code.delx.au - gnu-emacs-elpa/blob - packages/url-http-ntlm/url-http-ntlm.el

   1 ;;; url-http-ntlm.el --- NTLM authentication for the url library
   2
   3 ;; Copyright (C) 2008  Tom Schutzer-Weissmann
   4
   5 ;; Author: Tom Schutzer-Weissmann <tom@schutzer-weissmann.net>
   6 ;; Keywords: comm, data, processes, hypermedia
   7
   8 ;; This program is free software; you can redistribute it and/or modify
   9 ;; it under the terms of the GNU General Public License as published by
  10 ;; the Free Software Foundation, either version 3 of the License, or
  11 ;; (at your option) any later version.
  12
  13 ;; This program is distributed in the hope that it will be useful,
  14 ;; but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 ;; GNU General Public License for more details.
  17
  18 ;; You should have received a copy of the GNU General Public License
  19 ;; along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 ;;; Commentary:
  22 ;;
  23 ;; This package provides a NTLM handler for the URL package.
  24 ;; It supports one username and password per server.
  25 ;;
  26 ;; Installation:
  27 ;;
  28 ;; Add the directory containing this file to the load path and then load the url-http-ntlm
  29 ;; package. One way would be to add something like the lines below to your .emacs file:
  30 ;;
  31 ;; (add-to-list 'load-path ".emacs.d/url-http-ntlm")
  32 ;; (require 'url-http-ntlm)
  33 ;;
  34 ;; Acknowledgements:
  35 ;;
  36 ;; Taro Kawagishi <tarok@transpulse.org> wrote ntlm.el and md4.el, which are parts of FLIM
  37 ;; (Faithful Library about Internet Message).
  38 ;;
  39 ;; http://stuff.mit.edu/afs/sipb/contrib/emacs/packages/flim-1.14.7/ntlm.el
  40 ;; http://stuff.mit.edu/afs/sipb/contrib/emacs/packages/flim-1.14.7/md4.el
  41
  42 ;;; Code:
  43 (require 'url-auth)
  44 (require 'url-http)
  45 (require 'mail-parse)
  46 (require 'cl)
  47 (require 'ntlm)
  48
  49 (defvar url-http-ntlm-auth-storage nil
  50   "Authentication storage. An alist that maps a server name
  51 to a pair of \(<username> <ntlm hashes>\).
  52
  53 The hashes are built using `ntlm-get-password-hashes'.
  54 The username can contain the domain name, in the form \"user@domain\".
  55
  56 Note that for any server, only one user and password is ever stored.")
  57
  58 (defun url-ntlm-auth (url &optional prompt overwrite realm args)
  59   "Get the contents of the Authorization header for a HTTP
  60   response using NTLM authentication, to access URL.  Because
  61   NTLM is a two-step process, this function expects to be called
  62   twice, first to generate the NTLM type 1 message (request),
  63   then to respond to the server's type 2 message (challenge) with
  64   a suitable response.
  65
  66   PROMPT, OVERWRITE, and REALM are ignored.
  67
  68   ARGS is expected to contain the WWW-Authentication header from
  69   the server's last response. These are used by
  70   `url-http-get-stage' to determine what stage we are at."
  71   (url-ntlm-ensure-keepalive)
  72   (let ((stage (url-ntlm-get-stage args)))
  73     (case stage
  74       ;;
  75       ;; NTLM Type 1 message: the request
  76       (:request
  77        (destructuring-bind (&optional server user hash)
  78            (url-http-ntlm-authorisation url)
  79          (when server
  80            (url-http-ntlm-string (ntlm-build-auth-request user server)))))
  81       ;;
  82       ;; NTLM Type 3 message: the response
  83       (:response
  84        (let ((challenge (url-http-ntlm-get-challenge)))
  85          (destructuring-bind (server user hash)
  86              (url-http-ntlm-authorisation url)
  87            (url-http-ntlm-string (ntlm-build-auth-response challenge
  88                                                            user
  89                                                            hash)))))
  90       (:error
  91        (url-http-ntlm-authorisation url :clear)))))
  92
  93
  94 (defun url-ntlm-ensure-keepalive ()
  95   (assert url-http-attempt-keepalives
  96           nil
  97           "NTLM authentication won't work unless `url-http-attempt-keepalives' is set!"))
  98
  99
 100 (defun url-ntlm-clean-headers ()
 101   (setq url-http-extra-headers
 102         (url-http-ntlm-rmssoc "Authorization" url-http-extra-headers)))
 103
 104
 105 (defvar url-ntlm-last-args nil
 106   "Stores the last ARGS argument to `url-ntlm-get-stage' and the return value. This is
 107   used to detect multiple calls.")
