usr/src/lib/sasl_plugins/login/login.c

   1 /*
   2  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
   3  */
   4
   5 /* LOGIN is a PLAIN-like authenticator, but for older deployments. */
   6
   7 /* Login SASL plugin
   8  * Rob Siemborski (SASLv2 Conversion)
   9  * contributed by Rainer Schoepf <schoepf@uni-mainz.de>
  10  * based on PLAIN, by Tim Martin <tmartin@andrew.cmu.edu>
  11  * $Id: login.c,v 1.25 2003/02/13 19:56:04 rjs3 Exp $
  12  */
  13 /*
  14  * Copyright (c) 1998-2003 Carnegie Mellon University.  All rights reserved.
  15  *
  16  * Redistribution and use in source and binary forms, with or without
  17  * modification, are permitted provided that the following conditions
  18  * are met:
  19  *
  20  * 1. Redistributions of source code must retain the above copyright
  21  *    notice, this list of conditions and the following disclaimer.
  22  *
  23  * 2. Redistributions in binary form must reproduce the above copyright
  24  *    notice, this list of conditions and the following disclaimer in
  25  *    the documentation and/or other materials provided with the
  26  *    distribution.
  27  *
  28  * 3. The name "Carnegie Mellon University" must not be used to
  29  *    endorse or promote products derived from this software without
  30  *    prior written permission. For permission or any other legal
  31  *    details, please contact
  32  *      Office of Technology Transfer
  33  *      Carnegie Mellon University
  34  *      5000 Forbes Avenue
  35  *      Pittsburgh, PA  15213-3890
  36  *      (412) 268-4387, fax: (412) 268-7395
  37  *      tech-transfer@andrew.cmu.edu
  38  *
  39  * 4. Redistributions of any form whatsoever must retain the following
  40  *    acknowledgment:
  41  *    "This product includes software developed by Computing Services
  42  *     at Carnegie Mellon University (http://www.cmu.edu/computing/)."
  43  *
  44  * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
  45  * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  46  * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
  47  * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  48  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
  49  * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
  50  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  51  */
  52
  53 #include <config.h>
  54 #include <stdio.h>
  55 #include <ctype.h>
  56 #include <sasl.h>
  57 #include <saslplug.h>
  58
  59 #include "plugin_common.h"
  60
  61 #ifndef _SUN_SDK_
  62 #ifdef WIN32
  63 /* This must be after sasl.h */
  64 # include "saslLOGIN.h"
  65 #endif /* WIN32 */
  66 #endif /* !_SUN_SDK_ */
  67
  68 /*****************************  Common Section  *****************************/
  69
  70 #ifndef _SUN_SDK_
  71 static const char plugin_id[] = "$Id: login.c,v 1.25 2003/02/13 19:56:04 rjs3 Exp $";
  72 #endif /* !_SUN_SDK_ */
  73
  74 /*****************************  Server Section  *****************************/
  75
  76 typedef struct context {
  77     int state;
  78
  79     char *username;
  80     size_t username_len;
  81 } server_context_t;
  82
  83 static int login_server_mech_new(void *glob_context __attribute__((unused)),
  84                                  sasl_server_params_t *sparams,
  85                                  const char *challenge __attribute__((unused)),
  86                                  unsigned challen __attribute__((unused)),
  87                                  void **conn_context)
  88 {
  89     server_context_t *text;
  90
  91     /* holds state are in */
  92     text = sparams->utils->malloc(sizeof(server_context_t));
  93     if (text == NULL) {
  94         MEMERROR( sparams->utils );
  95         return SASL_NOMEM;
  96     }
  97
  98     memset(text, 0, sizeof(server_context_t));
  99
 100     text->state = 1;
 101
 102     *conn_context = text;
 103
 104     return SASL_OK;
 105 }
 106
 107 #define USERNAME_CHALLENGE "Username:"
 108 #define PASSWORD_CHALLENGE "Password:"
 109
 110 static int login_server_mech_step(void *conn_context,
 111                                   sasl_server_params_t *params,
 112                                   const char *clientin,
 113                                   unsigned clientinlen,
 114                                   const char **serverout,
 115                                   unsigned *serveroutlen,
 116                                   sasl_out_params_t *oparams)
 117 {
 118     server_context_t *text = (server_context_t *) conn_context;
