net/http/http_auth_handler_ntlm.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/http/http_auth_handler_ntlm.h"
   6
   7 #if !defined(NTLM_SSPI)
   8 #include "base/base64.h"
   9 #endif
  10 #include "base/logging.h"
  11 #include "base/strings/string_util.h"
  12 #include "base/strings/utf_string_conversions.h"
  13 #include "net/base/net_errors.h"
  14 #include "net/base/net_util.h"
  15 #include "net/http/http_auth_challenge_tokenizer.h"
  16
  17 namespace net {
  18
  19 HttpAuth::AuthorizationResult HttpAuthHandlerNTLM::HandleAnotherChallenge(
  20     HttpAuthChallengeTokenizer* challenge) {
  21   return ParseChallenge(challenge, false);
  22 }
  23
  24 bool HttpAuthHandlerNTLM::Init(HttpAuthChallengeTokenizer* tok) {
  25   auth_scheme_ = HttpAuth::AUTH_SCHEME_NTLM;
  26   score_ = 3;
  27   properties_ = ENCRYPTS_IDENTITY | IS_CONNECTION_BASED;
  28
  29   return ParseChallenge(tok, true) == HttpAuth::AUTHORIZATION_RESULT_ACCEPT;
  30 }
  31
  32 int HttpAuthHandlerNTLM::GenerateAuthTokenImpl(
  33     const AuthCredentials* credentials, const HttpRequestInfo* request,
  34     const CompletionCallback& callback, std::string* auth_token) {
  35 #if defined(NTLM_SSPI)
  36   return auth_sspi_.GenerateAuthToken(credentials, CreateSPN(origin_),
  37                                       auth_token, callback);
  38 #else  // !defined(NTLM_SSPI)
  39   // TODO(cbentzel): Shouldn't be hitting this case.
  40   if (!credentials) {
  41     LOG(ERROR) << "Username and password are expected to be non-NULL.";
  42     return ERR_MISSING_AUTH_CREDENTIALS;
  43   }
  44   // TODO(wtc): See if we can use char* instead of void* for in_buf and
  45   // out_buf.  This change will need to propagate to GetNextToken,
  46   // GenerateType1Msg, and GenerateType3Msg, and perhaps further.
  47   const void* in_buf;
  48   void* out_buf;
  49   uint32 in_buf_len, out_buf_len;
  50   std::string decoded_auth_data;
  51
  52   // The username may be in the form "DOMAIN\user".  Parse it into the two
  53   // components.
  54   base::string16 domain;
  55   base::string16 user;
  56   const base::string16& username = credentials->username();
  57   const base::char16 backslash_character = '\\';
  58   size_t backslash_idx = username.find(backslash_character);
  59   if (backslash_idx == base::string16::npos) {
  60     user = username;
  61   } else {
  62     domain = username.substr(0, backslash_idx);
  63     user = username.substr(backslash_idx + 1);
  64   }
  65   domain_ = domain;
  66   credentials_.Set(user, credentials->password());
  67
  68   // Initial challenge.
  69   if (auth_data_.empty()) {
  70     in_buf_len = 0;
  71     in_buf = NULL;
  72     int rv = InitializeBeforeFirstChallenge();
  73     if (rv != OK)
  74       return rv;
  75   } else {
  76     if (!base::Base64Decode(auth_data_, &decoded_auth_data)) {
  77       LOG(ERROR) << "Unexpected problem Base64 decoding.";
  78       return ERR_UNEXPECTED;
  79     }
  80     in_buf_len = decoded_auth_data.length();
  81     in_buf = decoded_auth_data.data();
  82   }
  83
  84   int rv = GetNextToken(in_buf, in_buf_len, &out_buf, &out_buf_len);
  85   if (rv != OK)
  86     return rv;
  87
  88   // Base64 encode data in output buffer and prepend "NTLM ".
  89   std::string encode_input(static_cast<char*>(out_buf), out_buf_len);
  90   std::string encode_output;
  91   base::Base64Encode(encode_input, &encode_output);
  92   // OK, we are done with |out_buf|
  93   free(out_buf);
  94   *auth_token = std::string("NTLM ") + encode_output;
  95   return OK;
  96 #endif
  97 }
  98
  99 // The NTLM challenge header looks like:
 100 //   WWW-Authenticate: NTLM auth-data
 101 HttpAuth::AuthorizationResult HttpAuthHandlerNTLM::ParseChallenge(
 102     HttpAuthChallengeTokenizer* tok, bool initial_challenge) {
 103 #if defined(NTLM_SSPI)
 104   // auth_sspi_ contains state for whether or not this is the initial challenge.
 105   return auth_sspi_.ParseChallenge(tok);
 106 #else
 107   // TODO(cbentzel): Most of the logic between SSPI, GSSAPI, and portable NTLM
 108   // authentication parsing could probably be shared - just need to know if
 109   // there was previously a challenge round.
 110   // TODO(cbentzel): Write a test case to validate that auth_data_ is left empty
 111   // in all failure conditions.
 112   auth_data_.clear();
 113
 114   // Verify the challenge's auth-scheme.
 115   if (!base::LowerCaseEqualsASCII(tok->scheme(), "ntlm"))
 116     return HttpAuth::AUTHORIZATION_RESULT_INVALID;
 117
 118   std::string base64_param = tok->base64_param();
 119   if (base64_param.empty()) {
 120     if (!initial_challenge)
 121       return HttpAuth::AUTHORIZATION_RESULT_REJECT;
 122     return HttpAuth::AUTHORIZATION_RESULT_ACCEPT;
 123   } else {
 124     if (initial_challenge)
 125       return HttpAuth::AUTHORIZATION_RESULT_INVALID;
 126   }
 127
 128   auth_data_ = base64_param;
 129   return HttpAuth::AUTHORIZATION_RESULT_ACCEPT;
 130 #endif  // defined(NTLM_SSPI)
 131 }
 132
 133 // static
 134 std::string HttpAuthHandlerNTLM::CreateSPN(const GURL& origin) {
 135   // The service principal name of the destination server.  See
 136   // http://msdn.microsoft.com/en-us/library/ms677949%28VS.85%29.aspx
 137   std::string target("HTTP/");
 138   target.append(GetHostAndPort(origin));
 139   return target;
 140 }
 141
 142 }  // namespace net