 108 (make-variable-buffer-local 'url-ntlm-last-args)
 109
 110
 111 (defun url-ntlm-get-stage (args)
 112   "Determine what stage of the NTLM handshake we are at.
 113
 114 PROMPT and ARGS come from `url-ntlm-auth''s caller, `url-get-authentication'. Their
 115 meaning depends on the current implementation - this function is well and truly coupled...
 116
 117 url-get-authentication' calls `url-ntlm-auth' once when checking what authentication
 118 schemes are supported (PROMPT and ARGS are nil), and then twice for every stage of the
 119 handshake: the first time PROMPT is nil, the second, t; ARGS contains the server
 120 response's \"WWW-Authenticate\" header, munged by `url-parse-args'."
 121   (let* ((response-rxp     "^NTLM TlRMTVNTUAADAAA")
 122          (challenge-rxp    "^TLRMTVNTUAACAAA")
 123          (auth-header      (assoc "Authorization" url-http-extra-headers))
 124          (case-fold-search t)
 125          stage)
 126     (if (eq args (car url-ntlm-last-args))
 127         ;; multiple calls, return the same argument we returned last time
 128         (cdr url-ntlm-last-args)
 129         ;;
 130         (let ((stage
 131                (cond ((and auth-header (string-match response-rxp (cdr auth-header)))
 132                       :error)
 133                      ((and (= (length args) 2)
 134                            (destructuring-bind (challenge ntlm) args
 135                              (and (string-equal "ntlm" (car ntlm))
 136                                   (string-match challenge-rxp (car challenge)))))
 137                       :response)
 138                      (t
 139                       :request))))
 140           (url-ntlm-clean-headers)
 141           (setq url-ntlm-last-args (cons args stage))
 142           stage))))
 143
 144
 145 (defun url-http-ntlm-authorisation (url &optional clear)
 146   "Get or clear NTLM authentication details for URL. If CLEAR is
 147   non-nil, clear any saved credentials for server. Otherwise,
 148   return the credentials, prompting the user if necessary.
 149
 150 If URL contains a username and a password, they are used and
 151 stored credentials are not affected.
 152
 153 Note that for any server, only one user and password is ever
 154 stored."
 155   (let* ((href   (if (stringp url)
 156                      (url-generic-parse-url url)
 157                      url))
 158          (server (url-host href))
 159          (user   (url-user href))
 160          (pass   (url-password href))
 161          (stored (assoc server url-http-ntlm-auth-storage))
 162          (both   (and user pass)))
 163     (if clear
 164         ;; clear
 165         (unless both
 166           (setq url-http-ntlm-auth-storage
 167                 (url-http-ntlm-rmssoc server url-http-ntlm-auth-storage))
 168           nil)
 169         ;; get
 170         (if (or both
 171                 (and stored user (not (equal user (second stored))))
 172                 (not stored))
 173             (let* ((user*  (if both
 174                                user
 175                                (read-string (url-auth-user-prompt url realm)
 176                                             (or user (user-real-login-name)))))
 177                    (pass*  (if both
 178                                pass
 179                                (read-passwd "Password: ")))
 180                    (entry `(,server . (,user* ,(ntlm-get-password-hashes pass*)))))
 181               (unless both
 182                 (setq url-http-ntlm-auth-storage
 183                       (cons entry
 184                             (url-http-ntlm-rmssoc server url-http-ntlm-auth-storage))))
 185               entry)
 186             ;;
 187             stored))))
 188
 189
 190 (defun url-http-ntlm-get-challenge ()
 191   "Return the NTLM Type-2 message in the WWW-Authenticate header,
 192 if it is there."
 193   (save-restriction
 194     (mail-narrow-to-head)
 195     (let ((www-authenticate (mail-fetch-field "www-authenticate")))
 196       (when (string-match "NTLM\\s-+\\(\\S-+\\)"
 197                           www-authenticate)
 198         (base64-decode-string (match-string 1 www-authenticate))))))
 199
 200
 201 (defun url-http-ntlm-rmssoc (key alist)
 202   (remove* key alist :key 'car :test 'equal))
 203
 204
 205 (defun url-http-ntlm-string (data)
 206   (concat "NTLM " (base64-encode-string data :nobreak)))
 207
 208
 209 (url-register-auth-scheme "ntlm" nil 8)
 210
 211
 212 (provide 'url-http-ntlm)
 213 ;;; url-http-ntlm.el ends here