1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * Copyright 2003 Sun Microsystems, Inc. All rights reserved.
3*0Sstevel@tonic-gate * Use is subject to license terms.
4*0Sstevel@tonic-gate */
5*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
6*0Sstevel@tonic-gate
7*0Sstevel@tonic-gate /* CRAM-MD5 SASL plugin
8*0Sstevel@tonic-gate * Rob Siemborski
9*0Sstevel@tonic-gate * Tim Martin
10*0Sstevel@tonic-gate * $Id: cram.c,v 1.79 2003/02/18 18:27:37 rjs3 Exp $
11*0Sstevel@tonic-gate */
12*0Sstevel@tonic-gate /*
13*0Sstevel@tonic-gate * Copyright (c) 1998-2003 Carnegie Mellon University. All rights reserved.
14*0Sstevel@tonic-gate *
15*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
16*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions
17*0Sstevel@tonic-gate * are met:
18*0Sstevel@tonic-gate *
19*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
20*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
21*0Sstevel@tonic-gate *
22*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
23*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in
24*0Sstevel@tonic-gate * the documentation and/or other materials provided with the
25*0Sstevel@tonic-gate * distribution.
26*0Sstevel@tonic-gate *
27*0Sstevel@tonic-gate * 3. The name "Carnegie Mellon University" must not be used to
28*0Sstevel@tonic-gate * endorse or promote products derived from this software without
29*0Sstevel@tonic-gate * prior written permission. For permission or any other legal
30*0Sstevel@tonic-gate * details, please contact
31*0Sstevel@tonic-gate * Office of Technology Transfer
32*0Sstevel@tonic-gate * Carnegie Mellon University
33*0Sstevel@tonic-gate * 5000 Forbes Avenue
34*0Sstevel@tonic-gate * Pittsburgh, PA 15213-3890
35*0Sstevel@tonic-gate * (412) 268-4387, fax: (412) 268-7395
36*0Sstevel@tonic-gate * tech-transfer@andrew.cmu.edu
37*0Sstevel@tonic-gate *
38*0Sstevel@tonic-gate * 4. Redistributions of any form whatsoever must retain the following
39*0Sstevel@tonic-gate * acknowledgment:
40*0Sstevel@tonic-gate * "This product includes software developed by Computing Services
41*0Sstevel@tonic-gate * at Carnegie Mellon University (http://www.cmu.edu/computing/)."
42*0Sstevel@tonic-gate *
43*0Sstevel@tonic-gate * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
44*0Sstevel@tonic-gate * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
45*0Sstevel@tonic-gate * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
46*0Sstevel@tonic-gate * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
47*0Sstevel@tonic-gate * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
48*0Sstevel@tonic-gate * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
49*0Sstevel@tonic-gate * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
50*0Sstevel@tonic-gate */
51*0Sstevel@tonic-gate
52*0Sstevel@tonic-gate #include <config.h>
53*0Sstevel@tonic-gate
54*0Sstevel@tonic-gate #include <string.h>
55*0Sstevel@tonic-gate #include <stdlib.h>
56*0Sstevel@tonic-gate #include <stdio.h>
57*0Sstevel@tonic-gate #ifndef macintosh
58*0Sstevel@tonic-gate #include <sys/stat.h>
59*0Sstevel@tonic-gate #endif
60*0Sstevel@tonic-gate #include <fcntl.h>
61*0Sstevel@tonic-gate
62*0Sstevel@tonic-gate #include <sasl.h>
63*0Sstevel@tonic-gate #include <saslplug.h>
64*0Sstevel@tonic-gate #include <saslutil.h>
65*0Sstevel@tonic-gate
66*0Sstevel@tonic-gate #ifdef _SUN_SDK_
67*0Sstevel@tonic-gate #include <unistd.h>
68*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
69*0Sstevel@tonic-gate
70*0Sstevel@tonic-gate #include "plugin_common.h"
71*0Sstevel@tonic-gate
72*0Sstevel@tonic-gate #ifdef macintosh
73*0Sstevel@tonic-gate #include <sasl_cram_plugin_decl.h>
74*0Sstevel@tonic-gate #endif
75*0Sstevel@tonic-gate
76*0Sstevel@tonic-gate /***************************** Common Section *****************************/
77*0Sstevel@tonic-gate
78*0Sstevel@tonic-gate #ifndef _SUN_SDK_
79*0Sstevel@tonic-gate static const char plugin_id[] = "$Id: cram.c,v 1.79 2003/02/18 18:27:37 rjs3 Exp $";
80*0Sstevel@tonic-gate #endif /* !_SUN_SDK_ */
81*0Sstevel@tonic-gate
82*0Sstevel@tonic-gate /* convert a string of 8bit chars to it's representation in hex
83*0Sstevel@tonic-gate * using lowercase letters
84*0Sstevel@tonic-gate */
convert16(unsigned char * in,int inlen,const sasl_utils_t * utils)85*0Sstevel@tonic-gate static char *convert16(unsigned char *in, int inlen, const sasl_utils_t *utils)
86*0Sstevel@tonic-gate {
87*0Sstevel@tonic-gate static char hex[]="0123456789abcdef";
88*0Sstevel@tonic-gate int lup;
89*0Sstevel@tonic-gate char *out;
90*0Sstevel@tonic-gate
91*0Sstevel@tonic-gate out = utils->malloc(inlen*2+1);
92*0Sstevel@tonic-gate if (out == NULL) return NULL;
93*0Sstevel@tonic-gate
94*0Sstevel@tonic-gate for (lup=0; lup < inlen; lup++) {
95*0Sstevel@tonic-gate out[lup*2] = hex[in[lup] >> 4];
96*0Sstevel@tonic-gate out[lup*2+1] = hex[in[lup] & 15];
97*0Sstevel@tonic-gate }
