PageRenderTime 1128ms CodeModel.GetById 25ms RepoModel.GetById 0ms app.codeStats 0ms

/lib/curl_ntlm_msgs.c

http://github.com/bagder/curl
C | 817 lines | 516 code | 110 blank | 191 comment | 81 complexity | 1a2254d59057927e8a5b87b220fc39f6 MD5 | raw file
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at http://curl.haxx.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. ***************************************************************************/
  22. #include "curl_setup.h"
  23. #if defined(USE_NTLM) && !defined(USE_WINDOWS_SSPI)
  24. /*
  25. * NTLM details:
  26. *
  27. * http://davenport.sourceforge.net/ntlm.html
  28. * http://www.innovation.ch/java/ntlm.html
  29. */
  30. #define DEBUG_ME 0
  31. #include "urldata.h"
  32. #include "non-ascii.h"
  33. #include "sendf.h"
  34. #include "curl_base64.h"
  35. #include "curl_ntlm_core.h"
  36. #include "curl_gethostname.h"
  37. #include "curl_multibyte.h"
  38. #include "warnless.h"
  39. #include "vtls/vtls.h"
  40. #ifdef USE_NSS
  41. #include "vtls/nssg.h" /* for Curl_nss_force_init() */
  42. #endif
  43. #define BUILDING_CURL_NTLM_MSGS_C
  44. #include "curl_ntlm_msgs.h"
  45. #include "curl_sasl.h"
  46. #include "curl_endian.h"
  47. #include "curl_printf.h"
  48. /* The last #include files should be: */
  49. #include "curl_memory.h"
  50. #include "memdebug.h"
  51. /* "NTLMSSP" signature is always in ASCII regardless of the platform */
  52. #define NTLMSSP_SIGNATURE "\x4e\x54\x4c\x4d\x53\x53\x50"
  53. #define SHORTPAIR(x) ((x) & 0xff), (((x) >> 8) & 0xff)
  54. #define LONGQUARTET(x) ((x) & 0xff), (((x) >> 8) & 0xff), \
  55. (((x) >> 16) & 0xff), (((x) >> 24) & 0xff)
  56. #if DEBUG_ME
  57. # define DEBUG_OUT(x) x
  58. static void ntlm_print_flags(FILE *handle, unsigned long flags)
  59. {
  60. if(flags & NTLMFLAG_NEGOTIATE_UNICODE)
  61. fprintf(handle, "NTLMFLAG_NEGOTIATE_UNICODE ");
  62. if(flags & NTLMFLAG_NEGOTIATE_OEM)
  63. fprintf(handle, "NTLMFLAG_NEGOTIATE_OEM ");
  64. if(flags & NTLMFLAG_REQUEST_TARGET)
  65. fprintf(handle, "NTLMFLAG_REQUEST_TARGET ");
  66. if(flags & (1<<3))
  67. fprintf(handle, "NTLMFLAG_UNKNOWN_3 ");
  68. if(flags & NTLMFLAG_NEGOTIATE_SIGN)
  69. fprintf(handle, "NTLMFLAG_NEGOTIATE_SIGN ");
  70. if(flags & NTLMFLAG_NEGOTIATE_SEAL)
  71. fprintf(handle, "NTLMFLAG_NEGOTIATE_SEAL ");
  72. if(flags & NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE)
  73. fprintf(handle, "NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE ");
  74. if(flags & NTLMFLAG_NEGOTIATE_LM_KEY)
  75. fprintf(handle, "NTLMFLAG_NEGOTIATE_LM_KEY ");
  76. if(flags & NTLMFLAG_NEGOTIATE_NETWARE)
  77. fprintf(handle, "NTLMFLAG_NEGOTIATE_NETWARE ");
  78. if(flags & NTLMFLAG_NEGOTIATE_NTLM_KEY)
  79. fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM_KEY ");
  80. if(flags & (1<<10))
  81. fprintf(handle, "NTLMFLAG_UNKNOWN_10 ");
  82. if(flags & NTLMFLAG_NEGOTIATE_ANONYMOUS)
