Quelle nsAuthSASL.cpp Sprache: C

/* vim:set ts=4 sw=2 et cindent: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "nsNativeCharsetUtils.h"
#include "nsIPrefService.h"
#include "nsServiceManagerUtils.h"

#include "nsAuthSASL.h"

static const char kNegotiateAuthSSPI[] = "network.auth.use-sspi";

nsAuthSASL::nsAuthSASL() { mSASLReady = false; }

void nsAuthSASL::Reset() { mSASLReady = false; }

/* Limitations apply to this class's thread safety. See the header file */
NS_IMPL_ISUPPORTS(nsAuthSASL, nsIAuthModule)

NS_IMETHODIMP
nsAuthSASL::Init(const nsACString& serviceName, uint32_t serviceFlags,
                 const nsAString& domain, const nsAString& username,
                 const nsAString& password) {
  nsresult rv;

  NS_ASSERTION(!username.IsEmpty(), "SASL requires a username");
  NS_ASSERTION(domain.IsEmpty() && password.IsEmpty(),
               "unexpected credentials");

  mUsername = username;

  // If we're doing SASL, we should do mutual auth
  serviceFlags |= REQ_MUTUAL_AUTH;

  // Find out whether we should be trying SSPI or not
  const char* authType = "kerb-gss";

  nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
  if (prefs) {
    bool val;
    rv = prefs->GetBoolPref(kNegotiateAuthSSPI, &val);
    if (NS_SUCCEEDED(rv) && val) authType = "kerb-sspi";
  }

  MOZ_ALWAYS_TRUE(mInnerModule = nsIAuthModule::CreateInstance(authType));

  mInnerModule->Init(serviceName, serviceFlags, u""_ns, u""_ns, u""_ns);

  return NS_OK;
}

NS_IMETHODIMP
nsAuthSASL::GetNextToken(const void* inToken, uint32_t inTokenLen,
                         void** outToken, uint32_t* outTokenLen) {
  nsresult rv;
  void* unwrappedToken;
  char* message;
  uint32_t unwrappedTokenLen, messageLen;
  nsAutoCString userbuf;

  if (!mInnerModule) return NS_ERROR_NOT_INITIALIZED;

  if (mSASLReady) {
    // If the server COMPLETEs with an empty token, Cyrus sends us that token.
    // I don't think this is correct, but we need to handle that behaviour.
    // Cyrus ignores the contents of our reply token.
    if (inTokenLen == 0) {
      *outToken = nullptr;
      *outTokenLen = 0;
      return NS_OK;
    }
    // We've completed the GSSAPI portion of the handshake, and are
    // now ready to do the SASL security layer and authzid negotiation

    // Input packet from the server needs to be unwrapped.
    rv = mInnerModule->Unwrap(inToken, inTokenLen, &unwrappedToken,
                              &unwrappedTokenLen);
    if (NS_FAILED(rv)) {
      Reset();
      return rv;
    }

    // If we were doing security layers then we'd care what the
    // server had sent us. We're not, so all we had to do was make
    // sure that the signature was correct with the above unwrap()
    free(unwrappedToken);

    NS_CopyUnicodeToNative(mUsername, userbuf);
    messageLen = userbuf.Length() + 4 + 1;
    message = (char*)moz_xmalloc(messageLen);
    message[0] = 0x01;  // No security layer
    message[1] = 0x00;
    message[2] = 0x00;
    message[3] = 0x00;  // Maxbuf must be zero if we've got no sec layer
    strcpy(message + 4, userbuf.get());
    // Userbuf should not be nullptr terminated, so trim the trailing nullptr
    // when wrapping the message
    rv = mInnerModule->Wrap((void*)message, messageLen - 1, false, outToken,
                            outTokenLen);
    free(message);
    Reset();  // All done
    return NS_SUCCEEDED(rv) ? NS_SUCCESS_AUTH_FINISHED : rv;
  }
  rv = mInnerModule->GetNextToken(inToken, inTokenLen, outToken, outTokenLen);
  if (rv == NS_SUCCESS_AUTH_FINISHED) {
    mSASLReady = true;
    rv = NS_OK;
  }
  return rv;
}

NS_IMETHODIMP
nsAuthSASL::Unwrap(const void* inToken, uint32_t inTokenLen, void** outToken,
                   uint32_t* outTokenLen) {
  return NS_ERROR_NOT_IMPLEMENTED;
}

NS_IMETHODIMP
nsAuthSASL::Wrap(const void* inToken, uint32_t inTokenLen, bool confidential,
                 void** outToken, uint32_t* outTokenLen) {
  return NS_ERROR_NOT_IMPLEMENTED;
}

quality100%

¤ Dauer der Verarbeitung: 0.13 Sekunden (vorverarbeitet) ¤

Wurzel

Suchen

Beweissystem der NASA

Beweissystem Isabelle

NIST Cobol Testsuite

Cephes Mathematical Library

Wiener Entwicklungsmethode

Haftungshinweis

Die Informationen auf dieser Webseite wurden nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit, noch Qualität der bereit gestellten Informationen zugesichert.

Bemerkung:

Die farbliche Syntaxdarstellung ist noch experimentell.