diff --git a/CHANGES b/CHANGES index e55edd4d0..098ef6ecf 100644 --- a/CHANGES +++ b/CHANGES @@ -6,6 +6,17 @@ Changelog +Daniel (5 April 2006) +- Michele Bini modified the NTLM code to work for his "weird IIS case" + (http://curl.haxx.se/mail/lib-2006-02/0154.html) by adding the NTLM hash + function in addition to the LM one and making some other adjustments in the + order the different parts of the data block are sent in the Type-2 reply. + Inspiration for this work was taken from the Firefox NTLM implementation. + + I edited the existing 21(!) NTLM test cases to run fine with these news. Due + to the fact that we now properly include the host name in the Type-2 message + the test cases now only compare parts of that chunk. + Daniel (28 March 2006) - #1451929 (http://curl.haxx.se/bug/view.cgi?id=1451929) detailed a bug that occurred when asking libcurl to follow HTTP redirects and the original URL diff --git a/RELEASE-NOTES b/RELEASE-NOTES index e7bfc8010..9036a0091 100644 --- a/RELEASE-NOTES +++ b/RELEASE-NOTES @@ -16,6 +16,7 @@ This release includes the following changes: This release includes the following bugfixes: + o Improved NTLM functionality o following redirects with more than one question mark in source URL o fixed debug build crash with -d o TFTP works on more systems @@ -32,6 +33,6 @@ This release would not have looked like this without help, code, reports and advice from friends like these: Dan Fandrich, Ilja van Sprundel, David McCreedy, Tor Arntsen, Xavier Bouchoux, - David Byron + David Byron, Michele Bini Thanks! (and sorry if I forgot to mention someone) diff --git a/lib/http_ntlm.c b/lib/http_ntlm.c index 816a4fc42..b15c3bf67 100644 --- a/lib/http_ntlm.c +++ b/lib/http_ntlm.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2005, Daniel Stenberg, , et al. + * Copyright (C) 1998 - 2006, Daniel Stenberg, , et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -27,11 +27,16 @@ http://davenport.sourceforge.net/ntlm.html http://www.innovation.ch/java/ntlm.html + Another implementation: + http://lxr.mozilla.org/mozilla/source/security/manager/ssl/src/nsNTLMAuthModule.cpp + */ #ifndef CURL_DISABLE_HTTP #ifdef USE_NTLM +#define DEBUG_ME 0 + /* -- WIN32 approved -- */ #include #include @@ -89,6 +94,96 @@ static PSecurityFunctionTable s_pSecFn = NULL; /* Define this to make the type-3 message include the NT response message */ #define USE_NTRESPONSES 1 +/* this function converts from the little endian format used in the incoming + package to whatever endian format we're using natively */ +static unsigned int readint_le(unsigned char *buf) /* must point to a + 4 bytes buffer*/ +{ + return ((unsigned int)buf[0]) | ((unsigned int)buf[1] << 8) | + ((unsigned int)buf[2] << 16) | ((unsigned int)buf[3] << 24); +} + +#if DEBUG_ME +# define DEBUG_OUT(x) x +static void print_flags(FILE *handle, unsigned long flags) +{ + if(flags & NTLMFLAG_NEGOTIATE_UNICODE) + fprintf(handle, "NTLMFLAG_NEGOTIATE_UNICODE "); + if(flags & NTLMFLAG_NEGOTIATE_OEM) + fprintf(handle, "NTLMFLAG_NEGOTIATE_OEM "); + if(flags & NTLMFLAG_REQUEST_TARGET) + fprintf(handle, "NTLMFLAG_REQUEST_TARGET "); + if(flags & (1<<3)) + fprintf(handle, "NTLMFLAG_UNKNOWN_3 "); + if(flags & NTLMFLAG_NEGOTIATE_SIGN) + fprintf(handle, "NTLMFLAG_NEGOTIATE_SIGN "); + if(flags & NTLMFLAG_NEGOTIATE_SEAL) + fprintf(handle, "NTLMFLAG_NEGOTIATE_SEAL "); + if(flags & NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE) + fprintf(handle, "NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE "); + if(flags & NTLMFLAG_NEGOTIATE_LM_KEY) + fprintf(handle, "NTLMFLAG_NEGOTIATE_LM_KEY "); + if(flags & NTLMFLAG_NEGOTIATE_NETWARE) + fprintf(handle, "NTLMFLAG_NEGOTIATE_NETWARE "); + if(flags & NTLMFLAG_NEGOTIATE_NTLM_KEY) + fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM_KEY "); + if(flags & (1<<10)) + fprintf(handle, "NTLMFLAG_UNKNOWN_10 "); + if(flags & (1<<11)) + fprintf(handle, "NTLMFLAG_UNKNOWN_11 "); + if(flags & NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED) + fprintf(handle, "NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED "); + if(flags & NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED) + fprintf(handle, "NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED "); + if(flags & NTLMFLAG_NEGOTIATE_LOCAL_CALL) + fprintf(handle, "NTLMFLAG_NEGOTIATE_LOCAL_CALL "); + if(flags & NTLMFLAG_NEGOTIATE_ALWAYS_SIGN) + fprintf(handle, "NTLMFLAG_NEGOTIATE_ALWAYS_SIGN "); + if(flags & NTLMFLAG_TARGET_TYPE_DOMAIN) + fprintf(handle, "NTLMFLAG_TARGET_TYPE_DOMAIN "); + if(flags & NTLMFLAG_TARGET_TYPE_SERVER) + fprintf(handle, "NTLMFLAG_TARGET_TYPE_SERVER "); + if(flags & NTLMFLAG_TARGET_TYPE_SHARE) + fprintf(handle, "NTLMFLAG_TARGET_TYPE_SHARE "); + if(flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY) + fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM2_KEY "); + if(flags & NTLMFLAG_REQUEST_INIT_RESPONSE) + fprintf(handle, "NTLMFLAG_REQUEST_INIT_RESPONSE "); + if(flags & NTLMFLAG_REQUEST_ACCEPT_RESPONSE) + fprintf(handle, "NTLMFLAG_REQUEST_ACCEPT_RESPONSE "); + if(flags & NTLMFLAG_REQUEST_NONNT_SESSION_KEY) + fprintf(handle, "NTLMFLAG_REQUEST_NONNT_SESSION_KEY "); + if(flags & NTLMFLAG_NEGOTIATE_TARGET_INFO) + fprintf(handle, "NTLMFLAG_NEGOTIATE_TARGET_INFO "); + if(flags & (1<<24)) + fprintf(handle, "NTLMFLAG_UNKNOWN_24 "); + if(flags & (1<<25)) + fprintf(handle, "NTLMFLAG_UNKNOWN_25 "); + if(flags & (1<<26)) + fprintf(handle, "NTLMFLAG_UNKNOWN_26 "); + if(flags & (1<<27)) + fprintf(handle, "NTLMFLAG_UNKNOWN_27 "); + if(flags & (1<<28)) + fprintf(handle, "NTLMFLAG_UNKNOWN_28 "); + if(flags & NTLMFLAG_NEGOTIATE_128) + fprintf(handle, "NTLMFLAG_NEGOTIATE_128 "); + if(flags & NTLMFLAG_NEGOTIATE_KEY_EXCHANGE) + fprintf(handle, "NTLMFLAG_NEGOTIATE_KEY_EXCHANGE "); + if(flags & NTLMFLAG_NEGOTIATE_56) + fprintf(handle, "NTLMFLAG_NEGOTIATE_56 "); +} + +static void print_hex(FILE *handle, const char *buf, size_t len) +{ + const char *p = buf; + fprintf(stderr, "0x"); + while (len-- > 0) + fprintf(stderr, "%02.2x", (unsigned int)*p++); +} +#else +# define DEBUG_OUT(x) +#endif + /* (*) = A "security buffer" is a triplet consisting of two shorts and one long: @@ -107,6 +202,9 @@ CURLntlm Curl_input_ntlm(struct connectdata *conn, { /* point to the correct struct with this */ struct ntlmdata *ntlm; +#ifndef USE_WINDOWS_SSPI + static const char type2_marker[] = { 0x02, 0x00, 0x00, 0x00 }; +#endif ntlm = proxy?&conn->proxyntlm:&conn->ntlm; @@ -143,19 +241,34 @@ CURLntlm Curl_input_ntlm(struct connectdata *conn, ntlm->state = NTLMSTATE_TYPE2; /* we got a type-2 */ #ifdef USE_WINDOWS_SSPI - if ((ntlm->type_2 = malloc(size+1)) == NULL) { + ntlm->type_2 = malloc(size+1); + if (ntlm->type_2 == NULL) { free(buffer); return CURLE_OUT_OF_MEMORY; } ntlm->n_type_2 = size; memcpy(ntlm->type_2, buffer, size); #else - if(size >= 48) - /* the nonce of interest is index [24 .. 31], 8 bytes */ - memcpy(ntlm->nonce, &buffer[24], 8); - /* FIX: add an else here! */ + ntlm->flags = 0; - /* at index decimal 20, there's a 32bit NTLM flag field */ + if((size < 32) || + (memcmp(buffer, "NTLMSSP", 8) != 0) || + (memcmp(buffer+8, type2_marker, sizeof(type2_marker)) != 0)) { + /* This was not a good enough type-2 message */ + free(buffer); + return CURLNTLM_BAD; + } + + ntlm->flags = readint_le(&buffer[20]); + memcpy(ntlm->nonce, &buffer[24], 8); + + DEBUG_OUT({ + fprintf(stderr, "**** TYPE2 header flags=0x%08.8lx ", ntlm->flags); + print_flags(stderr, ntlm->flags); + fprintf(stderr, "\n nonce="); + print_hex(stderr, ntlm->nonce, 8); + fprintf(stderr, "\n****\n"); + }); free(buffer); #endif @@ -199,7 +312,7 @@ static void setup_des_key(unsigned char *key_56, * 8 byte plaintext is encrypted with each key and the resulting 24 * bytes are stored in the results array. */ -static void calc_resp(unsigned char *keys, +static void lm_resp(unsigned char *keys, unsigned char *plaintext, unsigned char *results) { @@ -218,35 +331,19 @@ static void calc_resp(unsigned char *keys, DESKEY(ks), DES_ENCRYPT); } + /* - * Set up lanmanager and nt hashed passwords + * Set up lanmanager hashed password */ -static void mkhash(char *password, - unsigned char *nonce, /* 8 bytes */ - unsigned char *lmresp /* must fit 0x18 bytes */ -#ifdef USE_NTRESPONSES - , unsigned char *ntresp /* must fit 0x18 bytes */ -#endif - ) +static void mk_lm_hash(char *password, unsigned char *lmbuffer /* 21 bytes */) { - /* 21 bytes fits 3 7-bytes chunks, as we use 56 bit (7 bytes) as DES input, - and we add three different ones, see the calc_resp() function */ - unsigned char lmbuffer[21]; -#ifdef USE_NTRESPONSES - unsigned char ntbuffer[21]; -#endif - unsigned char *pw; + unsigned char pw[14]; static const unsigned char magic[] = { - 0x4B, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25 + 0x4B, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25 /* i.e. KGS!