98*0Sstevel@tonic-gate
99*0Sstevel@tonic-gate out[lup*2] = 0;
100*0Sstevel@tonic-gate return out;
101*0Sstevel@tonic-gate }
102*0Sstevel@tonic-gate
103*0Sstevel@tonic-gate
104*0Sstevel@tonic-gate /***************************** Server Section *****************************/
105*0Sstevel@tonic-gate
106*0Sstevel@tonic-gate typedef struct server_context {
107*0Sstevel@tonic-gate int state;
108*0Sstevel@tonic-gate
109*0Sstevel@tonic-gate char *challenge;
110*0Sstevel@tonic-gate } server_context_t;
111*0Sstevel@tonic-gate
112*0Sstevel@tonic-gate static int
crammd5_server_mech_new(void * glob_context,sasl_server_params_t * sparams,const char * challenge,unsigned challen,void ** conn_context)113*0Sstevel@tonic-gate crammd5_server_mech_new(void *glob_context __attribute__((unused)),
114*0Sstevel@tonic-gate sasl_server_params_t *sparams,
115*0Sstevel@tonic-gate const char *challenge __attribute__((unused)),
116*0Sstevel@tonic-gate unsigned challen __attribute__((unused)),
117*0Sstevel@tonic-gate void **conn_context)
118*0Sstevel@tonic-gate {
119*0Sstevel@tonic-gate server_context_t *text;
120*0Sstevel@tonic-gate
121*0Sstevel@tonic-gate /* holds state are in */
122*0Sstevel@tonic-gate text = sparams->utils->malloc(sizeof(server_context_t));
123*0Sstevel@tonic-gate if (text == NULL) {
124*0Sstevel@tonic-gate MEMERROR( sparams->utils );
125*0Sstevel@tonic-gate return SASL_NOMEM;
126*0Sstevel@tonic-gate }
127*0Sstevel@tonic-gate
128*0Sstevel@tonic-gate memset(text, 0, sizeof(server_context_t));
129*0Sstevel@tonic-gate
130*0Sstevel@tonic-gate text->state = 1;
131*0Sstevel@tonic-gate
132*0Sstevel@tonic-gate *conn_context = text;
133*0Sstevel@tonic-gate
134*0Sstevel@tonic-gate return SASL_OK;
135*0Sstevel@tonic-gate }
136*0Sstevel@tonic-gate
137*0Sstevel@tonic-gate /*
138*0Sstevel@tonic-gate * Returns the current time (or part of it) in string form
139*0Sstevel@tonic-gate * maximum length=15
140*0Sstevel@tonic-gate */
gettime(sasl_server_params_t * sparams)141*0Sstevel@tonic-gate static char *gettime(sasl_server_params_t *sparams)
142*0Sstevel@tonic-gate {
143*0Sstevel@tonic-gate char *ret;
144*0Sstevel@tonic-gate time_t t;
145*0Sstevel@tonic-gate
146*0Sstevel@tonic-gate t=time(NULL);
147*0Sstevel@tonic-gate ret= sparams->utils->malloc(15);
148*0Sstevel@tonic-gate if (ret==NULL) return NULL;
149*0Sstevel@tonic-gate
150*0Sstevel@tonic-gate /* the bottom bits are really the only random ones so if
151*0Sstevel@tonic-gate we overflow we don't want to loose them */
152*0Sstevel@tonic-gate snprintf(ret,15,"%lu",t%(0xFFFFFF));
153*0Sstevel@tonic-gate
154*0Sstevel@tonic-gate return ret;
155*0Sstevel@tonic-gate }
156*0Sstevel@tonic-gate
randomdigits(sasl_server_params_t * sparams)157*0Sstevel@tonic-gate static char *randomdigits(sasl_server_params_t *sparams)
158*0Sstevel@tonic-gate {
159*0Sstevel@tonic-gate unsigned int num;
160*0Sstevel@tonic-gate char *ret;
161*0Sstevel@tonic-gate unsigned char temp[5]; /* random 32-bit number */
162*0Sstevel@tonic-gate
163*0Sstevel@tonic-gate #if defined _DEV_URANDOM && defined _SUN_SDK_
164*0Sstevel@tonic-gate {
165*0Sstevel@tonic-gate int fd = open(_DEV_URANDOM, O_RDONLY);
166*0Sstevel@tonic-gate int nread = 0;
167*0Sstevel@tonic-gate
168*0Sstevel@tonic-gate if (fd != -1) {
169*0Sstevel@tonic-gate nread = read(fd, temp, 4);
170*0Sstevel@tonic-gate close(fd);
171*0Sstevel@tonic-gate }
172*0Sstevel@tonic-gate if (nread != 4)
173*0Sstevel@tonic-gate sparams->utils->rand(sparams->utils->rpool,
174*0Sstevel@tonic-gate (char *) temp, 4);
175*0Sstevel@tonic-gate }
176*0Sstevel@tonic-gate #else
177*0Sstevel@tonic-gate sparams->utils->rand(sparams->utils->rpool,(char *) temp,4);
178*0Sstevel@tonic-gate #endif /* _DEV_URANDOM && _SUN_SDK_ */
179*0Sstevel@tonic-gate num=(temp[0] * 256 * 256 * 256) +
180*0Sstevel@tonic-gate (temp[1] * 256 * 256) +
181*0Sstevel@tonic-gate (temp[2] * 256) +
182*0Sstevel@tonic-gate (temp[3] );
183*0Sstevel@tonic-gate
184*0Sstevel@tonic-gate ret = sparams->utils->malloc(15); /* there's no way an unsigned can be longer than this right? */
185*0Sstevel@tonic-gate if (ret == NULL) return NULL;
186*0Sstevel@tonic-gate sprintf(ret, "%u", num);
187*0Sstevel@tonic-gate
188*0Sstevel@tonic-gate return ret;
189*0Sstevel@tonic-gate }
190*0Sstevel@tonic-gate
191*0Sstevel@tonic-gate static int
crammd5_server_mech_step1(server_context_t * text,sasl_server_params_t * sparams,const char * clientin,unsigned clientinlen,const char ** serverout,unsigned * serveroutlen,sasl_out_params_t * oparams)192*0Sstevel@tonic-gate crammd5_server_mech_step1(server_context_t *text,
193*0Sstevel@tonic-gate sasl_server_params_t *sparams,
194*0Sstevel@tonic-gate const char *clientin __attribute__((unused)),
195*0Sstevel@tonic-gate unsigned clientinlen,
196*0Sstevel@tonic-gate const char **serverout,
197*0Sstevel@tonic-gate unsigned *serveroutlen,
198*0Sstevel@tonic-gate sasl_out_params_t *oparams __attribute__((unused)))
