15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 55821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/http/http_auth_handler_ntlm.h" 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <stdlib.h> 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// For gethostname 95821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_POSIX) 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <unistd.h> 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(OS_WIN) 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <winsock2.h> 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/md5.h" 165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/rand_util.h" 177d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/strings/string_util.h" 18c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "base/strings/sys_string_conversions.h" 19868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "base/strings/utf_string_conversions.h" 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/base/net_errors.h" 215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/base/net_util.h" 225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/base/zap.h" 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/http/des.h" 245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/http/md4.h" 255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace net { 275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Based on mozilla/security/manager/ssl/src/nsNTLMAuthModule.cpp, 295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// CVS rev. 1.14. 305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// TODO(wtc): 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// - The IS_BIG_ENDIAN code is not tested. 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// - Enable the logging code or just delete it. 345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// - Delete or comment out the LM code, which hasn't been tested and isn't 355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// being used. 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)/* ***** BEGIN LICENSE BLOCK ***** 385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * Version: MPL 1.1/GPL 2.0/LGPL 2.1 395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * 405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * The contents of this file are subject to the Mozilla Public License Version 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * 1.1 (the "License"); you may not use this file except in compliance with 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * the License. You may obtain a copy of the License at 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * http://www.mozilla.org/MPL/ 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * Software distributed under the License is distributed on an "AS IS" basis, 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * for the specific language governing rights and limitations under the 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * License. 495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * 505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * The Original Code is Mozilla. 515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * 525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * The Initial Developer of the Original Code is IBM Corporation. 535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * Portions created by IBM Corporation are Copyright (C) 2003 545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * IBM Corporation. All Rights Reserved. 555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * 565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * Contributor(s): 575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * Darin Fisher <darin@meer.net> 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * 595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * Alternatively, the contents of this file may be used under the terms of 605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * either the GNU General Public License Version 2 or later (the "GPL"), or 615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), 625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * in which case the provisions of the GPL or the LGPL are applicable instead 635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * of those above. If you wish to allow use of your version of this file only 645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * under the terms of either the GPL or the LGPL, and not to allow others to 655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * use your version of this file under the terms of the MPL, indicate your 665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * decision by deleting the provisions above and replace them with the notice 675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * and other provisions required by the GPL or the LGPL. If you do not delete 685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * the provisions above, a recipient may use your version of this file under 695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * the terms of any one of the MPL, the GPL or the LGPL. 705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * 715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * ***** END LICENSE BLOCK ***** */ 725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Discover the endianness by testing processor architecture. 745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(ARCH_CPU_X86) || defined(ARCH_CPU_X86_64)\ 755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) || defined(ARCH_CPU_ARMEL) || defined(ARCH_CPU_MIPSEL) 765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#define IS_LITTLE_ENDIAN 1 775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#undef IS_BIG_ENDIAN 785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(ARCH_CPU_MIPSEB) 795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#define IS_BIG_ENDIAN 1 805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#undef IS_LITTLE_ENDIAN 815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#else 825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#error "Unknown endianness" 835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#define NTLM_LOG(x) ((void) 0) 865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)//----------------------------------------------------------------------------- 885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// This file contains a cross-platform NTLM authentication implementation. It 895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// is based on documentation from: http://davenport.sourceforge.net/ntlm.html 905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)//----------------------------------------------------------------------------- 915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)enum { 935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateUnicode = 0x00000001, 945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateOEM = 0x00000002, 955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_RequestTarget = 0x00000004, 965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Unknown1 = 0x00000008, 975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateSign = 0x00000010, 985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateSeal = 0x00000020, 995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateDatagramStyle = 0x00000040, 1005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateLanManagerKey = 0x00000080, 1015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateNetware = 0x00000100, 1025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateNTLMKey = 0x00000200, 1035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Unknown2 = 0x00000400, 1045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Unknown3 = 0x00000800, 1055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateDomainSupplied = 0x00001000, 1065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateWorkstationSupplied = 0x00002000, 1075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateLocalCall = 0x00004000, 1085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateAlwaysSign = 0x00008000, 1095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_TargetTypeDomain = 0x00010000, 