2
0

ntlm.c 25 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. #include "curl_setup.h"
  25. #if defined(USE_NTLM) && !defined(USE_WINDOWS_SSPI)
  26. /*
  27. * NTLM details:
  28. *
  29. * https://davenport.sourceforge.net/ntlm.html
  30. * https://www.innovation.ch/java/ntlm.html
  31. */
  32. #define DEBUG_ME 0
  33. #include "urldata.h"
  34. #include "sendf.h"
  35. #include "curl_ntlm_core.h"
  36. #include "curl_gethostname.h"
  37. #include "curl_multibyte.h"
  38. #include "curl_md5.h"
  39. #include "warnless.h"
  40. #include "rand.h"
  41. #include "vtls/vtls.h"
  42. /* SSL backend-specific #if branches in this file must be kept in the order
  43. documented in curl_ntlm_core. */
  44. #if defined(NTLM_NEEDS_NSS_INIT)
  45. #include "vtls/nssg.h" /* for Curl_nss_force_init() */
  46. #endif
  47. #define BUILDING_CURL_NTLM_MSGS_C
  48. #include "vauth/vauth.h"
  49. #include "vauth/ntlm.h"
  50. #include "curl_endian.h"
  51. #include "curl_printf.h"
  52. /* The last #include files should be: */
  53. #include "curl_memory.h"
  54. #include "memdebug.h"
  55. /* "NTLMSSP" signature is always in ASCII regardless of the platform */
  56. #define NTLMSSP_SIGNATURE "\x4e\x54\x4c\x4d\x53\x53\x50"
  57. /* The fixed host name we provide, in order to not leak our real local host
  58. name. Copy the name used by Firefox. */
  59. #define NTLM_HOSTNAME "WORKSTATION"
  60. #if DEBUG_ME
  61. # define DEBUG_OUT(x) x
  62. static void ntlm_print_flags(FILE *handle, unsigned long flags)
  63. {
  64. if(flags & NTLMFLAG_NEGOTIATE_UNICODE)
  65. fprintf(handle, "NTLMFLAG_NEGOTIATE_UNICODE ");
  66. if(flags & NTLMFLAG_NEGOTIATE_OEM)
  67. fprintf(handle, "NTLMFLAG_NEGOTIATE_OEM ");
  68. if(flags & NTLMFLAG_REQUEST_TARGET)
  69. fprintf(handle, "NTLMFLAG_REQUEST_TARGET ");
  70. if(flags & (1<<3))
  71. fprintf(handle, "NTLMFLAG_UNKNOWN_3 ");
  72. if(flags & NTLMFLAG_NEGOTIATE_SIGN)
  73. fprintf(handle, "NTLMFLAG_NEGOTIATE_SIGN ");
  74. if(flags & NTLMFLAG_NEGOTIATE_SEAL)
  75. fprintf(handle, "NTLMFLAG_NEGOTIATE_SEAL ");
  76. if(flags & NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE)
  77. fprintf(handle, "NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE ");
  78. if(flags & NTLMFLAG_NEGOTIATE_LM_KEY)
  79. fprintf(handle, "NTLMFLAG_NEGOTIATE_LM_KEY ");
  80. if(flags & NTLMFLAG_NEGOTIATE_NETWARE)
  81. fprintf(handle, "NTLMFLAG_NEGOTIATE_NETWARE ");
  82. if(flags & NTLMFLAG_NEGOTIATE_NTLM_KEY)
  83. fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM_KEY ");
  84. if(flags & (1<<10))
  85. fprintf(handle, "NTLMFLAG_UNKNOWN_10 ");
  86. if(flags & NTLMFLAG_NEGOTIATE_ANONYMOUS)
  87. fprintf(handle, "NTLMFLAG_NEGOTIATE_ANONYMOUS ");
  88. if(flags & NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED)
