ntlm.c@ 95219

Last change on this file since 95219 was 85671, checked in by vboxsync, 4 years ago
Export out internal curl copy to make it a lot simpler to build VBox (OSE) on Windows. bugref:9814
Property svn:eol-style set to `native`
File size: 27.5 KB

Line
1	/***************************************************************************
2	* _ _ ____ _
3	* Project ___\| \| \| \| _ \\| \|
4	* / __\| \| \| \| \|_) \| \|
5	* \| (__\| \|_\| \| _ <\| \|___
6	* \___\|\___/\|_\| \_\_____\|
7	*
8	* Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
9	*
10	* This software is licensed as described in the file COPYING, which
11	* you should have received as part of this distribution. The terms
12	* are also available at https://curl.haxx.se/docs/copyright.html.
13	*
14	* You may opt to use, copy, modify, merge, publish, distribute and/or sell
15	* copies of the Software, and permit persons to whom the Software is
16	* furnished to do so, under the terms of the COPYING file.
17	*
18	* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19	* KIND, either express or implied.
20	*
21	***************************************************************************/
22
23	#include "curl_setup.h"
24
25	#if defined(USE_NTLM) && !defined(USE_WINDOWS_SSPI)
26
27	/*
28	* NTLM details:
29	*
30	* https://davenport.sourceforge.io/ntlm.html
31	* https://www.innovation.ch/java/ntlm.html
32	*/
33
34	#define DEBUG_ME 0
35
36	#include "urldata.h"
37	#include "non-ascii.h"
38	#include "sendf.h"
39	#include "curl_base64.h"
40	#include "curl_ntlm_core.h"
41	#include "curl_gethostname.h"
42	#include "curl_multibyte.h"
43	#include "warnless.h"
44	#include "rand.h"
45	#include "vtls/vtls.h"
46
47	/* SSL backend-specific #if branches in this file must be kept in the order
48	documented in curl_ntlm_core. */
49	#if defined(NTLM_NEEDS_NSS_INIT)
50	#include "vtls/nssg.h" /* for Curl_nss_force_init() */
51	#endif
52
53	#define BUILDING_CURL_NTLM_MSGS_C
54	#include "vauth/vauth.h"
55	#include "vauth/ntlm.h"
56	#include "curl_endian.h"
57	#include "curl_printf.h"
58
59	/* The last #include files should be: */
60	#include "curl_memory.h"
61	#include "memdebug.h"
62
63	/* "NTLMSSP" signature is always in ASCII regardless of the platform */
64	#define NTLMSSP_SIGNATURE "\x4e\x54\x4c\x4d\x53\x53\x50"
65
66	#define SHORTPAIR(x) ((int)((x) & 0xff)), ((int)(((x) >> 8) & 0xff))
67	#define LONGQUARTET(x) ((int)((x) & 0xff)), ((int)(((x) >> 8) & 0xff)), \
68	((int)(((x) >> 16) & 0xff)), ((int)(((x) >> 24) & 0xff))
69
70	#if DEBUG_ME
71	# define DEBUG_OUT(x) x
72	static void ntlm_print_flags(FILE *handle, unsigned long flags)
73	{
74	if(flags & NTLMFLAG_NEGOTIATE_UNICODE)
75	fprintf(handle, "NTLMFLAG_NEGOTIATE_UNICODE ");
76	if(flags & NTLMFLAG_NEGOTIATE_OEM)
77	fprintf(handle, "NTLMFLAG_NEGOTIATE_OEM ");
78	if(flags & NTLMFLAG_REQUEST_TARGET)
79	fprintf(handle, "NTLMFLAG_REQUEST_TARGET ");
80	if(flags & (1<<3))
81	fprintf(handle, "NTLMFLAG_UNKNOWN_3 ");
82	if(flags & NTLMFLAG_NEGOTIATE_SIGN)
83	fprintf(handle, "NTLMFLAG_NEGOTIATE_SIGN ");
84	if(flags & NTLMFLAG_NEGOTIATE_SEAL)
