--- /dev/null
+/*\r
+ * OpenVPN -- An application to securely tunnel IP networks\r
+ * over a single TCP/UDP port, with support for SSL/TLS-based\r
+ * session authentication and key exchange,\r
+ * packet encryption, packet authentication, and\r
+ * packet compression.\r
+ *\r
+ * Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>\r
+ *\r
+ * This program is free software; you can redistribute it and/or modify\r
+ * it under the terms of the GNU General Public License version 2\r
+ * as published by the Free Software Foundation.\r
+ *\r
+ * This program is distributed in the hope that it will be useful,\r
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of\r
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\r
+ * GNU General Public License for more details.\r
+ *\r
+ * You should have received a copy of the GNU General Public License\r
+ * along with this program (see the file COPYING included with this\r
+ * distribution); if not, write to the Free Software Foundation, Inc.,\r
+ * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA\r
+ */\r
+\r
+#include "syshead.h"\r
+\r
+#if PROXY_DIGEST_AUTH\r
+\r
+#include "crypto.h"\r
+#include "httpdigest.h"\r
+\r
+static void\r
+CvtHex(\r
+ IN HASH Bin,\r
+ OUT HASHHEX Hex\r
+ )\r
+{\r
+ unsigned short i;\r
+ unsigned char j;\r
+\r
+ for (i = 0; i < HASHLEN; i++) {\r
+ j = (Bin[i] >> 4) & 0xf;\r
+ if (j <= 9)\r
+ Hex[i*2] = (j + '0');\r
+ else\r
+ Hex[i*2] = (j + 'a' - 10);\r
+ j = Bin[i] & 0xf;\r
+ if (j <= 9)\r
+ Hex[i*2+1] = (j + '0');\r
+ else\r
+ Hex[i*2+1] = (j + 'a' - 10);\r
+ };\r
+ Hex[HASHHEXLEN] = '\0';\r
+};\r
+\r
+/* calculate H(A1) as per spec */\r
+void\r
+DigestCalcHA1(\r
+ IN char * pszAlg,\r
+ IN char * pszUserName,\r
+ IN char * pszRealm,\r
+ IN char * pszPassword,\r
+ IN char * pszNonce,\r
+ IN char * pszCNonce,\r
+ OUT HASHHEX SessionKey\r
+ )\r
+{\r
+ MD5_CTX Md5Ctx;\r
+ HASH HA1;\r
+\r
+ MD5_Init(&Md5Ctx);\r
+ MD5_Update(&Md5Ctx, pszUserName, strlen(pszUserName));\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ MD5_Update(&Md5Ctx, pszRealm, strlen(pszRealm));\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ MD5_Update(&Md5Ctx, pszPassword, strlen(pszPassword));\r
+ MD5_Final(HA1, &Md5Ctx);\r
+ if (pszAlg && stricmp(pszAlg, "md5-sess") == 0)\r
+ {\r
+ MD5_Init(&Md5Ctx);\r
+ MD5_Update(&Md5Ctx, HA1, HASHLEN);\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ MD5_Update(&Md5Ctx, pszNonce, strlen(pszNonce));\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ MD5_Update(&Md5Ctx, pszCNonce, strlen(pszCNonce));\r
+ MD5_Final(HA1, &Md5Ctx);\r
+ };\r
+ CvtHex(HA1, SessionKey);\r
+}\r
+\r
+/* calculate request-digest/response-digest as per HTTP Digest spec */\r
+void\r
+DigestCalcResponse(\r
+ IN HASHHEX HA1, /* H(A1) */\r
+ IN char * pszNonce, /* nonce from server */\r
+ IN char * pszNonceCount, /* 8 hex digits */\r
+ IN char * pszCNonce, /* client nonce */\r
+ IN char * pszQop, /* qop-value: "", "auth", "auth-int" */\r
+ IN char * pszMethod, /* method from the request */\r
+ IN char * pszDigestUri, /* requested URL */\r
+ IN HASHHEX HEntity, /* H(entity body) if qop="auth-int" */\r
+ OUT HASHHEX Response /* request-digest or response-digest */\r