1105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_TargetTypeServer = 0x00020000, 1115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_TargetTypeShare = 0x00040000, 1125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateNTLM2Key = 0x00080000, 1135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_RequestInitResponse = 0x00100000, 1145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_RequestAcceptResponse = 0x00200000, 1155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_RequestNonNTSessionKey = 0x00400000, 1165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateTargetInfo = 0x00800000, 1175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Unknown4 = 0x01000000, 1185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Unknown5 = 0x02000000, 1195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Unknown6 = 0x04000000, 1205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Unknown7 = 0x08000000, 1215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Unknown8 = 0x10000000, 1225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Negotiate128 = 0x20000000, 1235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateKeyExchange = 0x40000000, 1245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Negotiate56 = 0x80000000 1255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 1265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// We send these flags with our type 1 message. 1285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)enum { 1295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_TYPE1_FLAGS = (NTLM_NegotiateUnicode | 1305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateOEM | 1315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_RequestTarget | 1325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateNTLMKey | 1335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateAlwaysSign | 1345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_NegotiateNTLM2Key) 1355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 1365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static const char NTLM_SIGNATURE[] = "NTLMSSP"; 1385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static const char NTLM_TYPE1_MARKER[] = { 0x01, 0x00, 0x00, 0x00 }; 1395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static const char NTLM_TYPE2_MARKER[] = { 0x02, 0x00, 0x00, 0x00 }; 1405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static const char NTLM_TYPE3_MARKER[] = { 0x03, 0x00, 0x00, 0x00 }; 1415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)enum { 1435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_TYPE1_HEADER_LEN = 32, 1445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_TYPE2_HEADER_LEN = 32, 1455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_TYPE3_HEADER_LEN = 64, 1465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LM_HASH_LEN = 16, 1485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LM_RESP_LEN = 24, 1495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_HASH_LEN = 16, 1515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_RESP_LEN = 24 1525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 1535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)//----------------------------------------------------------------------------- 1555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// The return value of this function controls whether or not the LM hash will 1575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// be included in response to a NTLM challenge. 1585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 1595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// In Mozilla, this function returns the value of the boolean preference 1605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// "network.ntlm.send-lm-response". By default, the preference is disabled 1615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// since servers should almost never need the LM hash, and the LM hash is what 1625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// makes NTLM authentication less secure. See 1635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// https://bugzilla.mozilla.org/show_bug.cgi?id=250691 for further details. 1645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 1655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// We just return a hardcoded false. 1665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static bool SendLM() { 1675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 1685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)//----------------------------------------------------------------------------- 1715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#define LogFlags(x) ((void) 0) 1735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#define LogBuf(a, b, c) ((void) 0) 1745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#define LogToken(a, b, c) ((void) 0) 1755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)//----------------------------------------------------------------------------- 1775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Byte order swapping. 1795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#define SWAP16(x) ((((x) & 0xff) << 8) | (((x) >> 8) & 0xff)) 1805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#define SWAP32(x) ((SWAP16((x) & 0xffff) << 16) | (SWAP16((x) >> 16))) 1815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static void* WriteBytes(void* buf, const void* data, uint32 data_len) { 1835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(buf, data, data_len); 1845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return static_cast<char*>(buf) + data_len; 1855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static void* WriteDWORD(void* buf, uint32 dword) { 1885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#ifdef IS_BIG_ENDIAN 1895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NTLM uses little endian on the wire. 1905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) dword = SWAP32(dword); 1915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 1925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return WriteBytes(buf, &dword, sizeof(dword)); 1935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static void* WriteSecBuf(void* buf, uint16 length, uint32 offset) { 1965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#ifdef IS_BIG_ENDIAN 1975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) length = SWAP16(length); 1985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) offset = SWAP32(offset); 1995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 2005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) buf = WriteBytes(buf, &length, sizeof(length)); 2015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) buf = WriteBytes(buf, &length, sizeof(length)); 2025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) buf = WriteBytes(buf, &offset, sizeof(offset)); 2035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return buf; 2045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#ifdef IS_BIG_ENDIAN 2075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)/** 2085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * WriteUnicodeLE copies a unicode string from one buffer to another. The 2095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * resulting unicode string is in little-endian format. The input string is 2105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * assumed to be in the native endianness of the local machine. It is safe 2115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * to pass the same buffer as both input and output, which is a handy way to 2125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) * convert the unicode buffer to little-endian on big-endian platforms. 2135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) */ 2145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static void* WriteUnicodeLE(void* buf, const char16* str, uint32 str_len) { 2155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Convert input string from BE to LE. 2165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8* cursor = static_cast<uint8*>(buf); 2175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const uint8* input = reinterpret_cast<const uint8*>(str); 2185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (uint32 i = 0; i < str_len; ++i, input += 2, cursor += 2) { 2195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Allow for the case where |buf == str|. 