 119
 120     *serverout = NULL;
 121     *serveroutlen = 0;
 122
 123     switch (text->state) {
 124
 125     case 1:
 126         text->state = 2;
 127
 128         /* Check inlen, (possibly we have already the user name) */
 129         /* In this case fall through to state 2 */
 130         if (clientinlen == 0) {
 131             /* demand username */
 132
 133             *serveroutlen = strlen(USERNAME_CHALLENGE);
 134             *serverout = USERNAME_CHALLENGE;
 135
 136             return SASL_CONTINUE;
 137         }
 138
 139
 140     case 2:
 141         /* Catch really long usernames */
 142         if (clientinlen > 1024) {
 143 #ifdef _SUN_SDK_
 144             params->utils->log(params->utils->conn, SASL_LOG_ERR,
 145                 "username too long (>1024 characters)");
 146 #else
 147             SETERROR(params->utils, "username too long (>1024 characters)");
 148 #endif  /* _SUN_SDK_ */
 149             return SASL_BADPROT;
 150         }
 151
 152         /* get username */
 153         text->username =
 154             params->utils->malloc(sizeof(sasl_secret_t) + clientinlen + 1);
 155         if (!text->username) {
 156             MEMERROR( params->utils );
 157             return SASL_NOMEM;
 158         }
 159
 160         strncpy(text->username, clientin, clientinlen);
 161         text->username_len = clientinlen;
 162         text->username[clientinlen] = '\0';
 163
 164         /* demand password */
 165         *serveroutlen = strlen(PASSWORD_CHALLENGE);
 166         *serverout = PASSWORD_CHALLENGE;
 167
 168         text->state = 3;
 169
 170         return SASL_CONTINUE;
 171
 172
 173     case 3: {
 174         sasl_secret_t *password;
 175         int result;
 176
 177         /* Catch really long passwords */
 178         if (clientinlen > 1024) {
 179 #ifdef _SUN_SDK_
 180             params->utils->log(params->utils->conn, SASL_LOG_ERR,
 181                      "clientinlen is > 1024 characters in LOGIN plugin");
 182 #else
 183             SETERROR(params->utils,
 184                      "clientinlen is > 1024 characters in LOGIN plugin");
 185 #endif  /* _SUN_SDK_ */
 186             return SASL_BADPROT;
 187         }
 188
 189         /* get password */
 190         password =
 191             params->utils->malloc(sizeof(sasl_secret_t) + clientinlen + 1);
 192         if (!password) {
 193             MEMERROR(params->utils);
 194             return SASL_NOMEM;
 195         }
 196
 197         strncpy((char *)password->data, clientin, clientinlen);
 198         password->data[clientinlen] = '\0';
 199         password->len = clientinlen;
 200
 201         /* canonicalize username first, so that password verification is
 202          * done against the canonical id */
 203         result = params->canon_user(params->utils->conn, text->username,
 204                                     text->username_len,
 205                                     SASL_CU_AUTHID | SASL_CU_AUTHZID, oparams);
 206         if (result != SASL_OK) {
 207                 _plug_free_secret(params->utils, &password);
 208                 return result;
 209         }
 210
 211         /* verify_password - return sasl_ok on success */
 212         result = params->utils->checkpass(params->utils->conn,
 213                                         oparams->authid, oparams->alen,
 214                                         (char *)password->data, password->len);
 215
 216         if (result != SASL_OK) {
 217             _plug_free_secret(params->utils, &password);
 218             return result;
 219         }
 220
 221         if (params->transition) {
 222             params->transition(params->utils->conn,
 223                                (char *)password->data, password->len);
 224         }
 225
 226         _plug_free_secret(params->utils, &password);
 227
 228         *serverout = NULL;
 229         *serveroutlen = 0;
 230
 231         oparams->doneflag = 1;
 232         oparams->mech_ssf = 0;
 233         oparams->maxoutbuf = 0;
 234         oparams->encode_context = NULL;
 235         oparams->encode = NULL;
 236         oparams->decode_context = NULL;
 237         oparams->decode = NULL;
 238         oparams->param_version = 0;
 239
 240         return SASL_OK;
 241     }
 242
 243
 244     default:
 245         params->utils->log(NULL, SASL_LOG_ERR,
 246                            "Invalid LOGIN server step %d\n", text->state);
 247         return SASL_FAIL;
 248     }
 249
 250     return SASL_FAIL; /* should never get here */
