You are viewing a plain text version of this content. The canonical link for it is here.
Posted to c-commits@axis.apache.org by ro...@apache.org on 2026/01/30 18:54:32 UTC
(axis-axis2-c-core) 11/12: AXIS2C-1708 Modern security hardening: Remove NTLM authentication support
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit a9e64d1d0fa5b01944d53e38f5a55829675eb8c4
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Fri Jan 30 08:14:23 2026 -1000
AXIS2C-1708 Modern security hardening: Remove NTLM authentication support
NTLM has been completely removed from Axis2/C due to critical security
vulnerabilities. Microsoft is deprecating NTLM in Windows systems.
NTLM vulnerabilities include:
- Pass-the-hash attacks
- NTLM relay attacks
- Weak cryptography (MD4/DES based)
- Session hijacking vulnerabilities
Changes:
- Removed axis2_http_sender_configure_http_ntlm_auth() function
- Removed axis2_http_sender_configure_proxy_ntlm_auth() function
- Removed --enable-heimdal and --enable-libntlm configure options
- Removed NTLM Makefile configurations and sample client
- Updated axis2_ntlm.h to produce compile error if included
- Marked NTLM constants in axis2_http_transport.h as deprecated
- Updated SECURITY.md documentation
Recommended alternatives:
- Kerberos (for Windows/AD environments)
- OAuth 2.0/OpenID Connect (for modern applications)
- Mutual TLS (mTLS) (for service-to-service)
Reference: https://techcommunity.microsoft.com/blog/windows-itpro-blog/the-evolution-of-windows-authentication/4478637
Co-Authored-By: Claude Opus 4.5 <no...@anthropic.com>
---
configure.ac | 59 +--
docs/SECURITY.md | 33 +-
include/axis2_http_transport.h | 36 +-
include/axis2_ntlm.h | 233 +-----------
samples/client/Makefile.am | 5 +-
src/core/transport/http/sender/Makefile.am | 6 +-
src/core/transport/http/sender/http_sender.c | 547 ++++-----------------------
7 files changed, 148 insertions(+), 771 deletions(-)
diff --git a/configure.ac b/configure.ac
index 9d85ca787..d635a08a6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -245,52 +245,16 @@ AC_ARG_ENABLE(libxml2, [ --enable-libxml2
AC_MSG_RESULT(no)
)
-AC_MSG_CHECKING(whether to build heimdal ntlm wrapper library)
-AC_ARG_ENABLE(heimdal, [ --enable-heimdal
- build heimdal ntlm library wrapper (default=no)],
-[ case "${enableval}" in
- no)
- AC_MSG_RESULT(no)
- NTLM_WRAPPER_DIR=""
- NTLM_DIR=""
- NTLM_LIB=""
- ;;
- *)
- AC_MSG_RESULT(yes)
- NTLM_WRAPPER_DIR="heimdal"
- NTLM_DIR="ntlm"
- #PKG_CHECK_MODULES(HEIMDAL, heimdal-1.4)
- CFLAGS="$CFLAGS -DAXIS2_HEIMDAL_ENABLED -DAXIS2_NTLM_ENABLED"
- CPPFLAGS="$CPPFLAGS $NTLM_CFLAGS -DAXIS2_HEIMDAL_ENABLED -DAXIS2_NTLM_ENABLED"
- LDFLAGS="$LDFLAGS $NTLM_LDFLAGS"
- NTLM_LIB="./ntlm/heimdal/libaxis2_ntlm.la"
- ;;
- esac ],
- AC_MSG_RESULT(no)
-)
-
-AC_MSG_CHECKING(whether to build libntlm ntlm wrapper library)
-AC_ARG_ENABLE(libntlm, [ --enable-libntlm
- build libntlm ntlm library wrapper (default=no)],
-[ case "${enableval}" in
- no)
- AC_MSG_RESULT(no)
- NTLM_WRAPPER_DIR=""
- NTLM_DIR=""
- NTLM_LIB=""
- ;;
- *)
- AC_MSG_RESULT(yes)
- NTLM_WRAPPER_DIR="libntlm"
- NTLM_DIR="ntlm"
- CFLAGS="$CFLAGS -DAXIS2_LIBNTLM_ENABLED -DAXIS2_NTLM_ENABLED"
- CPPFLAGS="$CPPFLAGS $NTLM_CFLAGS -DAXIS2_LIBNTLM_ENABLED -DAXIS2_NTLM_ENABLED -DLIBNTLM_CFLAGS"
- LDFLAGS="$LDFLAGS $NTLM_LDFLAGS $LIBNTLM_LIBS"
- NTLM_LIB="./ntlm/libntlm/libaxis2_ntlm.la"
- ;;
- esac ],
- AC_MSG_RESULT(no)
-)
+dnl NTLM support has been completely removed from Axis2/C.
+dnl NTLM is a legacy protocol with known security vulnerabilities including:
+dnl - Pass-the-hash attacks
+dnl - Relay attacks
+dnl - Weak cryptography (MD4/DES based)
+dnl Microsoft is deprecating NTLM. Use Kerberos, OAuth 2.0, or mTLS instead.
+dnl See: https://techcommunity.microsoft.com/blog/windows-itpro-blog/the-evolution-of-windows-authentication/4478637
+NTLM_WRAPPER_DIR=""
+NTLM_DIR=""
+NTLM_LIB=""
AC_MSG_CHECKING(whether to build tcp transport)
@@ -820,9 +784,6 @@ AC_CONFIG_FILES([Makefile \
src/core/transport/http/sender/Makefile \
src/core/transport/http/sender/ssl/Makefile \
src/core/transport/http/sender/libcurl/Makefile \
- src/core/transport/http/sender/ntlm/Makefile \
- src/core/transport/http/sender/ntlm/heimdal/Makefile \
- src/core/transport/http/sender/ntlm/libntlm/Makefile \
src/core/transport/http/receiver/Makefile \
src/core/transport/http/server/simple_axis2_server/Makefile \
src/core/transport/http/server/Makefile \
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 4981b16d9..9be459112 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -93,15 +93,14 @@ To ensure proper certificate validation:
## HTTP Authentication
-Axis2/C supports multiple HTTP authentication schemes:
+Axis2/C supports HTTP authentication schemes for securing web service communications.
### Supported Schemes
-| Scheme | Build Flag | Security Level | Use Case |
-|--------|-----------|----------------|----------|
-| Basic | (default) | Low | Internal networks with TLS only |
-| Digest | (default) | Medium | When Basic is insufficient |
-| NTLM | `--enable-heimdal` or `--enable-libntlm` | Medium | Windows/AD environments |
+| Scheme | Status | Security Level | Use Case |
+|--------|--------|----------------|----------|
+| Basic | Supported | Low | Internal networks with TLS only |
+| Digest | Supported | Medium | When Basic is insufficient |
### Security Considerations
@@ -111,8 +110,26 @@ Axis2/C supports multiple HTTP authentication schemes:
2. **Digest Authentication**: More secure than Basic as passwords are hashed,
but vulnerable to man-in-the-middle without TLS.
