curl_ntlm_wb.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. #include "curl_setup.h"
  25. #if !defined(CURL_DISABLE_HTTP) && defined(USE_NTLM) && \
  26. defined(NTLM_WB_ENABLED)
  27. /*
  28. * NTLM details:
  29. *
  30. * https://davenport.sourceforge.net/ntlm.html
  31. * https://www.innovation.ch/java/ntlm.html
  32. */
  33. #define DEBUG_ME 0
  34. #ifdef HAVE_SYS_WAIT_H
  35. #include <sys/wait.h>
  36. #endif
  37. #ifdef HAVE_SIGNAL_H
  38. #include <signal.h>
  39. #endif
  40. #ifdef HAVE_PWD_H
  41. #include <pwd.h>
  42. #endif
  43. #include "urldata.h"
  44. #include "sendf.h"
  45. #include "select.h"
  46. #include "vauth/ntlm.h"
  47. #include "curl_ntlm_core.h"
  48. #include "curl_ntlm_wb.h"
  49. #include "url.h"
  50. #include "strerror.h"
  51. #include "strdup.h"
  52. #include "strcase.h"
  53. /* The last 3 #include files should be in this order */
  54. #include "curl_printf.h"
  55. #include "curl_memory.h"
  56. #include "memdebug.h"
  57. #if DEBUG_ME
  58. # define DEBUG_OUT(x) x
  59. #else
  60. # define DEBUG_OUT(x) Curl_nop_stmt
  61. #endif
  62. /* Portable 'sclose_nolog' used only in child process instead of 'sclose'
  63. to avoid fooling the socket leak detector */
  64. #if defined(HAVE_CLOSESOCKET)
  65. # define sclose_nolog(x) closesocket((x))
  66. #elif defined(HAVE_CLOSESOCKET_CAMEL)
  67. # define sclose_nolog(x) CloseSocket((x))
  68. #else
  69. # define sclose_nolog(x) close((x))
  70. #endif
  71. static void ntlm_wb_cleanup(struct ntlmdata *ntlm)
  72. {
  73. if(ntlm->ntlm_auth_hlpr_socket != CURL_SOCKET_BAD) {
  74. sclose(ntlm->ntlm_auth_hlpr_socket);
  75. ntlm->ntlm_auth_hlpr_socket = CURL_SOCKET_BAD;
  76. }
  77. if(ntlm->ntlm_auth_hlpr_pid) {
  78. int i;
  79. for(i = 0; i < 4; i++) {
  80. pid_t ret = waitpid(ntlm->ntlm_auth_hlpr_pid, NULL, WNOHANG);
  81. if(ret == ntlm->ntlm_auth_hlpr_pid || errno == ECHILD)
  82. break;
  83. switch(i) {
  84. case 0:
  85. kill(ntlm->ntlm_auth_hlpr_pid, SIGTERM);
  86. break;
  87. case 1:
  88. /* Give the process another moment to shut down cleanly before
  89. bringing down the axe */
  90. Curl_wait_ms(1);
  91. break;
  92. case 2:
  93. kill(ntlm->ntlm_auth_hlpr_pid, SIGKILL);
  94. break;
  95. case 3:
  96. break;
  97. }
  98. }
  99. ntlm->ntlm_auth_hlpr_pid = 0;
  100. }
  101. Curl_safefree(ntlm->challenge);
  102. Curl_safefree(ntlm->response);
  103. }
  104. static CURLcode ntlm_wb_init(struct Curl_easy *data, struct ntlmdata *ntlm,
  105. const char *userp)
  106. {
  107. curl_socket_t sockfds[2];
  108. pid_t child_pid;
  109. const char *username;
  110. char *slash, *domain = NULL;
  111. const char *ntlm_auth = NULL;
  112. char *ntlm_auth_alloc = NULL;
  113. #if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
  114. struct passwd pw, *pw_res;
  115. char pwbuf[1024];
  116. #endif
  117. char buffer[STRERROR_LEN];
  118. #if defined(CURL_DISABLE_VERBOSE_STRINGS)
  119. (void) data;
  120. #endif
  121. /* Return if communication with ntlm_auth already set up */
  122. if(ntlm->ntlm_auth_hlpr_socket != CURL_SOCKET_BAD ||
  123. ntlm->ntlm_auth_hlpr_pid)
  124. return CURLE_OK;
  125. username = userp;
  126. /* The real ntlm_auth really doesn't like being invoked with an
  127. empty username. It won't make inferences for itself, and expects
  128. the client to do so (mostly because it's really designed for
  129. servers like squid to use for auth, and client support is an
  130. afterthought for it). So try hard to provide a suitable username
  131. if we don't already have one. But if we can't, provide the
