code.delx.au - gnu-emacs-elpa/blob - packages/url-http-ntlm/url-http-ntlm.el

   1 ;;; url-http-ntlm.el --- NTLM authentication for the url library
   2
   3 ;; Copyright (C) 2008, 2015 Free Software Foundation, Inc.
   4
   5 ;; Author: Tom Schutzer-Weissmann <tom.weissmann@gmail.com>
   6 ;; Maintainer: Thomas Fitzsimmons <fitzsim@fitzsim.org>
   7 ;; Keywords: comm, data, processes, hypermedia
   8 ;; Homepage: https://code.google.com/p/url-http-ntlm/
   9 ;; Package-Requires: ((ntlm "2.0.0"))
  10
  11 ;; This program is free software; you can redistribute it and/or modify
  12 ;; it under the terms of the GNU General Public License as published by
  13 ;; the Free Software Foundation, either version 3 of the License, or
  14 ;; (at your option) any later version.
  15
  16 ;; This program is distributed in the hope that it will be useful,
  17 ;; but WITHOUT ANY WARRANTY; without even the implied warranty of
  18 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 ;; GNU General Public License for more details.
  20
  21 ;; You should have received a copy of the GNU General Public License
  22 ;; along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23
  24 ;;; Commentary:
  25 ;;
  26 ;; This package provides a NTLM handler for the URL package.
  27 ;;
  28 ;; Installation:
  29 ;;
  30 ;; M-x package-install RET url-http-ntlm RET
  31 ;;
  32 ;; Acknowledgements:
  33 ;;
  34 ;; Taro Kawagishi <tarok@transpulse.org> wrote ntlm.el and md4.el,
  35 ;; which are parts of FLIM (Faithful Library about Internet Message).
  36 ;;
  37 ;; http://stuff.mit.edu/afs/sipb/contrib/emacs/packages/flim-1.14.7/ntlm.el
  38 ;; http://stuff.mit.edu/afs/sipb/contrib/emacs/packages/flim-1.14.7/md4.el
  39
  40 ;;; Code:
  41 (require 'url-auth)
  42 (require 'url-http)
  43 (require 'mail-parse)
  44 (require 'cl-lib)
  45 (require 'ntlm)
  46
  47 ;; Remove authorization after redirect.
  48 (when (and (boundp 'emacs-major-version)
  49            (< emacs-major-version 25))
  50   (require (intern (format "url-http-ntlm-parse-headers-%d.%d"
  51                            emacs-major-version
  52                            emacs-minor-version))))
  53
  54 \f
  55 ;;; Private variables.
  56 (defvar url-http-ntlm--auth-storage nil
  57   "Authentication storage.
  58 An alist that maps a server name to a pair of \(<username> <ntlm
  59 hashes>\).
  60
  61 The hashes are built using `ntlm-get-password-hashes'.")
  62
  63 (defvar url-http-ntlm--last-args nil
  64   "The last `url-http-ntlm--get-stage' arguments and result.
  65 This is used to detect multiple calls.")
  66 (make-variable-buffer-local 'url-http-ntlm--last-args)
  67
  68 (defvar url-http-ntlm--loop-timer-counter nil
  69   "A hash table used to detect NTLM negotiation errors.
  70 Keys are urls, entries are (START-TIME . COUNTER).")
  71
  72 (defvar url-http-ntlm--default-users nil
  73   "An alist that stores one default username per server.")
  74
  75 \f
  76 ;;; Private functions.
  77 (defun url-http-ntlm--detect-loop (url)
  78   "Detect potential infinite loop when NTLM fails on URL."
  79   (when (not url-http-ntlm--loop-timer-counter)
  80     (setq url-http-ntlm--loop-timer-counter (make-hash-table :test 'equal)))
  81   (let* ((url-string (url-recreate-url url))
  82          (last-entry (gethash url-string url-http-ntlm--loop-timer-counter))
  83          (start-time (car last-entry))
  84          (counter (cdr last-entry)))
  85     (if last-entry
  86         (progn
  87           (if (< (-  (float-time) start-time) 10.0)
  88               (if (< counter 20)
  89                   ;; Still within time window, so increment count.
  90                   (puthash url-string (cons start-time (1+ counter))
  91                            url-http-ntlm--loop-timer-counter)
  92                 ;; Error detected, so remove entry and clear.