-3. **NTLM Authentication**: Windows-specific. Requires Heimdal or libntlm library.
- Provides single sign-on in Windows domains.
+### NTLM Authentication - REMOVED
+
+**NTLM support has been completely removed from Axis2/C.**
+
+Microsoft is deprecating NTLM:
+- [The evolution of Windows authentication](https://techcommunity.microsoft.com/blog/windows-itpro-blog/the-evolution-of-windows-authentication/4478637)
+
+NTLM had critical security vulnerabilities including:
+- Pass-the-hash attacks
+- NTLM relay attacks
+- Weak cryptographic algorithms (MD4/DES based)
+- Session hijacking vulnerabilities
+
+**Recommended alternatives:**
+- **Kerberos** - For Windows/Active Directory environments
+- **OAuth 2.0/OpenID Connect** - For modern web applications
+- **Mutual TLS (mTLS)** - For service-to-service communication
+- **SAML** - For enterprise SSO scenarios
+
+The `--enable-heimdal` and `--enable-libntlm` configure options have been removed.
### Configuration Example
diff --git a/include/axis2_http_transport.h b/include/axis2_http_transport.h
index 5c5df49e6..be3c102be 100644
--- a/include/axis2_http_transport.h
+++ b/include/axis2_http_transport.h
@@ -999,21 +999,19 @@ extern "C"
*/
#define AXIS2_PROXY_AUTH_PASSWD "PROXY_AUTH_PASSWD"
- /**
- * NTLM authentication domain property name
- */
- #define AXIS2_NTLM_AUTH_DOMAIN "NTLM_AUTH_DOMAIN"
-
- /**
- * NTLM authentication workstation property name
- */
- #define AXIS2_NTLM_AUTH_WORKSTATION "NTLM_AUTH_WORKSTATION"
-
- /**
- * NTLM authentication flags property name
+ /* NTLM authentication has been removed from Axis2/C due to security vulnerabilities.
+ * NTLM is deprecated by Microsoft and has known weaknesses including:
+ * - Pass-the-hash attacks
+ * - Relay attacks
+ * - Weak cryptography (MD4/DES based)
+ * Use Kerberos, OAuth 2.0, or mTLS instead.
+ * See: https://techcommunity.microsoft.com/blog/windows-itpro-blog/the-evolution-of-windows-authentication/4478637
+ *
+ * The following NTLM-related constants are retained for API compatibility but are non-functional:
*/
- #define AXIS2_NTLM_AUTH_FLAGS "NTLM_AUTH_FLAGS"
-
+ #define AXIS2_NTLM_AUTH_DOMAIN "NTLM_AUTH_DOMAIN" /* DEPRECATED - NTLM removed */
+ #define AXIS2_NTLM_AUTH_WORKSTATION "NTLM_AUTH_WORKSTATION" /* DEPRECATED - NTLM removed */
+ #define AXIS2_NTLM_AUTH_FLAGS "NTLM_AUTH_FLAGS" /* DEPRECATED - NTLM removed */
/* #define AXIS2_HTTP_AUTH_TYPE "HTTP_AUTH_TYPE"*/
@@ -1026,9 +1024,10 @@ extern "C"
* HTTP "Digest" authentication
*/
#define AXIS2_HTTP_AUTH_TYPE_DIGEST "Digest"
-
+
/**
- * "NTLM" authentication
+ * "NTLM" authentication - DEPRECATED AND REMOVED
+ * This constant is retained for API compatibility but NTLM is no longer functional.
*/
#define AXIS2_HTTP_AUTH_TYPE_NTLM "NTLM"
@@ -1041,9 +1040,10 @@ extern "C"
* Proxy "Digest" authentication
*/
#define AXIS2_PROXY_AUTH_TYPE_DIGEST "Digest"
-
+
/**
- * Proxy "NTLM" authentication
+ * Proxy "NTLM" authentication - DEPRECATED AND REMOVED
+ * This constant is retained for API compatibility but NTLM is no longer functional.
*/
#define AXIS2_PROXY_AUTH_TYPE_NTLM "NTLM"
diff --git a/include/axis2_ntlm.h b/include/axis2_ntlm.h
index 5af376c10..9feda93e0 100644
--- a/include/axis2_ntlm.h
+++ b/include/axis2_ntlm.h
@@ -1,4 +1,3 @@
-
/*
* Copyright 2004,2005 The Apache Software Foundation.
*
@@ -13,223 +12,33 @@
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
- *
*/
#ifndef AXIS2_NTLM_H
#define AXIS2_NTLM_H
/**
- *@file axis2_ntlm.h
- *@brief this is the ntlm authentication abstraction layer for axis2
+ * @file axis2_ntlm.h
+ * @brief NTLM Authentication - REMOVED
+ *
+ * NTLM support has been completely removed from Axis2/C due to security vulnerabilities.
+ * This header is retained only for API compatibility - attempting to use NTLM functions
+ * will result in compilation or runtime errors.
+ *
+ * NTLM vulnerabilities include:
+ * - Pass-the-hash attacks
+ * - Relay attacks
+ * - Weak cryptography (MD4/DES based)
+ *
+ * Microsoft is deprecating NTLM:
+ * https://techcommunity.microsoft.com/blog/windows-itpro-blog/the-evolution-of-windows-authentication/4478637
+ *
+ * Recommended alternatives:
+ * - Kerberos (for Windows domain environments)
+ * - OAuth 2.0 (for modern authentication)
+ * - mTLS (mutual TLS for certificate-based authentication)
*/
-#include <axutil_env.h>
-#include <axutil_utils.h>
-
-#ifdef __cplusplus
-extern "C"
-{
-#endif
-
- #define NTLM_NEG_NTLM 0x00000200
- #define NTLM_NEG_UNICODE 0x00000001
- #define NTLM_TARGET_DOMAIN 0x00010000
-
- typedef struct axis2_ntlm_ops axis2_ntlm_ops_t;
- typedef struct axis2_ntlm axis2_ntlm_t;
-
- /**
- * @defgroup axis2_ntlm ntlm
- * @ingroup axiom
- * @{
- * @}
- */
-
- /**
- * @defgroup axis2_ntlm ntlm
- * @ingroup axis2_ntlm
- * @{
- */
-
- /**
- * \brief AXIS2_NTLM ops
- * Encapsulator struct for ops of axiis2_ntlm
- */
-
- struct axis2_ntlm_ops
- {
- /**
- * free pull_ntlm
- * @param ntlm axis2_ntlm struct
- * @param env axutil_environment MUST NOT be NULL
- * @returns axis2_status_code
- */
-
- void (
- AXIS2_CALL
- * free)(
- axis2_ntlm_t * ntlm,
- const axutil_env_t * env);
-
- /**
- * Create Type1 NTLM message. This will create a type1 message and assign
- * it to the return type.
