ntlm.c 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.haxx.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. ***************************************************************************/
  22. #include "curl_setup.h"
  23. #if defined(USE_NTLM) && !defined(USE_WINDOWS_SSPI)
  24. /*
  25. * NTLM details:
  26. *
  27. * https://davenport.sourceforge.io/ntlm.html
  28. * https://www.innovation.ch/java/ntlm.html
  29. */
  30. #define DEBUG_ME 0
  31. #include "urldata.h"
  32. #include "non-ascii.h"
  33. #include "sendf.h"
  34. #include "curl_base64.h"
  35. #include "curl_ntlm_core.h"
  36. #include "curl_gethostname.h"
  37. #include "curl_multibyte.h"
  38. #include "curl_md5.h"
  39. #include "warnless.h"
  40. #include "rand.h"
  41. #include "vtls/vtls.h"
  42. /* SSL backend-specific #if branches in this file must be kept in the order
  43. documented in curl_ntlm_core. */
  44. #if defined(NTLM_NEEDS_NSS_INIT)
  45. #include "vtls/nssg.h" /* for Curl_nss_force_init() */
  46. #endif
  47. #define BUILDING_CURL_NTLM_MSGS_C
  48. #include "vauth/vauth.h"
  49. #include "vauth/ntlm.h"
  50. #include "curl_endian.h"
  51. #include "curl_printf.h"
  52. /* The last #include files should be: */
  53. #include "curl_memory.h"
  54. #include "memdebug.h"
  55. /* "NTLMSSP" signature is always in ASCII regardless of the platform */
  56. #define NTLMSSP_SIGNATURE "\x4e\x54\x4c\x4d\x53\x53\x50"
  57. #define SHORTPAIR(x) ((int)((x) & 0xff)), ((int)(((x) >> 8) & 0xff))
  58. #define LONGQUARTET(x) ((int)((x) & 0xff)), ((int)(((x) >> 8) & 0xff)), \
  59. ((int)(((x) >> 16) & 0xff)), ((int)(((x) >> 24) & 0xff))
  60. #if DEBUG_ME
  61. # define DEBUG_OUT(x) x
  62. static void ntlm_print_flags(FILE *handle, unsigned long flags)
  63. {
  64. if(flags & NTLMFLAG_NEGOTIATE_UNICODE)
  65. fprintf(handle, "NTLMFLAG_NEGOTIATE_UNICODE ");
  66. if(flags & NTLMFLAG_NEGOTIATE_OEM)
  67. fprintf(handle, "NTLMFLAG_NEGOTIATE_OEM ");
  68. if(flags & NTLMFLAG_REQUEST_TARGET)
  69. fprintf(handle, "NTLMFLAG_REQUEST_TARGET ");
  70. if(flags & (1<<3))
  71. fprintf(handle, "NTLMFLAG_UNKNOWN_3 ");
  72. if(flags & NTLMFLAG_NEGOTIATE_SIGN)
  73. fprintf(handle, "NTLMFLAG_NEGOTIATE_SIGN ");
  74. if(flags & NTLMFLAG_NEGOTIATE_SEAL)
  75. fprintf(handle, "NTLMFLAG_NEGOTIATE_SEAL ");
  76. if(flags & NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE)
  77. fprintf(handle, "NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE ");
  78. if(flags & NTLMFLAG_NEGOTIATE_LM_KEY)
  79. fprintf(handle, "NTLMFLAG_NEGOTIATE_LM_KEY ");
  80. if(flags & NTLMFLAG_NEGOTIATE_NETWARE)
  81. fprintf(handle, "NTLMFLAG_NEGOTIATE_NETWARE ");
  82. if(flags & NTLMFLAG_NEGOTIATE_NTLM_KEY)
  83. fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM_KEY ");
  84. if(flags & (1<<10))
  85. fprintf(handle, "NTLMFLAG_UNKNOWN_10 ");
  86. if(flags & NTLMFLAG_NEGOTIATE_ANONYMOUS)
