/* ======================================================================== * Copyright 2018 - 2020 Eduardo Chappa * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * * ======================================================================== */ long auth_oauth2_client (authchallenge_t challenger,authrespond_t responder, char *service,NETMBX *mb,void *stream, unsigned long port, unsigned long *trial,char *user); #ifndef HTTP_OAUTH2_INCLUDED void mm_login_oauth2_c_client_method (NETMBX *, char *, char *, OAUTH2_S *, unsigned long, int *); #endif /* HTTP_OAUTH2_INCLUDED */ AUTHENTICATOR auth_oa2 = { AU_HIDE, /* hidden */ OA2NAME, /* authenticator name */ NIL, /* always valid */ auth_oauth2_client, /* client method */ NIL, /* server method */ NIL /* next authenticator */ }; #define OAUTH2_USER "user=" #define OAUTH2_BEARER "auth=Bearer " #ifndef OAUTH2_GENERATE_STATE #define OAUTH2_GENERATE_STATE char *oauth2_generate_state(void); /* we generate something like a guid, but not care about * anything, but that it is really random. */ char *oauth2_generate_state(void) { char rv[37]; int i; rv[0] = '\0'; for(i = 0; i < 4; i++) sprintf(rv + strlen(rv), "%x", random() % 256); sprintf(rv + strlen(rv), "%c", '-'); for(i = 0; i < 2; i++) sprintf(rv + strlen(rv), "%x", random() % 256); sprintf(rv + strlen(rv), "%c", '-'); for(i = 0; i < 2; i++) sprintf(rv + strlen(rv), "%x", random() % 256); sprintf(rv + strlen(rv), "%c", '-'); for(i = 0; i < 2; i++) sprintf(rv + strlen(rv), "%x", random() % 256); sprintf(rv + strlen(rv), "%c", '-'); for(i = 0; i < 6; i++) sprintf(rv + strlen(rv), "%x", random() % 256); rv[36] = '\0'; return cpystr(rv); } #endif /* OAUTH2_GENERATE_STATE */ /* Client authenticator * Accepts: challenger function * responder function * SASL service name * parsed network mailbox structure * stream argument for functions * pointer to current trial count * returned user name * Returns: T if success, NIL otherwise, number of trials incremented if retry */ long auth_oauth2_client (authchallenge_t challenger,authrespond_t responder, char *service,NETMBX *mb,void *stream, unsigned long port, unsigned long *trial,char *user) { char *u; void *challenge; unsigned long clen; long ret = NIL; OAUTH2_S oauth2; int tryanother = 0; /* try another authentication method */ memset((void *) &oauth2, 0, sizeof(OAUTH2_S)); /* snarl if not SSL/TLS session */ if (!mb->sslflag && !mb->tlsflag) mm_log ("SECURITY PROBLEM: insecure server advertised AUTH=XOAUTH2",WARN); /* get initial (empty) challenge */ if ((challenge = (*challenger) (stream,&clen)) != NULL) { fs_give ((void **) &challenge); if (clen) { /* abort if challenge non-empty */ mm_log ("Server bug: non-empty initial XOAUTH2 challenge",WARN); (*responder) (stream,NIL,0); ret = LONGT; /* will get a BAD response back */ } /* * the call to mm_login_method is supposed to return the username * and access token. If this is not known by the application, then * we call our internal functions to get a refresh token, access token * and expiration time. * * Programmers note: We always call mm_login_method at least once. * The first call is done with empty parameters and it indicates * we are asking the application to load it the best it can. Then * the application returns the loaded value. If we get it fully loaded * we use the value, but if we don't get it fully loaded, we call * our internal functions to try to fully load it. * * If in the internal call we get it loaded, then we use these values * to log in. At this time we call the app to send back the loaded values * so it can save them for the next time we call. This is done in a * second call to mm_login_method. If we do not get oauth2 back with * fully loaded values we cancel authentication completely. If the * user cannot load this variable, then the