- * @param ntlm axis2_ntlm
- * @param env axutil_environment, MUST NOT be NULL.
- * @param encoded_message return type passed by caller.
- * @param encoded_len length of the encoded message
- * @param uname user name
- * @param passwd password
- * @param flags NTLM flags
- * @param domain domain
- * @returns status , AXIS2_FAILURE on error
- */
-
- axis2_status_t (
- AXIS2_CALL
- * create_type1_message)(
- axis2_ntlm_t * ntlm,
- const axutil_env_t * env,
- axis2_char_t **encoded_message,
- int *encoded_len,
- const axis2_char_t *uname,
- const axis2_char_t *passwd,
- const int flags,
- const axis2_char_t *domain);
-
- /**
- * Create Type3 NTLM message. This will create a type3 message and assign
- * it to the return type.
- * @param ntlm axis2_ntlm
- * @param env axutil_environment, MUST NOT be NULL.
- * @param header_value Header value extracted from the type2 message
- * @param encoded_message return type passed by caller.
- * @param encoded_len length of the encoded message
- * @param uname user name
- * @param passwd password
- * @param domain domain
- * @param workstation workstation
- * @returns status , AXIS2_FAILURE on error
- */
-
- axis2_status_t(
- AXIS2_CALL
- * create_type3_message)(
- axis2_ntlm_t * ntlm,
- const axutil_env_t * env,
- axis2_char_t *header_value,
- axis2_char_t **encoded_message,
- int *encoded_len,
- const axis2_char_t *uname,
- const axis2_char_t *passwd,
- const axis2_char_t *domain,
- const axis2_char_t *workstation);
-
-
- };
-
- /**
- * @brief axis2_ntlm struct
- * Axis2 NTLM
- */
- struct axis2_ntlm
- {
- const axis2_ntlm_ops_t *ops;
- };
-
- /**
- * Creates an instance of axis2_ntlm that would be used to
- * authorize NTLM
- * @param env environment struct, must not be null
- * @returns a pointer to axis2_ntlm_t struct
- * NULL on error with error code set in the environment's error
- */
- AXIS2_EXTERN axis2_ntlm_t *AXIS2_CALL
- axis2_ntlm_create(
- const axutil_env_t * env);
-
-
- /**
- * free method for ntlm
- * @param ntlm pointer to the NTLM struct
- * @param env environment struct, must not be null
- *
- * @return
- */
- AXIS2_EXTERN void AXIS2_CALL
- axis2_ntlm_free(
- axis2_ntlm_t * ntlm,
- const axutil_env_t * env);
-
- /**
- * Create Type1 NTLM message. This will create a type1 message and assign
- * it to the return type.
- * @param ntlm axis2_ntlm
- * @param env axutil_environment, MUST NOT be NULL.
- * @param encoded_message return type passed by caller.
- * @param encoded_len length of the encoded message
- * @param uname user name
- * @param passwd password
- * @param flags NTLM flags
- * @param domain domain
- * @returns status , AXIS2_FAILURE on error
- */
- AXIS2_EXTERN axis2_status_t AXIS2_CALL
- axis2_ntlm_auth_create_type1_message(
- axis2_ntlm_t * ntlm,
- const axutil_env_t * env,
- axis2_char_t **encoded_message,
- int *encoded_len,
- const axis2_char_t *uname,
- const axis2_char_t *passwd,
- const int flags,
- const axis2_char_t *domain);
-
- /**
- * Create Type3 NTLM message. This will create a type3 message and assign
- * it to the return type.
- * @param ntlm axis2_ntlm
- * @param env axutil_environment, MUST NOT be NULL.
- * @param header_value Header value extracted from the type2 message
- * @param encoded_message return type passed by caller.
- * @param encoded_len length of the encoded message
- * @param uname user name
- * @param passwd password
- * @param domain domain
- * @param workstation workstation
- * @returns status , AXIS2_FAILURE on error
- */
- AXIS2_EXTERN axis2_status_t AXIS2_CALL
- axis2_ntlm_auth_create_type3_message(
- axis2_ntlm_t * ntlm,
- const axutil_env_t * env,
- axis2_char_t *header_value,
- axis2_char_t **encoded_message,
- int *encoded_len,
- const axis2_char_t *uname,
- const axis2_char_t *passwd,
- const axis2_char_t *domain,
- const axis2_char_t *workstation);
-
- /** @} */
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* AXIS2_NTLM_H */
-
-
-
-
-
-
-
-
-
-
-
-
-
+#error "NTLM authentication has been removed from Axis2/C. Use Kerberos, OAuth 2.0, or mTLS instead."
+#endif /* AXIS2_NTLM_H */
diff --git a/samples/client/Makefile.am b/samples/client/Makefile.am
index d00109ab0..ea3b7f6d3 100644
--- a/samples/client/Makefile.am
+++ b/samples/client/Makefile.am
@@ -12,6 +12,7 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
-SUBDIRS = echo math google notify mtom yahoo version mtom_callback session $(NTLM_DIR)
-DIST_SUBDIRS = echo math google notify mtom yahoo version mtom_callback session ntlm
+# NTLM sample removed - NTLM support has been removed from Axis2/C for security reasons
+SUBDIRS = echo math google notify mtom yahoo version mtom_callback session
+DIST_SUBDIRS = echo math google notify mtom yahoo version mtom_callback session
EXTRA_DIST= Makefile.am
diff --git a/src/core/transport/http/sender/Makefile.am b/src/core/transport/http/sender/Makefile.am
index 6dc2ae87b..4e778ca32 100644
--- a/src/core/transport/http/sender/Makefile.am
+++ b/src/core/transport/http/sender/Makefile.am
@@ -12,8 +12,9 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
-SUBDIRS=ssl libcurl $(NTLM_DIR)
-DIST_SUBDIRS=ssl libcurl ntlm
+# NTLM support has been removed - see docs/SECURITY.md
+SUBDIRS=ssl libcurl
+DIST_SUBDIRS=ssl libcurl
lib_LTLIBRARIES = libaxis2_http_sender.la
@@ -50,7 +51,6 @@ libaxis2_http_sender_la_LIBADD = $(top_builddir)/src/core/transport/http/common/
$(top_builddir)/axiom/src/om/libaxis2_axiom.la\
$(top_builddir)/util/src/libaxutil.la\
$(top_builddir)/src/core/engine/libaxis2_engine.la\
- ${NTLM_LIB}\
$(LIBCURL_LIBS)\
$(SSL_LIBS)
diff --git a/src/core/transport/http/sender/http_sender.c b/src/core/transport/http/sender/http_sender.c
index 6aad128e6..4de58f14f 100644
--- a/src/core/transport/http/sender/http_sender.c
+++ b/src/core/transport/http/sender/http_sender.c
@@ -38,7 +38,14 @@
#include <axiom_soap.h>
#include <axutil_version.h>
#include "ssl/ssl_stream.h"
-#include <axis2_ntlm.h>
+/* NTLM support has been completely removed from Axis2/C.