  87. fprintf(handle, "NTLMFLAG_NEGOTIATE_ANONYMOUS ");
  88. if(flags & NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED)
  89. fprintf(handle, "NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED ");
  90. if(flags & NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED)
  91. fprintf(handle, "NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED ");
  92. if(flags & NTLMFLAG_NEGOTIATE_LOCAL_CALL)
  93. fprintf(handle, "NTLMFLAG_NEGOTIATE_LOCAL_CALL ");
  94. if(flags & NTLMFLAG_NEGOTIATE_ALWAYS_SIGN)
  95. fprintf(handle, "NTLMFLAG_NEGOTIATE_ALWAYS_SIGN ");
  96. if(flags & NTLMFLAG_TARGET_TYPE_DOMAIN)
  97. fprintf(handle, "NTLMFLAG_TARGET_TYPE_DOMAIN ");
  98. if(flags & NTLMFLAG_TARGET_TYPE_SERVER)
  99. fprintf(handle, "NTLMFLAG_TARGET_TYPE_SERVER ");
  100. if(flags & NTLMFLAG_TARGET_TYPE_SHARE)
  101. fprintf(handle, "NTLMFLAG_TARGET_TYPE_SHARE ");
  102. if(flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY)
  103. fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM2_KEY ");
  104. if(flags & NTLMFLAG_REQUEST_INIT_RESPONSE)
  105. fprintf(handle, "NTLMFLAG_REQUEST_INIT_RESPONSE ");
  106. if(flags & NTLMFLAG_REQUEST_ACCEPT_RESPONSE)
  107. fprintf(handle, "NTLMFLAG_REQUEST_ACCEPT_RESPONSE ");
  108. if(flags & NTLMFLAG_REQUEST_NONNT_SESSION_KEY)
  109. fprintf(handle, "NTLMFLAG_REQUEST_NONNT_SESSION_KEY ");
  110. if(flags & NTLMFLAG_NEGOTIATE_TARGET_INFO)
  111. fprintf(handle, "NTLMFLAG_NEGOTIATE_TARGET_INFO ");
  112. if(flags & (1<<24))
  113. fprintf(handle, "NTLMFLAG_UNKNOWN_24 ");
  114. if(flags & (1<<25))
  115. fprintf(handle, "NTLMFLAG_UNKNOWN_25 ");
  116. if(flags & (1<<26))
  117. fprintf(handle, "NTLMFLAG_UNKNOWN_26 ");
  118. if(flags & (1<<27))
  119. fprintf(handle, "NTLMFLAG_UNKNOWN_27 ");
  120. if(flags & (1<<28))
  121. fprintf(handle, "NTLMFLAG_UNKNOWN_28 ");
  122. if(flags & NTLMFLAG_NEGOTIATE_128)
  123. fprintf(handle, "NTLMFLAG_NEGOTIATE_128 ");
  124. if(flags & NTLMFLAG_NEGOTIATE_KEY_EXCHANGE)
  125. fprintf(handle, "NTLMFLAG_NEGOTIATE_KEY_EXCHANGE ");
  126. if(flags & NTLMFLAG_NEGOTIATE_56)
  127. fprintf(handle, "NTLMFLAG_NEGOTIATE_56 ");
  128. }
  129. static void ntlm_print_hex(FILE *handle, const char *buf, size_t len)
  130. {
  131. const char *p = buf;
  132. (void) handle;
  133. fprintf(stderr, "0x");
  134. while(len-- > 0)
  135. fprintf(stderr, "%02.2x", (unsigned int)*p++);
  136. }
  137. #else
  138. # define DEBUG_OUT(x) Curl_nop_stmt
  139. #endif
  140. /*
  141. * ntlm_decode_type2_target()
  142. *
  143. * This is used to decode the "target info" in the NTLM type-2 message
  144. * received.
  145. *
  146. * Parameters:
  147. *
  148. * data [in] - The session handle.
  149. * buffer [in] - The decoded type-2 message.
  150. * size [in] - The input buffer size, at least 32 bytes.
  151. * ntlm [in/out] - The NTLM data struct being used and modified.
  152. *
  153. * Returns CURLE_OK on success.
