PageRenderTime 137ms CodeModel.GetById 15ms RepoModel.GetById 1ms app.codeStats 0ms

/release/src/router/libcurl/lib/curl_ntlm_msgs.c

https://gitlab.com/envieidoc/tomato
C | 980 lines | 635 code | 134 blank | 211 comment | 88 complexity | c0a4f48347d0aeb401cf2e415f1dec52 MD5 | raw file
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at http://curl.haxx.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. ***************************************************************************/
  22. #include "curl_setup.h"
  23. #ifdef USE_NTLM
  24. /*
  25. * NTLM details:
  26. *
  27. * http://davenport.sourceforge.net/ntlm.html
  28. * http://www.innovation.ch/java/ntlm.html
  29. */
  30. #define DEBUG_ME 0
  31. #include "urldata.h"
  32. #include "non-ascii.h"
  33. #include "sendf.h"
  34. #include "curl_base64.h"
  35. #include "curl_ntlm_core.h"
  36. #include "curl_gethostname.h"
  37. #include "curl_multibyte.h"
  38. #include "warnless.h"
  39. #include "curl_memory.h"
  40. #ifdef USE_WINDOWS_SSPI
  41. # include "curl_sspi.h"
  42. #endif
  43. #include "vtls/vtls.h"
  44. #define BUILDING_CURL_NTLM_MSGS_C
  45. #include "curl_ntlm_msgs.h"
  46. #define _MPRINTF_REPLACE /* use our functions only */
  47. #include <curl/mprintf.h>
  48. /* The last #include file should be: */
  49. #include "memdebug.h"
  50. /* "NTLMSSP" signature is always in ASCII regardless of the platform */
  51. #define NTLMSSP_SIGNATURE "\x4e\x54\x4c\x4d\x53\x53\x50"
  52. #define SHORTPAIR(x) ((x) & 0xff), (((x) >> 8) & 0xff)
  53. #define LONGQUARTET(x) ((x) & 0xff), (((x) >> 8) & 0xff), \
  54. (((x) >> 16) & 0xff), (((x) >> 24) & 0xff)
  55. #if DEBUG_ME
  56. # define DEBUG_OUT(x) x
  57. static void ntlm_print_flags(FILE *handle, unsigned long flags)
  58. {
  59. if(flags & NTLMFLAG_NEGOTIATE_UNICODE)
  60. fprintf(handle, "NTLMFLAG_NEGOTIATE_UNICODE ");
  61. if(flags & NTLMFLAG_NEGOTIATE_OEM)
  62. fprintf(handle, "NTLMFLAG_NEGOTIATE_OEM ");
  63. if(flags & NTLMFLAG_REQUEST_TARGET)
  64. fprintf(handle, "NTLMFLAG_REQUEST_TARGET ");
  65. if(flags & (1<<3))
  66. fprintf(handle, "NTLMFLAG_UNKNOWN_3 ");
  67. if(flags & NTLMFLAG_NEGOTIATE_SIGN)
  68. fprintf(handle, "NTLMFLAG_NEGOTIATE_SIGN ");
  69. if(flags & NTLMFLAG_NEGOTIATE_SEAL)
  70. fprintf(handle, "NTLMFLAG_NEGOTIATE_SEAL ");
  71. if(flags & NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE)
  72. fprintf(handle, "NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE ");
  73. if(flags & NTLMFLAG_NEGOTIATE_LM_KEY)
  74. fprintf(handle, "NTLMFLAG_NEGOTIATE_LM_KEY ");
  75. if(flags & NTLMFLAG_NEGOTIATE_NETWARE)
  76. fprintf(handle, "NTLMFLAG_NEGOTIATE_NETWARE ");
  77. if(flags & NTLMFLAG_NEGOTIATE_NTLM_KEY)
  78. fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM_KEY ");
  79. if(flags & (1<<10))
  80. fprintf(handle, "NTLMFLAG_UNKNOWN_10 ");
  81. if(flags & NTLMFLAG_NEGOTIATE_ANONYMOUS)
  82. fprintf(handle, "NTLMFLAG_NEGOTIATE_ANONYMOUS ");
  83. if(flags & NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED)
  84. fprintf(handle, "NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED ");
  85. if(flags & NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED)
  86. fprintf(handle, "NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED ");
  87. if(flags & NTLMFLAG_NEGOTIATE_LOCAL_CALL)
  88. fprintf(handle, "NTLMFLAG_NEGOTIATE_LOCAL_CALL ");
  89. if(flags & NTLMFLAG_NEGOTIATE_ALWAYS_SIGN)
  90. fprintf(handle, "NTLMFLAG_NEGOTIATE_ALWAYS_SIGN ");
  91. if(flags & NTLMFLAG_TARGET_TYPE_DOMAIN)
  92. fprintf(handle, "NTLMFLAG_TARGET_TYPE_DOMAIN ");
  93. if(flags & NTLMFLAG_TARGET_TYPE_SERVER)
  94. fprintf(handle, "NTLMFLAG_TARGET_TYPE_SERVER ");
  95. if(flags & NTLMFLAG_TARGET_TYPE_SHARE)
  96. fprintf(handle, "NTLMFLAG_TARGET_TYPE_SHARE ");
  97. if(flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY)
