You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2422 lines
68 KiB
2422 lines
68 KiB
/*++
|
|
|
|
Copyright (c) 1995 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
splugin.cxx
|
|
|
|
Abstract:
|
|
|
|
This file contains the implementation for Plug In Authentication
|
|
|
|
The following functions are exported by this module:
|
|
|
|
AuthOnRequest
|
|
AuthOnResponse
|
|
AuthCtxClose
|
|
AuthInDialog
|
|
AuthNotify
|
|
AuthUnload
|
|
|
|
Author:
|
|
|
|
Arthur Bierer (arthurbi) 25-Dec-1995
|
|
|
|
Revision History:
|
|
|
|
Rajeev Dujari (rajeevd) 01-Oct-1996 overhauled
|
|
|
|
Adriaan Canter (adriaanc) 01-03-1998 :
|
|
AUTHCTX now a virtual base class, from which derived classes
|
|
inherit to implement the different authentication protocols:
|
|
|
|
BASIC_CTX (Basic auth),
|
|
PLUG_CTX (NTLM, Negotiate)
|
|
DIGEST_CTX (Digest auth, new)
|
|
|
|
|
|
--*/
|
|
|
|
#include <wininetp.h>
|
|
#include <splugin.hxx>
|
|
#include "auth.h"
|
|
#include "sspspm.h"
|
|
|
|
//
|
|
// constants
|
|
//
|
|
|
|
#define WILDCARD 0x05 // don't use '*' since it can appear in an URL
|
|
#define AssertHaveLock() INET_ASSERT(g_dwOwnerId == GetCurrentThreadId())
|
|
|
|
#define MAX_AUTH_HDR_SIZE (MAX_BLOB_SIZE + HTTP_PROXY_AUTHORIZATION_LEN + 2)
|
|
|
|
//
|
|
// globals
|
|
//
|
|
|
|
// Global authentication providers list and state.
|
|
AUTHCTX::SPMState AUTHCTX::g_eState;
|
|
AUTHCTX::SPMData *AUTHCTX::g_pSPMList = NULL;
|
|
|
|
|
|
// Global auth crit sect.
|
|
CCritSec g_crstAuth;
|
|
|
|
#ifdef DBG
|
|
DWORD g_dwOwnerId = 0;
|
|
LONG g_nLockCount = 0;
|
|
#endif
|
|
|
|
//
|
|
// private prototypes
|
|
//
|
|
|
|
//-----------------------------------------------------------------------------
|
|
//
|
|
// AUTH_CREDS class definition.
|
|
//
|
|
//
|
|
PRIVATE AUTH_CREDS *Creds_Create
|
|
(
|
|
LPSTR lpszHost,
|
|
LPSTR lpszRealm,
|
|
AUTHCTX::SPMData* pSPM
|
|
);
|
|
|
|
void Creds_Free (AUTH_CREDS *Creds);
|
|
|
|
|
|
|
|
//-----------------------------------------------------------------------------
|
|
//
|
|
// Utilities
|
|
//
|
|
//
|
|
|
|
PRIVATE VOID SspiFlush (LPSTR pszDll);
|
|
PRIVATE BOOL TemplateMatch(LPSTR lpszTemplate, LPSTR lpszFilename);
|
|
PRIVATE LPSTR MakeTemplate (LPSTR docname);
|
|
PRIVATE LPSTR GetProxyName (HTTP_REQUEST_HANDLE_OBJECT *pRequest);
|
|
|
|
PRIVATE BOOL ReadRegKey(
|
|
BYTE * pbRegValue,
|
|
DWORD * pdwNumBytes,
|
|
LPSTR pszRegKey,
|
|
LPSTR pszRegValueName,
|
|
DWORD dwRegTypeExpected);
|
|
|
|
|
|
|
|
//-----------------------------------------------------------------------------
|
|
//
|
|
//
|
|
// AUTH_CREDS functions
|
|
//
|
|
// Creds_CREATE
|
|
// Creds_FREE
|
|
// SetUser
|
|
// SetPass
|
|
// FlushCredsList
|
|
//
|
|
|
|
PRIVATE AUTH_CREDS *Creds_Create // AUTH_CREDS constructor
|
|
(
|
|
LPSTR lpszHost, // Host Name to place in structure.
|
|
LPSTR lpszRealm, // Realm string to add.
|
|
AUTHCTX::SPMData * pSPM
|
|
)
|
|
{
|
|
AUTH_CREDS* Creds = (AUTH_CREDS *) ALLOCATE_ZERO_MEMORY(sizeof(*Creds));
|
|
if (!Creds)
|
|
return NULL;
|
|
|
|
INET_ASSERT (!Creds->lpszHost);
|
|
Creds->lpszHost = lpszHost ? NewString(lpszHost) : NULL;
|
|
|
|
INET_ASSERT (!Creds->lpszRealm);
|
|
Creds->lpszRealm = lpszRealm ? NewString(lpszRealm) : NULL;
|
|
Creds->pSPM = pSPM;
|
|
|
|
Creds->xszPass.SetSecuritySensitive();
|
|
|
|
if ( (!Creds->lpszHost && lpszHost)
|
|
|| (!Creds->lpszRealm && lpszRealm)
|
|
)
|
|
{
|
|
Creds_Free(Creds);
|
|
return NULL;
|
|
}
|
|
|
|
return Creds;
|
|
}
|
|
|
|
PRIVATE VOID Creds_Free(AUTH_CREDS *Creds) // AUTH_CREDS destructor
|
|
{
|
|
if ( Creds )
|
|
{
|
|
if (Creds->lpszHost)
|
|
FREE_MEMORY(Creds->lpszHost);
|
|
if ( Creds->lpszUser )
|
|
{
|
|
SecureZeroMemory(Creds->lpszUser, strlen(Creds->lpszUser));
|
|
FREE_MEMORY(Creds->lpszUser);
|
|
}
|
|
Creds->xszPass.Free();
|
|
if ( Creds->lpszRealm )
|
|
FREE_MEMORY(Creds->lpszRealm);
|
|
FREE_MEMORY(Creds);
|
|
}
|
|
}
|
|
|
|
PUBLIC DWORD AUTH_CREDS::SetUser (LPSTR lpszInput)
|
|
{
|
|
//AssertHaveLock();
|
|
if (!lpszInput)
|
|
{
|
|
if (lpszUser)
|
|
{
|
|
SecureZeroMemory(lpszUser, strlen(lpszUser));
|
|
FREE_MEMORY (lpszUser);
|
|
}
|
|
lpszUser = NULL;
|
|
return ERROR_SUCCESS;
|
|
}
|
|
if (lpszUser && !lstrcmp (lpszUser, lpszInput))
|
|
return ERROR_SUCCESS; // didn't change
|
|
LPSTR lpszTemp = NewString(lpszInput);
|
|
if (!lpszTemp)
|
|
return ERROR_NOT_ENOUGH_MEMORY;
|
|
if (lpszUser)
|
|
{
|
|
SecureZeroMemory(lpszUser, strlen(lpszUser));
|
|
FREE_MEMORY (lpszUser);
|
|
}
|
|
lpszUser = lpszTemp;
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
PUBLIC DWORD AUTH_CREDS::SetPass (LPSTR lpszInput)
|
|
{
|
|
//AssertHaveLock();
|
|
if (!lpszInput)
|
|
{
|
|
xszPass.Free();
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
return xszPass.SetData(lpszInput) ? ERROR_SUCCESS : ERROR_NOT_ENOUGH_MEMORY;
|
|
}
|
|
|
|
|
|
/*++
|
|
Delete some entries from a singly linked list.
|
|
--*/
|
|
/*
|
|
PRIVATE void FlushCredsList (AUTH_CREDS **ppList)
|
|
{
|
|
AssertHaveLock();
|
|
|
|
AUTH_CREDS *Creds = *ppList;
|
|
while (Creds)
|
|
{
|
|
AUTH_CREDS *CredsNext = Creds->pNext;
|
|
|
|
if (!Creds->nLockCount)
|
|
Creds_Free (Creds);
|
|
else
|
|
{
|
|
*ppList = Creds;
|
|
ppList = &(Creds->pNext);
|
|
}
|
|
|
|
Creds = CredsNext;
|
|
}
|
|
*ppList = NULL;
|
|
}
|
|
*/
|
|
|
|
|
|
//-----------------------------------------------------------------------------
|
|
//
|
|
//
|
|
// Auth* functions
|
|
//
|
|
// AuthOpen
|
|
// AuthClose
|
|
// AuthLock
|
|
// AuthUnlock
|
|
// AuthInDialog
|
|
// AuthNotify
|
|
//
|
|
//
|
|
|
|
BOOL AuthOpen (void)
|
|
{
|
|
INET_ASSERT (!g_dwOwnerId && !g_nLockCount);
|
|
return g_crstAuth.Init();
|
|
}
|
|
|
|
void AuthClose (void)
|
|
{
|
|
g_crstAuth.FreeLock();
|
|
INET_ASSERT (!g_dwOwnerId && !g_nLockCount);
|
|
}
|
|
|
|
BOOL AuthLock (void)
|
|
{
|
|
INET_ASSERT(g_crstAuth.IsInitialized() == TRUE);
|
|
if (!g_crstAuth.Lock())
|
|
{
|
|
INET_ASSERT(FALSE);
|
|
return FALSE;
|
|
}
|
|
DEBUG_ONLY (if (!g_nLockCount++) g_dwOwnerId = GetCurrentThreadId();)
|
|
return TRUE;
|
|
}
|
|
|
|
void AuthUnlock (void)
|
|
{
|
|
INET_ASSERT(g_crstAuth.IsInitialized() == TRUE);
|
|
INET_ASSERT (g_nLockCount > 0);
|
|
DEBUG_ONLY (if (!--g_nLockCount) g_dwOwnerId = 0;)
|
|
g_crstAuth.Unlock();
|
|
}
|
|
|
|
|
|
PUBLIC void AuthUnload (void)
|
|
/*++
|
|
Routine Description:
|
|
Frees all Cached URLs, and unloads any loaded DLL authentication modeles.
|
|
|
|
--*/
|
|
{
|
|
if (g_crstAuth.IsInitialized())
|
|
{
|
|
if (AuthLock())
|
|
{
|
|
AUTHCTX::UnloadAll();
|
|
AuthUnlock();
|
|
}
|
|
}
|
|
|
|
DIGEST_CTX::GlobalRelease();
|
|
}
|
|
|
|
|
|
//-----------------------------------------------------------------------------
|
|
//
|
|
//
|
|
// Utility Functions:
|
|
//
|
|
// SspiFlush
|
|
// TemplateMatch
|
|
// MakeTemplate
|
|
// GetProxyName
|
|
// ReadRegKey
|
|
// TrimQuotes
|
|
// TrimWhiteSpace
|
|
// GetDelimitedToken
|
|
// GetKeyValuePair
|
|
//
|
|
//
|
|
|
|
|
|
typedef BOOL (WINAPI * SSPI_FLUSH) (VOID) ;
|
|
|
|
void SspiFlush (LPSTR pszDll)
|
|
{
|
|
__try
|
|
{
|
|
HINSTANCE hinst = GetModuleHandle (pszDll);
|
|
|
|
if (hinst)
|
|
{
|
|
SSPI_FLUSH pfnFlush = (SSPI_FLUSH)
|
|
GetProcAddress (hinst, "CleanupCredentialCache");
|
|
|
|
if (pfnFlush)
|
|
{
|
|
(*pfnFlush) ();
|
|
}
|
|
}
|
|
}
|
|
__except (EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
INET_ASSERT (FALSE);
|
|
}
|
|
ENDEXCEPT
|
|
}
|
|
|
|
|
|
|
|
PRIVATE BOOL TemplateMatch(LPSTR lpszTemplate, LPSTR lpszFilename)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Attempts to match a template URL string with a URL ( FileName )
|
|
|
|
Arguments:
|
|
|
|
lpszTemplate - Template to match against.