199*0Sstevel@tonic-gate {
200*0Sstevel@tonic-gate char *time, *randdigits;
201*0Sstevel@tonic-gate
202*0Sstevel@tonic-gate /* we shouldn't have received anything */
203*0Sstevel@tonic-gate if (clientinlen != 0) {
204*0Sstevel@tonic-gate #ifdef _SUN_SDK_
205*0Sstevel@tonic-gate sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR,
206*0Sstevel@tonic-gate "CRAM-MD5 does not accept inital data");
207*0Sstevel@tonic-gate #else
208*0Sstevel@tonic-gate SETERROR(sparams->utils, "CRAM-MD5 does not accpet inital data");
209*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
210*0Sstevel@tonic-gate return SASL_BADPROT;
211*0Sstevel@tonic-gate }
212*0Sstevel@tonic-gate
213*0Sstevel@tonic-gate /* get time and a random number for the nonce */
214*0Sstevel@tonic-gate time = gettime(sparams);
215*0Sstevel@tonic-gate randdigits = randomdigits(sparams);
216*0Sstevel@tonic-gate if ((time == NULL) || (randdigits == NULL)) {
217*0Sstevel@tonic-gate MEMERROR( sparams->utils );
218*0Sstevel@tonic-gate return SASL_NOMEM;
219*0Sstevel@tonic-gate }
220*0Sstevel@tonic-gate
221*0Sstevel@tonic-gate /* allocate some space for the challenge */
222*0Sstevel@tonic-gate text->challenge = sparams->utils->malloc(200 + 1);
223*0Sstevel@tonic-gate if (text->challenge == NULL) {
224*0Sstevel@tonic-gate MEMERROR(sparams->utils);
225*0Sstevel@tonic-gate return SASL_NOMEM;
226*0Sstevel@tonic-gate }
227*0Sstevel@tonic-gate
228*0Sstevel@tonic-gate /* create the challenge */
229*0Sstevel@tonic-gate snprintf(text->challenge, 200, "<%s.%s@%s>", randdigits, time,
230*0Sstevel@tonic-gate sparams->serverFQDN);
231*0Sstevel@tonic-gate
232*0Sstevel@tonic-gate *serverout = text->challenge;
233*0Sstevel@tonic-gate *serveroutlen = strlen(text->challenge);
234*0Sstevel@tonic-gate
235*0Sstevel@tonic-gate /* free stuff */
236*0Sstevel@tonic-gate sparams->utils->free(time);
237*0Sstevel@tonic-gate sparams->utils->free(randdigits);
238*0Sstevel@tonic-gate
239*0Sstevel@tonic-gate text->state = 2;
240*0Sstevel@tonic-gate
241*0Sstevel@tonic-gate return SASL_CONTINUE;
242*0Sstevel@tonic-gate }
243*0Sstevel@tonic-gate
244*0Sstevel@tonic-gate static int
crammd5_server_mech_step2(server_context_t * text,sasl_server_params_t * sparams,const char * clientin,unsigned clientinlen,const char ** serverout,unsigned * serveroutlen,sasl_out_params_t * oparams)245*0Sstevel@tonic-gate crammd5_server_mech_step2(server_context_t *text,
246*0Sstevel@tonic-gate sasl_server_params_t *sparams,
247*0Sstevel@tonic-gate const char *clientin,
248*0Sstevel@tonic-gate unsigned clientinlen,
249*0Sstevel@tonic-gate const char **serverout __attribute__((unused)),
250*0Sstevel@tonic-gate unsigned *serveroutlen __attribute__((unused)),
251*0Sstevel@tonic-gate sasl_out_params_t *oparams)
252*0Sstevel@tonic-gate {
253*0Sstevel@tonic-gate char *userid = NULL;
254*0Sstevel@tonic-gate sasl_secret_t *sec = NULL;
255*0Sstevel@tonic-gate int pos, len;
256*0Sstevel@tonic-gate int result = SASL_FAIL;
257*0Sstevel@tonic-gate const char *password_request[] = { SASL_AUX_PASSWORD,
258*0Sstevel@tonic-gate "*cmusaslsecretCRAM-MD5",
259*0Sstevel@tonic-gate NULL };
260*0Sstevel@tonic-gate struct propval auxprop_values[3];
261*0Sstevel@tonic-gate HMAC_MD5_CTX tmphmac;
262*0Sstevel@tonic-gate HMAC_MD5_STATE md5state;
263*0Sstevel@tonic-gate int clear_md5state = 0;
264*0Sstevel@tonic-gate char *digest_str = NULL;
265*0Sstevel@tonic-gate UINT4 digest[4];
266*0Sstevel@tonic-gate
267*0Sstevel@tonic-gate /* extract userid; everything before last space */
268*0Sstevel@tonic-gate pos = clientinlen-1;
269*0Sstevel@tonic-gate while ((pos > 0) && (clientin[pos] != ' ')) pos--;
270*0Sstevel@tonic-gate
271*0Sstevel@tonic-gate if (pos <= 0) {
272*0Sstevel@tonic-gate #ifdef _SUN_SDK_
273*0Sstevel@tonic-gate sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR,
274*0Sstevel@tonic-gate "need authentication name");
275*0Sstevel@tonic-gate #else
276*0Sstevel@tonic-gate SETERROR( sparams->utils,"need authentication name");
277*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
278*0Sstevel@tonic-gate return SASL_BADPROT;
279*0Sstevel@tonic-gate }
280*0Sstevel@tonic-gate
281*0Sstevel@tonic-gate userid = (char *) sparams->utils->malloc(pos+1);
282*0Sstevel@tonic-gate if (userid == NULL) {
283*0Sstevel@tonic-gate MEMERROR( sparams->utils);
284*0Sstevel@tonic-gate return SASL_NOMEM;
285*0Sstevel@tonic-gate }
286*0Sstevel@tonic-gate
287*0Sstevel@tonic-gate /* copy authstr out */
288*0Sstevel@tonic-gate memcpy(userid, clientin, pos);
289*0Sstevel@tonic-gate userid[pos] = '\0';
290*0Sstevel@tonic-gate
291*0Sstevel@tonic-gate result = sparams->utils->prop_request(sparams->propctx, password_request);
292*0Sstevel@tonic-gate if (result != SASL_OK) goto done;
293*0Sstevel@tonic-gate
294*0Sstevel@tonic-gate /* this will trigger the getting of the aux properties */