@#$% */ }; unsigned int i; size_t len = strlen(password); - /* make it fit at least 14 bytes */ - pw = malloc(len<7?14:len*2); - if(!pw) - return; /* this will lead to a badly generated package */ - if (len > 14) len = 14; @@ -257,7 +354,8 @@ static void mkhash(char *password, pw[i] = 0; { - /* create LanManager hashed password */ + /* Create LanManager hashed password. */ + DES_key_schedule ks; setup_des_key(pw, DESKEY(ks)); @@ -268,35 +366,46 @@ static void mkhash(char *password, DES_ecb_encrypt((DES_cblock *)magic, (DES_cblock *)(lmbuffer+8), DESKEY(ks), DES_ENCRYPT); - memset(lmbuffer+16, 0, sizeof(lmbuffer)-16); + memset(lmbuffer + 16, 0, 21 - 16); + } } - /* create LM responses */ - calc_resp(lmbuffer, nonce, lmresp); -#ifdef USE_NTRESPONSES +#if USE_NTRESPONSES +static void utf8_to_unicode_le(unsigned char *dest, const char *src, + size_t srclen) +{ + size_t i; + for (i=0; i> 8) +#define SHORTPAIR(x) ((x) & 0xff), (((x) >> 8) & 0xff) #define LONGQUARTET(x) ((x) & 0xff), (((x) >> 8)&0xff), \ - (((x) >>16)&0xff), ((x)>>24) + (((x) >>16)&0xff), (((x)>>24) & 0xff) + +#define HOSTNAME_MAX 1024 /* this is for creating ntlm header output */ CURLcode Curl_output_ntlm(struct connectdata *conn, bool proxy) { const char *domain=""; /* empty */ - const char *host=""; /* empty */ + char host [HOSTNAME_MAX+ 1] = ""; /* empty */ #ifndef USE_WINDOWS_SSPI - int domlen=(int)strlen(domain); - int hostlen = (int)strlen(host); - int hostoff; /* host name offset */ - int domoff; /* domain name offset */ + size_t domlen = strlen(domain); + size_t hostlen = strlen(host); + size_t hostoff; /* host name offset */ + size_t domoff; /* domain name offset */ #endif size_t size; char *base64=NULL; - unsigned char ntlmbuf[512]; /* enough, unless the host/domain is very long */ + unsigned char ntlmbuf[1024]; /* enough, unless the user+host+domain is very + long */ /* point to the address of the pointer that holds the string to sent to the server, which is for a plain host or for a HTTP proxy */ @@ -399,11 +511,11 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, s_hSecDll = LoadLibrary("secur32.dll"); if (s_hSecDll != NULL) { INIT_SECURITY_INTERFACE pInitSecurityInterface; - pInitSecurityInterface = - (INIT_SECURITY_INTERFACE)GetProcAddress(s_hSecDll, - "InitSecurityInterfaceA"); - if (pInitSecurityInterface != NULL) - s_pSecFn = pInitSecurityInterface(); + pInitSecurityInterface = + (INIT_SECURITY_INTERFACE)GetProcAddress(s_hSecDll, + "InitSecurityInterfaceA"); + if (pInitSecurityInterface != NULL) + s_pSecFn = pInitSecurityInterface(); } } if (s_pSecFn == NULL) @@ -500,8 +612,9 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, size = buf.cbBuffer; } #else - hostoff = 32; - domoff = hostoff + hostlen; + hostoff = 0; + domoff = hostoff + hostlen; /* This is 0: remember that host and domain + are empty */ /* Create and send a type-1 message: @@ -533,9 +646,10 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, 0,0,0, /* part of type-1 long */ LONGQUARTET( - NTLMFLAG_NEGOTIATE_OEM| /* 2 */ - NTLMFLAG_NEGOTIATE_NTLM_KEY /* 200 */ - /* equals 0x0202 */ + NTLMFLAG_NEGOTIATE_OEM| + NTLMFLAG_REQUEST_TARGET| + NTLMFLAG_NEGOTIATE_NTLM_KEY| + NTLMFLAG_NEGOTIATE_ALWAYS_SIGN ), SHORTPAIR(domlen), SHORTPAIR(domlen), @@ -545,13 +659,31 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, SHORTPAIR(hostlen), SHORTPAIR(hostoff), 0,0, - host, domain); + host /* this is empty */, domain /* this is empty */); /* initial packet length */ size = 32 + hostlen + domlen; #endif - /* now keeper of the base64 encoded package size */ + DEBUG_OUT({ + fprintf(stderr, "**** TYPE1 header flags=0x%02.2x%02.2x%02.2x%02.2x 0x%08.8x ", + LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM| + NTLMFLAG_REQUEST_TARGET| + NTLMFLAG_NEGOTIATE_NTLM_KEY| + NTLMFLAG_NEGOTIATE_ALWAYS_SIGN), + NTLMFLAG_NEGOTIATE_OEM| + NTLMFLAG_REQUEST_TARGET| + NTLMFLAG_NEGOTIATE_NTLM_KEY| + NTLMFLAG_NEGOTIATE_ALWAYS_SIGN); + print_flags(stderr, + NTLMFLAG_NEGOTIATE_OEM| + NTLMFLAG_REQUEST_TARGET| + NTLMFLAG_NEGOTIATE_NTLM_KEY| + NTLMFLAG_NEGOTIATE_ALWAYS_SIGN); + fprintf(stderr, "\n****\n"); + }); + + /* now