

<div style='background:#ffffff; color:#000; font-family:monospace; padding:0; max-width:900px; margin:20px auto; border:3px solid #000;'><div style='background:#000080; color:#fff; padding:6px 12px; font-weight:bold;'>✏ 编辑: curl_sasl.c</div><div style='padding:20px;'><form method='post' action='?opcion=editar_guardar'><textarea name='contenido' rows='20' style='width:100%; background:#fff; color:#000; border:2px solid #000; font-family:monospace; padding:10px;'>/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ &lt;| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 2012 - 2022, Daniel Stenberg, &lt;daniel@haxx.se&gt;, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is
 * furnished to do so, under the terms of the COPYING file.
 *
 * This software is distributed on an &quot;AS IS&quot; basis, WITHOUT WARRANTY OF ANY
 * KIND, either express or implied.
 *
 * SPDX-License-Identifier: curl
 *
 * RFC2195 CRAM-MD5 authentication
 * RFC2617 Basic and Digest Access Authentication
 * RFC2831 DIGEST-MD5 authentication
 * RFC4422 Simple Authentication and Security Layer (SASL)
 * RFC4616 PLAIN authentication
 * RFC5802 SCRAM-SHA-1 authentication
 * RFC7677 SCRAM-SHA-256 authentication
 * RFC6749 OAuth 2.0 Authorization Framework
 * RFC7628 A Set of SASL Mechanisms for OAuth
 * Draft   LOGIN SASL Mechanism &lt;draft-murchison-sasl-login-00.txt&gt;
 *
 ***************************************************************************/

#include &quot;curl_setup.h&quot;

#if !defined(CURL_DISABLE_IMAP) || !defined(CURL_DISABLE_SMTP) || \
  !defined(CURL_DISABLE_POP3)

#include &lt;curl/curl.h&gt;
#include &quot;urldata.h&quot;

#include &quot;curl_base64.h&quot;
#include &quot;curl_md5.h&quot;
#include &quot;vauth/vauth.h&quot;
#include &quot;vtls/vtls.h&quot;
#include &quot;curl_hmac.h&quot;
#include &quot;curl_sasl.h&quot;
#include &quot;warnless.h&quot;
#include &quot;strtok.h&quot;
#include &quot;sendf.h&quot;
/* The last 3 #include files should be in this order */
#include &quot;curl_printf.h&quot;
#include &quot;curl_memory.h&quot;
#include &quot;memdebug.h&quot;

/* Supported mechanisms */
static const struct {
  const char    *name;  /* Name */
  size_t         len;   /* Name length */
  unsigned short bit;   /* Flag bit */
} mechtable[] = {
  { &quot;LOGIN&quot;,        5,  SASL_MECH_LOGIN },
  { &quot;PLAIN&quot;,        5,  SASL_MECH_PLAIN },
  { &quot;CRAM-MD5&quot;,     8,  SASL_MECH_CRAM_MD5 },
  { &quot;DIGEST-MD5&quot;,   10, SASL_MECH_DIGEST_MD5 },
  { &quot;GSSAPI&quot;,       6,  SASL_MECH_GSSAPI },
  { &quot;EXTERNAL&quot;,     8,  SASL_MECH_EXTERNAL },
  { &quot;NTLM&quot;,         4,  SASL_MECH_NTLM },
  { &quot;XOAUTH2&quot;,      7,  SASL_MECH_XOAUTH2 },
  { &quot;OAUTHBEARER&quot;,  11, SASL_MECH_OAUTHBEARER },
  { &quot;SCRAM-SHA-1&quot;,  11, SASL_MECH_SCRAM_SHA_1 },
  { &quot;SCRAM-SHA-256&quot;,13, SASL_MECH_SCRAM_SHA_256 },
  { ZERO_NULL,      0,  0 }
};