  83. fprintf(handle, "NTLMFLAG_NEGOTIATE_ANONYMOUS ");
  84. if(flags & NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED)
  85. fprintf(handle, "NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED ");
  86. if(flags & NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED)
  87. fprintf(handle, "NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED ");
  88. if(flags & NTLMFLAG_NEGOTIATE_LOCAL_CALL)
  89. fprintf(handle, "NTLMFLAG_NEGOTIATE_LOCAL_CALL ");
  90. if(flags & NTLMFLAG_NEGOTIATE_ALWAYS_SIGN)
  91. fprintf(handle, "NTLMFLAG_NEGOTIATE_ALWAYS_SIGN ");
  92. if(flags & NTLMFLAG_TARGET_TYPE_DOMAIN)
  93. fprintf(handle, "NTLMFLAG_TARGET_TYPE_DOMAIN ");
  94. if(flags & NTLMFLAG_TARGET_TYPE_SERVER)
  95. fprintf(handle, "NTLMFLAG_TARGET_TYPE_SERVER ");
  96. if(flags & NTLMFLAG_TARGET_TYPE_SHARE)
  97. fprintf(handle, "NTLMFLAG_TARGET_TYPE_SHARE ");
  98. if(flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY)
  99. fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM2_KEY ");
  100. if(flags & NTLMFLAG_REQUEST_INIT_RESPONSE)
  101. fprintf(handle, "NTLMFLAG_REQUEST_INIT_RESPONSE ");
  102. if(flags & NTLMFLAG_REQUEST_ACCEPT_RESPONSE)
  103. fprintf(handle, "NTLMFLAG_REQUEST_ACCEPT_RESPONSE ");
  104. if(flags & NTLMFLAG_REQUEST_NONNT_SESSION_KEY)
  105. fprintf(handle, "NTLMFLAG_REQUEST_NONNT_SESSION_KEY ");
  106. if(flags & NTLMFLAG_NEGOTIATE_TARGET_INFO)
  107. fprintf(handle, "NTLMFLAG_NEGOTIATE_TARGET_INFO ");
  108. if(flags & (1<<24))
  109. fprintf(handle, "NTLMFLAG_UNKNOWN_24 ");
  110. if(flags & (1<<25))
  111. fprintf(handle, "NTLMFLAG_UNKNOWN_25 ");
  112. if(flags & (1<<26))
  113. fprintf(handle, "NTLMFLAG_UNKNOWN_26 ");
  114. if(flags & (1<<27))
  115. fprintf(handle, "NTLMFLAG_UNKNOWN_27 ");
  116. if(flags & (1<<28))
  117. fprintf(handle, "NTLMFLAG_UNKNOWN_28 ");
  118. if(flags & NTLMFLAG_NEGOTIATE_128)
  119. fprintf(handle, "NTLMFLAG_NEGOTIATE_128 ");
  120. if(flags & NTLMFLAG_NEGOTIATE_KEY_EXCHANGE)
  121. fprintf(handle, "NTLMFLAG_NEGOTIATE_KEY_EXCHANGE ");
  122. if(flags & NTLMFLAG_NEGOTIATE_56)
  123. fprintf(handle, "NTLMFLAG_NEGOTIATE_56 ");
  124. }
  125. static void ntlm_print_hex(FILE *handle, const char *buf, size_t len)
  126. {
  127. const char *p = buf;
  128. (void)handle;
  129. fprintf(stderr, "0x");
  130. while(len-- > 0)
  131. fprintf(stderr, "%02.2x", (unsigned int)*p++);
  132. }
  133. #else
  134. # define DEBUG_OUT(x) Curl_nop_stmt
  135. #endif
  136. /*
  137. * ntlm_decode_type2_target()
  138. *
  139. * This is used to decode the "target info" in the ntlm type-2 message
  140. * received.
  141. *
  142. * Parameters:
  143. *
  144. * data [in] - The session handle.
  145. * buffer [in] - The decoded type-2 message.
  146. * size [in] - The input buffer size, at least 32 bytes.
  147. * ntlm [in/out] - The ntlm data struct being used and modified.