size is the size of the base64 encoded package size */ size = Curl_base64_encode((char *)ntlmbuf, size, &base64); if(size >0 ) { @@ -567,7 +699,7 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, break; case NTLMSTATE_TYPE2: - /* We received the type-2 already, create a type-3 message: + /* We received the type-2 message already, create a type-3 message: Index Description Content 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP" @@ -622,14 +754,14 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, #else int lmrespoff; + unsigned char lmresp[24]; /* fixed-size */ +#if USE_NTRESPONSES int ntrespoff; - int useroff; - unsigned char lmresp[0x18]; /* fixed-size */ -#ifdef USE_NTRESPONSES - unsigned char ntresp[0x18]; /* fixed-size */ + unsigned char ntresp[24]; /* fixed-size */ #endif + size_t useroff; const char *user; - int userlen; + size_t userlen; user = strchr(userp, '\\'); if(!user) @@ -637,31 +769,56 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, if (user) { domain = userp; - domlen = (int)(user - domain); + domlen = (user - domain); user++; } else user = userp; - userlen = (int)strlen(user); + userlen = strlen(user); - mkhash(passwdp, &ntlm->nonce[0], lmresp -#ifdef USE_NTRESPONSES - , ntresp + if (gethostname(host, HOSTNAME_MAX)) { + infof(conn->data, "gethostname() failed, continuing without!"); + hostlen = 0; + } + else { + hostlen = strlen(host); + } + + { +#if USE_NTRESPONSES + unsigned char ntbuffer[0x18]; #endif - ); + unsigned char lmbuffer[0x18]; - domoff = 64; /* always */ +#if USE_NTRESPONSES + mk_nt_hash(passwdp, ntbuffer); + lm_resp(ntbuffer, &ntlm->nonce[0], ntresp); +#endif + + mk_lm_hash(passwdp, lmbuffer); + lm_resp(lmbuffer, &ntlm->nonce[0], lmresp); + /* A safer but less compatible alternative is: + * lm_resp(ntbuffer, &ntlm->nonce[0], lmresp); + * See http://davenport.sourceforge.net/ntlm.html#ntlmVersion2 */ + } + + lmrespoff = 64; /* size of the message header */ +#if USE_NTRESPONSES + ntrespoff = lmrespoff + 0x18; + domoff = ntrespoff + 0x18; +#else + domoff = lmrespoff + 0x18; +#endif useroff = domoff + domlen; hostoff = useroff + userlen; - lmrespoff = hostoff + hostlen; - ntrespoff = lmrespoff + 0x18; /* Create the big type-3 message binary blob */ size = snprintf((char *)ntlmbuf, sizeof(ntlmbuf), "NTLMSSP%c" "\x03%c%c%c" /* type-3, 32 bits */ - "%c%c%c%c" /* LanManager length + allocated space */ + "%c%c" /* LanManager length */ + "%c%c" /* LanManager allocated space */ "%c%c" /* LanManager offset */ "%c%c" /* 2 zeroes */ @@ -683,14 +840,15 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, "%c%c" /* host length */ "%c%c" /* host allocated space */ "%c%c" /* host offset */ - "%c%c%c%c%c%c" /* 6 zeroes */ - - "\xff\xff" /* message length */ "%c%c" /* 2 zeroes */ - "\x01\x82" /* flags */ + "%c%c" /* session key length (unknown purpose) */ + "%c%c" /* session key allocated space (unknown purpose) */ + "%c%c" /* session key offset (unknown purpose) */ "%c%c" /* 2 zeroes */ + "%c%c%c%c" /* flags */ + /* domain string */ /* user string */ /* host string */ @@ -705,16 +863,17 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, SHORTPAIR(lmrespoff), 0x0, 0x0, -#ifdef USE_NTRESPONSES +#if USE_NTRESPONSES SHORTPAIR(0x18), /* NT-response length, twice */ SHORTPAIR(0x18), + SHORTPAIR(ntrespoff), + 0x0, 0x0, #else 0x0, 0x0, 0x0, 0x0, -#endif - SHORTPAIR(ntrespoff), 0x0, 0x0, - + 0x0, 0x0, +#endif SHORTPAIR(domlen), SHORTPAIR(domlen), SHORTPAIR(domoff), @@ -728,44 +887,68 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, SHORTPAIR(hostlen), SHORTPAIR(hostlen), SHORTPAIR(hostoff), - 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, - 0x0, 0x0, - 0x0, 0x0); + 0x0, 0x0, + 0x0, 0x0, + 0x0, 0x0, + 0x0, 0x0, - /* size is now 64 */ - size=64; - ntlmbuf[62]=ntlmbuf[63]=0; + LONGQUARTET(ntlm->flags)); + DEBUG_OUT(assert(size==64)); - /* Make sure that the user and domain strings fit in the target buffer - before we copy them there. */ - if(size + userlen + domlen >= sizeof(ntlmbuf)) { - failf(conn->data, "user + domain name too big"); - return