+ )\r
+{\r
+ MD5_CTX Md5Ctx;\r
+ HASH HA2;\r
+ HASH RespHash;\r
+ HASHHEX HA2Hex;\r
+\r
+ // calculate H(A2)\r
+ MD5_Init(&Md5Ctx);\r
+ MD5_Update(&Md5Ctx, pszMethod, strlen(pszMethod));\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ MD5_Update(&Md5Ctx, pszDigestUri, strlen(pszDigestUri));\r
+ if (stricmp(pszQop, "auth-int") == 0)\r
+ {\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ MD5_Update(&Md5Ctx, HEntity, HASHHEXLEN);\r
+ };\r
+ MD5_Final(HA2, &Md5Ctx);\r
+ CvtHex(HA2, HA2Hex);\r
+\r
+ // calculate response\r
+ MD5_Init(&Md5Ctx);\r
+ MD5_Update(&Md5Ctx, HA1, HASHHEXLEN);\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ MD5_Update(&Md5Ctx, pszNonce, strlen(pszNonce));\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ if (*pszQop)\r
+ {\r
+ MD5_Update(&Md5Ctx, pszNonceCount, strlen(pszNonceCount));\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ MD5_Update(&Md5Ctx, pszCNonce, strlen(pszCNonce));\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ MD5_Update(&Md5Ctx, pszQop, strlen(pszQop));\r
+ MD5_Update(&Md5Ctx, ":", 1);\r
+ };\r
+ MD5_Update(&Md5Ctx, HA2Hex, HASHHEXLEN);\r
+ MD5_Final(RespHash, &Md5Ctx);\r
+ CvtHex(RespHash, Response);\r
+}\r
+\r
+#endif\r
#include "common.h"
#include "misc.h"
+#include "crypto.h"
#include "win32.h"
#include "socket.h"
#include "fdmisc.h"
#include "proxy.h"
#include "base64.h"
+#include "httpdigest.h"
#include "ntlm.h"
#ifdef WIN32
p->up = static_proxy_user_pass;
}
}
+static void
+clear_user_pass_http (void)
+{
+ purge_user_pass (&static_proxy_user_pass, true);
+}
+
+static void
+dump_residual (socket_descriptor_t sd,
+ int timeout,
+ volatile int *signal_received)
+{
+ char buf[256];
+ while (true)
+ {
+ if (!recv_line (sd, buf, sizeof (buf), timeout, true, NULL, signal_received))
+ return;
+ chomp (buf);
+ msg (D_PROXY, "PROXY HEADER: '%s'", buf);
+ }
+}
+
+/*
+ * Extract the Proxy-Authenticate header from the stream.
+ * Consumes all headers.
+ */
+static int
+get_proxy_authenticate (socket_descriptor_t sd,
+ int timeout,
+ char **data,
+ struct gc_arena *gc,
+ volatile int *signal_received)
+{
+ char buf[256];
+ int ret = HTTP_AUTH_NONE;
+ while (true)
+ {
+ if (!recv_line (sd, buf, sizeof (buf), timeout, true, NULL, signal_received))
+ {
+ *data = NULL;
+ return HTTP_AUTH_NONE;
+ }
+ chomp (buf);
+ if (!strlen(buf))
+ return ret;
+ if (ret == HTTP_AUTH_NONE && !strncmp(buf, "Proxy-Authenticate: ", 20))
+ {
+ if (!strncmp(buf+20, "Basic ", 6))
+ {
+ msg (D_PROXY, "PROXY AUTH BASIC: '%s'", buf);
+ *data = string_alloc(buf+26, gc);
+ ret = HTTP_AUTH_BASIC;
+ }
+#if PROXY_DIGEST_AUTH
+ else if (!strncmp(buf+20, "Digest ", 7))
+ {
+ msg (D_PROXY, "PROXY AUTH DIGEST: '%s'", buf);
+ *data = string_alloc(buf+27, gc);
+ ret = HTTP_AUTH_DIGEST;
+ }
+#endif
+#if NTLM
+ else if (!strncmp(buf+20, "NTLM", 4))
+ {
+ msg (D_PROXY, "PROXY AUTH HTLM: '%s'", buf);
+ *data = NULL;
+ ret = HTTP_AUTH_NTLM;
+ }
+#endif
+ }
+ }
+}
+
+static void
+store_proxy_authenticate (struct http_proxy_info *p, char *data)
+{
+ if (p->proxy_authenticate)
+ free (p->proxy_authenticate);
+ p->proxy_authenticate = data;
+}
+
+/*
+ * Parse out key/value pairs from Proxy-Authenticate string.