  148. *
  149. * Returns CURLE_OK on success.
  150. */
  151. static CURLcode ntlm_decode_type2_target(struct SessionHandle *data,
  152. unsigned char *buffer,
  153. size_t size,
  154. struct ntlmdata *ntlm)
  155. {
  156. unsigned short target_info_len = 0;
  157. unsigned int target_info_offset = 0;
  158. if(size >= 48) {
  159. target_info_len = Curl_read16_le(&buffer[40]);
  160. target_info_offset = Curl_read32_le(&buffer[44]);
  161. if(target_info_len > 0) {
  162. if(((target_info_offset + target_info_len) > size) ||
  163. (target_info_offset < 48)) {
  164. infof(data, "NTLM handshake failure (bad type-2 message). "
  165. "Target Info Offset Len is set incorrect by the peer\n");
  166. return CURLE_BAD_CONTENT_ENCODING;
  167. }
  168. ntlm->target_info = malloc(target_info_len);
  169. if(!ntlm->target_info)
  170. return CURLE_OUT_OF_MEMORY;
  171. memcpy(ntlm->target_info, &buffer[target_info_offset], target_info_len);
  172. }
  173. }
  174. ntlm->target_info_len = target_info_len;
  175. return CURLE_OK;
  176. }
  177. /*
  178. NTLM message structure notes:
  179. A 'short' is a 'network short', a little-endian 16-bit unsigned value.
  180. A 'long' is a 'network long', a little-endian, 32-bit unsigned value.
  181. A 'security buffer' represents a triplet used to point to a buffer,
  182. consisting of two shorts and one long:
  183. 1. A 'short' containing the length of the buffer content in bytes.
  184. 2. A 'short' containing the allocated space for the buffer in bytes.
  185. 3. A 'long' containing the offset to the start of the buffer in bytes,
  186. from the beginning of the NTLM message.
  187. */
  188. /*
  189. * Curl_sasl_decode_ntlm_type2_message()
  190. *
  191. * This is used to decode an already encoded NTLM type-2 message. The message
  192. * is first decoded from a base64 string into a raw NTLM message and checked
  193. * for validity before the appropriate data for creating a type-3 message is
  194. * written to the given NTLM data structure.
  195. *
  196. * Parameters:
  197. *
  198. * data [in] - The session handle.
  199. * type2msg [in] - The base64 encoded type-2 message.
  200. * ntlm [in/out] - The ntlm data struct being used and modified.
  201. *
  202. * Returns CURLE_OK on success.
  203. */
  204. CURLcode Curl_sasl_decode_ntlm_type2_message(struct SessionHandle *data,
  205. const char *type2msg,
  206. struct ntlmdata *ntlm)
  207. {
  208. static const char type2_marker[] = { 0x02, 0x00, 0x00, 0x00 };
  209. /* NTLM type-2 message structure:
  210. Index Description Content
  211. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  212. (0x4e544c4d53535000)
  213. 8 NTLM Message Type long (0x02000000)
  214. 12 Target Name security buffer
  215. 20 Flags long
  216. 24 Challenge 8 bytes
  217. (32) Context 8 bytes (two consecutive longs) (*)
  218. (40) Target Information security buffer (*)
  219. (48) OS Version Structure 8 bytes (*)
  220. 32 (48) (56) Start of data block (*)
  221. (*) -> Optional
  222. */
  223. CURLcode result = CURLE_OK;
  224. unsigned char *type2 = NULL;
  225. size_t type2_len = 0;
  226. #if defined(USE_NSS)
  227. /* Make sure the crypto backend is initialized */
  228. result = Curl_nss_force_init(data);
  229. if(result)
  230. return result;
  231. #elif defined(CURL_DISABLE_VERBOSE_STRINGS)
  232. (void)data;