295*0Sstevel@tonic-gate result = sparams->canon_user(sparams->utils->conn,
296*0Sstevel@tonic-gate userid, 0, SASL_CU_AUTHID | SASL_CU_AUTHZID,
297*0Sstevel@tonic-gate oparams);
298*0Sstevel@tonic-gate if (result != SASL_OK) goto done;
299*0Sstevel@tonic-gate
300*0Sstevel@tonic-gate result = sparams->utils->prop_getnames(sparams->propctx,
301*0Sstevel@tonic-gate password_request,
302*0Sstevel@tonic-gate auxprop_values);
303*0Sstevel@tonic-gate if (result < 0 ||
304*0Sstevel@tonic-gate ((!auxprop_values[0].name || !auxprop_values[0].values) &&
305*0Sstevel@tonic-gate (!auxprop_values[1].name || !auxprop_values[1].values))) {
306*0Sstevel@tonic-gate /* We didn't find this username */
307*0Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
308*0Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn,0,
309*0Sstevel@tonic-gate gettext("no secret in database"));
310*0Sstevel@tonic-gate #else
311*0Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn,0,
312*0Sstevel@tonic-gate "no secret in database");
313*0Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
314*0Sstevel@tonic-gate result = SASL_NOUSER;
315*0Sstevel@tonic-gate goto done;
316*0Sstevel@tonic-gate }
317*0Sstevel@tonic-gate
318*0Sstevel@tonic-gate if (auxprop_values[0].name && auxprop_values[0].values) {
319*0Sstevel@tonic-gate len = strlen(auxprop_values[0].values[0]);
320*0Sstevel@tonic-gate if (len == 0) {
321*0Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
322*0Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn,0,
323*0Sstevel@tonic-gate gettext("empty secret"));
324*0Sstevel@tonic-gate #else
325*0Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn,0,
326*0Sstevel@tonic-gate "empty secret");
327*0Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
328*0Sstevel@tonic-gate result = SASL_FAIL;
329*0Sstevel@tonic-gate goto done;
330*0Sstevel@tonic-gate }
331*0Sstevel@tonic-gate
332*0Sstevel@tonic-gate sec = sparams->utils->malloc(sizeof(sasl_secret_t) + len);
333*0Sstevel@tonic-gate if (!sec) goto done;
334*0Sstevel@tonic-gate
335*0Sstevel@tonic-gate sec->len = len;
336*0Sstevel@tonic-gate #ifdef _SUN_SDK_
337*0Sstevel@tonic-gate strncpy((char *)sec->data, auxprop_values[0].values[0], len + 1);
338*0Sstevel@tonic-gate #else
339*0Sstevel@tonic-gate strncpy(sec->data, auxprop_values[0].values[0], len + 1);
340*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
341*0Sstevel@tonic-gate
342*0Sstevel@tonic-gate clear_md5state = 1;
343*0Sstevel@tonic-gate /* Do precalculation on plaintext secret */
344*0Sstevel@tonic-gate sparams->utils->hmac_md5_precalc(&md5state, /* OUT */
345*0Sstevel@tonic-gate sec->data,
346*0Sstevel@tonic-gate sec->len);
347*0Sstevel@tonic-gate } else if (auxprop_values[1].name && auxprop_values[1].values) {
348*0Sstevel@tonic-gate /* We have a precomputed secret */
349*0Sstevel@tonic-gate memcpy(&md5state, auxprop_values[1].values[0],
350*0Sstevel@tonic-gate sizeof(HMAC_MD5_STATE));
351*0Sstevel@tonic-gate } else {
352*0Sstevel@tonic-gate #ifdef _SUN_SDK_
353*0Sstevel@tonic-gate sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR,
354*0Sstevel@tonic-gate "Have neither type of secret");
355*0Sstevel@tonic-gate #else
356*0Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn, 0,
357*0Sstevel@tonic-gate "Have neither type of secret");
358*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
359*0Sstevel@tonic-gate return SASL_FAIL;
360*0Sstevel@tonic-gate }
361*0Sstevel@tonic-gate
362*0Sstevel@tonic-gate /* ok this is annoying:
363*0Sstevel@tonic-gate so we have this half-way hmac transform instead of the plaintext
364*0Sstevel@tonic-gate that means we half to:
365*0Sstevel@tonic-gate -import it back into a md5 context
366*0Sstevel@tonic-gate -do an md5update with the nonce
367*0Sstevel@tonic-gate -finalize it
368*0Sstevel@tonic-gate */
369*0Sstevel@tonic-gate sparams->utils->hmac_md5_import(&tmphmac, (HMAC_MD5_STATE *) &md5state);
370*0Sstevel@tonic-gate sparams->utils->MD5Update(&(tmphmac.ictx),
371*0Sstevel@tonic-gate (const unsigned char *) text->challenge,
372*0Sstevel@tonic-gate strlen(text->challenge));
373*0Sstevel@tonic-gate sparams->utils->hmac_md5_final((unsigned char *) &digest, &tmphmac);
374*0Sstevel@tonic-gate
375*0Sstevel@tonic-gate /* convert to base 16 with lower case letters */
376*0Sstevel@tonic-gate digest_str = convert16((unsigned char *) digest, 16, sparams->utils);
377*0Sstevel@tonic-gate
378*0Sstevel@tonic-gate /* if same then verified
379*0Sstevel@tonic-gate * - we know digest_str is null terminated but clientin might not be
380*0Sstevel@tonic-gate */
381*0Sstevel@tonic-gate if (strncmp(digest_str, clientin+pos+1, strlen(digest_str)) != 0) {
382*0Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
383*0Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn, 0,
384*0Sstevel@tonic-gate gettext("incorrect digest response"));
385*0Sstevel@tonic-gate #else
386*0Sstevel@tonic-gate sparams->utils->seterror(sparams->utils->conn, 0,