  132. empty one anyway. Perhaps they have an implementation of the
  133. ntlm_auth helper which *doesn't* need it so we might as well try */
  134. if(!username || !username[0]) {
  135. username = getenv("NTLMUSER");
  136. if(!username || !username[0])
  137. username = getenv("LOGNAME");
  138. if(!username || !username[0])
  139. username = getenv("USER");
  140. #if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
  141. if((!username || !username[0]) &&
  142. !getpwuid_r(geteuid(), &pw, pwbuf, sizeof(pwbuf), &pw_res) &&
  143. pw_res) {
  144. username = pw.pw_name;
  145. }
  146. #endif
  147. if(!username || !username[0])
  148. username = userp;
  149. }
  150. slash = strpbrk(username, "\\/");
  151. if(slash) {
  152. domain = strdup(username);
  153. if(!domain)
  154. return CURLE_OUT_OF_MEMORY;
  155. slash = domain + (slash - username);
  156. *slash = '\0';
  157. username = username + (slash - domain) + 1;
  158. }
  159. /* For testing purposes, when DEBUGBUILD is defined and environment
  160. variable CURL_NTLM_WB_FILE is set a fake_ntlm is used to perform
  161. NTLM challenge/response which only accepts commands and output
  162. strings pre-written in test case definitions */
  163. #ifdef DEBUGBUILD
  164. ntlm_auth_alloc = curl_getenv("CURL_NTLM_WB_FILE");
  165. if(ntlm_auth_alloc)
  166. ntlm_auth = ntlm_auth_alloc;
  167. else
  168. #endif
  169. ntlm_auth = NTLM_WB_FILE;
  170. if(access(ntlm_auth, X_OK) != 0) {
  171. failf(data, "Could not access ntlm_auth: %s errno %d: %s",
  172. ntlm_auth, errno, Curl_strerror(errno, buffer, sizeof(buffer)));
  173. goto done;
  174. }
  175. if(Curl_socketpair(AF_UNIX, SOCK_STREAM, 0, sockfds)) {
  176. failf(data, "Could not open socket pair. errno %d: %s",
  177. errno, Curl_strerror(errno, buffer, sizeof(buffer)));
  178. goto done;
  179. }
  180. child_pid = fork();
  181. if(child_pid == -1) {
  182. sclose(sockfds[0]);
  183. sclose(sockfds[1]);
  184. failf(data, "Could not fork. errno %d: %s",
  185. errno, Curl_strerror(errno, buffer, sizeof(buffer)));
  186. goto done;
  187. }
  188. else if(!child_pid) {
  189. /*
  190. * child process
  191. */
  192. /* Don't use sclose in the child since it fools the socket leak detector */
  193. sclose_nolog(sockfds[0]);
  194. if(dup2(sockfds[1], STDIN_FILENO) == -1) {
  195. failf(data, "Could not redirect child stdin. errno %d: %s",
  196. errno, Curl_strerror(errno, buffer, sizeof(buffer)));
  197. exit(1);
  198. }
  199. if(dup2(sockfds[1], STDOUT_FILENO) == -1) {
  200. failf(data, "Could not redirect child stdout. errno %d: %s",
  201. errno, Curl_strerror(errno, buffer, sizeof(buffer)));
  202. exit(1);
  203. }
  204. if(domain)
  205. execl(ntlm_auth, ntlm_auth,
  206. "--helper-protocol", "ntlmssp-client-1",
  207. "--use-cached-creds",
  208. "--username", username,
  209. "--domain", domain,
  210. NULL);
  211. else
  212. execl(ntlm_auth, ntlm_auth,
  213. "--helper-protocol", "ntlmssp-client-1",
  214. "--use-cached-creds",
  215. "--username", username,
  216. NULL);
  217. sclose_nolog(sockfds[1]);
  218. failf(data, "Could not execl(). errno %d: %s",
  219. errno, Curl_strerror(errno, buffer, sizeof(buffer)));
  220. exit(1);
  221. }
  222. sclose(sockfds[1]);
  223. ntlm->ntlm_auth_hlpr_socket = sockfds[0];
  224. ntlm->ntlm_auth_hlpr_pid = child_pid;
  225. free(domain);
  226. free(ntlm_auth_alloc);
  227. return CURLE_OK;
  228. done:
  229. free(domain);
  230. free(ntlm_auth_alloc);
  231. return CURLE_REMOTE_ACCESS_DENIED;
  232. }
  233. /* if larger than this, something is seriously wrong */