85	fprintf(handle, "NTLMFLAG_NEGOTIATE_SEAL ");
86	if(flags & NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE)
87	fprintf(handle, "NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE ");
88	if(flags & NTLMFLAG_NEGOTIATE_LM_KEY)
89	fprintf(handle, "NTLMFLAG_NEGOTIATE_LM_KEY ");
90	if(flags & NTLMFLAG_NEGOTIATE_NETWARE)
91	fprintf(handle, "NTLMFLAG_NEGOTIATE_NETWARE ");
92	if(flags & NTLMFLAG_NEGOTIATE_NTLM_KEY)
93	fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM_KEY ");
94	if(flags & (1<<10))
95	fprintf(handle, "NTLMFLAG_UNKNOWN_10 ");
96	if(flags & NTLMFLAG_NEGOTIATE_ANONYMOUS)
97	fprintf(handle, "NTLMFLAG_NEGOTIATE_ANONYMOUS ");
98	if(flags & NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED)
99	fprintf(handle, "NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED ");
100	if(flags & NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED)
101	fprintf(handle, "NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED ");
102	if(flags & NTLMFLAG_NEGOTIATE_LOCAL_CALL)
103	fprintf(handle, "NTLMFLAG_NEGOTIATE_LOCAL_CALL ");
104	if(flags & NTLMFLAG_NEGOTIATE_ALWAYS_SIGN)
105	fprintf(handle, "NTLMFLAG_NEGOTIATE_ALWAYS_SIGN ");
106	if(flags & NTLMFLAG_TARGET_TYPE_DOMAIN)
107	fprintf(handle, "NTLMFLAG_TARGET_TYPE_DOMAIN ");
108	if(flags & NTLMFLAG_TARGET_TYPE_SERVER)
109	fprintf(handle, "NTLMFLAG_TARGET_TYPE_SERVER ");
110	if(flags & NTLMFLAG_TARGET_TYPE_SHARE)
111	fprintf(handle, "NTLMFLAG_TARGET_TYPE_SHARE ");
112	if(flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY)
113	fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM2_KEY ");
114	if(flags & NTLMFLAG_REQUEST_INIT_RESPONSE)
115	fprintf(handle, "NTLMFLAG_REQUEST_INIT_RESPONSE ");
116	if(flags & NTLMFLAG_REQUEST_ACCEPT_RESPONSE)
117	fprintf(handle, "NTLMFLAG_REQUEST_ACCEPT_RESPONSE ");
118	if(flags & NTLMFLAG_REQUEST_NONNT_SESSION_KEY)
119	fprintf(handle, "NTLMFLAG_REQUEST_NONNT_SESSION_KEY ");
120	if(flags & NTLMFLAG_NEGOTIATE_TARGET_INFO)
121	fprintf(handle, "NTLMFLAG_NEGOTIATE_TARGET_INFO ");
122	if(flags & (1<<24))
123	fprintf(handle, "NTLMFLAG_UNKNOWN_24 ");
124	if(flags & (1<<25))
125	fprintf(handle, "NTLMFLAG_UNKNOWN_25 ");
126	if(flags & (1<<26))
127	fprintf(handle, "NTLMFLAG_UNKNOWN_26 ");
128	if(flags & (1<<27))
129	fprintf(handle, "NTLMFLAG_UNKNOWN_27 ");
130	if(flags & (1<<28))
131	fprintf(handle, "NTLMFLAG_UNKNOWN_28 ");
132	if(flags & NTLMFLAG_NEGOTIATE_128)
133	fprintf(handle, "NTLMFLAG_NEGOTIATE_128 ");
134	if(flags & NTLMFLAG_NEGOTIATE_KEY_EXCHANGE)
135	fprintf(handle, "NTLMFLAG_NEGOTIATE_KEY_EXCHANGE ");
136	if(flags & NTLMFLAG_NEGOTIATE_56)
137	fprintf(handle, "NTLMFLAG_NEGOTIATE_56 ");
138	}
139
140	static void ntlm_print_hex(FILE handle, const char buf, size_t len)
141	{
142	const char *p = buf;
143
144	(void) handle;
145
146	fprintf(stderr, "0x");
147	while(len-- > 0)
148	fprintf(stderr, "%02.2x", (unsigned int)*p++);
149	}
150	#else
151	# define DEBUG_OUT(x) Curl_nop_stmt
152	#endif
153
154	/*
155	* ntlm_decode_type2_target()
156	*
157	* This is used to decode the "target info" in the NTLM type-2 message
158	* received.