387*0Sstevel@tonic-gate "incorrect digest response");
388*0Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
389*0Sstevel@tonic-gate result = SASL_BADAUTH;
390*0Sstevel@tonic-gate goto done;
391*0Sstevel@tonic-gate }
392*0Sstevel@tonic-gate
393*0Sstevel@tonic-gate /* set oparams */
394*0Sstevel@tonic-gate oparams->doneflag = 1;
395*0Sstevel@tonic-gate oparams->mech_ssf = 0;
396*0Sstevel@tonic-gate oparams->maxoutbuf = 0;
397*0Sstevel@tonic-gate oparams->encode_context = NULL;
398*0Sstevel@tonic-gate oparams->encode = NULL;
399*0Sstevel@tonic-gate oparams->decode_context = NULL;
400*0Sstevel@tonic-gate oparams->decode = NULL;
401*0Sstevel@tonic-gate oparams->param_version = 0;
402*0Sstevel@tonic-gate
403*0Sstevel@tonic-gate result = SASL_OK;
404*0Sstevel@tonic-gate
405*0Sstevel@tonic-gate done:
406*0Sstevel@tonic-gate if (userid) sparams->utils->free(userid);
407*0Sstevel@tonic-gate if (sec) _plug_free_secret(sparams->utils, &sec);
408*0Sstevel@tonic-gate
409*0Sstevel@tonic-gate if (digest_str) sparams->utils->free(digest_str);
410*0Sstevel@tonic-gate if (clear_md5state) memset(&md5state, 0, sizeof(md5state));
411*0Sstevel@tonic-gate
412*0Sstevel@tonic-gate return result;
413*0Sstevel@tonic-gate }
414*0Sstevel@tonic-gate
crammd5_server_mech_step(void * conn_context,sasl_server_params_t * sparams,const char * clientin,unsigned clientinlen,const char ** serverout,unsigned * serveroutlen,sasl_out_params_t * oparams)415*0Sstevel@tonic-gate static int crammd5_server_mech_step(void *conn_context,
416*0Sstevel@tonic-gate sasl_server_params_t *sparams,
417*0Sstevel@tonic-gate const char *clientin,
418*0Sstevel@tonic-gate unsigned clientinlen,
419*0Sstevel@tonic-gate const char **serverout,
420*0Sstevel@tonic-gate unsigned *serveroutlen,
421*0Sstevel@tonic-gate sasl_out_params_t *oparams)
422*0Sstevel@tonic-gate {
423*0Sstevel@tonic-gate server_context_t *text = (server_context_t *) conn_context;
424*0Sstevel@tonic-gate
425*0Sstevel@tonic-gate *serverout = NULL;
426*0Sstevel@tonic-gate *serveroutlen = 0;
427*0Sstevel@tonic-gate
428*0Sstevel@tonic-gate /* this should be well more than is ever needed */
429*0Sstevel@tonic-gate if (clientinlen > 1024) {
430*0Sstevel@tonic-gate #ifdef _SUN_SDK_
431*0Sstevel@tonic-gate sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR,
432*0Sstevel@tonic-gate "CRAM-MD5 input longer than 1024 bytes");
433*0Sstevel@tonic-gate #else
434*0Sstevel@tonic-gate SETERROR(sparams->utils, "CRAM-MD5 input longer than 1024 bytes");
435*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
436*0Sstevel@tonic-gate return SASL_BADPROT;
437*0Sstevel@tonic-gate }
438*0Sstevel@tonic-gate
439*0Sstevel@tonic-gate switch (text->state) {
440*0Sstevel@tonic-gate
441*0Sstevel@tonic-gate case 1:
442*0Sstevel@tonic-gate return crammd5_server_mech_step1(text, sparams,
443*0Sstevel@tonic-gate clientin, clientinlen,
444*0Sstevel@tonic-gate serverout, serveroutlen,
445*0Sstevel@tonic-gate oparams);
446*0Sstevel@tonic-gate
447*0Sstevel@tonic-gate case 2:
448*0Sstevel@tonic-gate return crammd5_server_mech_step2(text, sparams,
449*0Sstevel@tonic-gate clientin, clientinlen,
450*0Sstevel@tonic-gate serverout, serveroutlen,
451*0Sstevel@tonic-gate oparams);
452*0Sstevel@tonic-gate
453*0Sstevel@tonic-gate default: /* should never get here */
454*0Sstevel@tonic-gate #ifdef _SUN_SDK_
455*0Sstevel@tonic-gate sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR,
456*0Sstevel@tonic-gate "Invalid CRAM-MD5 server step %d", text->state);
457*0Sstevel@tonic-gate #else
458*0Sstevel@tonic-gate sparams->utils->log(NULL, SASL_LOG_ERR,
459*0Sstevel@tonic-gate "Invalid CRAM-MD5 server step %d\n", text->state);
460*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
461*0Sstevel@tonic-gate return SASL_FAIL;
462*0Sstevel@tonic-gate }
463*0Sstevel@tonic-gate
464*0Sstevel@tonic-gate #ifndef _SUN_SDK_
465*0Sstevel@tonic-gate return SASL_FAIL; /* should never get here */
466*0Sstevel@tonic-gate #endif /* !_SUN_SDK_ */
467*0Sstevel@tonic-gate }
468*0Sstevel@tonic-gate
crammd5_server_mech_dispose(void * conn_context,const sasl_utils_t * utils)469*0Sstevel@tonic-gate static void crammd5_server_mech_dispose(void *conn_context,
470*0Sstevel@tonic-gate const sasl_utils_t *utils)
471*0Sstevel@tonic-gate {
472*0Sstevel@tonic-gate server_context_t *text = (server_context_t *) conn_context;
473*0Sstevel@tonic-gate
474*0Sstevel@tonic-gate if (!text) return;
475*0Sstevel@tonic-gate
476*0Sstevel@tonic-gate if (text->challenge) _plug_free_string(utils,&(text->challenge));
477*0Sstevel@tonic-gate
478*0Sstevel@tonic-gate utils->free(text);
479*0Sstevel@tonic-gate }
480*0Sstevel@tonic-gate
481*0Sstevel@tonic-gate static sasl_server_plug_t crammd5_server_plugins[] =
482*0Sstevel@tonic-gate {
483*0Sstevel@tonic-gate {
484*0Sstevel@tonic-gate "CRAM-MD5", /* mech_name */
485*0Sstevel@tonic-gate 0, /* max_ssf */
