curl_ntlm.c 6.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at http://curl.haxx.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. ***************************************************************************/
  22. #include "curl_setup.h"
  23. #ifdef USE_NTLM
  24. /*
  25. * NTLM details:
  26. *
  27. * http://davenport.sourceforge.net/ntlm.html
  28. * http://www.innovation.ch/java/ntlm.html
  29. */
  30. #define DEBUG_ME 0
  31. #include "urldata.h"
  32. #include "sendf.h"
  33. #include "rawstr.h"
  34. #include "curl_ntlm.h"
  35. #include "curl_ntlm_msgs.h"
  36. #include "curl_ntlm_wb.h"
  37. #include "url.h"
  38. #include "curl_memory.h"
  39. #define _MPRINTF_REPLACE /* use our functions only */
  40. #include <curl/mprintf.h>
  41. #if defined(USE_NSS)
  42. #include "nssg.h"
  43. #elif defined(USE_WINDOWS_SSPI)
  44. #include "curl_sspi.h"
  45. #endif
  46. /* The last #include file should be: */
  47. #include "memdebug.h"
  48. #if DEBUG_ME
  49. # define DEBUG_OUT(x) x
  50. #else
  51. # define DEBUG_OUT(x) Curl_nop_stmt
  52. #endif
  53. CURLcode Curl_input_ntlm(struct connectdata *conn,
  54. bool proxy, /* if proxy or not */
  55. const char *header) /* rest of the www-authenticate:
  56. header */
  57. {
  58. /* point to the correct struct with this */
  59. struct ntlmdata *ntlm;
  60. CURLcode result = CURLE_OK;
  61. #ifdef USE_NSS
  62. result = Curl_nss_force_init(conn->data);
  63. if(result)
  64. return result;
  65. #endif
  66. ntlm = proxy ? &conn->proxyntlm : &conn->ntlm;
  67. /* skip initial whitespaces */
  68. while(*header && ISSPACE(*header))
  69. header++;
  70. if(checkprefix("NTLM", header)) {
  71. header += strlen("NTLM");
  72. while(*header && ISSPACE(*header))
  73. header++;
  74. if(*header) {
  75. result = Curl_ntlm_decode_type2_message(conn->data, header, ntlm);
  76. if(CURLE_OK != result)
  77. return result;
  78. ntlm->state = NTLMSTATE_TYPE2; /* We got a type-2 message */
  79. }
  80. else {
  81. if(ntlm->state == NTLMSTATE_TYPE3) {
  82. infof(conn->data, "NTLM handshake rejected\n");
  83. Curl_http_ntlm_cleanup(conn);
  84. ntlm->state = NTLMSTATE_NONE;
  85. return CURLE_REMOTE_ACCESS_DENIED;
  86. }
  87. else if(ntlm->state >= NTLMSTATE_TYPE1) {
  88. infof(conn->data, "NTLM handshake failure (internal error)\n");
  89. return CURLE_REMOTE_ACCESS_DENIED;
  90. }
  91. ntlm->state = NTLMSTATE_TYPE1; /* We should send away a type-1 */
  92. }
  93. }
  94. return result;
  95. }
  96. /*
  97. * This is for creating ntlm header output
  98. */
  99. CURLcode Curl_output_ntlm(struct connectdata *conn,
  100. bool proxy)
  101. {
  102. char *base64 = NULL;
  103. size_t len = 0;
  104. CURLcode error;
  105. /* point to the address of the pointer that holds the string to send to the
  106. server, which is for a plain host or for a HTTP proxy */
  107. char **allocuserpwd;
  108. /* point to the name and password for this */
  109. const char *userp;
  110. const char *passwdp;
  111. /* point to the correct struct with this */
  112. struct ntlmdata *ntlm;
  113. struct auth *authp;
  114. DEBUGASSERT(conn);
  115. DEBUGASSERT(conn->data);
  116. #ifdef USE_NSS
  117. if(CURLE_OK != Curl_nss_force_init(conn->data))
  118. return CURLE_OUT_OF_MEMORY;
  119. #endif
  120. if(proxy) {
  121. allocuserpwd = &conn->allocptr.proxyuserpwd;
  122. userp = conn->proxyuser;
  123. passwdp = conn->proxypasswd;
  124. ntlm = &conn->proxyntlm;
  125. authp = &conn->data->state.authproxy;
  126. }
  127. else {
  128. allocuserpwd = &conn->allocptr.userpwd;
  129. userp = conn->user;
  130. passwdp = conn->passwd;
  131. ntlm = &conn->ntlm;
  132. authp = &conn->data->state.authhost;
  133. }
  134. authp->done = FALSE;
  135. /* not set means empty */
  136. if(!userp)
  137. userp = "";
  138. if(!passwdp)
  139. passwdp = "";
  140. #ifdef USE_WINDOWS_SSPI
  141. if(s_hSecDll == NULL) {
  142. /* not thread safe and leaks - use curl_global_init() to avoid */
  143. CURLcode err = Curl_sspi_global_init();
  144. if(s_hSecDll == NULL)
  145. return err;
  146. }
  147. #endif
  148. switch(ntlm->state) {
  149. case NTLMSTATE_TYPE1:
  150. default: /* for the weird cases we (re)start here */
  151. /* Create a type-1 message */
  152. error = Curl_ntlm_create_type1_message(userp, passwdp, ntlm, &base64,
  153. &len);
  154. if(error)
  155. return error;
  156. if(base64) {
  157. Curl_safefree(*allocuserpwd);
  158. *allocuserpwd = aprintf("%sAuthorization: NTLM %s\r\n",
  159. proxy ? "Proxy-" : "",
  160. base64);
  161. free(base64);
  162. if(!*allocuserpwd)
  163. return CURLE_OUT_OF_MEMORY;
  164. DEBUG_OUT(fprintf(stderr, "**** Header %s\n ", *allocuserpwd));
  165. }
  166. break;
  167. case NTLMSTATE_TYPE2:
  168. /* We already received the type-2 message, create a type-3 message */
  169. error = Curl_ntlm_create_type3_message(conn->data, userp, passwdp,
  170. ntlm, &base64, &len);
  171. if(error)
  172. return error;
  173. if(base64) {
  174. Curl_safefree(*allocuserpwd);
  175. *allocuserpwd = aprintf("%sAuthorization: NTLM %s\r\n",
  176. proxy ? "Proxy-" : "",
  177. base64);
  178. free(base64);
  179. if(!*allocuserpwd)
  180. return CURLE_OUT_OF_MEMORY;
  181. DEBUG_OUT(fprintf(stderr, "**** %s\n ", *allocuserpwd));
  182. ntlm->state = NTLMSTATE_TYPE3; /* we send a type-3 */
  183. authp->done = TRUE;
  184. }
  185. break;
  186. case NTLMSTATE_TYPE3:
  187. /* connection is already authenticated,
  188. * don't send a header in future requests */
  189. Curl_safefree(*allocuserpwd);
  190. authp->done = TRUE;
  191. break;
  192. }
  193. return CURLE_OK;
  194. }
  195. void Curl_http_ntlm_cleanup(struct connectdata *conn)
  196. {
  197. #ifdef USE_WINDOWS_SSPI
  198. Curl_ntlm_sspi_cleanup(&conn->ntlm);
  199. Curl_ntlm_sspi_cleanup(&conn->proxyntlm);
  200. #elif defined(NTLM_WB_ENABLED)
  201. Curl_ntlm_wb_cleanup(conn);
  202. #else
  203. (void)conn;
  204. #endif
  205. }
  206. #endif /* USE_NTLM */