  234. #define MAX_NTLM_WB_RESPONSE 100000
  235. static CURLcode ntlm_wb_response(struct Curl_easy *data, struct ntlmdata *ntlm,
  236. const char *input, curlntlm state)
  237. {
  238. size_t len_in = strlen(input), len_out = 0;
  239. struct dynbuf b;
  240. char *ptr = NULL;
  241. unsigned char *buf = (unsigned char *)data->state.buffer;
  242. Curl_dyn_init(&b, MAX_NTLM_WB_RESPONSE);
  243. while(len_in > 0) {
  244. ssize_t written = swrite(ntlm->ntlm_auth_hlpr_socket, input, len_in);
  245. if(written == -1) {
  246. /* Interrupted by a signal, retry it */
  247. if(errno == EINTR)
  248. continue;
  249. /* write failed if other errors happen */
  250. goto done;
  251. }
  252. input += written;
  253. len_in -= written;
  254. }
  255. /* Read one line */
  256. while(1) {
  257. ssize_t size =
  258. sread(ntlm->ntlm_auth_hlpr_socket, buf, data->set.buffer_size);
  259. if(size == -1) {
  260. if(errno == EINTR)
  261. continue;
  262. goto done;
  263. }
  264. else if(size == 0)
  265. goto done;
  266. if(Curl_dyn_addn(&b, buf, size))
  267. goto done;
  268. len_out = Curl_dyn_len(&b);
  269. ptr = Curl_dyn_ptr(&b);
  270. if(len_out && ptr[len_out - 1] == '\n') {
  271. ptr[len_out - 1] = '\0';
  272. break; /* done! */
  273. }
  274. /* loop */
  275. }
  276. /* Samba/winbind installed but not configured */
  277. if(state == NTLMSTATE_TYPE1 &&
  278. len_out == 3 &&
  279. ptr[0] == 'P' && ptr[1] == 'W')
  280. goto done;
  281. /* invalid response */
  282. if(len_out < 4)
  283. goto done;
  284. if(state == NTLMSTATE_TYPE1 &&
  285. (ptr[0]!='Y' || ptr[1]!='R' || ptr[2]!=' '))
  286. goto done;
  287. if(state == NTLMSTATE_TYPE2 &&
  288. (ptr[0]!='K' || ptr[1]!='K' || ptr[2]!=' ') &&
  289. (ptr[0]!='A' || ptr[1]!='F' || ptr[2]!=' '))
  290. goto done;
  291. ntlm->response = strdup(ptr + 3);
  292. Curl_dyn_free(&b);
  293. if(!ntlm->response)
  294. return CURLE_OUT_OF_MEMORY;
  295. return CURLE_OK;
  296. done:
  297. Curl_dyn_free(&b);
  298. return CURLE_REMOTE_ACCESS_DENIED;
  299. }
  300. CURLcode Curl_input_ntlm_wb(struct Curl_easy *data,
  301. struct connectdata *conn,
  302. bool proxy,
  303. const char *header)
  304. {
  305. struct ntlmdata *ntlm = proxy ? &conn->proxyntlm : &conn->ntlm;
  306. curlntlm *state = proxy ? &conn->proxy_ntlm_state : &conn->http_ntlm_state;
  307. (void) data; /* In case it gets unused by nop log macros. */
  308. if(!checkprefix("NTLM", header))
  309. return CURLE_BAD_CONTENT_ENCODING;
  310. header += strlen("NTLM");
  311. while(*header && ISSPACE(*header))
  312. header++;
  313. if(*header) {
  314. ntlm->challenge = strdup(header);
  315. if(!ntlm->challenge)
  316. return CURLE_OUT_OF_MEMORY;
  317. *state = NTLMSTATE_TYPE2; /* We got a type-2 message */
  318. }
  319. else {
  320. if(*state == NTLMSTATE_LAST) {
  321. infof(data, "NTLM auth restarted");
  322. Curl_http_auth_cleanup_ntlm_wb(conn);
  323. }
  324. else if(*state == NTLMSTATE_TYPE3) {
  325. infof(data, "NTLM handshake rejected");
  326. Curl_http_auth_cleanup_ntlm_wb(conn);
  327. *state = NTLMSTATE_NONE;
  328. return CURLE_REMOTE_ACCESS_DENIED;
  329. }
  330. else if(*state >= NTLMSTATE_TYPE1) {
  331. infof(data, "NTLM handshake failure (internal error)");
  332. return CURLE_REMOTE_ACCESS_DENIED;
  333. }
  334. *state = NTLMSTATE_TYPE1; /* We should send away a type-1 */
  335. }
  336. return CURLE_OK;
  337. }
  338. /*
  339. * This is for creating ntlm header output by delegating challenge/response
  340. * to Samba's winbind daemon helper ntlm_auth.