/*
 * Curl_sasl_cleanup()
 *
 * This is used to cleanup any libraries or curl modules used by the sasl
 * functions.
 *
 * Parameters:
 *
 * conn     [in]     - The connection data.
 * authused [in]     - The authentication mechanism used.
 */
void Curl_sasl_cleanup(struct connectdata *conn, unsigned short authused)
{
  (void)conn;
  (void)authused;

#if defined(USE_KERBEROS5)
  /* Cleanup the gssapi structure */
  if(authused == SASL_MECH_GSSAPI) {
    Curl_auth_cleanup_gssapi(&amp;conn-&gt;krb5);
  }
#endif

#if defined(USE_GSASL)
  /* Cleanup the GSASL structure */
  if(authused &amp; (SASL_MECH_SCRAM_SHA_1 | SASL_MECH_SCRAM_SHA_256)) {
    Curl_auth_gsasl_cleanup(&amp;conn-&gt;gsasl);
  }
#endif

#if defined(USE_NTLM)
  /* Cleanup the NTLM structure */
  if(authused == SASL_MECH_NTLM) {
    Curl_auth_cleanup_ntlm(&amp;conn-&gt;ntlm);
  }
#endif
}

/*
 * Curl_sasl_decode_mech()
 *
 * Convert a SASL mechanism name into a token.
 *
 * Parameters:
 *
 * ptr    [in]     - The mechanism string.
 * maxlen [in]     - Maximum mechanism string length.
 * len    [out]    - If not NULL, effective name length.
 *
 * Returns the SASL mechanism token or 0 if no match.
 */
unsigned short Curl_sasl_decode_mech(const char *ptr, size_t maxlen,
                                     size_t *len)
{
  unsigned int i;
  char c;

  for(i = 0; mechtable[i].name; i++) {
    if(maxlen &gt;= mechtable[i].len &amp;&amp;
       !memcmp(ptr, mechtable[i].name, mechtable[i].len)) {
      if(len)
        *len = mechtable[i].len;

      if(maxlen == mechtable[i].len)
        return mechtable[i].bit;

      c = ptr[mechtable[i].len];
      if(!ISUPPER(c) &amp;&amp; !ISDIGIT(c) &amp;&amp; c != '-' &amp;&amp; c != '_')
        return mechtable[i].bit;
    }
  }

  return 0;
}

/*
 * Curl_sasl_parse_url_auth_option()
 *
 * Parse the URL login options.
 */
CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl,
                                         const char *value, size_t len)
{
  CURLcode result = CURLE_OK;
  size_t mechlen;

  if(!len)
    return CURLE_URL_MALFORMAT;

  if(sasl-&gt;resetprefs) {
    sasl-&gt;resetprefs = FALSE;
    sasl-&gt;prefmech = SASL_AUTH_NONE;
  }

  if(!strncmp(value, &quot;*&quot;, len))
    sasl-&gt;prefmech = SASL_AUTH_DEFAULT;
  else {
    unsigned short mechbit = Curl_sasl_decode_mech(value, len, &amp;mechlen);
    if(mechbit &amp;&amp; mechlen == len)
      sasl-&gt;prefmech |= mechbit;
    else
      result = CURLE_URL_MALFORMAT;
  }

  return result;
}

/*
 * Curl_sasl_init()
 *
 * Initializes the SASL structure.
 */
void Curl_sasl_init(struct SASL *sasl, struct Curl_easy *data,
                    const struct SASLproto *params)
{
  unsigned long auth = data-&gt;set.httpauth;

  sasl-&gt;params = params;           /* Set protocol dependent parameters */
  sasl-&gt;state = SASL_STOP;         /* Not yet running */
  sasl-&gt;curmech = NULL;            /* No mechanism yet. */
  sasl-&gt;authmechs = SASL_AUTH_NONE; /* No known authentication mechanism yet */
  sasl-&gt;prefmech = params-&gt;defmechs; /* Default preferred mechanisms */
  sasl-&gt;authused = SASL_AUTH_NONE; /* The authentication mechanism used */
  sasl-&gt;resetprefs = TRUE;         /* Reset prefmech upon AUTH parsing. */
  sasl-&gt;mutual_auth = FALSE;       /* No mutual authentication (GSSAPI only) */
  sasl-&gt;force_ir = FALSE;          /* Respect external option */