 251 }
 252
 253 static void login_server_mech_dispose(void *conn_context,
 254                                       const sasl_utils_t *utils)
 255 {
 256     server_context_t *text = (server_context_t *) conn_context;
 257
 258     if (!text) return;
 259
 260     if (text->username) utils->free(text->username);
 261
 262     utils->free(text);
 263 }
 264
 265 static sasl_server_plug_t login_server_plugins[] =
 266 {
 267     {
 268         "LOGIN",                        /* mech_name */
 269         0,                              /* max_ssf */
 270         SASL_SEC_NOANONYMOUS,           /* security_flags */
 271         0,                              /* features */
 272         NULL,                           /* glob_context */
 273         &login_server_mech_new,         /* mech_new */
 274         &login_server_mech_step,        /* mech_step */
 275         &login_server_mech_dispose,     /* mech_dispose */
 276         NULL,                           /* mech_free */
 277         NULL,                           /* setpass */
 278         NULL,                           /* user_query */
 279         NULL,                           /* idle */
 280         NULL,                           /* mech_avail */
 281         NULL                            /* spare */
 282     }
 283 };
 284
 285 int login_server_plug_init(sasl_utils_t *utils,
 286                            int maxversion,
 287                            int *out_version,
 288                            sasl_server_plug_t **pluglist,
 289                            int *plugcount)
 290 {
 291     if (maxversion < SASL_SERVER_PLUG_VERSION) {
 292         SETERROR(utils, "LOGIN version mismatch");
 293         return SASL_BADVERS;
 294     }
 295
 296     *out_version = SASL_SERVER_PLUG_VERSION;
 297     *pluglist = login_server_plugins;
 298     *plugcount = 1;
 299
 300     return SASL_OK;
 301 }
 302
 303 /*****************************  Client Section  *****************************/
 304
 305 typedef struct client_context {
 306     int state;
 307
 308 #ifdef _INTEGRATED_SOLARIS_
 309     void *h;
 310 #endif /* _INTEGRATED_SOLARIS_ */
 311     sasl_secret_t *password;
 312     unsigned int free_password; /* set if we need to free password */
 313 } client_context_t;
 314
 315 static int login_client_mech_new(void *glob_context __attribute__((unused)),
 316                                  sasl_client_params_t *params,
 317                                  void **conn_context)
 318 {
 319     client_context_t *text;
 320
 321     /* holds state are in */
 322     text = params->utils->malloc(sizeof(client_context_t));
 323     if (text == NULL) {
 324         MEMERROR(params->utils);
 325         return SASL_NOMEM;
 326     }
 327
 328     memset(text, 0, sizeof(client_context_t));
 329
 330     text->state = 1;
 331
 332     *conn_context = text;
 333
 334     return SASL_OK;
 335 }
 336
 337 static int login_client_mech_step(void *conn_context,
 338                                   sasl_client_params_t *params,
 339                                   const char *serverin __attribute__((unused)),
 340                                   unsigned serverinlen __attribute__((unused)),
 341                                   sasl_interact_t **prompt_need,
 342                                   const char **clientout,
 343                                   unsigned *clientoutlen,
 344                                   sasl_out_params_t *oparams)
 345 {
 346     client_context_t *text = (client_context_t *) conn_context;
 347
 348     *clientout = NULL;
 349     *clientoutlen = 0;
 350
 351     switch (text->state) {
 352
 353     case 1: {
 354         const char *user;
 355         int auth_result = SASL_OK;
 356         int pass_result = SASL_OK;
 357         int result;
 358
 359         /* check if sec layer strong enough */
 360         if (params->props.min_ssf > params->external_ssf) {
 361 #ifdef _INTEGRATED_SOLARIS_
 362             params->utils->log(params->utils->conn, SASL_LOG_ERR,
 363                 gettext("SSF requested of LOGIN plugin"));
 364 #else
 365             SETERROR( params->utils, "SSF requested of LOGIN plugin");
 366 #endif /* _INTEGRATED_SOLARIS_ */
 367             return SASL_TOOWEAK;
 368         }
 369
 370         /* try to get the userid */
 371         /* Note: we want to grab the authname and not the userid, which is
 372          *       who we AUTHORIZE as, and will be the same as the authname
 373          *       for the LOGIN mech.