+ * Return true on success, or false on parse failure.
+ */
+static bool
+get_key_value(const char *str, /* source string */
+ char *key, /* key stored here */
+ char *value, /* value stored here */
+ int max_key_len,
+ int max_value_len,
+ const char **endptr) /* next search position */
+{
+ int c;
+ bool starts_with_quote = false;
+ bool escape = false;
+
+ for (c = max_key_len-1; (*str && (*str != '=') && c--); )
+ *key++ = *str++;
+ *key = '\0';
+
+ if('=' != *str++)
+ /* no key/value found */
+ return false;
+
+ if('\"' == *str)
+ {
+ /* quoted string */
+ str++;
+ starts_with_quote = true;
+ }
+
+ for (c = max_value_len-1; *str && c--; str++)
+ {
+ switch (*str)
+ {
+ case '\\':
+ if (!escape)
+ {
+ /* possibly the start of an escaped quote */
+ escape = true;
+ *value++ = '\\'; /* even though this is an escape character, we still
+ store it as-is in the target buffer */
+ continue;
+ }
+ break;
+ case ',':
+ if (!starts_with_quote)
+ {
+ /* this signals the end of the value if we didn't get a starting quote
+ and then we do "sloppy" parsing */
+ c=0; /* the end */
+ continue;
+ }
+ break;
+ case '\r':
+ case '\n':
+ /* end of string */
+ c=0;
+ continue;
+ case '\"':
+ if (!escape && starts_with_quote)
+ {
+ /* end of string */
+ c=0;
+ continue;
+ }
+ break;
+ }
+ escape = false;
+ *value++ = *str;
+ }
+ *value = '\0';
+
+ *endptr = str;
+
+ return true; /* success */
+}
+
+static char *
+get_pa_var (const char *key, const char *pa, struct gc_arena *gc)
+{
+ char k[64];
+ char v[256];
+ const char *content = pa;
+
+ while (true)
+ {
+ const int status = get_key_value(content, k, v, sizeof(k), sizeof(v), &content);
+ if (status)
+ {
+ if (!strcmp(key, k))
+ return string_alloc(v, gc);
+ }
+ else
+ return NULL;
+
+ /* advance to start of next key */
+ if (*content == ',')
+ ++content;
+ while (*content && isspace(*content))
+ ++content;
+ }
+}
struct http_proxy_info *
http_proxy_new (const struct http_proxy_options *o,
opt.server = auto_proxy_info->http.server;
opt.port = auto_proxy_info->http.port;
- opt.auth_retry = true;
+ if (!opt.auth_retry)
+ opt.auth_retry = PAR_ALL;
o = &opt;
}
p->auth_method = HTTP_AUTH_NONE;
else if (!strcmp (o->auth_method_string, "basic"))
p->auth_method = HTTP_AUTH_BASIC;
+#if NTLM
else if (!strcmp (o->auth_method_string, "ntlm"))
p->auth_method = HTTP_AUTH_NTLM;
else if (!strcmp (o->auth_method_string, "ntlm2"))
p->auth_method = HTTP_AUTH_NTLM2;
+#endif
else
- msg (M_FATAL, "ERROR: unknown HTTP authentication method: '%s' -- only the 'none', 'basic', 'ntlm', or 'ntlm2' methods are currently supported",
+ msg (M_FATAL, "ERROR: unknown HTTP authentication method: '%s'",
o->auth_method_string);
}
volatile int *signal_received)
{
struct gc_arena gc = gc_new ();
- char buf[256];
+ char buf[512];
char buf2[128];
char get[80];
int status;
int nparms;
bool ret = false;
+ bool processed = false;
/* get user/pass if not previously given or if --auto-proxy is being used */
if (p->auth_method == HTTP_AUTH_BASIC
+ || p->auth_method == HTTP_AUTH_DIGEST
|| p->auth_method == HTTP_AUTH_NTLM)
get_user_pass_http (p, false);
- /* format HTTP CONNECT message */
- openvpn_snprintf (buf, sizeof(buf), "CONNECT %s:%d HTTP/%s",