  98. fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM2_KEY ");
  99. if(flags & NTLMFLAG_REQUEST_INIT_RESPONSE)
  100. fprintf(handle, "NTLMFLAG_REQUEST_INIT_RESPONSE ");
  101. if(flags & NTLMFLAG_REQUEST_ACCEPT_RESPONSE)
  102. fprintf(handle, "NTLMFLAG_REQUEST_ACCEPT_RESPONSE ");
  103. if(flags & NTLMFLAG_REQUEST_NONNT_SESSION_KEY)
  104. fprintf(handle, "NTLMFLAG_REQUEST_NONNT_SESSION_KEY ");
  105. if(flags & NTLMFLAG_NEGOTIATE_TARGET_INFO)
  106. fprintf(handle, "NTLMFLAG_NEGOTIATE_TARGET_INFO ");
  107. if(flags & (1<<24))
  108. fprintf(handle, "NTLMFLAG_UNKNOWN_24 ");
  109. if(flags & (1<<25))
  110. fprintf(handle, "NTLMFLAG_UNKNOWN_25 ");
  111. if(flags & (1<<26))
  112. fprintf(handle, "NTLMFLAG_UNKNOWN_26 ");
  113. if(flags & (1<<27))
  114. fprintf(handle, "NTLMFLAG_UNKNOWN_27 ");
  115. if(flags & (1<<28))
  116. fprintf(handle, "NTLMFLAG_UNKNOWN_28 ");
  117. if(flags & NTLMFLAG_NEGOTIATE_128)
  118. fprintf(handle, "NTLMFLAG_NEGOTIATE_128 ");
  119. if(flags & NTLMFLAG_NEGOTIATE_KEY_EXCHANGE)
  120. fprintf(handle, "NTLMFLAG_NEGOTIATE_KEY_EXCHANGE ");
  121. if(flags & NTLMFLAG_NEGOTIATE_56)
  122. fprintf(handle, "NTLMFLAG_NEGOTIATE_56 ");
  123. }
  124. static void ntlm_print_hex(FILE *handle, const char *buf, size_t len)
  125. {
  126. const char *p = buf;
  127. (void)handle;
  128. fprintf(stderr, "0x");
  129. while(len-- > 0)
  130. fprintf(stderr, "%02.2x", (unsigned int)*p++);
  131. }
  132. #else
  133. # define DEBUG_OUT(x) Curl_nop_stmt
  134. #endif
  135. #ifndef USE_WINDOWS_SSPI
  136. /*
  137. * This function converts from the little endian format used in the
  138. * incoming package to whatever endian format we're using natively.
  139. * Argument is a pointer to a 4 byte buffer.
  140. */
  141. static unsigned int readint_le(unsigned char *buf)
  142. {
  143. return ((unsigned int)buf[0]) | ((unsigned int)buf[1] << 8) |
  144. ((unsigned int)buf[2] << 16) | ((unsigned int)buf[3] << 24);
  145. }
  146. /*
  147. * This function converts from the little endian format used in the incoming
  148. * package to whatever endian format we're using natively. Argument is a
  149. * pointer to a 2 byte buffer.
  150. */
  151. static unsigned int readshort_le(unsigned char *buf)
  152. {
  153. return ((unsigned int)buf[0]) | ((unsigned int)buf[1] << 8);
  154. }
  155. /*
  156. * Curl_ntlm_decode_type2_target()
  157. *
  158. * This is used to decode the "target info" in the ntlm type-2 message
  159. * received.
  160. *
  161. * Parameters:
  162. *
  163. * data [in] - Pointer to the session handle
  164. * buffer [in] - The decoded base64 ntlm header of Type 2
  165. * size [in] - The input buffer size, atleast 32 bytes
  166. * ntlm [in] - Pointer to ntlm data struct being used and modified.
  167. *
  168. * Returns CURLE_OK on success.
  169. */
  170. CURLcode Curl_ntlm_decode_type2_target(struct SessionHandle *data,
  171. unsigned char *buffer,
  172. size_t size,
  173. struct ntlmdata *ntlm)
  174. {
  175. unsigned int target_info_len = 0;
  176. unsigned int target_info_offset = 0;
  177. Curl_safefree(ntlm->target_info);
  178. ntlm->target_info_len = 0;
  179. if(size >= 48) {
  180. target_info_len = readshort_le(&buffer[40]);
  181. target_info_offset = readint_le(&buffer[44]);
  182. if(target_info_len > 0) {
  183. if(((target_info_offset + target_info_len) > size) ||
  184. (target_info_offset < 48)) {
  185. infof(data, "NTLM handshake failure (bad type-2 message). "
  186. "Target Info Offset Len is set incorrect by the peer\n");
  187. return CURLE_REMOTE_ACCESS_DENIED;
  188. }
  189. ntlm->target_info = malloc(target_info_len);
  190. if(!ntlm->target_info)
  191. return CURLE_OUT_OF_MEMORY;
  192. memcpy(ntlm->target_info, &buffer[target_info_offset], target_info_len);
  193. ntlm->target_info_len = target_info_len;
  194. }
  195. }
  196. return CURLE_OK;