  233. #endif
  234. /* Decode the base-64 encoded type-2 message */
  235. if(strlen(type2msg) && *type2msg != '=') {
  236. result = Curl_base64_decode(type2msg, &type2, &type2_len);
  237. if(result)
  238. return result;
  239. }
  240. /* Ensure we have a valid type-2 message */
  241. if(!type2) {
  242. infof(data, "NTLM handshake failure (empty type-2 message)\n");
  243. return CURLE_BAD_CONTENT_ENCODING;
  244. }
  245. ntlm->flags = 0;
  246. if((type2_len < 32) ||
  247. (memcmp(type2, NTLMSSP_SIGNATURE, 8) != 0) ||
  248. (memcmp(type2 + 8, type2_marker, sizeof(type2_marker)) != 0)) {
  249. /* This was not a good enough type-2 message */
  250. free(type2);
  251. infof(data, "NTLM handshake failure (bad type-2 message)\n");
  252. return CURLE_BAD_CONTENT_ENCODING;
  253. }
  254. ntlm->flags = Curl_read32_le(&type2[20]);
  255. memcpy(ntlm->nonce, &type2[24], 8);
  256. if(ntlm->flags & NTLMFLAG_NEGOTIATE_TARGET_INFO) {
  257. result = ntlm_decode_type2_target(data, type2, type2_len, ntlm);
  258. if(result) {
  259. free(type2);
  260. infof(data, "NTLM handshake failure (bad type-2 message)\n");
  261. return result;
  262. }
  263. }
  264. DEBUG_OUT({
  265. fprintf(stderr, "**** TYPE2 header flags=0x%08.8lx ", ntlm->flags);
  266. ntlm_print_flags(stderr, ntlm->flags);
  267. fprintf(stderr, "\n nonce=");
  268. ntlm_print_hex(stderr, (char *)ntlm->nonce, 8);
  269. fprintf(stderr, "\n****\n");
  270. fprintf(stderr, "**** Header %s\n ", header);
  271. });
  272. free(type2);
  273. return result;
  274. }
  275. /* copy the source to the destination and fill in zeroes in every
  276. other destination byte! */
  277. static void unicodecpy(unsigned char *dest, const char *src, size_t length)
  278. {
  279. size_t i;
  280. for(i = 0; i < length; i++) {
  281. dest[2 * i] = (unsigned char)src[i];
  282. dest[2 * i + 1] = '\0';
  283. }
  284. }
  285. /*
  286. * Curl_sasl_create_ntlm_type1_message()
  287. *
  288. * This is used to generate an already encoded NTLM type-1 message ready for
  289. * sending to the recipient using the appropriate compile time crypto API.
  290. *
  291. * Parameters:
  292. *
  293. * userp [in] - The user name in the format User or Domain\User.
  294. * passdwp [in] - The user's password.
  295. * ntlm [in/out] - The ntlm data struct being used and modified.
  296. * outptr [in/out] - The address where a pointer to newly allocated memory
  297. * holding the result will be stored upon completion.
  298. * outlen [out] - The length of the output message.
  299. *
  300. * Returns CURLE_OK on success.
  301. */
  302. CURLcode Curl_sasl_create_ntlm_type1_message(const char *userp,
  303. const char *passwdp,
  304. struct ntlmdata *ntlm,
  305. char **outptr, size_t *outlen)
  306. {
  307. /* NTLM type-1 message structure:
  308. Index Description Content
  309. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  310. (0x4e544c4d53535000)
  311. 8 NTLM Message Type long (0x01000000)
  312. 12 Flags long
  313. (16) Supplied Domain security buffer (*)
  314. (24) Supplied Workstation security buffer (*)
  315. (32) OS Version Structure 8 bytes (*)
  316. (32) (40) Start of data block (*)
  317. (*) -> Optional
  318. */
  319. size_t size;
  320. unsigned char ntlmbuf[NTLM_BUFSIZE];
  321. const char *host = ""; /* empty */
  322. const char *domain = ""; /* empty */
