You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ol...@apache.org on 2013/07/08 11:28:18 UTC
svn commit: r1500628 - in
/httpcomponents/httpclient/branches/4.2.x/httpclient/src:
main/java/org/apache/http/impl/auth/NTLMScheme.java
test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java
Author: olegk
Date: Mon Jul 8 09:28:18 2013
New Revision: 1500628
URL: http://svn.apache.org/r1500628
Log:
Follow up to HTTPCLIENT-1383: fixes another infinite loop in case of an out of sequence NTLM response
Contributed by Ricardo Pereira <thc202 at gmail.com>
Modified:
httpcomponents/httpclient/branches/4.2.x/httpclient/src/main/java/org/apache/http/impl/auth/NTLMScheme.java
httpcomponents/httpclient/branches/4.2.x/httpclient/src/test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java
Modified: httpcomponents/httpclient/branches/4.2.x/httpclient/src/main/java/org/apache/http/impl/auth/NTLMScheme.java
URL: http://svn.apache.org/viewvc/httpcomponents/httpclient/branches/4.2.x/httpclient/src/main/java/org/apache/http/impl/auth/NTLMScheme.java?rev=1500628&r1=1500627&r2=1500628&view=diff
==============================================================================
--- httpcomponents/httpclient/branches/4.2.x/httpclient/src/main/java/org/apache/http/impl/auth/NTLMScheme.java (original)
+++ httpcomponents/httpclient/branches/4.2.x/httpclient/src/main/java/org/apache/http/impl/auth/NTLMScheme.java Mon Jul 8 09:28:18 2013
@@ -105,6 +105,7 @@ public class NTLMScheme extends AuthSche
} else {
if (this.state.compareTo(State.MSG_TYPE1_GENERATED) < 0) {
this.state = State.FAILED;
+ throw new MalformedChallengeException("Out of sequence NTLM response message");
} else if (this.state == State.MSG_TYPE1_GENERATED) {
this.state = State.MSG_TYPE2_RECEVIED;
}
@@ -123,7 +124,9 @@ public class NTLMScheme extends AuthSche
+ credentials.getClass().getName());
}
String response = null;
- if (this.state == State.CHALLENGE_RECEIVED || this.state == State.FAILED) {
+ if (this.state == State.FAILED) {
+ throw new AuthenticationException("NTLM authentication failed");
+ } else if (this.state == State.CHALLENGE_RECEIVED) {
response = this.engine.generateType1Msg(
ntcredentials.getDomain(),
ntcredentials.getWorkstation());
Modified: httpcomponents/httpclient/branches/4.2.x/httpclient/src/test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java
URL: http://svn.apache.org/viewvc/httpcomponents/httpclient/branches/4.2.x/httpclient/src/test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java?rev=1500628&r1=1500627&r2=1500628&view=diff
==============================================================================
--- httpcomponents/httpclient/branches/4.2.x/httpclient/src/test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java (original)
+++ httpcomponents/httpclient/branches/4.2.x/httpclient/src/test/java/org/apache/http/impl/client/TestClientAuthenticationFakeNTLM.java Mon Jul 8 09:28:18 2013
@@ -171,6 +171,12 @@ public class TestClientAuthenticationFak
static class NtlmType2MessageOnlyResponseHandler implements HttpRequestHandler {
+ private final String authenticateHeaderValue;
+
+ public NtlmType2MessageOnlyResponseHandler(final String type2Message) {
+ this.authenticateHeaderValue = "NTLM " + type2Message;
+ }
+
public void handle(
final HttpRequest request,
final HttpResponse response,
@@ -180,15 +186,39 @@ public class TestClientAuthenticationFak
HttpStatus.SC_UNAUTHORIZED,
"Authentication Required"));
response.setHeader("Connection", "Keep-Alive");
- response.setHeader(HttpHeaders.WWW_AUTHENTICATE, "NTLM TlRMTVNTUAACAA" +
- "AADAAMADgAAAAzggLiASNFZ4mrze8AAAAAAAAAAAAAAAAAAAAABgBwFwAAAA9T" +
- "AGUAcgB2AGUAcgA=");
+ response.setHeader(HttpHeaders.WWW_AUTHENTICATE, authenticateHeaderValue);
}
}
@Test
public void testNTLMType2MessageOnlyAuthenticationFailure() throws Exception {
- this.localServer.register("*", new NtlmType2MessageOnlyResponseHandler());
+ this.localServer.register("*", new NtlmType2MessageOnlyResponseHandler("TlRMTVNTUAACAA" +
+ "AADAAMADgAAAAzggLiASNFZ4mrze8AAAAAAAAAAAAAAAAAAAAABgBwFwAAAA9T" +
+ "AGUAcgB2AGUAcgA="));
+ this.localServer.start();
+
+ BasicCredentialsProvider credsProvider = new BasicCredentialsProvider();
+ credsProvider.setCredentials(AuthScope.ANY,
+ new NTCredentials("test", "test", null, null));
+
+ this.httpclient.setCredentialsProvider(credsProvider);
+
+ HttpContext context = new BasicHttpContext();
+
+ HttpHost targethost = getServerHttp();
+ HttpGet httpget = new HttpGet("/");
+
+ HttpResponse response = this.httpclient.execute(targethost, httpget, context);
+ EntityUtils.consume(response.getEntity());
+ Assert.assertEquals(HttpStatus.SC_UNAUTHORIZED,
+ response.getStatusLine().getStatusCode());
+ }
+
+ @Test
+ public void testNTLMType2NonUnicodeMessageOnlyAuthenticationFailure() throws Exception {
+ this.localServer.register("*", new NtlmType2MessageOnlyResponseHandler("TlRMTVNTUAACAA" +
+ "AABgAGADgAAAAyggLiASNFZ4mrze8AAAAAAAAAAAAAAAAAAAAABgBwFwAAAA9T" +
+ "ZXJ2ZXI="));
this.localServer.start();
BasicCredentialsProvider credsProvider = new BasicCredentialsProvider();