• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /***************************************************************************
2  *                                  _   _ ____  _
3  *  Project                     ___| | | |  _ \| |
4  *                             / __| | | | |_) | |
5  *                            | (__| |_| |  _ <| |___
6  *                             \___|\___/|_| \_\_____|
7  *
8  * Copyright (C) 2014 - 2016, Steve Holme, <steve_holme@hotmail.com>.
9  * Copyright (C) 2015 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
10  *
11  * This software is licensed as described in the file COPYING, which
12  * you should have received as part of this distribution. The terms
13  * are also available at https://curl.haxx.se/docs/copyright.html.
14  *
15  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
16  * copies of the Software, and permit persons to whom the Software is
17  * furnished to do so, under the terms of the COPYING file.
18  *
19  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20  * KIND, either express or implied.
21  *
22  * RFC2831 DIGEST-MD5 authentication
23  *
24  ***************************************************************************/
25 
26 #include "curl_setup.h"
27 
28 #if defined(USE_WINDOWS_SSPI) && !defined(CURL_DISABLE_CRYPTO_AUTH)
29 
30 #include <curl/curl.h>
31 
32 #include "vauth/vauth.h"
33 #include "vauth/digest.h"
34 #include "urldata.h"
35 #include "curl_base64.h"
36 #include "warnless.h"
37 #include "curl_multibyte.h"
38 #include "sendf.h"
39 #include "strdup.h"
40 #include "strcase.h"
41 
42 /* The last #include files should be: */
43 #include "curl_memory.h"
44 #include "memdebug.h"
45 
46 /*
47 * Curl_auth_is_digest_supported()
48 *
49 * This is used to evaluate if DIGEST is supported.
50 *
51 * Parameters: None
52 *
53 * Returns TRUE if DIGEST is supported by Windows SSPI.
54 */
Curl_auth_is_digest_supported(void)55 bool Curl_auth_is_digest_supported(void)
56 {
57   PSecPkgInfo SecurityPackage;
58   SECURITY_STATUS status;
59 
60   /* Query the security package for Digest */
61   status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
62                                               &SecurityPackage);
63 
64   return (status == SEC_E_OK ? TRUE : FALSE);
65 }
66 
67 /*
68  * Curl_auth_create_digest_md5_message()
69  *
70  * This is used to generate an already encoded DIGEST-MD5 response message
71  * ready for sending to the recipient.
72  *
73  * Parameters:
74  *
75  * data    [in]     - The session handle.
76  * chlg64  [in]     - The base64 encoded challenge message.
77  * userp   [in]     - The user name in the format User or Domain\User.
78  * passwdp [in]     - The user's password.
79  * service [in]     - The service type such as http, smtp, pop or imap.
80  * outptr  [in/out] - The address where a pointer to newly allocated memory
81  *                    holding the result will be stored upon completion.
82  * outlen  [out]    - The length of the output message.
83  *
84  * Returns CURLE_OK on success.
