1/* 2 * Copyright 2003 Sun Microsystems, Inc. All rights reserved. 3 * Use is subject to license terms. 4 */ 5#pragma ident "%Z%%M% %I% %E% SMI" 6 7/* CRAM-MD5 SASL plugin 8 * Rob Siemborski 9 * Tim Martin 10 * $Id: cram.c,v 1.79 2003/02/18 18:27:37 rjs3 Exp $ 11 */ 12/* 13 * Copyright (c) 1998-2003 Carnegie Mellon University. All rights reserved. 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 19 * 1. Redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer. 21 * 22 * 2. Redistributions in binary form must reproduce the above copyright 23 * notice, this list of conditions and the following disclaimer in 24 * the documentation and/or other materials provided with the 25 * distribution. 26 * 27 * 3. The name "Carnegie Mellon University" must not be used to 28 * endorse or promote products derived from this software without 29 * prior written permission. For permission or any other legal 30 * details, please contact 31 * Office of Technology Transfer 32 * Carnegie Mellon University 33 * 5000 Forbes Avenue 34 * Pittsburgh, PA 15213-3890 35 * (412) 268-4387, fax: (412) 268-7395 36 * tech-transfer@andrew.cmu.edu 37 * 38 * 4. Redistributions of any form whatsoever must retain the following 39 * acknowledgment: 40 * "This product includes software developed by Computing Services 41 * at Carnegie Mellon University (http://www.cmu.edu/computing/)." 42 * 43 * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO 44 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 45 * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE 46 * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 47 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN 48 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING 49 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 50 */ 51 52#include <config.h> 53 54#include <string.h> 55#include <stdlib.h> 56#include <stdio.h> 57#ifndef macintosh 58#include <sys/stat.h> 59#endif 60#include <fcntl.h> 61 62#include <sasl.h> 63#include <saslplug.h> 64#include <saslutil.h> 65 66#ifdef _SUN_SDK_ 67#include <unistd.h> 68#endif /* _SUN_SDK_ */ 69 70#include "plugin_common.h" 71 72#ifdef macintosh 73#include <sasl_cram_plugin_decl.h> 74#endif 75 76/***************************** Common Section *****************************/ 77 78#ifndef _SUN_SDK_ 79static const char plugin_id[] = "$Id: cram.c,v 1.79 2003/02/18 18:27:37 rjs3 Exp $"; 80#endif /* !_SUN_SDK_ */ 81 82/* convert a string of 8bit chars to it's representation in hex 83 * using lowercase letters 84 */ 85static char *convert16(unsigned char *in, int inlen, const sasl_utils_t *utils) 86{ 87 static char hex[]="0123456789abcdef"; 88 int lup; 89 char *out; 90 91 out = utils->malloc(inlen*2+1); 92 if (out == NULL) return NULL; 93 94 for (lup=0; lup < inlen; lup++) { 95 out[lup*2] = hex[in[lup] >> 4]; 96 out[lup*2+1] = hex[in[lup] & 15]; 97 } 98 99 out[lup*2] = 0; 100 return out; 101} 102 103 104/***************************** Server Section *****************************/ 105 106typedef struct server_context { 107 int state; 108 109 char *challenge; 110} server_context_t; 111 112static int 113crammd5_server_mech_new(void *glob_context __attribute__((unused)), 