  197. }
  198. #endif
  199. /*
  200. NTLM message structure notes:
  201. A 'short' is a 'network short', a little-endian 16-bit unsigned value.
  202. A 'long' is a 'network long', a little-endian, 32-bit unsigned value.
  203. A 'security buffer' represents a triplet used to point to a buffer,
  204. consisting of two shorts and one long:
  205. 1. A 'short' containing the length of the buffer content in bytes.
  206. 2. A 'short' containing the allocated space for the buffer in bytes.
  207. 3. A 'long' containing the offset to the start of the buffer in bytes,
  208. from the beginning of the NTLM message.
  209. */
  210. /*
  211. * Curl_ntlm_decode_type2_message()
  212. *
  213. * This is used to decode a ntlm type-2 message received from a HTTP or SASL
  214. * based (such as SMTP, POP3 or IMAP) server. The message is first decoded
  215. * from a base64 string into a raw ntlm message and checked for validity
  216. * before the appropriate data for creating a type-3 message is written to
  217. * the given ntlm data structure.
  218. *
  219. * Parameters:
  220. *
  221. * data [in] - Pointer to session handle.
  222. * header [in] - Pointer to the input buffer.
  223. * ntlm [in] - Pointer to ntlm data struct being used and modified.
  224. *
  225. * Returns CURLE_OK on success.
  226. */
  227. CURLcode Curl_ntlm_decode_type2_message(struct SessionHandle *data,
  228. const char *header,
  229. struct ntlmdata *ntlm)
  230. {
  231. #ifndef USE_WINDOWS_SSPI
  232. static const char type2_marker[] = { 0x02, 0x00, 0x00, 0x00 };
  233. #endif
  234. /* NTLM type-2 message structure:
  235. Index Description Content
  236. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  237. (0x4e544c4d53535000)
  238. 8 NTLM Message Type long (0x02000000)
  239. 12 Target Name security buffer
  240. 20 Flags long
  241. 24 Challenge 8 bytes
  242. (32) Context 8 bytes (two consecutive longs) (*)
  243. (40) Target Information security buffer (*)
  244. (48) OS Version Structure 8 bytes (*)
  245. 32 (48) (56) Start of data block (*)
  246. (*) -> Optional
  247. */
  248. size_t size = 0;
  249. unsigned char *buffer = NULL;
  250. CURLcode error;
  251. #if defined(CURL_DISABLE_VERBOSE_STRINGS) || defined(USE_WINDOWS_SSPI)
  252. (void)data;
  253. #endif
  254. error = Curl_base64_decode(header, &buffer, &size);
  255. if(error)
  256. return error;
  257. if(!buffer) {
  258. infof(data, "NTLM handshake failure (unhandled condition)\n");
  259. return CURLE_REMOTE_ACCESS_DENIED;
  260. }
  261. #ifdef USE_WINDOWS_SSPI
  262. ntlm->type_2 = malloc(size + 1);
  263. if(ntlm->type_2 == NULL) {
  264. free(buffer);
  265. return CURLE_OUT_OF_MEMORY;
  266. }
  267. ntlm->n_type_2 = curlx_uztoul(size);
  268. memcpy(ntlm->type_2, buffer, size);
  269. #else
  270. ntlm->flags = 0;
  271. if((size < 32) ||
  272. (memcmp(buffer, NTLMSSP_SIGNATURE, 8) != 0) ||
  273. (memcmp(buffer + 8, type2_marker, sizeof(type2_marker)) != 0)) {
  274. /* This was not a good enough type-2 message */
  275. free(buffer);
  276. infof(data, "NTLM handshake failure (bad type-2 message)\n");
  277. return CURLE_REMOTE_ACCESS_DENIED;
  278. }
  279. ntlm->flags = readint_le(&buffer[20]);
  280. memcpy(ntlm->nonce, &buffer[24], 8);
  281. if(ntlm->flags & NTLMFLAG_NEGOTIATE_TARGET_INFO) {
  282. error = Curl_ntlm_decode_type2_target(data, buffer, size, ntlm);
  283. if(error) {
  284. free(buffer);
  285. infof(data, "NTLM handshake failure (bad type-2 message)\n");
  286. return error;
  287. }
  288. }
  289. DEBUG_OUT({
  290. fprintf(stderr, "**** TYPE2 header flags=0x%08.8lx ", ntlm->flags);
  291. ntlm_print_flags(stderr, ntlm->flags);
  292. fprintf(stderr, "\n nonce=");
  293. ntlm_print_hex(stderr, (char *)ntlm->nonce, 8);
  294. fprintf(stderr, "\n****\n");
  295. fprintf(stderr, "**** Header %s\n ", header);
  296. });