  154. */
  155. static CURLcode ntlm_decode_type2_target(struct Curl_easy *data,
  156. unsigned char *buffer,
  157. size_t size,
  158. struct ntlmdata *ntlm)
  159. {
  160. unsigned short target_info_len = 0;
  161. unsigned int target_info_offset = 0;
  162. #if defined(CURL_DISABLE_VERBOSE_STRINGS)
  163. (void) data;
  164. #endif
  165. if(size >= 48) {
  166. target_info_len = Curl_read16_le(&buffer[40]);
  167. target_info_offset = Curl_read32_le(&buffer[44]);
  168. if(target_info_len > 0) {
  169. if((target_info_offset >= size) ||
  170. ((target_info_offset + target_info_len) > size) ||
  171. (target_info_offset < 48)) {
  172. infof(data, "NTLM handshake failure (bad type-2 message). "
  173. "Target Info Offset Len is set incorrect by the peer\n");
  174. return CURLE_BAD_CONTENT_ENCODING;
  175. }
  176. ntlm->target_info = malloc(target_info_len);
  177. if(!ntlm->target_info)
  178. return CURLE_OUT_OF_MEMORY;
  179. memcpy(ntlm->target_info, &buffer[target_info_offset], target_info_len);
  180. }
  181. }
  182. ntlm->target_info_len = target_info_len;
  183. return CURLE_OK;
  184. }
  185. /*
  186. NTLM message structure notes:
  187. A 'short' is a 'network short', a little-endian 16-bit unsigned value.
  188. A 'long' is a 'network long', a little-endian, 32-bit unsigned value.
  189. A 'security buffer' represents a triplet used to point to a buffer,
  190. consisting of two shorts and one long:
  191. 1. A 'short' containing the length of the buffer content in bytes.
  192. 2. A 'short' containing the allocated space for the buffer in bytes.
  193. 3. A 'long' containing the offset to the start of the buffer in bytes,
  194. from the beginning of the NTLM message.
  195. */
  196. /*
  197. * Curl_auth_is_ntlm_supported()
  198. *
  199. * This is used to evaluate if NTLM is supported.
  200. *
  201. * Parameters: None
  202. *
  203. * Returns TRUE as NTLM as handled by libcurl.
  204. */
  205. bool Curl_auth_is_ntlm_supported(void)
  206. {
  207. return TRUE;
  208. }
  209. /*
  210. * Curl_auth_decode_ntlm_type2_message()
  211. *
  212. * This is used to decode an already encoded NTLM type-2 message. The message
  213. * is first decoded from a base64 string into a raw NTLM message and checked
  214. * for validity before the appropriate data for creating a type-3 message is
  215. * written to the given NTLM data structure.
  216. *
  217. * Parameters:
  218. *
  219. * data [in] - The session handle.
  220. * type2msg [in] - The base64 encoded type-2 message.
  221. * ntlm [in/out] - The NTLM data struct being used and modified.
  222. *
  223. * Returns CURLE_OK on success.
  224. */
  225. CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
  226. const char *type2msg,
  227. struct ntlmdata *ntlm)
  228. {
  229. static const char type2_marker[] = { 0x02, 0x00, 0x00, 0x00 };
  230. /* NTLM type-2 message structure:
  231. Index Description Content
  232. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  233. (0x4e544c4d53535000)
  234. 8 NTLM Message Type long (0x02000000)
  235. 12 Target Name security buffer
  236. 20 Flags long
  237. 24 Challenge 8 bytes
  238. (32) Context 8 bytes (two consecutive longs) (*)
  239. (40) Target Information security buffer (*)
  240. (48) OS Version Structure 8 bytes (*)
  241. 32 (48) (56) Start of data block (*)
  242. (*) -> Optional
  243. */
  244. CURLcode result = CURLE_OK;
  245. unsigned char *type2 = NULL;
  246. size_t type2_len = 0;
  247. #if defined(NTLM_NEEDS_NSS_INIT)
  248. /* Make sure the crypto backend is initialized */