- host,
- port,
- p->options.http_version);
-
- msg (D_PROXY, "Send to HTTP proxy: '%s'", buf);
-
- /* send HTTP CONNECT message to proxy */
- if (!send_line_crlf (sd, buf))
- goto error;
-
- /* send User-Agent string if provided */
- if (p->options.user_agent)
+ /* are we being called again after getting the digest server nonce in the previous transaction? */
+ if (p->auth_method == HTTP_AUTH_DIGEST && p->proxy_authenticate)
{
- openvpn_snprintf (buf, sizeof(buf), "User-Agent: %s",
- p->options.user_agent);
- if (!send_line_crlf (sd, buf))
- goto error;
+ nparms = 1;
+ status = 407;
}
-
- /* auth specified? */
- switch (p->auth_method)
+ else
{
- case HTTP_AUTH_NONE:
- break;
+ /* format HTTP CONNECT message */
+ openvpn_snprintf (buf, sizeof(buf), "CONNECT %s:%d HTTP/%s",
+ host,
+ port,
+ p->options.http_version);
- case HTTP_AUTH_BASIC:
- openvpn_snprintf (buf, sizeof(buf), "Proxy-Authorization: Basic %s",
- username_password_as_base64 (p, &gc));
- msg (D_PROXY, "Attempting Basic Proxy-Authorization");
- dmsg (D_SHOW_KEYS, "Send to HTTP proxy: '%s'", buf);
- openvpn_sleep (1);
+ msg (D_PROXY, "Send to HTTP proxy: '%s'", buf);
+
+ /* send HTTP CONNECT message to proxy */
if (!send_line_crlf (sd, buf))
goto error;
- break;
+
+ /* send User-Agent string if provided */
+ if (p->options.user_agent)
+ {
+ openvpn_snprintf (buf, sizeof(buf), "User-Agent: %s",
+ p->options.user_agent);
+ if (!send_line_crlf (sd, buf))
+ goto error;
+ }
+
+ /* auth specified? */
+ switch (p->auth_method)
+ {
+ case HTTP_AUTH_NONE:
+ break;
+
+ case HTTP_AUTH_BASIC:
+ openvpn_snprintf (buf, sizeof(buf), "Proxy-Authorization: Basic %s",
+ username_password_as_base64 (p, &gc));
+ msg (D_PROXY, "Attempting Basic Proxy-Authorization");
+ dmsg (D_SHOW_KEYS, "Send to HTTP proxy: '%s'", buf);
+ if (!send_line_crlf (sd, buf))
+ goto error;
+ break;
#if NTLM
- case HTTP_AUTH_NTLM:
- case HTTP_AUTH_NTLM2:
- /* keep-alive connection */
- openvpn_snprintf (buf, sizeof(buf), "Proxy-Connection: Keep-Alive");
- if (!send_line_crlf (sd, buf))
- goto error;
+ case HTTP_AUTH_NTLM:
+ case HTTP_AUTH_NTLM2:
+ /* keep-alive connection */
+ openvpn_snprintf (buf, sizeof(buf), "Proxy-Connection: Keep-Alive");
+ if (!send_line_crlf (sd, buf))
+ goto error;
- openvpn_snprintf (buf, sizeof(buf), "Proxy-Authorization: NTLM %s",
- ntlm_phase_1 (p, &gc));
- msg (D_PROXY, "Attempting NTLM Proxy-Authorization phase 1");
- dmsg (D_SHOW_KEYS, "Send to HTTP proxy: '%s'", buf);
- openvpn_sleep (1);
- if (!send_line_crlf (sd, buf))
- goto error;
- break;
+ openvpn_snprintf (buf, sizeof(buf), "Proxy-Authorization: NTLM %s",
+ ntlm_phase_1 (p, &gc));
+ msg (D_PROXY, "Attempting NTLM Proxy-Authorization phase 1");
+ dmsg (D_SHOW_KEYS, "Send to HTTP proxy: '%s'", buf);
+ if (!send_line_crlf (sd, buf))
+ goto error;
+ break;
#endif
- default:
- ASSERT (0);
- }
+ default:
+ ASSERT (0);
+ }
- /* send empty CR, LF */
- openvpn_sleep (1);
- if (!send_crlf (sd))
- goto error;
+ /* send empty CR, LF */
+ if (!send_crlf (sd))
+ goto error;
- /* receive reply from proxy */
- if (!recv_line (sd, buf, sizeof(buf), p->options.timeout, true, NULL, signal_received))
- goto error;
+ /* receive reply from proxy */
