From 8daa83a594a2e98f39d764422bfbdbc62c9efd44 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 19:20:00 +0200 Subject: Adding upstream version 2:4.20.0+dfsg. Signed-off-by: Daniel Baumann --- third_party/heimdal/lib/ntlm/digest.c | 994 ++++++++++++++++++++++++++++++++++ 1 file changed, 994 insertions(+) create mode 100644 third_party/heimdal/lib/ntlm/digest.c (limited to 'third_party/heimdal/lib/ntlm/digest.c') diff --git a/third_party/heimdal/lib/ntlm/digest.c b/third_party/heimdal/lib/ntlm/digest.c new file mode 100644 index 0000000..42c39ff --- /dev/null +++ b/third_party/heimdal/lib/ntlm/digest.c @@ -0,0 +1,994 @@ +/* + * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Portions Copyright (c) 2010 Apple Inc. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include "heim-auth.h" +#include "ntlm_err.h" + +struct heim_digest_desc { +#define F_SERVER 1 +#define F_HAVE_HASH 2 +#define F_HAVE_HA1 4 +#define F_USE_PREFIX 8 + int flags; + int type; + char *password; + uint8_t SecretHash[CC_MD5_DIGEST_LENGTH]; + char *serverNonce; + char *serverRealm; + char *serverQOP; + char *serverMethod; + char *serverMaxbuf; + char *serverOpaque; + char *clientUsername; + char *clientResponse; + char *clientURI; + char *clientRealm; + char *clientNonce; + char *clientQOP; + char *clientNC; + char *serverAlgorithm; + char *auth_id; + + /* internally allocated objects returned to caller */ + char *serverChallenge; + char *clientReply; + char *serverReply; +}; + +#define FREE_AND_CLEAR(x) do { if ((x)) { free((x)); (x) = NULL; } } while(0) +#define MEMSET_FREE_AND_CLEAR(x) do { if ((x)) { memset(x, 0, strlen(x)); free((x)); (x) = NULL; } } while(0) + +static const char digest_prefix[] = "Digest "; + +static void +clear_context(heim_digest_t context) +{ + MEMSET_FREE_AND_CLEAR(context->password); + memset(context->SecretHash, 0, sizeof(context->SecretHash)); + context->flags &= ~(F_HAVE_HASH); + FREE_AND_CLEAR(context->serverNonce); + FREE_AND_CLEAR(context->serverRealm); + FREE_AND_CLEAR(context->serverQOP); + FREE_AND_CLEAR(context->serverMethod); + FREE_AND_CLEAR(context->serverMaxbuf); + FREE_AND_CLEAR(context->serverOpaque); + FREE_AND_CLEAR(context->clientUsername); + FREE_AND_CLEAR(context->clientResponse); + FREE_AND_CLEAR(context->clientURI); + FREE_AND_CLEAR(context->clientRealm); + FREE_AND_CLEAR(context->clientNonce); + FREE_AND_CLEAR(context->clientQOP); + FREE_AND_CLEAR(context->clientNC); + FREE_AND_CLEAR(context->serverAlgorithm); + FREE_AND_CLEAR(context->auth_id); + + FREE_AND_CLEAR(context->serverChallenge); + FREE_AND_CLEAR(context->clientReply); + FREE_AND_CLEAR(context->serverReply); +} + +static void +digest_userhash(const char *user, const char *realm, const char *password, + unsigned char md[CC_MD5_DIGEST_LENGTH]) +{ + CC_MD5_CTX ctx; + + CC_MD5_Init(&ctx); + CC_MD5_Update(&ctx, user, (CC_LONG)strlen(user)); + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, realm, (CC_LONG)strlen(realm)); + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, password, (CC_LONG)strlen(password)); + CC_MD5_Final(md, &ctx); +} + +static char * +build_A1_hash(heim_digest_t context) +{ + unsigned char md[CC_MD5_DIGEST_LENGTH]; + CC_MD5_CTX ctx; + char *A1; + + if (context->flags & F_HAVE_HA1) { + memcpy(md, context->SecretHash, sizeof(md)); + } else if (context->flags & F_HAVE_HASH) { + memcpy(md, context->SecretHash, sizeof(md)); + } else if (context->password) { + if (context->clientUsername == NULL) + return NULL; + if (context->serverRealm == NULL) + return NULL; + digest_userhash(context->clientUsername, + context->serverRealm, + context->password, + md); + } else + return NULL; + + if ((context->type == HEIM_DIGEST_TYPE_RFC2617_MD5_SESS || context->type == HEIM_DIGEST_TYPE_RFC2831) && (context->flags & F_HAVE_HA1) == 0) { + if (context->serverNonce == NULL) + return NULL; + + CC_MD5_Init(&ctx); + CC_MD5_Update(&ctx, md, sizeof(md)); + memset(md, 0, sizeof(md)); + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, context->serverNonce, (CC_LONG)strlen(context->serverNonce)); + if (context->clientNonce) { + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, context->clientNonce, (CC_LONG)strlen(context->clientNonce)); + } + if (context->type == HEIM_DIGEST_TYPE_RFC2831 && context->auth_id) { + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, context->auth_id, (CC_LONG)strlen(context->auth_id)); + } + CC_MD5_Final(md, &ctx); + } + hex_encode(md, sizeof(md), &A1); + if (A1) + strlwr(A1); + + return A1; +} + +static char * +build_A2_hash(heim_digest_t context, const char *method) +{ + unsigned char md[CC_MD5_DIGEST_LENGTH]; + CC_MD5_CTX ctx; + char *A2; + + CC_MD5_Init(&ctx); + if (method) + CC_MD5_Update(&ctx, method, (CC_LONG)strlen(method)); + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, context->clientURI, (CC_LONG)strlen(context->clientURI)); + + /* conf|int */ + if (context->type == HEIM_DIGEST_TYPE_RFC2831) { + if (strcasecmp(context->clientQOP, "auth-int") == 0 || strcasecmp(context->clientQOP, "auth-conf") == 0) { + /* XXX if we have a body hash, use that */ + static char conf_zeros[] = ":00000000000000000000000000000000"; + CC_MD5_Update(&ctx, conf_zeros, sizeof(conf_zeros) - 1); + } + } else { + /* support auth-int ? */ + if (context->clientQOP && strcasecmp(context->clientQOP, "auth") != 0) + return NULL; + } + + CC_MD5_Final(md, &ctx); + + hex_encode(md, sizeof(md), &A2); + if (A2) + strlwr(A2); + + return A2; +} + +/* + * + */ + +struct md5_value { + char *mv_name; + char *mv_value; + struct md5_value *mv_next; +}; + +static void +free_values(struct md5_value *val) +{ + struct md5_value *v; + while(val) { + v = val->mv_next; + if (val->mv_name) + free(val->mv_name); + if (val->mv_value) + free(val->mv_value); + free(val); + val = v; + } +} + +/* + * Search for entry, if found, remove entry and return string to be freed. + */ + +static char * +values_find(struct md5_value **val, const char *v) +{ + struct md5_value *cur; + char *str; + + while (*val != NULL) { + if (strcasecmp(v, (*val)->mv_name) == 0) + break; + val = &(*val)->mv_next; + } + if (*val == NULL) + return NULL; + cur = *val; + *val = (*val)->mv_next; + + str = cur->mv_value; + free(cur->mv_name); + free(cur); + + return str; +} + +static int +parse_values(const char *string, struct md5_value **val) +{ + struct md5_value *v; + size_t size; + char *str, *p1, *p2; + size_t sz; + + *val = NULL; + + if ((str = strdup(string)) == NULL) + return ENOMEM; + + size = strlen(str); + + p1 = str; + + while (p1 - str < size) { + sz = strspn(p1, " \t\n\r,"); + if (p1[sz] == '\0') + break; + p1 += sz; + sz = strcspn(p1, " \t\n\r="); + if (sz == 0 || p1[sz] == '\0') + goto error; + p2 = p1 + sz; + + if ((v = malloc(sizeof(*v))) == NULL) + goto nomem; + v->mv_name = v->mv_value = NULL; + v->mv_next = *val; + *val = v; + if ((v->mv_name = malloc(p2 - p1 + 1)) == NULL) + goto nomem; + strncpy(v->mv_name, p1, p2 - p1); + v->mv_name[p2 - p1] = '\0'; + + sz = strspn(p2, " \t\n\r"); + if (p2[sz] == '\0') + goto error; + p2 += sz; + + if (*p2 != '=') + goto error; + p2++; + + sz = strspn(p2, " \t\n\r"); + if (p2[sz] == '\0') + goto error; + p2 += sz; + p1 = p2; + + if (*p2 == '"') { + p1++; + while (*p2 == '"') { + p2++; + p2 = strchr(p2, '\"'); + if (p2 == NULL) + goto error; + if (p2[0] == '\0') + goto error; + if (p2[-1] != '\\') + break; + } + } else { + sz = strcspn(p2, " \t\n\r=,"); + p2 += sz; + } + +#if 0 /* allow empty values */ + if (p1 == p2) + goto error; +#endif + + if ((v->mv_value = malloc(p2 - p1 + 1)) == NULL) + goto nomem; + strncpy(v->mv_value, p1, p2 - p1); + v->mv_value[p2 - p1] = '\0'; + + if (p2[0] == '\0') + break; + if (p2[0] == '"') + p2++; + + sz = strspn(p2, " \t\n\r"); + if (p2[sz] == '\0') + break; + p2 += sz; + + if (p2[0] == '\0') + break; + if (p2[0] != ',') + goto error; + p1 = p2; + } + + free(str); + + return 0; + error: + free_values(*val); + *val = NULL; + free(str); + return EINVAL; + nomem: + free_values(*val); + *val = NULL; + free(str); + return ENOMEM; +} + +/* + * + */ + +static const char * +check_prefix(heim_digest_t context, const char *challenge) +{ + if (strncasecmp(digest_prefix, challenge, sizeof(digest_prefix) - 1) == 0) { + + challenge += sizeof(digest_prefix) - 1; + while (*challenge == 0x20) /* remove extra space */ + challenge++; + context->flags |= F_USE_PREFIX; + } + + return challenge; +} + +/* + * + */ + +heim_digest_t +heim_digest_create(int server, int type) +{ + heim_digest_t context; + + context = calloc(1, sizeof(*context)); + if (context == NULL) + return NULL; + context->flags |= F_SERVER; + context->type = type; + + return context; +} + +static char * +generate_nonce(void) +{ + uint8_t rand[8]; + char *nonce; + + if (CCRandomCopyBytes(kCCRandomDefault, rand, sizeof(rand)) != kCCSuccess) + return NULL; + + if (rk_hex_encode(rand, sizeof(rand), &nonce) < 0) + return NULL; + + return nonce; +} + +/** + * Generate a challange, needs to set serverRealm before calling this function. + * + * If type is set to HEIM_DIGEST_TYPE_AUTO, the HEIM_DIGEST_TYPE_RFC2831 will be used instead. + * + * For RFC2617 and RFC2831 QOP is required, so if any qop other then "auth" is requested, it need to be set with heim_diest_set_key(). + * + * @return returns the challenge or NULL on error or failure to build the string. the lifetime + * of the string is manage by heim_digest and last until the the context is + * freed or until next call to heim_digest_generate_challenge(). + */ + +const char * +heim_digest_generate_challenge(heim_digest_t context) +{ + char *challenge = NULL; + + if (context->serverRealm == NULL) + return NULL; + + if (context->serverNonce == NULL) { + if ((context->serverNonce = generate_nonce()) == NULL) + return NULL; + } + + if (context->serverQOP == NULL) { + if ((context->serverQOP = strdup("auth")) == NULL) + return NULL; + } + + if (context->serverMaxbuf == NULL) { + if ((context->serverMaxbuf = strdup("65536")) == NULL) + return NULL; + } + + switch(context->type) { + case HEIM_DIGEST_TYPE_RFC2617_MD5: + asprintf(&challenge, "realm=\"%s\",nonce=\"%s\",algorithm=md5,qop=\"%s\"", + context->serverRealm, context->serverNonce, + context->serverQOP); + break; + case HEIM_DIGEST_TYPE_RFC2617_MD5_SESS: + asprintf(&challenge, "realm=\"%s\",nonce=\"%s\",algorithm=md5-sess,qop=\"%s\"", + context->serverRealm, context->serverNonce, context->serverQOP); + break; + case HEIM_DIGEST_TYPE_RFC2069: + asprintf(&challenge, "realm=\"%s\",nonce=\"%s\"", + context->serverRealm, context->serverNonce); + break; + case HEIM_DIGEST_TYPE_AUTO: + context->type = HEIM_DIGEST_TYPE_RFC2831; + HEIM_FALLTHROUGH; + case HEIM_DIGEST_TYPE_RFC2831: + asprintf(&challenge, "realm=\"%s\",nonce=\"%s\",qop=\"%s\",algorithm=md5-sess,charset=utf-8,maxbuf=%s", + context->serverRealm, context->serverNonce, context->serverQOP, context->serverMaxbuf); + break; + } + + FREE_AND_CLEAR(context->serverChallenge); + context->serverChallenge = challenge; + + return challenge; +} + +int +heim_digest_parse_challenge(heim_digest_t context, const char *challenge) +{ + struct md5_value *val = NULL; + int ret, type; + + challenge = check_prefix(context, challenge); + + ret = parse_values(challenge, &val); + if (ret) + goto out; + + ret = 1; + + context->serverNonce = values_find(&val, "nonce"); + if (context->serverNonce == NULL) goto out; + + context->serverRealm = values_find(&val, "realm"); + if (context->serverRealm == NULL) goto out; + + /* check alg */ + + context->serverAlgorithm = values_find(&val, "algorithm"); + if (context->serverAlgorithm == NULL || strcasecmp(context->serverAlgorithm, "md5") == 0) { + type = HEIM_DIGEST_TYPE_RFC2617_MD5; + } else if (strcasecmp(context->serverAlgorithm, "md5-sess") == 0) { + type = HEIM_DIGEST_TYPE_RFC2617_OR_RFC2831; + } else { + goto out; + } + + context->serverQOP = values_find(&val, "qop"); + if (context->serverQOP == NULL) + type = HEIM_DIGEST_TYPE_RFC2069; + + context->serverOpaque = values_find(&val, "opaque"); + + if (context->type != HEIM_DIGEST_TYPE_AUTO && (context->type & type) == 0) + goto out; + else if (context->type == HEIM_DIGEST_TYPE_AUTO) + context->type = type; + + ret = 0; + out: + free_values(val); + if (ret) + clear_context(context); + return ret; +} + + +static void +set_auth_method(heim_digest_t context) +{ + + if (context->serverMethod == NULL) { + if (context->type == HEIM_DIGEST_TYPE_RFC2831) + context->serverMethod = strdup("AUTHENTICATE"); + else + context->serverMethod = strdup("GET"); + } +} + +int +heim_digest_parse_response(heim_digest_t context, const char *response) +{ + struct md5_value *val = NULL; + char *nonce; + int ret; + + response = check_prefix(context, response); + + ret = parse_values(response, &val); + if (ret) + goto out; + + ret = 1; + + if (context->type == HEIM_DIGEST_TYPE_AUTO) { + goto out; + } else if (context->type == HEIM_DIGEST_TYPE_RFC2617_OR_RFC2831) { + context->clientURI = values_find(&val, "uri"); + if (context->clientURI) { + context->type = HEIM_DIGEST_TYPE_RFC2617_MD5_SESS; + } else { + context->clientURI = values_find(&val, "digest-uri"); + context->type = HEIM_DIGEST_TYPE_RFC2831; + } + } else if (context->type == HEIM_DIGEST_TYPE_RFC2831) { + context->clientURI = values_find(&val, "digest-uri"); + } else { + context->clientURI = values_find(&val, "uri"); + } + + if (context->clientURI == NULL) + goto out; + + context->clientUsername = values_find(&val, "username"); + if (context->clientUsername == NULL) goto out; + + /* if client sent realm, make sure its the same of serverRealm if its set */ + context->clientRealm = values_find(&val, "realm"); + if (context->clientRealm && context->serverRealm && strcmp(context->clientRealm, context->serverRealm) != 0) + goto out; + + context->clientResponse = values_find(&val, "response"); + if (context->clientResponse == NULL) goto out; + + nonce = values_find(&val, "nonce"); + if (nonce == NULL) goto out; + + if (strcmp(nonce, context->serverNonce) != 0) { + free(nonce); + goto out; + } + free(nonce); + + if (context->type != HEIM_DIGEST_TYPE_RFC2069) { + + context->clientQOP = values_find(&val, "qop"); + if (context->clientQOP == NULL) goto out; + + /* + * If we have serverQOP, lets check that clientQOP exists + * in the list of server entries. + */ + + if (context->serverQOP) { + Boolean found = false; + char *b, *e; + size_t len, clen = strlen(context->clientQOP); + + b = context->serverQOP; + while (b && !found) { + e = strchr(b, ','); + if (e == NULL) + len = strlen(b); + else { + len = e - b; + e += 1; + } + if (clen == len && strncmp(b, context->clientQOP, len) == 0) + found = true; + b = e; + } + if (!found) + goto out; + } + + context->clientNC = values_find(&val, "nc"); + if (context->clientNC == NULL) goto out; + + context->clientNonce = values_find(&val, "cnonce"); + if (context->clientNonce == NULL) goto out; + } + + set_auth_method(context); + + ret = 0; + out: + free_values(val); + return ret; +} + +char * +heim_digest_userhash(const char *user, const char *realm, const char *password) +{ + unsigned char md[CC_MD5_DIGEST_LENGTH]; + char *str = NULL; + + digest_userhash(user, realm, password, md); + + hex_encode(md, sizeof(md), &str); + if (str) + strlwr(str); + return str; +} + +static char * +build_digest(heim_digest_t context, const char *a1, const char *method) +{ + CC_MD5_CTX ctx; + uint8_t md[CC_MD5_DIGEST_LENGTH]; + char *a2, *str = NULL; + + a2 = build_A2_hash(context, method); + if (a2 == NULL) + return NULL; + + CC_MD5_Init(&ctx); + CC_MD5_Update(&ctx, a1, (CC_LONG)strlen(a1)); + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, context->serverNonce, (CC_LONG)strlen(context->serverNonce)); + if (context->type != HEIM_DIGEST_TYPE_RFC2069) { + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, context->clientNC, (CC_LONG)strlen(context->clientNC)); + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, context->clientNonce, (CC_LONG)strlen(context->clientNonce)); + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, context->clientQOP, (CC_LONG)strlen(context->clientQOP)); + } + CC_MD5_Update(&ctx, ":", 1); + CC_MD5_Update(&ctx, a2, (CC_LONG)strlen(a2)); + CC_MD5_Final(md, &ctx); + + free(a2); + + hex_encode(md, sizeof(md), &str); + if (str) + strlwr(str); + + return str; +} + +static void +build_server_response(heim_digest_t context, char *a1, char **response) +{ + char *str; + + str = build_digest(context, a1, NULL); + if (str == NULL) + return; + + FREE_AND_CLEAR(context->serverReply); + asprintf(&context->serverReply, "%srspauth=%s", + (context->flags & F_USE_PREFIX) ? digest_prefix : "", + str); + free(str); + if (response) + *response = context->serverReply; +} + + +/** + * Create response from server to client to server, server verification is in