hc-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ol...@apache.org
Subject svn commit: r1500628 - in /httpcomponents/httpclient/branches/4.2.x/httpclient/src: main/java/org/apache/http/impl/auth/NTLMScheme.java test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java
Date Mon, 08 Jul 2013 09:28:18 GMT
Author: olegk
Date: Mon Jul  8 09:28:18 2013
New Revision: 1500628

URL: http://svn.apache.org/r1500628
Log:
Follow up to HTTPCLIENT-1383: fixes another infinite loop in case of an out of sequence NTLM
response
Contributed by Ricardo Pereira <thc202 at gmail.com>

Modified:
    httpcomponents/httpclient/branches/4.2.x/httpclient/src/main/java/org/apache/http/impl/auth/NTLMScheme.java
    httpcomponents/httpclient/branches/4.2.x/httpclient/src/test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java

Modified: httpcomponents/httpclient/branches/4.2.x/httpclient/src/main/java/org/apache/http/impl/auth/NTLMScheme.java
URL: http://svn.apache.org/viewvc/httpcomponents/httpclient/branches/4.2.x/httpclient/src/main/java/org/apache/http/impl/auth/NTLMScheme.java?rev=1500628&r1=1500627&r2=1500628&view=diff
==============================================================================
--- httpcomponents/httpclient/branches/4.2.x/httpclient/src/main/java/org/apache/http/impl/auth/NTLMScheme.java
(original)
+++ httpcomponents/httpclient/branches/4.2.x/httpclient/src/main/java/org/apache/http/impl/auth/NTLMScheme.java
Mon Jul  8 09:28:18 2013
@@ -105,6 +105,7 @@ public class NTLMScheme extends AuthSche
         } else {
             if (this.state.compareTo(State.MSG_TYPE1_GENERATED) < 0) {
                 this.state = State.FAILED;
+                throw new MalformedChallengeException("Out of sequence NTLM response message");
             } else if (this.state == State.MSG_TYPE1_GENERATED) {
                 this.state = State.MSG_TYPE2_RECEVIED;
             }
@@ -123,7 +124,9 @@ public class NTLMScheme extends AuthSche
               + credentials.getClass().getName());
         }
         String response = null;
-        if (this.state == State.CHALLENGE_RECEIVED || this.state == State.FAILED) {
+        if (this.state == State.FAILED) {
+            throw new AuthenticationException("NTLM authentication failed");
+        } else if (this.state == State.CHALLENGE_RECEIVED) {
             response = this.engine.generateType1Msg(
                     ntcredentials.getDomain(),
                     ntcredentials.getWorkstation());

Modified: httpcomponents/httpclient/branches/4.2.x/httpclient/src/test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java
URL: http://svn.apache.org/viewvc/httpcomponents/httpclient/branches/4.2.x/httpclient/src/test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java?rev=1500628&r1=1500627&r2=1500628&view=diff
==============================================================================
--- httpcomponents/httpclient/branches/4.2.x/httpclient/src/test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java
(original)
+++ httpcomponents/httpclient/branches/4.2.x/httpclient/src/test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java
Mon Jul  8 09:28:18 2013
@@ -171,6 +171,12 @@ public class TestClientAuthenticationFak
 
     static class NtlmType2MessageOnlyResponseHandler implements HttpRequestHandler {
 
+        private final String authenticateHeaderValue;
+
+        public NtlmType2MessageOnlyResponseHandler(final String type2Message) {
+            this.authenticateHeaderValue = "NTLM " + type2Message;
+        }
+
         public void handle(
                 final HttpRequest request,
                 final HttpResponse response,
@@ -180,15 +186,39 @@ public class TestClientAuthenticationFak
                     HttpStatus.SC_UNAUTHORIZED,
                     "Authentication Required"));
             response.setHeader("Connection", "Keep-Alive");
-            response.setHeader(HttpHeaders.WWW_AUTHENTICATE, "NTLM TlRMTVNTUAACAA" +
-                    "AADAAMADgAAAAzggLiASNFZ4mrze8AAAAAAAAAAAAAAAAAAAAABgBwFwAAAA9T" +
-                    "AGUAcgB2AGUAcgA=");
+            response.setHeader(HttpHeaders.WWW_AUTHENTICATE, authenticateHeaderValue);
         }
     }
 
     @Test
     public void testNTLMType2MessageOnlyAuthenticationFailure() throws Exception {
-        this.localServer.register("*", new NtlmType2MessageOnlyResponseHandler());
+        this.localServer.register("*", new NtlmType2MessageOnlyResponseHandler("TlRMTVNTUAACAA"
+
+                "AADAAMADgAAAAzggLiASNFZ4mrze8AAAAAAAAAAAAAAAAAAAAABgBwFwAAAA9T" +
+                "AGUAcgB2AGUAcgA="));
+        this.localServer.start();
+
+        BasicCredentialsProvider credsProvider = new BasicCredentialsProvider();
+        credsProvider.setCredentials(AuthScope.ANY,
+                new NTCredentials("test", "test", null, null));
+
+        this.httpclient.setCredentialsProvider(credsProvider);
+
+        HttpContext context = new BasicHttpContext();
+
+        HttpHost targethost = getServerHttp();
+        HttpGet httpget = new HttpGet("/");
+
+        HttpResponse response = this.httpclient.execute(targethost, httpget, context);
+        EntityUtils.consume(response.getEntity());
+        Assert.assertEquals(HttpStatus.SC_UNAUTHORIZED,
+                response.getStatusLine().getStatusCode());
+    }
+
+    @Test
+    public void testNTLMType2NonUnicodeMessageOnlyAuthenticationFailure() throws Exception
{
+        this.localServer.register("*", new NtlmType2MessageOnlyResponseHandler("TlRMTVNTUAACAA"
+
+                "AABgAGADgAAAAyggLiASNFZ4mrze8AAAAAAAAAAAAAAAAAAAAABgBwFwAAAA9T" +
+                "ZXJ2ZXI="));
         this.localServer.start();
 
         BasicCredentialsProvider credsProvider = new BasicCredentialsProvider();



Mime
View raw message