159	*
160	* Parameters:
161	*
162	* data [in] - The session handle.
163	* buffer [in] - The decoded type-2 message.
164	* size [in] - The input buffer size, at least 32 bytes.
165	* ntlm [in/out] - The NTLM data struct being used and modified.
166	*
167	* Returns CURLE_OK on success.
168	*/
169	static CURLcode ntlm_decode_type2_target(struct Curl_easy *data,
170	unsigned char *buffer,
171	size_t size,
172	struct ntlmdata *ntlm)
173	{
174	unsigned short target_info_len = 0;
175	unsigned int target_info_offset = 0;
176
177	#if defined(CURL_DISABLE_VERBOSE_STRINGS)
178	(void) data;
179	#endif
180
181	if(size >= 48) {
182	target_info_len = Curl_read16_le(&buffer[40]);
183	target_info_offset = Curl_read32_le(&buffer[44]);
184	if(target_info_len > 0) {
185	if((target_info_offset >= size) \|\|
186	((target_info_offset + target_info_len) > size) \|\|
187	(target_info_offset < 48)) {
188	infof(data, "NTLM handshake failure (bad type-2 message). "
189	"Target Info Offset Len is set incorrect by the peer\n");
190	return CURLE_BAD_CONTENT_ENCODING;
191	}
192
193	ntlm->target_info = malloc(target_info_len);
194	if(!ntlm->target_info)
195	return CURLE_OUT_OF_MEMORY;
196
197	memcpy(ntlm->target_info, &buffer[target_info_offset], target_info_len);
198	}
199	}
200
201	ntlm->target_info_len = target_info_len;
202
203	return CURLE_OK;
204	}
205
206	/*
207	NTLM message structure notes:
208
209	A 'short' is a 'network short', a little-endian 16-bit unsigned value.
210
211	A 'long' is a 'network long', a little-endian, 32-bit unsigned value.
212
213	A 'security buffer' represents a triplet used to point to a buffer,
214	consisting of two shorts and one long:
215
216	1. A 'short' containing the length of the buffer content in bytes.
217	2. A 'short' containing the allocated space for the buffer in bytes.
218	3. A 'long' containing the offset to the start of the buffer in bytes,
219	from the beginning of the NTLM message.
220	*/
221
222	/*
223	* Curl_auth_is_ntlm_supported()
224	*
225	* This is used to evaluate if NTLM is supported.
226	*
227	* Parameters: None
228	*
229	* Returns TRUE as NTLM as handled by libcurl.
230	*/
231	bool Curl_auth_is_ntlm_supported(void)
232	{
233	return TRUE;
234	}
235
236	/*
237	* Curl_auth_decode_ntlm_type2_message()
238	*
239	* This is used to decode an already encoded NTLM type-2 message. The message
240	* is first decoded from a base64 string into a raw NTLM message and checked
241	* for validity before the appropriate data for creating a type-3 message is
242	* written to the given NTLM data structure.
243	*
244	* Parameters:
245	*
246	* data [in] - The session handle.
247	* type2msg [in] - The base64 encoded type-2 message.
248	* ntlm [in/out] - The NTLM data struct being used and modified.
249	*
250	* Returns CURLE_OK on success.