response. + * clientUsername and clientURI have to be given. + * If realm is not set, its used from server. + */ + +const char * +heim_digest_create_response(heim_digest_t context, char **response) +{ + char *a1, *str, *cnonce = NULL, *opaque = NULL, *uri = NULL, *nc = NULL; + + if (response) + *response = NULL; + + if (context->clientUsername == NULL || context->clientURI == NULL) + return NULL; + + if (context->clientRealm == NULL) { + if (context->serverRealm == NULL) + return NULL; + if ((context->clientRealm = strdup(context->serverRealm)) == NULL) + return NULL; + } + + if (context->type != HEIM_DIGEST_TYPE_RFC2069) { + if (context->clientNC == NULL) { + if ((context->clientNC = strdup("00000001")) == NULL) + return NULL; + } + if (context->clientNonce == NULL) { + if ((context->clientNonce = generate_nonce()) == NULL) + return NULL; + } + + /** + * If using non RFC2069, appropriate QOP should be set. + * + * Pick QOP from server if not given, if its a list, pick the first entry + */ + if (context->clientQOP == NULL) { + char *r; + if (context->serverQOP == NULL) + return NULL; + r = strchr(context->serverQOP, ','); + if (r == NULL) { + if ((context->clientQOP = strdup(context->serverQOP)) == NULL) + return NULL; + } else { + size_t len = (r - context->serverQOP) + 1; + if ((context->clientQOP = malloc(len)) == NULL) + return NULL; + strlcpy(context->clientQOP, context->serverQOP, len); + } + } + } + + set_auth_method(context); + + a1 = build_A1_hash(context); + if (a1 == NULL) + return NULL; + + str = build_digest(context, a1, context->serverMethod); + if (str == NULL) { + MEMSET_FREE_AND_CLEAR(a1); + return NULL; + } + + MEMSET_FREE_AND_CLEAR(context->clientResponse); + context->clientResponse = str; + + if (context->clientURI) { + const char *name = "digest-uri"; + if (context->type != HEIM_DIGEST_TYPE_RFC2831) + name = "uri"; + asprintf(&uri, ",%s=\"%s\"", name, context->clientURI); + } + + if (context->serverOpaque) + asprintf(&opaque, ",opaque=\"%s\"", context->serverOpaque); + + if (context->clientNonce) + asprintf(&cnonce, ",cnonce=\"%s\"", context->clientNonce); + + if (context->clientNC) + asprintf(&nc, ",nc=%s", context->clientNC); + + asprintf(&context->clientReply, + "username=%s,realm=%s,nonce=\"%s\",qop=\"%s\"%s%s%s,response=\"%s\"%s", + context->clientUsername, context->clientRealm, + context->serverNonce, + context->clientQOP, + uri ? uri : "", + cnonce ? cnonce : "", + nc ? nc : "", + context->clientResponse, + opaque ? opaque : ""); + + build_server_response(context, a1, response); + MEMSET_FREE_AND_CLEAR(a1); + FREE_AND_CLEAR(uri); + FREE_AND_CLEAR(opaque); + FREE_AND_CLEAR(cnonce); + FREE_AND_CLEAR(nc); + + return context->clientReply; +} + +int +heim_digest_verify(heim_digest_t context, char **response) +{ + char *a1; + char *str; + int res; + + if (response) + *response = NULL; + + set_auth_method(context); + + a1 = build_A1_hash(context); + if (a1 == NULL) + return ENOMEM; + + str = build_digest(context, a1, context->serverMethod); + if (str == NULL) { + MEMSET_FREE_AND_CLEAR(a1); + return ENOMEM; + } + + res = (strcmp(str, context->clientResponse) == 0) ? 