+ * NTLM is a legacy protocol with known security vulnerabilities including:
+ * - Pass-the-hash attacks
+ * - Relay attacks
+ * - Weak cryptography (MD4/DES based)
+ * Microsoft is deprecating NTLM: https://techcommunity.microsoft.com/blog/windows-itpro-blog/the-evolution-of-windows-authentication/4478637
+ * Use Kerberos, OAuth 2.0, or mTLS instead.
+ */
#ifdef AXIS2_LIBCURL_ENABLED
#include "libcurl/axis2_libcurl.h"
@@ -145,14 +152,6 @@ axis2_http_sender_configure_http_digest_auth(
axis2_http_simple_request_t * request,
axis2_char_t * header_data);
-static axis2_status_t
-axis2_http_sender_configure_http_ntlm_auth(
- axis2_http_sender_t * sender,
- const axutil_env_t * env,
- axis2_msg_ctx_t * msg_ctx,
- axis2_http_simple_request_t * request,
- axis2_char_t * header_data);
-
static axis2_status_t
axis2_http_sender_configure_proxy_digest_auth(
axis2_http_sender_t * sender,
@@ -161,14 +160,7 @@ axis2_http_sender_configure_proxy_digest_auth(
axis2_http_simple_request_t * request,
axis2_char_t * header_data);
-static axis2_status_t
-axis2_http_sender_configure_proxy_ntlm_auth(
- axis2_http_sender_t * sender,
- const axutil_env_t * env,
- axis2_msg_ctx_t * msg_ctx,
- axis2_http_simple_request_t * request,
- axis2_char_t * header_data);
-
+/* NTLM authentication functions removed - see security note at top of file */
#endif
@@ -274,7 +266,7 @@ axis2_http_sender_send(
axutil_url_t *url = NULL;
axiom_xml_writer_t *xml_writer = NULL;
axis2_char_t *buffer = NULL;
- unsigned int buffer_size = 0;
+ size_t buffer_size = 0;
const axis2_char_t *char_set_enc = NULL;
axutil_string_t *char_set_enc_str = NULL;
int status_code = -1;
@@ -282,7 +274,7 @@ axis2_http_sender_send(
axis2_char_t *content_type = NULL;
axis2_bool_t content_type_deepl_copy = AXIS2_TRUE;
axis2_byte_t *output_stream = NULL;
- int output_stream_size = 0;
+ size_t output_stream_size = 0;
axis2_bool_t doing_mtom = AXIS2_FALSE;
axutil_property_t *dump_property = NULL;
axutil_param_t *ssl_pp_param = NULL;
@@ -958,7 +950,7 @@ axis2_http_sender_send(
{
/* HTTP 1.1 */
axis2_char_t *header = NULL;
- int host_len = 0;
+ size_t host_len = 0;
host_len = axutil_strlen(axutil_url_get_host(url, env));
header = AXIS2_MALLOC(env->allocator, host_len + 10 * sizeof(axis2_char_t));
sprintf(header, "%s:%d", axutil_url_get_host(url, env), axutil_url_get_port(url, env));
@@ -1062,8 +1054,7 @@ axis2_http_sender_send(
}
if(proxy_auth_property_value && (0 == axutil_strcmp(proxy_auth_property_value,
- AXIS2_PROXY_AUTH_TYPE_DIGEST) || 0 == axutil_strcmp(proxy_auth_property_value,
- AXIS2_HTTP_AUTH_TYPE_NTLM)))
+ AXIS2_PROXY_AUTH_TYPE_DIGEST)))
{
force_proxy_auth = AXIS2_FALSE;
force_proxy_auth_with_head = AXIS2_TRUE;
@@ -1102,8 +1093,7 @@ axis2_http_sender_send(
}
if(http_auth_property_value && (0 == axutil_strcmp(http_auth_property_value,
- AXIS2_HTTP_AUTH_TYPE_DIGEST) || 0 == axutil_strcmp(http_auth_property_value,
- AXIS2_HTTP_AUTH_TYPE_NTLM)))
+ AXIS2_HTTP_AUTH_TYPE_DIGEST)))
{
force_http_auth = AXIS2_FALSE;
force_http_auth_with_head = AXIS2_TRUE;
@@ -2117,18 +2107,18 @@ axis2_http_sender_configure_http_basic_auth(
}
if(uname && passwd)
{
- int elen;
- int plen = axutil_strlen(uname) + axutil_strlen(passwd) + 1;
+ size_t elen;
+ size_t plen = axutil_strlen(uname) + axutil_strlen(passwd) + 1;
axis2_char_t *to_encode = (axis2_char_t *)(AXIS2_MALLOC(env->allocator,
sizeof(axis2_char_t) * plen + 1));
axis2_char_t *encoded = NULL;
axis2_char_t *auth_str = NULL;
sprintf(to_encode, "%s:%s", uname, passwd);
- elen = axutil_base64_encode_len(plen);
+ elen = (size_t)axutil_base64_encode_len((int)plen);
encoded = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t) * elen));
auth_str
= (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t) * (elen + 6)));
- axutil_base64_encode(encoded, to_encode, plen);
+ axutil_base64_encode(encoded, to_encode, (int)plen);
sprintf(auth_str, "%s %s", AXIS2_HTTP_AUTH_TYPE_BASIC, encoded);
axis2_http_sender_util_add_header(env, request, AXIS2_HTTP_HEADER_AUTHORIZATION, auth_str);
@@ -2231,18 +2221,18 @@ axis2_http_sender_configure_proxy_basic_auth(
}
if(uname && passwd)
{
- int elen;
- int plen = axutil_strlen(uname) + axutil_strlen(passwd) + 1;
+ size_t elen;
+ size_t plen = axutil_strlen(uname) + axutil_strlen(passwd) + 1;
axis2_char_t *to_encode = (axis2_char_t *)(AXIS2_MALLOC(env->allocator,
sizeof(axis2_char_t) * plen + 1));
axis2_char_t *encoded = NULL;
axis2_char_t *auth_str = NULL;
sprintf(to_encode, "%s:%s", uname, passwd);
- elen = axutil_base64_encode_len(plen);
+ elen = (size_t)axutil_base64_encode_len((int)plen);
encoded = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t) * elen));
auth_str
= (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t) * (elen + 6)));
- axutil_base64_encode(encoded, to_encode, plen);
+ axutil_base64_encode(encoded, to_encode, (int)plen);
sprintf(auth_str, "%s %s", AXIS2_PROXY_AUTH_TYPE_BASIC, encoded);
axis2_http_sender_util_add_header(env, request, AXIS2_HTTP_HEADER_PROXY_AUTHORIZATION,
auth_str);