251	*/
252	CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
253	const char *type2msg,
254	struct ntlmdata *ntlm)
255	{
256	static const char type2_marker[] = { 0x02, 0x00, 0x00, 0x00 };
257
258	/* NTLM type-2 message structure:
259
260	Index Description Content
261	0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
262	(0x4e544c4d53535000)
263	8 NTLM Message Type long (0x02000000)
264	12 Target Name security buffer
265	20 Flags long
266	24 Challenge 8 bytes
267	(32) Context 8 bytes (two consecutive longs) (*)
268	(40) Target Information security buffer (*)
269	(48) OS Version Structure 8 bytes (*)
270	32 (48) (56) Start of data block (*)
271	(*) -> Optional
272	*/
273
274	CURLcode result = CURLE_OK;
275	unsigned char *type2 = NULL;
276	size_t type2_len = 0;
277
278	#if defined(NTLM_NEEDS_NSS_INIT)
279	/* Make sure the crypto backend is initialized */
280	result = Curl_nss_force_init(data);
281	if(result)
282	return result;
283	#elif defined(CURL_DISABLE_VERBOSE_STRINGS)
284	(void)data;
285	#endif
286
287	/* Decode the base-64 encoded type-2 message */
288	if(strlen(type2msg) && *type2msg != '=') {
289	result = Curl_base64_decode(type2msg, &type2, &type2_len);
290	if(result)
291	return result;
292	}
293
294	/* Ensure we have a valid type-2 message */
295	if(!type2) {
296	infof(data, "NTLM handshake failure (empty type-2 message)\n");
297	return CURLE_BAD_CONTENT_ENCODING;
298	}
299
300	ntlm->flags = 0;
301
302	if((type2_len < 32) \|\|
303	(memcmp(type2, NTLMSSP_SIGNATURE, 8) != 0) \|\|
304	(memcmp(type2 + 8, type2_marker, sizeof(type2_marker)) != 0)) {
305	/* This was not a good enough type-2 message */
306	free(type2);
307	infof(data, "NTLM handshake failure (bad type-2 message)\n");
308	return CURLE_BAD_CONTENT_ENCODING;
309	}
310
311	ntlm->flags = Curl_read32_le(&type2[20]);
312	memcpy(ntlm->nonce, &type2[24], 8);
313
314	if(ntlm->flags & NTLMFLAG_NEGOTIATE_TARGET_INFO) {
315	result = ntlm_decode_type2_target(data, type2, type2_len, ntlm);
316	if(result) {
317	free(type2);
318	infof(data, "NTLM handshake failure (bad type-2 message)\n");
319	return result;
320	}
321	}
322
323	DEBUG_OUT({
324	fprintf(stderr, "**** TYPE2 header flags=0x%08.8lx ", ntlm->flags);
325	ntlm_print_flags(stderr, ntlm->flags);
326	fprintf(stderr, "\n nonce=");
327	ntlm_print_hex(stderr, (char *)ntlm->nonce, 8);
328	fprintf(stderr, "\n****\n");
329	fprintf(stderr, "**** Header %s\n ", header);
330	});
331
332	free(type2);
333
334	return result;
335	}
336
337	/* copy the source to the destination and fill in zeroes in every
338	other destination byte! */
339	static void unicodecpy(unsigned char dest, const char src, size_t length)
340	{
341	size_t i;
342	for(i = 0; i < length; i++) {
343	dest[2 * i] = (unsigned char)src[i];
344	dest[2 * i + 1] = '\0';
345	}
346	}
347
348	/*
349	* Curl_auth_create_ntlm_type1_message()
350	*
351	* This is used to generate an already encoded NTLM type-1 message ready for
352	* sending to the recipient using the appropriate compile time crypto API.
353	*
354	* Parameters:
355	*
356	* data [in] - The session handle.
357	* userp [in] - The user name in the format User or Domain\User.
358	* passwdp [in] - The user's password.
359	* service [in] - The service type such as http, smtp, pop or imap.
360	* host [in] - The host name.
361	* ntlm [in/out] - The NTLM data struct being used and modified.
362	* outptr [in/out] - The address where a pointer to newly allocated memory
363	* holding the result will be stored upon completion.
364	* outlen [out] - The length of the output message.
365	*
366	* Returns CURLE_OK on success.