|
|
lpszFilename - URL to match with the template
|
|
|
|
Return Value:
|
|
|
|
BOOL
|
|
Success - TRUE - match
|
|
Failure - FALSE - no match
|
|
|
|
Comments:
|
|
|
|
Note: This Legacy code from the SpyGlass IE 1.0 browser
|
|
|
|
--*/
|
|
|
|
{
|
|
/* code for this routine cloned from HTAA_templateMatch() */
|
|
|
|
CHAR *p = lpszTemplate;
|
|
CHAR *q = lpszFilename;
|
|
int m;
|
|
|
|
if (!lpszTemplate || !lpszFilename)
|
|
return 0;
|
|
|
|
for (; *p && *q && *p == *q; p++, q++) /* Find first mismatch */
|
|
; /* do nothing else */
|
|
|
|
if (!*p && !*q)
|
|
return 1; /* Equally long equal strings */
|
|
else if (WILDCARD == *p)
|
|
{ /* Wildcard */
|
|
p++; /* Skip wildcard character */
|
|
m = strlen(q) - strlen(p); /* Amount to match to wildcard */
|
|
if (m < 0)
|
|
return 0; /* No match, filename too short */
|
|
else
|
|
{ /* Skip the matched characters and compare */
|
|
if (lstrcmp(p, q + m))
|
|
return 0; /* Tail mismatch */
|
|
else
|
|
return 1; /* Tail match */
|
|
}
|
|
} /* if wildcard */
|
|
else
|
|
return 0; /* Length or character mismatch */
|
|
}
|
|
|
|
|
|
PRIVATE LPSTR MakeTemplate (LPSTR docname)
|
|
|
|
/*++
|
|
Routine Description:
|
|
Makes a Template String (from a URL) that can later be used to match a range of URLs.
|
|
|
|
Arguments:
|
|
ppszTemplate - pointer to pointer of where Template can be stored
|
|
docname - URL to create a template with.
|
|
|
|
Return Value: BOOL
|
|
Success - TRUE - created
|
|
Failure - FALSE - error
|
|
|
|
Comments:
|
|
Note: This Legacy code from the SpyGlass IE 1.0 browser
|
|
--*/
|
|
|
|
{
|
|
CHAR *pszTemplate = NULL;
|
|
unsigned long k;
|
|
k = 0;
|
|
|
|
if (docname)
|
|
{
|
|
CHAR *slash;
|
|
CHAR *first_slash;
|
|
|
|
//
|
|
// Ignore everything after first reserved character.
|
|
//
|
|
|
|
BYTE chSave = 0;
|
|
LPSTR lpszScan = docname;
|
|
while (*lpszScan)
|
|
{
|
|
if (*lpszScan == '?' || *lpszScan == ';')
|
|
{
|
|
chSave = *lpszScan;
|
|
*lpszScan = 0;
|
|
break;
|
|
}
|
|
lpszScan++;
|
|
}
|
|
|
|
slash = strrchr(docname, '/');
|
|
|
|
//
|
|
// If there is a "//" and no other slashes,
|
|
// then make sure not to chop the hostname off
|
|
// the URL. ex: http://www.netscape.com
|
|
// should be //www.netscape.com* not //*
|
|
//
|
|
|
|
if (slash)
|
|
{
|
|
first_slash = strchr(docname, '/' );
|
|
if ((first_slash+1) == slash)
|
|
k = lstrlen(docname);
|
|
else
|
|
k = (unsigned long)(slash-docname)+1;
|
|
}
|
|
|
|
// Restore any reserved character (or rewrite terminating null)
|
|
*lpszScan = chSave;
|
|
}
|
|
|
|
pszTemplate = (CHAR *) ALLOCATE_FIXED_MEMORY(k+2);
|
|
if (!pszTemplate)
|
|
return 0;
|
|
|
|
memcpy(pszTemplate, docname, k);
|
|
pszTemplate[k]= WILDCARD;
|
|
pszTemplate[k+1]=0;
|
|
|
|
DEBUG_PRINT(HTTP, INFO, ("MakeTemplate: made template [%s] from [%s]\n",
|
|
pszTemplate, docname ));
|
|
|
|
return pszTemplate;
|
|
}
|
|
|
|
LPSTR GetProxyName (HTTP_REQUEST_HANDLE_OBJECT *pRequest)
|
|
{
|
|
// Get the proxy name.
|
|
LPSTR lpszProxy;
|
|
DWORD cbProxy;
|
|
INTERNET_PORT port;
|
|
|
|
pRequest->GetProxyName(
|
|
&lpszProxy,
|
|
&cbProxy,
|
|
&port);
|
|
|
|
return lpszProxy;
|
|
}
|
|
|
|
|
|
//++------------------------------------------------------------------------
|
|
//
|
|
// Function: ReadRegKey
|
|
//
|
|
// Synopsis: This function reads a registry key.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Returns: TRUE no error
|
|
// FALSE a fatal error happened
|
|
//
|
|
// History: AshishS Created 5/22/96
|
|
//------------------------------------------------------------------------
|
|
|
|
BOOL ReadRegKey(
|
|
BYTE * pbRegValue, // The value of the reg key will be
|
|
// stored here
|
|
DWORD * pdwNumBytes, // Pointer to DWORD conataining
|
|
// the number of bytes in the above buffer - will be
|
|
// set to actual bytes stored.
|
|
LPSTR pszRegKey, // Reg Key to be opened
|
|
LPSTR pszRegValueName, // Reg Value to query
|
|
DWORD dwRegTypeExpected) // Expected type of Value
|
|
{
|
|
HKEY hRegKey;
|
|
DWORD dwRegType;
|
|
LONG lResult;
|
|
|
|
//read registry to find out name of the file
|
|
if ( (lResult = REGOPENKEYEX(HKEY_LOCAL_MACHINE,
|
|
pszRegKey, // address of subkey name
|
|
0, // reserved
|
|
KEY_READ, // samDesired
|
|
&hRegKey
|
|
// address of handle of open key
|
|
)) != ERROR_SUCCESS )
|
|
{
|
|
goto cleanup;
|
|
}
|
|
|
|
|
|
if ( (lResult =RegQueryValueEx( hRegKey,
|
|
pszRegValueName,
|
|
0, // reserved
|
|
&dwRegType,// address of buffer
|
|
// for value type
|
|
pbRegValue,
|
|
pdwNumBytes)) != ERROR_SUCCESS )
|
|
{
|
|
REGCLOSEKEY(hRegKey);
|
|
goto cleanup;
|
|
}
|
|
|
|
REGCLOSEKEY(hRegKey);
|
|
|
|
if ( dwRegType != dwRegTypeExpected )
|
|
{
|
|
goto cleanup;
|
|
}
|
|
|
|
return TRUE;
|
|
|
|
cleanup:
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
Inplace trim of one leading and one trailing quote.
|
|
-----------------------------------------------------------------------------*/
|
|
VOID TrimQuotes(LPSTR *psz, LPDWORD pcb)
|
|
{
|
|
if (*pcb && (**psz == '"'))
|
|
{
|
|
(*psz)++;
|
|
(*pcb)--;
|
|
}
|
|
if (*pcb && (*(*psz + *pcb - 1) == '"'))
|
|
(*pcb)--;
|
|
}
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
Inplace trim of leading and trailing whitespace.
|
|
-----------------------------------------------------------------------------*/
|
|
VOID TrimWhiteSpace(LPSTR *psz, LPDWORD pcb)
|
|
{
|
|
DWORD cb = *pcb;
|
|
CHAR* beg = *psz;
|
|
CHAR* end = beg + cb - 1;
|
|
|
|
while ((cb != 0) && ((*beg == ' ') || (*beg == '\t')))
|
|
{
|
|
beg++;
|
|
cb--;
|
|
}
|
|
|
|
while ((cb != 0) && ((*end == ' ') || (*end == '\t')))
|
|
{
|
|
end--;
|
|
cb--;
|
|
}
|
|
|
|
*psz = beg;
|
|
*pcb = cb;
|
|
}
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
Inplace strtok based on one delimiter. Ignores delimiter scoped by quotes.
|
|
-----------------------------------------------------------------------------*/
|
|
BOOL GetDelimitedToken(LPSTR* pszBuf, LPDWORD pcbBuf,
|
|
LPSTR* pszTok, LPDWORD pcbTok,
|
|
CHAR cDelim)
|
|
{
|
|
CHAR *pEnd;
|
|
BOOL fQuote = FALSE,
|
|
fRet = FALSE;
|
|
|
|
*pcbTok = 0;
|
|
*pszTok = *pszBuf;
|
|
pEnd = *pszBuf + *pcbBuf - 1;
|
|
|
|
while (*pcbBuf)
|
|
{
|
|
if ( ((**pszBuf == cDelim) && !fQuote)
|
|
|| (*pszBuf == pEnd)
|
|
|| (**pszBuf =='\r')
|
|
|| (**pszBuf =='\n'))
|
|
{
|
|
fRet = TRUE;
|
|
break;
|
|
}
|
|
|
|
if (**pszBuf == '"')
|
|
fQuote = !fQuote;
|
|
|
|
(*pszBuf)++;
|
|
(*pcbBuf)--;
|
|
}
|
|
|
|
if (fRet)
|
|
{
|
|
*pcbBuf = (DWORD) (pEnd - *pszBuf);
|
|
if (**pszBuf == cDelim)
|
|
{
|
|
*pcbTok = (DWORD)(*pszBuf - *pszTok);
|
|
(*pszBuf)++;
|
|
}
|
|
else
|
|
*pcbTok = (DWORD) (*pszBuf - *pszTok) + 1;
|
|
}
|
|
|
|
return fRet;
|
|
}
|
|
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
Inplace retrieval of key and value from a buffer of form key = <">value<">
|
|
-----------------------------------------------------------------------------*/
|
|
BOOL GetKeyValuePair(LPSTR szB, DWORD cbB,
|
|
LPSTR* pszK, LPDWORD pcbK,
|
|
LPSTR* pszV, LPDWORD pcbV)
|
|
{
|
|
if (GetDelimitedToken(&szB, &cbB, pszK, pcbK, '='))
|
|
{
|
|
TrimWhiteSpace(pszK, pcbK);
|
|
|
|
if (cbB)
|
|
{
|
|
*pszV = szB;
|
|
*pcbV = cbB;
|
|
TrimWhiteSpace(pszV, pcbV);
|
|
}
|
|
else
|
|
{
|
|
*pszV = NULL;
|
|
*pcbV = 0;
|
|
}
|
|
return TRUE;
|
|
}
|
|
|
|
else
|
|
{
|
|
*pszK = *pszV = NULL;
|
|
*pcbK = *pcbV = 0;
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
|
|
//-----------------------------------------------------------------------------
|
|
//
|
|
//
|
|
// Main authentication functions:
|
|
//
|
|
// AddAuthorizationHeader
|
|
// AuthOnRequest
|
|
// ProcessResponseHeader
|
|
// AuthOnRequest
|
|
//
|
|
//
|
|
|
|
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
-----------------------------------------------------------------------------*/
|
|
PRIVATE void AddAuthorizationHeader
|
|
(
|
|
HTTP_REQUEST_HANDLE_OBJECT *pRequest,
|
|
AUTHCTX* pAuthCtx
|
|
)
|
|
{
|
|
if (!pAuthCtx)
|
|
return;
|
|
|
|
INET_ASSERT(pAuthCtx->_pSPMData);
|
|
|
|
// AssertHaveLock();
|
|
|
|
// Call the auth package.
