Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:rkwasny
firefox2
firefox-ntlm.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File firefox-ntlm.patch of Package firefox2
diff --git a/mozilla/extensions/auth/Makefile.in b/mozilla/extensions/auth/Makefile.in index f0aff40..46e5f5e 100644 --- a/mozilla/extensions/auth/Makefile.in +++ b/mozilla/extensions/auth/Makefile.in @@ -78,6 +78,8 @@ CPPSRCS += \ ifeq ($(OS_ARCH),WINNT) LOCAL_INCLUDES += -DUSE_SSPI CPPSRCS += nsAuthSSPI.cpp +else +CPPSRCS += nsAuthSambaNTLM.cpp endif include $(topsrcdir)/config/rules.mk diff --git a/mozilla/extensions/auth/nsAuthFactory.cpp b/mozilla/extensions/auth/nsAuthFactory.cpp index b3d515c..71705e5 100644 --- a/mozilla/extensions/auth/nsAuthFactory.cpp +++ b/mozilla/extensions/auth/nsAuthFactory.cpp @@ -127,6 +127,36 @@ nsKerbSSPIAuthConstructor(nsISupports *outer, REFNSIID iid, void **result) {0x8c, 0xd6, 0x08, 0x00, 0x20, 0x0c, 0x9a, 0x66} \ } +#else + +#define NS_SAMBANTLMAUTH_CID \ +{ /* bc54f001-6eb0-4e32-9f49-7e064d8e70ef */ \ + 0xbc54f001, \ + 0x6eb0, \ + 0x4e32, \ + {0x9f, 0x49, 0x7e, 0x06, 0x4d, 0x8e, 0x70, 0xef} \ +} + +#include "nsAuthSambaNTLM.h" +static NS_METHOD +nsSambaNTLMAuthConstructor(nsISupports *outer, REFNSIID iid, void **result) +{ + if (outer) + return NS_ERROR_NO_AGGREGATION; + + nsCOMPtr<nsAuthSambaNTLM> auth = new nsAuthSambaNTLM(); + if (!auth) + return NS_ERROR_OUT_OF_MEMORY; + + nsresult rv = auth->SpawnNTLMAuthHelper(); + if (NS_FAILED(rv)) { + // Failure here probably means that cached credentials were not available + return rv; + } + + return auth->QueryInterface(iid, result); +} + #endif static NS_METHOD @@ -206,6 +236,12 @@ static nsModuleComponentInfo components[] = { NS_AUTH_MODULE_CONTRACTID_PREFIX "sys-ntlm", nsSysNTLMAuthConstructor }, +#else + { "nsAuthSambaNTLM", + NS_SAMBANTLMAUTH_CID, + NS_AUTH_MODULE_CONTRACTID_PREFIX "sys-ntlm", + nsSambaNTLMAuthConstructor + }, #endif { "nsHttpNegotiateAuth", NS_HTTPNEGOTIATEAUTH_CID, diff --git a/mozilla/extensions/auth/nsAuthSambaNTLM.cpp b/mozilla/extensions/auth/nsAuthSambaNTLM.cpp new file mode 100644 index 0000000..05d00f2 --- /dev/null +++ b/mozilla/extensions/auth/nsAuthSambaNTLM.cpp @@ -0,0 +1,323 @@ +/* vim:set ts=4 sw=4 et cindent: */ +/* ***** BEGIN LICENSE BLOCK ***** + * Version: MPL 1.1/GPL 2.0/LGPL 2.1 + * + * The contents of this file are subject to the Mozilla Public License Version + * 1.1 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * http://www.mozilla.org/MPL/ + * + * Software distributed under the License is distributed on an "AS IS" basis, + * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License + * for the specific language governing rights and limitations under the + * License. + * + * The Original Code is Samba NTLM Authentication. + * + * The Initial Developer of the Original Code is Novell. + * Portions created by the Initial Developer are Copyright (C) 2005 + * the Initial Developer. All Rights Reserved. + * + * Contributor(s): + * Robert O'Callahan (rocallahan@novell.com) + * + * Alternatively, the contents of this file may be used under the terms of + * either the GNU General Public License Version 2 or later (the "GPL"), or + * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), + * in which case the provisions of the GPL or the LGPL are applicable instead + * of those above. If you wish to allow use of your version of this file only + * under the terms of either the GPL or the LGPL, and not to allow others to + * use your version of this file under the terms of the MPL, indicate your + * decision by deleting the provisions above and replace them with the notice + * and other provisions required by the GPL or the LGPL. If you do not delete + * the provisions above, a recipient may use your version of this file under + * the terms of any one of the MPL, the GPL or the LGPL. + * + * ***** END LICENSE BLOCK ***** */ + +#include "nsAuth.h" +#include "nsAuthSambaNTLM.h" +#include "prenv.h" +#include "plbase64.h" + +#include <stdlib.h> +#include <sys/types.h> +#include <sys/wait.h> +#include <unistd.h> +#include <errno.h> + +nsAuthSambaNTLM::nsAuthSambaNTLM() + : mInitialMessage(nsnull), mChildPID(0), mFromChildFD(-1), mToChildFD(-1) +{ +} + +nsAuthSambaNTLM::~nsAuthSambaNTLM() +{ + // ntlm_auth reads from stdin regularly so closing our file handles + // should cause it to exit. Trying to kill it with a signal would be + // problematic because another process could have spawned with that pid + // if it has unexpectedly quit. + Shutdown(); + free(mInitialMessage); +} + +void +nsAuthSambaNTLM::Shutdown() +{ + if (mFromChildFD >= 0) { + close(mFromChildFD); + mFromChildFD = -1; + } + if (mToChildFD >= 0) { + close(mToChildFD); + mToChildFD = -1; + } + if (mChildPID) { + waitpid(mChildPID, nsnull, 0); + mChildPID = 0; + } +} + +NS_IMPL_ISUPPORTS1(nsAuthSambaNTLM, nsIAuthModule) + +static PRBool +SpawnIOChild(char** aArgs, pid_t* aPID, int* aFromChildFD, int* aToChildFD) +{ + int toChildPipe[2]; + if (pipe(toChildPipe) < 0) + return PR_FALSE; + int fromChildPipe[2]; + if (pipe(fromChildPipe) < 0) { + close(toChildPipe[0]); + close(toChildPipe[1]); + return PR_FALSE; + } + + pid_t pid = fork(); + if (pid < 0) { + PRInt32 i; + for (i = 0; i < 2; ++i) { + close(fromChildPipe[i]); + close(toChildPipe[i]); + } + NS_WARNING("fork() failed"); + return PR_FALSE; + } + + if (pid > 0) { + // We are the parent + close(toChildPipe[0]); + close(fromChildPipe[1]); + *aPID = pid; + *aFromChildFD = fromChildPipe[0]; + *aToChildFD = toChildPipe[1]; + return PR_TRUE; + } + + // We are the child + close(toChildPipe[1]); + close(fromChildPipe[0]); + // Make stdin read from toChildPipe + int result0 = dup2(toChildPipe[0], 0); + // Make stdout write to fromChildPipe + int result1 = dup2(fromChildPipe[1], 1); + if (result0 >= 0 && result1 >= 0) { + execvp(aArgs[0], aArgs); + } + + // Guess an error occurred! Just exit, the parent will notice + // that we're not responding correctly. + LOG(("ntlm_auth exec failure, errno=%d", errno)); + exit(0); + // ... satisfy the compiler + return PR_FALSE; +} + +static PRBool WriteString(int aFD, const nsACString& aString) +{ + PRInt32 length = aString.Length(); + nsPromiseFlatCString flat(aString); + const char* s = flat.get(); + LOG(("Writing to ntlm_auth: %s", s)); + + while (length > 0) { + int result = write(aFD, s, length); + if (result <= 0) + return PR_FALSE; + s += result; + length -= result; + } + return PR_TRUE; +} + +static PRBool ReadLine(int aFD, nsACString& aString) +{ + // ntlm_auth is defined to only send one line in response to each of our + // input lines. So this simple unbuffered strategy works as long as we + // read the response immediately after sending one request. + aString.Truncate(); + for (;;) { + char buf[1024]; + int result = read(aFD, buf, sizeof(buf)); + if (result <= 0) + return PR_FALSE; + aString.Append(buf, result); + if (buf[result - 1] == '\n') { + LOG(("Read from ntlm_auth: %s", nsPromiseFlatCString(aString).get())); + return PR_TRUE; + } + } +} + +/** + * Returns a heap-allocated array of PRUint8s, and stores the length in aLen. + * Returns nsnull if there's an error of any kind. + */ +static PRUint8* ExtractMessage(const nsACString& aLine, PRUint32* aLen) +{ + // ntlm_auth sends blobs to us as base64-encoded strings after the "xx " + // preamble on the response line. + PRInt32 length = aLine.Length(); + // The caller should verify there is a valid "xx " prefix and the line + // is terminated with a \n + NS_ASSERTION(length >= 4, "Line too short..."); + nsPromiseFlatCString flat(aLine); + const char* s = flat.get() + 3; + length -= 4; // lose first 3 chars plus trailing \n + NS_ASSERTION(s[length] == '\n', "aLine not newline-terminated"); + + if (length & 3) { + // The base64 encoded block must be multiple of 4. If not, something + // screwed up. + NS_WARNING("Base64 encoded block should be a multiple of 4 chars"); + return nsnull; + } + + // Calculate the exact length. I wonder why there isn't a function for this + // in plbase64. + PRInt32 numEquals; + for (numEquals = 0; numEquals < length; ++numEquals) { + if (flat.get()[length - 