367	*/
368	CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
369	const char *userp,
370	const char *passwdp,
371	const char *service,
372	const char *hostname,
373	struct ntlmdata *ntlm,
374	char *outptr, size_t outlen)
375	{
376	/* NTLM type-1 message structure:
377
378	Index Description Content
379	0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
380	(0x4e544c4d53535000)
381	8 NTLM Message Type long (0x01000000)
382	12 Flags long
383	(16) Supplied Domain security buffer (*)
384	(24) Supplied Workstation security buffer (*)
385	(32) OS Version Structure 8 bytes (*)
386	(32) (40) Start of data block (*)
387	(*) -> Optional
388	*/
389
390	size_t size;
391
392	unsigned char ntlmbuf[NTLM_BUFSIZE];
393	const char host = ""; / empty */
394	const char domain = ""; / empty */
395	size_t hostlen = 0;
396	size_t domlen = 0;
397	size_t hostoff = 0;
398	size_t domoff = hostoff + hostlen; /* This is 0: remember that host and
399	domain are empty */
400	(void)userp;
401	(void)passwdp;
402	(void)service,
403	(void)hostname,
404
405	/* Clean up any former leftovers and initialise to defaults */
406	Curl_auth_ntlm_cleanup(ntlm);
407
408	#if defined(USE_NTRESPONSES) && defined(USE_NTLM2SESSION)
409	#define NTLM2FLAG NTLMFLAG_NEGOTIATE_NTLM2_KEY
410	#else
411	#define NTLM2FLAG 0
412	#endif
413	msnprintf((char *)ntlmbuf, NTLM_BUFSIZE,
414	NTLMSSP_SIGNATURE "%c"
415	"\x01%c%c%c" /* 32-bit type = 1 */
416	"%c%c%c%c" /* 32-bit NTLM flag field */
417	"%c%c" /* domain length */
418	"%c%c" /* domain allocated space */
419	"%c%c" /* domain name offset */
420	"%c%c" /* 2 zeroes */
421	"%c%c" /* host length */
422	"%c%c" /* host allocated space */
423	"%c%c" /* host name offset */
424	"%c%c" /* 2 zeroes */
425	"%s" /* host name */
426	"%s", /* domain string */
427	0, /* trailing zero */
428	0, 0, 0, /* part of type-1 long */
429
430	LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM \|
431	NTLMFLAG_REQUEST_TARGET \|
432	NTLMFLAG_NEGOTIATE_NTLM_KEY \|
433	NTLM2FLAG \|
434	NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
435	SHORTPAIR(domlen),
436	SHORTPAIR(domlen),
437	SHORTPAIR(domoff),
438	0, 0,
439	SHORTPAIR(hostlen),
440	SHORTPAIR(hostlen),
441	SHORTPAIR(hostoff),
442	0, 0,
443	host, /* this is empty */
444	domain /* this is empty */);
445
446	/* Initial packet length */
447	size = 32 + hostlen + domlen;
448
449	DEBUG_OUT({
450	fprintf(stderr, "* TYPE1 header flags=0x%02.2x%02.2x%02.2x%02.2x "
451	"0x%08.8x ",
452	LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM \|
453	NTLMFLAG_REQUEST_TARGET \|
454	NTLMFLAG_NEGOTIATE_NTLM_KEY \|
455	NTLM2FLAG \|
456	NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
457	NTLMFLAG_NEGOTIATE_OEM \|
458	NTLMFLAG_REQUEST_TARGET \|
459	NTLMFLAG_NEGOTIATE_NTLM_KEY \|
460	NTLM2FLAG \|
461	NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
462	ntlm_print_flags(stderr,
463	NTLMFLAG_NEGOTIATE_OEM \|
464	NTLMFLAG_REQUEST_TARGET \|
465	NTLMFLAG_NEGOTIATE_NTLM_KEY \|
466	NTLM2FLAG \|
467	NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
468	fprintf(stderr, "\n****\n");
469	});
470
471	/* Return with binary blob encoded into base64 */
472	return Curl_base64_encode(data, (char *)ntlmbuf, size, outptr, outlen);
473	}
474
475	/*
476	* Curl_auth_create_ntlm_type3_message()
477	*
478	* This is used to generate an already encoded NTLM type-3 message ready for
479	* sending to the recipient using the appropriate compile time crypto API.
480	*
481	* Parameters:
482	*
483	* data [in] - The session handle.
484	* userp [in] - The user name in the format User or Domain\User.
485	* passwdp [in] - The user's password.
486	* ntlm [in/out] - The NTLM data struct being used and modified.
487	* outptr [in/out] - The address where a pointer to newly allocated memory
488	* holding the result will be stored upon completion.
489	* outlen [out] - The length of the output message.
490	*
491	* Returns CURLE_OK on success.