user, through the client, * should disable XOAUTH2 as an authentication method and try a new one. * * If we make our internal mm_login_oauth2_c_client_method call, * we might still need to call the client to get the access token, * this is done through a callback declared by the client. If we need * that information, but the callback is not declared, this process * will fail, so we will check if that call is declared as soon as we * know we should start it, and we will only start it if this callback * is declared. * * We start this process by calling the client and loading oauth2 * with the required information as best as we can. */ mm_login_method (mb, user, (void *) &oauth2, *trial, OA2NAME); if(oauth2.param[OA2_State].value) fs_give((void **) &oauth2.param[OA2_State].value); oauth2.param[OA2_State].value = oauth2_generate_state(); /* * If we did not get an access token, try to get one through * our internal functions */ if(oauth2.name && oauth2.access_token == NIL){ char *RefreshToken = NIL; if(oauth2.param[OA2_RefreshToken].value) RefreshToken = cpystr(oauth2.param[OA2_RefreshToken].value); mm_login_oauth2_c_client_method (mb, user, OA2NAME, &oauth2, *trial, &tryanother); /* * if we got an access token from the c_client_method call, * or somehow there was a change in the refresh token, return * it to the client so that it will save it. */ if(!tryanother && (oauth2.access_token || (!RefreshToken && oauth2.param[OA2_RefreshToken].value) || (RefreshToken && oauth2.param[OA2_RefreshToken].value && strcmp(RefreshToken, oauth2.param[OA2_RefreshToken].value)))) mm_login_method (mb, user, (void *) &oauth2, *trial, OA2NAME); } /* empty challenge or user requested abort or client does not have info */ if(!oauth2.access_token) { (*responder) (stream,NIL,0); *trial = 0; /* cancel subsequent attempts */ ret = LONGT; /* will get a BAD response back */ } else { unsigned long rlen = strlen(OAUTH2_USER) + strlen(user) + strlen(OAUTH2_BEARER) + strlen(oauth2.access_token) + 1 + 2; char *response = (char *) fs_get (rlen); char *t = response; /* copy authorization id */ for (u = OAUTH2_USER; *u; *t++ = *u++); for (u = user; *u; *t++ = *u++); *t++ = '\001'; /* delimiting ^A */ for (u = OAUTH2_BEARER; *u; *t++ = *u++); for (u = oauth2.access_token; *u; *t++ = *u++); *t++ = '\001'; /* delimiting ^A */ *t++ = '\001'; /* delimiting ^A */ if ((*responder) (stream,response,rlen)) { if ((challenge = (*challenger) (stream,&clen)) != NULL) fs_give ((void **) &challenge); else { ++*trial; /* can try again if necessary */ ret = *trial < 3 ? LONGT : NIL; /* check the authentication */ /* When the Access Token expires we fail once, but after we get * a new one, we should succeed at the second attempt. If the * Refresh Token has expired somehow, we invalidate it if we * reach *trial to 3. This forces the process to restart later on. */ if(*trial == 3){ if(oauth2.param[OA2_State].value) fs_give((void **) &oauth2.param[OA2_State].value); fs_give((void **) &oauth2.param[OA2_RefreshToken].value); fs_give((void **) &oauth2.access_token); oauth2.expiration = 0L; } } } fs_give ((void **) &response); } } if (!ret || !oauth2.name || tryanother) *trial = 65535; /* don't retry if bad protocol */ return ret; } #ifndef HTTP_OAUTH2_INCLUDED #define HTTP_OAUTH2_INCLUDED /* * The code above is enough to implement XOAUTH2, all one needs is the username * and access token and give it to the function above. However, normal users cannot * be expected to get the access token, so we ask the client to help with getting * the access token, refresh token and expire values, so the code below is written * to help with that. */ #include "http.h" #include "json.h" void mm_login_oauth2_c_client_method (NETMBX *mb, char *user, char *method, OAUTH2_S *oauth2, unsigned long trial, int *tryanother) { int