diff options
Diffstat (limited to 'extensions/auth/nsHttpNegotiateAuth.cpp')
| -rw-r--r-- | extensions/auth/nsHttpNegotiateAuth.cpp | 576 |
1 files changed, 576 insertions, 0 deletions
diff --git a/extensions/auth/nsHttpNegotiateAuth.cpp b/extensions/auth/nsHttpNegotiateAuth.cpp new file mode 100644 index 0000000000..00d0891631 --- /dev/null +++ b/extensions/auth/nsHttpNegotiateAuth.cpp @@ -0,0 +1,576 @@ +/* vim:set ts=4 sw=2 sts=2 et cindent: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +// +// HTTP Negotiate Authentication Support Module +// +// Described by IETF Internet draft: draft-brezak-kerberos-http-00.txt +// (formerly draft-brezak-spnego-http-04.txt) +// +// Also described here: +// http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsecure/html/http-sso-1.asp +// + +#include <string.h> +#include <stdlib.h> + +#include "nsAuth.h" +#include "nsHttpNegotiateAuth.h" + +#include "nsIHttpAuthenticableChannel.h" +#include "nsIAuthModule.h" +#include "nsIPrefBranch.h" +#include "nsIPrefService.h" +#include "nsIProxyInfo.h" +#include "nsIURI.h" +#include "nsCOMPtr.h" +#include "nsString.h" +#include "nsNetCID.h" +#include "nsProxyRelease.h" +#include "plbase64.h" +#include "plstr.h" +#include "mozilla/Base64.h" +#include "mozilla/Logging.h" +#include "mozilla/Tokenizer.h" +#include "mozilla/UniquePtr.h" +#include "mozilla/Unused.h" +#include "prmem.h" +#include "prnetdb.h" +#include "mozilla/Likely.h" +#include "mozilla/Sprintf.h" +#include "nsIChannel.h" +#include "nsNetUtil.h" +#include "nsThreadUtils.h" +#include "nsIHttpAuthenticatorCallback.h" +#include "mozilla/Mutex.h" +#include "nsICancelable.h" +#include "nsUnicharUtils.h" +#include "mozilla/net/HttpAuthUtils.h" +#include "mozilla/ClearOnShutdown.h" + +using mozilla::Base64Decode; + +//----------------------------------------------------------------------------- + +static const char kNegotiate[] = "Negotiate"; +static const char kNegotiateAuthTrustedURIs[] = + "network.negotiate-auth.trusted-uris"; +static const char kNegotiateAuthDelegationURIs[] = + "network.negotiate-auth.delegation-uris"; +static const char kNegotiateAuthAllowProxies[] = + "network.negotiate-auth.allow-proxies"; +static const char kNegotiateAuthAllowNonFqdn[] = + "network.negotiate-auth.allow-non-fqdn"; +static const char kNegotiateAuthSSPI[] = "network.auth.use-sspi"; +static const char kSSOinPBmode[] = "network.auth.private-browsing-sso"; + +mozilla::StaticRefPtr<nsHttpNegotiateAuth> nsHttpNegotiateAuth::gSingleton; + +#define kNegotiateLen (sizeof(kNegotiate) - 1) +#define DEFAULT_THREAD_TIMEOUT_MS 30000 + +//----------------------------------------------------------------------------- + +// Return false when the channel comes from a Private browsing window. +static bool TestNotInPBMode(nsIHttpAuthenticableChannel* authChannel, + bool proxyAuth) { + // Proxy should go all the time, it's not considered a privacy leak + // to send default credentials to a proxy. + if (proxyAuth) { + return true; + } + + nsCOMPtr<nsIChannel> bareChannel = do_QueryInterface(authChannel); + MOZ_ASSERT(bareChannel); + + if (!NS_UsePrivateBrowsing(bareChannel)) { + return true; + } + + nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID); + if (prefs) { + bool ssoInPb; + if (NS_SUCCEEDED(prefs->GetBoolPref(kSSOinPBmode, &ssoInPb)) && ssoInPb) { + return true; + } + + // When the "Never remember history" option is set, all channels are + // set PB mode flag, but here we want to make an exception, users + // want their credentials go out. + bool dontRememberHistory; + if (NS_SUCCEEDED(prefs->GetBoolPref("browser.privatebrowsing.autostart", + &dontRememberHistory)) && + dontRememberHistory) { + return true; + } + } + + return false; +} + +already_AddRefed<nsIHttpAuthenticator> nsHttpNegotiateAuth::GetOrCreate() { + nsCOMPtr<nsIHttpAuthenticator> authenticator; + if (gSingleton) { + authenticator = gSingleton; + } else { + gSingleton = new nsHttpNegotiateAuth(); + mozilla::ClearOnShutdown(&gSingleton); + authenticator = gSingleton; + } + + return authenticator.forget(); +} + +NS_IMETHODIMP +nsHttpNegotiateAuth::GetAuthFlags(uint32_t* flags) { + // + // Negotiate Auth creds should not be reused across multiple requests. + // Only perform the negotiation when it is explicitly requested by the + // server. Thus, do *NOT* use the "REUSABLE_CREDENTIALS" flag here. + // + // CONNECTION_BASED is specified instead of REQUEST_BASED since we need + // to complete a sequence of transactions with the server over the same + // connection. + // + *flags = CONNECTION_BASED | IDENTITY_IGNORED; + return NS_OK; +} + +// +// Always set *identityInvalid == FALSE here. This +// will prevent the browser from popping up the authentication +// prompt window. Because GSSAPI does not have an API +// for fetching initial credentials (ex: A Kerberos TGT), +// there is no correct way to get the users credentials. +// +NS_IMETHODIMP +nsHttpNegotiateAuth::ChallengeReceived(nsIHttpAuthenticableChannel* authChannel, + const char* challenge, bool isProxyAuth, + nsISupports** sessionState, + nsISupports** continuationState, + bool* identityInvalid) { + nsIAuthModule* rawModule = (nsIAuthModule*)*continuationState; + + *identityInvalid = false; + if (rawModule) { + return NS_OK; + } + + nsresult rv; + nsCOMPtr<nsIAuthModule> module; + + nsCOMPtr<nsIURI> uri; + rv = authChannel->GetURI(getter_AddRefs(uri)); + if (NS_FAILED(rv)) return rv; + + uint32_t req_flags = nsIAuthModule::REQ_DEFAULT; + nsAutoCString service; + + if (isProxyAuth) { + if (!TestBoolPref(kNegotiateAuthAllowProxies)) { + LOG(("nsHttpNegotiateAuth::ChallengeReceived proxy auth blocked\n")); + return NS_ERROR_ABORT; + } + + req_flags |= nsIAuthModule::REQ_PROXY_AUTH; + nsCOMPtr<nsIProxyInfo> proxyInfo; + authChannel->GetProxyInfo(getter_AddRefs(proxyInfo)); + NS_ENSURE_STATE(proxyInfo); + + proxyInfo->GetHost(service); + } else { + bool allowed = + TestNotInPBMode(authChannel, isProxyAuth) && + (TestNonFqdn(uri) || mozilla::net::auth::URIMatchesPrefPattern( + uri, kNegotiateAuthTrustedURIs)); + if (!allowed) { + LOG(("nsHttpNegotiateAuth::ChallengeReceived URI blocked\n")); + return NS_ERROR_ABORT; + } + + bool delegation = mozilla::net::auth::URIMatchesPrefPattern( + uri, kNegotiateAuthDelegationURIs); + if (delegation) { + LOG((" using REQ_DELEGATE\n")); + req_flags |= nsIAuthModule::REQ_DELEGATE; + } + + rv = uri->GetAsciiHost(service); + if (NS_FAILED(rv)) return rv; + } + + LOG((" service = %s\n", service.get())); + + // + // The correct service name for IIS servers is "HTTP/f.q.d.n", so + // construct the proper service name for passing to "gss_import_name". + // + // TODO: Possibly make this a configurable service name for use + // with non-standard servers that use stuff like "khttp/f.q.d.n" + // instead. + // + service.InsertLiteral("HTTP@", 0); + + const char* authType; + if (TestBoolPref(kNegotiateAuthSSPI)) { + LOG((" using negotiate-sspi\n")); + authType = "negotiate-sspi"; + } else { + LOG((" using negotiate-gss\n")); + authType = "negotiate-gss"; + } + + MOZ_ALWAYS_TRUE(module = nsIAuthModule::CreateInstance(authType)); + + rv = module->Init(service.get(), req_flags, nullptr, nullptr, nullptr); + + if (NS_FAILED(rv)) { + return