summaryrefslogtreecommitdiffstats
path: root/lib/vauth
diff options
context:
space:
mode:
Diffstat (limited to 'lib/vauth')
-rw-r--r--lib/vauth/digest.c25
-rw-r--r--lib/vauth/ntlm.c101
-rw-r--r--lib/vauth/spnego_gssapi.c8
-rw-r--r--lib/vauth/spnego_sspi.c24
-rw-r--r--lib/vauth/vauth.h5
5 files changed, 27 insertions, 136 deletions
diff --git a/lib/vauth/digest.c b/lib/vauth/digest.c
index d8aac66..d461609 100644
--- a/lib/vauth/digest.c
+++ b/lib/vauth/digest.c
@@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
- * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@@ -40,7 +40,6 @@
#include "warnless.h"
#include "strtok.h"
#include "strcase.h"
-#include "non-ascii.h" /* included for Curl_convert_... prototypes */
#include "curl_printf.h"
#include "rand.h"
@@ -56,20 +55,7 @@
#define DIGEST_QOP_VALUE_STRING_AUTH "auth"
#define DIGEST_QOP_VALUE_STRING_AUTH_INT "auth-int"
#define DIGEST_QOP_VALUE_STRING_AUTH_CONF "auth-conf"
-
-/* The CURL_OUTPUT_DIGEST_CONV macro below is for non-ASCII machines.
- It converts digest text to ASCII so the MD5 will be correct for
- what ultimately goes over the network.
-*/
-#define CURL_OUTPUT_DIGEST_CONV(a, b) \
- do { \
- result = Curl_convert_to_network(a, b, strlen(b)); \
- if(result) { \
- free(b); \
- return result; \
- } \
- } while(0)
-#endif /* !USE_WINDOWS_SSPI */
+#endif
bool Curl_auth_digest_get_pair(const char *str, char *value, char *content,
const char **endptr)
@@ -692,7 +678,7 @@ static CURLcode auth_create_digest_http_message(
if(result)
return result;
- result = Curl_base64_encode(data, cnoncebuf, strlen(cnoncebuf),
+ result = Curl_base64_encode(cnoncebuf, strlen(cnoncebuf),
&cnonce, &cnonce_sz);
if(result)
return result;
@@ -705,7 +691,6 @@ static CURLcode auth_create_digest_http_message(
if(!hashthis)
return CURLE_OUT_OF_MEMORY;
- CURL_OUTPUT_DIGEST_CONV(data, hashthis);
hash(hashbuf, (unsigned char *) hashthis, strlen(hashthis));
free(hashthis);
convert_to_ascii(hashbuf, (unsigned char *)userh);
@@ -726,7 +711,6 @@ static CURLcode auth_create_digest_http_message(
if(!hashthis)
return CURLE_OUT_OF_MEMORY;
- CURL_OUTPUT_DIGEST_CONV(data, hashthis); /* convert on non-ASCII machines */
hash(hashbuf, (unsigned char *) hashthis, strlen(hashthis));
free(hashthis);
convert_to_ascii(hashbuf, ha1);
@@ -739,7 +723,6 @@ static CURLcode auth_create_digest_http_message(
if(!tmp)
return CURLE_OUT_OF_MEMORY;
- CURL_OUTPUT_DIGEST_CONV(data, tmp); /* Convert on non-ASCII machines */
hash(hashbuf, (unsigned char *) tmp, strlen(tmp));
free(tmp);
convert_to_ascii(hashbuf, ha1);
@@ -778,7 +761,6 @@ static CURLcode auth_create_digest_http_message(
if(!hashthis)
return CURLE_OUT_OF_MEMORY;
- CURL_OUTPUT_DIGEST_CONV(data, hashthis); /* convert on non-ASCII machines */
hash(hashbuf, (unsigned char *) hashthis, strlen(hashthis));
free(hashthis);
convert_to_ascii(hashbuf, ha2);
@@ -794,7 +776,6 @@ static CURLcode auth_create_digest_http_message(
if(!hashthis)
return CURLE_OUT_OF_MEMORY;
- CURL_OUTPUT_DIGEST_CONV(data, hashthis); /* convert on non-ASCII machines */
hash(hashbuf, (unsigned char *) hashthis, strlen(hashthis));
free(hashthis);
convert_to_ascii(hashbuf, request_digest);