486*0Sstevel@tonic-gate SASL_SEC_NOPLAINTEXT
487*0Sstevel@tonic-gate | SASL_SEC_NOANONYMOUS, /* security_flags */
488*0Sstevel@tonic-gate SASL_FEAT_SERVER_FIRST, /* features */
489*0Sstevel@tonic-gate NULL, /* glob_context */
490*0Sstevel@tonic-gate &crammd5_server_mech_new, /* mech_new */
491*0Sstevel@tonic-gate &crammd5_server_mech_step, /* mech_step */
492*0Sstevel@tonic-gate &crammd5_server_mech_dispose, /* mech_dispose */
493*0Sstevel@tonic-gate NULL, /* mech_free */
494*0Sstevel@tonic-gate NULL, /* setpass */
495*0Sstevel@tonic-gate NULL, /* user_query */
496*0Sstevel@tonic-gate NULL, /* idle */
497*0Sstevel@tonic-gate NULL, /* mech avail */
498*0Sstevel@tonic-gate NULL /* spare */
499*0Sstevel@tonic-gate }
500*0Sstevel@tonic-gate };
501*0Sstevel@tonic-gate
crammd5_server_plug_init(const sasl_utils_t * utils,int maxversion,int * out_version,sasl_server_plug_t ** pluglist,int * plugcount)502*0Sstevel@tonic-gate int crammd5_server_plug_init(const sasl_utils_t *utils,
503*0Sstevel@tonic-gate int maxversion,
504*0Sstevel@tonic-gate int *out_version,
505*0Sstevel@tonic-gate sasl_server_plug_t **pluglist,
506*0Sstevel@tonic-gate int *plugcount)
507*0Sstevel@tonic-gate {
508*0Sstevel@tonic-gate if (maxversion < SASL_SERVER_PLUG_VERSION) {
509*0Sstevel@tonic-gate #ifdef _SUN_SDK_
510*0Sstevel@tonic-gate utils->log(NULL, SASL_LOG_ERR, "CRAM version mismatch");
511*0Sstevel@tonic-gate #else
512*0Sstevel@tonic-gate SETERROR( utils, "CRAM version mismatch");
513*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
514*0Sstevel@tonic-gate return SASL_BADVERS;
515*0Sstevel@tonic-gate }
516*0Sstevel@tonic-gate
517*0Sstevel@tonic-gate *out_version = SASL_SERVER_PLUG_VERSION;
518*0Sstevel@tonic-gate *pluglist = crammd5_server_plugins;
519*0Sstevel@tonic-gate *plugcount = 1;
520*0Sstevel@tonic-gate
521*0Sstevel@tonic-gate return SASL_OK;
522*0Sstevel@tonic-gate }
523*0Sstevel@tonic-gate
524*0Sstevel@tonic-gate /***************************** Client Section *****************************/
525*0Sstevel@tonic-gate
526*0Sstevel@tonic-gate typedef struct client_context {
527*0Sstevel@tonic-gate char *out_buf;
528*0Sstevel@tonic-gate unsigned out_buf_len;
529*0Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
530*0Sstevel@tonic-gate void *h;
531*0Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
532*0Sstevel@tonic-gate } client_context_t;
533*0Sstevel@tonic-gate
crammd5_client_mech_new(void * glob_context,sasl_client_params_t * params,void ** conn_context)534*0Sstevel@tonic-gate static int crammd5_client_mech_new(void *glob_context __attribute__((unused)),
535*0Sstevel@tonic-gate sasl_client_params_t *params,
536*0Sstevel@tonic-gate void **conn_context)
537*0Sstevel@tonic-gate {
538*0Sstevel@tonic-gate client_context_t *text;
539*0Sstevel@tonic-gate
540*0Sstevel@tonic-gate /* holds state are in */
541*0Sstevel@tonic-gate text = params->utils->malloc(sizeof(client_context_t));
542*0Sstevel@tonic-gate if (text == NULL) {
543*0Sstevel@tonic-gate MEMERROR(params->utils);
544*0Sstevel@tonic-gate return SASL_NOMEM;
545*0Sstevel@tonic-gate }
546*0Sstevel@tonic-gate
547*0Sstevel@tonic-gate memset(text, 0, sizeof(client_context_t));
548*0Sstevel@tonic-gate
549*0Sstevel@tonic-gate *conn_context = text;
550*0Sstevel@tonic-gate
551*0Sstevel@tonic-gate return SASL_OK;
552*0Sstevel@tonic-gate }
553*0Sstevel@tonic-gate
make_hashed(sasl_secret_t * sec,char * nonce,int noncelen,const sasl_utils_t * utils)554*0Sstevel@tonic-gate static char *make_hashed(sasl_secret_t *sec, char *nonce, int noncelen,
555*0Sstevel@tonic-gate const sasl_utils_t *utils)
556*0Sstevel@tonic-gate {
557*0Sstevel@tonic-gate char secret[65];
558*0Sstevel@tonic-gate unsigned char digest[24];
559*0Sstevel@tonic-gate int lup;
560*0Sstevel@tonic-gate char *in16;
561*0Sstevel@tonic-gate
562*0Sstevel@tonic-gate if (sec == NULL) return NULL;
563*0Sstevel@tonic-gate
564*0Sstevel@tonic-gate if (sec->len < 64) {
565*0Sstevel@tonic-gate memcpy(secret, sec->data, sec->len);
566*0Sstevel@tonic-gate
567*0Sstevel@tonic-gate /* fill in rest with 0's */
568*0Sstevel@tonic-gate for (lup= sec->len; lup < 64; lup++)
569*0Sstevel@tonic-gate secret[lup]='\0';
570*0Sstevel@tonic-gate
571*0Sstevel@tonic-gate } else {
572*0Sstevel@tonic-gate memcpy(secret, sec->data, 64);
573*0Sstevel@tonic-gate }
574*0Sstevel@tonic-gate
575*0Sstevel@tonic-gate /* do the hmac md5 hash output 128 bits */
576*0Sstevel@tonic-gate utils->hmac_md5((unsigned char *) nonce, noncelen,
577*0Sstevel@tonic-gate (unsigned char *) secret, 64, digest);
578*0Sstevel@tonic-gate
579*0Sstevel@tonic-gate /* convert that to hex form */
580*0Sstevel@tonic-gate in16 = convert16(digest, 16, utils);
581*0Sstevel@tonic-gate if (in16 == NULL) return NULL;
582*0Sstevel@tonic-gate
583*0Sstevel@tonic-gate return in16;
584*0Sstevel@tonic-gate }
585*0Sstevel@tonic-gate