  249. result = Curl_nss_force_init(data);
  250. if(result)
  251. return result;
  252. #elif defined(CURL_DISABLE_VERBOSE_STRINGS)
  253. (void)data;
  254. #endif
  255. /* Decode the base-64 encoded type-2 message */
  256. if(strlen(type2msg) && *type2msg != '=') {
  257. result = Curl_base64_decode(type2msg, &type2, &type2_len);
  258. if(result)
  259. return result;
  260. }
  261. /* Ensure we have a valid type-2 message */
  262. if(!type2) {
  263. infof(data, "NTLM handshake failure (empty type-2 message)\n");
  264. return CURLE_BAD_CONTENT_ENCODING;
  265. }
  266. ntlm->flags = 0;
  267. if((type2_len < 32) ||
  268. (memcmp(type2, NTLMSSP_SIGNATURE, 8) != 0) ||
  269. (memcmp(type2 + 8, type2_marker, sizeof(type2_marker)) != 0)) {
  270. /* This was not a good enough type-2 message */
  271. free(type2);
  272. infof(data, "NTLM handshake failure (bad type-2 message)\n");
  273. return CURLE_BAD_CONTENT_ENCODING;
  274. }
  275. ntlm->flags = Curl_read32_le(&type2[20]);
  276. memcpy(ntlm->nonce, &type2[24], 8);
  277. if(ntlm->flags & NTLMFLAG_NEGOTIATE_TARGET_INFO) {
  278. result = ntlm_decode_type2_target(data, type2, type2_len, ntlm);
  279. if(result) {
  280. free(type2);
  281. infof(data, "NTLM handshake failure (bad type-2 message)\n");
  282. return result;
  283. }
  284. }
  285. DEBUG_OUT({
  286. fprintf(stderr, "**** TYPE2 header flags=0x%08.8lx ", ntlm->flags);
  287. ntlm_print_flags(stderr, ntlm->flags);
  288. fprintf(stderr, "\n nonce=");
  289. ntlm_print_hex(stderr, (char *)ntlm->nonce, 8);
  290. fprintf(stderr, "\n****\n");
  291. fprintf(stderr, "**** Header %s\n ", header);
  292. });
  293. free(type2);
  294. return result;
  295. }
  296. /* copy the source to the destination and fill in zeroes in every
  297. other destination byte! */
  298. static void unicodecpy(unsigned char *dest, const char *src, size_t length)
  299. {
  300. size_t i;
  301. for(i = 0; i < length; i++) {
  302. dest[2 * i] = (unsigned char)src[i];
  303. dest[2 * i + 1] = '\0';
  304. }
  305. }
  306. /*
  307. * Curl_auth_create_ntlm_type1_message()
  308. *
  309. * This is used to generate an already encoded NTLM type-1 message ready for
  310. * sending to the recipient using the appropriate compile time crypto API.
  311. *
  312. * Parameters:
  313. *
  314. * data [in] - The session handle.
  315. * userp [in] - The user name in the format User or Domain\User.
  316. * passwdp [in] - The user's password.
  317. * service [in] - The service type such as http, smtp, pop or imap.
  318. * host [in] - The host name.
  319. * ntlm [in/out] - The NTLM data struct being used and modified.
  320. * outptr [in/out] - The address where a pointer to newly allocated memory
  321. * holding the result will be stored upon completion.
  322. * outlen [out] - The length of the output message.
  323. *
  324. * Returns CURLE_OK on success.
  325. */
  326. CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
  327. const char *userp,
  328. const char *passwdp,
  329. const char *service,
  330. const char *hostname,
  331. struct ntlmdata *ntlm,
  332. char **outptr, size_t *outlen)
  333. {
  334. /* NTLM type-1 message structure:
  335. Index Description Content
  336. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  337. (0x4e544c4d53535000)
  338. 8 NTLM Message Type long (0x01000000)
  339. 12 Flags long
  340. (16) Supplied Domain security buffer (*)
  341. (24) Supplied Workstation security buffer (*)
  342. (32) OS Version Structure 8 bytes (*)
  343. (32) (40) Start of data block (*)