|
|
// CHAR *szHeader;
|
|
// DWORD dwFastHeaderSize = MAX_BLOB_SIZE + HTTP_PROXY_AUTHORIZATION_LEN + 2;
|
|
// CHAR* pszFastHeader = NULL;
|
|
CHAR *szSlowHeader = NULL;
|
|
// ULONG cbHeader;
|
|
LPSTR pBuf;
|
|
DWORD cbBuf;
|
|
DWORD dwPlugInError;
|
|
// CHAR *pszHeader;
|
|
|
|
/*
|
|
pszFastHeader = (CHAR*)ALLOCATE_FIXED_MEMORY(dwFastHeaderSize);
|
|
if (!pszFastHeader)
|
|
{
|
|
// Don't worry about reporting an error.
|
|
// Since this is a low mem condition, the only failure resulting
|
|
// from this is that the header won't be added, and this won't
|
|
// directly cause any more harm than unexpectedly failing to
|
|
// authenticate, which isn't bad, given the low mem state.
|
|
return;
|
|
}
|
|
*/
|
|
|
|
|
|
INT PackageId;
|
|
ULONG cbMaxToken;
|
|
|
|
//
|
|
// GetPkgMaxToken() will return 10000 if invalid pkg.
|
|
//
|
|
|
|
if( (pAuthCtx->_pSPMData) &&
|
|
(pAuthCtx->_pSPMData->szScheme) &&
|
|
((PackageId = GetPkgId( pAuthCtx->_pSPMData->szScheme )) != -1)
|
|
)
|
|
{
|
|
cbMaxToken = GetPkgMaxToken( PackageId );
|
|
} else {
|
|
cbMaxToken = MAX_AUTH_MSG_SIZE;
|
|
}
|
|
|
|
//
|
|
// add space for base64 overhead (33%, but round up)
|
|
//
|
|
|
|
cbMaxToken += (cbMaxToken/2);
|
|
|
|
// Prefix with the appropriate header.
|
|
|
|
BOOL fOkToRetry = TRUE;
|
|
|
|
|
|
cbBuf = HTTP_PROXY_AUTHORIZATION_LEN + 1 + cbMaxToken + 2 + 1;
|
|
|
|
retry_alloc:
|
|
|
|
szSlowHeader = (CHAR*)ALLOCATE_FIXED_MEMORY(cbBuf);
|
|
|
|
if( szSlowHeader == NULL )
|
|
{
|
|
return;
|
|
}
|
|
|
|
if (pAuthCtx->_fIsProxy)
|
|
{
|
|
memcpy (szSlowHeader, HTTP_PROXY_AUTHORIZATION_SZ, HTTP_PROXY_AUTHORIZATION_LEN);
|
|
pBuf = szSlowHeader + HTTP_PROXY_AUTHORIZATION_LEN;
|
|
|
|
// Don't reuse this keep-alive socket after a password cache flush.
|
|
pRequest->SetAuthorized();
|
|
}
|
|
else
|
|
{
|
|
memcpy (szSlowHeader, HTTP_AUTHORIZATION_SZ, HTTP_AUTHORIZATION_LEN);
|
|
pBuf = szSlowHeader + HTTP_AUTHORIZATION_LEN;
|
|
|
|
// Don't reuse a keep-alive socket after a password cache flush.
|
|
pRequest->SetAuthorized();
|
|
}
|
|
|
|
*pBuf++ = ' ';
|
|
INET_ASSERT (HTTP_PROXY_AUTHORIZATION_LEN >= HTTP_AUTHORIZATION_LEN);
|
|
|
|
dwPlugInError =
|
|
pAuthCtx->PreAuthUser(pBuf, &cbBuf);
|
|
|
|
if ((dwPlugInError == ERROR_INSUFFICIENT_BUFFER) && (pAuthCtx->GetSchemeType() == WINHTTP_AUTH_SCHEME_PASSPORT))
|
|
{
|
|
if (fOkToRetry)
|
|
{
|
|
fOkToRetry = FALSE;
|
|
FREE_MEMORY(szSlowHeader);
|
|
szSlowHeader = NULL;
|
|
goto retry_alloc;
|
|
}
|
|
}
|
|
|
|
// If the plug in did not fail, add its header to the outgoing header list
|
|
if (dwPlugInError == ERROR_SUCCESS && pAuthCtx->GetState() != AUTHCTX::STATE_ERROR)
|
|
{
|
|
// Append CR-LF.
|
|
pBuf += cbBuf;
|
|
*pBuf++ = '\r';
|
|
*pBuf++ = '\n';
|
|
*pBuf = 0;
|
|
cbBuf = (DWORD) (pBuf - szSlowHeader);
|
|
|
|
// Add or replace the (proxy-)authorization header.
|
|
wHttpAddRequestHeaders (pRequest, szSlowHeader, cbBuf,
|
|
HTTP_ADDREQ_FLAG_ADD | HTTP_ADDREQ_FLAG_REPLACE);
|
|
|
|
}
|
|
|
|
// delete [] pszHeader;
|
|
if( szSlowHeader )
|
|
{
|
|
FREE_MEMORY( szSlowHeader );
|
|
}
|
|
|
|
/*
|
|
if (pszFastHeader)
|
|
{
|
|
FREE_MEMORY( pszFastHeader );
|
|
}
|
|
*/
|
|
|
|
//DEBUG_LEAVE(0);
|
|
}
|
|
|
|
// biaow: move this to a better place
|
|
|
|
PSTR DwordSchemeToString(DWORD dwScheme)
|
|
{
|
|
switch (dwScheme)
|
|
{
|
|
case WINHTTP_AUTH_SCHEME_BASIC:
|
|
return "Basic";
|
|
case WINHTTP_AUTH_SCHEME_NTLM:
|
|
return "NTLM";
|
|
case WINHTTP_AUTH_SCHEME_PASSPORT:
|
|
return "Passport1.4";
|
|
case WINHTTP_AUTH_SCHEME_DIGEST:
|
|
return "Digest";
|
|
case WINHTTP_AUTH_SCHEME_NEGOTIATE:
|
|
return "Negotiate";
|
|
default:
|
|
return "";
|
|
}
|
|
}
|
|
|
|
DWORD DwordSchemeToFlags(DWORD dwScheme)
|
|
{
|
|
switch (dwScheme)
|
|
{
|
|
case WINHTTP_AUTH_SCHEME_BASIC:
|
|
return PLUGIN_AUTH_FLAGS_KEEP_ALIVE_NOT_REQUIRED;
|
|
case WINHTTP_AUTH_SCHEME_NTLM:
|
|
return PLUGIN_AUTH_FLAGS_NO_REALM;
|
|
case WINHTTP_AUTH_SCHEME_PASSPORT:
|
|
return PLUGIN_AUTH_FLAGS_KEEP_ALIVE_NOT_REQUIRED;
|
|
case WINHTTP_AUTH_SCHEME_DIGEST:
|
|
return PLUGIN_AUTH_FLAGS_KEEP_ALIVE_NOT_REQUIRED | PLUGIN_AUTH_FLAGS_CAN_HANDLE_UI;
|
|
case WINHTTP_AUTH_SCHEME_NEGOTIATE:
|
|
return PLUGIN_AUTH_FLAGS_KEEP_ALIVE_NOT_REQUIRED | PLUGIN_AUTH_FLAGS_NO_REALM;
|
|
default:
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
-----------------------------------------------------------------------------*/
|
|
PUBLIC DWORD AuthOnRequest (IN HINTERNET hRequestMapped)
|
|
{
|
|
DEBUG_ENTER ((DBG_HTTP, Dword, "AuthOnRequest", "%#x", hRequestMapped));
|
|
|
|
DWORD dwError = ERROR_SUCCESS;
|
|
LPSTR lpszUser, lpszPass = NULL;
|
|
|
|
// Get username, password, url, and auth context from request handle.
|
|
HTTP_REQUEST_HANDLE_OBJECT *pRequest =
|
|
(HTTP_REQUEST_HANDLE_OBJECT *) hRequestMapped;
|
|
|
|
|
|
AUTHCTX *pAuthCtx = pRequest->GetAuthCtx();
|
|
BOOL fCredsChanged = FALSE;
|
|
|
|
// PROXY AUTHENTICATION
|
|
//
|
|
// CERN proxies should remove proxy-authorization headers before forwarding
|
|
// requests to servers. Otherwise, don't add proxy authorization headers
|
|
// that would be seen by servers on a direct connect or via SSL tunneling.
|
|
|
|
if (pRequest->IsRequestUsingProxy()
|
|
&& !pRequest->IsTalkingToSecureServerViaProxy())
|
|
{
|
|
// if an app sets proxy creds, we want to make sure that the specified
|
|
// auth scheme is the same as the auth scheme in progress. Otherwise, we
|
|
// will delete the current auth context and build a new one based on the
|
|
// new scheme.
|
|
if (pRequest->_pProxyCreds
|
|
&& (pAuthCtx && pAuthCtx->_fIsProxy)
|
|
&& (pAuthCtx->GetRawSchemeType() != pRequest->_pProxyCreds->_AuthScheme))
|
|
{
|
|
delete pAuthCtx;
|
|
pAuthCtx = NULL;
|
|
pRequest->SetAuthCtx(NULL);
|
|
}
|
|
|
|
if (pAuthCtx && pAuthCtx->_fIsProxy)
|
|
{
|
|
// We have a proxy authentication in progress.
|
|
// If a user/pass set on handle, transfer to AUTH_CREDS.
|
|
|
|
// First check for proxy credentials and fallback to server
|
|
// for legacy wininet apps. This will invalidate the credentials
|
|
// on the handle they were found for any subsequent calls to
|
|
// GetUserAndPass.
|
|
|
|
// Serialize access to globals.
|
|
if (AuthLock())
|
|
{
|
|
if (pRequest->_pProxyCreds)
|
|
{
|
|
lpszPass = pRequest->_pProxyCreds->GetPassword();
|
|
pAuthCtx->_pCreds->SetUser(pRequest->_pProxyCreds->_pszUserName);
|
|
pAuthCtx->_pCreds->SetPass(lpszPass);
|
|
|
|
}
|
|
else if (pRequest->GetUserAndPass(IS_PROXY, &lpszUser, &lpszPass))
|
|
{
|
|
pAuthCtx->_pCreds->SetUser(lpszUser);
|
|
pAuthCtx->_pCreds->SetPass(lpszPass);
|
|
}
|
|
|
|
AuthUnlock();
|
|
|
|
// Add the authorization header.