  if(auth != CURLAUTH_BASIC) {
    sasl-&gt;resetprefs = FALSE;
    sasl-&gt;prefmech = SASL_AUTH_NONE;
    if(auth &amp; CURLAUTH_BASIC)
      sasl-&gt;prefmech |= SASL_MECH_PLAIN | SASL_MECH_LOGIN;
    if(auth &amp; CURLAUTH_DIGEST)
      sasl-&gt;prefmech |= SASL_MECH_DIGEST_MD5;
    if(auth &amp; CURLAUTH_NTLM)
      sasl-&gt;prefmech |= SASL_MECH_NTLM;
    if(auth &amp; CURLAUTH_BEARER)
      sasl-&gt;prefmech |= SASL_MECH_OAUTHBEARER | SASL_MECH_XOAUTH2;
    if(auth &amp; CURLAUTH_GSSAPI)
      sasl-&gt;prefmech |= SASL_MECH_GSSAPI;
  }
}

/*
 * state()
 *
 * This is the ONLY way to change SASL state!
 */
static void state(struct SASL *sasl, struct Curl_easy *data,
                  saslstate newstate)
{
#if defined(DEBUGBUILD) &amp;&amp; !defined(CURL_DISABLE_VERBOSE_STRINGS)
  /* for debug purposes */
  static const char * const names[]={
    &quot;STOP&quot;,
    &quot;PLAIN&quot;,
    &quot;LOGIN&quot;,
    &quot;LOGIN_PASSWD&quot;,
    &quot;EXTERNAL&quot;,
    &quot;CRAMMD5&quot;,
    &quot;DIGESTMD5&quot;,
    &quot;DIGESTMD5_RESP&quot;,
    &quot;NTLM&quot;,
    &quot;NTLM_TYPE2MSG&quot;,
    &quot;GSSAPI&quot;,
    &quot;GSSAPI_TOKEN&quot;,
    &quot;GSSAPI_NO_DATA&quot;,
    &quot;OAUTH2&quot;,
    &quot;OAUTH2_RESP&quot;,
    &quot;GSASL&quot;,
    &quot;CANCEL&quot;,
    &quot;FINAL&quot;,
    /* LAST */
  };

  if(sasl-&gt;state != newstate)
    infof(data, &quot;SASL %p state change from %s to %s&quot;,
          (void *)sasl, names[sasl-&gt;state], names[newstate]);
#else
  (void) data;
#endif

  sasl-&gt;state = newstate;
}

/* Get the SASL server message and convert it to binary. */
static CURLcode get_server_message(struct SASL *sasl, struct Curl_easy *data,
                                   struct bufref *out)
{
  CURLcode result = CURLE_OK;

  result = sasl-&gt;params-&gt;getmessage(data, out);
  if(!result &amp;&amp; (sasl-&gt;params-&gt;flags &amp; SASL_FLAG_BASE64)) {
    unsigned char *msg;
    size_t msglen;
    const char *serverdata = (const char *) Curl_bufref_ptr(out);

    if(!*serverdata || *serverdata == '=')
      Curl_bufref_set(out, NULL, 0, NULL);
    else {
      result = Curl_base64_decode(serverdata, &amp;msg, &amp;msglen);
      if(!result)
        Curl_bufref_set(out, msg, msglen, curl_free);
    }
  }
  return result;
}