  89. fprintf(handle, "NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED ");
  90. if(flags & NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED)
  91. fprintf(handle, "NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED ");
  92. if(flags & NTLMFLAG_NEGOTIATE_LOCAL_CALL)
  93. fprintf(handle, "NTLMFLAG_NEGOTIATE_LOCAL_CALL ");
  94. if(flags & NTLMFLAG_NEGOTIATE_ALWAYS_SIGN)
  95. fprintf(handle, "NTLMFLAG_NEGOTIATE_ALWAYS_SIGN ");
  96. if(flags & NTLMFLAG_TARGET_TYPE_DOMAIN)
  97. fprintf(handle, "NTLMFLAG_TARGET_TYPE_DOMAIN ");
  98. if(flags & NTLMFLAG_TARGET_TYPE_SERVER)
  99. fprintf(handle, "NTLMFLAG_TARGET_TYPE_SERVER ");
  100. if(flags & NTLMFLAG_TARGET_TYPE_SHARE)
  101. fprintf(handle, "NTLMFLAG_TARGET_TYPE_SHARE ");
  102. if(flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY)
  103. fprintf(handle, "NTLMFLAG_NEGOTIATE_NTLM2_KEY ");
  104. if(flags & NTLMFLAG_REQUEST_INIT_RESPONSE)
  105. fprintf(handle, "NTLMFLAG_REQUEST_INIT_RESPONSE ");
  106. if(flags & NTLMFLAG_REQUEST_ACCEPT_RESPONSE)
  107. fprintf(handle, "NTLMFLAG_REQUEST_ACCEPT_RESPONSE ");
  108. if(flags & NTLMFLAG_REQUEST_NONNT_SESSION_KEY)
  109. fprintf(handle, "NTLMFLAG_REQUEST_NONNT_SESSION_KEY ");
  110. if(flags & NTLMFLAG_NEGOTIATE_TARGET_INFO)
  111. fprintf(handle, "NTLMFLAG_NEGOTIATE_TARGET_INFO ");
  112. if(flags & (1<<24))
  113. fprintf(handle, "NTLMFLAG_UNKNOWN_24 ");
  114. if(flags & (1<<25))
  115. fprintf(handle, "NTLMFLAG_UNKNOWN_25 ");
  116. if(flags & (1<<26))
  117. fprintf(handle, "NTLMFLAG_UNKNOWN_26 ");
  118. if(flags & (1<<27))
  119. fprintf(handle, "NTLMFLAG_UNKNOWN_27 ");
  120. if(flags & (1<<28))
  121. fprintf(handle, "NTLMFLAG_UNKNOWN_28 ");
  122. if(flags & NTLMFLAG_NEGOTIATE_128)
  123. fprintf(handle, "NTLMFLAG_NEGOTIATE_128 ");
  124. if(flags & NTLMFLAG_NEGOTIATE_KEY_EXCHANGE)
  125. fprintf(handle, "NTLMFLAG_NEGOTIATE_KEY_EXCHANGE ");
  126. if(flags & NTLMFLAG_NEGOTIATE_56)
  127. fprintf(handle, "NTLMFLAG_NEGOTIATE_56 ");
  128. }
  129. static void ntlm_print_hex(FILE *handle, const char *buf, size_t len)
  130. {
  131. const char *p = buf;
  132. (void) handle;
  133. fprintf(stderr, "0x");
  134. while(len-- > 0)
  135. fprintf(stderr, "%02.2x", (unsigned int)*p++);
  136. }
  137. #else
  138. # define DEBUG_OUT(x) Curl_nop_stmt
  139. #endif
  140. /*
  141. * ntlm_decode_type2_target()
  142. *
  143. * This is used to decode the "target info" in the NTLM type-2 message
  144. * received.
  145. *
  146. * Parameters:
  147. *
  148. * data [in] - The session handle.
  149. * type2ref [in] - The type-2 message.
  150. * ntlm [in/out] - The NTLM data struct being used and modified.
  151. *
  152. * Returns CURLE_OK on success.