 374          */
 375         if (oparams->user == NULL) {
 376             auth_result = _plug_get_authid(params->utils, &user, prompt_need);
 377
 378             if ((auth_result != SASL_OK) && (auth_result != SASL_INTERACT))
 379                 return auth_result;
 380         }
 381
 382         /* try to get the password */
 383         if (text->password == NULL) {
 384             pass_result = _plug_get_password(params->utils, &text->password,
 385                                              &text->free_password, prompt_need);
 386
 387             if ((pass_result != SASL_OK) && (pass_result != SASL_INTERACT))
 388                 return pass_result;
 389         }
 390
 391         /* free prompts we got */
 392         if (prompt_need && *prompt_need) {
 393             params->utils->free(*prompt_need);
 394             *prompt_need = NULL;
 395         }
 396
 397         /* if there are prompts not filled in */
 398         if ((auth_result == SASL_INTERACT) || (pass_result == SASL_INTERACT)) {
 399             /* make the prompt list */
 400             result =
 401 #ifdef _INTEGRATED_SOLARIS_
 402                 _plug_make_prompts(params->utils, &text->h, prompt_need,
 403                     NULL, NULL,
 404                     auth_result == SASL_INTERACT ?
 405                     gettext("Please enter your authentication name") : NULL,
 406                     NULL,
 407                     pass_result == SASL_INTERACT ?
 408                     gettext("Please enter your password") : NULL, NULL,
 409                     NULL, NULL, NULL,
 410                     NULL, NULL, NULL);
 411 #else
 412                 _plug_make_prompts(params->utils, prompt_need,
 413                                    NULL, NULL,
 414                                    auth_result == SASL_INTERACT ?
 415                                    "Please enter your authentication name" : NULL,
 416                                    NULL,
 417                                    pass_result == SASL_INTERACT ?
