File indexing completed on 2025-03-16 10:02:23

 /*
     This file is part of the KDE libraries
     SPDX-FileCopyrightText: 2008, 2009 Andreas Hartmetz <ahartmetz@gmail.com>
 
     SPDX-License-Identifier: LGPL-2.0-or-later
 */
 
 #ifndef HTTPAUTHENTICATION_H
 #define HTTPAUTHENTICATION_H
 
 #include <config-gssapi.h>
 
 #include <QByteArray>
 #include <QList>
 #include <QString>
 #include <QUrl>
 
 #include <QLoggingCategory>
 Q_DECLARE_LOGGING_CATEGORY(KIO_HTTP_AUTH)
 
 namespace KIO
 {
 class AuthInfo;
 }
 
 class KConfigGroup;
 
 class KAbstractHttpAuthentication
 {
 public:
     explicit KAbstractHttpAuthentication(KConfigGroup *config = nullptr);
     virtual ~KAbstractHttpAuthentication();
 
     /**
      * Choose the best authentication mechanism from the offered ones
      *
      * This will return the most secure mechanism from the list of
      * mechanisms returned by the server.
      */
     static QByteArray bestOffer(const QList<QByteArray> &offers);
 
     /**
      * Returns authentication object instance appropriate for @p offer.
      *
      * @param offer   the header from which an authentication object is created.
      * @param config  the config object to read stored authentication information.
      */
     static KAbstractHttpAuthentication *newAuth(const QByteArray &offer, KConfigGroup *config = nullptr);
 
     /**
      * Split all headers containing multiple authentication offers.
      *
      * @param offers the offers from multiple HTTP authentication header lines.
      * @return a list where each entry contains only a single offer
      */
     static QList<QByteArray> splitOffers(const QList<QByteArray> &offers);
 
     /**
      * reset to state after default construction.
      */
     void reset();
     /**
      * the authentication scheme: "Negotiate", "Digest", "Basic", "NTLM"
      */
     virtual QByteArray scheme() const = 0;
     /**
      * initiate authentication with challenge string (from HTTP header)
      */
     virtual void setChallenge(const QByteArray &c, const QUrl &resource, const QByteArray &httpMethod);
     /**
      * return value updated by setChallenge()
      *
      * if this is false user and password passed to generateResponse
      * will be ignored and may be empty.
      */
     bool needCredentials() const
     {
         return m_needCredentials;
     }
     /**
      * KIO compatible data to find cached credentials.
      *
      * Note that username and/or password as well as UI text will NOT be filled in.
      */
     virtual void fillKioAuthInfo(KIO::AuthInfo *ai) const = 0;
     /**
      * what to do in response to challenge
      */
     virtual void generateResponse(const QString &user, const QString &password) = 0;
 
     /**
      * returns true when the final stage of authentication is reached.
      *
      * Unless the authentication scheme requires multiple stages like NTLM this
      * function will always return true.
      */
     bool wasFinalStage() const
     {
         return m_finalAuthStage;
     }
     /**
      * Returns true if the authentication scheme supports path matching to identify
      * resources that belong to the same protection space (realm).
      *
      * See RFC 2617.
      */
     virtual bool supportsPathMatching() const
     {
         return false;
     }
 
     // the following accessors return useful data after generateResponse() has been called.
     // clients process the following fields top to bottom: highest priority is on top
 
     // malformed challenge and similar problems - it is advisable to reconnect
     bool isError() const
     {
         return m_isError;
     }
     /**
      * force keep-alive connection because the authentication method requires it
      */
     bool forceKeepAlive() const
     {
         return m_forceKeepAlive;
     }
     /**
      * force disconnection because the authentication method requires it
      */
     bool forceDisconnect() const
     {
         return m_forceDisconnect;
     }
 
     /**
      * insert this into the next request header after "Authorization: "
      * or "Proxy-Authorization: "
      */
     QByteArray headerFragment() const
     {
         return m_headerFragment;
     }
     /**
      * Returns the realm sent by the server.
      *
      * This is mainly for GUI shown to the user. This is the identification of
      * the protected area on the server (e.g. "Konquis home directory" or
      * "KDE files").
      */
     QString realm() const;
 
     /**
      * Sets the cache password flag to @p enable.
      */
     void setCachePasswordEnabled(bool enable)
     {
         m_keepPassword = enable;
     }
 