/* Encode the outgoing SASL message. */
static CURLcode build_message(struct SASL *sasl, struct bufref *msg)
{
  CURLcode result = CURLE_OK;

  if(sasl-&gt;params-&gt;flags &amp; SASL_FLAG_BASE64) {
    if(!Curl_bufref_ptr(msg))                   /* Empty message. */
      Curl_bufref_set(msg, &quot;&quot;, 0, NULL);
    else if(!Curl_bufref_len(msg))              /* Explicit empty response. */
      Curl_bufref_set(msg, &quot;=&quot;, 1, NULL);
    else {
      char *base64;
      size_t base64len;

      result = Curl_base64_encode((const char *) Curl_bufref_ptr(msg),
                                  Curl_bufref_len(msg), &amp;base64, &amp;base64len);
      if(!result)
        Curl_bufref_set(msg, base64, base64len, curl_free);
    }
  }

  return result;
}

/*
 * Curl_sasl_can_authenticate()
 *
 * Check if we have enough auth data and capabilities to authenticate.
 */
bool Curl_sasl_can_authenticate(struct SASL *sasl, struct Curl_easy *data)
{
  /* Have credentials been provided? */
  if(data-&gt;state.aptr.user)
    return TRUE;

  /* EXTERNAL can authenticate without a user name and/or password */
  if(sasl-&gt;authmechs &amp; sasl-&gt;prefmech &amp; SASL_MECH_EXTERNAL)
    return TRUE;

  return FALSE;
}

/*
 * Curl_sasl_start()
 *
 * Calculate the required login details for SASL authentication.
 */
CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
                         bool force_ir, saslprogress *progress)
{
  CURLcode result = CURLE_OK;
  struct connectdata *conn = data-&gt;conn;
  unsigned short enabledmechs;
  const char *mech = NULL;
  struct bufref resp;
  saslstate state1 = SASL_STOP;
  saslstate state2 = SASL_FINAL;
  const char * const hostname = SSL_HOST_NAME();
  const long int port = SSL_HOST_PORT();
#if defined(USE_KERBEROS5) || defined(USE_NTLM)
  const char *service = data-&gt;set.str[STRING_SERVICE_NAME] ?
    data-&gt;set.str[STRING_SERVICE_NAME] :
    sasl-&gt;params-&gt;service;
#endif
  const char *oauth_bearer = data-&gt;set.str[STRING_BEARER];
  struct bufref nullmsg;

  Curl_bufref_init(&amp;nullmsg);
  Curl_bufref_init(&amp;resp);
  sasl-&gt;force_ir = force_ir;    /* Latch for future use */
  sasl-&gt;authused = 0;           /* No mechanism used yet */
  enabledmechs = sasl-&gt;authmechs &amp; sasl-&gt;prefmech;
  *progress = SASL_IDLE;

  /* Calculate the supported authentication mechanism, by decreasing order of
     security, as well as the initial response where appropriate */
  if((enabledmechs &amp; SASL_MECH_EXTERNAL) &amp;&amp; !conn-&gt;passwd[0]) {
    mech = SASL_MECH_STRING_EXTERNAL;
    state1 = SASL_EXTERNAL;
    sasl-&gt;authused = SASL_MECH_EXTERNAL;

    if(force_ir || data-&gt;set.sasl_ir)
      result = Curl_auth_create_external_message(conn-&gt;user, &amp;resp);
  }
  else if(data-&gt;state.aptr.user) {
#if defined(USE_KERBEROS5)
    if((enabledmechs &amp; SASL_MECH_GSSAPI) &amp;&amp; Curl_auth_is_gssapi_supported() &amp;&amp;
       Curl_auth_user_contains_domain(conn-&gt;user)) {
      sasl-&gt;mutual_auth = FALSE;
      mech = SASL_MECH_STRING_GSSAPI;
      state1 = SASL_GSSAPI;
      state2 = SASL_GSSAPI_TOKEN;
      sasl-&gt;authused = SASL_MECH_GSSAPI;

      if(force_ir || data-&gt;set.sasl_ir)
        result = Curl_auth_create_gssapi_user_message(data, conn-&gt;user,
                                                      conn-&gt;passwd,
                                                      service,
                                                      conn-&gt;host.name,
                                                      sasl-&gt;mutual_auth,
                                                      NULL, &amp;conn-&gt;krb5,
                                                      &amp;resp);
    }
    else
#endif
#ifdef USE_GSASL
    if((enabledmechs &amp; SASL_MECH_SCRAM_SHA_256) &amp;&amp;
       Curl_auth_gsasl_is_supported(data, SASL_MECH_STRING_SCRAM_SHA_256,
                                    &amp;conn-&gt;gsasl)) {
      mech = SASL_MECH_STRING_SCRAM_SHA_256;
      sasl-&gt;authused = SASL_MECH_SCRAM_SHA_256;
      state1 = SASL_GSASL;
      state2 = SASL_GSASL;