  344. (*) -> Optional
  345. */
  346. size_t size;
  347. unsigned char ntlmbuf[NTLM_BUFSIZE];
  348. const char *host = ""; /* empty */
  349. const char *domain = ""; /* empty */
  350. size_t hostlen = 0;
  351. size_t domlen = 0;
  352. size_t hostoff = 0;
  353. size_t domoff = hostoff + hostlen; /* This is 0: remember that host and
  354. domain are empty */
  355. (void)userp;
  356. (void)passwdp;
  357. (void)service,
  358. (void)hostname,
  359. /* Clean up any former leftovers and initialise to defaults */
  360. Curl_auth_cleanup_ntlm(ntlm);
  361. #if defined(USE_NTRESPONSES) && defined(USE_NTLM2SESSION)
  362. #define NTLM2FLAG NTLMFLAG_NEGOTIATE_NTLM2_KEY
  363. #else
  364. #define NTLM2FLAG 0
  365. #endif
  366. msnprintf((char *)ntlmbuf, NTLM_BUFSIZE,
  367. NTLMSSP_SIGNATURE "%c"
  368. "\x01%c%c%c" /* 32-bit type = 1 */
  369. "%c%c%c%c" /* 32-bit NTLM flag field */
  370. "%c%c" /* domain length */
  371. "%c%c" /* domain allocated space */
  372. "%c%c" /* domain name offset */
  373. "%c%c" /* 2 zeroes */
  374. "%c%c" /* host length */
  375. "%c%c" /* host allocated space */
  376. "%c%c" /* host name offset */
  377. "%c%c" /* 2 zeroes */
  378. "%s" /* host name */
  379. "%s", /* domain string */
  380. 0, /* trailing zero */
  381. 0, 0, 0, /* part of type-1 long */
  382. LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
  383. NTLMFLAG_REQUEST_TARGET |
  384. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  385. NTLM2FLAG |
  386. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
  387. SHORTPAIR(domlen),
  388. SHORTPAIR(domlen),
  389. SHORTPAIR(domoff),
  390. 0, 0,
  391. SHORTPAIR(hostlen),
  392. SHORTPAIR(hostlen),
  393. SHORTPAIR(hostoff),
  394. 0, 0,
  395. host, /* this is empty */
  396. domain /* this is empty */);
  397. /* Initial packet length */
  398. size = 32 + hostlen + domlen;
  399. DEBUG_OUT({
  400. fprintf(stderr, "* TYPE1 header flags=0x%02.2x%02.2x%02.2x%02.2x "
  401. "0x%08.8x ",
  402. LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
  403. NTLMFLAG_REQUEST_TARGET |
  404. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  405. NTLM2FLAG |
  406. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
  407. NTLMFLAG_NEGOTIATE_OEM |
  408. NTLMFLAG_REQUEST_TARGET |
  409. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  410. NTLM2FLAG |
  411. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
  412. ntlm_print_flags(stderr,
  413. NTLMFLAG_NEGOTIATE_OEM |
  414. NTLMFLAG_REQUEST_TARGET |
  415. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  416. NTLM2FLAG |
  417. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
  418. fprintf(stderr, "\n****\n");
  419. });
  420. /* Return with binary blob encoded into base64 */
  421. return Curl_base64_encode(data, (char *)ntlmbuf, size, outptr, outlen);
  422. }
  423. /*
  424. * Curl_auth_create_ntlm_type3_message()
  425. *
  426. * This is used to generate an already encoded NTLM type-3 message ready for
  427. * sending to the recipient using the appropriate compile time crypto API.
  428. *
  429. * Parameters:
  430. *
  431. * data [in] - The session handle.
  432. * userp [in] - The user name in the format User or Domain\User.
  433. * passwdp [in] - The user's password.
  434. * ntlm [in/out] - The NTLM data struct being used and modified.
  435. * outptr [in/out] - The address where a pointer to newly allocated memory
  436. * holding the result will be stored upon completion.
  437. * outlen [out] - The length of the output message.
  438. *
  439. * Returns CURLE_OK on success.