2205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8 temp = input[0]; 2215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor[0] = input[1]; 2225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor[1] = temp; 2235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return buf; 2255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 2275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static uint16 ReadUint16(const uint8*& buf) { 2295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint16 x = (static_cast<uint16>(buf[0])) | 2305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) (static_cast<uint16>(buf[1]) << 8); 2315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) buf += sizeof(x); 2325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return x; 2335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static uint32 ReadUint32(const uint8*& buf) { 2365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 x = (static_cast<uint32>(buf[0])) | 2375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) (static_cast<uint32>(buf[1]) << 8) | 2385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) (static_cast<uint32>(buf[2]) << 16) | 2395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) (static_cast<uint32>(buf[3]) << 24); 2405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) buf += sizeof(x); 2415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return x; 2425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)//----------------------------------------------------------------------------- 2455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// LM_Hash computes the LM hash of the given password. 2475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 2485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// param password 2495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// unicode password. 2505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// param hash 2515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 16-byte result buffer 2525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 2535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Note: This function is not being used because our SendLM() function always 2545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// returns false. 255c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)static void LM_Hash(const base::string16& password, uint8* hash) { 2565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static const uint8 LM_MAGIC[] = "KGS!@#$%"; 2575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Convert password to OEM character set. We'll just use the native 2595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // filesystem charset. 2605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string passbuf = base::SysWideToNativeMB(UTF16ToWide(password)); 2615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) StringToUpperASCII(&passbuf); 2625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) passbuf.resize(14, '\0'); 2635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8 k1[8], k2[8]; 2655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DESMakeKey(reinterpret_cast<const uint8*>(passbuf.data()) , k1); 2665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DESMakeKey(reinterpret_cast<const uint8*>(passbuf.data()) + 7, k2); 2675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ZapString(&passbuf); 2685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Use password keys to hash LM magic string twice. 2705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DESEncrypt(k1, LM_MAGIC, hash); 2715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DESEncrypt(k2, LM_MAGIC, hash + 8); 2725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// NTLM_Hash computes the NTLM hash of the given password. 2755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 2765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// param password 2775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// null-terminated unicode password. 2785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// param hash 2795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 16-byte result buffer 280c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)static void NTLM_Hash(const base::string16& password, uint8* hash) { 2815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#ifdef IS_BIG_ENDIAN 2825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 len = password.length(); 2835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8* passbuf; 2845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) passbuf = static_cast<uint8*>(malloc(len * 2)); 2865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) WriteUnicodeLE(passbuf, password.data(), len); 2875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) weak_crypto::MD4Sum(passbuf, len * 2, hash); 2885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ZapBuf(passbuf, len * 2); 2905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) free(passbuf); 2915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#else 2925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) weak_crypto::MD4Sum(reinterpret_cast<const uint8*>(password.data()), 2935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) password.length() * 2, hash); 2945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 2955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)//----------------------------------------------------------------------------- 2985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// LM_Response generates the LM response given a 16-byte password hash and the 3005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// challenge from the Type-2 message. 3015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 3025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// param hash 3035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 16-byte password hash 3045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// param challenge 3055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 8-byte challenge from Type-2 message 3065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// param response 3075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 24-byte buffer to contain the LM response upon return 3085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static void LM_Response(const uint8* hash, 3095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const uint8* challenge, 3105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8* response) { 3115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8 keybytes[21], k1[8], k2[8], k3[8]; 3125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(keybytes, hash, 16); 3145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ZapBuf(keybytes + 16, 5); 3155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DESMakeKey(keybytes , k1); 3175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DESMakeKey(keybytes + 7, k2); 3185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DESMakeKey(keybytes + 14, k3); 3195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DESEncrypt(k1, challenge, response); 3215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DESEncrypt(k2, challenge, response + 8); 3225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DESEncrypt(k3, challenge, response + 16); 3235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 3245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)//----------------------------------------------------------------------------- 3265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Returns OK or a network error code. 3285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static int GenerateType1Msg(void** out_buf, uint32* out_len) { 3295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 3305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Verify that buf_len is sufficient. 3315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 3325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *out_len = NTLM_TYPE1_HEADER_LEN; 3335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *out_buf = malloc(*out_len); 3345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!