  297. #endif
  298. free(buffer);
  299. return CURLE_OK;
  300. }
  301. #ifdef USE_WINDOWS_SSPI
  302. void Curl_ntlm_sspi_cleanup(struct ntlmdata *ntlm)
  303. {
  304. Curl_safefree(ntlm->type_2);
  305. if(ntlm->has_handles) {
  306. s_pSecFn->DeleteSecurityContext(&ntlm->c_handle);
  307. s_pSecFn->FreeCredentialsHandle(&ntlm->handle);
  308. ntlm->has_handles = 0;
  309. }
  310. Curl_sspi_free_identity(ntlm->p_identity);
  311. ntlm->p_identity = NULL;
  312. }
  313. #endif
  314. #ifndef USE_WINDOWS_SSPI
  315. /* copy the source to the destination and fill in zeroes in every
  316. other destination byte! */
  317. static void unicodecpy(unsigned char *dest, const char *src, size_t length)
  318. {
  319. size_t i;
  320. for(i = 0; i < length; i++) {
  321. dest[2 * i] = (unsigned char)src[i];
  322. dest[2 * i + 1] = '\0';
  323. }
  324. }
  325. #endif
  326. /*
  327. * Curl_ntlm_create_type1_message()
  328. *
  329. * This is used to generate an already encoded NTLM type-1 message ready for
  330. * sending to the recipient, be it a HTTP or SASL based (such as SMTP, POP3
  331. * or IMAP) server, using the appropriate compile time crypo API.
  332. *
  333. * Parameters:
  334. *
  335. * userp [in] - The user name in the format User or Domain\User.
  336. * passdwp [in] - The user's password.
  337. * ntlm [in/out] - The ntlm data struct being used and modified.
  338. * outptr [in/out] - The address where a pointer to newly allocated memory
  339. * holding the result will be stored upon completion.
  340. * outlen [out] - The length of the output message.
  341. *
  342. * Returns CURLE_OK on success.
  343. */
  344. CURLcode Curl_ntlm_create_type1_message(const char *userp,
  345. const char *passwdp,
  346. struct ntlmdata *ntlm,
  347. char **outptr,
  348. size_t *outlen)
  349. {
  350. /* NTLM type-1 message structure:
  351. Index Description Content
  352. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  353. (0x4e544c4d53535000)
  354. 8 NTLM Message Type long (0x01000000)
  355. 12 Flags long
  356. (16) Supplied Domain security buffer (*)
  357. (24) Supplied Workstation security buffer (*)
  358. (32) OS Version Structure 8 bytes (*)
  359. (32) (40) Start of data block (*)
  360. (*) -> Optional
  361. */
  362. unsigned char ntlmbuf[NTLM_BUFSIZE];
  363. size_t size;
  364. #ifdef USE_WINDOWS_SSPI
  365. SecBuffer type_1_buf;
  366. SecBufferDesc type_1_desc;
  367. SECURITY_STATUS status;
  368. unsigned long attrs;
  369. TimeStamp tsDummy; /* For Windows 9x compatibility of SSPI calls */
  370. Curl_ntlm_sspi_cleanup(ntlm);
  371. if(userp && *userp) {
  372. CURLcode result;
  373. /* Populate our identity structure */
  374. result = Curl_create_sspi_identity(userp, passwdp, &ntlm->identity);
  375. if(result)
  376. return result;
  377. /* Allow proper cleanup of the identity structure */
  378. ntlm->p_identity = &ntlm->identity;
  379. }
  380. else
  381. /* Use the current Windows user */
  382. ntlm->p_identity = NULL;
  383. /* Acquire our credientials handle */
  384. status = s_pSecFn->AcquireCredentialsHandle(NULL,
  385. (TCHAR *) TEXT("NTLM"),
  386. SECPKG_CRED_OUTBOUND, NULL,
  387. ntlm->p_identity, NULL, NULL,
  388. &ntlm->handle, &tsDummy);
  389. if(status != SEC_E_OK)
  390. return CURLE_OUT_OF_MEMORY;
  391. /* Setup the type-1 "output" security buffer */
  392. type_1_desc.ulVersion = SECBUFFER_VERSION;
  393. type_1_desc.cBuffers = 1;
  394. type_1_desc.pBuffers = &type_1_buf;
  395. type_1_buf.cbBuffer = NTLM_BUFSIZE;
  396. type_1_buf.BufferType = SECBUFFER_TOKEN;
  397. type_1_buf.pvBuffer = ntlmbuf;
  398. /* Generate our type-1 message */
  399. status = s_pSecFn->InitializeSecurityContext(&ntlm->handle, NULL,
  400. (TCHAR *) TEXT(""),
  401. ISC_REQ_CONFIDENTIALITY |
  402. ISC_REQ_REPLAY_DETECT |
  403. ISC_REQ_CONNECTION,