114 sasl_server_params_t *sparams, 115 const char *challenge __attribute__((unused)), 116 unsigned challen __attribute__((unused)), 117 void **conn_context) 118{ 119 server_context_t *text; 120 121 /* holds state are in */ 122 text = sparams->utils->malloc(sizeof(server_context_t)); 123 if (text == NULL) { 124 MEMERROR( sparams->utils ); 125 return SASL_NOMEM; 126 } 127 128 memset(text, 0, sizeof(server_context_t)); 129 130 text->state = 1; 131 132 *conn_context = text; 133 134 return SASL_OK; 135} 136 137/* 138 * Returns the current time (or part of it) in string form 139 * maximum length=15 140 */ 141static char *gettime(sasl_server_params_t *sparams) 142{ 143 char *ret; 144 time_t t; 145 146 t=time(NULL); 147 ret= sparams->utils->malloc(15); 148 if (ret==NULL) return NULL; 149 150 /* the bottom bits are really the only random ones so if 151 we overflow we don't want to loose them */ 152 snprintf(ret,15,"%lu",t%(0xFFFFFF)); 153 154 return ret; 155} 156 157static char *randomdigits(sasl_server_params_t *sparams) 158{ 159 unsigned int num; 160 char *ret; 161 unsigned char temp[5]; /* random 32-bit number */ 162 163#if defined _DEV_URANDOM && defined _SUN_SDK_ 164 { 165 int fd = open(_DEV_URANDOM, O_RDONLY); 166 int nread = 0; 167 168 if (fd != -1) { 169 nread = read(fd, temp, 4); 170 close(fd); 171 } 172 if (nread != 4) 173 sparams->utils->rand(sparams->utils->rpool, 174 (char *) temp, 4); 175 } 176#else 177 sparams->utils->rand(sparams->utils->rpool,(char *) temp,4); 178#endif /* _DEV_URANDOM && _SUN_SDK_ */ 179 num=(temp[0] * 256 * 256 * 256) + 180 (temp[1] * 256 * 256) + 181 (temp[2] * 256) + 182 (temp[3] ); 183 184 ret = sparams->utils->malloc(15); /* there's no way an unsigned can be longer than this right? */ 185 if (ret == NULL) return NULL; 186 sprintf(ret, "%u", num); 187 188 return ret; 189} 190 191static int 192crammd5_server_mech_step1(server_context_t *text, 193 sasl_server_params_t *sparams, 194 const char *clientin __attribute__((unused)), 195 unsigned clientinlen, 196 const char **serverout, 197 unsigned *serveroutlen, 198 sasl_out_params_t *oparams __attribute__((unused))) 199{ 200 char *time, *randdigits; 201 202 /* we shouldn't have received anything */ 203 if (clientinlen != 0) { 204#ifdef _SUN_SDK_ 205 sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR, 206 "CRAM-MD5 does not accept inital data"); 207#else 208 SETERROR(sparams->utils, "CRAM-MD5 does not accpet inital data"); 209#endif /* _SUN_SDK_ */ 210 return SASL_BADPROT; 211 } 212 213 /* get time and a random number for the nonce */ 214 time = gettime(sparams); 215 randdigits = randomdigits(sparams); 216 if ((time == NULL) || (randdigits == NULL)) { 217 MEMERROR( sparams->utils ); 218 return SASL_NOMEM; 219 } 220 221 /* allocate some space for the challenge */ 222 text->challenge = sparams->utils->malloc(200 + 1); 223 if (text->challenge == NULL) { 224 MEMERROR(sparams->utils); 225 return SASL_NOMEM; 226 } 227 228 /* create the challenge */ 229 snprintf(text->challenge, 200, "<%s.%s@%s>", randdigits, time, 230 sparams->serverFQDN); 231 232 *serverout = text->challenge; 233 *serveroutlen = strlen(text->challenge); 234 235 /* free stuff */ 236 sparams->utils->free(time); 237 sparams->utils->free(randdigits); 238 239 text->state = 2; 240 241 return SASL_CONTINUE; 242} 243 244static int 245crammd5_server_mech_step2(server_context_t *text, 246 sasl_server_params_t *sparams, 247 const char *clientin, 248 unsigned clientinlen, 249 const char **serverout __attribute__((unused)), 250 unsigned *serveroutlen __attribute__((unused)), 251 sasl_out_params_t *oparams) 252{ 253 char *userid = NULL; 254 sasl_secret_t *sec = NULL; 255 int pos, len; 256 int result = SASL_FAIL; 257 const char *password_request[] = { SASL_AUX_PASSWORD, 258 "*cmusaslsecretCRAM-MD5", 259 NULL }; 260 struct propval auxprop_values[3]; 261 HMAC_MD5_CTX tmphmac; 262 HMAC_MD5_STATE md5state; 263 int clear_md5state = 0; 264 char *digest_str = NULL; 265 UINT4 digest[4]; 266 267 /* extract userid; everything before last space */ 268 pos = clientinlen-1; 269 while ((pos > 0) && (clientin[pos] != ' ')) pos--; 270 271 if (pos <= 0) { 272#ifdef _SUN_SDK_ 273 sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR, 274 "need authentication name"); 275#else 276 SETERROR( sparams->utils,"need authentication name"); 277#endif /* _SUN_SDK_ */ 278 return SASL_BADPROT; 279 } 280 281 userid = (char *) sparams->utils->malloc(pos+1); 282 if (userid == NULL) { 283 MEMERROR( sparams->utils); 284 return SASL_NOMEM; 285 } 286 287 /* copy authstr out */ 288 memcpy(userid, clientin, pos); 289 userid[pos] = '\0'; 290 291 result = sparams->utils->prop_request(sparams->propctx, password_request); 292 if (result != SASL_OK) goto done; 293 294 /* this will trigger the getting of the aux properties */ 295 result = sparams->canon_user(sparams->utils->conn, 296 userid, 0, SASL_CU_AUTHID | SASL_CU_AUTHZID, 297 oparams); 298 if (result != SASL_OK) goto done; 299 300 result = sparams->utils->prop_getnames(sparams->propctx, 301 password_request, 302 auxprop_values); 303 if (result < 0 || 304 ((!auxprop_values[0].name || !auxprop_values[0].values) && 305 (!auxprop_values[1].name || !auxprop_values[1].values))) { 306 /* We didn't find this username */ 307#ifdef _INTEGRATED_SOLARIS_ 308 sparams->utils->seterror(sparams->utils->conn,0, 309 gettext("no secret in database")); 310#else 311 sparams->utils->seterror(sparams->utils->conn,0, 312 "no secret in database"); 313#endif /* _INTEGRATED_SOLARIS_ */ 314 result = SASL_NOUSER; 315 goto done; 316 } 317 318 if (auxprop_values[0].name && auxprop_values[0].values) { 319 len = strlen(auxprop_values[0].values[0]); 320 if (len == 0) { 321#ifdef _INTEGRATED_SOLARIS_ 322 sparams->utils->seterror(sparams->utils->conn,0, 323 gettext("empty secret")); 324#else 325 sparams->utils->seterror(sparams->utils->conn,0, 326 "empty secret"); 327#endif /* _INTEGRATED_SOLARIS_ */ 328 result = SASL_FAIL; 329 goto done; 330 } 331 332 sec = sparams->utils->malloc(sizeof(sasl_secret_t) + len); 333 if (!sec) goto done; 334 335 sec->len = len; 336#ifdef _SUN_SDK_ 337 strncpy((char *)sec->data, auxprop_values[0].values[0], len + 1); 338#else 339 strncpy(sec->data, auxprop_values[0].values[0], len + 1); 340#endif /* _SUN_SDK_ */ 341 342 clear_md5state = 1; 343 /* Do precalculation on plaintext secret */ 344 sparams->utils->hmac_md5_precalc(&md5state, /* OUT */ 345 sec->data, 346 sec->len); 347 } else if (auxprop_values[1].name && auxprop_values[1].values) { 348 /* We have a precomputed secret */ 349 memcpy(&md5state, auxprop_values[1].values[0], 350 sizeof(HMAC_MD5_STATE)); 351 } else { 352#ifdef _SUN_SDK_ 353 sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR, 354 "Have neither type of secret"); 355#else 356 sparams->utils->seterror(sparams->utils->conn, 0, 357 "Have neither type of secret"); 358#endif /* _SUN_SDK_ */ 359 return SASL_FAIL; 360 } 361 362 /* ok this is annoying: 363 so we have this half-way hmac transform instead of the plaintext 364 that means we half to: 365 -import it back into a md5 context 366 -do an md5update with the nonce 367 -finalize it 368 */ 369 sparams->utils->hmac_md5_import(&tmphmac, (HMAC_MD5_STATE *) &md5state); 370 sparams->utils->MD5Update(&(tmphmac.ictx), 371 (const unsigned char *) text->challenge, 372 strlen(text->challenge)); 373 sparams->utils->hmac_md5_final((unsigned char *) &digest, &tmphmac); 374 375 /* convert to base 16 with lower case letters */ 376 digest_str = convert16((unsigned char *) digest, 16, sparams->utils); 377 378 /* if same then verified 379 * - we know digest_str is null terminated but clientin might not be 380 */ 381 if (strncmp(digest_str, clientin+pos+1, strlen(digest_str)) != 0) { 382#ifdef _INTEGRATED_SOLARIS_ 383 sparams->utils->seterror(sparams->utils->conn, 0, 384 gettext("incorrect digest response")); 385#else 386 sparams->utils->seterror(sparams->utils->conn, 0, 387 "incorrect digest response"); 388#endif /* _INTEGRATED_SOLARIS_ */ 389 result = SASL_BADAUTH; 390 goto done; 391 } 392 393 /* set oparams */ 394 oparams->doneflag = 1; 395 oparams->mech_ssf = 0; 396 oparams->maxoutbuf = 0; 397 oparams->encode_context = NULL; 398 oparams->encode = NULL; 399 oparams->decode_context = NULL; 400 oparams->decode = NULL; 401 oparams->param_version = 0; 402 403 result = SASL_OK; 404 405 done: 406 if (userid) sparams->utils->free(userid); 407 if (sec) _plug_free_secret(sparams->utils, &sec); 408 409 if (digest_str) sparams->utils->free(digest_str); 410 if (clear_md5state) memset(&md5state, 0, sizeof(md5state)); 411 412 return result; 413} 414 415static int crammd5_server_mech_step(void *conn_context, 416 sasl_server_params_t *sparams, 417 const char *clientin, 418 unsigned clientinlen, 419 const char **serverout, 420 unsigned *serveroutlen, 421 sasl_out_params_t *oparams) 422{ 423 server_context_t *text = (server_context_t *) conn_context; 424 425 *serverout = NULL; 426 *serveroutlen = 0; 427 428 /* this should be well more than is ever needed */ 429 if (clientinlen > 1024) { 430#ifdef _SUN_SDK_ 431 sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR, 432 "CRAM-MD5 input longer than 1024 bytes"); 433#else 434 SETERROR(sparams->utils, "CRAM-MD5 input longer than 1024 bytes"); 435#endif /* _SUN_SDK_ */ 436 return SASL_BADPROT; 437 } 438 439 switch (text->state) { 440 441 case 1: 442 return crammd5_server_mech_step1(text, sparams, 443 clientin, clientinlen, 444 serverout, serveroutlen, 445 oparams); 446 447 case 2: 448 return crammd5_server_mech_step2(text, sparams, 449 clientin, clientinlen, 450 serverout, serveroutlen, 451 oparams); 452 453 default: /* should never get here */ 454#ifdef _SUN_SDK_ 455 sparams->utils->log(sparams->utils->conn, SASL_LOG_ERR, 456 "Invalid CRAM-MD5 server step %d", text->state); 457#else 458 sparams->utils->log(NULL, SASL_LOG_ERR, 459 "Invalid CRAM-MD5 server step %d\n", text->state); 460#endif /* _SUN_SDK_ */ 461 return SASL_FAIL; 462 } 463 464#ifndef _SUN_SDK_ 465 return SASL_FAIL; /* should never get here */ 466#endif /* !_SUN_SDK_ */ 467} 468 469static void crammd5_server_mech_dispose(void *conn_context, 470 const sasl_utils_t *utils) 471{ 472 server_context_t *text = (server_context_t *) conn_context; 473 474 if (!text) return; 475 476 if (text->challenge) _plug_free_string(utils,&(text->challenge)); 477 478 utils->free(text); 479} 480 481static sasl_server_plug_t crammd5_server_plugins[] = 482{ 483 { 484 "CRAM-MD5", /* mech_name */ 485 0, /* max_ssf */ 486 SASL_SEC_NOPLAINTEXT 487 | SASL_SEC_NOANONYMOUS, /* security_flags */ 488 SASL_FEAT_SERVER_FIRST, /* features */ 489 NULL, /* glob_context */ 490 &crammd5_server_mech_new, /* mech_new */ 491 &crammd5_server_mech_step, /* mech_step */ 492 &crammd5_server_mech_dispose, /* mech_dispose */ 493 NULL, /* mech_free */ 494 NULL, /* setpass */ 495 NULL, /* user_query */ 496 NULL, /* idle */ 497 NULL, /* mech avail */ 498 NULL /* spare */ 499 } 500}; 501 502int crammd5_server_plug_init(const sasl_utils_t *utils, 503 int maxversion, 504 int *out_version, 505 sasl_server_plug_t **pluglist, 506 int *plugcount) 507{ 508 if (maxversion < SASL_SERVER_PLUG_VERSION) { 509#ifdef _SUN_SDK_ 510 utils->log(NULL, SASL_LOG_ERR, "CRAM version mismatch"); 511#else 512 SETERROR( utils, "CRAM version mismatch"); 513#endif /* _SUN_SDK_ */ 514 return SASL_BADVERS; 515 } 516 517 *out_version = SASL_SERVER_PLUG_VERSION; 518 *pluglist = crammd5_server_plugins; 519 *plugcount = 1; 520 521 return SASL_OK; 522} 523 524/***************************** Client Section *****************************/ 525 526typedef struct client_context { 527 char *out_buf; 528 unsigned out_buf_len; 529#ifdef _INTEGRATED_SOLARIS_ 530 void *h; 531#endif /* _INTEGRATED_SOLARIS_ */ 532} client_context_t; 533 534static int crammd5_client_mech_new(void *glob_context __attribute__((unused)), 535 sasl_client_params_t *params, 536 void **conn_context) 537{ 538 client_context_t *text; 539 540 /* holds state are in */ 541 text = params->utils->malloc(sizeof(client_context_t)); 542 if (text == NULL) { 543 MEMERROR(params->utils); 544 return SASL_NOMEM; 545 } 546 547 memset(text, 0, sizeof(client_context_t)); 548 549 *conn_context = text; 550 551 return SASL_OK; 552} 553 554static char *make_hashed(sasl_secret_t *sec, char *nonce, int noncelen, 555 const sasl_utils_t *utils) 556{ 557 char secret[65]; 558 unsigned char digest[24]; 559 int lup; 560 char *in16; 561 562 if (sec == NULL) return NULL; 563 564 if (sec->len < 64) { 565 memcpy(secret, sec->data, sec->len); 566 567 /* fill in rest with 0's */ 568 for (lup= sec->len; lup < 64; lup++) 569 secret[lup]='\0'; 570 571 } else { 572 memcpy(secret, sec->data, 64); 573 } 574 575 /* do the hmac md5 hash output 128 bits */ 576 utils->hmac_md5((unsigned char *) nonce, noncelen, 577 (unsigned char *) secret, 64, digest); 578 579 /* convert that to hex form */ 580 in16 = convert16(digest, 16, utils); 581 if (in16 == NULL) return NULL; 582 583 return in16; 584} 585 586static int crammd5_client_mech_step(void *conn_context, 587 sasl_client_params_t *params, 588 const char *serverin, 589 unsigned serverinlen, 590 sasl_interact_t **prompt_need, 591 const char **clientout, 592 unsigned *clientoutlen, 593 sasl_out_params_t *oparams) 594{ 595 client_context_t *text = (client_context_t *) conn_context; 596 const char *authid; 597 sasl_secret_t *password = NULL; 598 unsigned int free_password = 0; /* set if we need to free password */ 599 int auth_result = SASL_OK; 600 int pass_result = SASL_OK; 601 int result; 602 int maxsize; 603 char *in16 = NULL; 604 605 *clientout = NULL; 606 *clientoutlen = 0; 607 608 /* First check for absurd lengths */ 609 if (serverinlen > 1024) { 610#ifdef _SUN_SDK_ 611 params->utils->log(params->utils->conn, SASL_LOG_ERR, 612 "CRAM-MD5 input longer than 1024 bytes"); 613#else 614 params->utils->seterror(params->utils->conn, 0, 615 "CRAM-MD5 input longer than 1024 bytes"); 616#endif /* _SUN_SDK_ */ 617 return SASL_BADPROT; 618 } 619 620 /* check if sec layer strong enough */ 621 if (params->props.min_ssf > params->external_ssf) { 622#ifdef _SUN_SDK_ 623 params->utils->log(params->utils->conn, SASL_LOG_ERR, 624 "SSF requested of CRAM-MD5 plugin"); 625#else 626 SETERROR( params->utils, "SSF requested of CRAM-MD5 plugin"); 627#endif /* _SUN_SDK_ */ 628 return SASL_TOOWEAK; 629 } 630 631 /* try to get the userid */ 632 if (oparams->authid == NULL) { 633 auth_result=_plug_get_authid(params->utils, &authid, prompt_need); 634 635 if ((auth_result != SASL_OK) && (auth_result != SASL_INTERACT)) 636 return auth_result; 637 } 638 639 /* try to get the password */ 640 if (password == NULL) { 641 pass_result=_plug_get_password(params->utils, &password, 642 &free_password, prompt_need); 643 644 if ((pass_result != SASL_OK) && (pass_result != SASL_INTERACT)) 645 return pass_result; 646 } 647 648 /* free prompts we got */ 649 if (prompt_need && *prompt_need) { 650 params->utils->free(*prompt_need); 651 *prompt_need = NULL; 652 } 653 654 /* if there are prompts not filled in */ 655 if ((auth_result == SASL_INTERACT) || (pass_result == SASL_INTERACT)) { 656 /* make the prompt list */ 657 result = 658#ifdef _INTEGRATED_SOLARIS_ 659 _plug_make_prompts(params->utils, &text->h, prompt_need, 660 NULL, NULL, 661 auth_result == SASL_INTERACT ? 662 convert_prompt(params->utils, &text->h, 663 gettext("Please enter your authentication name")) 664 : NULL, NULL, 665 pass_result == SASL_INTERACT ? 666 convert_prompt(params->utils, &text->h, 667 gettext("Please enter your password")) 668 : NULL, NULL, 669 NULL, NULL, NULL, 670 NULL, NULL, NULL); 671#else 672 _plug_make_prompts(params->utils, prompt_need, 673 NULL, NULL, 674 auth_result == SASL_INTERACT ? 675 "Please enter your authentication name" : NULL, 676 NULL, 677 pass_result == SASL_INTERACT ? 678 "Please enter your password" : NULL, NULL, 679 NULL, NULL, NULL, 680 NULL, NULL, NULL); 681#endif /* _INTEGRATED_SOLARIS_ */ 682 if (result != SASL_OK) goto cleanup; 683 684 return SASL_INTERACT; 685 } 686 687 if (!password) { 688 PARAMERROR(params->utils); 689 return SASL_BADPARAM; 690 } 691 692 result = params->canon_user(params->utils->conn, authid, 0, 693 SASL_CU_AUTHID | SASL_CU_AUTHZID, oparams); 694 if (result != SASL_OK) goto cleanup; 695 696 /* 697 * username SP digest (keyed md5 where key is passwd) 698 */ 699 700 in16 = make_hashed(password, (char *) serverin, serverinlen, 701 params->utils); 702 703 if (in16 == NULL) { 704#ifdef _SUN_SDK_ 705 params->utils->log(params->utils->conn, SASL_LOG_ERR, 706 "make_hashed failed"); 707#else 708 SETERROR(params->utils, "whoops, make_hashed failed us this time"); 709#endif /* _SUN_SDK_ */ 710 result = SASL_FAIL; 711 goto cleanup; 712 } 713 714 maxsize = 32+1+strlen(oparams->authid)+30; 715 result = _plug_buf_alloc(params->utils, &(text->out_buf), 716 &(text->out_buf_len), maxsize); 717 if (result != SASL_OK) goto cleanup; 718 719 snprintf(text->out_buf, maxsize, "%s %s", oparams->authid, in16); 720 721 *clientout = text->out_buf; 722 *clientoutlen = strlen(*clientout); 723 724 /* set oparams */ 725 oparams->doneflag = 1; 726 oparams->mech_ssf = 0; 727 oparams->maxoutbuf = 0; 728 oparams->encode_context = NULL; 729 oparams->encode = NULL; 730 oparams->decode_context = NULL; 731 oparams->decode = NULL; 732 oparams->param_version = 0; 733 734 result = SASL_OK; 735 736 cleanup: 737 /* get rid of private information */ 738 if (in16) _plug_free_string(params->utils, &in16); 739 740 /* get rid of all sensitive info */ 741 if (free_password) _plug_free_secret(params-> utils, &password); 742 743 return result; 744} 745 746static void crammd5_client_mech_dispose(void *conn_context, 747 const sasl_utils_t *utils) 748{ 749 client_context_t *text = (client_context_t *) conn_context; 750 751 if (!text) return; 752 753#ifdef _INTEGRATED_SOLARIS_ 754 convert_prompt(utils, &text->h, NULL); 755#endif /* _INTEGRATED_SOLARIS_ */ 756 if (text->out_buf) utils->free(text->out_buf); 757 758 utils->free(text); 759} 760 761static sasl_client_plug_t crammd5_client_plugins[] = 762{ 763 { 764 "CRAM-MD5", /* mech_name */ 765 0, /* max_ssf */ 766 SASL_SEC_NOPLAINTEXT 767 | SASL_SEC_NOANONYMOUS, /* security_flags */ 768 SASL_FEAT_SERVER_FIRST, /* features */ 769 NULL, /* required_prompts */ 770 NULL, /* glob_context */ 771 &crammd5_client_mech_new, /* mech_new */ 772 &crammd5_client_mech_step, /* mech_step */ 773 &crammd5_client_mech_dispose, /* mech_dispose */ 774 NULL, /* mech_free */ 775 NULL, /* idle */ 776 NULL, /* spare */ 777 NULL /* spare */ 778 } 779}; 780 781int crammd5_client_plug_init(const sasl_utils_t *utils, 782 int maxversion, 783 int *out_version, 784 sasl_client_plug_t **pluglist, 785 int *plugcount) 786{ 787 if (maxversion < SASL_CLIENT_PLUG_VERSION) { 788#ifdef _SUN_SDK_ 789 utils->log(NULL, SASL_LOG_ERR, "CRAM version mismatch"); 790#else 791 SETERROR( utils, "CRAM version mismatch"); 792#endif /* _SUN_SDK_ */ 793 return SASL_BADVERS; 794 } 795 796 *out_version = SASL_CLIENT_PLUG_VERSION; 797 *pluglist = crammd5_client_plugins; 798 *plugcount = 1; 799 800 return SASL_OK; 801} 802