diff --git a/lib/vauth/ntlm.c b/lib/vauth/ntlm.c
index 04f6590..115f70b 100644
--- a/lib/vauth/ntlm.c
+++ b/lib/vauth/ntlm.c
@@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
- * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@@ -34,7 +34,6 @@
#define DEBUG_ME 0
#include "urldata.h"
-#include "non-ascii.h"
#include "sendf.h"
#include "curl_ntlm_core.h"
#include "curl_gethostname.h"
@@ -383,12 +382,6 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
/* Clean up any former leftovers and initialise to defaults */
Curl_auth_cleanup_ntlm(ntlm);
-#if defined(USE_NTRESPONSES) && \
- (defined(USE_NTLM2SESSION) || defined(USE_NTLM_V2))
-#define NTLM2FLAG NTLMFLAG_NEGOTIATE_NTLM2_KEY
-#else
-#define NTLM2FLAG 0
-#endif
ntlmbuf = aprintf(NTLMSSP_SIGNATURE "%c"
"\x01%c%c%c" /* 32-bit type = 1 */
"%c%c%c%c" /* 32-bit NTLM flag field */
@@ -408,7 +401,7 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
NTLMFLAG_REQUEST_TARGET |
NTLMFLAG_NEGOTIATE_NTLM_KEY |
- NTLM2FLAG |
+ NTLMFLAG_NEGOTIATE_NTLM2_KEY |
NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
SHORTPAIR(domlen),
SHORTPAIR(domlen),
@@ -433,18 +426,18 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
NTLMFLAG_REQUEST_TARGET |
NTLMFLAG_NEGOTIATE_NTLM_KEY |
- NTLM2FLAG |
+ NTLMFLAG_NEGOTIATE_NTLM2_KEY |
NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
NTLMFLAG_NEGOTIATE_OEM |
NTLMFLAG_REQUEST_TARGET |
NTLMFLAG_NEGOTIATE_NTLM_KEY |
- NTLM2FLAG |
+ NTLMFLAG_NEGOTIATE_NTLM2_KEY |
NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
ntlm_print_flags(stderr,
NTLMFLAG_NEGOTIATE_OEM |
NTLMFLAG_REQUEST_TARGET |
NTLMFLAG_NEGOTIATE_NTLM_KEY |
- NTLM2FLAG |
+ NTLMFLAG_NEGOTIATE_NTLM2_KEY |
NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
fprintf(stderr, "\n****\n");
});
@@ -498,13 +491,11 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
unsigned char ntlmbuf[NTLM_BUFSIZE];
int lmrespoff;
unsigned char lmresp[24]; /* fixed-size */
-#ifdef USE_NTRESPONSES
int ntrespoff;
unsigned int ntresplen = 24;
unsigned char ntresp[24]; /* fixed-size */
unsigned char *ptr_ntresp = &ntresp[0];
unsigned char *ntlmv2resp = NULL;
-#endif
bool unicode = (ntlm->flags & NTLMFLAG_NEGOTIATE_UNICODE) ? TRUE : FALSE;
char host[HOSTNAME_MAX + 1] = "";
const char *user;
@@ -533,19 +524,14 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
/* Get the machine's un-qualified host name as NTLM doesn't like the fully
qualified domain name */
if(Curl_gethostname(host, sizeof(host))) {
- infof(data, "gethostname() failed, continuing without!");
+ infof(data, "gethostname() failed, continuing without");
hostlen = 0;
}
else {
hostlen = strlen(host);
}
-#if defined(USE_NTRESPONSES) && \
- (defined(USE_NTLM2SESSION) || defined(USE_NTLM_V2))
- /* We don't support NTLM2 or extended security if we don't have
- USE_NTRESPONSES */
if(ntlm->flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY) {
-# if defined(USE_NTLM_V2)
unsigned char ntbuffer[0x18];
unsigned char entropy[8];
unsigned char ntlmv2hash[0x18];
@@ -558,7 +544,7 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
if(result)
return result;
- result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