  404. 0, SECURITY_NETWORK_DREP,
  405. NULL, 0,
  406. &ntlm->c_handle, &type_1_desc,
  407. &attrs, &tsDummy);
  408. if(status == SEC_I_COMPLETE_AND_CONTINUE ||
  409. status == SEC_I_CONTINUE_NEEDED)
  410. s_pSecFn->CompleteAuthToken(&ntlm->c_handle, &type_1_desc);
  411. else if(status != SEC_E_OK) {
  412. s_pSecFn->FreeCredentialsHandle(&ntlm->handle);
  413. return CURLE_RECV_ERROR;
  414. }
  415. ntlm->has_handles = 1;
  416. size = type_1_buf.cbBuffer;
  417. #else
  418. const char *host = ""; /* empty */
  419. const char *domain = ""; /* empty */
  420. size_t hostlen = 0;
  421. size_t domlen = 0;
  422. size_t hostoff = 0;
  423. size_t domoff = hostoff + hostlen; /* This is 0: remember that host and
  424. domain are empty */
  425. (void)userp;
  426. (void)passwdp;
  427. (void)ntlm;
  428. #if USE_NTLM2SESSION
  429. #define NTLM2FLAG NTLMFLAG_NEGOTIATE_NTLM2_KEY
  430. #else
  431. #define NTLM2FLAG 0
  432. #endif
  433. snprintf((char *)ntlmbuf, NTLM_BUFSIZE,
  434. NTLMSSP_SIGNATURE "%c"
  435. "\x01%c%c%c" /* 32-bit type = 1 */
  436. "%c%c%c%c" /* 32-bit NTLM flag field */
  437. "%c%c" /* domain length */
  438. "%c%c" /* domain allocated space */
  439. "%c%c" /* domain name offset */
  440. "%c%c" /* 2 zeroes */
  441. "%c%c" /* host length */
  442. "%c%c" /* host allocated space */
  443. "%c%c" /* host name offset */
  444. "%c%c" /* 2 zeroes */
  445. "%s" /* host name */
  446. "%s", /* domain string */
  447. 0, /* trailing zero */
  448. 0, 0, 0, /* part of type-1 long */
  449. LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
  450. NTLMFLAG_REQUEST_TARGET |
  451. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  452. NTLM2FLAG |
  453. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
  454. SHORTPAIR(domlen),
  455. SHORTPAIR(domlen),
  456. SHORTPAIR(domoff),
  457. 0, 0,
  458. SHORTPAIR(hostlen),
  459. SHORTPAIR(hostlen),
  460. SHORTPAIR(hostoff),
  461. 0, 0,
  462. host, /* this is empty */
  463. domain /* this is empty */);
  464. /* Initial packet length */
  465. size = 32 + hostlen + domlen;
  466. #endif
  467. DEBUG_OUT({
  468. fprintf(stderr, "* TYPE1 header flags=0x%02.2x%02.2x%02.2x%02.2x "
  469. "0x%08.8x ",
  470. LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
  471. NTLMFLAG_REQUEST_TARGET |
  472. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  473. NTLM2FLAG |
  474. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
  475. NTLMFLAG_NEGOTIATE_OEM |
  476. NTLMFLAG_REQUEST_TARGET |
  477. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  478. NTLM2FLAG |
  479. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
  480. ntlm_print_flags(stderr,
  481. NTLMFLAG_NEGOTIATE_OEM |
  482. NTLMFLAG_REQUEST_TARGET |
  483. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  484. NTLM2FLAG |
  485. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
  486. fprintf(stderr, "\n****\n");
  487. });
  488. /* Return with binary blob encoded into base64 */
  489. return Curl_base64_encode(NULL, (char *)ntlmbuf, size, outptr, outlen);
  490. }
  491. /*
  492. * Curl_ntlm_create_type3_message()
  493. *
  494. * This is used to generate an already encoded NTLM type-3 message ready for
  495. * sending to the recipient, be it a HTTP or SASL based (such as SMTP, POP3
  496. * or IMAP) server, using the appropriate compile time crypo API.
  497. *
  498. * Parameters:
  499. *
  500. * data [in] - The session handle.
  501. * userp [in] - The user name in the format User or Domain\User.
  502. * passdwp [in] - The user's password.
  503. * ntlm [in/out] - The ntlm data struct being used and modified.
  504. * outptr [in/out] - The address where a pointer to newly allocated memory
  505. * holding the result will be stored upon completion.
  506. * outlen [out] - The length of the output message.
  507. *
  508. * Returns CURLE_OK on success.