1 - numEquals] != '=') + break; + } + *aLen = (length/4)*3 - numEquals; + return NS_REINTERPRET_CAST(PRUint8*, PL_Base64Decode(flat.get() + 3, length - 4, nsnull)); +} + +nsresult +nsAuthSambaNTLM::SpawnNTLMAuthHelper() +{ + const char* username = PR_GetEnv("USER"); + if (!username) + return NS_ERROR_FAILURE; + + char* args[] = { + "ntlm_auth", + "--helper-protocol", "ntlmssp-client-1", + "--use-cached-creds", + "--username", NS_CONST_CAST(char*, username), + nsnull + }; + + PRBool isOK = SpawnIOChild(args, &mChildPID, &mFromChildFD, &mToChildFD); + if (!isOK) + return NS_ERROR_FAILURE; + + if (!WriteString(mToChildFD, NS_LITERAL_CSTRING("YR\n"))) + return NS_ERROR_FAILURE; + nsCString line; + if (!ReadLine(mFromChildFD, line)) + return NS_ERROR_FAILURE; + if (!StringBeginsWith(line, NS_LITERAL_CSTRING("YR "))) { + // Something went wrong. Perhaps no credentials are accessible. + return NS_ERROR_FAILURE; + } + + // It gave us an initial client-to-server request packet. Save that + // because we'll need it later. + mInitialMessage = ExtractMessage(line, &mInitialMessageLen); + if (!mInitialMessage) + return NS_ERROR_FAILURE; + return NS_OK; +} + +NS_IMETHODIMP +nsAuthSambaNTLM::Init(const char *serviceName, + PRUint32 serviceFlags, + const PRUnichar *domain, + const PRUnichar *username, + const PRUnichar *password) +{ + NS_ASSERTION(!username && !domain && !password, "unexpected credentials"); + return NS_OK; +} + +NS_IMETHODIMP +nsAuthSambaNTLM::GetNextToken(const void *inToken, + PRUint32 inTokenLen, + void **outToken, + PRUint32 *outTokenLen) +{ + if (!inToken) { + /* someone wants our initial message */ + *outToken = nsMemory::Clone(mInitialMessage, mInitialMessageLen); + if (!*outToken) + return NS_ERROR_OUT_OF_MEMORY; + *outTokenLen = mInitialMessageLen; + return NS_OK; + } + + /* inToken must be a type 2 message. Get ntlm_auth to generate our response */ + char* encoded = PL_Base64Encode(NS_STATIC_CAST(const char*, inToken), inTokenLen, nsnull); + if (!encoded) + return NS_ERROR_OUT_OF_MEMORY; + + nsCString request; + request.AssignLiteral("TT "); + request.Append(encoded); + free(encoded); + request.Append('\n'); + + if (!WriteString(mToChildFD, request)) + return NS_ERROR_FAILURE; + nsCString line; + if (!ReadLine(mFromChildFD, line)) + return NS_ERROR_FAILURE; + if (!StringBeginsWith(line, NS_LITERAL_CSTRING("KK "))) { + // Something went wrong. Perhaps no credentials are accessible. + return NS_ERROR_FAILURE; + } + PRUint8* buf = ExtractMessage(line, outTokenLen); + if (!buf) + return NS_ERROR_FAILURE; + // *outToken has to be freed by nsMemory::Free, which may not be free() + *outToken = nsMemory::Clone(buf, *outTokenLen); + if (!*outToken) { + free(buf); + return NS_ERROR_OUT_OF_MEMORY; + } + + // We're done. Close our file descriptors now and reap the helper + // process. + Shutdown(); + return NS_OK; +} + +NS_IMETHODIMP +nsAuthSambaNTLM::Unwrap(const void *inToken, + PRUint32 inTokenLen, + void **outToken, + PRUint32 *outTokenLen) +{ + return NS_ERROR_NOT_IMPLEMENTED; +} + +NS_IMETHODIMP +nsAuthSambaNTLM::Wrap(const void *inToken, + PRUint32 inTokenLen, + PRBool confidential, + void **outToken, + PRUint32 *outTokenLen) +{ + return NS_ERROR_NOT_IMPLEMENTED; +} diff --git a/mozilla/extensions/auth/nsAuthSambaNTLM.h b/mozilla/extensions/auth/nsAuthSambaNTLM.h new file mode 100644 index 0000000..6034f03 --- /dev/null +++ b/mozilla/extensions/auth/nsAuthSambaNTLM.h @@ -0,0 +1,78 @@ +/* vim:set ts=4 sw=4 et cindent: */ +/* ***** BEGIN LICENSE BLOCK ***** + * Version: MPL 1.1/GPL 2.0/LGPL 2.1 + * + * The contents of this file are subject to the Mozilla Public License Version + * 1.1 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * http://www.mozilla.org/MPL/ + * + * Software distributed under the License is distributed on an "AS IS" basis, + * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License + * for the specific language governing rights and limitations under the + * License. + * + * The Original Code is Samba NTLM Authentication. + * + * The Initial Developer of the Original