  93                 (url-http-ntlm--authorization url-string :clear)
  94                 (remhash url-string url-http-ntlm--loop-timer-counter)
  95                 (error
  96                  (format (concat "Access rate to %s is too high,"
  97                                  " indicating an NTLM failure;"
  98                                  " to debug, re-run with url-debug set to 1")
  99                          url-string)))
 100             ;; Timeout expired, so reset counter.
 101             (puthash url-string (cons (float-time) 0)
 102                      url-http-ntlm--loop-timer-counter)))
 103       ;; New access, so initialize counter to 0.
 104       (puthash url-string (cons (float-time) 0)
 105                url-http-ntlm--loop-timer-counter))))
 106
 107 (defun url-http-ntlm--ensure-user (url)
 108   "Return URL with its user slot set.
 109 If URL's user slot is nil, set it to the last user that made a
 110 request to the host in URL's server slot."
 111   (let ((new-url url))
 112     (if (url-user new-url)
 113         new-url
 114       (setf (url-user new-url)
 115             (cdr (assoc (url-host new-url) url-http-ntlm--default-users)))
 116       new-url)))
 117
 118 (defun url-http-ntlm--ensure-keepalive ()
 119   "Report an error if `url-http-attempt-keepalives' is not set."
 120   (cl-assert url-http-attempt-keepalives
 121              nil
 122              (concat "NTLM authentication won't work unless"
 123                      " `url-http-attempt-keepalives' is set!")))
 124
 125 (defun url-http-ntlm--clean-headers ()
 126   "Remove Authorization element from `url-http-extra-headers' alist."
 127   (cl-declare (special url-http-extra-headers))
 128   (setq url-http-extra-headers
 129         (url-http-ntlm--rmssoc "Authorization" url-http-extra-headers)))
 130
 131 (defun url-http-ntlm--get-stage (args)
 132   "Determine what stage of the NTLM handshake we are at.
 133 PROMPT and ARGS come from `url-ntlm-auth''s caller,
 134 `url-get-authentication'.  Their meaning depends on the current
 135 implementation - this function is well and truly coupled.
 136
 137 url-get-authentication' calls `url-ntlm-auth' once when checking
 138 what authentication schemes are supported (PROMPT and ARGS are
 139 nil), and then twice for every stage of the handshake: the first
 140 time PROMPT is nil, the second, t; ARGS contains the server
 141 response's \"WWW-Authenticate\" header, munged by
 142 `url-parse-args'."
 143   (cl-declare (special url-http-extra-headers))
 144   (let* ((response-rxp     "^NTLM TlRMTVNTUAADAAA")
 145          (challenge-rxp    "^TLRMTVNTUAACAAA")
 146          (auth-header      (assoc "Authorization" url-http-extra-headers))
 147          (case-fold-search t)
 148          stage)
 149     (if (eq args (car url-http-ntlm--last-args))
 150         ;; multiple calls, return the same argument we returned last time
 151         (cdr url-http-ntlm--last-args)
 152       (let ((stage
 153              (cond ((and auth-header (string-match response-rxp
 154                                                    (cdr auth-header)))
 155                     :error)
 156                    ((and (= (length args) 2)
 157                          (cl-destructuring-bind (challenge ntlm) args
 158                            (and (string-equal "ntlm" (car ntlm))
 159                                 (string-match challenge-rxp
 160                                               (car challenge)))))
 161                     :response)
 162                    (t
 163                     :request))))
 164         (url-http-ntlm--clean-headers)
 165         (setq url-http-ntlm--last-args (cons args stage))
 166         stage))))
 167
 168 (defun url-http-ntlm--authorization (url &optional clear realm)
 169   "Get or clear NTLM authentication details for URL.
 170 If CLEAR is non-nil, clear any saved credentials for server.
 171 Otherwise, return the credentials, prompting the user if
 172 necessary.  REALM appears in the prompt.
 173
 174 If URL contains a username and a password, they are used and
 175 stored credentials are not affected."