85  */
Curl_auth_create_digest_md5_message(struct Curl_easy * data,const char * chlg64,const char * userp,const char * passwdp,const char * service,char ** outptr,size_t * outlen)86 CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
87                                              const char *chlg64,
88                                              const char *userp,
89                                              const char *passwdp,
90                                              const char *service,
91                                              char **outptr, size_t *outlen)
92 {
93   CURLcode result = CURLE_OK;
94   TCHAR *spn = NULL;
95   size_t chlglen = 0;
96   size_t token_max = 0;
97   unsigned char *input_token = NULL;
98   unsigned char *output_token = NULL;
99   CredHandle credentials;
100   CtxtHandle context;
101   PSecPkgInfo SecurityPackage;
102   SEC_WINNT_AUTH_IDENTITY identity;
103   SEC_WINNT_AUTH_IDENTITY *p_identity;
104   SecBuffer chlg_buf;
105   SecBuffer resp_buf;
106   SecBufferDesc chlg_desc;
107   SecBufferDesc resp_desc;
108   SECURITY_STATUS status;
109   unsigned long attrs;
110   TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
111 
112   /* Decode the base-64 encoded challenge message */
113   if(strlen(chlg64) && *chlg64 != '=') {
114     result = Curl_base64_decode(chlg64, &input_token, &chlglen);
115     if(result)
116       return result;
117   }
118 
119   /* Ensure we have a valid challenge message */
120   if(!input_token) {
121     infof(data, "DIGEST-MD5 handshake failure (empty challenge message)\n");
122 
123     return CURLE_BAD_CONTENT_ENCODING;
124   }
125 
126   /* Query the security package for DigestSSP */
127   status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
128                                               &SecurityPackage);
129   if(status != SEC_E_OK) {
130     free(input_token);
131 
132     return CURLE_NOT_BUILT_IN;
133   }
134 
135   token_max = SecurityPackage->cbMaxToken;
136 
137   /* Release the package buffer as it is not required anymore */
138   s_pSecFn->FreeContextBuffer(SecurityPackage);
139 
140   /* Allocate our response buffer */
141   output_token = malloc(token_max);
142   if(!output_token) {
143     free(input_token);
144 
145     return CURLE_OUT_OF_MEMORY;
146   }
147 
148   /* Generate our SPN */
149   spn = Curl_auth_build_spn(service, data->conn->host.name, NULL);
150   if(!spn) {
151     free(output_token);
152     free(input_token);
153 
154     return CURLE_OUT_OF_MEMORY;
155   }
156 
157   if(userp && *userp) {
158     /* Populate our identity structure */
159     result = Curl_create_sspi_identity(userp, passwdp, &identity);
160     if(result) {
161       free(spn);
162       free(output_token);
163       free(input_token);
164 
165       return result;
166     }
167 
168     /* Allow proper cleanup of the identity structure */
169     p_identity = &identity;
170   }
171   else
172     /* Use the current Windows user */
173     p_identity = NULL;
174 
175   /* Acquire our credentials handle */
176   status = s_pSecFn->AcquireCredentialsHandle(NULL,
177                                               (TCHAR *) TEXT(SP_NAME_DIGEST),
178                                               SECPKG_CRED_OUTBOUND, NULL,
179                                               p_identity, NULL, NULL,
180                                               &credentials, &expiry);
181 
182   if(status != SEC_E_OK) {
183     Curl_sspi_free_identity(p_identity);
184     free(spn);
185     free(output_token);
186     free(input_token);
187 
188     return CURLE_LOGIN_DENIED;
189   }
190 
191   /* Setup the challenge "input" security buffer */
192   chlg_desc.ulVersion = SECBUFFER_VERSION;
193   chlg_desc.cBuffers  = 1;
194   chlg_desc.pBuffers  = &chlg_buf;
195   chlg_buf.BufferType = SECBUFFER_TOKEN;
196   chlg_buf.pvBuffer   = input_token;
197   chlg_buf.cbBuffer   = curlx_uztoul(chlglen);
198 
199   /* Setup the response "output" security buffer */
200   resp_desc.ulVersion = SECBUFFER_VERSION;
201   resp_desc.cBuffers  = 1;
202   resp_desc.pBuffers  = &resp_buf;
203   resp_buf.BufferType = SECBUFFER_TOKEN;
204   resp_buf.pvBuffer   = output_token;
205   resp_buf.cbBuffer   = curlx_uztoul(token_max);
206 
207   /* Generate our response message */
208   status = s_pSecFn->InitializeSecurityContext(&credentials, NULL, spn,
209                                                0, 0, 0, &chlg_desc, 0,
210                                                &context, &resp_desc, &attrs,
211                                                &expiry);
212 
213   if(status == SEC_I_COMPLETE_NEEDED ||
214      status == SEC_I_COMPLETE_AND_CONTINUE)
215     s_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
216   else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
217     s_pSecFn->FreeCredentialsHandle(&credentials);
218     Curl_sspi_free_identity(p_identity);
219     free(spn);
220     free(output_token);
221     free(input_token);
222 
223     return CURLE_RECV_ERROR;
224   }
225 
226   /* Base64 encode the response */
227   result = Curl_base64_encode(data, (char *) output_token, resp_buf.cbBuffer,
228                               outptr, outlen);
229 
230   /* Free our handles */
231   s_pSecFn->DeleteSecurityContext(&context);
232   s_pSecFn->FreeCredentialsHandle(&credentials);
233 
234   /* Free the identity structure */
235   Curl_sspi_free_identity(p_identity);
236 
237   /* Free the SPN */
238   free(spn);
239 
240   /* Free the response buffer */
241   free(output_token);
242 
243   /* Free the decoded challenge message */
244   free(input_token);
245 
246   return result;
247 }
248 
249 /*
250  * Curl_override_sspi_http_realm()
251  *
252  * This is used to populate the domain in a SSPI identity structure
253  * The realm is extracted from the challenge message and used as the
254  * domain if it is not already explicitly set.