|
|
AddAuthorizationHeader (pRequest, pAuthCtx);
|
|
}
|
|
}
|
|
|
|
// NO PROXY AUTHENTICATION CONTEXT -> SEE IF A AUTH_CREDS EXISTS.
|
|
else // See if we have a cached proxy user/pass.
|
|
{
|
|
if (pRequest->_pProxyCreds && pRequest->_pProxyCreds->_AuthScheme == WINHTTP_AUTH_SCHEME_BASIC)
|
|
{
|
|
AUTHCTX::SPMData* pSPMData = AUTHCTX::SPMLookup(DwordSchemeToString(pRequest->_pProxyCreds->_AuthScheme));
|
|
|
|
/*
|
|
reinterpret_cast<AUTHCTX::SPMData*>(New AUTHCTX::SPMData(
|
|
DwordSchemeToString(pRequest->_pProxyCreds->_AuthScheme),
|
|
DwordSchemeToFlags(pRequest->_pProxyCreds->_AuthScheme)));
|
|
*/
|
|
|
|
if (pSPMData)
|
|
{
|
|
AUTH_CREDS *pCreds = AUTHCTX::CreateCreds(pRequest, TRUE,
|
|
pSPMData, pRequest->_pProxyCreds->_pszRealm);
|
|
if (pCreds)
|
|
{
|
|
lpszPass = pRequest->_pProxyCreds->GetPassword();
|
|
pCreds->SetUser(pRequest->_pProxyCreds->_pszUserName);
|
|
pCreds->SetPass(lpszPass);
|
|
|
|
AUTHCTX* pNewAuthCtx = AUTHCTX::CreateAuthCtx(pRequest, IS_PROXY, pCreds);
|
|
if (pNewAuthCtx && pNewAuthCtx->GetSchemeType() == WINHTTP_AUTH_SCHEME_BASIC)
|
|
{
|
|
AddAuthorizationHeader (pRequest, pNewAuthCtx);
|
|
}
|
|
delete pNewAuthCtx;
|
|
pNewAuthCtx = NULL;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (lpszPass)
|
|
{
|
|
SecureZeroMemory(lpszPass, strlen(lpszPass));
|
|
FREE_MEMORY(lpszPass);
|
|
lpszPass = NULL;
|
|
}
|
|
|
|
// SERVER AUTHENTICATION
|
|
//
|
|
// Don't send server authorization when initiating SSL tunneling with proxy.
|
|
if (!pRequest->IsTunnel())
|
|
{
|
|
// if an app sets server creds, we want to make sure that the specified
|
|
// auth scheme is the same as the auth scheme in progress. Otherwise, we
|
|
// will delete the current auth context and build a new one based on the
|
|
// new scheme.
|
|
|
|
BOOL fNonePreferredSchemeUsed = FALSE;
|
|
|
|
if (pRequest->_pServerCreds
|
|
&& (pAuthCtx && !pAuthCtx->_fIsProxy)
|
|
&& (pAuthCtx->GetRawSchemeType() != pRequest->_pServerCreds->_AuthScheme))
|
|
{
|
|
delete pAuthCtx;
|
|
pAuthCtx = NULL;
|
|
pRequest->SetAuthCtx(NULL);
|
|
|
|
fNonePreferredSchemeUsed = TRUE;
|
|
}
|
|
|
|
// See if we have a server authentication in progress
|
|
if (pAuthCtx && !pAuthCtx->_fIsProxy)
|
|
{
|
|
// Server authentication in progress.
|
|
|
|
// If a user/pass set on handle, transfer to AUTH_CREDS.
|
|
// This will invalidate the credentials on the handle they
|
|
// were found for any subsequent calls to GetUserAndPass.
|
|
|
|
if (AuthLock())
|
|
{
|
|
if (pRequest->_pServerCreds)
|
|
{
|
|
lpszPass = pRequest->_pServerCreds->GetPassword();
|
|
pAuthCtx->_pCreds->SetUser(pRequest->_pServerCreds->_pszUserName);
|
|
pAuthCtx->_pCreds->SetPass(lpszPass);
|
|
}
|
|
else if (pRequest->GetUserAndPass(IS_SERVER, &lpszUser, &lpszPass))
|
|
{
|
|
pAuthCtx->_pCreds->SetUser(lpszUser);
|
|
pAuthCtx->_pCreds->SetPass(lpszPass);
|
|
}
|
|
|
|
AuthUnlock();
|
|
|
|
// Add the authorization header.
|
|
AddAuthorizationHeader (pRequest, pAuthCtx);
|
|
}
|
|
}
|
|
else // See if we have a cached server user/pass.
|
|
{
|
|
// NO PROXY AUTHENTICATION CONTEXT -> SEE IF A AUTH_CREDS EXISTS
|
|
|
|
if (pRequest->_pServerCreds)
|
|
{
|
|
AUTHCTX *pNewAuthCtx = NULL;
|
|
|
|
AUTHCTX::SPMData* pSPMData = AUTHCTX::SPMLookup(DwordSchemeToString(pRequest->_pServerCreds->_AuthScheme));
|
|
|
|
/*
|
|
reinterpret_cast<AUTHCTX::SPMData*>(New AUTHCTX::SPMData(
|
|
DwordSchemeToString(pRequest->_pServerCreds->_AuthScheme),
|
|
DwordSchemeToFlags(pRequest->_pServerCreds->_AuthScheme)));
|
|
*/
|
|
|
|
INET_ASSERT(pSPMData);
|
|
|
|
AUTH_CREDS *pCreds = AUTHCTX::CreateCreds(pRequest, FALSE,
|
|
pSPMData, pRequest->_pServerCreds->_pszRealm,
|
|
pRequest->_pServerCreds);
|
|
if (pCreds)
|
|
{
|
|
if (pRequest->_pServerCreds->_AuthScheme != WINHTTP_AUTH_SCHEME_PASSPORT)
|
|
{
|
|
pNewAuthCtx = AUTHCTX::CreateAuthCtx(pRequest, IS_SERVER, pCreds);
|
|
}
|
|
|
|
if(pNewAuthCtx)
|
|
{
|
|
if (pNewAuthCtx->GetSchemeType() == WINHTTP_AUTH_SCHEME_NTLM
|
|
|| pNewAuthCtx->GetSchemeType() == WINHTTP_AUTH_SCHEME_NEGOTIATE)
|
|
{
|
|
// NTLM or Negotiate (in which case we don't really know the
|
|
// protocol yet) - create the auth context, set it in the handle
|
|
// and set state to AUTHSTATE_NEGOTIATE. Handle now has
|
|
// a valid auth context and is in the correct auth state
|
|
// for the remainder of the authorization sequence.
|
|
|
|
// It's possible that the Creds entry was created when no proxy
|
|
// was in use and the user set a proxy. Check that this is
|
|
// not the case.
|
|
|
|
if (!fNonePreferredSchemeUsed &&
|
|
|
|
(!pRequest->IsMethodBody()
|
|
|| (pNewAuthCtx->GetSchemeType() == WINHTTP_AUTH_SCHEME_NTLM
|
|
&& pRequest->IsDisableNTLMPreauth())
|
|
|| (pRequest->IsRequestUsingProxy()
|
|
&& !pRequest->IsTalkingToSecureServerViaProxy())))
|
|
{
|
|
// NTLM preauth disabled or over proxy; no preauth.
|
|
delete pNewAuthCtx;
|
|
pNewAuthCtx = NULL;
|
|
}
|
|
else
|
|
{
|
|
// Set the auth context in the handle and
|
|
// add the auth header.
|
|
pRequest->SetAuthCtx(pNewAuthCtx);
|
|
pRequest->SetAuthState(AUTHSTATE_NEGOTIATE);
|
|
AddAuthorizationHeader (pRequest, pNewAuthCtx);
|
|
pNewAuthCtx = NULL;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if ((pNewAuthCtx->GetSchemeType() == WINHTTP_AUTH_SCHEME_DIGEST && !fCredsChanged)
|
|
|| (pNewAuthCtx->GetSchemeType() == WINHTTP_AUTH_SCHEME_BASIC))
|
|
{
|
|
pRequest->SetAuthCtx(pNewAuthCtx);
|
|
AddAuthorizationHeader (pRequest, pNewAuthCtx);
|
|
pRequest->SetCreds(pNewAuthCtx->_pCreds);
|
|
pNewAuthCtx = NULL;
|
|
}
|
|
//else if (pNewAuthCtx->GetSchemeType() == WINHTTP_AUTH_SCHEME_PASSPORT)
|
|
//{
|
|
// pRequest->SetAuthCtx(pNewAuthCtx);
|
|
// AddAuthorizationHeader (pRequest, pNewAuthCtx);
|
|
// pNewAuthCtx = NULL;
|
|
//}
|
|
}
|
|
|
|
if (pNewAuthCtx != NULL)
|
|
{
|
|
delete pNewAuthCtx;
|
|
pNewAuthCtx = NULL;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (lpszPass)
|
|
{
|
|
SecureZeroMemory(lpszPass, strlen(lpszPass));
|
|
FREE_MEMORY(lpszPass);
|
|
lpszPass = NULL;
|
|
}
|
|
|
|
DEBUG_LEAVE(dwError);
|
|
return dwError;
|
|
}
|
|
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
-----------------------------------------------------------------------------*/
|
|
DWORD ProcessResponseHeaders
|
|
(
|
|
HINTERNET hRequestMapped,
|
|
BOOL fIsProxy
|
|
)
|
|
{
|
|
DEBUG_ENTER ((DBG_HTTP, Dword, "ProcessResponseHeaders", "%#x", hRequestMapped));
|
|
|
|
DWORD dwError = ERROR_SUCCESS;
|
|
|
|
// Get context from request handle.
|
|
HTTP_REQUEST_HANDLE_OBJECT *pRequest
|
|
= (HTTP_REQUEST_HANDLE_OBJECT *) hRequestMapped;
|
|
AUTHCTX* pAuthCtx = pRequest->GetAuthCtx();
|
|
BOOL fDoNotSetCreds = FALSE;
|
|
|
|
if (pAuthCtx)
|
|
{
|
|
if ((dwError = pAuthCtx->UpdateFromHeaders(pRequest, fIsProxy))
|
|
!= ERROR_SUCCESS)
|
|
{
|
|
// Delete the auth context and fail auth
|
|
// immediately if any other error than
|
|
// scheme has been changed.
|
|
delete pAuthCtx;
|
|
pRequest->SetAuthCtx(NULL);
|
|
if (dwError != ERROR_HTTP_HEADER_NOT_FOUND)
|
|
{
|
|
goto cleanup;
|
|
}
|
|
|
|
fDoNotSetCreds = TRUE;
|
|
|
|
if (fIsProxy)
|
|
{
|
|
if (pRequest->_pProxyCreds)
|
|
{
|
|
delete pRequest->_pProxyCreds;
|
|
pRequest->_pProxyCreds = NULL;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if (pRequest->_pServerCreds)
|
|
{
|
|
delete pRequest->_pServerCreds;
|
|
pRequest->_pServerCreds = NULL;
|
|
}
|
|
}
|
|
|
|
pRequest->ClearUserAndPass(fIsProxy);
|
|
|
|
// Attempt to create a new auth context using
|
|
// the challenge received from the server.