  323. size_t hostlen = 0;
  324. size_t domlen = 0;
  325. size_t hostoff = 0;
  326. size_t domoff = hostoff + hostlen; /* This is 0: remember that host and
  327. domain are empty */
  328. (void)userp;
  329. (void)passwdp;
  330. /* Clean up any former leftovers and initialise to defaults */
  331. Curl_sasl_ntlm_cleanup(ntlm);
  332. #if USE_NTRESPONSES && USE_NTLM2SESSION
  333. #define NTLM2FLAG NTLMFLAG_NEGOTIATE_NTLM2_KEY
  334. #else
  335. #define NTLM2FLAG 0
  336. #endif
  337. snprintf((char *)ntlmbuf, NTLM_BUFSIZE,
  338. NTLMSSP_SIGNATURE "%c"
  339. "\x01%c%c%c" /* 32-bit type = 1 */
  340. "%c%c%c%c" /* 32-bit NTLM flag field */
  341. "%c%c" /* domain length */
  342. "%c%c" /* domain allocated space */
  343. "%c%c" /* domain name offset */
  344. "%c%c" /* 2 zeroes */
  345. "%c%c" /* host length */
  346. "%c%c" /* host allocated space */
  347. "%c%c" /* host name offset */
  348. "%c%c" /* 2 zeroes */
  349. "%s" /* host name */
  350. "%s", /* domain string */
  351. 0, /* trailing zero */
  352. 0, 0, 0, /* part of type-1 long */
  353. LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
  354. NTLMFLAG_REQUEST_TARGET |
  355. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  356. NTLM2FLAG |
  357. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
  358. SHORTPAIR(domlen),
  359. SHORTPAIR(domlen),
  360. SHORTPAIR(domoff),
  361. 0, 0,
  362. SHORTPAIR(hostlen),
  363. SHORTPAIR(hostlen),
  364. SHORTPAIR(hostoff),
  365. 0, 0,
  366. host, /* this is empty */
  367. domain /* this is empty */);
  368. /* Initial packet length */
  369. size = 32 + hostlen + domlen;
  370. DEBUG_OUT({
  371. fprintf(stderr, "* TYPE1 header flags=0x%02.2x%02.2x%02.2x%02.2x "
  372. "0x%08.8x ",
  373. LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
  374. NTLMFLAG_REQUEST_TARGET |
  375. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  376. NTLM2FLAG |
  377. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
  378. NTLMFLAG_NEGOTIATE_OEM |
  379. NTLMFLAG_REQUEST_TARGET |
  380. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  381. NTLM2FLAG |
  382. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
  383. ntlm_print_flags(stderr,
  384. NTLMFLAG_NEGOTIATE_OEM |
  385. NTLMFLAG_REQUEST_TARGET |
  386. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  387. NTLM2FLAG |
  388. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
  389. fprintf(stderr, "\n****\n");
  390. });
  391. /* Return with binary blob encoded into base64 */
  392. return Curl_base64_encode(NULL, (char *)ntlmbuf, size, outptr, outlen);
  393. }
  394. /*
  395. * Curl_sasl_create_ntlm_type3_message()
  396. *
  397. * This is used to generate an already encoded NTLM type-3 message ready for
  398. * sending to the recipient using the appropriate compile time crypto API.
  399. *
  400. * Parameters:
  401. *
  402. * data [in] - The session handle.
  403. * userp [in] - The user name in the format User or Domain\User.
  404. * passdwp [in] - The user's password.
  405. * ntlm [in/out] - The ntlm data struct being used and modified.
  406. * outptr [in/out] - The address where a pointer to newly allocated memory
  407. * holding the result will be stored upon completion.
  408. * outlen [out] - The length of the output message.
  409. *
  410. * Returns CURLE_OK on success.