  440. */
  441. CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
  442. const char *userp,
  443. const char *passwdp,
  444. struct ntlmdata *ntlm,
  445. char **outptr, size_t *outlen)
  446. {
  447. /* NTLM type-3 message structure:
  448. Index Description Content
  449. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  450. (0x4e544c4d53535000)
  451. 8 NTLM Message Type long (0x03000000)
  452. 12 LM/LMv2 Response security buffer
  453. 20 NTLM/NTLMv2 Response security buffer
  454. 28 Target Name security buffer
  455. 36 User Name security buffer
  456. 44 Workstation Name security buffer
  457. (52) Session Key security buffer (*)
  458. (60) Flags long (*)
  459. (64) OS Version Structure 8 bytes (*)
  460. 52 (64) (72) Start of data block
  461. (*) -> Optional
  462. */
  463. CURLcode result = CURLE_OK;
  464. size_t size;
  465. unsigned char ntlmbuf[NTLM_BUFSIZE];
  466. int lmrespoff;
  467. unsigned char lmresp[24]; /* fixed-size */
  468. #ifdef USE_NTRESPONSES
  469. int ntrespoff;
  470. unsigned int ntresplen = 24;
  471. unsigned char ntresp[24]; /* fixed-size */
  472. unsigned char *ptr_ntresp = &ntresp[0];
  473. unsigned char *ntlmv2resp = NULL;
  474. #endif
  475. bool unicode = (ntlm->flags & NTLMFLAG_NEGOTIATE_UNICODE) ? TRUE : FALSE;
  476. char host[HOSTNAME_MAX + 1] = "";
  477. const char *user;
  478. const char *domain = "";
  479. size_t hostoff = 0;
  480. size_t useroff = 0;
  481. size_t domoff = 0;
  482. size_t hostlen = 0;
  483. size_t userlen = 0;
  484. size_t domlen = 0;
  485. user = strchr(userp, '\\');
  486. if(!user)
  487. user = strchr(userp, '/');
  488. if(user) {
  489. domain = userp;
  490. domlen = (user - domain);
  491. user++;
  492. }
  493. else
  494. user = userp;
  495. userlen = strlen(user);
  496. /* Get the machine's un-qualified host name as NTLM doesn't like the fully
  497. qualified domain name */
  498. if(Curl_gethostname(host, sizeof(host))) {
  499. infof(data, "gethostname() failed, continuing without!\n");
  500. hostlen = 0;
  501. }
  502. else {
  503. hostlen = strlen(host);
  504. }
  505. #if defined(USE_NTRESPONSES) && defined(USE_NTLM_V2)
  506. if(ntlm->flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY) {
  507. unsigned char ntbuffer[0x18];
  508. unsigned char entropy[8];
  509. unsigned char ntlmv2hash[0x18];
  510. result = Curl_rand(data, entropy, 8);
  511. if(result)
  512. return result;
  513. result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
  514. if(result)
  515. return result;
  516. result = Curl_ntlm_core_mk_ntlmv2_hash(user, userlen, domain, domlen,
  517. ntbuffer, ntlmv2hash);
  518. if(result)
  519. return result;
  520. /* LMv2 response */
  521. result = Curl_ntlm_core_mk_lmv2_resp(ntlmv2hash, entropy,
  522. &ntlm->nonce[0], lmresp);
  523. if(result)
  524. return result;
  525. /* NTLMv2 response */
  526. result = Curl_ntlm_core_mk_ntlmv2_resp(ntlmv2hash, entropy,
  527. ntlm, &ntlmv2resp, &ntresplen);
  528. if(result)
  529. return result;
  530. ptr_ntresp = ntlmv2resp;
  531. }
  532. else
  533. #endif
  534. #if defined(USE_NTRESPONSES) && defined(USE_NTLM2SESSION)
  535. /* We don't support NTLM2 if we don't have USE_NTRESPONSES */
  536. if(ntlm->flags & NTLMFLAG_NEGOTIATE_NTLM_KEY) {
  537. unsigned char ntbuffer[0x18];
  538. unsigned char tmp[0x18];
  539. unsigned char md5sum[MD5_DIGEST_LENGTH];
  540. unsigned char entropy[8];
  541. /* Need to create 8 bytes random data */
  542. result = Curl_rand(data, entropy, 8);
  543. if(result)
  544. return result;
  545. /* 8 bytes random data as challenge in lmresp */
  546. memcpy(lmresp, entropy, 8);
  547. /* Pad with zeros */
  548. memset(lmresp + 8, 0, 0x10);
  549. /* Fill tmp with challenge(nonce?) + entropy */
  550. memcpy(tmp, &ntlm->nonce[0], 8);
  551. memcpy(tmp + 8, entropy, 8);
  552. Curl_md5it(md5sum, tmp, 16);
  553. /* We shall only use the first 8 bytes of md5sum, but the des code in
  554. Curl_ntlm_core_lm_resp only encrypt the first 8 bytes */
  555. result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
  556. if(result)
  557. return result;
  558. Curl_ntlm_core_lm_resp(ntbuffer, md5sum, ntresp);
  559. /* End of NTLM2 Session code */
  560. /* NTLM v2 session security is a misnomer because it is not NTLM v2.