  509. */
  510. CURLcode Curl_ntlm_create_type3_message(struct SessionHandle *data,
  511. const char *userp,
  512. const char *passwdp,
  513. struct ntlmdata *ntlm,
  514. char **outptr,
  515. size_t *outlen)
  516. {
  517. /* NTLM type-3 message structure:
  518. Index Description Content
  519. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  520. (0x4e544c4d53535000)
  521. 8 NTLM Message Type long (0x03000000)
  522. 12 LM/LMv2 Response security buffer
  523. 20 NTLM/NTLMv2 Response security buffer
  524. 28 Target Name security buffer
  525. 36 User Name security buffer
  526. 44 Workstation Name security buffer
  527. (52) Session Key security buffer (*)
  528. (60) Flags long (*)
  529. (64) OS Version Structure 8 bytes (*)
  530. 52 (64) (72) Start of data block
  531. (*) -> Optional
  532. */
  533. unsigned char ntlmbuf[NTLM_BUFSIZE];
  534. size_t size;
  535. #ifdef USE_WINDOWS_SSPI
  536. SecBuffer type_2_buf;
  537. SecBuffer type_3_buf;
  538. SecBufferDesc type_2_desc;
  539. SecBufferDesc type_3_desc;
  540. SECURITY_STATUS status;
  541. unsigned long attrs;
  542. TimeStamp tsDummy; /* For Windows 9x compatibility of SSPI calls */
  543. (void)passwdp;
  544. (void)userp;
  545. (void)data;
  546. /* Setup the type-2 "input" security buffer */
  547. type_2_desc.ulVersion = SECBUFFER_VERSION;
  548. type_2_desc.cBuffers = 1;
  549. type_2_desc.pBuffers = &type_2_buf;
  550. type_2_buf.BufferType = SECBUFFER_TOKEN;
  551. type_2_buf.pvBuffer = ntlm->type_2;
  552. type_2_buf.cbBuffer = ntlm->n_type_2;
  553. /* Setup the type-3 "output" security buffer */
  554. type_3_desc.ulVersion = SECBUFFER_VERSION;
  555. type_3_desc.cBuffers = 1;
  556. type_3_desc.pBuffers = &type_3_buf;
  557. type_3_buf.BufferType = SECBUFFER_TOKEN;
  558. type_3_buf.pvBuffer = ntlmbuf;
  559. type_3_buf.cbBuffer = NTLM_BUFSIZE;
  560. /* Generate our type-3 message */
  561. status = s_pSecFn->InitializeSecurityContext(&ntlm->handle,
  562. &ntlm->c_handle,
  563. (TCHAR *) TEXT(""),
  564. ISC_REQ_CONFIDENTIALITY |
  565. ISC_REQ_REPLAY_DETECT |
  566. ISC_REQ_CONNECTION,
  567. 0, SECURITY_NETWORK_DREP,
  568. &type_2_desc,
  569. 0, &ntlm->c_handle,
  570. &type_3_desc,
  571. &attrs, &tsDummy);
  572. if(status != SEC_E_OK)
  573. return CURLE_RECV_ERROR;
  574. size = type_3_buf.cbBuffer;
  575. Curl_ntlm_sspi_cleanup(ntlm);
  576. #else
  577. int lmrespoff;
  578. unsigned char lmresp[24]; /* fixed-size */
  579. #if USE_NTRESPONSES
  580. int ntrespoff;
  581. unsigned int ntresplen = 24;
  582. unsigned char ntresp[24]; /* fixed-size */
  583. unsigned char *ptr_ntresp = &ntresp[0];
  584. unsigned char *ntlmv2resp = NULL;
  585. #endif
  586. bool unicode = (ntlm->flags & NTLMFLAG_NEGOTIATE_UNICODE) ? TRUE : FALSE;
  587. char host[HOSTNAME_MAX + 1] = "";
  588. const char *user;
  589. const char *domain = "";
  590. size_t hostoff = 0;
  591. size_t useroff = 0;
  592. size_t domoff = 0;
  593. size_t hostlen = 0;
  594. size_t userlen = 0;
  595. size_t domlen = 0;
  596. CURLcode res = CURLE_OK;
  597. user = strchr(userp, '\\');
  598. if(!user)
  599. user = strchr(userp, '/');
  600. if(user) {
  601. domain = userp;
  602. domlen = (user - domain);
  603. user++;
  604. }
  605. else
  606. user = userp;
  607. if(user)
  608. userlen = strlen(user);
  609. /* Get the machine's un-qualified host name as NTLM doesn't like the fully
  610. qualified domain name */
  611. if(Curl_gethostname(host, sizeof(host))) {
  612. infof(data, "gethostname() failed, continuing without!\n");
  613. hostlen = 0;
  614. }
  615. else {
  616. hostlen = strlen(host);
  617. }
  618. #if USE_NTRESPONSES
  619. if(ntlm->target_info_len) {
  620. unsigned char ntbuffer[0x18];
  621. unsigned char entropy[8];
  622. unsigned char ntlmv2hash[0x18];