|
|
// If this fails, we follow logic as commented
|
|
// below.
|
|
pAuthCtx = AUTHCTX::CreateAuthCtx(pRequest, fIsProxy);
|
|
if (!pAuthCtx)
|
|
{
|
|
dwError = ERROR_SUCCESS;
|
|
goto cleanup;
|
|
}
|
|
|
|
pAuthCtx->DisableAutoLogon();
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// CreateAuthCtx returns NULL if auth scheme not
|
|
// supported (fall through from HttpFiltOnResponse
|
|
// in sendreq.cxx) or if scheme is NTLM and the
|
|
// socket is not keep-alive or via proxy.
|
|
// In these cases it is necessary to check for a NULL
|
|
// return value. The correct return code for these cases is
|
|
// ERROR_SUCCESS, which will be returned by AuthOnResponse.
|
|
pAuthCtx = AUTHCTX::CreateAuthCtx(pRequest, fIsProxy);
|
|
if (!pAuthCtx)
|
|
{
|
|
dwError = ERROR_SUCCESS;
|
|
goto cleanup;
|
|
}
|
|
}
|
|
|
|
LPSTR lpszUser, lpszPass = NULL;
|
|
|
|
// First check for proxy credentials and fallback to server
|
|
// for legacy wininet apps. This will invalidate the credentials
|
|
// on the handle they were found for any subsequent calls to
|
|
// GetUserAndPass.
|
|
|
|
// I believe we should be putting the credentials in the
|
|
// password cache at this time. The scenario is that a client
|
|
// sets credentials on a handle, after a successful authentication
|
|
// the Creds will have null credentials. Pre-auth will then pull up
|
|
// credentials for the default user!!!!!!!!!!!
|
|
|
|
// Serialize access to globals.
|
|
if (AuthLock())
|
|
{
|
|
if (pRequest->_pServerCreds && !fIsProxy)
|
|
{
|
|
lpszUser = pRequest->_pServerCreds->_pszUserName;
|
|
lpszPass = pRequest->_pServerCreds->GetPassword();
|
|
}
|
|
else if (pRequest->_pProxyCreds && fIsProxy)
|
|
{
|
|
lpszUser = pRequest->_pProxyCreds->_pszUserName;
|
|
lpszPass = pRequest->_pProxyCreds->GetPassword();
|
|
}
|
|
else if ((!pRequest->GetUserAndPass(fIsProxy, &lpszUser, &lpszPass)) && fIsProxy)
|
|
{
|
|
pRequest->GetUserAndPass(IS_SERVER, &lpszUser, &lpszPass);
|
|
}
|
|
|
|
AuthUnlock();
|
|
}
|
|
else
|
|
{
|
|
dwError = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto cleanup;
|
|
}
|
|
|
|
// If we retrieved credentials from the handle set
|
|
// them in the Creds.
|
|
if (lpszUser && lpszPass && !fDoNotSetCreds)
|
|
{
|
|
pAuthCtx->_pCreds->SetUser(lpszUser);
|
|
pAuthCtx->_pCreds->SetPass(lpszPass);
|
|
}
|
|
|
|
if (lpszPass)
|
|
{
|
|
SecureZeroMemory(lpszPass, strlen(lpszPass));
|
|
FREE_MEMORY(lpszPass);
|
|
lpszPass = NULL;
|
|
}
|
|
|
|
// Post authenticate user.
|
|
dwError = pAuthCtx->PostAuthUser();
|
|
|
|
// Map all unexpected error codes to login failure.
|
|
if (dwError != ERROR_WINHTTP_FORCE_RETRY
|
|
&& dwError != ERROR_WINHTTP_INCORRECT_PASSWORD)
|
|
{
|
|
dwError = ERROR_WINHTTP_LOGIN_FAILURE;
|
|
}
|
|
|
|
pRequest->SetAuthCtx(pAuthCtx);
|
|
|
|
cleanup:
|
|
|
|
DEBUG_LEAVE (dwError);
|
|
return dwError;
|
|
}
|
|
|
|
|
|
BOOL IsSameDomain(LPCSTR pszTarget, LPCSTR pszResponse)
|
|
{
|
|
LPCSTR pszTargetR = pszTarget + strlen(pszTarget);
|
|
DWORD dwDotsSeen = 0;
|
|
while (--pszTargetR > pszTarget)
|
|
{
|
|
if (*pszTargetR == '.')
|
|
{
|
|
if (++dwDotsSeen == 2)
|
|
{
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (dwDotsSeen == 2)
|
|
{
|
|
++pszTargetR;
|
|
DWORD dwOffsetR = strlen(pszTargetR);
|
|
if (strlen(pszResponse) < dwOffsetR)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
LPCSTR pszResponseR = pszResponse + strlen(pszResponse) - dwOffsetR;
|
|
|
|
return !strcmp(pszTargetR, pszResponseR);
|
|
}
|
|
else
|
|
{
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
VOID CheckForTweenerLogout(HTTP_REQUEST_HANDLE_OBJECT *pRequest)
|
|
{
|
|
DWORD dwIndex = 0;
|
|
DWORD dwError;
|
|
|
|
do
|
|
{
|
|
LPSTR szData;
|
|
DWORD cbData;
|
|
dwError = pRequest->FastQueryResponseHeader(HTTP_QUERY_AUTHENTICATION_INFO,
|
|
(LPVOID*) &szData,
|
|
&cbData,
|
|
dwIndex);
|
|
if (dwError == ERROR_SUCCESS)
|
|
{
|
|
BOOL fLogout = FALSE;
|
|
CHAR TempChar = szData[cbData];
|
|
szData[cbData] = '\0';
|
|
|
|
if (strstr(szData, "Passport1.4") && strstr(szData, "logout"))
|
|
{
|
|
fLogout = TRUE;
|
|
}
|
|
szData[cbData] = TempChar;
|
|
|
|
if (fLogout)
|
|
{
|
|
PP_CONTEXT hPP = GetRootHandle(pRequest)->GetPPContext();
|
|
if (hPP != NULL)
|
|
{
|
|
WCHAR wszDAHost[256];
|
|
DWORD dwDAHostLen = 256;
|
|
CHAR szDAHost[256];
|
|
|
|
::PP_GetEffectiveDAHost(hPP, wszDAHost, &dwDAHostLen);
|
|
::WideCharToMultiByte(CP_ACP, 0, wszDAHost, -1, szDAHost, 256, NULL, NULL);
|
|
|
|
if (IsSameDomain(pRequest->GetServerName(), szDAHost))
|
|
{
|
|
::PP_Logout(hPP, 0);
|
|
}
|
|
}
|
|
|
|
break;
|
|
}
|
|
}
|
|
|
|
++dwIndex;
|
|
|
|
} while (dwError == ERROR_SUCCESS);
|
|
}
|
|
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
|
|
Routine Description:
|
|
|
|
Validates, and Caches Authentication Request headers if needed. If a URL matches a
|
|
cached set of templates it is assumed to require specific authentication information.
|
|
|
|
Arguments:
|
|
|
|
hRequest - An open HTTP request handle
|
|
where headers will be added if needed.
|
|
|
|
Return Value:
|
|
|
|
DWORD
|
|
Success - ERROR_SUCCESS
|
|
|
|
Failure - One of Several Error codes defined in winerror.h or wininet.w
|
|
|
|
Comments:
|
|
|
|
Need to handle mutiple authentication pages.
|
|
|
|
-----------------------------------------------------------------------------*/
|
|
PUBLIC DWORD AuthOnResponse (HINTERNET hRequestMapped)
|
|
{
|
|
DEBUG_ENTER((DBG_HTTP,
|
|
Dword,
|
|
"AuthOnResponse",
|
|
"%#x [%#x]",
|
|
hRequestMapped,
|
|
((INTERNET_HANDLE_BASE *)hRequestMapped)->GetPseudoHandle()
|
|
));
|
|
|
|
// Get URL and password cache entry from request handle.
|
|
HTTP_REQUEST_HANDLE_OBJECT *pRequest =
|
|
(HTTP_REQUEST_HANDLE_OBJECT *) hRequestMapped;
|
|
|
|
AUTHCTX *pAuthCtx = pRequest->GetAuthCtx();
|
|
DWORD dwStatus = pRequest->GetStatusCode();
|
|
|
|
if (pAuthCtx)
|
|
{
|
|
if (pAuthCtx->_fIsProxy && dwStatus != HTTP_STATUS_PROXY_AUTH_REQ)
|
|
{
|
|
if (dwStatus == HTTP_STATUS_REDIRECT) // we might need to do Tweener auth
|
|
{
|
|
if (pRequest->_pTweenerProxyCreds)
|
|
{
|
|
Creds_Free(pRequest->_pTweenerProxyCreds);
|
|
pRequest->_pTweenerProxyCreds = NULL;
|
|
}
|
|
pRequest->_pTweenerProxyCreds = pAuthCtx->_pCreds;
|
|
pAuthCtx->_pCreds = NULL;
|
|
}
|
|
|
|
// We are done with proxy authentication.
|
|
delete pAuthCtx;
|
|
pRequest->SetAuthCtx (NULL);
|
|
|
|
if (pRequest->_pProxyCreds)
|
|
{
|
|
delete pRequest->_pProxyCreds;
|
|
pRequest->_pProxyCreds = NULL;
|
|
}
|
|
|
|
pRequest->ClearUserAndPass(IS_PROXY);
|
|
}
|
|
else if (!pAuthCtx->_fIsProxy && dwStatus != HTTP_STATUS_DENIED)
|
|
{
|
|
if ((pAuthCtx->GetSchemeType() != WINHTTP_AUTH_SCHEME_PASSPORT) || dwStatus != HTTP_STATUS_REDIRECT)
|
|
{
|
|
// We are done with server authentication.
|
|
|
|
if (pAuthCtx->GetSchemeType() == WINHTTP_AUTH_SCHEME_PASSPORT)
|
|
{
|
|
delete [] pRequest->m_lpszRetUrl;
|
|
pRequest->m_lpszRetUrl = ((PASSPORT_CTX*)pAuthCtx)->m_lpszRetUrl;
|
|
((PASSPORT_CTX*)pAuthCtx)->m_lpszRetUrl = NULL;
|
|
}
|
|
|
|
delete pAuthCtx;
|
|
pRequest->SetAuthCtx (NULL);
|
|
|
|
if (pRequest->_pServerCreds)
|
|
{
|
|
delete pRequest->_pServerCreds;
|
|
pRequest->_pServerCreds = NULL;
|
|
}
|
|
|
|
pRequest->ClearUserAndPass(IS_SERVER);
|
|
}
|
|
else
|
|
{
|
|
// in the case of Passport Auth, 302 is still not done yet,
|
|
// but this is quite strange since 302 came a second time
|
|
// biaow-todo: we could be in a loop here
|
|
}
|
|
}
|
|
}
|
|
|
|
// Remove any stale authorization headers in case wHttpSendRequest
|
|
// loops, for example, to handle a redirect. To ignore trailing colon,
|
|
// subtract 1 from header lengths passed to ReplaceRequestHeader.
