mirror of
https://github.com/moparisthebest/curl
synced 2024-11-17 23:15:08 -05:00
a730432e59
Attempt to add support for Secure Channel binding when negotiate authentication is used. The problem to solve is that by default IIS accepts channel binding and curl doesn't utilise them. The result was a 401 response. Scope affects only the Schannel(winssl)-SSPI combination. Fixes https://github.com/curl/curl/issues/3503 Closes https://github.com/curl/curl/pull/3509
255 lines
7.1 KiB
C
255 lines
7.1 KiB
C
/***************************************************************************
|
|
* _ _ ____ _
|
|
* Project ___| | | | _ \| |
|
|
* / __| | | | |_) | |
|
|
* | (__| |_| | _ <| |___
|
|
* \___|\___/|_| \_\_____|
|
|
*
|
|
* Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
|
|
*
|
|
* This software is licensed as described in the file COPYING, which
|
|
* you should have received as part of this distribution. The terms
|
|
* are also available at https://curl.haxx.se/docs/copyright.html.
|
|
*
|
|
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
|
* copies of the Software, and permit persons to whom the Software is
|
|
* furnished to do so, under the terms of the COPYING file.
|
|
*
|
|
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
|
* KIND, either express or implied.
|
|
*
|
|
***************************************************************************/
|
|
|
|
#include "curl_setup.h"
|
|
|
|
#if !defined(CURL_DISABLE_HTTP) && defined(USE_NTLM)
|
|
|
|
/*
|
|
* NTLM details:
|
|
*
|
|
* https://davenport.sourceforge.io/ntlm.html
|
|
* https://www.innovation.ch/java/ntlm.html
|
|
*/
|
|
|
|
#define DEBUG_ME 0
|
|
|
|
#include "urldata.h"
|
|
#include "sendf.h"
|
|
#include "strcase.h"
|
|
#include "http_ntlm.h"
|
|
#include "curl_ntlm_core.h"
|
|
#include "curl_ntlm_wb.h"
|
|
#include "vauth/vauth.h"
|
|
#include "url.h"
|
|
|
|
/* SSL backend-specific #if branches in this file must be kept in the order
|
|
documented in curl_ntlm_core. */
|
|
#if defined(NTLM_NEEDS_NSS_INIT)
|
|
#include "vtls/nssg.h"
|
|
#elif defined(USE_WINDOWS_SSPI)
|
|
#include "curl_sspi.h"
|
|
#endif
|
|
|
|
/* The last 3 #include files should be in this order */
|
|
#include "curl_printf.h"
|
|
#include "curl_memory.h"
|
|
#include "memdebug.h"
|
|
|
|
#if DEBUG_ME
|
|
# define DEBUG_OUT(x) x
|
|
#else
|
|
# define DEBUG_OUT(x) Curl_nop_stmt
|
|
#endif
|
|
|
|
CURLcode Curl_input_ntlm(struct connectdata *conn,
|
|
bool proxy, /* if proxy or not */
|
|
const char *header) /* rest of the www-authenticate:
|
|
header */
|
|
{
|
|
/* point to the correct struct with this */
|
|
struct ntlmdata *ntlm;
|
|
CURLcode result = CURLE_OK;
|
|
|
|
ntlm = proxy ? &conn->proxyntlm : &conn->ntlm;
|
|
|
|
if(checkprefix("NTLM", header)) {
|
|
header += strlen("NTLM");
|
|
|
|
while(*header && ISSPACE(*header))
|
|
header++;
|
|
|
|
if(*header) {
|
|
result = Curl_auth_decode_ntlm_type2_message(conn->data, header, ntlm);
|
|
if(result)
|
|
return result;
|
|
|
|
ntlm->state = NTLMSTATE_TYPE2; /* We got a type-2 message */
|
|
}
|
|
else {
|
|
if(ntlm->state == NTLMSTATE_LAST) {
|
|
infof(conn->data, "NTLM auth restarted\n");
|
|
Curl_http_ntlm_cleanup(conn);
|
|
}
|
|
else if(ntlm->state == NTLMSTATE_TYPE3) {
|
|
infof(conn->data, "NTLM handshake rejected\n");
|
|
Curl_http_ntlm_cleanup(conn);
|
|
ntlm->state = NTLMSTATE_NONE;
|
|
return CURLE_REMOTE_ACCESS_DENIED;
|
|
}
|
|
else if(ntlm->state >= NTLMSTATE_TYPE1) {
|
|
infof(conn->data, "NTLM handshake failure (internal error)\n");
|
|
return CURLE_REMOTE_ACCESS_DENIED;
|
|
}
|
|
|
|
ntlm->state = NTLMSTATE_TYPE1; /* We should send away a type-1 */
|
|
}
|
|
}
|
|
|
|
return result;
|
|
}
|
|
|
|
/*
|
|
* This is for creating ntlm header output
|
|
*/
|
|
CURLcode Curl_output_ntlm(struct connectdata *conn, bool proxy)
|
|
{
|
|
char *base64 = NULL;
|
|
size_t len = 0;
|
|
CURLcode result;
|
|
|
|
/* point to the address of the pointer that holds the string to send to the
|
|
server, which is for a plain host or for a HTTP proxy */
|
|
char **allocuserpwd;
|
|
|
|
/* point to the username, password, service and host */
|
|
const char *userp;
|
|
const char *passwdp;
|
|
const char *service = NULL;
|
|
const char *hostname = NULL;
|
|
|
|
/* point to the correct struct with this */
|
|
struct ntlmdata *ntlm;
|
|
struct auth *authp;
|
|
|
|
DEBUGASSERT(conn);
|
|
DEBUGASSERT(conn->data);
|
|
|
|
#if defined(NTLM_NEEDS_NSS_INIT)
|
|
if(CURLE_OK != Curl_nss_force_init(conn->data))
|
|
return CURLE_OUT_OF_MEMORY;
|
|
#endif
|
|
|
|
if(proxy) {
|
|
allocuserpwd = &conn->allocptr.proxyuserpwd;
|
|
userp = conn->http_proxy.user;
|
|
passwdp = conn->http_proxy.passwd;
|
|
service = conn->data->set.str[STRING_PROXY_SERVICE_NAME] ?
