N/A user_result == SASL_INTERACT ?
2N/A "Please enter your authorization name" : NULL,
2N/A NULL,
2N/A auth_result == SASL_INTERACT ?
2N/A "Please enter your authentication name" : NULL,
2N/A NULL,
2N/A pass_result == SASL_INTERACT ?
2N/A "Please enter your password" : NULL, NULL,
2N/A NULL, NULL, NULL,
2N/A NULL, NULL, NULL);
2N/A#endif /* _INTEGRATED_SOLARIS_ */
2N/A if (result != SASL_OK) goto cleanup;
2N/A
2N/A return SASL_INTERACT;
2N/A }
2N/A
2N/A if (!password) {
2N/A PARAMERROR(params->utils);
2N/A return SASL_BADPARAM;
2N/A }
2N/A
2N/A if (!user || !*user) {
2N/A result = params->canon_user(params->utils->conn, authid, 0,
2N/A SASL_CU_AUTHID | SASL_CU_AUTHZID, oparams);
2N/A }
2N/A else {
2N/A result = params->canon_user(params->utils->conn, user, 0,
2N/A SASL_CU_AUTHZID, oparams);
2N/A if (result != SASL_OK) goto cleanup;
2N/A
2N/A result = params->canon_user(params->utils->conn, authid, 0,
2N/A SASL_CU_AUTHID, oparams);
2N/A }
2N/A if (result != SASL_OK) goto cleanup;
2N/A
2N/A /* send authorized id NUL authentication id NUL password */
2N/A *clientoutlen = (oparams->ulen + 1
2N/A + oparams->alen + 1
2N/A + password->len);
2N/A
2N/A /* remember the extra NUL on the end for stupid clients */
2N/A result = _plug_buf_alloc(params->utils, &(text->out_buf),
2N/A &(text->out_buf_len), *clientoutlen + 1);
2N/A if (result != SASL_OK) goto cleanup;
2N/A
2N/A memset(text->out_buf, 0, *clientoutlen + 1);
2N/A memcpy(text->out_buf, oparams->user, oparams->ulen);
2N/A memcpy(text->out_buf + oparams->ulen + 1, oparams->authid, oparams->alen);
2N/A memcpy(text->out_buf + oparams->ulen + oparams->alen + 2,
2N/A password->data, password->len);
2N/A
2N/A *clientout = text->out_buf;
2N/A
2N/A /* set oparams */
2N/A oparams->doneflag = 1;
2N/A oparams->mech_ssf = 0;
2N/A oparams->maxoutbuf = 0;
2N/A oparams->encode_context = NULL;
2N/A oparams->encode = NULL;
2N/A oparams->decode_context = NULL;
2N/A oparams->decode = NULL;
2N/A oparams->param_version = 0;
2N/A
2N/A result = SASL_OK;
2N/A
2N/A cleanup:
2N/A /* free sensitive info */
2N/A if (free_password) _plug_free_secret(params->utils, &password);
2N/A
2N/A return result;
2N/A}
2N/A
2N/Astatic void plain_client_mech_dispose(void *conn_context,
2N/A const sasl_utils_t *utils)
2N/A{
2N/A client_context_t *text = (client_context_t *) conn_context;
2N/A
2N/A if (!text) return;
2N/A
2N/A if (text->out_buf) utils->free(text->out_buf);
2N/A#ifdef _INTEGRATED_SOLARIS_
2N/A convert_prompt(utils, &text->h, NULL);
2N/A#endif /* _INTEGRATED_SOLARIS_ */
2N/A
2N/A utils->free(text);
2N/A}
2N/A
2N/Astatic sasl_client_plug_t plain_client_plugins[] =
2N/A{
2N/A {
2N/A "PLAIN", /* mech_name */
2N/A 0, /* max_ssf */
2N/A SASL_SEC_NOANONYMOUS, /* security_flags */
2N/A SASL_FEAT_WANT_CLIENT_FIRST
2N/A | SASL_FEAT_ALLOWS_PROXY, /* features */
2N/A NULL, /* required_prompts */
2N/A NULL, /* glob_context */
2N/A &plain_client_mech_new, /* mech_new */
2N/A &plain_client_mech_step, /* mech_step */
2N/A &plain_client_mech_dispose, /* mech_dispose */
2N/A NULL, /* mech_free */
2N/A NULL, /* idle */
2N/A NULL, /* spare */
2N/A NULL /* spare */
2N/A }
2N/A};
2N/A
2N/Aint plain_client_plug_init(sasl_utils_t *utils,
2N/A int maxversion,
2N/A int *out_version,
2N/A sasl_client_plug_t **pluglist,
2N/A int *plugcount)
2N/A{
2N/A if (maxversion < SASL_CLIENT_PLUG_VERSION) {
2N/A SETERROR(utils, "PLAIN version mismatch");
2N/A return SASL_BADVERS;
2N/A }
2N/A
2N/A *out_version = SASL_CLIENT_PLUG_VERSION;
2N/A *pluglist = plain_client_plugins;
2N/A *plugcount = 1;
2N/A
2N/A return SASL_OK;
2N/A}