|
|
pRequest->ReplaceRequestHeader
|
|
(HTTP_QUERY_AUTHORIZATION,
|
|
"", 0, 0, HTTP_ADDREQ_FLAG_REPLACE);
|
|
pRequest->ReplaceRequestHeader
|
|
(HTTP_QUERY_PROXY_AUTHORIZATION,
|
|
"", 0, 0, HTTP_ADDREQ_FLAG_REPLACE);
|
|
|
|
DWORD error;
|
|
|
|
//
|
|
// note: Negotiate MUTUAL_AUTH can return dwStatus = 200 with a final
|
|
// WWW-Authenticate blob to process. logic below could be adjusted
|
|
// to ProcessResponseHeaders() in this situation, which allows MUTUAL_AUTH
|
|
// to be enforced.
|
|
//
|
|
|
|
switch (dwStatus)
|
|
{
|
|
case HTTP_STATUS_PROXY_AUTH_REQ: // 407
|
|
if (pRequest->IsRequestUsingProxy())
|
|
error = ProcessResponseHeaders(pRequest, IS_PROXY);
|
|
else
|
|
error = ERROR_WINHTTP_INVALID_SERVER_RESPONSE;
|
|
break;
|
|
|
|
case HTTP_STATUS_REDIRECT: // 302
|
|
{
|
|
INTERNET_HANDLE_OBJECT * pInternet = GetRootHandle((INTERNET_HANDLE_BASE*)pRequest);
|
|
if (pInternet->TweenerDisabled())
|
|
{
|
|
// biaow-todo: no passport support for down-levels yet
|
|
|
|
pRequest->SetAuthState(AUTHSTATE_NONE);
|
|
error = ERROR_SUCCESS;
|
|
|
|
break;
|
|
}
|
|
}
|
|
|
|
// process the header to see whether this is a 302 passport1.4 challenge
|
|
|
|
case HTTP_STATUS_DENIED: // 401
|
|
|
|
error = ProcessResponseHeaders(pRequest, IS_SERVER);
|
|
break;
|
|
|
|
default:
|
|
pRequest->SetAuthState(AUTHSTATE_NONE);
|
|
error = ERROR_SUCCESS;
|
|
}
|
|
|
|
// creds set by WinHttpSetCredentials() is good for one "authentication attempt" only.
|
|
// Since we are done authentication here, we are deleting it.
|
|
|
|
// biaow: detect the "final" failure so that we can delete the creds.
|
|
|
|
if (pRequest->_pTweenerProxyCreds)
|
|
{
|
|
Creds_Free(pRequest->_pTweenerProxyCreds);
|
|
pRequest->_pTweenerProxyCreds = NULL;
|
|
}
|
|
|
|
CheckForTweenerLogout(pRequest);
|
|
|
|
DEBUG_LEAVE(error);
|
|
return error;
|
|
}
|
|
|
|
|
|
|
|
|
|
//-----------------------------------------------------------------------------
|
|
//
|
|
//
|
|
// AUTHCTX Base class definitions
|
|
//
|
|
//
|
|
//
|
|
// static funcs:
|
|
// InitializeSPMList
|
|
// UnloadAll
|
|
// CreateAuthCtx
|
|
// CreateAuthCtx (using Creds*)
|
|
// GetSPMListState
|
|
// SearchCredsList
|
|
// FindOrCreateCreds
|
|
// GetAuthHeaderData
|
|
//
|
|
// base funcs:
|
|
// FindHdrIdxFromScheme
|
|
// GetScheme
|
|
// GetSchemeType - returns enum
|
|
// GetFlags - returns SPM flags
|
|
// GetState - returns state of SPM provider
|
|
//
|
|
//
|
|
// virtual overrides: defined in basic.cxx, plug.cxx and digest.cxx
|
|
// UpdateFromHeaders
|
|
// PreAuthUser
|
|
// PostAuthUser
|
|
//
|
|
//
|
|
//
|
|
|
|
|
|
/*---------------------------------------------------------------------------
|
|
AUTHCTX::SPMData constructor
|
|
---------------------------------------------------------------------------*/
|
|
AUTHCTX::SPMData::SPMData(LPSTR _szScheme, DWORD _dwFlags)
|
|
{
|
|
if (_szScheme)
|
|
{
|
|
szScheme = NewString(_szScheme);
|
|
cbScheme = strlen(_szScheme);
|
|
}
|
|
else
|
|
{
|
|
szScheme = NULL;
|
|
cbScheme = 0;
|
|
}
|
|
|
|
if (szScheme)
|
|
{
|
|
if (!lstrcmpi(szScheme, "Basic"))
|
|
eScheme = WINHTTP_AUTH_SCHEME_BASIC;
|
|
else if (!lstrcmpi(szScheme, "NTLM"))
|
|
eScheme = WINHTTP_AUTH_SCHEME_NTLM;
|
|
else if (!lstrcmpi(szScheme, "Digest"))
|
|
eScheme = WINHTTP_AUTH_SCHEME_DIGEST;
|
|
else if (!lstrcmpi(szScheme, "Negotiate"))
|
|
eScheme = WINHTTP_AUTH_SCHEME_NEGOTIATE;
|
|
else if (!lstrcmpi(szScheme, "Passport1.4"))
|
|
eScheme = WINHTTP_AUTH_SCHEME_PASSPORT;
|
|
else
|
|
eScheme = 0;
|
|
|
|
dwFlags = _dwFlags;
|
|
eState = STATE_NOTLOADED;
|
|
}
|
|
else
|
|
{
|
|
dwFlags = 0;
|
|
eState = STATE_ERROR;
|
|
}
|
|
}
|
|
|
|
/*---------------------------------------------------------------------------
|
|
AUTHCTX::SPMData destructor
|
|
---------------------------------------------------------------------------*/
|
|
AUTHCTX::SPMData::~SPMData()
|
|
{ delete szScheme; }
|
|
|
|
|
|
/*---------------------------------------------------------------------------
|
|
AUTHCTX constructor
|
|
---------------------------------------------------------------------------*/
|
|
AUTHCTX::AUTHCTX(SPMData *pData, AUTH_CREDS *pCreds)
|
|
{
|
|
_pSPMData = pData;
|
|
_pCreds = pCreds;
|
|
_pRequest = NULL;
|
|
_fIsProxy = FALSE;
|
|
_pvContext = NULL;
|
|
_eSubScheme = 0;
|
|
_dwSubFlags = 0;
|
|
|
|
_fDisableAutoLogon = FALSE;
|
|
|
|
_CtxCriSec.Init();
|
|
}
|
|
|
|
|
|
/*---------------------------------------------------------------------------
|
|
Destructor
|
|
---------------------------------------------------------------------------*/
|
|
AUTHCTX::~AUTHCTX()
|
|
{
|
|
if (AuthLock())
|
|
{
|
|
if (_pCreds)
|
|
Creds_Free(_pCreds);
|
|
AuthUnlock();
|
|
}
|
|
|
|
_CtxCriSec.FreeLock();
|
|
}
|
|
|
|
|
|
// ------------------------ Static Functions ---------------------------------
|
|
|
|
|
|
/*---------------------------------------------------------------------------
|
|
InitializeSPMList
|
|
---------------------------------------------------------------------------*/
|
|
BOOL AUTHCTX::InitializeSPMList()
|
|
{
|
|
BOOL retVal = FALSE;
|
|
|
|
struct SchemeFlagsPair
|
|
{
|
|
LPSTR pszScheme;
|
|
DWORD Flags;
|
|
};
|
|
|
|
SchemeFlagsPair SchemeFlags[] = {
|
|
{"NTLM", PLUGIN_AUTH_FLAGS_NO_REALM},
|
|
{"Basic", PLUGIN_AUTH_FLAGS_KEEP_ALIVE_NOT_REQUIRED},
|
|
{"Digest", PLUGIN_AUTH_FLAGS_KEEP_ALIVE_NOT_REQUIRED | PLUGIN_AUTH_FLAGS_CAN_HANDLE_UI},
|
|
{"Negotiate", PLUGIN_AUTH_FLAGS_KEEP_ALIVE_NOT_REQUIRED | PLUGIN_AUTH_FLAGS_NO_REALM},
|
|
{"Passport1.4", PLUGIN_AUTH_FLAGS_KEEP_ALIVE_NOT_REQUIRED}
|
|
};
|
|
|
|
if( GetSPMListState() == STATE_LOADED)
|
|
{
|
|
retVal = TRUE;
|
|
goto done;
|
|
}
|
|
|
|
SPMData *pNew;
|
|
g_pSPMList = NULL;
|
|
g_eState = STATE_ERROR;
|
|
|
|
AssertHaveLock();
|
|
|
|
// Hard-wired Basic, NTLM and Digest
|
|
for (DWORD dwIndex = 0; dwIndex < sizeof(SchemeFlags) / sizeof(SchemeFlagsPair); dwIndex++)
|
|
{
|
|
if (!GlobalPlatformVersion5 // we don't support Negotiate on NT4 or Win9x
|
|
&& !stricmp(SchemeFlags[dwIndex].pszScheme, "Negotiate"))
|
|
{
|
|
continue;
|
|
}
|
|
|
|
pNew = (AUTHCTX::SPMData*) New SPMData(SchemeFlags[dwIndex].pszScheme, SchemeFlags[dwIndex].Flags);
|
|
if (!pNew)
|
|
goto done;
|
|
|
|
// Add to head of list.
|
|
if (pNew->eState != STATE_ERROR)
|
|
{
|
|
pNew->pNext = g_pSPMList;
|
|
g_pSPMList = pNew;
|
|
}
|
|
}
|
|
|
|
// The list is now in the correct state.
|
|
g_eState = STATE_LOADED;
|
|
retVal = TRUE;
|
|
|
|
done:
|
|
return retVal;
|
|
}
|
|
|
|
|
|
VOID AUTHCTX::UnloadAll()
|
|
{
|
|
|
|
SPMData *pData = g_pSPMList;
|
|
while (pData)
|
|
{
|
|
SPMData *pNext = pData->pNext;
|
|
delete pData;
|
|
pData = pNext;
|
|
}
|
|
|
|
SSPI_Unload();
|
|
|
|
g_eState = STATE_NOTLOADED;
|
|
g_pSPMList = NULL;
|
|
}
|
|
|
|
DWORD StringSchemeToDword(LPSTR szScheme)
|
|
{
|
|
if (!stricmp(szScheme, "Basic"))
|
|
{
|
|
return WINHTTP_AUTH_SCHEME_BASIC;
|
|
}
|
|
else if (!stricmp(szScheme, "Digest"))
|
|
{
|
|
return WINHTTP_AUTH_SCHEME_DIGEST;
|
|
}
|
|
else if (!stricmp(szScheme, "Passport1.4"))
|
|
{
|
|
return WINHTTP_AUTH_SCHEME_PASSPORT;
|
|
}
|
|
else if (!stricmp(szScheme, "NTLM"))
|
|
{
|
|
return WINHTTP_AUTH_SCHEME_NTLM;
|
|
}
|
|
else if (!stricmp(szScheme, "Negotiate"))
|
|
{
|
|
return WINHTTP_AUTH_SCHEME_NEGOTIATE;
|
|
}
|
|
else
|
|
{
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
/*---------------------------------------------------------------------------
|
|
CreateAuthCtx
|
|
Create an AUTHCTX* from headers - initially the authentication context
|
|
is created without a AUTH_CREDS entry. The AUTH_CREDS entry will be found or created
|
|
and possibly updated in UpdateFromHeaders.