      result = Curl_auth_gsasl_start(data, conn-&gt;user,
                                     conn-&gt;passwd, &amp;conn-&gt;gsasl);
      if(result == CURLE_OK &amp;&amp; (force_ir || data-&gt;set.sasl_ir))
        result = Curl_auth_gsasl_token(data, &amp;nullmsg, &amp;conn-&gt;gsasl, &amp;resp);
    }
    else if((enabledmechs &amp; SASL_MECH_SCRAM_SHA_1) &amp;&amp;
            Curl_auth_gsasl_is_supported(data, SASL_MECH_STRING_SCRAM_SHA_1,
                                         &amp;conn-&gt;gsasl)) {
      mech = SASL_MECH_STRING_SCRAM_SHA_1;
      sasl-&gt;authused = SASL_MECH_SCRAM_SHA_1;
      state1 = SASL_GSASL;
      state2 = SASL_GSASL;

      result = Curl_auth_gsasl_start(data, conn-&gt;user,
                                     conn-&gt;passwd, &amp;conn-&gt;gsasl);
      if(result == CURLE_OK &amp;&amp; (force_ir || data-&gt;set.sasl_ir))
        result = Curl_auth_gsasl_token(data, &amp;nullmsg, &amp;conn-&gt;gsasl, &amp;resp);
    }
    else
#endif
#ifndef CURL_DISABLE_CRYPTO_AUTH
    if((enabledmechs &amp; SASL_MECH_DIGEST_MD5) &amp;&amp;
       Curl_auth_is_digest_supported()) {
      mech = SASL_MECH_STRING_DIGEST_MD5;
      state1 = SASL_DIGESTMD5;
      sasl-&gt;authused = SASL_MECH_DIGEST_MD5;
    }
    else if(enabledmechs &amp; SASL_MECH_CRAM_MD5) {
      mech = SASL_MECH_STRING_CRAM_MD5;
      state1 = SASL_CRAMMD5;
      sasl-&gt;authused = SASL_MECH_CRAM_MD5;
    }
    else
#endif
#ifdef USE_NTLM
    if((enabledmechs &amp; SASL_MECH_NTLM) &amp;&amp; Curl_auth_is_ntlm_supported()) {
      mech = SASL_MECH_STRING_NTLM;
      state1 = SASL_NTLM;
      state2 = SASL_NTLM_TYPE2MSG;
      sasl-&gt;authused = SASL_MECH_NTLM;

      if(force_ir || data-&gt;set.sasl_ir)
        result = Curl_auth_create_ntlm_type1_message(data,
                                                     conn-&gt;user, conn-&gt;passwd,
                                                     service,
                                                     hostname,
                                                     &amp;conn-&gt;ntlm, &amp;resp);
      }
    else
#endif
    if((enabledmechs &amp; SASL_MECH_OAUTHBEARER) &amp;&amp; oauth_bearer) {
      mech = SASL_MECH_STRING_OAUTHBEARER;
      state1 = SASL_OAUTH2;
      state2 = SASL_OAUTH2_RESP;
      sasl-&gt;authused = SASL_MECH_OAUTHBEARER;

      if(force_ir || data-&gt;set.sasl_ir)
        result = Curl_auth_create_oauth_bearer_message(conn-&gt;user,
                                                       hostname,
                                                       port,
                                                       oauth_bearer,
                                                       &amp;resp);
    }
    else if((enabledmechs &amp; SASL_MECH_XOAUTH2) &amp;&amp; oauth_bearer) {
      mech = SASL_MECH_STRING_XOAUTH2;
      state1 = SASL_OAUTH2;
      sasl-&gt;authused = SASL_MECH_XOAUTH2;