  153. */
  154. static CURLcode ntlm_decode_type2_target(struct Curl_easy *data,
  155. const struct bufref *type2ref,
  156. struct ntlmdata *ntlm)
  157. {
  158. unsigned short target_info_len = 0;
  159. unsigned int target_info_offset = 0;
  160. const unsigned char *type2 = Curl_bufref_ptr(type2ref);
  161. size_t type2len = Curl_bufref_len(type2ref);
  162. #if defined(CURL_DISABLE_VERBOSE_STRINGS)
  163. (void) data;
  164. #endif
  165. if(type2len >= 48) {
  166. target_info_len = Curl_read16_le(&type2[40]);
  167. target_info_offset = Curl_read32_le(&type2[44]);
  168. if(target_info_len > 0) {
  169. if((target_info_offset > type2len) ||
  170. (target_info_offset + target_info_len) > type2len ||
  171. target_info_offset < 48) {
  172. infof(data, "NTLM handshake failure (bad type-2 message). "
  173. "Target Info Offset Len is set incorrect by the peer");
  174. return CURLE_BAD_CONTENT_ENCODING;
  175. }
  176. free(ntlm->target_info); /* replace any previous data */
  177. ntlm->target_info = malloc(target_info_len);
  178. if(!ntlm->target_info)
  179. return CURLE_OUT_OF_MEMORY;
  180. memcpy(ntlm->target_info, &type2[target_info_offset], target_info_len);
  181. }
  182. }
  183. ntlm->target_info_len = target_info_len;
  184. return CURLE_OK;
  185. }
  186. /*
  187. NTLM message structure notes:
  188. A 'short' is a 'network short', a little-endian 16-bit unsigned value.
  189. A 'long' is a 'network long', a little-endian, 32-bit unsigned value.
  190. A 'security buffer' represents a triplet used to point to a buffer,
  191. consisting of two shorts and one long:
  192. 1. A 'short' containing the length of the buffer content in bytes.
  193. 2. A 'short' containing the allocated space for the buffer in bytes.
  194. 3. A 'long' containing the offset to the start of the buffer in bytes,
  195. from the beginning of the NTLM message.
  196. */
  197. /*
  198. * Curl_auth_is_ntlm_supported()
  199. *
  200. * This is used to evaluate if NTLM is supported.
  201. *
  202. * Parameters: None
  203. *
  204. * Returns TRUE as NTLM as handled by libcurl.
  205. */
  206. bool Curl_auth_is_ntlm_supported(void)
  207. {
  208. return TRUE;
  209. }
  210. /*
  211. * Curl_auth_decode_ntlm_type2_message()
  212. *
  213. * This is used to decode an NTLM type-2 message. The raw NTLM message is
  214. * checked * for validity before the appropriate data for creating a type-3
  215. * message is * written to the given NTLM data structure.
  216. *
  217. * Parameters:
  218. *
  219. * data [in] - The session handle.
  220. * type2ref [in] - The type-2 message.
  221. * ntlm [in/out] - The NTLM data struct being used and modified.
  222. *
  223. * Returns CURLE_OK on success.