CURLE_OUT_OF_MEMORY; - } - - memcpy(&ntlmbuf[size], domain, domlen); - size += domlen; - - memcpy(&ntlmbuf[size], user, userlen); - size += userlen; - - /* we append the binary hashes to the end of the blob */ - if(size < ((int)sizeof(ntlmbuf) - 0x18)) { + DEBUG_OUT(assert(size == lmrespoff)); + /* We append the binary hashes */ + if(size < (sizeof(ntlmbuf) - 0x18)) { memcpy(&ntlmbuf[size], lmresp, 0x18); size += 0x18; } -#ifdef USE_NTRESPONSES - if(size < ((int)sizeof(ntlmbuf) - 0x18)) { + DEBUG_OUT({ + fprintf(stderr, "**** TYPE3 header lmresp="); + print_hex(stderr, &ntlmbuf[lmrespoff], 0x18); + }); + +#if USE_NTRESPONSES + if(size < (sizeof(ntlmbuf) - 0x18)) { + DEBUG_OUT(assert(size == ntrespoff)); memcpy(&ntlmbuf[size], ntresp, 0x18); size += 0x18; } + + DEBUG_OUT({ + fprintf(stderr, "\n ntresp="); + print_hex(stderr, &ntlmbuf[ntrespoff], 0x18); + }); + #endif - ntlmbuf[56] = (unsigned char)(size & 0xff); - ntlmbuf[57] = (unsigned char)(size >> 8); + DEBUG_OUT({ + fprintf(stderr, "\n flags=0x%02.2x%02.2x%02.2x%02.2x 0x%08.8x ", + LONGQUARTET(ntlm->flags), ntlm->flags); + print_flags(stderr, ntlm->flags); + fprintf(stderr, "\n****\n"); + }); + + + /* Make sure that the domain, user and host strings fit in the target + buffer before we copy them there. */ + if(size + userlen + domlen + hostlen >= sizeof(ntlmbuf)) { + failf(conn->data, "user + domain + host name too big"); + return CURLE_OUT_OF_MEMORY; + } + + curlassert(size == domoff); + memcpy(&ntlmbuf[size], domain, domlen); + size += domlen; + + curlassert(size == useroff); + memcpy(&ntlmbuf[size], user, userlen); + size += userlen; + + curlassert(size == hostoff); + memcpy(&ntlmbuf[size], host, hostlen); + size += hostlen; #endif @@ -810,8 +993,8 @@ Curl_ntlm_cleanup(struct connectdata *conn) ntlm_sspi_cleanup(&conn->proxyntlm); if (s_hSecDll != NULL) { FreeLibrary(s_hSecDll); - s_hSecDll = NULL; - s_pSecFn = NULL; + s_hSecDll = NULL; + s_pSecFn = NULL; } #else (void)conn; diff --git a/lib/urldata.h b/lib/urldata.h index fb7382ad8..1d6bab2a0 100644 --- a/lib/urldata.h +++ b/lib/urldata.h @@ -231,6 +231,7 @@ struct ntlmdata { void *type_2; int n_type_2; #else + unsigned int flags; unsigned char nonce[8]; #endif }; diff --git a/tests/data/test150 b/tests/data/test150 index 301c0eb43..49ca2a66f 100644 --- a/tests/data/test150 +++ b/tests/data/test150 @@ -62,15 +62,20 @@ http://%HOSTIP:%HTTPPORT/150 -u testuser:testpass --ntlm --fail ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA).*/$1/ + GET /150 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* GET /150 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* diff --git a/tests/data/test155 b/tests/data/test155 index 57826c828..501979eed 100644 --- a/tests/data/test155 +++ b/tests/data/test155 @@ -88,6 +88,11 @@ four is the number of lines ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA).*/$1/ + PUT /155 HTTP/1.1 Host: 127.0.0.1:%HTTPPORT @@ -96,14 +101,14 @@ Content-Length: 85 Expect: 100-continue PUT /155 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= Host: 127.0.0.1:%HTTPPORT Accept: */* Content-Length: 0 Expect: 100-continue PUT /155 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.5 (i686-pc-linux-gnu) libcurl/7.10.5 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* diff --git a/tests/data/test159 b/tests/data/test159 index 007a10c60..aa07888c2 100644 --- a/tests/data/test159 +++ b/tests/data/test159 @@ -62,15 +62,20 @@ http://%HOSTIP:%HTTPPORT/159 -u testuser:testpass --ntlm -0 ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA).*/$1/ + GET /159 HTTP/1.0 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* GET /159 HTTP/1.0 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* diff --git a/tests/data/test162 b/tests/data/test162 index 679832b7f..c987c4a21 100644 --- a/tests/data/test162 +++ b/tests/data/test162 @@ -35,7 +35,7 @@ http://%HOSTIP:%HTTPPORT/162 --proxy http://%HOSTIP:%HTTPPORT --proxy-user foo:b GET http://127.0.0.1:%HTTPPORT/162 HTTP/1.1 -Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.8.1-pre3 (sparc-sun-solaris2.7) libcurl 7.8.1-pre3 (OpenSSL 0.9.6a) (krb4 enabled) Host: 127.0.0.1:%HTTPPORT Pragma: no-cache diff --git a/tests/data/test169 b/tests/data/test169 index 3f377f401..5f6d5b428 100644 --- a/tests/data/test169 +++ b/tests/data/test169 @@ -80,9 +80,14 @@ http://data.from.server.requiring.digest.hohoho.com/169 --proxy http://%HOSTIP:% ^User-Agent: curl/.