255  *
256  * Parameters:
257  *
258  * chlg     [in]     - The challenge message.
259  * identity [in/out] - The identity structure.
260  *
261  * Returns CURLE_OK on success.
262  */
Curl_override_sspi_http_realm(const char * chlg,SEC_WINNT_AUTH_IDENTITY * identity)263 CURLcode Curl_override_sspi_http_realm(const char *chlg,
264                                        SEC_WINNT_AUTH_IDENTITY *identity)
265 {
266   xcharp_u domain, dup_domain;
267 
268   /* If domain is blank or unset, check challenge message for realm */
269   if(!identity->Domain || !identity->DomainLength) {
270     for(;;) {
271       char value[DIGEST_MAX_VALUE_LENGTH];
272       char content[DIGEST_MAX_CONTENT_LENGTH];
273 
274       /* Pass all additional spaces here */
275       while(*chlg && ISSPACE(*chlg))
276         chlg++;
277 
278       /* Extract a value=content pair */
279       if(Curl_auth_digest_get_pair(chlg, value, content, &chlg)) {
280         if(strcasecompare(value, "realm")) {
281 
282           /* Setup identity's domain and length */
283           domain.tchar_ptr = Curl_convert_UTF8_to_tchar((char *) content);
284           if(!domain.tchar_ptr)
285             return CURLE_OUT_OF_MEMORY;
286 
287           dup_domain.tchar_ptr = _tcsdup(domain.tchar_ptr);
288           if(!dup_domain.tchar_ptr) {
289             Curl_unicodefree(domain.tchar_ptr);
290             return CURLE_OUT_OF_MEMORY;
291           }
292 
293           free(identity->Domain);
294           identity->Domain = dup_domain.tbyte_ptr;
295           identity->DomainLength = curlx_uztoul(_tcslen(dup_domain.tchar_ptr));
296           dup_domain.tchar_ptr = NULL;
297 
298           Curl_unicodefree(domain.tchar_ptr);
299         }
300         else {
301           /* Unknown specifier, ignore it! */
302         }
303       }
304       else
305         break; /* We're done here */
306 
307       /* Pass all additional spaces here */
308       while(*chlg && ISSPACE(*chlg))
309         chlg++;
310 
311       /* Allow the list to be comma-separated */
312       if(',' == *chlg)
313         chlg++;
314     }
315   }
316 
317   return CURLE_OK;
318 }
319 
320 /*
321  * Curl_auth_decode_digest_http_message()
322  *
323  * This is used to decode a HTTP DIGEST challenge message into the separate
324  * attributes.
325  *
326  * Parameters:
327  *
328  * chlg    [in]     - The challenge message.
329  * digest  [in/out] - The digest data struct being used and modified.
330  *
331  * Returns CURLE_OK on success.