 418                                    "Please enter your password" : NULL, NULL,
 419                                    NULL, NULL, NULL,
 420                                    NULL, NULL, NULL);
 421 #endif /* _INTEGRATED_SOLARIS_ */
 422             if (result != SASL_OK) return result;
 423
 424             return SASL_INTERACT;
 425         }
 426
 427         if (!text->password) {
 428             PARAMERROR(params->utils);
 429             return SASL_BADPARAM;
 430         }
 431
 432         result = params->canon_user(params->utils->conn, user, 0,
 433                                     SASL_CU_AUTHID | SASL_CU_AUTHZID, oparams);
 434         if (result != SASL_OK) return result;
 435
 436         /* server should have sent request for username - we ignore it */
 437         if (!serverin) {
 438 #ifdef _SUN_SDK_
 439             params->utils->log(params->utils->conn, SASL_LOG_ERR,
 440                       "Server didn't issue challenge for USERNAME");
 441 #else
 442             SETERROR( params->utils,
 443                       "Server didn't issue challenge for USERNAME");
 444 #endif /* _SUN_SDK_ */
 445             return SASL_BADPROT;
 446         }
 447
 448         if (!clientout) {
 449             PARAMERROR( params->utils );
 450             return SASL_BADPARAM;
 451         }
 452
 453         if (clientoutlen) *clientoutlen = oparams->alen;
 454         *clientout = oparams->authid;
 455
 456         text->state = 2;
 457
 458         return SASL_CONTINUE;
 459     }
 460
 461     case 2:
 462         /* server should have sent request for password - we ignore it */
 463         if (!serverin) {
 464 #ifdef _SUN_SDK_
 465             params->utils->log(params->utils->conn, SASL_LOG_ERR,
 466                       "Server didn't issue challenge for PASSWORD");
 467 #else
 468             SETERROR( params->utils,
 469                       "Server didn't issue challenge for PASSWORD");
 470 #endif /* _SUN_SDK_ */
 471             return SASL_BADPROT;
 472         }
 473
 474         if (!clientout) {
 475             PARAMERROR(params->utils);
 476             return SASL_BADPARAM;
 477         }
 478
 479         if (clientoutlen) *clientoutlen = text->password->len;
 480         *clientout = (char *)text->password->data;
 481
 482         /* set oparams */
 483         oparams->doneflag = 1;
 484         oparams->mech_ssf = 0;
 485         oparams->maxoutbuf = 0;
 486         oparams->encode_context = NULL;
 487         oparams->encode = NULL;
 488         oparams->decode_context = NULL;
 489         oparams->decode = NULL;
 490         oparams->param_version = 0;
 491
 492         return SASL_OK;
 493
 494     default:
 495         params->utils->log(NULL, SASL_LOG_ERR,
 496                            "Invalid LOGIN client step %d\n", text->state);
 497         return SASL_FAIL;
 498     }
 499
 500     return SASL_FAIL; /* should never get here */
 501 }
 502
 503 static void login_client_mech_dispose(void *conn_context,
 504                                       const sasl_utils_t *utils)
 505 {
 506     client_context_t *text = (client_context_t *) conn_context;
 507
 508     if (!text) return;
 509
 510     /* free sensitive info */
 511     if (text->free_password) _plug_free_secret(utils, &(text->password));
 512 #ifdef _INTEGRATED_SOLARIS_
 513     convert_prompt(utils, &text->h, NULL);
 514 #endif /* _INTEGRATED_SOLARIS_ */
 515
 516     utils->free(text);
 517 }
 518
 519 static sasl_client_plug_t login_client_plugins[] =
 520 {
 521     {
 522         "LOGIN",                        /* mech_name */
 523         0,                              /* max_ssf */
 524         SASL_SEC_NOANONYMOUS,           /* security_flags */
 525         SASL_FEAT_SERVER_FIRST,         /* features */
 526         NULL,                           /* required_prompts */
 527         NULL,                           /* glob_context */
 528         &login_client_mech_new,         /* mech_new */
 529         &login_client_mech_step,        /* mech_step */
 530         &login_client_mech_dispose,     /* mech_dispose */
 531         NULL,                           /* mech_free */
 532         NULL,                           /* idle */
 533         NULL,                           /* spare */
 534         NULL                            /* spare */
 535     }
 536 };
 537
 538 int login_client_plug_init(sasl_utils_t *utils,
 539                            int maxversion,
 540                            int *out_version,
 541                            sasl_client_plug_t **pluglist,
 542                            int *plugcount)
 543 {
 544     if (maxversion < SASL_CLIENT_PLUG_VERSION) {
 545         SETERROR(utils, "Version mismatch in LOGIN");
 546         return SASL_BADVERS;
 547     }
 548
 549     *out_version = SASL_CLIENT_PLUG_VERSION;
 550     *pluglist = login_client_plugins;
 551     *plugcount = 1;
 552
 553     return SASL_OK;
 554 }