@@ -2343,10 +2333,10 @@ axis2_http_sender_configure_http_digest_auth(
}
if(uname && passwd)
{
- int elen = 0; /* length of header content */
- int print_const = 5; /* constant accounts for printing the
+ size_t elen = 0; /* length of header content */
+ size_t print_const = 5; /* constant accounts for printing the
quoatation marks, comma, and space */
- int response_length = 32;
+ size_t response_length = 32;
axis2_char_t *temp = NULL;
axis2_char_t *alloc_temp = NULL;
axis2_char_t *algo = AXIS2_HTTP_AUTHORIZATION_REQUEST_ALGORITHM_MD5;
@@ -2398,9 +2388,10 @@ axis2_http_sender_configure_http_digest_auth(
temp = axutil_strchr(realm, AXIS2_ESC_DOUBLE_QUOTE);
alloc_temp = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t)
* (temp - realm + 1)));
+ if(!alloc_temp)
+ return AXIS2_FAILURE;
strncpy(alloc_temp, realm, (temp - realm));
- if(alloc_temp)
- alloc_temp[temp - realm] = AXIS2_ESC_NULL;
+ alloc_temp[temp - realm] = AXIS2_ESC_NULL;
realm = alloc_temp;
alloc_temp = NULL;
elen += print_const + axutil_strlen(AXIS2_HTTP_AUTHORIZATION_REQUEST_PARAM_REALM)
@@ -2422,9 +2413,10 @@ axis2_http_sender_configure_http_digest_auth(
temp = axutil_strchr(qop, AXIS2_ESC_DOUBLE_QUOTE);
alloc_temp = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t)
* (temp - qop + 1)));
+ if(!alloc_temp)
+ return AXIS2_FAILURE;
strncpy(alloc_temp, qop, (temp - qop));
- if(alloc_temp)
- alloc_temp[temp - qop] = AXIS2_ESC_NULL;
+ alloc_temp[temp - qop] = AXIS2_ESC_NULL;
qop = alloc_temp;
alloc_temp = NULL;
}
@@ -2440,9 +2432,10 @@ axis2_http_sender_configure_http_digest_auth(
temp = axutil_strchr(nonce, AXIS2_ESC_DOUBLE_QUOTE);
alloc_temp = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t)
* (temp - nonce + 1)));
+ if(!alloc_temp)
+ return AXIS2_FAILURE;
strncpy(alloc_temp, nonce, (temp - nonce));
- if(alloc_temp)
- alloc_temp[temp - nonce] = AXIS2_ESC_NULL;
+ alloc_temp[temp - nonce] = AXIS2_ESC_NULL;
nonce = alloc_temp;
alloc_temp = NULL;
@@ -2467,9 +2460,10 @@ axis2_http_sender_configure_http_digest_auth(
temp = axutil_strchr(opaque, AXIS2_ESC_DOUBLE_QUOTE);
alloc_temp = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t)
* (temp - opaque + 1)));
+ if(!alloc_temp)
+ return AXIS2_FAILURE;
strncpy(alloc_temp, opaque, (temp - opaque));
- if(alloc_temp)
- alloc_temp[temp - opaque] = AXIS2_ESC_NULL;
+ alloc_temp[temp - opaque] = AXIS2_ESC_NULL;
opaque = alloc_temp;
alloc_temp = NULL;
elen += print_const + axutil_strlen(AXIS2_HTTP_AUTHORIZATION_REQUEST_PARAM_OPAQUE)
@@ -2571,195 +2565,7 @@ axis2_http_sender_configure_http_digest_auth(
return AXIS2_FAILURE;
}
-static axis2_status_t
-axis2_http_sender_configure_http_ntlm_auth(
- axis2_http_sender_t * sender,
- const axutil_env_t * env,
- axis2_msg_ctx_t * msg_ctx,
- axis2_http_simple_request_t * request,
- axis2_char_t * header_data)
-{
-
-#ifndef AXIS2_NTLM_ENABLED
- AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "NTLM is not enabled. Please consider building "\
- "Axis2/C enabling a ntlm client library");
- return AXIS2_FAILURE;
-#else
-
- axutil_property_t *http_auth_un = NULL;
- axutil_property_t *http_auth_pw = NULL;
- axutil_property_t *ntlm_auth_dm = NULL;
- axutil_property_t *ntlm_auth_wo = NULL;
- axutil_property_t *ntlm_auth_fg = NULL;
- axis2_char_t *uname = NULL;
- axis2_char_t *passwd = NULL;
- int flags = 0;
- axis2_char_t *domain = NULL;
- axis2_char_t *workstation = NULL;
-
-
- http_auth_un = axis2_msg_ctx_get_property(msg_ctx, env, AXIS2_HTTP_AUTH_UNAME);
- http_auth_pw = axis2_msg_ctx_get_property(msg_ctx, env, AXIS2_HTTP_AUTH_PASSWD);
- ntlm_auth_dm = axis2_msg_ctx_get_property(msg_ctx, env, AXIS2_NTLM_AUTH_DOMAIN);
- ntlm_auth_wo = axis2_msg_ctx_get_property(msg_ctx, env, AXIS2_NTLM_AUTH_WORKSTATION);
- ntlm_auth_fg = axis2_msg_ctx_get_property(msg_ctx, env, AXIS2_NTLM_AUTH_FLAGS);
- if(http_auth_un && http_auth_pw)
- {
- uname = (axis2_char_t *)axutil_property_get_value(http_auth_un, env);
- passwd = (axis2_char_t *)axutil_property_get_value(http_auth_pw, env);
- }
- if(!uname || !passwd)
- {
- axis2_conf_ctx_t *conf_ctx = NULL;
- axis2_conf_t *conf = NULL;
- axis2_transport_out_desc_t *trans_desc = NULL;
- axutil_param_t *http_auth_param = NULL;
- axutil_hash_t *transport_attrs = NULL;
-
- conf_ctx = axis2_msg_ctx_get_conf_ctx(msg_ctx, env);
- if(conf_ctx)
- {
- conf = axis2_conf_ctx_get_conf(conf_ctx, env);
- if(conf)
- {
- trans_desc = axis2_conf_get_transport_out(conf, env, AXIS2_TRANSPORT_ENUM_HTTP);
- }
- }
- if(trans_desc)
- {
- http_auth_param = axutil_param_container_get_param(
- axis2_transport_out_desc_param_container(trans_desc, env), env,
- AXIS2_HTTP_AUTHENTICATION);
- if(http_auth_param)
- {
- transport_attrs = axutil_param_get_attributes(http_auth_param, env);
- if(transport_attrs)
- {
- axutil_generic_obj_t *obj = NULL;
- axiom_attribute_t *username_attr = NULL;
- axiom_attribute_t *password_attr = NULL;
-
- obj = axutil_hash_get(transport_attrs, AXIS2_HTTP_AUTHENTICATION_USERNAME,
- AXIS2_HASH_KEY_STRING);
- if(obj)
- {
- username_attr = (axiom_attribute_t *)axutil_generic_obj_get_value(obj, env);
