GNU SASL consists of a library (`libgsasl'), a command line utility (`gsasl') to access the library from the shell, and a manual. The library includes support for the framework (with authentication functions and application data privacy and integrity functions) and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.
The library is easily ported because it does not do network communication by itself, but rather leaves it up to the calling application. The library is flexible with regards to the authorization infrastructure used, as it utilize a callback into the application to decide whether a user is authorized or not.
GNU SASL is developed for the GNU/Linux system, but runs on over 20 platforms including most major Unix platforms and Windows, and many kind of devices including iPAQ handhelds and S/390 mainframes.
GNU SASL is written in pure ANSI C89 to be portable to embedded and otherwise limited platforms. The entire library, with full support for ANONYMOUS, EXTERNAL, PLAIN, LOGIN and CRAM-MD5, and the front-end that support client and server mode, and the IMAP and SMTP protocols, fits in under 60kb on an Intel x86 platform, without any modifications to the code. (This figure was accurate as of version 0.0.13.)
The library is licensed under the GNU Lesser General Public License, and the command-line interface, self-tests and examples are licensed under the GNU General Public License.
The project web page:
http://www.gnu.org/software/gsasl/
The software archive:
ftp://alpha.gnu.org/pub/gnu/gsasl/
Further information and paid contract development:
Simon Josefsson <simon@josefsson.org>
/* client.c --- Example SASL client. * Copyright (C) 2004, 2005 Simon Josefsson * * This file is part of GNU SASL. * * GNU SASL is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * GNU SASL is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with GNU SASL; if not, write to the Free Software * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * */ #include <stdarg.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <gsasl.h> static void client_authenticate (Gsasl * ctx, Gsasl_session * session) { char buf[BUFSIZ] = ""; char *p; int rc; /* This loop mimic a protocol where the client send data first. */ do { /* Generate client output. */ rc = gsasl_step64 (session, buf, &p); if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK) { /* If sucessful, print it. */ printf ("Output:\n%s\n", p); free (p); } if (rc == GSASL_NEEDS_MORE) { /* If the client need more data from server, get it here. */ printf ("Input base64 encoded data from server:\n"); fgets (buf, sizeof (buf) - 1, stdin); if (buf[strlen (buf) - 1] == '\n') buf[strlen (buf) - 1] = '\0'; } } while (rc == GSASL_NEEDS_MORE); printf ("\n"); if (rc != GSASL_OK) { printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc)); return; } /* The client is done. Here you would typically check if the server let the client in. If not, you could try again. */ printf ("If server accepted us, we're done.\n"); } static void client (Gsasl * ctx) { Gsasl_session *session; const char *mech = "PLAIN"; int rc; /* Create new authentication session. */ if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK) { printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc)); return; } /* Set username and password in session handle. This info will be lost when this session is deallocated below. */ gsasl_property_set (session, GSASL_AUTHID, "jas"); gsasl_property_set (session, GSASL_PASSWORD, "secret"); /* Do it. */ client_authenticate (ctx, session); /* Cleanup. */ gsasl_finish (session); } int main (int argc, char *argv[]) { Gsasl *ctx = NULL; int rc; /* Initialize library. */ if ((rc = gsasl_init (&ctx)) != GSASL_OK) { printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc)); return 1; } /* Do it. */ client (ctx); /* Cleanup. */ gsasl_done (ctx); return 0; }
/* client-serverfirst.c --- Example SASL client, where server send data first. * Copyright (C) 2004, 2005 Simon Josefsson * * This file is part of GNU SASL. * * GNU SASL is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * GNU SASL is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with GNU SASL; if not, write to the Free Software * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * */ #include <stdarg.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <gsasl.h> static void client_authenticate (Gsasl * ctx, Gsasl_session * session) { char buf[BUFSIZ] = ""; char *p; int rc; /* This loop mimic a protocol where the server get to send data first. */ do { printf ("Input base64 encoded data from server:\n"); fgets (buf, sizeof (buf) - 1, stdin); if (buf[strlen (buf) - 1] == '\n') buf[strlen (buf) - 1] = '\0'; rc = gsasl_step64 (session, buf, &p); if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK) { printf ("Output:\n%s\n", p); free (p); } } while (rc == GSASL_NEEDS_MORE); printf ("\n"); if (rc != GSASL_OK) { printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc)); return; } /* The client is done. Here you would typically check if the server let the client in. If not, you could try again. */ printf ("If server accepted us, we're done.\n"); } static void client (Gsasl * ctx) { Gsasl_session *session; const char *mech = "CRAM-MD5"; int rc; /* Create new authentication session. */ if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK) { printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc)); return; } /* Set username and password in session handle. This info will be lost when this session is deallocated below. */ gsasl_property_set (session, GSASL_AUTHID, "jas"); gsasl_property_set (session, GSASL_PASSWORD, "secret"); /* Do it. */ client_authenticate (ctx, session); /* Cleanup. */ gsasl_finish (session); } int main (int argc, char *argv[]) { Gsasl *ctx = NULL; int rc; /* Initialize library. */ if ((rc = gsasl_init (&ctx)) != GSASL_OK) { printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc)); return 1; } /* Do it. */ client (ctx); /* Cleanup. */ gsasl_done (ctx); return 0; }