  224. */
  225. CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
  226. const struct bufref *type2ref,
  227. struct ntlmdata *ntlm)
  228. {
  229. static const char type2_marker[] = { 0x02, 0x00, 0x00, 0x00 };
  230. /* NTLM type-2 message structure:
  231. Index Description Content
  232. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  233. (0x4e544c4d53535000)
  234. 8 NTLM Message Type long (0x02000000)
  235. 12 Target Name security buffer
  236. 20 Flags long
  237. 24 Challenge 8 bytes
  238. (32) Context 8 bytes (two consecutive longs) (*)
  239. (40) Target Information security buffer (*)
  240. (48) OS Version Structure 8 bytes (*)
  241. 32 (48) (56) Start of data block (*)
  242. (*) -> Optional
  243. */
  244. CURLcode result = CURLE_OK;
  245. const unsigned char *type2 = Curl_bufref_ptr(type2ref);
  246. size_t type2len = Curl_bufref_len(type2ref);
  247. #if defined(NTLM_NEEDS_NSS_INIT)
  248. /* Make sure the crypto backend is initialized */
  249. result = Curl_nss_force_init(data);
  250. if(result)
  251. return result;
  252. #elif defined(CURL_DISABLE_VERBOSE_STRINGS)
  253. (void)data;
  254. #endif
  255. ntlm->flags = 0;
  256. if((type2len < 32) ||
  257. (memcmp(type2, NTLMSSP_SIGNATURE, 8) != 0) ||
  258. (memcmp(type2 + 8, type2_marker, sizeof(type2_marker)) != 0)) {
  259. /* This was not a good enough type-2 message */
  260. infof(data, "NTLM handshake failure (bad type-2 message)");
  261. return CURLE_BAD_CONTENT_ENCODING;
  262. }
  263. ntlm->flags = Curl_read32_le(&type2[20]);
  264. memcpy(ntlm->nonce, &type2[24], 8);
  265. if(ntlm->flags & NTLMFLAG_NEGOTIATE_TARGET_INFO) {
  266. result = ntlm_decode_type2_target(data, type2ref, ntlm);
  267. if(result) {
  268. infof(data, "NTLM handshake failure (bad type-2 message)");
  269. return result;
  270. }
  271. }
  272. DEBUG_OUT({
  273. fprintf(stderr, "**** TYPE2 header flags=0x%08.8lx ", ntlm->flags);
  274. ntlm_print_flags(stderr, ntlm->flags);
  275. fprintf(stderr, "\n nonce=");
  276. ntlm_print_hex(stderr, (char *)ntlm->nonce, 8);
  277. fprintf(stderr, "\n****\n");
  278. fprintf(stderr, "**** Header %s\n ", header);
  279. });
  280. return result;
  281. }
  282. /* copy the source to the destination and fill in zeroes in every
  283. other destination byte! */
  284. static void unicodecpy(unsigned char *dest, const char *src, size_t length)
  285. {
  286. size_t i;
  287. for(i = 0; i < length; i++) {
  288. dest[2 * i] = (unsigned char)src[i];
  289. dest[2 * i + 1] = '\0';
  290. }
  291. }
  292. /*
  293. * Curl_auth_create_ntlm_type1_message()
  294. *
  295. * This is used to generate an NTLM type-1 message ready for sending to the
  296. * recipient using the appropriate compile time crypto API.
  297. *
  298. * Parameters:
  299. *
  300. * data [in] - The session handle.
  301. * userp [in] - The user name in the format User or Domain\User.
  302. * passwdp [in] - The user's password.
  303. * service [in] - The service type such as http, smtp, pop or imap.
  304. * host [in] - The host name.
  305. * ntlm [in/out] - The NTLM data struct being used and modified.
  306. * out [out] - The result storage.
  307. *
  308. * Returns CURLE_OK on success.