- }
- if(username_attr)
- {
- uname = axiom_attribute_get_value(username_attr, env);
- }
- obj = NULL;
-
- obj = axutil_hash_get(transport_attrs, AXIS2_HTTP_AUTHENTICATION_PASSWORD,
- AXIS2_HASH_KEY_STRING);
- if(obj)
- {
- password_attr = (axiom_attribute_t *)axutil_generic_obj_get_value(obj, env);
- }
- if(password_attr)
- {
- passwd = axiom_attribute_get_value(password_attr, env);
- }
- }
- }
- }
- }
- if(ntlm_auth_fg)
- {
- axis2_char_t *temp_flags = (axis2_char_t *) axutil_property_get_value(ntlm_auth_fg, env);
- if(temp_flags)
- {
- flags = atoi(temp_flags);
- }
- else
- {
- flags = 0;
- }
- }
- else
- {
- flags = 0;
- }
- if(ntlm_auth_dm)
- {
- domain = (axis2_char_t *)axutil_property_get_value(ntlm_auth_dm, env);
- }
- if(ntlm_auth_wo)
- {
- workstation = (axis2_char_t *)axutil_property_get_value(ntlm_auth_wo, env);
- }
- if(uname && passwd)
- {
- int elen = 0;
- axis2_char_t *auth_str = NULL;
- axis2_char_t *encoded_message = NULL;
- axis2_http_header_t *tmp_header = NULL;
- axis2_ntlm_t *ntlm = NULL;
- axis2_status_t status = AXIS2_FAILURE;
-
- ntlm = axis2_ntlm_create(env);
- if(!header_data || !*header_data) /* NTLM unauthorized received */
- {
- /* Ceate type 1(negotiation) header message */
- status = axis2_ntlm_auth_create_type1_message(ntlm, env, &encoded_message, &elen, uname,
- passwd, flags, domain);
- /*status = axis2_ntlm_auth_create_type1_message(ntlm, env, &encoded_message, &elen, "nandika",
- "nandika", 0, "mydomain", "workstation");*/
- }
- else /* NTLM challange received */
- {
- /* Create Type3 (authentication) header message */
- status = axis2_ntlm_auth_create_type3_message(ntlm, env, header_data,
- &encoded_message, &elen, uname, passwd, domain, workstation);
- }
- if(status != AXIS2_SUCCESS)
- {
- if(encoded_message)
- {
- AXIS2_FREE(env->allocator, encoded_message);
- encoded_message = NULL;
- }
- if(ntlm)
- {
- axis2_ntlm_free(ntlm, env);
- }
- AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
- "axis2_ntlm_auth_create_type3_message call failed");
- return status;
- }
- AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "encoded_message:%s", encoded_message);
-
- auth_str
- = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t) * (elen + 6)));
- sprintf(auth_str, "%s %s", AXIS2_HTTP_AUTH_TYPE_NTLM, encoded_message);
- tmp_header = axis2_http_simple_request_get_first_header(request, env,
- AXIS2_HTTP_HEADER_AUTHORIZATION);
- if(tmp_header)
- {
- axis2_char_t *tmp_header_val = axis2_http_header_get_value(tmp_header, env);
- if(tmp_header_val)
- {
- axis2_http_header_set_value(tmp_header, env, auth_str);
- }
- }
- else
- {
- axis2_http_sender_util_add_header(env, request, AXIS2_HTTP_HEADER_AUTHORIZATION, auth_str);
- }
-
-
- AXIS2_FREE(env->allocator, encoded_message);
- encoded_message = NULL;
- axis2_ntlm_free(ntlm, env);
- AXIS2_FREE(env->allocator, auth_str);
- auth_str = NULL;
-
- return AXIS2_SUCCESS;
- }
- return AXIS2_FAILURE;
-#endif
-} /* axis2_http_sender_configure_http_ntlm_auth */
+/* NTLM authentication removed - see security note at top of file */
static axis2_status_t
axis2_http_sender_configure_proxy_digest_auth(
@@ -2851,10 +2657,10 @@ axis2_http_sender_configure_proxy_digest_auth(
}
if(uname && passwd)
{
- int elen = 0; /* length of header content */
- int print_const = 5; /* constant accounts for printing the
+ size_t elen = 0; /* length of header content */
+ size_t print_const = 5; /* constant accounts for printing the
quoatation marks, comma, and space */
- int response_length = 32;
+ size_t response_length = 32;
axis2_char_t *temp = NULL;
axis2_char_t *alloc_temp = NULL;
axis2_char_t *algo = AXIS2_HTTP_AUTHORIZATION_REQUEST_ALGORITHM_MD5;
@@ -2906,9 +2712,10 @@ axis2_http_sender_configure_proxy_digest_auth(
temp = axutil_strchr(realm, AXIS2_ESC_DOUBLE_QUOTE);
alloc_temp = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t)
* (temp - realm + 1)));
+ if(!alloc_temp)
+ return AXIS2_FAILURE;
strncpy(alloc_temp, realm, (temp - realm));
- if(alloc_temp)
- alloc_temp[temp - realm] = AXIS2_ESC_NULL;
+ alloc_temp[temp - realm] = AXIS2_ESC_NULL;
realm = alloc_temp;
alloc_temp = NULL;
elen += print_const + axutil_strlen(AXIS2_HTTP_AUTHORIZATION_REQUEST_PARAM_REALM)
@@ -2930,9 +2737,10 @@ axis2_http_sender_configure_proxy_digest_auth(
temp = axutil_strchr(qop, AXIS2_ESC_DOUBLE_QUOTE);
alloc_temp = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t)
* (temp - qop + 1)));
+ if(!alloc_temp)
+ return AXIS2_FAILURE;
strncpy(alloc_temp, qop, (temp - qop));
- if(alloc_temp)
- alloc_temp[temp - qop] = AXIS2_ESC_NULL;
+ alloc_temp[temp - qop] = AXIS2_ESC_NULL;
qop = alloc_temp;
alloc_temp = NULL;
}
@@ -2948,9 +2756,10 @@ axis2_http_sender_configure_proxy_digest_auth(
temp = axutil_strchr(nonce, AXIS2_ESC_DOUBLE_QUOTE);
alloc_temp = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t)
* (temp - nonce + 1)));
+ if(!alloc_temp)
+ return AXIS2_FAILURE;
strncpy(alloc_temp, nonce, (temp - nonce));
- if(alloc_temp)
- alloc_temp[temp - nonce] = AXIS2_ESC_NULL;