|
|
conn->data->set.str[STRING_PROXY_SERVICE_NAME] : "HTTP";
|
|
hostname = conn->http_proxy.host.name;
|
|
ntlm = &conn->proxyntlm;
|
|
authp = &conn->data->state.authproxy;
|
|
}
|
|
else {
|
|
allocuserpwd = &conn->allocptr.userpwd;
|
|
userp = conn->user;
|
|
passwdp = conn->passwd;
|
|
service = conn->data->set.str[STRING_SERVICE_NAME] ?
|
|
conn->data->set.str[STRING_SERVICE_NAME] : "HTTP";
|
|
hostname = conn->host.name;
|
|
ntlm = &conn->ntlm;
|
|
authp = &conn->data->state.authhost;
|
|
}
|
|
authp->done = FALSE;
|
|
|
|
/* not set means empty */
|
|
if(!userp)
|
|
userp = "";
|
|
|
|
if(!passwdp)
|
|
passwdp = "";
|
|
|
|
#ifdef USE_WINDOWS_SSPI
|
|
if(s_hSecDll == NULL) {
|
|
/* not thread safe and leaks - use curl_global_init() to avoid */
|
|
CURLcode err = Curl_sspi_global_init();
|
|
if(s_hSecDll == NULL)
|
|
return err;
|
|
}
|
|
#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
|
|
ntlm->sslContext = conn->sslContext;
|
|
#endif
|
|
#endif
|
|
|
|
switch(ntlm->state) {
|
|
case NTLMSTATE_TYPE1:
|
|
default: /* for the weird cases we (re)start here */
|
|
/* Create a type-1 message */
|
|
result = Curl_auth_create_ntlm_type1_message(conn->data, userp, passwdp,
|
|
service, hostname,
|
|
ntlm, &base64,
|
|
&len);
|
|
if(result)
|
|
return result;
|
|
|
|
if(base64) {
|
|
free(*allocuserpwd);
|
|
*allocuserpwd = aprintf("%sAuthorization: NTLM %s\r\n",
|
|
proxy ? "Proxy-" : "",
|
|
base64);
|
|
free(base64);
|
|
if(!*allocuserpwd)
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
DEBUG_OUT(fprintf(stderr, "**** Header %s\n ", *allocuserpwd));
|
|
}
|
|
break;
|
|
|
|
case NTLMSTATE_TYPE2:
|
|
/* We already received the type-2 message, create a type-3 message */
|
|
result = Curl_auth_create_ntlm_type3_message(conn->data, userp, passwdp,
|
|
ntlm, &base64, &len);
|
|
if(result)
|
|
return result;
|
|
|
|
if(base64) {
|
|
free(*allocuserpwd);
|
|
*allocuserpwd = aprintf("%sAuthorization: NTLM %s\r\n",
|
|
proxy ? "Proxy-" : "",
|
|
base64);
|
|
free(base64);
|
|
if(!*allocuserpwd)
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
DEBUG_OUT(fprintf(stderr, "**** %s\n ", *allocuserpwd));
|
|
|
|
ntlm->state = NTLMSTATE_TYPE3; /* we send a type-3 */
|
|
authp->done = TRUE;
|
|
}
|
|
break;
|
|
|
|
case NTLMSTATE_TYPE3:
|
|
/* connection is already authenticated,
|
|
* don't send a header in future requests */
|
|
ntlm->state = NTLMSTATE_LAST;
|
|
/* FALLTHROUGH */
|
|
case NTLMSTATE_LAST:
|
|
Curl_safefree(*allocuserpwd);
|
|
authp->done = TRUE;
|
|
break;
|
|
}
|
|
|
|
return CURLE_OK;
|
|
}
|
|
|
|
void Curl_http_ntlm_cleanup(struct connectdata *conn)
|
|
{
|
|
Curl_auth_ntlm_cleanup(&conn->ntlm);
|
|
Curl_auth_ntlm_cleanup(&conn->proxyntlm);
|
|
|
|
#if defined(NTLM_WB_ENABLED)
|
|
Curl_ntlm_wb_cleanup(conn);
|
|
#endif
|
|
}
|
|
|
|
#endif /* !CURL_DISABLE_HTTP && USE_NTLM */
|