 #ifdef ENABLE_HTTP_AUTH_NONCE_SETTER
     // NOTE: FOR USE in unit testing ONLY.
     virtual void setDigestNonceValue(const QByteArray &)
     {
     }
 #endif
 
 protected:
     void authInfoBoilerplate(KIO::AuthInfo *a) const;
     /**
      * Returns any authentication data that should be cached for future use.
      *
      * NOTE: Do not reimplement this function for connection based authentication
      * schemes such as NTLM.
      */
     virtual QByteArray authDataToCache() const
     {
         return QByteArray();
     }
     void generateResponseCommon(const QString &user, const QString &password);
 
     KConfigGroup *m_config;
     QByteArray m_scheme; ///< this is parsed from the header and not necessarily == scheme().
     QByteArray m_challengeText;
     QList<QByteArray> m_challenge;
     QUrl m_resource;
     QByteArray m_httpMethod;
 
     bool m_isError;
     bool m_needCredentials;
     bool m_forceKeepAlive;
     bool m_forceDisconnect;
     bool m_finalAuthStage;
     bool m_keepPassword;
     QByteArray m_headerFragment;
 
     QString m_username;
     QString m_password;
 };
 
 class KHttpBasicAuthentication : public KAbstractHttpAuthentication
 {
 public:
     QByteArray scheme() const override;
     void fillKioAuthInfo(KIO::AuthInfo *ai) const override;
     void generateResponse(const QString &user, const QString &password) override;
     bool supportsPathMatching() const override
     {
         return true;
     }
 
 protected:
     QByteArray authDataToCache() const override
     {
         return m_challengeText;
     }
 
 private:
     friend class KAbstractHttpAuthentication;
     KHttpBasicAuthentication(KConfigGroup *config = nullptr)
         : KAbstractHttpAuthentication(config)
     {
     }
 };
 
 class KHttpDigestAuthentication : public KAbstractHttpAuthentication
 {
 public:
     QByteArray scheme() const override;
     void setChallenge(const QByteArray &c, const QUrl &resource, const QByteArray &httpMethod) override;
     void fillKioAuthInfo(KIO::AuthInfo *ai) const override;
     void generateResponse(const QString &user, const QString &password) override;
     bool supportsPathMatching() const override
     {
         return true;
     }
 #ifdef ENABLE_HTTP_AUTH_NONCE_SETTER
     void setDigestNonceValue(const QByteArray &) override;
 #endif
 
 protected:
     QByteArray authDataToCache() const override
     {
         return m_challengeText;
     }
 
 private:
     friend class KAbstractHttpAuthentication;
     KHttpDigestAuthentication(KConfigGroup *config = nullptr)
         : KAbstractHttpAuthentication(config)
     {
     }
 #ifdef ENABLE_HTTP_AUTH_NONCE_SETTER
     QByteArray m_nonce;
 #endif
 };
 
 class KHttpNtlmAuthentication : public KAbstractHttpAuthentication
 {
 public:
     QByteArray scheme() const override;
     void setChallenge(const QByteArray &c, const QUrl &resource, const QByteArray &httpMethod) override;
     void fillKioAuthInfo(KIO::AuthInfo *ai) const override;
     void generateResponse(const QString &user, const QString &password) override;
 
 private:
     friend class KAbstractHttpAuthentication;
     explicit KHttpNtlmAuthentication(KConfigGroup *config = nullptr)
         : KAbstractHttpAuthentication(config)
         , m_stage1State(Init)
     {
     }
     enum Stage1State {
         Init = 0,
         SentNTLMv1,
         SentNTLMv2,
     };
     Stage1State m_stage1State;
 };
 
 #if HAVE_LIBGSSAPI
 class KHttpNegotiateAuthentication : public KAbstractHttpAuthentication
 {
 public:
     QByteArray scheme() const override;
     void setChallenge(const QByteArray &c, const QUrl &resource, const QByteArray &httpMethod) override;
     void fillKioAuthInfo(KIO::AuthInfo *ai) const override;
     void generateResponse(const QString &user, const QString &password) override;
 
 private:
     friend class KAbstractHttpAuthentication;
     explicit KHttpNegotiateAuthentication(KConfigGroup *config = nullptr)
         : KAbstractHttpAuthentication(config)
     {
     }
 };
 #endif // HAVE_LIBGSSAPI
 
 #endif // HTTPAUTHENTICATION_H