+ alloc_temp[temp - nonce] = AXIS2_ESC_NULL;
nonce = alloc_temp;
alloc_temp = NULL;
@@ -2975,9 +2784,10 @@ axis2_http_sender_configure_proxy_digest_auth(
temp = axutil_strchr(opaque, AXIS2_ESC_DOUBLE_QUOTE);
alloc_temp = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t)
* (temp - opaque + 1)));
+ if(!alloc_temp)
+ return AXIS2_FAILURE;
strncpy(alloc_temp, opaque, (temp - opaque));
- if(alloc_temp)
- alloc_temp[temp - opaque] = AXIS2_ESC_NULL;
+ alloc_temp[temp - opaque] = AXIS2_ESC_NULL;
opaque = alloc_temp;
alloc_temp = NULL;
elen += print_const + axutil_strlen(AXIS2_HTTP_AUTHORIZATION_REQUEST_PARAM_OPAQUE)
@@ -3094,215 +2904,7 @@ axis2_http_sender_configure_proxy_digest_auth(
return AXIS2_FAILURE;
}
-static axis2_status_t
-axis2_http_sender_configure_proxy_ntlm_auth(
- axis2_http_sender_t * sender,
- const axutil_env_t * env,
- axis2_msg_ctx_t * msg_ctx,
- axis2_http_simple_request_t * request,
- axis2_char_t * header_data)
-{
-#ifndef AXIS2_NTLM_ENABLED
- AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "NTLM is not enabled. Please consider building "\
- "Axis2/C enabling a ntlm client library");
- return AXIS2_FAILURE;
-#else
- axutil_property_t *proxy_auth_un = NULL;
- axutil_property_t *proxy_auth_pw = NULL;
- axutil_property_t *ntlm_auth_dm = NULL;
- axutil_property_t *ntlm_auth_wo = NULL;
- axutil_property_t *ntlm_auth_fg = NULL;
- axis2_char_t *uname = NULL;
- axis2_char_t *passwd = NULL;
- int flags = 0;
- axis2_char_t *domain = NULL;
- axis2_char_t *workstation = NULL;
-
-
-
- if(!header_data || !*header_data)
- return AXIS2_FAILURE;
-
- proxy_auth_un = axis2_msg_ctx_get_property(msg_ctx, env, AXIS2_PROXY_AUTH_UNAME);
- proxy_auth_pw = axis2_msg_ctx_get_property(msg_ctx, env, AXIS2_PROXY_AUTH_PASSWD);
- ntlm_auth_dm = axis2_msg_ctx_get_property(msg_ctx, env, AXIS2_NTLM_AUTH_DOMAIN);
- ntlm_auth_wo = axis2_msg_ctx_get_property(msg_ctx, env, AXIS2_NTLM_AUTH_WORKSTATION);
- ntlm_auth_fg = axis2_msg_ctx_get_property(msg_ctx, env, AXIS2_NTLM_AUTH_FLAGS);
-
- if(proxy_auth_un && proxy_auth_pw)
- {
- uname = (axis2_char_t *)axutil_property_get_value(proxy_auth_un, env);
- passwd = (axis2_char_t *)axutil_property_get_value(proxy_auth_pw, env);
- }
- if(!uname || !passwd)
- {
- axis2_conf_ctx_t *conf_ctx = NULL;
- axis2_conf_t *conf = NULL;
- axis2_transport_out_desc_t *trans_desc = NULL;
- axutil_param_t *proxy_param = NULL;
- axutil_hash_t *transport_attrs = NULL;
-
- conf_ctx = axis2_msg_ctx_get_conf_ctx(msg_ctx, env);
- if(conf_ctx)
- {
- conf = axis2_conf_ctx_get_conf(conf_ctx, env);
- if(conf)
- {
- trans_desc = axis2_conf_get_transport_out(conf, env, AXIS2_TRANSPORT_ENUM_HTTP);
- }
- }
- if(trans_desc)
- {
- proxy_param = axutil_param_container_get_param(
- axis2_transport_out_desc_param_container(trans_desc, env), env,
- AXIS2_HTTP_PROXY_API);
- if(!proxy_param)
- {
- proxy_param = axutil_param_container_get_param(
- axis2_transport_out_desc_param_container(trans_desc, env), env,
- AXIS2_HTTP_PROXY);
- }
- if(proxy_param)
- {
- transport_attrs = axutil_param_get_attributes(proxy_param, env);
-
- if(transport_attrs)
- {
- axutil_generic_obj_t *obj = NULL;
- axiom_attribute_t *username_attr = NULL;
- axiom_attribute_t *password_attr = NULL;
-
- obj = axutil_hash_get(transport_attrs, AXIS2_HTTP_PROXY_USERNAME,
- AXIS2_HASH_KEY_STRING);
- if(obj)
- {
- username_attr = (axiom_attribute_t *)axutil_generic_obj_get_value(obj, env);
- }
- if(username_attr)
- {
- uname = axiom_attribute_get_value(username_attr, env);
- }
-
- obj = NULL;
- obj = axutil_hash_get(transport_attrs, AXIS2_HTTP_PROXY_PASSWORD,
- AXIS2_HASH_KEY_STRING);
- if(obj)
- {
- password_attr = (axiom_attribute_t *)axutil_generic_obj_get_value(obj, env);
- }
- if(password_attr)
- {
- passwd = axiom_attribute_get_value(password_attr, env);
- }
- }
- }
- }
- }
- if(ntlm_auth_fg)
- {
- axis2_char_t *temp_flags = (axis2_char_t *) axutil_property_get_value(ntlm_auth_fg, env);
- if(temp_flags)
- {
- flags = atoi(temp_flags);
- }
- else
- {
- flags = 0;
- }
- }
- else
- {
- flags = 0;
- }
- if(ntlm_auth_dm)
- {
- domain = (axis2_char_t *)axutil_property_get_value(ntlm_auth_dm, env);
- }
- if(ntlm_auth_wo)
- {
- workstation = (axis2_char_t *)axutil_property_get_value(ntlm_auth_wo, env);
- }
- if(uname && passwd)
- {
- int *elen = NULL;
- axis2_char_t *auth_str = NULL;
- axis2_char_t *encoded_message = NULL;
- axis2_http_header_t *tmp_header = NULL;
- axis2_ntlm_t *ntlm = NULL;
- axis2_status_t status = AXIS2_FAILURE;
-
- ntlm = axis2_ntlm_create(env);
- if(!header_data || !*header_data) /* NTLM unauthorized received */
- {
- /* Ceate type 1(negotiation) header message */
- status = axis2_ntlm_auth_create_type1_message(ntlm, env, &encoded_message, elen, uname,
- passwd, flags, domain);
- if(status != AXIS2_SUCCESS)
- {
- if(encoded_message)
- {
- AXIS2_FREE(env->allocator, encoded_message);
- encoded_message = NULL;
- }
- if(ntlm)
- {
- axis2_ntlm_free(ntlm, env);
- }
- AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
- "axis2_ntlm_auth_create_type1_message call failed");