i; HTTP_PARAM_S params[OAUTH2_PARAM_NUMBER]; OAUTH2_SERVER_METHOD_S RefreshMethod; char *s = NULL; JSON_S *json = NULL; if(oauth2->param[OA2_Id].value == NULL || oauth2->param[OA2_Secret].value == NULL){ oauth2clientinfo_t ogci = (oauth2clientinfo_t) mail_parameters (NIL, GET_OA2CLIENTINFO, NIL); if(ogci) (*ogci)(oauth2->name, method, &oauth2->param[OA2_Id].value, &oauth2->param[OA2_Secret].value); } if(oauth2->param[OA2_Id].value == NULL || oauth2->param[OA2_Secret].value == NULL) return; /* first check if we have a refresh token, and in that case use it */ if(oauth2->param[OA2_RefreshToken].value){ RefreshMethod = oauth2->server_mthd[OA2_GetAccessTokenFromRefreshToken]; for(i = 0; RefreshMethod.params[i] != OA2_End; i++){ OA2_type j = RefreshMethod.params[i]; params[i].name = oauth2->param[j].name; params[i].value = oauth2->param[j].value; } params[i].name = params[i].value = NULL; if(strcmp(RefreshMethod.name, "POST") == 0) s = http_post_param(RefreshMethod.urlserver, params); else if(strcmp(RefreshMethod.name, "POST2") == 0) s = http_post_param2(RefreshMethod.urlserver, params); if(s){ unsigned char *t, *u; if((t = strstr(s, "\r\n\r\n")) && (u = strchr(t, '{'))) json = json_parse(&u); fs_give((void **) &s); } if(json != NULL){ JSON_X *jx; jx = json_body_value(json, "access_token"); if(jx && jx->jtype == JString) oauth2->access_token = cpystr((char *) jx->value); jx = json_body_value(json, "expires_in"); if(jx){ if(jx->jtype == JString){ unsigned long *l = fs_get(sizeof(unsigned long)); *l = atol((char *) jx->value); fs_give(&jx->value); jx->value = (void *) l; jx->jtype = JLong; } if(jx->jtype == JLong) oauth2->expiration = time(0) + *(unsigned long *) jx->value; } json_free(&json); } return; } /* * else, we do not have a refresh token, nor an access token. * We need to start the process to get an access code. We use this * to get an access token and refresh token. */ { RefreshMethod = oauth2->server_mthd[OA2_GetAccessCode]; for(i = 0; RefreshMethod.params[i] != OA2_End; i++){ OA2_type j = RefreshMethod.params[i]; params[i].name = oauth2->param[j].name; params[i].value = oauth2->param[j].value; } params[i].name = params[i].value = NULL; if(strcmp(RefreshMethod.name, "GET") == 0){ char *url = http_get_param_url(RefreshMethod.urlserver, params); oauth2getaccesscode_t ogac = (oauth2getaccesscode_t) mail_parameters (NIL, GET_OA2CLIENTGETACCESSCODE, NIL); if(ogac) oauth2->param[OA2_Code].value = (*ogac)(url, oauth2, tryanother); } if(oauth2->param[OA2_Code].value){ RefreshMethod = oauth2->server_mthd[OA2_GetAccessTokenFromAccessCode]; for(i = 0; RefreshMethod.params[i] != OA2_End; i++){ OA2_type j = RefreshMethod.params[i]; params[i].name = oauth2->param[j].name; params[i].value = oauth2->param[j].value; } params[i].name = params[i].value = NULL; if(strcmp(RefreshMethod.name, "POST") == 0) s = http_post_param(RefreshMethod.urlserver, params); else if(strcmp(RefreshMethod.name, "POST2") == 0) s = http_post_param2(RefreshMethod.urlserver, params); if(s){ unsigned char *t, *u; if((t = strstr(s, "\r\n\r\n")) && (u = strchr(t, '{'))) json = json_parse(&u); fs_give((void **) &s); } if(json != NULL){ JSON_X *jx; jx = json_body_value(json, "refresh_token"); if(jx && jx->jtype == JString) oauth2->param[OA2_RefreshToken].value = cpystr((char *) jx->value); jx = json_body_value(json, "access_token"); if(jx && jx->jtype == JString) oauth2->access_token = cpystr((char *) jx->value); jx = json_body_value(json, "expires_in"); if(jx){ if(jx->jtype == JString){ unsigned long *l = fs_get(sizeof(unsigned long)); *l = atol((char *) jx->value); fs_give(&jx->value); jx->value = (void *) l; jx->jtype = JLong; } if(jx->jtype == JLong) oauth2->expiration = time(0) + *(unsigned long *) jx->value; } json_free(&json); } } return; } } #endif /* HTTP_OAUTH2_INCLUDED */