crammd5_client_mech_step(void * conn_context,sasl_client_params_t * params,const char * serverin,unsigned serverinlen,sasl_interact_t ** prompt_need,const char ** clientout,unsigned * clientoutlen,sasl_out_params_t * oparams)586*0Sstevel@tonic-gate static int crammd5_client_mech_step(void *conn_context,
587*0Sstevel@tonic-gate sasl_client_params_t *params,
588*0Sstevel@tonic-gate const char *serverin,
589*0Sstevel@tonic-gate unsigned serverinlen,
590*0Sstevel@tonic-gate sasl_interact_t **prompt_need,
591*0Sstevel@tonic-gate const char **clientout,
592*0Sstevel@tonic-gate unsigned *clientoutlen,
593*0Sstevel@tonic-gate sasl_out_params_t *oparams)
594*0Sstevel@tonic-gate {
595*0Sstevel@tonic-gate client_context_t *text = (client_context_t *) conn_context;
596*0Sstevel@tonic-gate const char *authid;
597*0Sstevel@tonic-gate sasl_secret_t *password = NULL;
598*0Sstevel@tonic-gate unsigned int free_password = 0; /* set if we need to free password */
599*0Sstevel@tonic-gate int auth_result = SASL_OK;
600*0Sstevel@tonic-gate int pass_result = SASL_OK;
601*0Sstevel@tonic-gate int result;
602*0Sstevel@tonic-gate int maxsize;
603*0Sstevel@tonic-gate char *in16 = NULL;
604*0Sstevel@tonic-gate
605*0Sstevel@tonic-gate *clientout = NULL;
606*0Sstevel@tonic-gate *clientoutlen = 0;
607*0Sstevel@tonic-gate
608*0Sstevel@tonic-gate /* First check for absurd lengths */
609*0Sstevel@tonic-gate if (serverinlen > 1024) {
610*0Sstevel@tonic-gate #ifdef _SUN_SDK_
611*0Sstevel@tonic-gate params->utils->log(params->utils->conn, SASL_LOG_ERR,
612*0Sstevel@tonic-gate "CRAM-MD5 input longer than 1024 bytes");
613*0Sstevel@tonic-gate #else
614*0Sstevel@tonic-gate params->utils->seterror(params->utils->conn, 0,
615*0Sstevel@tonic-gate "CRAM-MD5 input longer than 1024 bytes");
616*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
617*0Sstevel@tonic-gate return SASL_BADPROT;
618*0Sstevel@tonic-gate }
619*0Sstevel@tonic-gate
620*0Sstevel@tonic-gate /* check if sec layer strong enough */
621*0Sstevel@tonic-gate if (params->props.min_ssf > params->external_ssf) {
622*0Sstevel@tonic-gate #ifdef _SUN_SDK_
623*0Sstevel@tonic-gate params->utils->log(params->utils->conn, SASL_LOG_ERR,
624*0Sstevel@tonic-gate "SSF requested of CRAM-MD5 plugin");
625*0Sstevel@tonic-gate #else
626*0Sstevel@tonic-gate SETERROR( params->utils, "SSF requested of CRAM-MD5 plugin");
627*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
628*0Sstevel@tonic-gate return SASL_TOOWEAK;
629*0Sstevel@tonic-gate }
630*0Sstevel@tonic-gate
631*0Sstevel@tonic-gate /* try to get the userid */
632*0Sstevel@tonic-gate if (oparams->authid == NULL) {
633*0Sstevel@tonic-gate auth_result=_plug_get_authid(params->utils, &authid, prompt_need);
634*0Sstevel@tonic-gate
635*0Sstevel@tonic-gate if ((auth_result != SASL_OK) && (auth_result != SASL_INTERACT))
636*0Sstevel@tonic-gate return auth_result;
637*0Sstevel@tonic-gate }
638*0Sstevel@tonic-gate
639*0Sstevel@tonic-gate /* try to get the password */
640*0Sstevel@tonic-gate if (password == NULL) {
641*0Sstevel@tonic-gate pass_result=_plug_get_password(params->utils, &password,
642*0Sstevel@tonic-gate &free_password, prompt_need);
643*0Sstevel@tonic-gate
644*0Sstevel@tonic-gate if ((pass_result != SASL_OK) && (pass_result != SASL_INTERACT))
645*0Sstevel@tonic-gate return pass_result;
646*0Sstevel@tonic-gate }
647*0Sstevel@tonic-gate
648*0Sstevel@tonic-gate /* free prompts we got */
649*0Sstevel@tonic-gate if (prompt_need && *prompt_need) {
650*0Sstevel@tonic-gate params->utils->free(*prompt_need);
651*0Sstevel@tonic-gate *prompt_need = NULL;
652*0Sstevel@tonic-gate }
653*0Sstevel@tonic-gate
654*0Sstevel@tonic-gate /* if there are prompts not filled in */
655*0Sstevel@tonic-gate if ((auth_result == SASL_INTERACT) || (pass_result == SASL_INTERACT)) {
656*0Sstevel@tonic-gate /* make the prompt list */
657*0Sstevel@tonic-gate result =
658*0Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
659*0Sstevel@tonic-gate _plug_make_prompts(params->utils, &text->h, prompt_need,
660*0Sstevel@tonic-gate NULL, NULL,
661*0Sstevel@tonic-gate auth_result == SASL_INTERACT ?
662*0Sstevel@tonic-gate convert_prompt(params->utils, &text->h,
663*0Sstevel@tonic-gate gettext("Please enter your authentication name"))
664*0Sstevel@tonic-gate : NULL, NULL,
665*0Sstevel@tonic-gate pass_result == SASL_INTERACT ?
666*0Sstevel@tonic-gate convert_prompt(params->utils, &text->h,
667*0Sstevel@tonic-gate gettext("Please enter your password"))
668*0Sstevel@tonic-gate : NULL, NULL,
669*0Sstevel@tonic-gate NULL, NULL, NULL,
670*0Sstevel@tonic-gate NULL, NULL, NULL);
671*0Sstevel@tonic-gate #else
672*0Sstevel@tonic-gate _plug_make_prompts(params->utils, prompt_need,
673*0Sstevel@tonic-gate NULL, NULL,
674*0Sstevel@tonic-gate auth_result == SASL_INTERACT ?
675*0Sstevel@tonic-gate "Please enter your authentication name" : NULL,
676*0Sstevel@tonic-gate NULL,
677*0Sstevel@tonic-gate pass_result == SASL_INTERACT ?