  623. #if defined(DEBUGBUILD)
  624. /* Use static client nonce in debug (Test Suite) builds */
  625. memcpy(entropy, "12345678", sizeof(entropy));
  626. #else
  627. /* Create an 8 byte random client nonce */
  628. Curl_ssl_random(data, entropy, sizeof(entropy));
  629. #endif
  630. res = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
  631. if(res)
  632. return res;
  633. res = Curl_ntlm_core_mk_ntlmv2_hash(user, userlen, domain, domlen,
  634. ntbuffer, ntlmv2hash);
  635. if(res)
  636. return res;
  637. /* LMv2 response */
  638. res = Curl_ntlm_core_mk_lmv2_resp(ntlmv2hash, entropy, &ntlm->nonce[0],
  639. lmresp);
  640. if(res)
  641. return res;
  642. /* NTLMv2 response */
  643. res = Curl_ntlm_core_mk_ntlmv2_resp(ntlmv2hash, entropy, ntlm, &ntlmv2resp,
  644. &ntresplen);
  645. if(res)
  646. return res;
  647. ptr_ntresp = ntlmv2resp;
  648. }
  649. else
  650. #endif
  651. #if USE_NTLM2SESSION
  652. /* We don't support NTLM2 if we don't have USE_NTRESPONSES */
  653. if(ntlm->flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY) {
  654. unsigned char ntbuffer[0x18];
  655. unsigned char tmp[0x18];
  656. unsigned char md5sum[MD5_DIGEST_LENGTH];
  657. unsigned char entropy[8];
  658. /* Need to create 8 bytes random data */
  659. Curl_ssl_random(data, entropy, sizeof(entropy));
  660. /* 8 bytes random data as challenge in lmresp */
  661. memcpy(lmresp, entropy, 8);
  662. /* Pad with zeros */
  663. memset(lmresp + 8, 0, 0x10);
  664. /* Fill tmp with challenge(nonce?) + entropy */
  665. memcpy(tmp, &ntlm->nonce[0], 8);
  666. memcpy(tmp + 8, entropy, 8);
  667. Curl_ssl_md5sum(tmp, 16, md5sum, MD5_DIGEST_LENGTH);
  668. /* We shall only use the first 8 bytes of md5sum, but the des
  669. code in Curl_ntlm_core_lm_resp only encrypt the first 8 bytes */
  670. if(CURLE_OUT_OF_MEMORY ==
  671. Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer))
  672. return CURLE_OUT_OF_MEMORY;
  673. Curl_ntlm_core_lm_resp(ntbuffer, md5sum, ntresp);
  674. /* End of NTLM2 Session code */
  675. }
  676. else
  677. #endif
  678. {
  679. #if USE_NTRESPONSES
  680. unsigned char ntbuffer[0x18];
  681. #endif
  682. unsigned char lmbuffer[0x18];
  683. #if USE_NTRESPONSES
  684. if(CURLE_OUT_OF_MEMORY ==
  685. Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer))
  686. return CURLE_OUT_OF_MEMORY;
  687. Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], ntresp);
  688. #endif
  689. Curl_ntlm_core_mk_lm_hash(data, passwdp, lmbuffer);
  690. Curl_ntlm_core_lm_resp(lmbuffer, &ntlm->nonce[0], lmresp);
  691. /* A safer but less compatible alternative is:
  692. * Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], lmresp);
  693. * See http://davenport.sourceforge.net/ntlm.html#ntlmVersion2 */
  694. }
  695. if(unicode) {
  696. domlen = domlen * 2;
  697. userlen = userlen * 2;
  698. hostlen = hostlen * 2;
  699. }
  700. lmrespoff = 64; /* size of the message header */
  701. #if USE_NTRESPONSES
  702. ntrespoff = lmrespoff + 0x18;
  703. domoff = ntrespoff + ntresplen;
  704. #else
  705. domoff = lmrespoff + 0x18;
  706. #endif
  707. useroff = domoff + domlen;
  708. hostoff = useroff + userlen;
  709. /* Create the big type-3 message binary blob */
  710. size = snprintf((char *)ntlmbuf, NTLM_BUFSIZE,
  711. NTLMSSP_SIGNATURE "%c"
  712. "\x03%c%c%c" /* 32-bit type = 3 */
  713. "%c%c" /* LanManager length */
  714. "%c%c" /* LanManager allocated space */
  715. "%c%c" /* LanManager offset */
  716. "%c%c" /* 2 zeroes */
  717. "%c%c" /* NT-response length */
  718. "%c%c" /* NT-response allocated space */
  719. "%c%c" /* NT-response offset */
  720. "%c%c" /* 2 zeroes */
  721. "%c%c" /* domain length */
  722. "%c%c" /* domain allocated space */
  723. "%c%c" /* domain name offset */
  724. "%c%c" /* 2 zeroes */