|
|
---------------------------------------------------------------------------*/
|
|
AUTHCTX* AUTHCTX::CreateAuthCtx(HTTP_REQUEST_HANDLE_OBJECT * pRequest, BOOL fIsProxy)
|
|
{
|
|
LPSTR szScheme = NULL;
|
|
DWORD cbScheme = 0, dwError = 0, dwAuthIdx = 0;
|
|
AUTHCTX *pAuthCtx = NULL;
|
|
WINHTTP_REQUEST_CREDENTIALS* pRequestCreds = fIsProxy ? pRequest->_pProxyCreds : pRequest->_pServerCreds;
|
|
|
|
pRequest->_PreferredScheme = 0;
|
|
pRequest->_SupportedSchemes = 0;
|
|
|
|
// Get scheme. This is assumed to be the first
|
|
// non-ws token in the auth header info.
|
|
do
|
|
{
|
|
DWORD dwScheme = 0;
|
|
AUTHCTX::SPMData *pSPM = NULL;
|
|
|
|
delete [] szScheme;
|
|
szScheme = NULL;
|
|
|
|
// It is necessary to hold on to the auth index
|
|
// in this loop because we could have gone through
|
|
// more than one scheme.
|
|
dwError = GetAuthHeaderData(pRequest, fIsProxy, NULL,
|
|
&szScheme, &cbScheme, ALLOCATE_BUFFER | GET_SCHEME, dwAuthIdx++);
|
|
|
|
if (dwError != ERROR_SUCCESS)
|
|
goto quit;
|
|
|
|
pSPM = SPMLookup(szScheme);
|
|
|
|
if (pSPM == NULL)
|
|
continue;
|
|
|
|
dwScheme = pSPM ? pSPM->eScheme : 0;
|
|
|
|
pRequest->_KnowSupportedSchemes = TRUE;
|
|
pRequest->_SupportedSchemes |= dwScheme;
|
|
pRequest->_AuthTarget = fIsProxy ? WINHTTP_AUTH_TARGET_PROXY : WINHTTP_AUTH_TARGET_SERVER;
|
|
|
|
DEBUG_PRINT(API,
|
|
INFO,
|
|
("CreateAuthCtx(%x) : Auth Target = %x\n",
|
|
fIsProxy,
|
|
pRequest->_AuthTarget
|
|
));
|
|
|
|
if (pRequest->_PreferredScheme == 0)
|
|
pRequest->_PreferredScheme = dwScheme;
|
|
|
|
// If we haven't created an auth context yet, maybe create one.
|
|
if (pAuthCtx == NULL)
|
|
{
|
|
// If there is a scheme we have credentials for,
|
|
//only create an auth context for that scheme.
|
|
if (pRequestCreds && pRequestCreds->_AuthScheme == dwScheme)
|
|
{
|
|
AUTH_CREDS* pAuthCreds = AUTHCTX::CreateCreds(pRequest, fIsProxy,
|
|
pSPM, pRequestCreds->_pszRealm,
|
|
pRequestCreds);
|
|
if (pAuthCreds)
|
|
{
|
|
pAuthCtx = AUTHCTX::CreateAuthCtx(pRequest, fIsProxy, pAuthCreds);
|
|
}
|
|
}
|
|
// If there isn't a scheme we have credentials for,
|
|
//create an auth context for the first scheme.
|
|
else if (pRequestCreds == NULL)
|
|
{
|
|
pAuthCtx = CreateAuthCtx(pRequest, fIsProxy, szScheme);
|
|
}
|
|
|
|
// If creation of an auth context is successful, update
|
|
// the context from any header info.
|
|
if (pAuthCtx)
|
|
{
|
|
if (pAuthCtx->UpdateFromHeaders(pRequest, fIsProxy) != ERROR_SUCCESS)
|
|
{
|
|
delete pAuthCtx;
|
|
pAuthCtx = NULL;
|
|
}
|
|
}
|
|
}
|
|
} while (1);
|
|
|
|
quit:
|
|
|
|
if (szScheme)
|
|
delete szScheme;
|
|
|
|
return pAuthCtx;
|
|
}
|
|
|
|
AUTHCTX::SPMData* AUTHCTX::SPMLookup(LPSTR szScheme)
|
|
{
|
|
if (!AuthLock())
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
AUTHCTX::SPMData *pSPM = NULL;
|
|
|
|
if (!AUTHCTX::InitializeSPMList())
|
|
{
|
|
// not critical, just no authentication
|
|
goto quit;
|
|
}
|
|
|
|
pSPM = g_pSPMList;
|
|
|
|
// Find SPMData to create from scheme.
|
|
while (pSPM)
|
|
{
|
|
if (!lstrcmpi(pSPM->szScheme, szScheme))
|
|
break;
|
|
|
|
pSPM = pSPM->pNext;
|
|
}
|
|
|
|
quit:
|
|
AuthUnlock();
|
|
return pSPM;
|
|
}
|
|
|
|
/*---------------------------------------------------------------------------
|
|
CreateAuthCtx
|
|
Create an AUTHCTX without a AUTH_CREDS from scheme
|
|
---------------------------------------------------------------------------*/
|
|
AUTHCTX* AUTHCTX::CreateAuthCtx(HTTP_REQUEST_HANDLE_OBJECT *pRequest,
|
|
BOOL fIsProxy, LPSTR szScheme)
|
|
{
|
|
if (!AuthLock())
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
AUTHCTX *pNewAuthCtx = NULL;
|
|
|
|
// we don't want to create a Passport1.4 context on 401 response (from DA)
|
|
if (!lstrcmpi("Passport1.4", szScheme))
|
|
{
|
|
if (pRequest->GetStatusCode() == HTTP_STATUS_DENIED)
|
|
{
|
|
goto quit;
|
|
}
|
|
}
|
|
|
|
SPMData *pSPM = SPMLookup( szScheme);
|
|
|
|
if (!pSPM)
|
|
{
|
|
// No matching auth scheme found.
|
|
// Not critical, just no auth.
|
|
goto quit;
|
|
}
|
|
|
|
// Create an auth context without Creds
|
|
switch(pSPM->eScheme)
|
|
{
|
|
// Create BASIC_CTX with NULL AUTH_CREDS.
|
|
case WINHTTP_AUTH_SCHEME_BASIC:
|
|
pNewAuthCtx = New BASIC_CTX(pRequest, fIsProxy, pSPM, NULL);
|
|
break;
|
|
|
|
// Create DIGEST_CTX with NULL AUTH_CREDS.
|
|
case WINHTTP_AUTH_SCHEME_DIGEST:
|
|
pNewAuthCtx = New DIGEST_CTX(pRequest, fIsProxy, pSPM, NULL);
|
|
break;
|
|
|
|
case WINHTTP_AUTH_SCHEME_PASSPORT:
|
|
pNewAuthCtx = new PASSPORT_CTX(pRequest, fIsProxy, pSPM, NULL);
|
|
if (pNewAuthCtx)
|
|
{
|
|
if (((PASSPORT_CTX*)pNewAuthCtx)->Init() == FALSE)
|
|
{
|
|
delete pNewAuthCtx;
|
|
pNewAuthCtx = NULL;
|
|
}
|
|
}
|
|
break;
|
|
|
|
// Create PLUG_CTX with NULL AUTH_CREDS.
|
|
case WINHTTP_AUTH_SCHEME_NTLM:
|
|
case WINHTTP_AUTH_SCHEME_NEGOTIATE:
|
|
|
|
default:
|
|
pNewAuthCtx = New PLUG_CTX(pRequest, fIsProxy, pSPM, NULL);
|
|
|
|
}
|
|
|
|
|
|
quit:
|
|
AuthUnlock();
|
|
return pNewAuthCtx;
|
|
}
|
|
|
|
|
|
/*---------------------------------------------------------------------------
|
|
CreateAuthCtx
|
|
Create an AUTHCTX from a AUTH_CREDS.
|
|
---------------------------------------------------------------------------*/
|
|
AUTHCTX* AUTHCTX::CreateAuthCtx(HTTP_REQUEST_HANDLE_OBJECT *pRequest,
|
|
BOOL fIsProxy, AUTH_CREDS* pCreds)
|
|
{
|
|
if (!AuthLock())
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
AUTHCTX *pNewAuthCtx = NULL;
|
|
|
|
if (!AUTHCTX::InitializeSPMList())
|
|
{
|
|
// not critical, just no authentication
|
|
goto quit;
|
|
}
|
|
|
|
// Handle tests (via proxy, is keep-alive)
|
|
// will be done in UpdateFromHeaders. Here
|
|
// we just construct the AUTHCTX.
|
|
switch(pCreds->pSPM->eScheme)
|
|
{
|
|
// Create BASIC_CTX.
|
|
case WINHTTP_AUTH_SCHEME_BASIC:
|
|
|
|
pNewAuthCtx = New BASIC_CTX(pRequest, fIsProxy, pCreds->pSPM, pCreds);
|
|
break;
|
|
|
|
// Create DIGEST_CTX.
|
|
case WINHTTP_AUTH_SCHEME_DIGEST:
|
|
pNewAuthCtx = New DIGEST_CTX(pRequest, fIsProxy, pCreds->pSPM, pCreds);
|
|
break;
|
|
|
|
case WINHTTP_AUTH_SCHEME_PASSPORT:
|
|
pNewAuthCtx = new PASSPORT_CTX(pRequest, fIsProxy, pCreds->pSPM, pCreds);
|
|
if (pNewAuthCtx)
|
|
{
|
|
if (((PASSPORT_CTX*)pNewAuthCtx)->Init() == FALSE)
|
|
{
|
|
delete pNewAuthCtx;
|
|
pNewAuthCtx = NULL;
|
|
}
|
|
}
|
|
break;
|
|
|
|
// Create PLUG_CTX.
|
|
case WINHTTP_AUTH_SCHEME_NTLM:
|
|
case WINHTTP_AUTH_SCHEME_NEGOTIATE:
|
|
|
|
default:
|
|
pNewAuthCtx = New PLUG_CTX(pRequest, fIsProxy, pCreds->pSPM, pCreds);
|
|
|
|
}
|
|
|
|
|
|
quit:
|
|
AuthUnlock();
|
|
return pNewAuthCtx;
|
|
}
|
|
|
|
AUTHCTX::SPMState AUTHCTX::GetSPMListState()
|
|
{ return g_eState; }
|
|
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
SearchCredsList
|
|
-----------------------------------------------------------------------------*/
|
|
//AUTH_CREDS* AUTHCTX::SearchCredsList
|
|
// (AUTH_CREDS* Creds, LPSTR lpszHost, LPSTR lpszUri, LPSTR lpszRealm, SPMData *pSPM)
|
|
/*++
|
|
|
|
Routine Description:
|
|
Scans the Linked List Cache for URLs, Realms, and Servers. Also allows
|
|
filter fields, to narrow searches.
|
|
|
|
Arguments:
|
|
Creds - Pointer to first item to search from.
|
|
lpszHost - Host, or Server name to search on.
|
|
lpszUri - URL to search on.