332  */
Curl_auth_decode_digest_http_message(const char * chlg,struct digestdata * digest)333 CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
334                                               struct digestdata *digest)
335 {
336   size_t chlglen = strlen(chlg);
337 
338   /* We had an input token before so if there's another one now that means we
339      provided bad credentials in the previous request or it's stale. */
340   if(digest->input_token) {
341     bool stale = false;
342     const char *p = chlg;
343 
344     /* Check for the 'stale' directive */
345     for(;;) {
346       char value[DIGEST_MAX_VALUE_LENGTH];
347       char content[DIGEST_MAX_CONTENT_LENGTH];
348 
349       while(*p && ISSPACE(*p))
350         p++;
351 
352       if(!Curl_auth_digest_get_pair(p, value, content, &p))
353         break;
354 
355       if(strcasecompare(value, "stale") &&
356          strcasecompare(content, "true")) {
357         stale = true;
358         break;
359       }
360 
361       while(*p && ISSPACE(*p))
362         p++;
363 
364       if(',' == *p)
365         p++;
366     }
367 
368     if(stale)
369       Curl_auth_digest_cleanup(digest);
370     else
371       return CURLE_LOGIN_DENIED;
372   }
373 
374   /* Store the challenge for use later */
375   digest->input_token = (BYTE *) Curl_memdup(chlg, chlglen + 1);
376   if(!digest->input_token)
377     return CURLE_OUT_OF_MEMORY;
378 
379   digest->input_token_len = chlglen;
380 
381   return CURLE_OK;
382 }
383 
384 /*
385  * Curl_auth_create_digest_http_message()
386  *
387  * This is used to generate a HTTP DIGEST response message ready for sending
388  * to the recipient.
389  *
390  * Parameters:
391  *
392  * data    [in]     - The session handle.
393  * userp   [in]     - The user name in the format User or Domain\User.
394  * passwdp [in]     - The user's password.
395  * request [in]     - The HTTP request.
396  * uripath [in]     - The path of the HTTP uri.
397  * digest  [in/out] - The digest data struct being used and modified.
398  * outptr  [in/out] - The address where a pointer to newly allocated memory
399  *                    holding the result will be stored upon completion.
400  * outlen  [out]    - The length of the output message.
401  *
402  * Returns CURLE_OK on success.
403  */
Curl_auth_create_digest_http_message(struct Curl_easy * data,const char * userp,const char * passwdp,const unsigned char * request,const unsigned char * uripath,struct digestdata * digest,char ** outptr,size_t * outlen)404 CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
405                                               const char *userp,
406                                               const char *passwdp,
407                                               const unsigned char *request,
408                                               const unsigned char *uripath,
409                                               struct digestdata *digest,
410                                               char **outptr, size_t *outlen)
411 {
412   size_t token_max;
413   char *resp;
414   BYTE *output_token;
415   size_t output_token_len = 0;
416   PSecPkgInfo SecurityPackage;
417   SecBuffer chlg_buf[5];
418   SecBufferDesc chlg_desc;
419   SECURITY_STATUS status;
420 
421   (void) data;
422 
423   /* Query the security package for DigestSSP */
424   status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),
425                                               &SecurityPackage);
426   if(status != SEC_E_OK)
427     return CURLE_NOT_BUILT_IN;
428 
429   token_max = SecurityPackage->cbMaxToken;
430 
431   /* Release the package buffer as it is not required anymore */
432   s_pSecFn->FreeContextBuffer(SecurityPackage);
433 
434   /* Allocate the output buffer according to the max token size as indicated
435      by the security package */
436   output_token = malloc(token_max);
437   if(!output_token) {
438     return CURLE_OUT_OF_MEMORY;
439   }
440 
441   /* If the user/passwd that was used to make the identity for http_context
442      has changed then delete that context. */