 176   (let* ((href   (if (stringp url)
 177                      (url-generic-parse-url url)
 178                    url))
 179          (type   (url-type href))
 180          (user   (url-user href))
 181          (server (url-host href))
 182          (port   (url-portspec href))
 183          (pass   (url-password href))
 184          (stored (assoc (list type user server port)
 185                         url-http-ntlm--auth-storage))
 186          (both   (and user pass)))
 187     (if clear
 188         ;; clear
 189         (unless both
 190           (setq url-http-ntlm--default-users
 191                 (url-http-ntlm--rmssoc server url-http-ntlm--default-users))
 192           (setq url-http-ntlm--auth-storage
 193                 (url-http-ntlm--rmssoc '(type user* server port)
 194                                        url-http-ntlm--auth-storage))
 195           nil)
 196       ;; get
 197       (if (or both
 198               (and stored user (not (equal user (cl-second (car stored)))))
 199               (not stored))
 200           (let* ((user* (or user
 201                             (url-do-auth-source-search server type :user)
 202                             (read-string (url-auth-user-prompt url realm)
 203                                          (or user (user-real-login-name)))))
 204                  (pass* (if both
 205                             pass
 206                           (or (url-do-auth-source-search server type :secret)
 207                               (read-passwd (format "Password [for %s]: "
 208                                                    (url-recreate-url url))))))
 209                  (key   (list type user* server port))
 210                  (entry `(,key . (,(ntlm-get-password-hashes pass*)))))
 211             (unless both
 212               (setq url-http-ntlm--default-users
 213                     (cons
 214                      `(,server . ,user*)
 215                      (url-http-ntlm--rmssoc server
 216                                             url-http-ntlm--default-users)))
 217               (setq url-http-ntlm--auth-storage
 218                     (cons entry
 219                           (url-http-ntlm--rmssoc
 220                            key
 221                            url-http-ntlm--auth-storage))))
 222             entry)
 223         stored))))
 224
 225 (defun url-http-ntlm--get-challenge ()
 226   "Return the NTLM Type-2 message in the WWW-Authenticate header.
 227 Return nil if the NTLM Type-2 message is not present."
 228   (save-restriction
 229     (mail-narrow-to-head)
 230     (let ((www-authenticate (mail-fetch-field "www-authenticate")))
 231       (when (string-match "NTLM\\s-+\\(\\S-+\\)"
 232                           www-authenticate)
 233         (base64-decode-string (match-string 1 www-authenticate))))))
 234
 235 (defun url-http-ntlm--rmssoc (key alist)
 236   "Remove all elements whose `car' match KEY from ALIST."
 237   (cl-remove key alist :key 'car :test 'equal))
 238
 239 (defun url-http-ntlm--string (data)
 240   "Return DATA encoded as an NTLM string."
 241   (concat "NTLM " (base64-encode-string data :nobreak)))
 242
 243 \f
 244 ;;; Public function called by `url-get-authentication'.
 245 ;;;###autoload
 246 (defun url-ntlm-auth (url &optional prompt overwrite realm args)
 247   "Return an NTLM HTTP authorization header.
 248 Get the contents of the Authorization header for a HTTP response
 249 using NTLM authentication, to access URL.  Because NTLM is a
 250 two-step process, this function expects to be called twice, first
 251 to generate the NTLM type 1 message (request), then to respond to
 252 the server's type 2 message (challenge) with a suitable response.
 253
 254 PROMPT, OVERWRITE, and REALM are ignored.
 255
 256 ARGS is expected to contain the WWW-Authentication header from
 257 the server's last response.  These are used by
 258 `url-http-get-stage' to determine what stage we are at."
 259   (url-http-ntlm--ensure-keepalive)
 260   (let* ((user-url (url-http-ntlm--ensure-user url))
 261          (stage (url-http-ntlm--get-stage args)))
 262     (cl-case stage
 263       ;; NTLM Type 1 message: the request
 264       (:request
 265        (url-http-ntlm--detect-loop user-url)
 266        (cl-destructuring-bind (&optional key hash)
 267            (url-http-ntlm--authorization user-url nil realm)
 268          (when (cl-third key)
 269            (url-http-ntlm--string
 270             (ntlm-build-auth-request (cl-second key) (cl-third key))))))
 271       ;; NTLM Type 3 message: the response
 272       (:response
 273        (url-http-ntlm--detect-loop user-url)
 274        (let ((challenge (url-http-ntlm--get-challenge)))
 275          (cl-destructuring-bind (key hash)
 276              (url-http-ntlm--authorization user-url nil realm)
 277            (url-http-ntlm--string
 278             (ntlm-build-auth-response challenge
 279                                       (cl-second key)
 280                                       hash)))))
 281       (:error
 282        (url-http-ntlm--authorization user-url :clear)))))
 283
 284 \f
 285 ;;; Register `url-ntlm-auth' HTTP authentication method.
 286 ;;;###autoload
 287 (url-register-auth-scheme "ntlm" nil 8)
 288
 289 (provide 'url-http-ntlm)
 290
 291 ;;; url-http-ntlm.el ends here