  411. */
  412. CURLcode Curl_sasl_create_ntlm_type3_message(struct SessionHandle *data,
  413. const char *userp,
  414. const char *passwdp,
  415. struct ntlmdata *ntlm,
  416. char **outptr, size_t *outlen)
  417. {
  418. /* NTLM type-3 message structure:
  419. Index Description Content
  420. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  421. (0x4e544c4d53535000)
  422. 8 NTLM Message Type long (0x03000000)
  423. 12 LM/LMv2 Response security buffer
  424. 20 NTLM/NTLMv2 Response security buffer
  425. 28 Target Name security buffer
  426. 36 User Name security buffer
  427. 44 Workstation Name security buffer
  428. (52) Session Key security buffer (*)
  429. (60) Flags long (*)
  430. (64) OS Version Structure 8 bytes (*)
  431. 52 (64) (72) Start of data block
  432. (*) -> Optional
  433. */
  434. CURLcode result = CURLE_OK;
  435. size_t size;
  436. unsigned char ntlmbuf[NTLM_BUFSIZE];
  437. int lmrespoff;
  438. unsigned char lmresp[24]; /* fixed-size */
  439. #if USE_NTRESPONSES
  440. int ntrespoff;
  441. unsigned int ntresplen = 24;
  442. unsigned char ntresp[24]; /* fixed-size */
  443. unsigned char *ptr_ntresp = &ntresp[0];
  444. unsigned char *ntlmv2resp = NULL;
  445. #endif
  446. bool unicode = (ntlm->flags & NTLMFLAG_NEGOTIATE_UNICODE) ? TRUE : FALSE;
  447. char host[HOSTNAME_MAX + 1] = "";
  448. const char *user;
  449. const char *domain = "";
  450. size_t hostoff = 0;
  451. size_t useroff = 0;
  452. size_t domoff = 0;
  453. size_t hostlen = 0;
  454. size_t userlen = 0;
  455. size_t domlen = 0;
  456. user = strchr(userp, '\\');
  457. if(!user)
  458. user = strchr(userp, '/');
  459. if(user) {
  460. domain = userp;
  461. domlen = (user - domain);
  462. user++;
  463. }
  464. else
  465. user = userp;
  466. if(user)
  467. userlen = strlen(user);
  468. /* Get the machine's un-qualified host name as NTLM doesn't like the fully
  469. qualified domain name */
  470. if(Curl_gethostname(host, sizeof(host))) {
  471. infof(data, "gethostname() failed, continuing without!\n");
  472. hostlen = 0;
  473. }
  474. else {
  475. hostlen = strlen(host);
  476. }
  477. #if USE_NTRESPONSES && USE_NTLM_V2
  478. if(ntlm->target_info_len) {
  479. unsigned char ntbuffer[0x18];
  480. unsigned int entropy[2];
  481. unsigned char ntlmv2hash[0x18];
  482. entropy[0] = Curl_rand(data);
  483. entropy[1] = Curl_rand(data);
  484. result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
  485. if(result)
  486. return result;
  487. result = Curl_ntlm_core_mk_ntlmv2_hash(user, userlen, domain, domlen,
  488. ntbuffer, ntlmv2hash);
  489. if(result)
  490. return result;
  491. /* LMv2 response */
  492. result = Curl_ntlm_core_mk_lmv2_resp(ntlmv2hash,
  493. (unsigned char *)&entropy[0],
  494. &ntlm->nonce[0], lmresp);
  495. if(result)
  496. return result;
  497. /* NTLMv2 response */
  498. result = Curl_ntlm_core_mk_ntlmv2_resp(ntlmv2hash,
  499. (unsigned char *)&entropy[0],
  500. ntlm, &ntlmv2resp, &ntresplen);
  501. if(result)
  502. return result;
  503. ptr_ntresp = ntlmv2resp;
  504. }
  505. else
  506. #endif
  507. #if USE_NTRESPONSES && USE_NTLM2SESSION
  508. /* We don't support NTLM2 if we don't have USE_NTRESPONSES */
  509. if(ntlm->flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY) {
  510. unsigned char ntbuffer[0x18];