443   if((userp && !digest->user) || (!userp && digest->user) ||
444      (passwdp && !digest->passwd) || (!passwdp && digest->passwd) ||
445      (userp && digest->user && strcmp(userp, digest->user)) ||
446      (passwdp && digest->passwd && strcmp(passwdp, digest->passwd))) {
447     if(digest->http_context) {
448       s_pSecFn->DeleteSecurityContext(digest->http_context);
449       Curl_safefree(digest->http_context);
450     }
451     Curl_safefree(digest->user);
452     Curl_safefree(digest->passwd);
453   }
454 
455   if(digest->http_context) {
456     chlg_desc.ulVersion    = SECBUFFER_VERSION;
457     chlg_desc.cBuffers     = 5;
458     chlg_desc.pBuffers     = chlg_buf;
459     chlg_buf[0].BufferType = SECBUFFER_TOKEN;
460     chlg_buf[0].pvBuffer   = NULL;
461     chlg_buf[0].cbBuffer   = 0;
462     chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;
463     chlg_buf[1].pvBuffer   = (void *) request;
464     chlg_buf[1].cbBuffer   = curlx_uztoul(strlen((const char *) request));
465     chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;
466     chlg_buf[2].pvBuffer   = (void *) uripath;
467     chlg_buf[2].cbBuffer   = curlx_uztoul(strlen((const char *) uripath));
468     chlg_buf[3].BufferType = SECBUFFER_PKG_PARAMS;
469     chlg_buf[3].pvBuffer   = NULL;
470     chlg_buf[3].cbBuffer   = 0;
471     chlg_buf[4].BufferType = SECBUFFER_PADDING;
472     chlg_buf[4].pvBuffer   = output_token;
473     chlg_buf[4].cbBuffer   = curlx_uztoul(token_max);
474 
475     status = s_pSecFn->MakeSignature(digest->http_context, 0, &chlg_desc, 0);
476     if(status == SEC_E_OK)
477       output_token_len = chlg_buf[4].cbBuffer;
478     else { /* delete the context so a new one can be made */
479       infof(data, "digest_sspi: MakeSignature failed, error 0x%08lx\n",
480             (long)status);
481       s_pSecFn->DeleteSecurityContext(digest->http_context);
482       Curl_safefree(digest->http_context);
483     }
484   }
485 
486   if(!digest->http_context) {
487     CredHandle credentials;
488     SEC_WINNT_AUTH_IDENTITY identity;
489     SEC_WINNT_AUTH_IDENTITY *p_identity;
490     SecBuffer resp_buf;
491     SecBufferDesc resp_desc;
492     unsigned long attrs;
493     TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
494     TCHAR *spn;
495 
496     /* free the copy of user/passwd used to make the previous identity */
497     Curl_safefree(digest->user);
498     Curl_safefree(digest->passwd);
499 
500     if(userp && *userp) {
501       /* Populate our identity structure */
502       if(Curl_create_sspi_identity(userp, passwdp, &identity)) {
503         free(output_token);
504         return CURLE_OUT_OF_MEMORY;
505       }
506 
507       /* Populate our identity domain */
508       if(Curl_override_sspi_http_realm((const char *) digest->input_token,
509                                        &identity)) {
510         free(output_token);
511         return CURLE_OUT_OF_MEMORY;
512       }
513 
514       /* Allow proper cleanup of the identity structure */
515       p_identity = &identity;
516     }
517     else
518       /* Use the current Windows user */
519       p_identity = NULL;
520 
521     if(userp) {
522       digest->user = strdup(userp);
523 
524       if(!digest->user) {
525         free(output_token);
526         return CURLE_OUT_OF_MEMORY;
527       }
528     }
529 
530     if(passwdp) {
531       digest->passwd = strdup(passwdp);
532 
533       if(!digest->passwd) {
534         free(output_token);
535         Curl_safefree(digest->user);
536         return CURLE_OUT_OF_MEMORY;
537       }
538     }
539 
540     /* Acquire our credentials handle */
541     status = s_pSecFn->AcquireCredentialsHandle(NULL,
542                                                 (TCHAR *) TEXT(SP_NAME_DIGEST),
543                                                 SECPKG_CRED_OUTBOUND, NULL,
544                                                 p_identity, NULL, NULL,
545                                                 &credentials, &expiry);
546     if(status != SEC_E_OK) {
547       Curl_sspi_free_identity(p_identity);
548       free(output_token);