0 : EINVAL; + free(str); + if (res) { + MEMSET_FREE_AND_CLEAR(a1); + return res; + } + + /* build server_response */ + build_server_response(context, a1, response); + MEMSET_FREE_AND_CLEAR(a1); + /* XXX break ABI and return internally allocated string instead */ + if (response) + *response = strdup(*response); + + return 0; +} + +/** + * Create a rspauth= response. + * Assumes that the A1hash/password serverNonce, clientNC, clientNonce, clientQOP is set. + * + * @return the rspauth string (including rspauth), return key are stored in serverReply and will be invalid after another call to heim_digest_* + */ + +const char * +heim_digest_server_response(heim_digest_t context) +{ + char *a1; + + if (context->serverNonce == NULL) + return NULL; + if (context->clientURI == NULL) + return NULL; + + a1 = build_A1_hash(context); + if (a1 == NULL) + return NULL; + + build_server_response(context, a1, NULL); + MEMSET_FREE_AND_CLEAR(a1); + + return context->serverReply; +} + +void +heim_digest_get_session_key(heim_digest_t context, void **key, size_t *keySize) +{ +} + +void +heim_digest_release(heim_digest_t context) +{ + clear_context(context); + free(context); +} + +struct { + char *name; + size_t offset; +} keys[] = { +#define KVN(value) { #value, offsetof(struct heim_digest_desc, value) } + KVN(serverNonce), + KVN(serverRealm), + KVN(serverQOP), + KVN(serverMethod), + { "method", offsetof(struct heim_digest_desc, serverMethod) }, + KVN(serverMaxbuf), + KVN(clientUsername), + { "username", offsetof(struct heim_digest_desc, clientUsername) }, + KVN(clientResponse), + KVN(clientURI), + { "uri", offsetof(struct heim_digest_desc, clientURI) }, + KVN(clientRealm), + { "realm", offsetof(struct heim_digest_desc, clientRealm) }, + KVN(clientNonce), + KVN(clientQOP), + KVN(clientNC), + KVN(serverAlgorithm), + KVN(auth_id) +#undef KVN +}; + +const char * +heim_digest_get_key(heim_digest_t context, const char *key) +{ + size_t n; + + for (n = 0; n < sizeof(keys) / sizeof(keys[0]); n++) { + if (strcasecmp(key, keys[n].name) == 0) { + char **ptr = (char **)((((char *)context) + keys[n].offset)); + return *ptr; + } + } + return NULL; +} + +int +heim_digest_set_key(heim_digest_t context, const char *key, const char *value) +{ + + if (strcmp(key, "password") == 0) { + FREE_AND_CLEAR(context->password); + if ((context->password = strdup(value)) == NULL) + return ENOMEM; + context->flags &= ~(F_HAVE_HASH|F_HAVE_HA1); + } else if (strcmp(key, "userhash") == 0) { + ssize_t ret; + FREE_AND_CLEAR(context->password); + + ret = hex_decode(value, context->SecretHash, sizeof(context->SecretHash)); + if (ret != sizeof(context->SecretHash)) + return EINVAL; + context->flags &= ~F_HAVE_HA1; + context->flags |= F_HAVE_HASH; + } else if (strcmp(key, "H(A1)") == 0) { + ssize_t ret; + FREE_AND_CLEAR(context->password); + + ret = hex_decode(value, context->SecretHash, sizeof(context->SecretHash)); + if (ret != sizeof(context->SecretHash)) + return EINVAL; + context->flags &= ~F_HAVE_HASH; + context->flags |= F_HAVE_HA1; + } else if (strcmp(key, "method") == 0) { + FREE_AND_CLEAR(context->serverMethod); + if ((context->serverMethod = strdup(value)) == NULL) + return ENOMEM; + } else { + size_t n; + + for (n = 0; n < sizeof(keys) / sizeof(keys[0]); n++) { + if (strcasecmp(key, keys[n].name) == 0) { + char **ptr = (char **)((((char *)context) + keys[n].offset)); + FREE_AND_CLEAR(*ptr); + if (((*ptr) = strdup(value)) == NULL) + return ENOMEM; + break; + } + } + if (n == sizeof(keys) / sizeof(keys[0])) + return ENOENT; + } + return 0; +} + -- cgit v1.2.3