+ result = Curl_ntlm_core_mk_nt_hash(passwdp, ntbuffer);
if(result)
return result;
@@ -580,67 +566,21 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
return result;
ptr_ntresp = ntlmv2resp;
-# else /* defined(USE_NTLM_V2) */
- unsigned char ntbuffer[0x18];
- unsigned char tmp[0x18];
- unsigned char md5sum[MD5_DIGEST_LEN];
- unsigned char entropy[8];
-
- /* NTLM version 1 with extended security. */
-
- /* Need to create 8 bytes random data */
- result = Curl_rand(data, entropy, 8);
- if(result)
- return result;
-
- /* 8 bytes random data as challenge in lmresp */
- memcpy(lmresp, entropy, 8);
-
- /* Pad with zeros */
- memset(lmresp + 8, 0, 0x10);
-
- /* Fill tmp with challenge(nonce?) + entropy */
- memcpy(tmp, &ntlm->nonce[0], 8);
- memcpy(tmp + 8, entropy, 8);
-
- result = Curl_md5it(md5sum, tmp, 16);
- if(result)
- return result;
-
- /* We shall only use the first 8 bytes of md5sum, but the des code in
- Curl_ntlm_core_lm_resp only encrypt the first 8 bytes */
- result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
- if(result)
- return result;
-
- Curl_ntlm_core_lm_resp(ntbuffer, md5sum, ntresp);
-
- /* End of NTLM2 Session code */
- /* NTLM v2 session security is a misnomer because it is not NTLM v2.
- It is NTLM v1 using the extended session security that is also
- in NTLM v2 */
-# endif /* defined(USE_NTLM_V2) */
}
- else
-#endif
- {
+ else {
-#ifdef USE_NTRESPONSES
unsigned char ntbuffer[0x18];
-#endif
unsigned char lmbuffer[0x18];
/* NTLM version 1 */
-#ifdef USE_NTRESPONSES
- result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
+ result = Curl_ntlm_core_mk_nt_hash(passwdp, ntbuffer);
if(result)
return result;
Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], ntresp);
-#endif
- result = Curl_ntlm_core_mk_lm_hash(data, passwdp, lmbuffer);
+ result = Curl_ntlm_core_mk_lm_hash(passwdp, lmbuffer);
if(result)
return result;
@@ -659,12 +599,8 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
}
lmrespoff = 64; /* size of the message header */
-#ifdef USE_NTRESPONSES
ntrespoff = lmrespoff + 0x18;
domoff = ntrespoff + ntresplen;
-#else
- domoff = lmrespoff + 0x18;
-#endif
useroff = domoff + domlen;
hostoff = useroff + userlen;
@@ -719,17 +655,11 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
SHORTPAIR(lmrespoff),
0x0, 0x0,
-#ifdef USE_NTRESPONSES
SHORTPAIR(ntresplen), /* NT-response length, twice */
SHORTPAIR(ntresplen),
SHORTPAIR(ntrespoff),
0x0, 0x0,
-#else
- 0x0, 0x0,
- 0x0, 0x0,
- 0x0, 0x0,
- 0x0, 0x0,
-#endif
+
SHORTPAIR(domlen),
SHORTPAIR(domlen),
SHORTPAIR(domoff),
@@ -766,7 +696,6 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
ntlm_print_hex(stderr, (char *)&ntlmbuf[lmrespoff], 0x18);
});
-#ifdef USE_NTRESPONSES
/* ntresplen + size should not be risking an integer overflow here */
if(ntresplen + size > sizeof(ntlmbuf)) {
failf(data, "incoming NTLM message too big");
@@ -783,8 +712,6 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
free(ntlmv2resp);/* Free the dynamic buffer allocated for NTLMv2 */
-#endif
-
DEBUG_OUT({
fprintf(stderr, "\n flags=0x%02.2x%02.2x%02.2x%02.2x 0x%08.8x ",
LONGQUARTET(ntlm->flags), ntlm->flags);