|
|
lpszRealm - Security Realm to search on
|
|
lpszScheme - Authentication scheme to search on.
|
|
Return Value:
|
|
|
|
AUTH_CREDS *
|
|
Success - Pointer to found item.
|
|
|
|
Failure - NULL pointer.
|
|
|
|
Comments:
|
|
Note: This Legacy code from the SpyGlass IE 1.0 browser
|
|
|
|
The AUTH_CREDS lists are searched on every request. Could optimize by keeping
|
|
a hash value of the server/proxy name.
|
|
|
|
If an exact match isn't found on a 401 response, the list is walked again
|
|
to search for a realm match. Could add a parameter to do both at once.
|
|
--*/
|
|
|
|
/*
|
|
{
|
|
AssertHaveLock();
|
|
|
|
while (Creds)
|
|
{
|
|
if ( (!pSPM || pSPM == Creds->pSPM)
|
|
&& (!lpszHost || !lstrcmpi(Creds->lpszHost,lpszHost))
|
|
&& (!lpszRealm || !lstrcmpi(Creds->lpszRealm,lpszRealm))
|
|
&& (!lpszUri || TemplateMatch (Creds->lpszUrl, lpszUri))
|
|
)
|
|
{
|
|
|
|
DEBUG_PRINT(HTTP, INFO, ("Lookup: Found template match [%q]\n",
|
|
Creds->lpszUser));
|
|
return Creds;
|
|
}
|
|
else
|
|
{
|
|
Creds = Creds->pNext;
|
|
}
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
*/
|
|
|
|
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
FindOrCreateCreds
|
|
-----------------------------------------------------------------------------*/
|
|
AUTH_CREDS* AUTHCTX::CreateCreds(
|
|
HTTP_REQUEST_HANDLE_OBJECT *pRequest,
|
|
BOOL fIsProxy,
|
|
SPMData *pSPM,
|
|
LPSTR lpszRealm,
|
|
WINHTTP_REQUEST_CREDENTIALS* pRequestCredentials // defaults to NULL
|
|
)
|
|
{
|
|
//AssertHaveLock();
|
|
|
|
// Create a AUTH_CREDS.
|
|
AUTH_CREDS *Creds;
|
|
Creds = NULL;
|
|
|
|
if (!pSPM)
|
|
{
|
|
INET_ASSERT(FALSE);
|
|
goto quit;
|
|
}
|
|
|
|
// Get host from request handle.
|
|
LPSTR lpszHost;
|
|
lpszHost = fIsProxy?
|
|
GetProxyName(pRequest) : pRequest->GetServerName();
|
|
|
|
// For NTLM, use the hostname analagously to basic realm.
|
|
if (pSPM->eScheme == WINHTTP_AUTH_SCHEME_NTLM || pSPM->eScheme == WINHTTP_AUTH_SCHEME_NEGOTIATE)
|
|
{
|
|
INET_ASSERT (!lpszRealm);
|
|
lpszRealm = lpszHost;
|
|
}
|
|
|
|
Creds = Creds_Create (lpszHost, lpszRealm, pSPM);
|
|
|
|
if (pRequestCredentials)
|
|
{
|
|
LPSTR lpszPass = pRequestCredentials->GetPassword();
|
|
|
|
if( ERROR_SUCCESS != Creds->SetUser(pRequestCredentials->_pszUserName)
|
|
|| ERROR_SUCCESS != Creds->SetPass(lpszPass))
|
|
{
|
|
Creds_Free(Creds);
|
|
Creds = NULL;
|
|
}
|
|
|
|
if (lpszPass)
|
|
{
|
|
SecureZeroMemory(lpszPass, strlen(lpszPass));
|
|
FREE_MEMORY(lpszPass);
|
|
}
|
|
}
|
|
|
|
quit:
|
|
|
|
return Creds;
|
|
}
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
GetAuthHeaderData
|
|
-----------------------------------------------------------------------------*/
|
|
DWORD AUTHCTX::GetAuthHeaderData(
|
|
HTTP_REQUEST_HANDLE_OBJECT *pRequest,
|
|
BOOL fIsProxy,
|
|
LPSTR szItem,
|
|
LPSTR *pszData,
|
|
LPDWORD pcbData,
|
|
DWORD dwFlags,
|
|
DWORD dwIndex)
|
|
{
|
|
LPSTR szData;
|
|
DWORD cbData, cbItem, dwError = ERROR_SUCCESS;;
|
|
CHAR *szTok, *szKey, *szValue;
|
|
DWORD cbTok, cbKey, cbValue;
|
|
|
|
szTok = szKey = szValue = NULL;
|
|
cbTok = cbKey = cbValue = NULL;
|
|
|
|
cbItem = szItem ? strlen(szItem) : 0;
|
|
|
|
DWORD dwQuery = fIsProxy?
|
|
HTTP_QUERY_PROXY_AUTHENTICATE : HTTP_QUERY_WWW_AUTHENTICATE;
|
|
|
|
// NULL item passed in means get up to the first \r\n, or
|
|
// possibly only the scheme is desired depending on dwFlags.
|
|
if (!cbItem)
|
|
{
|
|
if ((dwError = pRequest->FastQueryResponseHeader(dwQuery,
|
|
(LPVOID*) &szData,
|
|
&cbData,
|
|
dwIndex)) != ERROR_SUCCESS)
|
|
{
|
|
goto quit;
|
|
}
|
|
|
|
// Only the scheme is desired.
|
|
if (dwFlags & GET_SCHEME)
|
|
{
|
|
CHAR* ptr;
|
|
ptr = szValue = szData;
|
|
cbValue = 0;
|
|
while (!(*ptr == ' ' || *ptr == '\t' || *ptr == '\r' || *ptr == '\n'))
|
|
{
|
|
ptr++;
|
|
cbValue++;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// The entire header is desired.
|
|
szValue = szData;
|
|
cbValue = cbData;
|
|
}
|
|
|
|
}
|
|
else
|
|
{
|
|
// An item was passed in - attempt to parse this
|
|
// from the headers and return the corresponding
|
|
// value.
|
|
if ((dwError = pRequest->FastQueryResponseHeader(dwQuery,
|
|
(LPVOID*) &szData,
|
|
&cbData,
|
|
dwIndex)) != ERROR_SUCCESS)
|
|
{
|
|
goto quit;
|
|
}
|
|
|
|
// Successfully retrieved header. Parse for the desired item.
|
|
|
|
// Point past scheme
|
|
while (!(*szData == ' ' || *szData == '\t' || *szData == '\r' || *szData == '\n'))
|
|
{
|
|
szData++;
|
|
cbData--;
|
|
}
|
|
|
|
// Attempt to parse an item of the format 'key = <">value<">'
|
|
// from a comma delmited list of items.
|
|
dwError = ERROR_HTTP_HEADER_NOT_FOUND;
|
|
while (GetDelimitedToken(&szData, &cbData, &szTok, &cbTok, ','))
|
|
{
|
|
if (GetKeyValuePair(szTok, cbTok, &szKey, &cbKey, &szValue, &cbValue))
|
|
{
|
|
if ((cbItem == cbKey) && !strnicmp(szKey, szItem, cbItem))
|
|
{
|
|
TrimQuotes(&szValue, &cbValue);
|
|
dwError = ERROR_SUCCESS;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
if (dwError == ERROR_SUCCESS)
|
|
{
|
|
// Allocate buffer containing data
|
|
// or return reference.
|
|
if (dwFlags & ALLOCATE_BUFFER)
|
|
{
|
|
*pszData = New CHAR[cbValue+1];
|
|
if (!*pszData)
|
|
{
|
|
dwError = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto quit;
|
|
}
|
|
memcpy(*pszData, szValue, cbValue);
|
|
(*pszData)[cbValue] = '\0';
|
|
*pcbData = cbValue;
|
|
}
|
|
else
|
|
{
|
|
*pszData = szValue;
|
|
*pcbData = cbValue;
|
|
}
|
|
}
|
|
|
|
quit:
|
|
|
|
if (dwError != ERROR_SUCCESS)
|
|
{
|
|
INET_ASSERT(dwIndex || dwError == ERROR_HTTP_HEADER_NOT_FOUND);
|
|
}
|
|
|
|
return dwError;
|
|
}
|
|
|
|
|
|
// ------------------------ Base class funcs---------------------------------
|
|
|
|
|
|
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
FindHdrIdxFromScheme
|
|
-----------------------------------------------------------------------------*/
|
|
DWORD AUTHCTX::FindHdrIdxFromScheme(LPDWORD pdwIndex)
|
|
{
|
|
LPSTR szHeader;
|
|
DWORD cbHeader, dwQuery, dwError;
|
|
|
|
dwQuery = _fIsProxy?
|
|
HTTP_QUERY_PROXY_AUTHENTICATE : HTTP_QUERY_WWW_AUTHENTICATE;
|
|
|
|
*pdwIndex = 0;
|
|
|
|
while ((dwError = _pRequest->FastQueryResponseHeader(dwQuery,
|
|
(LPVOID*) &szHeader,
|
|
&cbHeader,
|
|
*pdwIndex)) == ERROR_SUCCESS)
|
|
{
|
|
DWORD cb = 0;
|
|
CHAR *ptr = szHeader;
|
|
while (!(*ptr == ' ' || *ptr == '\t' || *ptr == '\r' || *ptr == '\n'))
|
|
{
|
|
ptr++;
|
|
cb++;
|
|
}
|
|
|
|
if ((_pSPMData->cbScheme == cb)
|
|
&& (!strnicmp(_pSPMData->szScheme, szHeader, cb)))
|
|
{
|
|
break;
|
|
}
|
|
(*pdwIndex)++;
|
|
}
|
|
return dwError;
|
|
}
|
|
|
|
/*-----------------------------------------------------------------------------
|
|
Get funcs.
|
|
-----------------------------------------------------------------------------*/
|
|
LPSTR AUTHCTX::GetScheme()
|
|
{ return _pSPMData->szScheme; }
|
|
|
|
DWORD AUTHCTX::GetSchemeType()
|
|
{
|
|
if (_pSPMData->eScheme == WINHTTP_AUTH_SCHEME_NEGOTIATE)
|
|
{
|
|
if (_eSubScheme == WINHTTP_AUTH_SCHEME_NTLM || _eSubScheme == WINHTTP_AUTH_SCHEME_KERBEROS)
|
|
{
|
|
return _eSubScheme;
|
|
}
|
|
}
|
|
return _pSPMData->eScheme;
|
|
}
|
|
|
|
DWORD AUTHCTX::GetRawSchemeType()
|
|
{
|
|
return _pSPMData->eScheme;
|
|
}
|
|
|
|
DWORD AUTHCTX::GetFlags()
|
|
{
|
|
if (_pSPMData->eScheme == WINHTTP_AUTH_SCHEME_NEGOTIATE)
|
|
{
|
|
if (_eSubScheme == WINHTTP_AUTH_SCHEME_NTLM || _eSubScheme == WINHTTP_AUTH_SCHEME_KERBEROS)
|
|
{
|
|
return _dwSubFlags;
|
|
}
|
|
}
|
|
return _pSPMData->dwFlags;
|
|
}
|
|
|
|
AUTHCTX::SPMState AUTHCTX::GetState()
|
|
{ return _pSPMData->eState; }
|