  561. It is NTLM v1 using the extended session security that is also
  562. in NTLM v2 */
  563. }
  564. else
  565. #endif
  566. {
  567. #ifdef USE_NTRESPONSES
  568. unsigned char ntbuffer[0x18];
  569. #endif
  570. unsigned char lmbuffer[0x18];
  571. #ifdef USE_NTRESPONSES
  572. result = Curl_ntlm_core_mk_nt_hash(data, passwdp, ntbuffer);
  573. if(result)
  574. return result;
  575. Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], ntresp);
  576. #endif
  577. result = Curl_ntlm_core_mk_lm_hash(data, passwdp, lmbuffer);
  578. if(result)
  579. return result;
  580. Curl_ntlm_core_lm_resp(lmbuffer, &ntlm->nonce[0], lmresp);
  581. /* A safer but less compatible alternative is:
  582. * Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], lmresp);
  583. * See https://davenport.sourceforge.io/ntlm.html#ntlmVersion2 */
  584. }
  585. if(unicode) {
  586. domlen = domlen * 2;
  587. userlen = userlen * 2;
  588. hostlen = hostlen * 2;
  589. }
  590. lmrespoff = 64; /* size of the message header */
  591. #ifdef USE_NTRESPONSES
  592. ntrespoff = lmrespoff + 0x18;
  593. domoff = ntrespoff + ntresplen;
  594. #else
  595. domoff = lmrespoff + 0x18;
  596. #endif
  597. useroff = domoff + domlen;
  598. hostoff = useroff + userlen;
  599. /* Create the big type-3 message binary blob */
  600. size = msnprintf((char *)ntlmbuf, NTLM_BUFSIZE,
  601. NTLMSSP_SIGNATURE "%c"
  602. "\x03%c%c%c" /* 32-bit type = 3 */
  603. "%c%c" /* LanManager length */
  604. "%c%c" /* LanManager allocated space */
  605. "%c%c" /* LanManager offset */
  606. "%c%c" /* 2 zeroes */
  607. "%c%c" /* NT-response length */
  608. "%c%c" /* NT-response allocated space */
  609. "%c%c" /* NT-response offset */
  610. "%c%c" /* 2 zeroes */
  611. "%c%c" /* domain length */
  612. "%c%c" /* domain allocated space */
  613. "%c%c" /* domain name offset */
  614. "%c%c" /* 2 zeroes */
  615. "%c%c" /* user length */
  616. "%c%c" /* user allocated space */
  617. "%c%c" /* user offset */
  618. "%c%c" /* 2 zeroes */
  619. "%c%c" /* host length */
  620. "%c%c" /* host allocated space */
  621. "%c%c" /* host offset */
  622. "%c%c" /* 2 zeroes */
  623. "%c%c" /* session key length (unknown purpose) */
  624. "%c%c" /* session key allocated space (unknown purpose) */
  625. "%c%c" /* session key offset (unknown purpose) */
  626. "%c%c" /* 2 zeroes */
  627. "%c%c%c%c", /* flags */
  628. /* domain string */
  629. /* user string */
  630. /* host string */
  631. /* LanManager response */
  632. /* NT response */
  633. 0, /* zero termination */
  634. 0, 0, 0, /* type-3 long, the 24 upper bits */
  635. SHORTPAIR(0x18), /* LanManager response length, twice */
  636. SHORTPAIR(0x18),
  637. SHORTPAIR(lmrespoff),
  638. 0x0, 0x0,
  639. #ifdef USE_NTRESPONSES
  640. SHORTPAIR(ntresplen), /* NT-response length, twice */
  641. SHORTPAIR(ntresplen),
  642. SHORTPAIR(ntrespoff),
  643. 0x0, 0x0,
  644. #else
  645. 0x0, 0x0,
  646. 0x0, 0x0,
  647. 0x0, 0x0,
  648. 0x0, 0x0,
  649. #endif
  650. SHORTPAIR(domlen),
  651. SHORTPAIR(domlen),
  652. SHORTPAIR(domoff),
  653. 0x0, 0x0,
  654. SHORTPAIR(userlen),
  655. SHORTPAIR(userlen),
  656. SHORTPAIR(useroff),
  657. 0x0, 0x0,