  309. */
  310. CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
  311. const char *userp,
  312. const char *passwdp,
  313. const char *service,
  314. const char *hostname,
  315. struct ntlmdata *ntlm,
  316. struct bufref *out)
  317. {
  318. /* NTLM type-1 message structure:
  319. Index Description Content
  320. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  321. (0x4e544c4d53535000)
  322. 8 NTLM Message Type long (0x01000000)
  323. 12 Flags long
  324. (16) Supplied Domain security buffer (*)
  325. (24) Supplied Workstation security buffer (*)
  326. (32) OS Version Structure 8 bytes (*)
  327. (32) (40) Start of data block (*)
  328. (*) -> Optional
  329. */
  330. size_t size;
  331. char *ntlmbuf;
  332. const char *host = ""; /* empty */
  333. const char *domain = ""; /* empty */
  334. size_t hostlen = 0;
  335. size_t domlen = 0;
  336. size_t hostoff = 0;
  337. size_t domoff = hostoff + hostlen; /* This is 0: remember that host and
  338. domain are empty */
  339. (void)data;
  340. (void)userp;
  341. (void)passwdp;
  342. (void)service,
  343. (void)hostname,
  344. /* Clean up any former leftovers and initialise to defaults */
  345. Curl_auth_cleanup_ntlm(ntlm);
  346. ntlmbuf = aprintf(NTLMSSP_SIGNATURE "%c"
  347. "\x01%c%c%c" /* 32-bit type = 1 */
  348. "%c%c%c%c" /* 32-bit NTLM flag field */
  349. "%c%c" /* domain length */
  350. "%c%c" /* domain allocated space */
  351. "%c%c" /* domain name offset */
  352. "%c%c" /* 2 zeroes */
  353. "%c%c" /* host length */
  354. "%c%c" /* host allocated space */
  355. "%c%c" /* host name offset */
  356. "%c%c" /* 2 zeroes */
  357. "%s" /* host name */
  358. "%s", /* domain string */
  359. 0, /* trailing zero */
  360. 0, 0, 0, /* part of type-1 long */
  361. LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
  362. NTLMFLAG_REQUEST_TARGET |
  363. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  364. NTLMFLAG_NEGOTIATE_NTLM2_KEY |
  365. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
  366. SHORTPAIR(domlen),
  367. SHORTPAIR(domlen),
  368. SHORTPAIR(domoff),
  369. 0, 0,
  370. SHORTPAIR(hostlen),
  371. SHORTPAIR(hostlen),
  372. SHORTPAIR(hostoff),
  373. 0, 0,
  374. host, /* this is empty */
  375. domain /* this is empty */);
  376. if(!ntlmbuf)
  377. return CURLE_OUT_OF_MEMORY;
  378. /* Initial packet length */
  379. size = 32 + hostlen + domlen;
  380. DEBUG_OUT({
  381. fprintf(stderr, "* TYPE1 header flags=0x%02.2x%02.2x%02.2x%02.2x "
  382. "0x%08.8x ",
  383. LONGQUARTET(NTLMFLAG_NEGOTIATE_OEM |
  384. NTLMFLAG_REQUEST_TARGET |
  385. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  386. NTLMFLAG_NEGOTIATE_NTLM2_KEY |
  387. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN),
  388. NTLMFLAG_NEGOTIATE_OEM |
  389. NTLMFLAG_REQUEST_TARGET |
  390. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  391. NTLMFLAG_NEGOTIATE_NTLM2_KEY |
  392. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
  393. ntlm_print_flags(stderr,
  394. NTLMFLAG_NEGOTIATE_OEM |
  395. NTLMFLAG_REQUEST_TARGET |
  396. NTLMFLAG_NEGOTIATE_NTLM_KEY |
  397. NTLMFLAG_NEGOTIATE_NTLM2_KEY |
  398. NTLMFLAG_NEGOTIATE_ALWAYS_SIGN);
  399. fprintf(stderr, "\n****\n");
  400. });
  401. Curl_bufref_set(out, ntlmbuf, size, curl_free);
  402. return CURLE_OK;
  403. }
  404. /*
  405. * Curl_auth_create_ntlm_type3_message()
  406. *
  407. * This is used to generate an already encoded NTLM type-3 message ready for
  408. * sending to the recipient using the appropriate compile time crypto API.
  409. *
  410. * Parameters:
  411. *
  412. * data [in] - The session handle.
  413. * userp [in] - The user name in the format User or Domain\User.
  414. * passwdp [in] - The user's password.
  415. * ntlm [in/out] - The NTLM data struct being used and modified.
  416. * out [out] - The result storage.
  417. *
  418. * Returns CURLE_OK on success.