+ if (!recv_line (sd, buf, sizeof(buf), p->options.timeout, true, NULL, signal_received))
+ goto error;
+
+ /* remove trailing CR, LF */
+ chomp (buf);
- /* remove trailing CR, LF */
- chomp (buf);
+ msg (D_PROXY, "HTTP proxy returned: '%s'", buf);
- msg (D_PROXY, "HTTP proxy returned: '%s'", buf);
+ /* parse return string */
+ nparms = sscanf (buf, "%*s %d", &status);
- /* parse return string */
- nparms = sscanf (buf, "%*s %d", &status);
+ }
/* check for a "407 Proxy Authentication Required" response */
- if (nparms >= 1 && status == 407)
+ while (nparms >= 1 && status == 407)
{
msg (D_PROXY, "Proxy requires authentication");
/* check for NTLM */
- if (p->auth_method == HTTP_AUTH_NTLM || p->auth_method == HTTP_AUTH_NTLM2)
+ if ((p->auth_method == HTTP_AUTH_NTLM || p->auth_method == HTTP_AUTH_NTLM2) && !processed)
{
#if NTLM
/* look for the phase 2 response */
msg (D_PROXY, "Received NTLM Proxy-Authorization phase 2 response");
/* receive and discard everything else */
- while (recv_line (sd, NULL, 0, p->options.timeout, true, NULL, signal_received))
+ while (recv_line (sd, NULL, 0, 2, true, NULL, signal_received))
;
/* now send the phase 3 reply */
/* send HOST etc, */
- openvpn_sleep (1);
openvpn_snprintf (buf, sizeof(buf), "Host: %s", host);
msg (D_PROXY, "Send to HTTP proxy: '%s'", buf);
if (!send_line_crlf (sd, buf))
}
msg (D_PROXY, "Send to HTTP proxy: '%s'", buf);
- openvpn_sleep (1);
if (!send_line_crlf (sd, buf))
goto error;
/* ok so far... */
/* send empty CR, LF */
- openvpn_sleep (1);
if (!send_crlf (sd))
goto error;
/* parse return string */
nparms = sscanf (buf, "%*s %d", &status);
-#else
- ASSERT (0); /* No NTLM support */
+ processed = true;
#endif
}
- else if (p->auth_method == HTTP_AUTH_NONE && p->options.auth_retry)
+#if PROXY_DIGEST_AUTH
+ else if (p->auth_method == HTTP_AUTH_DIGEST && !processed)
+ {
+ char *pa = p->proxy_authenticate;
+ const int method = p->auth_method;
+ ASSERT(pa);
+
+ if (method == HTTP_AUTH_DIGEST)
+ {
+ const char *http_method = "CONNECT";
+ const char *nonce_count = "00000001";
+ const char *qop = "auth";
+ const char *username = p->up.username;
+ const char *password = p->up.password;
+ char *opaque_kv = "";
+ char uri[128];
+ uint8_t cnonce_raw[8];
+ uint8_t *cnonce;
+ HASHHEX session_key;
+ HASHHEX response;
+
+ const char *realm = get_pa_var("realm", pa, &gc);
+ const char *nonce = get_pa_var("nonce", pa, &gc);
+ const char *algor = get_pa_var("algorithm", pa, &gc);
+ const char *opaque = get_pa_var("opaque", pa, &gc);
+
+ /* generate a client nonce */
+ ASSERT(RAND_bytes(cnonce_raw, sizeof(cnonce_raw)));
+ cnonce = make_base64_string2(cnonce_raw, sizeof(cnonce_raw), &gc);
+
+
+ /* build the digest response */
+ openvpn_snprintf (uri, sizeof(uri), "%s:%d",
+ host,
+ port);
+
+ if (opaque)
+ {
+ const int len = strlen(opaque)+16;
+ opaque_kv = gc_malloc(len, false, &gc);
+ openvpn_snprintf (opaque_kv, len, ", opaque=\"%s\"", opaque);
+ }
+
+ DigestCalcHA1(algor,
+ username,
+ realm,
+ password,
+ nonce,
+ cnonce,
+ session_key);
+ DigestCalcResponse(session_key,
+ nonce,
+ nonce_count,
+ cnonce,
+ qop,
+ http_method,
+ uri,
+ NULL,
+ response);
+
+ /* format HTTP CONNECT message */