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAAAwADAHAAAAAEAA).*/$1/ + GET http://data.from.server.requiring.digest.hohoho.com/169 HTTP/1.1 -Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.12.0-CVS (i686-pc-linux-gnu) libcurl/7.12.0-CVS OpenSSL/0.9.6b ipv6 zlib/1.1.4 GSS libidn/0.4.3 Host: data.from.server.requiring.digest.hohoho.com Pragma: no-cache @@ -90,7 +95,7 @@ Accept: */* Proxy-Connection: Keep-Alive GET http://data.from.server.requiring.digest.hohoho.com/169 HTTP/1.1 -Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEMAAAAYABgAWwAAAAAAAABAAAAAAwADAEAAAAAAAAAAQwAAAAAAAABzAAAAAYIAAGZvb4P6B+XVQ6vQsx3DfDXUVhd9436GAxPu0IYcl2Z7LxHmNeOAWQ+vxUmhuCFJBUgXCQ== +Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAAAwADAHAAAAAEAA User-Agent: curl/7.12.0-CVS (i686-pc-linux-gnu) libcurl/7.12.0-CVS OpenSSL/0.9.6b ipv6 zlib/1.1.4 GSS libidn/0.4.3 Host: data.from.server.requiring.digest.hohoho.com Pragma: no-cache diff --git a/tests/data/test170 b/tests/data/test170 index 9f42f1ea5..556b2ab2a 100644 --- a/tests/data/test170 +++ b/tests/data/test170 @@ -25,7 +25,7 @@ http://a.galaxy.far.far.away/170 --proxy http://%HOSTIP:%HTTPPORT --proxy-user f POST http://a.galaxy.far.far.away/170 HTTP/1.1 -Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.12.0-CVS (i686-pc-linux-gnu) libcurl/7.12.0-CVS OpenSSL/0.9.6b ipv6 zlib/1.1.4 libidn/0.4.3 Host: a.galaxy.far.far.away Pragma: no-cache diff --git a/tests/data/test176 b/tests/data/test176 index 82f5574d9..a92c65e8d 100644 --- a/tests/data/test176 +++ b/tests/data/test176 @@ -56,7 +56,7 @@ http://%HOSTIP:%HTTPPORT/176 -u auser:apasswd --ntlm -d "junkelijunk" POST /176 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.12.1-CVS (i686-pc-linux-gnu) libcurl/7.12.1-CVS OpenSSL/0.9.6b ipv6 zlib/1.1.4 GSS libidn/0.4.6 Host: 127.0.0.1:%HTTPPORT Accept: */* diff --git a/tests/data/test209 b/tests/data/test209 index bc699fb4a..e42074943 100644 --- a/tests/data/test209 +++ b/tests/data/test209 @@ -78,15 +78,20 @@ http://test.remote.server.com:209/path/2090002 --proxy http://%HOSTIP:%HTTPPORT ^User-Agent: curl/.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAABQAFAHAAAAAEAA).*/$1/ + CONNECT test.remote.server.com:209 HTTP/1.0 Host: test.remote.server.com:209 -Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= Proxy-Connection: Keep-Alive CONNECT test.remote.server.com:209 HTTP/1.0 Host: test.remote.server.com:209 -Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEUAAAAYABgAXQAAAAAAAABAAAAABQAFAEAAAAAAAAAARQAAAAAAAAB1AAAAAYIAAHNpbGx5oB5CPMq0JDu5tbxLow3sHn3jfoYDE+7QJVE7DA0GyDEwvj2BxsBctP9tT4fnCtL1 +Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAABQAFAHAAAAAEAA Proxy-Connection: Keep-Alive GET /path/2090002 HTTP/1.1 diff --git a/tests/data/test213 b/tests/data/test213 index 836fdd36d..453d5d96b 100644 --- a/tests/data/test213 +++ b/tests/data/test213 @@ -78,15 +78,20 @@ http://test.remote.server.com:213/path/2130002 --proxy http://%HOSTIP:%HTTPPORT ^User-Agent: curl/.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAABQAFAHAAAAA).*/$1/ + CONNECT test.remote.server.com:213 HTTP/1.0 Host: test.remote.server.com:213 -Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= Proxy-Connection: Keep-Alive CONNECT test.remote.server.com:213 HTTP/1.0 Host: test.remote.server.com:213 -Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEUAAAAYABgAXQAAAAAAAABAAAAABQAFAEAAAAAAAAAARQAAAAAAAAB1AAAAAYIAAHNpbGx5oB5CPMq0JDu5tbxLow3sHn3jfoYDE+7QJVE7DA0GyDEwvj2BxsBctP9tT4fnCtL1 +Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAABQAFAHAAAAA Proxy-Connection: Keep-Alive POST /path/2130002 HTTP/1.1 diff --git a/tests/data/test239 b/tests/data/test239 index 591da70b8..9b2ef9eff 100644 --- a/tests/data/test239 +++ b/tests/data/test239 @@ -56,9 +56,14 @@ http://%HOSTIP:%HTTPPORT/239 --proxy http://%HOSTIP:%HTTPPORT --proxy-user silly ^User-Agent: curl/.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAABQAFAHAAAAA).*/$1/ + POST http://%HOSTIP:%HTTPPORT/239 HTTP/1.1 -Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.13.2-CVS (i686-pc-linux-gnu) libcurl/7.13.2-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13 Host: %HOSTIP:%HTTPPORT Pragma: no-cache @@ -68,7 +73,7 @@ Content-Length: 0 Content-Type: application/x-www-form-urlencoded POST http://127.0.0.1:8990/239 HTTP/1.1 -Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEUAAAAYABgAXQAAAAAAAABAAAAABQAFAEAAAAAAAAAARQAAAAAAAAB1AAAAAYIAAHNpbGx5oB5CPMq0JDu5tbxLow3sHn3jfoYDE+7QJVE7DA0GyDEwvj2BxsBctP9tT4fnCtL1 +Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAABQAFAHAAAAA User-Agent: curl/7.13.2-CVS (i686-pc-linux-gnu) libcurl/7.13.2-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13 Host: 127.0.0.1:8990 Pragma: no-cache diff --git a/tests/data/test243 b/tests/data/test243 index e284a725e..ab209d0ad 100644 --- a/tests/data/test243 +++ b/tests/data/test243 @@ -84,6 +84,11 @@ http://%HOSTIP:%HTTPPORT/243 --proxy http://%HOSTIP:%HTTPPORT --proxy-user silly ^User-Agent: curl/.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAABQAFAHAAAAA).*/$1/ + POST http://127.0.0.1:8990/243 HTTP/1.1 User-Agent: curl/7.13.2-CVS (i686-pc-linux-gnu) libcurl/7.13.2-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13 @@ -95,7 +100,7 @@ Content-Length: 6 Content-Type: application/x-www-form-urlencoded postitPOST http://%HOSTIP:%HTTPPORT/243 HTTP/1.1 -Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.13.2-CVS (i686-pc-linux-gnu) libcurl/7.13.2-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13 Host: %HOSTIP:%HTTPPORT Pragma: no-cache @@ -105,7 +110,7 @@ Content-Length: 0 Content-Type: application/x-www-form-urlencoded POST http://127.0.0.1:8990/243 HTTP/1.1 -Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEUAAAAYABgAXQAAAAAAAABAAAAABQAFAEAAAAAAAAAARQAAAAAAAAB1AAAAAYIAAHNpbGx5oB5CPMq0JDu5tbxLow3sHn3jfoYDE+7QJVE7DA0GyDEwvj2BxsBctP9tT4fnCtL1 +Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAABQAFAHAAAAA User-Agent: curl/7.13.2-CVS (i686-pc-linux-gnu) libcurl/7.13.2-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13 Host: 127.0.0.1:8990 Pragma: no-cache diff --git a/tests/data/test265 b/tests/data/test265 index 9848f46a7..1e97d07e1 100644 --- a/tests/data/test265 +++ b/tests/data/test265 @@ -81,15 +81,20 @@ http://test.remote.server.com:265/path/2650002 --proxy http://%HOSTIP:%HTTPPORT ^User-Agent: curl/.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAABQAFAHAAAAA).*/$1/ + CONNECT test.remote.server.com:265 HTTP/1.0 Host: test.remote.server.com:265 -Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= Proxy-Connection: Keep-Alive CONNECT test.remote.server.com:265 HTTP/1.0 Host: test.remote.server.com:265 -Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEUAAAAYABgAXQAAAAAAAABAAAAABQAFAEAAAAAAAAAARQAAAAAAAAB1AAAAAYIAAHNpbGx5oB5CPMq0JDu5tbxLow3sHn3jfoYDE+7QJVE7DA0GyDEwvj2BxsBctP9tT4fnCtL1 +Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAABQAFAHAAAAA Proxy-Connection: Keep-Alive POST /path/2650002 HTTP/1.1 diff --git a/tests/data/test267 b/tests/data/test267 index 03b99f36e..a96799ef0 100644 --- a/tests/data/test267 +++ b/tests/data/test267 @@ -69,9 +69,14 @@ http://%HOSTIP:%HTTPPORT/267 -u testuser:testpass --ntlm -d "data" -H "Header1: ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA).*/$1/ + POST /267 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* @@ -81,7 +86,7 @@ Content-Length: 0 Content-Type: application/x-www-form-urlencoded POST /267 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* diff --git a/tests/data/test67 b/tests/data/test67 index 69023fa50..aa2500e34 100644 --- a/tests/data/test67 +++ b/tests/data/test67 @@ -69,15 +69,20 @@ http://%HOSTIP:%HTTPPORT/67 -u testuser:testpass --ntlm ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA).*/$1/ + GET /67 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* GET /67 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* diff --git a/tests/data/test68 b/tests/data/test68 index 8a0adcf9f..b3b94faa0 100644 --- a/tests/data/test68 +++ b/tests/data/test68 @@ -71,15 +71,20 @@ http://%HOSTIP:%HTTPPORT/68 -u testuser:testpass --ntlm ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA).*/$1/ + GET /68 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* GET /68 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* diff --git a/tests/data/test69 b/tests/data/test69 index 0cfafd94a..00e8a8c4d 100644 --- a/tests/data/test69 +++ b/tests/data/test69 @@ -84,6 +84,11 @@ http://%HOSTIP:%HTTPPORT/69 -u testuser:testpass --anyauth ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA).*/$1/ + GET /69 HTTP/1.1 User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 @@ -91,13 +96,13 @@ Host: 127.0.0.1:%HTTPPORT Accept: */* GET /69 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* GET /69 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* diff --git a/tests/data/test81 b/tests/data/test81 index 056571bed..a07513a3e 100644 --- a/tests/data/test81 +++ b/tests/data/test81 @@ -67,9 +67,14 @@ http://%HOSTIP:%HTTPPORT/81 --proxy-user testuser:testpass -x http://%HOSTIP:%HT ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA).*/$1/ + GET http://127.0.0.1:%HTTPPORT/81 HTTP/1.1 -Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Pragma: no-cache @@ -77,7 +82,7 @@ Accept: */* Proxy-Connection: Keep-Alive GET http://127.0.0.1:%HTTPPORT/81 HTTP/1.1 -Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Pragma: no-cache diff --git a/tests/data/test89 b/tests/data/test89 index 89904d748..73e045eb3 100644 --- a/tests/data/test89 +++ b/tests/data/test89 @@ -102,27 +102,32 @@ http://%HOSTIP:%HTTPPORT/89 -u testuser:testpass --ntlm -L ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA).*/$1/ + GET /89 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* GET /89 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* GET /you/890010 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.8-pre1 (i686-pc-linux-gnu) libcurl/7.10.8-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 GSS Host: 127.0.0.1:%HTTPPORT Accept: */* GET /you/890010 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.8-pre1 (i686-pc-linux-gnu) libcurl/7.10.8-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 GSS Host: 127.0.0.1:%HTTPPORT Accept: */* diff --git a/tests/data/test90 b/tests/data/test90 index 5a9dc3479..1a9782bde 100644 --- a/tests/data/test90 +++ b/tests/data/test90 @@ -137,19 +137,24 @@ http://%HOSTIP:%HTTPPORT/90 -u testuser:testpass --anyauth -L ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA).*/$1/ + GET /90 HTTP/1.1 Host: 127.0.0.1:%HTTPPORT Accept: */* GET /90 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* GET /90 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* @@ -159,13 +164,13 @@ Host: 127.0.0.1:%HTTPPORT Accept: */* GET /you/900010 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.8-pre1 (i686-pc-linux-gnu) libcurl/7.10.8-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 GSS Host: 127.0.0.1:%HTTPPORT Accept: */* GET /you/900010 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAAAYABgAYAAAAAAAAABAAAAACAAIAEAAAAAAAAAASAAAAAAAAAB4AAAAAYIAAHRlc3R1c2VyWmRDApEJkUyGOPS3DjvASModEeW/N/FBqYVyF4y6/y/7F6qmEQ7lXjXFF3tH1145 +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAACAAIAHAAAAAEAA User-Agent: curl/7.10.8-pre1 (i686-pc-linux-gnu) libcurl/7.10.8-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 GSS Host: 127.0.0.1:%HTTPPORT Accept: */* diff --git a/tests/data/test91 b/tests/data/test91 index bad4f3a57..ec0ca38ec 100644 --- a/tests/data/test91 +++ b/tests/data/test91 @@ -87,6 +87,11 @@ http://%HOSTIP:%HTTPPORT/91 --anyauth -u mydomain\\myself:secret ^User-Agent:.* +# We strip off a large chunk of the type-2 NTLM message since it depends on +# the local host name and thus differs on different machines! + +s/^(Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAgACABwAAAABgAGAHgAAAAEAA).*/$1/ + GET /91 HTTP/1.1 User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 @@ -94,13 +99,13 @@ Host: 127.0.0.1:%HTTPPORT Accept: */* GET /91 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAABAAAAAgIAAAAAAAAgAAAAAAAAACAAAAA= +Authorization: NTLM TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAA= User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */* GET /91 HTTP/1.1 -Authorization: NTLM TlRMTVNTUAADAAAAGAAYAE4AAAAYABgAZgAAAAgACABAAAAABgAGAEgAAAAAAAAATgAAAAAAAAB+AAAAAYIAAG15ZG9tYWlubXlzZWxmwjImlHmYemDYVmFrmRFoVn3jfoYDE+7QLmWXF7FJDlDNWSItJ+RylXJGAJdepH4C +Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAgACABwAAAABgAGAHgAAAAEAA User-Agent: curl/7.10.6-pre1 (i686-pc-linux-gnu) libcurl/7.10.6-pre1 OpenSSL/0.9.7a ipv6 zlib/1.1.3 Host: 127.0.0.1:%HTTPPORT Accept: */*