  419. */
  420. CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
  421. const char *userp,
  422. const char *passwdp,
  423. struct ntlmdata *ntlm,
  424. struct bufref *out)
  425. {
  426. /* NTLM type-3 message structure:
  427. Index Description Content
  428. 0 NTLMSSP Signature Null-terminated ASCII "NTLMSSP"
  429. (0x4e544c4d53535000)
  430. 8 NTLM Message Type long (0x03000000)
  431. 12 LM/LMv2 Response security buffer
  432. 20 NTLM/NTLMv2 Response security buffer
  433. 28 Target Name security buffer
  434. 36 User Name security buffer
  435. 44 Workstation Name security buffer
  436. (52) Session Key security buffer (*)
  437. (60) Flags long (*)
  438. (64) OS Version Structure 8 bytes (*)
  439. 52 (64) (72) Start of data block
  440. (*) -> Optional
  441. */
  442. CURLcode result = CURLE_OK;
  443. size_t size;
  444. unsigned char ntlmbuf[NTLM_BUFSIZE];
  445. int lmrespoff;
  446. unsigned char lmresp[24]; /* fixed-size */
  447. int ntrespoff;
  448. unsigned int ntresplen = 24;
  449. unsigned char ntresp[24]; /* fixed-size */
  450. unsigned char *ptr_ntresp = &ntresp[0];
  451. unsigned char *ntlmv2resp = NULL;
  452. bool unicode = (ntlm->flags & NTLMFLAG_NEGOTIATE_UNICODE) ? TRUE : FALSE;
  453. char host[HOSTNAME_MAX + 1] = "";
  454. const char *user;
  455. const char *domain = "";
  456. size_t hostoff = 0;
  457. size_t useroff = 0;
  458. size_t domoff = 0;
  459. size_t hostlen = 0;
  460. size_t userlen = 0;
  461. size_t domlen = 0;
  462. user = strchr(userp, '\\');
  463. if(!user)
  464. user = strchr(userp, '/');
  465. if(user) {
  466. domain = userp;
  467. domlen = (user - domain);
  468. user++;
  469. }
  470. else
  471. user = userp;
  472. userlen = strlen(user);
  473. #ifndef NTLM_HOSTNAME
  474. /* Get the machine's un-qualified host name as NTLM doesn't like the fully
  475. qualified domain name */
  476. if(Curl_gethostname(host, sizeof(host))) {
  477. infof(data, "gethostname() failed, continuing without");
  478. hostlen = 0;
  479. }
  480. else {
  481. hostlen = strlen(host);
  482. }
  483. #else
  484. (void)msnprintf(host, sizeof(host), "%s", NTLM_HOSTNAME);
  485. hostlen = sizeof(NTLM_HOSTNAME)-1;
  486. #endif
  487. if(ntlm->flags & NTLMFLAG_NEGOTIATE_NTLM2_KEY) {
  488. unsigned char ntbuffer[0x18];
  489. unsigned char entropy[8];
  490. unsigned char ntlmv2hash[0x18];
  491. /* Full NTLM version 2
  492. Although this cannot be negotiated, it is used here if available, as
  493. servers featuring extended security are likely supporting also
  494. NTLMv2. */
  495. result = Curl_rand(data, entropy, 8);
  496. if(result)
  497. return result;
  498. result = Curl_ntlm_core_mk_nt_hash(passwdp, ntbuffer);
  499. if(result)
  500. return result;
  501. result = Curl_ntlm_core_mk_ntlmv2_hash(user, userlen, domain, domlen,
  502. ntbuffer, ntlmv2hash);
  503. if(result)
  504. return result;
  505. /* LMv2 response */
  506. result = Curl_ntlm_core_mk_lmv2_resp(ntlmv2hash, entropy,