  658. SHORTPAIR(hostlen),
  659. SHORTPAIR(hostlen),
  660. SHORTPAIR(hostoff),
  661. 0x0, 0x0,
  662. 0x0, 0x0,
  663. 0x0, 0x0,
  664. 0x0, 0x0,
  665. 0x0, 0x0,
  666. LONGQUARTET(ntlm->flags));
  667. DEBUGASSERT(size == 64);
  668. DEBUGASSERT(size == (size_t)lmrespoff);
  669. /* We append the binary hashes */
  670. if(size < (NTLM_BUFSIZE - 0x18)) {
  671. memcpy(&ntlmbuf[size], lmresp, 0x18);
  672. size += 0x18;
  673. }
  674. DEBUG_OUT({
  675. fprintf(stderr, "**** TYPE3 header lmresp=");
  676. ntlm_print_hex(stderr, (char *)&ntlmbuf[lmrespoff], 0x18);
  677. });
  678. #ifdef USE_NTRESPONSES
  679. /* ntresplen + size should not be risking an integer overflow here */
  680. if(ntresplen + size > sizeof(ntlmbuf)) {
  681. failf(data, "incoming NTLM message too big");
  682. return CURLE_OUT_OF_MEMORY;
  683. }
  684. DEBUGASSERT(size == (size_t)ntrespoff);
  685. memcpy(&ntlmbuf[size], ptr_ntresp, ntresplen);
  686. size += ntresplen;
  687. DEBUG_OUT({
  688. fprintf(stderr, "\n ntresp=");
  689. ntlm_print_hex(stderr, (char *)&ntlmbuf[ntrespoff], ntresplen);
  690. });
  691. free(ntlmv2resp);/* Free the dynamic buffer allocated for NTLMv2 */
  692. #endif
  693. DEBUG_OUT({
  694. fprintf(stderr, "\n flags=0x%02.2x%02.2x%02.2x%02.2x 0x%08.8x ",
  695. LONGQUARTET(ntlm->flags), ntlm->flags);
  696. ntlm_print_flags(stderr, ntlm->flags);
  697. fprintf(stderr, "\n****\n");
  698. });
  699. /* Make sure that the domain, user and host strings fit in the
  700. buffer before we copy them there. */
  701. if(size + userlen + domlen + hostlen >= NTLM_BUFSIZE) {
  702. failf(data, "user + domain + host name too big");
  703. return CURLE_OUT_OF_MEMORY;
  704. }
  705. DEBUGASSERT(size == domoff);
  706. if(unicode)
  707. unicodecpy(&ntlmbuf[size], domain, domlen / 2);
  708. else
  709. memcpy(&ntlmbuf[size], domain, domlen);
  710. size += domlen;
  711. DEBUGASSERT(size == useroff);
  712. if(unicode)
  713. unicodecpy(&ntlmbuf[size], user, userlen / 2);
  714. else
  715. memcpy(&ntlmbuf[size], user, userlen);
  716. size += userlen;
  717. DEBUGASSERT(size == hostoff);
  718. if(unicode)
  719. unicodecpy(&ntlmbuf[size], host, hostlen / 2);
  720. else
  721. memcpy(&ntlmbuf[size], host, hostlen);
  722. size += hostlen;
  723. /* Convert domain, user, and host to ASCII but leave the rest as-is */
  724. result = Curl_convert_to_network(data, (char *)&ntlmbuf[domoff],
  725. size - domoff);
  726. if(result)
  727. return CURLE_CONV_FAILED;
  728. /* Return with binary blob encoded into base64 */
  729. result = Curl_base64_encode(data, (char *)ntlmbuf, size, outptr, outlen);
  730. Curl_auth_cleanup_ntlm(ntlm);
  731. return result;
  732. }
  733. /*
  734. * Curl_auth_cleanup_ntlm()
  735. *
  736. * This is used to clean up the NTLM specific data.
  737. *
  738. * Parameters:
  739. *
  740. * ntlm [in/out] - The NTLM data struct being cleaned up.
  741. *
  742. */
  743. void Curl_auth_cleanup_ntlm(struct ntlmdata *ntlm)
  744. {
  745. /* Free the target info */
  746. Curl_safefree(ntlm->target_info);
  747. /* Reset any variables */
  748. ntlm->target_info_len = 0;
  749. }
  750. #endif /* USE_NTLM && !USE_WINDOWS_SSPI */