Code is Novell. + * Portions created by the Initial Developer are Copyright (C) 2005 + * the Initial Developer. All Rights Reserved. + * + * Contributor(s): + * Robert O'Callahan (rocallahan@novell.com) + * + * Alternatively, the contents of this file may be used under the terms of + * either the GNU General Public License Version 2 or later (the "GPL"), or + * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), + * in which case the provisions of the GPL or the LGPL are applicable instead + * of those above. If you wish to allow use of your version of this file only + * under the terms of either the GPL or the LGPL, and not to allow others to + * use your version of this file under the terms of the MPL, indicate your + * decision by deleting the provisions above and replace them with the notice + * and other provisions required by the GPL or the LGPL. If you do not delete + * the provisions above, a recipient may use your version of this file under + * the terms of any one of the MPL, the GPL or the LGPL. + * + * ***** END LICENSE BLOCK ***** */ + +#ifndef nsAuthSambaNTLM_h__ +#define nsAuthSambaNTLM_h__ + +#include "nsIAuthModule.h" +#include "nsString.h" +#include "nsCOMPtr.h" + +/** + * This is an implementation of NTLM authentication that does single-signon + * by obtaining the user's Unix username and then asking Samba's + * ntlm_auth tool to do the authentication for us + * using the user's password cached in winbindd, if available. If the + * password is not available then this component fails to instantiate so + * nsHttpNTLMAuth will fall back to a different NTLM implementation. + */ +class nsAuthSambaNTLM : public nsIAuthModule +{ +public: + NS_DECL_ISUPPORTS + NS_DECL_NSIAUTHMODULE + + nsAuthSambaNTLM(); + + // We spawn the ntlm_auth helper from the module constructor, because + // that lets us fail to instantiate the module if ntlm_auth isn't + // available, triggering fallback to the built-in NTLM support (which + // doesn't support single signon, of course) + nsresult SpawnNTLMAuthHelper(); + +private: + ~nsAuthSambaNTLM(); + + void Shutdown(); + + PRUint8* mInitialMessage; /* free with free() */ + PRUint32 mInitialMessageLen; + PRInt32 mChildPID; + PRInt32 mFromChildFD, mToChildFD; +}; + +#endif /* nsAuthSambaNTLM_h__ */ diff --git a/mozilla/netwerk/protocol/http/src/nsHttpNTLMAuth.cpp b/mozilla/netwerk/protocol/http/src/nsHttpNTLMAuth.cpp index 9c25334..cde2695 100644 --- a/mozilla/netwerk/protocol/http/src/nsHttpNTLMAuth.cpp +++ b/mozilla/netwerk/protocol/http/src/nsHttpNTLMAuth.cpp @@ -46,8 +46,6 @@ //----------------------------------------------------------------------------- -#ifdef XP_WIN - #include "nsIPrefBranch.h" #include "nsIPrefService.h" #include "nsIServiceManager.h" @@ -208,8 +206,6 @@ public: }; NS_IMPL_ISUPPORTS0(nsNTLMSessionState) -#endif - //----------------------------------------------------------------------------- NS_IMPL_ISUPPORTS1(nsHttpNTLMAuth, nsIHttpAuthenticator) @@ -231,7 +227,6 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpChannel *channel, // start new auth sequence if challenge is exactly "NTLM" if (PL_strcasecmp(challenge, "NTLM") == 0) { nsCOMPtr<nsISupports> module; -#ifdef XP_WIN // // our session state is non-null to indicate that we've flagged // this auth domain as not accepting the system's default login. @@ -239,7 +234,7 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpChannel *channel, PRBool trySysNTLM = (*sessionState == nsnull); // - // on windows, we may have access to the built-in SSPI library, + // we may have access to a built-in SSPI library, // which could be used to authenticate the user without prompting. // // if the continuationState is null, then we may want to try using @@ -266,9 +261,7 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpChannel *channel, return NS_ERROR_OUT_OF_MEMORY; NS_ADDREF(*sessionState); } -#else - { -#endif + module = do_CreateInstance(NS_AUTH_MODULE_CONTRACTID_PREFIX "ntlm"); // prompt user for domain, username, and password...
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