@@ -823,12 +750,6 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
size += hostlen;
- /* Convert domain, user, and host to ASCII but leave the rest as-is */
- result = Curl_convert_to_network(data, (char *)&ntlmbuf[domoff],
- size - domoff);
- if(result)
- return CURLE_CONV_FAILED;
-
/* Return the binary blob. */
result = Curl_bufref_memdup(out, ntlmbuf, size);
diff --git a/lib/vauth/spnego_gssapi.c b/lib/vauth/spnego_gssapi.c
index 8e8932b..8c1a3ed 100644
--- a/lib/vauth/spnego_gssapi.c
+++ b/lib/vauth/spnego_gssapi.c
@@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
- * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@@ -204,16 +204,14 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
*
* Returns CURLE_OK on success.
*/
-CURLcode Curl_auth_create_spnego_message(struct Curl_easy *data,
- struct negotiatedata *nego,
+CURLcode Curl_auth_create_spnego_message(struct negotiatedata *nego,
char **outptr, size_t *outlen)
{
CURLcode result;
OM_uint32 minor_status;
/* Base64 encode the already generated response */
- result = Curl_base64_encode(data,
- nego->output_token.value,
+ result = Curl_base64_encode(nego->output_token.value,
nego->output_token.length,
outptr, outlen);
diff --git a/lib/vauth/spnego_sspi.c b/lib/vauth/spnego_sspi.c
index 68bb17d..d219d8b 100644
--- a/lib/vauth/spnego_sspi.c
+++ b/lib/vauth/spnego_sspi.c
@@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
- * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@@ -301,27 +301,19 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
*
* Returns CURLE_OK on success.
*/
-CURLcode Curl_auth_create_spnego_message(struct Curl_easy *data,
- struct negotiatedata *nego,
+CURLcode Curl_auth_create_spnego_message(struct negotiatedata *nego,
char **outptr, size_t *outlen)
{
- CURLcode result;
-
/* Base64 encode the already generated response */
- result = Curl_base64_encode(data,
- (const char *) nego->output_token,
- nego->output_token_length,
- outptr, outlen);
-
- if(result)
- return result;
-
- if(!*outptr || !*outlen) {
+ CURLcode result = Curl_base64_encode((const char *) nego->output_token,
+ nego->output_token_length, outptr,
+ outlen);
+ if(!result && (!*outptr || !*outlen)) {
free(*outptr);
- return CURLE_REMOTE_ACCESS_DENIED;
+ result = CURLE_REMOTE_ACCESS_DENIED;
}
- return CURLE_OK;
+ return result;
}
/*
diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
index 47a7c0b..6e12378 100644
--- a/lib/vauth/vauth.h
+++ b/lib/vauth/vauth.h
@@ -7,7 +7,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
- * Copyright (C) 2014 - 2021, Steve Holme, <steve_holme@hotmail.com>.
+ * Copyright (C) 2014 - 2022, Steve Holme, <steve_holme@hotmail.com>.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@@ -219,8 +219,7 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
/* This is used to generate a base64 encoded SPNEGO (Negotiate) response
message */
-CURLcode Curl_auth_create_spnego_message(struct Curl_easy *data,
- struct negotiatedata *nego,
+CURLcode Curl_auth_create_spnego_message(struct negotiatedata *nego,
char **outptr, size_t *outlen);
/* This is used to clean up the SPNEGO specifiec data */
generated by cgit v0.12 at 2025-03-20 15:20:08 (GMT)