  725. "%c%c" /* user length */
  726. "%c%c" /* user allocated space */
  727. "%c%c" /* user offset */
  728. "%c%c" /* 2 zeroes */
  729. "%c%c" /* host length */
  730. "%c%c" /* host allocated space */
  731. "%c%c" /* host offset */
  732. "%c%c" /* 2 zeroes */
  733. "%c%c" /* session key length (unknown purpose) */
  734. "%c%c" /* session key allocated space (unknown purpose) */
  735. "%c%c" /* session key offset (unknown purpose) */
  736. "%c%c" /* 2 zeroes */
  737. "%c%c%c%c", /* flags */
  738. /* domain string */
  739. /* user string */
  740. /* host string */
  741. /* LanManager response */
  742. /* NT response */
  743. 0, /* zero termination */
  744. 0, 0, 0, /* type-3 long, the 24 upper bits */
  745. SHORTPAIR(0x18), /* LanManager response length, twice */
  746. SHORTPAIR(0x18),
  747. SHORTPAIR(lmrespoff),
  748. 0x0, 0x0,
  749. #if USE_NTRESPONSES
  750. SHORTPAIR(ntresplen), /* NT-response length, twice */
  751. SHORTPAIR(ntresplen),
  752. SHORTPAIR(ntrespoff),
  753. 0x0, 0x0,
  754. #else
  755. 0x0, 0x0,
  756. 0x0, 0x0,
  757. 0x0, 0x0,
  758. 0x0, 0x0,
  759. #endif
  760. SHORTPAIR(domlen),
  761. SHORTPAIR(domlen),
  762. SHORTPAIR(domoff),
  763. 0x0, 0x0,
  764. SHORTPAIR(userlen),
  765. SHORTPAIR(userlen),
  766. SHORTPAIR(useroff),
  767. 0x0, 0x0,
  768. SHORTPAIR(hostlen),
  769. SHORTPAIR(hostlen),
  770. SHORTPAIR(hostoff),
  771. 0x0, 0x0,
  772. 0x0, 0x0,
  773. 0x0, 0x0,
  774. 0x0, 0x0,
  775. 0x0, 0x0,
  776. LONGQUARTET(ntlm->flags));
  777. DEBUGASSERT(size == 64);
  778. DEBUGASSERT(size == (size_t)lmrespoff);
  779. /* We append the binary hashes */
  780. if(size < (NTLM_BUFSIZE - 0x18)) {
  781. memcpy(&ntlmbuf[size], lmresp, 0x18);
  782. size += 0x18;
  783. }
  784. DEBUG_OUT({
  785. fprintf(stderr, "**** TYPE3 header lmresp=");
  786. ntlm_print_hex(stderr, (char *)&ntlmbuf[lmrespoff], 0x18);
  787. });
  788. #if USE_NTRESPONSES
  789. if(size < (NTLM_BUFSIZE - ntresplen)) {
  790. DEBUGASSERT(size == (size_t)ntrespoff);
  791. memcpy(&ntlmbuf[size], ptr_ntresp, ntresplen);
  792. size += ntresplen;
  793. }
  794. DEBUG_OUT({
  795. fprintf(stderr, "\n ntresp=");
  796. ntlm_print_hex(stderr, (char *)&ntlmbuf[ntrespoff], ntresplen);
  797. });
  798. Curl_safefree(ntlmv2resp);/* Free the dynamic buffer allocated for NTLMv2 */
  799. #endif
  800. DEBUG_OUT({
  801. fprintf(stderr, "\n flags=0x%02.2x%02.2x%02.2x%02.2x 0x%08.8x ",
  802. LONGQUARTET(ntlm->flags), ntlm->flags);
  803. ntlm_print_flags(stderr, ntlm->flags);
  804. fprintf(stderr, "\n****\n");
  805. });
  806. /* Make sure that the domain, user and host strings fit in the
  807. buffer before we copy them there. */
  808. if(size + userlen + domlen + hostlen >= NTLM_BUFSIZE) {
  809. failf(data, "user + domain + host name too big");
  810. return CURLE_OUT_OF_MEMORY;
  811. }
  812. DEBUGASSERT(size == domoff);
  813. if(unicode)
  814. unicodecpy(&ntlmbuf[size], domain, domlen / 2);
  815. else
  816. memcpy(&ntlmbuf[size], domain, domlen);
  817. size += domlen;
  818. DEBUGASSERT(size == useroff);
  819. if(unicode)
  820. unicodecpy(&ntlmbuf[size], user, userlen / 2);
  821. else
  822. memcpy(&ntlmbuf[size], user, userlen);
  823. size += userlen;
  824. DEBUGASSERT(size == hostoff);
  825. if(unicode)
  826. unicodecpy(&ntlmbuf[size], host, hostlen / 2);
  827. else
  828. memcpy(&ntlmbuf[size], host, hostlen);
  829. size += hostlen;
  830. /* Convert domain, user, and host to ASCII but leave the rest as-is */
  831. res = Curl_convert_to_network(data, (char *)&ntlmbuf[domoff],
  832. size - domoff);
  833. if(res)
  834. return CURLE_CONV_FAILED;
  835. #endif
  836. /* Return with binary blob encoded into base64 */
  837. return Curl_base64_encode(NULL, (char *)ntlmbuf, size, outptr, outlen);
  838. }
  839. #endif /* USE_NTLM */