492	*/
493	CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
494	const char *userp,
495	const char *passwdp,
496	struct ntlmdata *ntlm,
497	char *outptr, size_t outlen)
498
499	{
500	/* NTLM type-3 message structure:
501
502	Index Description Content
503	0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
504	(0x4e544c4d53535000)
505	8 NTLM Message Type long (0x03000000)
506	12 LM/LMv2 Response security buffer
507	20 NTLM/NTLMv2 Response security buffer
508	28 Target Name security buffer
509	36 User Name security buffer
510	44 Workstation Name security buffer
511	(52) Session Key security buffer (*)
512	(60) Flags long (*)
513	(64) OS Version Structure 8 bytes (*)
514	52 (64) (72) Start of data block
515	(*) -> Optional
516	*/
517
518	CURLcode result = CURLE_OK;
519	size_t size;
520	unsigned char ntlmbuf[NTLM_BUFSIZE];
521	int lmrespoff;
522	unsigned char lmresp[24]; /* fixed-size */
523	#ifdef USE_NTRESPONSES
524	int ntrespoff;
525	unsigned int ntresplen = 24;
526	unsigned char ntresp[24]; /* fixed-size */
527	unsigned char *ptr_ntresp = &ntresp[0];
528	unsigned char *ntlmv2resp = NULL;
529	#endif
530	bool unicode = (ntlm->flags & NTLMFLAG_NEGOTIATE_UNICODE) ? TRUE : FALSE;
531	char host[HOSTNAME_MAX + 1] = "";
532	const char *user;
533	const char *domain = "";
534	size_t hostoff = 0;
535	size_t useroff = 0;
536	size_t domoff = 0;
537	size_t hostlen = 0;
538	size_t userlen = 0;
539	size_t domlen = 0;
540
541	user = strchr(userp, '\\');
542	if(!user)
543	user = strchr(userp, '/');
544
545	if(user) {
546	domain = userp;
547	domlen = (user - domain);
548	user++;
549	}
550	else
551	user = userp;
552
553	userlen = strlen(user);
554
555	/* Get the machine's un-qualified host name as NTLM doesn't like the fully
556	qualified domain name */
557	if(Curl_gethostname(host, sizeof(host))) {
558	infof(data, "gethostname() failed, continuing without!\n");
559	hostlen = 0;
560	}
561	else {
562	hostlen = strlen(host);
563	}
564
565	#if defined(USE_NTRESPONSES) && defined(USE_NTLM_V2)
566	if(ntlm->flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY) {
567	unsigned char ntbuffer[0x18];
568	unsigned char entropy[8];
569	unsigned char ntlmv2hash[0x18];
570
571	result = Curl_rand(data, entropy, 8);
572	if(result)
573	return result;
574
575	result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
576	if(result)
577	return result;
578
579	result = Curl_ntlm_core_mk_ntlmv2_hash(user, userlen, domain, domlen,
580	ntbuffer, ntlmv2hash);
581	if(result)
582	return result;
583
584	/* LMv2 response */
585	result = Curl_ntlm_core_mk_lmv2_resp(ntlmv2hash, entropy,
586	&ntlm->nonce[0], lmresp);
587	if(result)
588	return result;
589
590	/* NTLMv2 response */
591	result = Curl_ntlm_core_mk_ntlmv2_resp(ntlmv2hash, entropy,
592	ntlm, &ntlmv2resp, &ntresplen);
593	if(result)
594	return result;
595
596	ptr_ntresp = ntlmv2resp;
597	}
598	else
599	#endif
600
601	#if defined(USE_NTRESPONSES) && defined(USE_NTLM2SESSION)
602	/* We don't support NTLM2 if we don't have USE_NTRESPONSES */
603	if(ntlm->flags & NTLMFLAG_NEGOTIATE_NTLM_KEY) {
604	unsigned char ntbuffer[0x18];
605	unsigned char tmp[0x18];
606	unsigned char md5sum[MD5_DIGEST_LENGTH];
607	unsigned char entropy[8];
608
609	/* Need to create 8 bytes random data */
610	result = Curl_rand(data, entropy, 8);
611	if(result)
612	return result;
613
614	/* 8 bytes random data as challenge in lmresp */
615	memcpy(lmresp, entropy, 8);
616
617	/* Pad with zeros */
618	memset(lmresp + 8, 0, 0x10);
619
620	/* Fill tmp with challenge(nonce?) + entropy */
621	memcpy(tmp, &ntlm->nonce[0], 8);
622	memcpy(tmp + 8, entropy, 8);
623
624	result = Curl_ssl_md5sum(tmp, 16, md5sum, MD5_DIGEST_LENGTH);
625	if(!result)
626	/* We shall only use the first 8 bytes of md5sum, but the des code in
627	Curl_ntlm_core_lm_resp only encrypt the first 8 bytes */
628	result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
629	if(result)
630	return result;
631
632	Curl_ntlm_core_lm_resp(ntbuffer, md5sum, ntresp);
633
634	/* End of NTLM2 Session code */
635	/* NTLM v2 session security is a misnomer because it is not NTLM v2.