678*0Sstevel@tonic-gate "Please enter your password" : NULL, NULL,
679*0Sstevel@tonic-gate NULL, NULL, NULL,
680*0Sstevel@tonic-gate NULL, NULL, NULL);
681*0Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
682*0Sstevel@tonic-gate if (result != SASL_OK) goto cleanup;
683*0Sstevel@tonic-gate
684*0Sstevel@tonic-gate return SASL_INTERACT;
685*0Sstevel@tonic-gate }
686*0Sstevel@tonic-gate
687*0Sstevel@tonic-gate if (!password) {
688*0Sstevel@tonic-gate PARAMERROR(params->utils);
689*0Sstevel@tonic-gate return SASL_BADPARAM;
690*0Sstevel@tonic-gate }
691*0Sstevel@tonic-gate
692*0Sstevel@tonic-gate result = params->canon_user(params->utils->conn, authid, 0,
693*0Sstevel@tonic-gate SASL_CU_AUTHID | SASL_CU_AUTHZID, oparams);
694*0Sstevel@tonic-gate if (result != SASL_OK) goto cleanup;
695*0Sstevel@tonic-gate
696*0Sstevel@tonic-gate /*
697*0Sstevel@tonic-gate * username SP digest (keyed md5 where key is passwd)
698*0Sstevel@tonic-gate */
699*0Sstevel@tonic-gate
700*0Sstevel@tonic-gate in16 = make_hashed(password, (char *) serverin, serverinlen,
701*0Sstevel@tonic-gate params->utils);
702*0Sstevel@tonic-gate
703*0Sstevel@tonic-gate if (in16 == NULL) {
704*0Sstevel@tonic-gate #ifdef _SUN_SDK_
705*0Sstevel@tonic-gate params->utils->log(params->utils->conn, SASL_LOG_ERR,
706*0Sstevel@tonic-gate "make_hashed failed");
707*0Sstevel@tonic-gate #else
708*0Sstevel@tonic-gate SETERROR(params->utils, "whoops, make_hashed failed us this time");
709*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
710*0Sstevel@tonic-gate result = SASL_FAIL;
711*0Sstevel@tonic-gate goto cleanup;
712*0Sstevel@tonic-gate }
713*0Sstevel@tonic-gate
714*0Sstevel@tonic-gate maxsize = 32+1+strlen(oparams->authid)+30;
715*0Sstevel@tonic-gate result = _plug_buf_alloc(params->utils, &(text->out_buf),
716*0Sstevel@tonic-gate &(text->out_buf_len), maxsize);
717*0Sstevel@tonic-gate if (result != SASL_OK) goto cleanup;
718*0Sstevel@tonic-gate
719*0Sstevel@tonic-gate snprintf(text->out_buf, maxsize, "%s %s", oparams->authid, in16);
720*0Sstevel@tonic-gate
721*0Sstevel@tonic-gate *clientout = text->out_buf;
722*0Sstevel@tonic-gate *clientoutlen = strlen(*clientout);
723*0Sstevel@tonic-gate
724*0Sstevel@tonic-gate /* set oparams */
725*0Sstevel@tonic-gate oparams->doneflag = 1;
726*0Sstevel@tonic-gate oparams->mech_ssf = 0;
727*0Sstevel@tonic-gate oparams->maxoutbuf = 0;
728*0Sstevel@tonic-gate oparams->encode_context = NULL;
729*0Sstevel@tonic-gate oparams->encode = NULL;
730*0Sstevel@tonic-gate oparams->decode_context = NULL;
731*0Sstevel@tonic-gate oparams->decode = NULL;
732*0Sstevel@tonic-gate oparams->param_version = 0;
733*0Sstevel@tonic-gate
734*0Sstevel@tonic-gate result = SASL_OK;
735*0Sstevel@tonic-gate
736*0Sstevel@tonic-gate cleanup:
737*0Sstevel@tonic-gate /* get rid of private information */
738*0Sstevel@tonic-gate if (in16) _plug_free_string(params->utils, &in16);
739*0Sstevel@tonic-gate
740*0Sstevel@tonic-gate /* get rid of all sensitive info */
741*0Sstevel@tonic-gate if (free_password) _plug_free_secret(params-> utils, &password);
742*0Sstevel@tonic-gate
743*0Sstevel@tonic-gate return result;
744*0Sstevel@tonic-gate }
745*0Sstevel@tonic-gate
crammd5_client_mech_dispose(void * conn_context,const sasl_utils_t * utils)746*0Sstevel@tonic-gate static void crammd5_client_mech_dispose(void *conn_context,
747*0Sstevel@tonic-gate const sasl_utils_t *utils)
748*0Sstevel@tonic-gate {
749*0Sstevel@tonic-gate client_context_t *text = (client_context_t *) conn_context;
750*0Sstevel@tonic-gate
751*0Sstevel@tonic-gate if (!text) return;
752*0Sstevel@tonic-gate
753*0Sstevel@tonic-gate #ifdef _INTEGRATED_SOLARIS_
754*0Sstevel@tonic-gate convert_prompt(utils, &text->h, NULL);
755*0Sstevel@tonic-gate #endif /* _INTEGRATED_SOLARIS_ */
756*0Sstevel@tonic-gate if (text->out_buf) utils->free(text->out_buf);
757*0Sstevel@tonic-gate
758*0Sstevel@tonic-gate utils->free(text);
759*0Sstevel@tonic-gate }
760*0Sstevel@tonic-gate
761*0Sstevel@tonic-gate static sasl_client_plug_t crammd5_client_plugins[] =
762*0Sstevel@tonic-gate {
763*0Sstevel@tonic-gate {
764*0Sstevel@tonic-gate "CRAM-MD5", /* mech_name */
765*0Sstevel@tonic-gate 0, /* max_ssf */
766*0Sstevel@tonic-gate SASL_SEC_NOPLAINTEXT
767*0Sstevel@tonic-gate | SASL_SEC_NOANONYMOUS, /* security_flags */
768*0Sstevel@tonic-gate SASL_FEAT_SERVER_FIRST, /* features */
769*0Sstevel@tonic-gate NULL, /* required_prompts */
770*0Sstevel@tonic-gate NULL, /* glob_context */
771*0Sstevel@tonic-gate &crammd5_client_mech_new, /* mech_new */
772*0Sstevel@tonic-gate &crammd5_client_mech_step, /* mech_step */
773*0Sstevel@tonic-gate &crammd5_client_mech_dispose, /* mech_dispose */
774*0Sstevel@tonic-gate NULL, /* mech_free */
775*0Sstevel@tonic-gate NULL, /* idle */
776*0Sstevel@tonic-gate NULL, /* spare */
777*0Sstevel@tonic-gate NULL /* spare */
778*0Sstevel@tonic-gate }
779*0Sstevel@tonic-gate };
780*0Sstevel@tonic-gate
crammd5_client_plug_init(const sasl_utils_t * utils,int maxversion,int * out_version,sasl_client_plug_t ** pluglist,int * plugcount)781*0Sstevel@tonic-gate int crammd5_client_plug_init(const sasl_utils_t *utils,
782*0Sstevel@tonic-gate int maxversion,
783*0Sstevel@tonic-gate int *out_version,
784*0Sstevel@tonic-gate sasl_client_plug_t **pluglist,
785*0Sstevel@tonic-gate int *plugcount)
786*0Sstevel@tonic-gate {
787*0Sstevel@tonic-gate if (maxversion < SASL_CLIENT_PLUG_VERSION) {
788*0Sstevel@tonic-gate #ifdef _SUN_SDK_
789*0Sstevel@tonic-gate utils->log(NULL, SASL_LOG_ERR, "CRAM version mismatch");
790*0Sstevel@tonic-gate #else
791*0Sstevel@tonic-gate SETERROR( utils, "CRAM version mismatch");
792*0Sstevel@tonic-gate #endif /* _SUN_SDK_ */
793*0Sstevel@tonic-gate return SASL_BADVERS;
794*0Sstevel@tonic-gate }
795*0Sstevel@tonic-gate
796*0Sstevel@tonic-gate *out_version = SASL_CLIENT_PLUG_VERSION;
797*0Sstevel@tonic-gate *pluglist = crammd5_client_plugins;
798*0Sstevel@tonic-gate *plugcount = 1;
799*0Sstevel@tonic-gate
800*0Sstevel@tonic-gate return SASL_OK;
801*0Sstevel@tonic-gate }
802