rv; + } + + module.forget(continuationState); + return NS_OK; +} + +NS_IMPL_ISUPPORTS(nsHttpNegotiateAuth, nsIHttpAuthenticator) + +namespace { + +// +// GetNextTokenCompleteEvent +// +// This event is fired on main thread when async call of +// nsHttpNegotiateAuth::GenerateCredentials is finished. During the Run() +// method the nsIHttpAuthenticatorCallback::OnCredsAvailable is called with +// obtained credentials, flags and NS_OK when successful, otherwise +// NS_ERROR_FAILURE is returned as a result of failed operation. +// +class GetNextTokenCompleteEvent final : public nsIRunnable, + public nsICancelable { + virtual ~GetNextTokenCompleteEvent() { + if (mCreds) { + free(mCreds); + } + }; + + public: + NS_DECL_THREADSAFE_ISUPPORTS + + explicit GetNextTokenCompleteEvent(nsIHttpAuthenticatorCallback* aCallback) + : mCallback(aCallback), mCreds(nullptr), mCancelled(false) {} + + NS_IMETHODIMP DispatchSuccess( + char* aCreds, uint32_t aFlags, + already_AddRefed<nsISupports> aSessionState, + already_AddRefed<nsISupports> aContinuationState) { + // Called from worker thread + MOZ_ASSERT(!NS_IsMainThread()); + + mCreds = aCreds; + mFlags = aFlags; + mResult = NS_OK; + mSessionState = aSessionState; + mContinuationState = aContinuationState; + return NS_DispatchToMainThread(this, NS_DISPATCH_NORMAL); + } + + NS_IMETHODIMP DispatchError( + already_AddRefed<nsISupports> aSessionState, + already_AddRefed<nsISupports> aContinuationState) { + // Called from worker thread + MOZ_ASSERT(!NS_IsMainThread()); + + mResult = NS_ERROR_FAILURE; + mSessionState = aSessionState; + mContinuationState = aContinuationState; + return NS_DispatchToMainThread(this, NS_DISPATCH_NORMAL); + } + + NS_IMETHODIMP Run() override { + // Runs on main thread + MOZ_ASSERT(NS_IsMainThread()); + + if (!mCancelled) { + nsCOMPtr<nsIHttpAuthenticatorCallback> callback; + callback.swap(mCallback); + callback->OnCredsGenerated(mCreds, mFlags, mResult, mSessionState, + mContinuationState); + } + return NS_OK; + } + + NS_IMETHODIMP Cancel(nsresult aReason) override { + // Supposed to be called from main thread + MOZ_ASSERT(NS_IsMainThread()); + + mCancelled = true; + nsCOMPtr<nsIHttpAuthenticatorCallback> callback = std::move(mCallback); + if (callback) { + callback->OnCredsGenerated(mCreds, mFlags, aReason, nullptr, nullptr); + } + return NS_OK; + } + + private: + nsCOMPtr<nsIHttpAuthenticatorCallback> mCallback; + char* mCreds; // This class owns it, freed in destructor + uint32_t mFlags; + nsresult mResult; + bool mCancelled; + nsCOMPtr<nsISupports> mSessionState; + nsCOMPtr<nsISupports> mContinuationState; +}; + +NS_IMPL_ISUPPORTS(GetNextTokenCompleteEvent, nsIRunnable, nsICancelable) + +// +// GetNextTokenRunnable +// +// This runnable is created by GenerateCredentialsAsync and it runs +// on the background thread pool and calls GenerateCredentials. +// +class GetNextTokenRunnable final : public mozilla::Runnable { + ~GetNextTokenRunnable() override = default; + + public: + GetNextTokenRunnable( + nsMainThreadPtrHandle<nsIHttpAuthenticableChannel>& authChannel, + const char* challenge, bool isProxyAuth, const char16_t* domain, + const char16_t* username, const char16_t* password, + nsISupports* sessionState, nsISupports* continuationState, + GetNextTokenCompleteEvent* aCompleteEvent) + : mozilla::Runnable("GetNextTokenRunnable"), + mAuthChannel(authChannel), + mChallenge(challenge), + mIsProxyAuth(isProxyAuth), + mDomain(domain), + mUsername(username), + mPassword(password), + mSessionState(sessionState), + mContinuationState(continuationState), + mCompleteEvent(aCompleteEvent) {} + + NS_IMETHODIMP Run() override { + // Runs