  507. &ntlm->nonce[0], lmresp);
  508. if(result)
  509. return result;
  510. /* NTLMv2 response */
  511. result = Curl_ntlm_core_mk_ntlmv2_resp(ntlmv2hash, entropy,
  512. ntlm, &ntlmv2resp, &ntresplen);
  513. if(result)
  514. return result;
  515. ptr_ntresp = ntlmv2resp;
  516. }
  517. else {
  518. unsigned char ntbuffer[0x18];
  519. unsigned char lmbuffer[0x18];
  520. /* NTLM version 1 */
  521. result = Curl_ntlm_core_mk_nt_hash(passwdp, ntbuffer);
  522. if(result)
  523. return result;
  524. Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], ntresp);
  525. result = Curl_ntlm_core_mk_lm_hash(passwdp, lmbuffer);
  526. if(result)
  527. return result;
  528. Curl_ntlm_core_lm_resp(lmbuffer, &ntlm->nonce[0], lmresp);
  529. ntlm->flags &= ~NTLMFLAG_NEGOTIATE_NTLM2_KEY;
  530. /* A safer but less compatible alternative is:
  531. * Curl_ntlm_core_lm_resp(ntbuffer, &ntlm->nonce[0], lmresp);
  532. * See https://davenport.sourceforge.net/ntlm.html#ntlmVersion2 */
  533. }
  534. if(unicode) {
  535. domlen = domlen * 2;
  536. userlen = userlen * 2;
  537. hostlen = hostlen * 2;
  538. }
  539. lmrespoff = 64; /* size of the message header */
  540. ntrespoff = lmrespoff + 0x18;
  541. domoff = ntrespoff + ntresplen;
  542. useroff = domoff + domlen;
  543. hostoff = useroff + userlen;
  544. /* Create the big type-3 message binary blob */
  545. size = msnprintf((char *)ntlmbuf, NTLM_BUFSIZE,
  546. NTLMSSP_SIGNATURE "%c"
  547. "\x03%c%c%c" /* 32-bit type = 3 */
  548. "%c%c" /* LanManager length */
  549. "%c%c" /* LanManager allocated space */
  550. "%c%c" /* LanManager offset */
  551. "%c%c" /* 2 zeroes */
  552. "%c%c" /* NT-response length */
  553. "%c%c" /* NT-response allocated space */
  554. "%c%c" /* NT-response offset */
  555. "%c%c" /* 2 zeroes */
  556. "%c%c" /* domain length */
  557. "%c%c" /* domain allocated space */
  558. "%c%c" /* domain name offset */
  559. "%c%c" /* 2 zeroes */
  560. "%c%c" /* user length */
  561. "%c%c" /* user allocated space */
  562. "%c%c" /* user offset */
  563. "%c%c" /* 2 zeroes */
  564. "%c%c" /* host length */
  565. "%c%c" /* host allocated space */
  566. "%c%c" /* host offset */
  567. "%c%c" /* 2 zeroes */
  568. "%c%c" /* session key length (unknown purpose) */
  569. "%c%c" /* session key allocated space (unknown purpose) */
  570. "%c%c" /* session key offset (unknown purpose) */
  571. "%c%c" /* 2 zeroes */
  572. "%c%c%c%c", /* flags */
  573. /* domain string */
  574. /* user string */
  575. /* host string */
  576. /* LanManager response */
  577. /* NT response */
  578. 0, /* null-termination */
  579. 0, 0, 0, /* type-3 long, the 24 upper bits */
  580. SHORTPAIR(0x18), /* LanManager response length, twice */
  581. SHORTPAIR(0x18),
  582. SHORTPAIR(lmrespoff),
  583. 0x0, 0x0,
  584. SHORTPAIR(ntresplen), /* NT-response length, twice */
  585. SHORTPAIR(ntresplen),
  586. SHORTPAIR(ntrespoff),
  587. 0x0, 0x0,
  588. SHORTPAIR(domlen),
  589. SHORTPAIR(domlen),
  590. SHORTPAIR(domoff),