636	It is NTLM v1 using the extended session security that is also
637	in NTLM v2 */
638	}
639	else
640	#endif
641	{
642
643	#ifdef USE_NTRESPONSES
644	unsigned char ntbuffer[0x18];
645	#endif
646	unsigned char lmbuffer[0x18];
647
648	#ifdef USE_NTRESPONSES
649	result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
650	if(result)
651	return result;
652
653	Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], ntresp);
654	#endif
655
656	result = Curl_ntlm_core_mk_lm_hash(data, passwdp, lmbuffer);
657	if(result)
658	return result;
659
660	Curl_ntlm_core_lm_resp(lmbuffer, &ntlm->nonce[0], lmresp);
661
662	/* A safer but less compatible alternative is:
663	* Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], lmresp);
664	* See https://davenport.sourceforge.io/ntlm.html#ntlmVersion2 */
665	}
666
667	if(unicode) {
668	domlen = domlen * 2;
669	userlen = userlen * 2;
670	hostlen = hostlen * 2;
671	}
672
673	lmrespoff = 64; /* size of the message header */
674	#ifdef USE_NTRESPONSES
675	ntrespoff = lmrespoff + 0x18;
676	domoff = ntrespoff + ntresplen;
677	#else
678	domoff = lmrespoff + 0x18;
679	#endif
680	useroff = domoff + domlen;
681	hostoff = useroff + userlen;
682
683	/* Create the big type-3 message binary blob */
684	size = msnprintf((char *)ntlmbuf, NTLM_BUFSIZE,
685	NTLMSSP_SIGNATURE "%c"
686	"\x03%c%c%c" /* 32-bit type = 3 */
687
688	"%c%c" /* LanManager length */
689	"%c%c" /* LanManager allocated space */
690	"%c%c" /* LanManager offset */
691	"%c%c" /* 2 zeroes */
692
693	"%c%c" /* NT-response length */
694	"%c%c" /* NT-response allocated space */
695	"%c%c" /* NT-response offset */
696	"%c%c" /* 2 zeroes */
697
698	"%c%c" /* domain length */
699	"%c%c" /* domain allocated space */
700	"%c%c" /* domain name offset */
701	"%c%c" /* 2 zeroes */
702
703	"%c%c" /* user length */
704	"%c%c" /* user allocated space */
705	"%c%c" /* user offset */
706	"%c%c" /* 2 zeroes */
707
708	"%c%c" /* host length */
709	"%c%c" /* host allocated space */
710	"%c%c" /* host offset */
711	"%c%c" /* 2 zeroes */
712
713	"%c%c" /* session key length (unknown purpose) */
714	"%c%c" /* session key allocated space (unknown purpose) */
715	"%c%c" /* session key offset (unknown purpose) */
716	"%c%c" /* 2 zeroes */
717
718	"%c%c%c%c", /* flags */
719
720	/* domain string */
721	/* user string */
722	/* host string */
723	/* LanManager response */
724	/* NT response */
725
726	0, /* zero termination */
727	0, 0, 0, /* type-3 long, the 24 upper bits */
728
729	SHORTPAIR(0x18), /* LanManager response length, twice */
730	SHORTPAIR(0x18),
731	SHORTPAIR(lmrespoff),
732	0x0, 0x0,
733
734	#ifdef USE_NTRESPONSES
735	SHORTPAIR(ntresplen), /* NT-response length, twice */
736	SHORTPAIR(ntresplen),
737	SHORTPAIR(ntrespoff),
738	0x0, 0x0,
739	#else
740	0x0, 0x0,
741	0x0, 0x0,
742	0x0, 0x0,
743	0x0, 0x0,
744	#endif
745	SHORTPAIR(domlen),
746	SHORTPAIR(domlen),
747	SHORTPAIR(domoff),
748	0x0, 0x0,
749
750	SHORTPAIR(userlen),
751	SHORTPAIR(userlen),
752	SHORTPAIR(useroff),
753	0x0, 0x0,
754
755	SHORTPAIR(hostlen),
756	SHORTPAIR(hostlen),
757	SHORTPAIR(hostoff),