/* client-mech.c --- Example SASL client, with a choice of mechanism to use. * Copyright (C) 2004, 2005 Simon Josefsson * * This file is part of GNU SASL. * * GNU SASL is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * GNU SASL is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with GNU SASL; if not, write to the Free Software * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * */ #include <stdarg.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <gsasl.h> static void client_authenticate (Gsasl * ctx, Gsasl_session * session) { char buf[BUFSIZ] = ""; char *p; int rc; /* This loop mimic a protocol where the server get to send data first. */ do { printf ("Input base64 encoded data from server:\n"); fgets (buf, sizeof (buf) - 1, stdin); if (buf[strlen (buf) - 1] == '\n') buf[strlen (buf) - 1] = '\0'; rc = gsasl_step64 (session, buf, &p); if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK) { printf ("Output:\n%s\n", p); free (p); } } while (rc == GSASL_NEEDS_MORE); printf ("\n"); if (rc != GSASL_OK) { printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc)); return; } /* The client is done. Here you would typically check if the server let the client in. If not, you could try again. */ printf ("If server accepted us, we're done.\n"); } static const char * client_mechanism (Gsasl * ctx) { static char mech[GSASL_MAX_MECHANISM_SIZE + 1] = ""; char mechlist[BUFSIZ] = ""; const char *suggestion; printf ("Enter list of mechanism that server support, separate by SPC:\n"); fgets (mechlist, sizeof (mechlist) - 1, stdin); suggestion = gsasl_client_suggest_mechanism (ctx, mechlist); if (suggestion) printf ("Library suggest use of `%s'.\n", suggestion); printf ("Enter mechanism to use:\n"); fgets (mech, sizeof (mech) - 1, stdin); mech[strlen (mech) - 1] = '\0'; return mech; } static void client (Gsasl * ctx) { Gsasl_session *session; const char *mech; int rc; /* Find out which mechanism to use. */ mech = client_mechanism (ctx); /* Create new authentication session. */ if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK) { printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc)); return; } /* Set username and password in session handle. This info will be lost when this session is deallocated below. */ gsasl_property_set (session, GSASL_AUTHID, "jas"); gsasl_property_set (session, GSASL_PASSWORD, "secret"); /* Do it. */ client_authenticate (ctx, session); /* Cleanup. */ gsasl_finish (session); } int main (int argc, char *argv[]) { Gsasl *ctx = NULL; int rc; /* Initialize library. */ if ((rc = gsasl_init (&ctx)) != GSASL_OK) { printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc)); return 1; } /* Do it. */ client (ctx); /* Cleanup. */ gsasl_done (ctx); return 0; }
/* client-callback.c --- Example SASL client, with callback for user info. * Copyright (C) 2004, 2005 Simon Josefsson * * This file is part of GNU SASL. * * GNU SASL is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * GNU SASL is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with GNU SASL; if not, write to the Free Software * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * */ #include <stdarg.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <gsasl.h> static void client_authenticate (Gsasl * ctx, Gsasl_session * session) { char buf[BUFSIZ] = ""; char *p; int rc; /* This loop mimic a protocol where the server get to send data first. */ do { printf ("Input base64 encoded data from server:\n"); fgets (buf, sizeof (buf) - 1, stdin); if (buf[strlen (buf) - 1] == '\n') buf[strlen (buf) - 1] = '\0'; rc = gsasl_step64 (session, buf, &p); if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK) { printf ("Output:\n%s\n", p); free (p); } } while (rc == GSASL_NEEDS_MORE); printf ("\n"); if (rc != GSASL_OK) { printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc)); return; } /* The client is done. Here you would typically check if the server let the client in. If not, you could try again. */ printf ("If server accepted us, we're done.\n"); } static void client (Gsasl * ctx) { Gsasl_session *session; const char *mech = "SECURID"; int rc; /* Create new authentication session. */ if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK) { printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc)); return; } /* Do it. */ client_authenticate (ctx, session); /* Cleanup. */ gsasl_finish (session); } static int callback (Gsasl * ctx, Gsasl_session * sctx, Gsasl_property prop) { char buf[BUFSIZ] = ""; int rc = GSASL_NO_CALLBACK; /* Get user info from user. */ printf ("Callback invoked, for property %d.\n", prop); switch (prop) { case GSASL_PASSCODE: printf ("Enter passcode:\n"); fgets (buf, sizeof (buf) - 1, stdin); buf[strlen (buf) - 1] = '\0'; gsasl_property_set (sctx, GSASL_PASSCODE, buf); rc = GSASL_OK; break; case GSASL_AUTHID: printf ("Enter username:\n"); fgets (buf, sizeof (buf) - 1, stdin); buf[strlen (buf) - 1] = '\0'; gsasl_property_set (sctx, GSASL_AUTHID, buf); rc = GSASL_OK; break; default: printf ("Unknown property! Don't worry.\n"); break; } return rc; } int main (int argc, char *argv[]) { Gsasl *ctx = NULL; int rc; /* Initialize library. */ if ((rc = gsasl_init (&ctx)) != GSASL_OK) { printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc)); return 1; } /* Set the callback handler for the library. */ gsasl_callback_set (ctx, callback); /* Do it. */ client (ctx); /* Cleanup. */ gsasl_done (ctx); return 0; }
1.4.7