on worker thread + MOZ_ASSERT(!NS_IsMainThread()); + + char* creds; + uint32_t flags; + nsresult rv = ObtainCredentialsAndFlags(&creds, &flags); + + // Passing session and continuation state this way to not touch + // referencing of the object that may not be thread safe. + // Not having a thread safe referencing doesn't mean the object + // cannot be used on multiple threads (one example is nsAuthSSPI.) + // This ensures state objects will be destroyed on the main thread + // when not changed by GenerateCredentials. + if (NS_FAILED(rv)) { + return mCompleteEvent->DispatchError(mSessionState.forget(), + mContinuationState.forget()); + } + + return mCompleteEvent->DispatchSuccess(creds, flags, mSessionState.forget(), + mContinuationState.forget()); + } + + NS_IMETHODIMP ObtainCredentialsAndFlags(char** aCreds, uint32_t* aFlags) { + nsresult rv; + + // Use negotiate service to call GenerateCredentials outside of main thread + nsCOMPtr<nsIHttpAuthenticator> authenticator = new nsHttpNegotiateAuth(); + + nsISupports* sessionState = mSessionState; + nsISupports* continuationState = mContinuationState; + // The continuationState is for the sake of completeness propagated + // to the caller (despite it is not changed in any GenerateCredentials + // implementation). + // + // The only implementation that use sessionState is the + // nsHttpDigestAuth::GenerateCredentials. Since there's no reason + // to implement nsHttpDigestAuth::GenerateCredentialsAsync + // because digest auth does not block the main thread, we won't + // propagate changes to sessionState to the caller because of + // the change is too complicated on the caller side. + // + // Should any of the session or continuation states change inside + // this method, they must be threadsafe. + rv = authenticator->GenerateCredentials( + mAuthChannel, mChallenge.get(), mIsProxyAuth, mDomain.get(), + mUsername.get(), mPassword.get(), &sessionState, &continuationState, + aFlags, aCreds); + if (mSessionState != sessionState) { + mSessionState = sessionState; + } + if (mContinuationState != continuationState) { + mContinuationState = continuationState; + } + return rv; + } + + private: + nsMainThreadPtrHandle<nsIHttpAuthenticableChannel> mAuthChannel; + nsCString mChallenge; + bool mIsProxyAuth; + nsString mDomain; + nsString mUsername; + nsString mPassword; + nsCOMPtr<nsISupports> mSessionState; + nsCOMPtr<nsISupports> mContinuationState; + RefPtr<GetNextTokenCompleteEvent> mCompleteEvent; +}; + +} // anonymous namespace + +NS_IMETHODIMP +nsHttpNegotiateAuth::GenerateCredentialsAsync( + nsIHttpAuthenticableChannel* authChannel, + nsIHttpAuthenticatorCallback* aCallback, const char* challenge, + bool isProxyAuth, const char16_t* domain, const char16_t* username, + const char16_t* password, nsISupports* sessionState, + nsISupports* continuationState, nsICancelable** aCancelable) { + NS_ENSURE_ARG(aCallback); + NS_ENSURE_ARG_POINTER(aCancelable); + + RefPtr<GetNextTokenCompleteEvent> cancelEvent = + new GetNextTokenCompleteEvent(aCallback); + + nsMainThreadPtrHandle<nsIHttpAuthenticableChannel> handle( + new nsMainThreadPtrHolder<nsIHttpAuthenticableChannel>( + "nsIHttpAuthenticableChannel", authChannel, false)); + nsCOMPtr<nsIRunnable> getNextTokenRunnable = new GetNextTokenRunnable( + handle, challenge, isProxyAuth, domain, username, password, sessionState, + continuationState, cancelEvent); + + nsresult rv = NS_DispatchBackgroundTask( + getNextTokenRunnable, nsIEventTarget::DISPATCH_EVENT_MAY_BLOCK); + NS_ENSURE_SUCCESS(rv, rv); + + cancelEvent.forget(aCancelable); + return NS_OK; +} + +// +// GenerateCredentials +// +// This routine is responsible for creating the correct authentication +// blob to pass to the server that requested "Negotiate" authentication. +// +NS_IMETHODIMP +nsHttpNegotiateAuth::GenerateCredentials( + nsIHttpAuthenticableChannel* authChannel, const char* challenge, + bool isProxyAuth, const char16_t* domain, const char16_t* username, + const char16_t* password, nsISupports** sessionState, + nsISupports** continuationState, uint32_t* flags, char** creds) { + // ChallengeReceived must have been called previously. + nsIAuthModule* module = (nsIAuthModule*)*continuationState; + NS_ENSURE_TRUE(module, NS_ERROR_NOT_INITIALIZED); + + *flags = USING_INTERNAL_IDENTITY; + + LOG(("nsHttpNegotiateAuth::GenerateCredentials() [challenge=%s]\n", + challenge)); + + NS_ASSERTION(creds, "null param"); + +#ifdef DEBUG + bool isGssapiAuth = !PL_strncasecmp(challenge, kNegotiate, kNegotiateLen); + NS_ASSERTION(isGssapiAuth, "Unexpected challenge"); +#endif + + // + // If the "Negotiate:" header had some data associated with it, + // that data should be used as the input to this call. This may + // be a continuation of an earlier call because GSSAPI authentication + // often takes multiple round-trips to complete depending on the + // context flags given. We want to use MUTUAL_AUTHENTICATION which + // generally *does* require multiple round-trips. Don't assume + // auth can be completed in just 1 call. + // + unsigned int len = strlen(challenge); + + void *inToken = nullptr, *outToken; + uint32_t inTokenLen, outTokenLen; + + if (len > kNegotiateLen) { + challenge += kNegotiateLen; + while (*challenge == ' ') challenge++; + len = strlen(challenge); + + if (!len) return NS_ERROR_UNEXPECTED; + + // strip off any padding (see bug 230351) + while (len && challenge[len - 1] == '=') len--; + + // + // Decode the response that followed the "Negotiate" token + // + nsresult rv = Base64Decode(challenge, len, (char**)&inToken, &inTokenLen); + + if (NS_FAILED(rv)) { + free(inToken); + return rv; + } + } else { + // + // Initializing, don't use an input token. + // + inTokenLen = 0; + } + + nsresult rv = + module->GetNextToken(inToken, inTokenLen, &outToken, &outTokenLen); + + free(inToken); + + if (NS_FAILED(rv)) return rv; + + if (outTokenLen == 0) { + LOG((" No output token to send, exiting")); + return NS_ERROR_FAILURE; + } + + // + // base64 encode the output token. + // + char* encoded_token = PL_Base64Encode((char*)outToken, outTokenLen, nullptr); + + free(outToken); + + if (!encoded_token) return NS_ERROR_OUT_OF_MEMORY; + + LOG((" Sending a token of length %d\n", outTokenLen)); + + // allocate a buffer sizeof("Negotiate" + " " + b64output_token + "\0") + const int bufsize = kNegotiateLen + 1 + strlen(encoded_token) + 1; + *creds = (char*)moz_xmalloc(bufsize); + snprintf(*creds, bufsize, "%s %s", kNegotiate, encoded_token); + + PR_Free(encoded_token); // PL_Base64Encode() uses PR_Malloc(). + return rv; +} + +bool nsHttpNegotiateAuth::TestBoolPref(const char* pref) { + nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID); + if (!prefs) return false; + + bool val; + nsresult rv = prefs->GetBoolPref(pref, &val); + if (NS_FAILED(rv)) return false; + + return val; +} + +bool nsHttpNegotiateAuth::TestNonFqdn(nsIURI* uri) { + nsAutoCString host; + PRNetAddr addr; + + if (!TestBoolPref(kNegotiateAuthAllowNonFqdn)) return false; + + if (NS_FAILED(uri->GetAsciiHost(host))) return false; + + // return true if host does not contain a dot and is not an ip address + return !host.IsEmpty() && !host.Contains('.') && + PR_StringToNetAddr(host.BeginReading(), &addr) != PR_SUCCESS; +} |