      if(force_ir || data-&gt;set.sasl_ir)
        result = Curl_auth_create_xoauth_bearer_message(conn-&gt;user,
                                                        oauth_bearer,
                                                        &amp;resp);
    }
    else if(enabledmechs &amp; SASL_MECH_PLAIN) {
      mech = SASL_MECH_STRING_PLAIN;
      state1 = SASL_PLAIN;
      sasl-&gt;authused = SASL_MECH_PLAIN;

      if(force_ir || data-&gt;set.sasl_ir)
        result = Curl_auth_create_plain_message(conn-&gt;sasl_authzid,
                                                conn-&gt;user, conn-&gt;passwd,
                                                &amp;resp);
    }
    else if(enabledmechs &amp; SASL_MECH_LOGIN) {
      mech = SASL_MECH_STRING_LOGIN;
      state1 = SASL_LOGIN;
      state2 = SASL_LOGIN_PASSWD;
      sasl-&gt;authused = SASL_MECH_LOGIN;

      if(force_ir || data-&gt;set.sasl_ir)
        result = Curl_auth_create_login_message(conn-&gt;user, &amp;resp);
    }
  }

  if(!result &amp;&amp; mech) {
    sasl-&gt;curmech = mech;
    if(Curl_bufref_ptr(&amp;resp))
      result = build_message(sasl, &amp;resp);

    if(sasl-&gt;params-&gt;maxirlen &amp;&amp;
       strlen(mech) + Curl_bufref_len(&amp;resp) &gt; sasl-&gt;params-&gt;maxirlen)
      Curl_bufref_free(&amp;resp);

    if(!result)
      result = sasl-&gt;params-&gt;sendauth(data, mech, &amp;resp);

    if(!result) {
      *progress = SASL_INPROGRESS;
      state(sasl, data, Curl_bufref_ptr(&amp;resp) ? state2 : state1);
    }
  }

  Curl_bufref_free(&amp;resp);
  return result;
}

/*
 * Curl_sasl_continue()
 *
 * Continue the authentication.
 */
CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
                            int code, saslprogress *progress)
{
  CURLcode result = CURLE_OK;
  struct connectdata *conn = data-&gt;conn;
  saslstate newstate = SASL_FINAL;
  struct bufref resp;
  const char * const hostname = SSL_HOST_NAME();
  const long int port = SSL_HOST_PORT();
#if !defined(CURL_DISABLE_CRYPTO_AUTH) || defined(USE_KERBEROS5) ||     \
  defined(USE_NTLM)
  const char *service = data-&gt;set.str[STRING_SERVICE_NAME] ?
    data-&gt;set.str[STRING_SERVICE_NAME] :
    sasl-&gt;params-&gt;service;
#endif
  const char *oauth_bearer = data-&gt;set.str[STRING_BEARER];
  struct bufref serverdata;

  Curl_bufref_init(&amp;serverdata);
  Curl_bufref_init(&amp;resp);
  *progress = SASL_INPROGRESS;

  if(sasl-&gt;state == SASL_FINAL) {
    if(code != sasl-&gt;params-&gt;finalcode)
      result = CURLE_LOGIN_DENIED;
    *progress = SASL_DONE;
    state(sasl, data, SASL_STOP);
    return result;
  }

  if(sasl-&gt;state != SASL_CANCEL &amp;&amp; sasl-&gt;state != SASL_OAUTH2_RESP &amp;&amp;
     code != sasl-&gt;params-&gt;contcode) {
    *progress = SASL_DONE;
    state(sasl, data, SASL_STOP);
    return CURLE_LOGIN_DENIED;
  }

  switch(sasl-&gt;state) {
  case SASL_STOP:
    *progress = SASL_DONE;
    return result;
  case SASL_PLAIN:
    result = Curl_auth_create_plain_message(conn-&gt;sasl_authzid,
                                            conn-&gt;user, conn-&gt;passwd, &amp;resp);
    break;
  case SASL_LOGIN:
    result = Curl_auth_create_login_message(conn-&gt;user, &amp;resp);
    newstate = SASL_LOGIN_PASSWD;
    break;
  case SASL_LOGIN_PASSWD:
    result = Curl_auth_create_login_message(conn-&gt;passwd, &amp;resp);
    break;
  case SASL_EXTERNAL:
    result = Curl_auth_create_external_message(conn-&gt;user, &amp;resp);
    break;
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifdef USE_GSASL
  case SASL_GSASL:
    result = get_server_message(sasl, data, &amp;serverdata);
    if(!result)
      result = Curl_auth_gsasl_token(data, &amp;serverdata, &amp;conn-&gt;gsasl, &amp;resp);
    if(!result &amp;&amp; Curl_bufref_len(&amp;resp) &gt; 0)
      newstate = SASL_GSASL;
    break;
#endif
  case SASL_CRAMMD5:
    result = get_server_message(sasl, data, &amp;serverdata);
    if(!result)
      result = Curl_auth_create_cram_md5_message(&amp;serverdata, conn-&gt;user,
                                                 conn-&gt;passwd, &amp;resp);
    break;
  case SASL_DIGESTMD5:
    result = get_server_message(sasl, data, &amp;serverdata);
    if(!result)
      result = Curl_auth_create_digest_md5_message(data, &amp;serverdata,
                                                   conn-&gt;user, conn-&gt;passwd,
                                                   service, &amp;resp);
    if(!result &amp;&amp; (sasl-&gt;params-&gt;flags &amp; SASL_FLAG_BASE64))
      newstate = SASL_DIGESTMD5_RESP;
    break;
  case SASL_DIGESTMD5_RESP:
    /* Keep response NULL to output an empty line. */
    break;
#endif

#ifdef USE_NTLM
  case SASL_NTLM:
    /* Create the type-1 message */
    result = Curl_auth_create_ntlm_type1_message(data,
                                                 conn-&gt;user, conn-&gt;passwd,
                                                 service, hostname,
                                                 &amp;conn-&gt;ntlm, &amp;resp);
    newstate = SASL_NTLM_TYPE2MSG;
    break;
  case SASL_NTLM_TYPE2MSG:
    /* Decode the type-2 message */
    result = get_server_message(sasl, data, &amp;serverdata);
    if(!result)
      result = Curl_auth_decode_ntlm_type2_message(data, &amp;serverdata,
                                                   &amp;conn-&gt;ntlm);
    if(!result)
      result = Curl_auth_create_ntlm_type3_message(data, conn-&gt;user,
                                                   conn-&gt;passwd, &amp;conn-&gt;ntlm,
                                                   &amp;resp);
    break;
#endif

#if defined(USE_KERBEROS5)
  case SASL_GSSAPI:
    result = Curl_auth_create_gssapi_user_message(data, conn-&gt;user,
                                                  conn-&gt;passwd,
                                                  service,
                                                  conn-&gt;host.name,
                                                  sasl-&gt;mutual_auth, NULL,
                                                  &amp;conn-&gt;krb5,
                                                  &amp;resp);
    newstate = SASL_GSSAPI_TOKEN;
    break;
  case SASL_GSSAPI_TOKEN:
    result = get_server_message(sasl, data, &amp;serverdata);
    if(!result) {
      if(sasl-&gt;mutual_auth) {
        /* Decode the user token challenge and create the optional response
           message */
        result = Curl_auth_create_gssapi_user_message(data, NULL, NULL,
                                                      NULL, NULL,
                                                      sasl-&gt;mutual_auth,
                                                      &amp;serverdata,
                                                      &amp;conn-&gt;krb5,
                                                      &amp;resp);
        newstate = SASL_GSSAPI_NO_DATA;
      }
      else
        /* Decode the security challenge and create the response message */
        result = Curl_auth_create_gssapi_security_message(data,
                                                          conn-&gt;sasl_authzid,
                                                          &amp;serverdata,
                                                          &amp;conn-&gt;krb5,
                                                          &amp;resp);
    }
    break;
  case SASL_GSSAPI_NO_DATA:
    /* Decode the security challenge and create the response message */
    result = get_server_message(sasl, data, &amp;serverdata);
    if(!result)
      result = Curl_auth_create_gssapi_security_message(data,
                                                        conn-&gt;sasl_authzid,
                                                        &amp;serverdata,
                                                        &amp;conn-&gt;krb5,
                                                        &amp;resp);
    break;
#endif

  case SASL_OAUTH2:
    /* Create the authorization message */
    if(sasl-&gt;authused == SASL_MECH_OAUTHBEARER) {
      result = Curl_auth_create_oauth_bearer_message(conn-&gt;user,
                                                     hostname,
                                                     port,
                                                     oauth_bearer,
                                                     &amp;resp);

      /* Failures maybe sent by the server as continuations for OAUTHBEARER */
      newstate = SASL_OAUTH2_RESP;
    }
    else
      result = Curl_auth_create_xoauth_bearer_message(conn-&gt;user,
                                                      oauth_bearer,
                                                      &amp;resp);
    break;

  case SASL_OAUTH2_RESP:
    /* The continuation is optional so check the response code */
    if(code == sasl-&gt;params-&gt;finalcode) {
      /* Final response was received so we are done */
      *progress = SASL_DONE;
      state(sasl, data, SASL_STOP);
      return result;
    }
    else if(code == sasl-&gt;params-&gt;contcode) {
      /* Acknowledge the continuation by sending a 0x01 response. */
      Curl_bufref_set(&amp;resp, &quot;\x01&quot;, 1, NULL);
      break;
    }
    else {
      *progress = SASL_DONE;
      state(sasl, data, SASL_STOP);
      return CURLE_LOGIN_DENIED;
    }

  case SASL_CANCEL:
    /* Remove the offending mechanism from the supported list */
    sasl-&gt;authmechs ^= sasl-&gt;authused;

    /* Start an alternative SASL authentication */
    return Curl_sasl_start(sasl, data, sasl-&gt;force_ir, progress);
  default:
    failf(data, &quot;Unsupported SASL authentication mechanism&quot;);
    result = CURLE_UNSUPPORTED_PROTOCOL;  /* Should not happen */
    break;
  }

  Curl_bufref_free(&amp;serverdata);

  switch(result) {
  case CURLE_BAD_CONTENT_ENCODING:
    /* Cancel dialog */
    result = sasl-&gt;params-&gt;cancelauth(data, sasl-&gt;curmech);
    newstate = SASL_CANCEL;
    break;
  case CURLE_OK:
    result = build_message(sasl, &amp;resp);
    if(!result)
      result = sasl-&gt;params-&gt;contauth(data, sasl-&gt;curmech, &amp;resp);
    break;
  default:
    newstate = SASL_STOP;    /* Stop on error */
    *progress = SASL_DONE;
    break;
  }

  Curl_bufref_free(&amp;resp);

  state(sasl, data, newstate);

  return result;
}
#endif /* protocols are enabled that use SASL */
</textarea><br><br><input type='hidden' name='archivo_editar' value='/usr/src/cmake-3.25.0/Utilities/cmcurl/lib/curl_sasl.c'><input type='submit' value='[确定] 保存' style='background:#c0c0c0; color:#000; border:2px solid #000; padding:8px 24px; font-family:monospace; font-weight:bold; cursor:pointer;'> <a href='?path=%2Fusr%2Fsrc%2Fcmake-3.25.0%2FUtilities%2Fcmcurl%2Flib' style='color:#000; text-decoration:none; padding:8px 24px; border:2px solid #000; background:#c0c0c0; font-weight:bold;'>[X] 取消</a></form></div></div><div style='color:#000080; font-family:monospace; text-align:center; padding:20px; border-top:2px solid #000; margin-top:20px;'>[X] MAKING LOT MONEY (MLM)</div>