549 
550       return CURLE_LOGIN_DENIED;
551     }
552 
553     /* Setup the challenge "input" security buffer if present */
554     chlg_desc.ulVersion    = SECBUFFER_VERSION;
555     chlg_desc.cBuffers     = 3;
556     chlg_desc.pBuffers     = chlg_buf;
557     chlg_buf[0].BufferType = SECBUFFER_TOKEN;
558     chlg_buf[0].pvBuffer   = digest->input_token;
559     chlg_buf[0].cbBuffer   = curlx_uztoul(digest->input_token_len);
560     chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;
561     chlg_buf[1].pvBuffer   = (void *) request;
562     chlg_buf[1].cbBuffer   = curlx_uztoul(strlen((const char *) request));
563     chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;
564     chlg_buf[2].pvBuffer   = NULL;
565     chlg_buf[2].cbBuffer   = 0;
566 
567     /* Setup the response "output" security buffer */
568     resp_desc.ulVersion = SECBUFFER_VERSION;
569     resp_desc.cBuffers  = 1;
570     resp_desc.pBuffers  = &resp_buf;
571     resp_buf.BufferType = SECBUFFER_TOKEN;
572     resp_buf.pvBuffer   = output_token;
573     resp_buf.cbBuffer   = curlx_uztoul(token_max);
574 
575     spn = Curl_convert_UTF8_to_tchar((char *) uripath);
576     if(!spn) {
577       s_pSecFn->FreeCredentialsHandle(&credentials);
578 
579       Curl_sspi_free_identity(p_identity);
580       free(output_token);
581 
582       return CURLE_OUT_OF_MEMORY;
583     }
584 
585     /* Allocate our new context handle */
586     digest->http_context = calloc(1, sizeof(CtxtHandle));
587     if(!digest->http_context)
588       return CURLE_OUT_OF_MEMORY;
589 
590     /* Generate our response message */
591     status = s_pSecFn->InitializeSecurityContext(&credentials, NULL,
592                                                  spn,
593                                                  ISC_REQ_USE_HTTP_STYLE, 0, 0,
594                                                  &chlg_desc, 0,
595                                                  digest->http_context,
596                                                  &resp_desc, &attrs, &expiry);
597     Curl_unicodefree(spn);
598 
599     if(status == SEC_I_COMPLETE_NEEDED ||
600        status == SEC_I_COMPLETE_AND_CONTINUE)
601       s_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
602     else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
603       s_pSecFn->FreeCredentialsHandle(&credentials);
604 
605       Curl_sspi_free_identity(p_identity);
606       free(output_token);
607 
608       Curl_safefree(digest->http_context);
609 
610       return CURLE_OUT_OF_MEMORY;
611     }
612 
613     output_token_len = resp_buf.cbBuffer;
614 
615     s_pSecFn->FreeCredentialsHandle(&credentials);
616     Curl_sspi_free_identity(p_identity);
617   }
618 
619   resp = malloc(output_token_len + 1);
620   if(!resp) {
621     free(output_token);
622 
623     return CURLE_OUT_OF_MEMORY;
624   }
625 
626   /* Copy the generated response */
627   memcpy(resp, output_token, output_token_len);
628   resp[output_token_len] = 0;
629 
630   /* Return the response */
631   *outptr = resp;
632   *outlen = output_token_len;
633 
634   /* Free the response buffer */
635   free(output_token);
636 
637   return CURLE_OK;
638 }
639 
640 /*
641  * Curl_auth_digest_cleanup()
642  *
643  * This is used to clean up the digest specific data.
644  *
645  * Parameters:
646  *
647  * digest    [in/out] - The digest data struct being cleaned up.
648  *
649  */
Curl_auth_digest_cleanup(struct digestdata * digest)650 void Curl_auth_digest_cleanup(struct digestdata *digest)
651 {
652   /* Free the input token */
653   Curl_safefree(digest->input_token);
654 
655   /* Reset any variables */
656   digest->input_token_len = 0;
657 
658   /* Delete security context */
659   if(digest->http_context) {
660     s_pSecFn->DeleteSecurityContext(digest->http_context);
661     Curl_safefree(digest->http_context);
662   }
663 
664   /* Free the copy of user/passwd used to make the identity for http_context */
665   Curl_safefree(digest->user);
666   Curl_safefree(digest->passwd);
667 }
668 
669 #endif /* USE_WINDOWS_SSPI && !CURL_DISABLE_CRYPTO_AUTH */
670