  591. 0x0, 0x0,
  592. SHORTPAIR(userlen),
  593. SHORTPAIR(userlen),
  594. SHORTPAIR(useroff),
  595. 0x0, 0x0,
  596. SHORTPAIR(hostlen),
  597. SHORTPAIR(hostlen),
  598. SHORTPAIR(hostoff),
  599. 0x0, 0x0,
  600. 0x0, 0x0,
  601. 0x0, 0x0,
  602. 0x0, 0x0,
  603. 0x0, 0x0,
  604. LONGQUARTET(ntlm->flags));
  605. DEBUGASSERT(size == 64);
  606. DEBUGASSERT(size == (size_t)lmrespoff);
  607. /* We append the binary hashes */
  608. if(size < (NTLM_BUFSIZE - 0x18)) {
  609. memcpy(&ntlmbuf[size], lmresp, 0x18);
  610. size += 0x18;
  611. }
  612. DEBUG_OUT({
  613. fprintf(stderr, "**** TYPE3 header lmresp=");
  614. ntlm_print_hex(stderr, (char *)&ntlmbuf[lmrespoff], 0x18);
  615. });
  616. /* ntresplen + size should not be risking an integer overflow here */
  617. if(ntresplen + size > sizeof(ntlmbuf)) {
  618. failf(data, "incoming NTLM message too big");
  619. return CURLE_OUT_OF_MEMORY;
  620. }
  621. DEBUGASSERT(size == (size_t)ntrespoff);
  622. memcpy(&ntlmbuf[size], ptr_ntresp, ntresplen);
  623. size += ntresplen;
  624. DEBUG_OUT({
  625. fprintf(stderr, "\n ntresp=");
  626. ntlm_print_hex(stderr, (char *)&ntlmbuf[ntrespoff], ntresplen);
  627. });
  628. free(ntlmv2resp);/* Free the dynamic buffer allocated for NTLMv2 */
  629. DEBUG_OUT({
  630. fprintf(stderr, "\n flags=0x%02.2x%02.2x%02.2x%02.2x 0x%08.8x ",
  631. LONGQUARTET(ntlm->flags), ntlm->flags);
  632. ntlm_print_flags(stderr, ntlm->flags);
  633. fprintf(stderr, "\n****\n");
  634. });
  635. /* Make sure that the domain, user and host strings fit in the
  636. buffer before we copy them there. */
  637. if(size + userlen + domlen + hostlen >= NTLM_BUFSIZE) {
  638. failf(data, "user + domain + host name too big");
  639. return CURLE_OUT_OF_MEMORY;
  640. }
  641. DEBUGASSERT(size == domoff);
  642. if(unicode)
  643. unicodecpy(&ntlmbuf[size], domain, domlen / 2);
  644. else
  645. memcpy(&ntlmbuf[size], domain, domlen);
  646. size += domlen;
  647. DEBUGASSERT(size == useroff);
  648. if(unicode)
  649. unicodecpy(&ntlmbuf[size], user, userlen / 2);
  650. else
  651. memcpy(&ntlmbuf[size], user, userlen);
  652. size += userlen;
  653. DEBUGASSERT(size == hostoff);
  654. if(unicode)
  655. unicodecpy(&ntlmbuf[size], host, hostlen / 2);
  656. else
  657. memcpy(&ntlmbuf[size], host, hostlen);
  658. size += hostlen;
  659. /* Return the binary blob. */
  660. result = Curl_bufref_memdup(out, ntlmbuf, size);
  661. Curl_auth_cleanup_ntlm(ntlm);
  662. return result;
  663. }
  664. /*
  665. * Curl_auth_cleanup_ntlm()
  666. *
  667. * This is used to clean up the NTLM specific data.
  668. *
  669. * Parameters:
  670. *
  671. * ntlm [in/out] - The NTLM data struct being cleaned up.
  672. *
  673. */
  674. void Curl_auth_cleanup_ntlm(struct ntlmdata *ntlm)
  675. {
  676. /* Free the target info */
  677. Curl_safefree(ntlm->target_info);
  678. /* Reset any variables */
  679. ntlm->target_info_len = 0;
  680. }
  681. #endif /* USE_NTLM && !USE_WINDOWS_SSPI */