758	0x0, 0x0,
759
760	0x0, 0x0,
761	0x0, 0x0,
762	0x0, 0x0,
763	0x0, 0x0,
764
765	LONGQUARTET(ntlm->flags));
766
767	DEBUGASSERT(size == 64);
768	DEBUGASSERT(size == (size_t)lmrespoff);
769
770	/* We append the binary hashes */
771	if(size < (NTLM_BUFSIZE - 0x18)) {
772	memcpy(&ntlmbuf[size], lmresp, 0x18);
773	size += 0x18;
774	}
775
776	DEBUG_OUT({
777	fprintf(stderr, "**** TYPE3 header lmresp=");
778	ntlm_print_hex(stderr, (char *)&ntlmbuf[lmrespoff], 0x18);
779	});
780
781	#ifdef USE_NTRESPONSES
782	/* ntresplen + size should not be risking an integer overflow here */
783	if(ntresplen + size > sizeof(ntlmbuf)) {
784	failf(data, "incoming NTLM message too big");
785	return CURLE_OUT_OF_MEMORY;
786	}
787	DEBUGASSERT(size == (size_t)ntrespoff);
788	memcpy(&ntlmbuf[size], ptr_ntresp, ntresplen);
789	size += ntresplen;
790
791	DEBUG_OUT({
792	fprintf(stderr, "\n ntresp=");
793	ntlm_print_hex(stderr, (char *)&ntlmbuf[ntrespoff], ntresplen);
794	});
795
796	free(ntlmv2resp);/* Free the dynamic buffer allocated for NTLMv2 */
797
798	#endif
799
800	DEBUG_OUT({
801	fprintf(stderr, "\n flags=0x%02.2x%02.2x%02.2x%02.2x 0x%08.8x ",
802	LONGQUARTET(ntlm->flags), ntlm->flags);
803	ntlm_print_flags(stderr, ntlm->flags);
804	fprintf(stderr, "\n****\n");
805	});
806
807	/* Make sure that the domain, user and host strings fit in the
808	buffer before we copy them there. */
809	if(size + userlen + domlen + hostlen >= NTLM_BUFSIZE) {
810	failf(data, "user + domain + host name too big");
811	return CURLE_OUT_OF_MEMORY;
812	}
813
814	DEBUGASSERT(size == domoff);
815	if(unicode)
816	unicodecpy(&ntlmbuf[size], domain, domlen / 2);
817	else
818	memcpy(&ntlmbuf[size], domain, domlen);
819
820	size += domlen;
821
822	DEBUGASSERT(size == useroff);
823	if(unicode)
824	unicodecpy(&ntlmbuf[size], user, userlen / 2);
825	else
826	memcpy(&ntlmbuf[size], user, userlen);
827
828	size += userlen;
829
830	DEBUGASSERT(size == hostoff);
831	if(unicode)
832	unicodecpy(&ntlmbuf[size], host, hostlen / 2);
833	else
834	memcpy(&ntlmbuf[size], host, hostlen);
835
836	size += hostlen;
837
838	/* Convert domain, user, and host to ASCII but leave the rest as-is */
839	result = Curl_convert_to_network(data, (char *)&ntlmbuf[domoff],
840	size - domoff);
841	if(result)
842	return CURLE_CONV_FAILED;
843
844	/* Return with binary blob encoded into base64 */
845	result = Curl_base64_encode(data, (char *)ntlmbuf, size, outptr, outlen);
846
847	Curl_auth_ntlm_cleanup(ntlm);
848
849	return result;
850	}
851
852	/*
853	* Curl_auth_ntlm_cleanup()
854	*
855	* This is used to clean up the NTLM specific data.
856	*
857	* Parameters:
858	*
859	* ntlm [in/out] - The NTLM data struct being cleaned up.
860	*
861	*/
862	void Curl_auth_ntlm_cleanup(struct ntlmdata *ntlm)
863	{
864	/* Free the target info */
865	Curl_safefree(ntlm->target_info);
866
867	/* Reset any variables */
868	ntlm->target_info_len = 0;
869	}
870
871	#endif /* USE_NTLM && !USE_WINDOWS_SSPI */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/curl-7.64.0/lib/vauth/ntlm.c@ 95219

Download in other formats: