/
digest.c
268 lines (241 loc) · 5.98 KB
1
2
3
/*
* OpenConnect (SSL + DTLS) VPN client
*
4
* Copyright © 2008-2015 Intel Corporation.
5
6
7
8
9
10
11
12
13
14
15
16
17
*
* Author: David Woodhouse <dwmw2@infradead.org>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
* version 2.1, as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*/
18
19
#include <config.h>
20
21
#include <errno.h>
#include <string.h>
22
#include <ctype.h>
23
24
25
#include "openconnect-internal.h"
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
#define ALGO_MD5 0
#define ALGO_MD5_SESS 1
static struct oc_text_buf *get_qs(char **str)
{
struct oc_text_buf *res;
int escaped = 0;
char *p = *str;
if (*p != '\"')
return NULL;
res = buf_alloc();
while (*++p) {
if (!escaped && *p == '\"') {
*str = p+1;
if (buf_error(res))
break;
return res;
}
if (escaped)
escaped = 0;
else if (*p == '\\')
escaped = 1;
buf_append_bytes(res, p, 1);
}
buf_free(res);
return NULL;
}
57
static void buf_append_unq(struct oc_text_buf *buf, const char *str)
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
{
while (*str) {
if (*str == '\"' || *str == '\\')
buf_append(buf, "\\");
buf_append_bytes(buf, str, 1);
str++;
}
}
static void buf_append_md5(struct oc_text_buf *buf, void *data, int len)
{
unsigned char md5[16];
if (openconnect_md5(md5, data, len)) {
buf->error = -EIO;
return;
}
76
buf_append_hex(buf, md5, 16);
77
}
78
79
80
int digest_authorization(struct openconnect_info *vpninfo, int proxy,
struct http_auth_state *auth_state,
81
struct oc_text_buf *hdrbuf)
82
{
83
84
85
86
87
88
89
90
91
char *chall;
int ret = -EINVAL;
int algo = ALGO_MD5;
int qop_auth = 0;
int nc = 1;
struct oc_text_buf *realm = NULL, *nonce = NULL, *opaque = NULL;
struct oc_text_buf *a1 = NULL, *a2 = NULL, *kd = NULL;
struct oc_text_buf *cnonce = NULL;
unsigned char cnonce_random[32];
92
const char *user, *pass;
93
94
95
96
97
98
99
100
101
102
if (proxy) {
user = vpninfo->proxy_user;
pass = vpninfo->proxy_pass;
} else {
/* Need to parse this out of the URL */
return -EINVAL;
}
if (!user || !pass)
103
104
return -EINVAL;
105
if (auth_state->state < AUTH_AVAILABLE)
106
107
return -EINVAL;
108
109
if (auth_state->state == AUTH_IN_PROGRESS) {
auth_state->state = AUTH_FAILED;
110
return -EAGAIN;
111
112
}
113
chall = auth_state->challenge;
114
115
116
117
if (!chall)
return -EINVAL;
while (*chall) {
118
if (!realm && !strncmp(chall, "realm=", 6)) {
119
120
121
122
chall += 6;
realm = get_qs(&chall);
if (!realm)
goto err;
123
} else if (!nonce && !strncmp(chall, "nonce=", 6)) {
124
125
126
127
128
129
130
131
132
133
134
135
chall += 6;
nonce = get_qs(&chall);
if (!nonce)
goto err;
} else if (!strncmp(chall, "qop=", 4)) {
chall += 4;
if (strncmp(chall, "\"auth\"", 6)) {
/* We don't support "auth-int" */
goto err;
}
qop_auth = 1;
chall += 6;
136
} else if (!opaque && !strncmp(chall, "opaque=", 7)) {
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
chall += 7;
opaque = get_qs(&chall);
if (!opaque)
goto err;
} else if (!strncmp(chall, "algorithm=", 10)) {
chall += 10;
if (!strncmp(chall, "MD5-sess", 8)) {
algo = ALGO_MD5_SESS;
chall += 8;
} else if (!strncmp(chall, "MD5", 3)) {
algo = ALGO_MD5;
chall += 3;
}
} else {
char *p = strchr(chall, '=');
if (!p)
goto err;
p++;
if (*p == '\"') {
/* Eat and discard a quoted-string */
int escaped = 0;
p++;
do {
if (escaped)
escaped = 0;
else if (*p == '\\')
escaped = 1;
if (!*p)
goto err;
} while (escaped || *p != '\"');
chall = p+1;
} else {
/* Not quoted. Just find the next comma (or EOL) */
p = strchr(p, ',');
if (!p)
break;
chall = p;
}
}
176
while (isspace((int)(unsigned char)*chall))
177
178
179
180
181
182
chall++;
if (!*chall)
break;
if (*chall != ',')
goto err;
chall++;
183
while (isspace((int)(unsigned char)*chall))
184
185
186
187
188
189
190
191
192
193
194
chall++;
if (!*chall)
break;
}
if (!nonce || !realm)
goto err;
if (openconnect_random(&cnonce_random, sizeof(cnonce_random)))
goto err;
cnonce = buf_alloc();
buf_append_base64(cnonce, cnonce_random, sizeof(cnonce_random));
195
196
if (buf_error(cnonce))
goto err;
197
198
199
200
201
202
/*
* According to RFC2617 §3.2.2.2:
* A1 = unq(username-value) ":" unq(realm-value) ":" passwd
* So the username is escaped, while the password isn't.
*/
203
a1 = buf_alloc();
204
205
buf_append_unq(a1, user);
buf_append(a1, ":%s:%s", realm->data, pass);
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
if (buf_error(a1))
goto err;
if (algo == ALGO_MD5_SESS) {
struct oc_text_buf *old_a1 = a1;
a1 = buf_alloc();
buf_append_md5(a1, old_a1->data, old_a1->pos);
buf_free(old_a1);
buf_append(a1, ":%s:%s\n", nonce->data, cnonce->data);
if (buf_error(a1))
goto err;
}
a2 = buf_alloc();
buf_append(a2, "CONNECT:%s:%d", vpninfo->hostname, vpninfo->port);
if (buf_error(a2))
goto err;
kd = buf_alloc();
buf_append_md5(kd, a1->data, a1->pos);
buf_append(kd, ":%s:", nonce->data);
if (qop_auth) {
buf_append(kd, "%08x:%s:auth:", nc, cnonce->data);
}
buf_append_md5(kd, a2->data, a2->pos);
231
232
if (buf_error(kd))
goto err;
233
234
235
buf_append(hdrbuf, "%sAuthorization: Digest username=\"", proxy ? "Proxy-" : "");
buf_append_unq(hdrbuf, user);
236
237
238
239
240
241
242
243
244
245
246
247
248
buf_append(hdrbuf, "\", realm=\"%s\", nonce=\"%s\", uri=\"%s:%d\", ",
realm->data, nonce->data, vpninfo->hostname, vpninfo->port);
if (qop_auth)
buf_append(hdrbuf, "cnonce=\"%s\", nc=%08x, qop=auth, ",
cnonce->data, nc);
if (opaque)
buf_append(hdrbuf, "opaque=\"%s\", ", opaque->data);
buf_append(hdrbuf, "response=\"");
buf_append_md5(hdrbuf, kd->data, kd->pos);
buf_append(hdrbuf, "\"\r\n");
ret = 0;
249
auth_state->state = AUTH_IN_PROGRESS;
250
251
252
253
254
255
256
if (proxy)
vpn_progress(vpninfo, PRG_INFO,
_("Attempting Digest authentication to proxy\n"));
else
vpn_progress(vpninfo, PRG_INFO,
_("Attempting Digest authentication to server '%s'\n"),
vpninfo->hostname);
257
err:
258
259
if (a1 && a1->data)
memset(a1->data, 0, a1->pos);
260
261
262
263
264
265
266
267
buf_free(a1);
buf_free(a2);
buf_free(kd);
buf_free(realm);
buf_free(nonce);
buf_free(cnonce);
buf_free(opaque);
return ret;
268
}