  511. unsigned char tmp[0x18];
  512. unsigned char md5sum[MD5_DIGEST_LENGTH];
  513. unsigned int entropy[2];
  514. /* Need to create 8 bytes random data */
  515. entropy[0] = Curl_rand(data);
  516. entropy[1] = Curl_rand(data);
  517. /* 8 bytes random data as challenge in lmresp */
  518. memcpy(lmresp, entropy, 8);
  519. /* Pad with zeros */
  520. memset(lmresp + 8, 0, 0x10);
  521. /* Fill tmp with challenge(nonce?) + entropy */
  522. memcpy(tmp, &ntlm->nonce[0], 8);
  523. memcpy(tmp + 8, entropy, 8);
  524. result = Curl_ssl_md5sum(tmp, 16, md5sum, MD5_DIGEST_LENGTH);
  525. if(!result)
  526. /* We shall only use the first 8 bytes of md5sum, but the des code in
  527. Curl_ntlm_core_lm_resp only encrypt the first 8 bytes */
  528. result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
  529. if(result)
  530. return result;
  531. Curl_ntlm_core_lm_resp(ntbuffer, md5sum, ntresp);
  532. /* End of NTLM2 Session code */
  533. }
  534. else
  535. #endif
  536. {
  537. #if USE_NTRESPONSES
  538. unsigned char ntbuffer[0x18];
  539. #endif
  540. unsigned char lmbuffer[0x18];
  541. #if USE_NTRESPONSES
  542. result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
  543. if(result)
  544. return result;
  545. Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], ntresp);
  546. #endif
  547. result = Curl_ntlm_core_mk_lm_hash(data, passwdp, lmbuffer);
  548. if(result)
  549. return result;
  550. Curl_ntlm_core_lm_resp(lmbuffer, &ntlm->nonce[0], lmresp);
  551. /* A safer but less compatible alternative is:
  552. * Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], lmresp);
  553. * See http://davenport.sourceforge.net/ntlm.html#ntlmVersion2 */
  554. }
  555. if(unicode) {
  556. domlen = domlen * 2;
  557. userlen = userlen * 2;
  558. hostlen = hostlen * 2;
  559. }
  560. lmrespoff = 64; /* size of the message header */
  561. #if USE_NTRESPONSES
  562. ntrespoff = lmrespoff + 0x18;
  563. domoff = ntrespoff + ntresplen;
  564. #else
  565. domoff = lmrespoff + 0x18;
  566. #endif
  567. useroff = domoff + domlen;
  568. hostoff = useroff + userlen;
  569. /* Create the big type-3 message binary blob */
  570. size = snprintf((char *)ntlmbuf, NTLM_BUFSIZE,
  571. NTLMSSP_SIGNATURE "%c"
  572. "\x03%c%c%c" /* 32-bit type = 3 */
  573. "%c%c" /* LanManager length */
  574. "%c%c" /* LanManager allocated space */
  575. "%c%c" /* LanManager offset */
  576. "%c%c" /* 2 zeroes */
  577. "%c%c" /* NT-response length */
  578. "%c%c" /* NT-response allocated space */
  579. "%c%c" /* NT-response offset */
  580. "%c%c" /* 2 zeroes */
  581. "%c%c" /* domain length */
  582. "%c%c" /* domain allocated space */
  583. "%c%c" /* domain name offset */
  584. "%c%c" /* 2 zeroes */
  585. "%c%c" /* user length */
  586. "%c%c" /* user allocated space */
  587. "%c%c" /* user offset */
  588. "%c%c" /* 2 zeroes */
  589. "%c%c" /* host length */
  590. "%c%c" /* host allocated space */
  591. "%c%c" /* host offset */
  592. "%c%c" /* 2 zeroes */
  593. "%c%c" /* session key length (unknown purpose) */
  594. "%c%c" /* session key allocated space (unknown purpose) */
  595. "%c%c" /* session key offset (unknown purpose) */
  596. "%c%c" /* 2 zeroes */
  597. "%c%c%c%c", /* flags */
  598. /* domain string */
  599. /* user string */
  600. /* host string */
  601. /* LanManager response */
  602. /* NT response */
  603. 0, /* zero termination */
  604. 0, 0, 0, /* type-3 long, the 24 upper bits */
  605. SHORTPAIR(0x18), /* LanManager response length, twice */
  606. SHORTPAIR(0x18),
  607. SHORTPAIR(lmrespoff),
  608. 0x0, 0x0,
  609. #if USE_NTRESPONSES
  610. SHORTPAIR(ntresplen), /* NT-response length, twice */
  611. SHORTPAIR(ntresplen),
  612. SHORTPAIR(ntrespoff),
  613. 0x0, 0x0,
  614. #else
  615. 0x0, 0x0,
  616. 0x0, 0x0,
  617. 0x0, 0x0,
  618. 0x0, 0x0,
  619. #endif
  620. SHORTPAIR(domlen),
  621. SHORTPAIR(domlen),
  622. SHORTPAIR(domoff),
  623. 0x0, 0x0,
  624. SHORTPAIR(userlen),
  625. SHORTPAIR(userlen),
  626. SHORTPAIR(useroff),
  627. 0x0, 0x0,
  628. SHORTPAIR(hostlen),
  629. SHORTPAIR(hostlen),
  630. SHORTPAIR(hostoff),
  631. 0x0, 0x0,
  632. 0x0, 0x0,
  633. 0x0, 0x0,
  634. 0x0, 0x0,
  635. 0x0, 0x0,
  636. LONGQUARTET(ntlm->flags));
  637. DEBUGASSERT(size == 64);
  638. DEBUGASSERT(size == (size_t)lmrespoff);
  639. /* We append the binary hashes */
  640. if(size < (NTLM_BUFSIZE - 0x18)) {
  641. memcpy(&ntlmbuf[size], lmresp, 0x18);
  642. size += 0x18;
  643. }
  644. DEBUG_OUT({
  645. fprintf(stderr, "**** TYPE3 header lmresp=");
  646. ntlm_print_hex(stderr, (char *)&ntlmbuf[lmrespoff], 0x18);
  647. });
  648. #if USE_NTRESPONSES
  649. if(size < (NTLM_BUFSIZE - ntresplen)) {
  650. DEBUGASSERT(size == (size_t)ntrespoff);
  651. memcpy(&ntlmbuf[size], ptr_ntresp, ntresplen);
  652. size += ntresplen;
  653. }
  654. DEBUG_OUT({
  655. fprintf(stderr, "\n ntresp=");
  656. ntlm_print_hex(stderr, (char *)&ntlmbuf[ntrespoff], ntresplen);
  657. });
  658. free(ntlmv2resp);/* Free the dynamic buffer allocated for NTLMv2 */
  659. #endif
  660. DEBUG_OUT({
  661. fprintf(stderr, "\n flags=0x%02.2x%02.2x%02.2x%02.2x 0x%08.8x ",
  662. LONGQUARTET(ntlm->flags), ntlm->flags);
  663. ntlm_print_flags(stderr, ntlm->flags);
  664. fprintf(stderr, "\n****\n");
  665. });
  666. /* Make sure that the domain, user and host strings fit in the
  667. buffer before we copy them there. */
  668. if(size + userlen + domlen + hostlen >= NTLM_BUFSIZE) {
  669. failf(data, "user + domain + host name too big");
  670. return CURLE_OUT_OF_MEMORY;
  671. }
  672. DEBUGASSERT(size == domoff);
  673. if(unicode)
  674. unicodecpy(&ntlmbuf[size], domain, domlen / 2);
  675. else
  676. memcpy(&ntlmbuf[size], domain, domlen);
  677. size += domlen;
  678. DEBUGASSERT(size == useroff);
  679. if(unicode)
  680. unicodecpy(&ntlmbuf[size], user, userlen / 2);
  681. else
  682. memcpy(&ntlmbuf[size], user, userlen);
  683. size += userlen;
  684. DEBUGASSERT(size == hostoff);
  685. if(unicode)
  686. unicodecpy(&ntlmbuf[size], host, hostlen / 2);
  687. else
  688. memcpy(&ntlmbuf[size], host, hostlen);
  689. size += hostlen;
  690. /* Convert domain, user, and host to ASCII but leave the rest as-is */
  691. result = Curl_convert_to_network(data, (char *)&ntlmbuf[domoff],
  692. size - domoff);
  693. if(result)
  694. return CURLE_CONV_FAILED;
  695. /* Return with binary blob encoded into base64 */
  696. result = Curl_base64_encode(NULL, (char *)ntlmbuf, size, outptr, outlen);
  697. Curl_sasl_ntlm_cleanup(ntlm);
  698. return result;
  699. }
  700. #endif /* USE_NTLM && !USE_WINDOWS_SSPI */