- return status;
- }
- }
- else /* NTLM challange received */
- {
- /* Create Type3 (authentication) header message */
- status = axis2_ntlm_auth_create_type3_message(ntlm, env, header_data, &encoded_message,
- elen, uname, passwd, domain, workstation);
- if(status != AXIS2_SUCCESS)
- {
- if(encoded_message)
- {
- AXIS2_FREE(env->allocator, encoded_message);
- encoded_message = NULL;
- }
- if(ntlm)
- {
- axis2_ntlm_free(ntlm, env);
- }
- AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
- "axis2_ntlm_auth_create_type3_message call failed");
- return status;
- }
- }
- auth_str
- = (axis2_char_t *)(AXIS2_MALLOC(env->allocator, sizeof(axis2_char_t) * (*elen + 6)));
- sprintf(auth_str, "%s %s", AXIS2_HTTP_AUTH_TYPE_NTLM, encoded_message);
- tmp_header = axis2_http_simple_request_get_first_header(request, env,
- AXIS2_HTTP_HEADER_AUTHORIZATION);
- if(tmp_header)
- {
- axis2_char_t *tmp_header_val = axis2_http_header_get_value(tmp_header, env);
- if(tmp_header_val)
- {
- axis2_http_header_set_value(tmp_header, env, auth_str);
- }
- }
- else
- {
- axis2_http_sender_util_add_header(env, request, AXIS2_HTTP_HEADER_AUTHORIZATION, auth_str);
- }
-
- AXIS2_FREE(env->allocator, encoded_message);
- encoded_message = NULL;
- axis2_ntlm_free(ntlm, env);
- AXIS2_FREE(env->allocator, auth_str);
- auth_str = NULL;
-
- return AXIS2_SUCCESS;
- }
- return AXIS2_FAILURE;
-#endif
-} /* configure_proxy_ntlm_auth */
+/* NTLM proxy authentication removed - see security note at top of file */
#endif
@@ -3351,8 +2953,7 @@ axis2_http_sender_configure_http_auth(
auth_type = http_auth_type_property_value;
}
}
- if(!force_http_auth || axutil_strcasecmp(auth_type, AXIS2_HTTP_AUTH_TYPE_DIGEST) == 0 ||
- axutil_strcasecmp(auth_type, AXIS2_HTTP_AUTH_TYPE_NTLM) == 0)
+ if(!force_http_auth || axutil_strcasecmp(auth_type, AXIS2_HTTP_AUTH_TYPE_DIGEST) == 0)
{
axis2_http_header_t *auth_header = NULL;
axis2_http_simple_response_t *response = NULL;
@@ -3380,8 +2981,7 @@ axis2_http_sender_configure_http_auth(
/*Read the realm and the rest stuff now from auth_type_end */
}
}
- if(force_http_auth && (axutil_strcasecmp(auth_type, AXIS2_HTTP_AUTH_TYPE_DIGEST) != 0 &&
- axutil_strcasecmp(auth_type, AXIS2_HTTP_AUTH_TYPE_NTLM) != 0))
+ if(force_http_auth && axutil_strcasecmp(auth_type, AXIS2_HTTP_AUTH_TYPE_DIGEST) != 0)
{
auth_type = NULL;
}
@@ -3397,15 +2997,11 @@ axis2_http_sender_configure_http_auth(
status = axis2_http_sender_configure_http_digest_auth(sender, env, msg_ctx, request,
auth_type_end);
}
- else if(axutil_strcasecmp(auth_type, AXIS2_HTTP_AUTH_TYPE_NTLM) == 0)
- {
- status = axis2_http_sender_configure_http_ntlm_auth(sender, env, msg_ctx, request,
- auth_type_end);
- }
else
{
- AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Authtype %s is not"
- "supported", auth_type);
+ /* NTLM support removed - use Kerberos, OAuth 2.0, or mTLS instead */
+ AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Authtype %s is not "
+ "supported (NTLM has been removed for security reasons)", auth_type);
}
}
else
@@ -3503,14 +3099,11 @@ axis2_http_sender_configure_proxy_auth(
status = axis2_http_sender_configure_proxy_digest_auth(sender, env, msg_ctx, request,
auth_type_end);
}
- else if(axutil_strcasecmp(auth_type, AXIS2_PROXY_AUTH_TYPE_NTLM) == 0)
- {
- status = axis2_http_sender_configure_proxy_ntlm_auth(sender, env, msg_ctx, request,
- auth_type_end);
- }
else
{
- AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Authtype %s is not supported", auth_type);
+ /* NTLM support removed - use Kerberos, OAuth 2.0, or mTLS instead */
+ AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Authtype %s is not supported "
+ "(NTLM has been removed for security reasons)", auth_type);
}
}
else
@@ -3570,13 +3163,11 @@ axis2_http_sender_set_http_auth_type(
{
status = axis2_msg_ctx_set_auth_type(msg_ctx, env, AXIS2_HTTP_AUTH_TYPE_DIGEST);
}
- if(axutil_strcasecmp(auth_type, AXIS2_HTTP_AUTH_TYPE_NTLM) == 0)
- {
- status = axis2_msg_ctx_set_auth_type(msg_ctx, env, AXIS2_HTTP_AUTH_TYPE_NTLM);
- }
else
{
- AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Authtype %s is not supported", auth_type);
+ /* NTLM support removed - use Kerberos, OAuth 2.0, or mTLS instead */
+ AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Authtype %s is not supported "
+ "(NTLM has been removed for security reasons)", auth_type);
}
}
else
@@ -3636,13 +3227,11 @@ axis2_http_sender_set_proxy_auth_type(
{
status = axis2_msg_ctx_set_auth_type(msg_ctx, env, AXIS2_PROXY_AUTH_TYPE_DIGEST);
}
- else if(axutil_strcasecmp(auth_type, AXIS2_PROXY_AUTH_TYPE_NTLM) == 0)
- {
- status = axis2_msg_ctx_set_auth_type(msg_ctx, env, AXIS2_PROXY_AUTH_TYPE_NTLM);
- }
else
{
- AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Authtype %s is not supported", auth_type);
+ /* NTLM support removed - use Kerberos, OAuth 2.0, or mTLS instead */
+ AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Authtype %s is not supported "
+ "(NTLM has been removed for security reasons)", auth_type);
}
}
else