+ openvpn_snprintf (buf, sizeof(buf), "%s %s HTTP/%s",
+ http_method,
+ uri,
+ p->options.http_version);
+
+ msg (D_PROXY, "Send to HTTP proxy: '%s'", buf);
+
+ /* send HTTP CONNECT message to proxy */
+ if (!send_line_crlf (sd, buf))
+ goto error;
+
+ /* send HOST etc, */
+ openvpn_snprintf (buf, sizeof(buf), "Host: %s", host);
+ msg (D_PROXY, "Send to HTTP proxy: '%s'", buf);
+ if (!send_line_crlf (sd, buf))
+ goto error;
+
+ /* send digest response */
+ openvpn_snprintf (buf, sizeof(buf), "Proxy-Authorization: Digest username=\"%s\", realm=\"%s\", nonce=\"%s\", uri=\"%s\", qop=%s, nc=%s, cnonce=\"%s\", response=\"%s\"%s",
+ username,
+ realm,
+ nonce,
+ uri,
+ qop,
+ nonce_count,
+ cnonce,
+ response,
+ opaque_kv
+ );
+ msg (D_PROXY, "Send to HTTP proxy: '%s'", buf);
+ if (!send_line_crlf (sd, buf))
+ goto error;
+ if (!send_crlf (sd))
+ goto error;
+
+ /* receive reply from proxy */
+ if (!recv_line (sd, buf, sizeof(buf), p->options.timeout, true, NULL, signal_received))
+ goto error;
+
+ /* remove trailing CR, LF */
+ chomp (buf);
+
+ msg (D_PROXY, "HTTP proxy returned: '%s'", buf);
+
+ /* parse return string */
+ nparms = sscanf (buf, "%*s %d", &status);
+ processed = true;
+ }
+ else
+ {
+ msg (D_PROXY, "HTTP proxy: digest method not supported");
+ goto error;
+ }
+ }
+#endif
+ else if (p->options.auth_retry)
{
- /*
- * Proxy needs authentication, but we don't have a user/pass.
- * Now we will change p->auth_method and return true so that
- * our caller knows to call us again on a newly opened socket.
- * JYFIXME: This code needs to check proxy error output and set
- * JYFIXME: p->auth_method = HTTP_AUTH_NTLM if necessary.
- */
- p->auth_method = HTTP_AUTH_BASIC;
- ret = true;
- goto done;
+ /* figure out what kind of authentication the proxy needs */
+ char *pa = NULL;
+ const int method = get_proxy_authenticate(sd,
+ p->options.timeout,
+ &pa,
+ NULL,
+ signal_received);
+ if (method != HTTP_AUTH_NONE)
+ {
+ if (pa)
+ msg (D_PROXY, "HTTP proxy authenticate '%s'", pa);
+ if (p->options.auth_retry == PAR_NCT && method == HTTP_AUTH_BASIC)
+ {
+ msg (D_PROXY, "HTTP proxy: support for basic auth and other cleartext proxy auth methods is disabled");
+ goto error;
+ }
+ p->auth_method = method;
+ store_proxy_authenticate(p, pa);
+ ret = true;
+ goto done;
+ }
+ else
+ {
+ msg (D_PROXY, "HTTP proxy: do not recognize the authentication method required by proxy");
+ free (pa);
+ goto error;
+ }
}
else
- goto error;
- }
+ {
+ if (!processed)
+ msg (D_PROXY, "HTTP proxy: no support for proxy authentication method");
+ goto error;
+ }
+ /* clear state */
+ if (p->options.auth_retry)
+ clear_user_pass_http();
+ store_proxy_authenticate(p, NULL);
+ }
/* check return code, success = 200 */
if (nparms < 1 || status != 200)
msg (D_LINK_ERRORS, "HTTP proxy returned bad status");
#if 0
/* DEBUGGING -- show a multi-line HTTP error response */
- while (true)
- {
- if (!recv_line (sd, buf, sizeof (buf), p->options.timeout, true, NULL, signal_received))
- goto error;
- chomp (buf);
- msg (D_PROXY, "HTTP proxy returned: '%s'", buf);
- }
+ dump_residual(sd, p->options.timeout, signal_received);
#endif
goto error;
}
projects / thirdparty / openvpn.git / commitdiff