  341. */
  342. CURLcode Curl_output_ntlm_wb(struct Curl_easy *data, struct connectdata *conn,
  343. bool proxy)
  344. {
  345. /* point to the address of the pointer that holds the string to send to the
  346. server, which is for a plain host or for an HTTP proxy */
  347. char **allocuserpwd;
  348. /* point to the name and password for this */
  349. const char *userp;
  350. struct ntlmdata *ntlm;
  351. curlntlm *state;
  352. struct auth *authp;
  353. CURLcode res = CURLE_OK;
  354. DEBUGASSERT(conn);
  355. DEBUGASSERT(data);
  356. if(proxy) {
  357. #ifndef CURL_DISABLE_PROXY
  358. allocuserpwd = &data->state.aptr.proxyuserpwd;
  359. userp = conn->http_proxy.user;
  360. ntlm = &conn->proxyntlm;
  361. state = &conn->proxy_ntlm_state;
  362. authp = &data->state.authproxy;
  363. #else
  364. return CURLE_NOT_BUILT_IN;
  365. #endif
  366. }
  367. else {
  368. allocuserpwd = &data->state.aptr.userpwd;
  369. userp = conn->user;
  370. ntlm = &conn->ntlm;
  371. state = &conn->http_ntlm_state;
  372. authp = &data->state.authhost;
  373. }
  374. authp->done = FALSE;
  375. /* not set means empty */
  376. if(!userp)
  377. userp = "";
  378. switch(*state) {
  379. case NTLMSTATE_TYPE1:
  380. default:
  381. /* Use Samba's 'winbind' daemon to support NTLM authentication,
  382. * by delegating the NTLM challenge/response protocol to a helper
  383. * in ntlm_auth.
  384. * https://web.archive.org/web/20190925164737
  385. * /devel.squid-cache.org/ntlm/squid_helper_protocol.html
  386. * https://www.samba.org/samba/docs/man/manpages-3/winbindd.8.html
  387. * https://www.samba.org/samba/docs/man/manpages-3/ntlm_auth.1.html
  388. * Preprocessor symbol 'NTLM_WB_ENABLED' is defined when this
  389. * feature is enabled and 'NTLM_WB_FILE' symbol holds absolute
  390. * filename of ntlm_auth helper.
  391. * If NTLM authentication using winbind fails, go back to original
  392. * request handling process.
  393. */
  394. /* Create communication with ntlm_auth */
  395. res = ntlm_wb_init(data, ntlm, userp);
  396. if(res)
  397. return res;
  398. res = ntlm_wb_response(data, ntlm, "YR\n", *state);
  399. if(res)
  400. return res;
  401. free(*allocuserpwd);
  402. *allocuserpwd = aprintf("%sAuthorization: NTLM %s\r\n",
  403. proxy ? "Proxy-" : "",
  404. ntlm->response);
  405. DEBUG_OUT(fprintf(stderr, "**** Header %s\n ", *allocuserpwd));
  406. Curl_safefree(ntlm->response);
  407. if(!*allocuserpwd)
  408. return CURLE_OUT_OF_MEMORY;
  409. break;
  410. case NTLMSTATE_TYPE2: {
  411. char *input = aprintf("TT %s\n", ntlm->challenge);
  412. if(!input)
  413. return CURLE_OUT_OF_MEMORY;
  414. res = ntlm_wb_response(data, ntlm, input, *state);
  415. free(input);
  416. if(res)
  417. return res;
  418. free(*allocuserpwd);
  419. *allocuserpwd = aprintf("%sAuthorization: NTLM %s\r\n",
  420. proxy ? "Proxy-" : "",
  421. ntlm->response);
  422. DEBUG_OUT(fprintf(stderr, "**** %s\n ", *allocuserpwd));
  423. *state = NTLMSTATE_TYPE3; /* we sent a type-3 */
  424. authp->done = TRUE;
  425. Curl_http_auth_cleanup_ntlm_wb(conn);
  426. if(!*allocuserpwd)
  427. return CURLE_OUT_OF_MEMORY;
  428. break;
  429. }
  430. case NTLMSTATE_TYPE3:
  431. /* connection is already authenticated,
  432. * don't send a header in future requests */
  433. *state = NTLMSTATE_LAST;
  434. /* FALLTHROUGH */
  435. case NTLMSTATE_LAST:
  436. Curl_safefree(*allocuserpwd);
  437. authp->done = TRUE;
  438. break;
  439. }
  440. return CURLE_OK;
  441. }
  442. void Curl_http_auth_cleanup_ntlm_wb(struct connectdata *conn)
  443. {
  444. ntlm_wb_cleanup(&conn->ntlm);
  445. ntlm_wb_cleanup(&conn->proxyntlm);
  446. }
  447. #endif /* !CURL_DISABLE_HTTP && USE_NTLM && NTLM_WB_ENABLED */