*out_buf) 3355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return ERR_OUT_OF_MEMORY; 3365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 3385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Write out type 1 message. 3395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 3405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void* cursor = *out_buf; 3415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 0 : signature 3435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteBytes(cursor, NTLM_SIGNATURE, sizeof(NTLM_SIGNATURE)); 3445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 8 : marker 3465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteBytes(cursor, NTLM_TYPE1_MARKER, sizeof(NTLM_TYPE1_MARKER)); 3475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 12 : flags 3495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteDWORD(cursor, NTLM_TYPE1_FLAGS); 3505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 3525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NOTE: It is common for the domain and workstation fields to be empty. 3535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This is true of Win2k clients, and my guess is that there is 3545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // little utility to sending these strings before the charset has 3555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // been negotiated. We follow suite -- anyways, it doesn't hurt 3565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // to save some bytes on the wire ;-) 3575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 3585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 16 : supplied domain security buffer (empty) 3605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteSecBuf(cursor, 0, 0); 3615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 24 : supplied workstation security buffer (empty) 3635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteSecBuf(cursor, 0, 0); 3645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return OK; 3665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 3675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)struct Type2Msg { 3695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 flags; // NTLM_Xxx bitwise combination 3705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8 challenge[8]; // 8 byte challenge 3715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const void* target; // target string (type depends on flags) 3725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 target_len; // target length in bytes 3735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 3745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Returns OK or a network error code. 3765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// TODO(wtc): This function returns ERR_UNEXPECTED when the input message is 3775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// invalid. We should return a better error code. 3785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static int ParseType2Msg(const void* in_buf, uint32 in_len, Type2Msg* msg) { 3795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Make sure in_buf is long enough to contain a meaningful type2 msg. 3805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 3815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 0 NTLMSSP Signature 3825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 8 NTLM Message Type 3835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 12 Target Name 3845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 20 Flags 3855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 24 Challenge 3865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 32 end of header, start of optional data blocks 3875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 3885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (in_len < NTLM_TYPE2_HEADER_LEN) 3895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return ERR_UNEXPECTED; 3905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const uint8* cursor = (const uint8*) in_buf; 3925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // verify NTLMSSP signature 3945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (memcmp(cursor, NTLM_SIGNATURE, sizeof(NTLM_SIGNATURE)) != 0) 3955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return ERR_UNEXPECTED; 3965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor += sizeof(NTLM_SIGNATURE); 3975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // verify Type-2 marker 3995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (memcmp(cursor, NTLM_TYPE2_MARKER, sizeof(NTLM_TYPE2_MARKER)) != 0) 4005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return ERR_UNEXPECTED; 4015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor += sizeof(NTLM_TYPE2_MARKER); 4025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // read target name security buffer 4045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 target_len = ReadUint16(cursor); 4055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ReadUint16(cursor); // discard next 16-bit value 4065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 offset = ReadUint32(cursor); // get offset from in_buf 4075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) msg->target_len = 0; 4085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) msg->target = NULL; 4095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Check the offset / length combo is in range of the input buffer, including 4105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // integer overflow checking. 4115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (offset + target_len > offset && offset + target_len <= in_len) { 4125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) msg->target_len = target_len; 4135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) msg->target = ((const uint8*) in_buf) + offset; 4145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // read flags 4175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) msg->flags = ReadUint32(cursor); 4185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // read challenge 4205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(msg->challenge, cursor, sizeof(msg->challenge)); 4215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor += sizeof(msg->challenge); 4225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_LOG(("NTLM type 2 message:\n")); 4245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LogBuf("target", (const uint8*) msg->target, msg->target_len); 4255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LogBuf("flags", (const uint8*) &msg->flags, 4); 4265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LogFlags(msg->flags); 4275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LogBuf("challenge", msg->challenge, sizeof(msg->challenge)); 4285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // We currently do not implement LMv2/NTLMv2 or NTLM2 responses, 4305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // so we can ignore target information. We may want to enable 4315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // support for these alternate mechanisms in the future. 4325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return OK; 4335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 4345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static void GenerateRandom(uint8* output, size_t n) { 4365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < n; ++i) 4375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) output[i] = base::RandInt(0, 255); 4385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 4395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Returns OK or a network error code. 441c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)static int GenerateType3Msg(const base::string16& domain, 442c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) const base::string16& username, 443c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) const base::string16& password, 4445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string& hostname, 4455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const void* rand_8_bytes, 4465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const void* in_buf, 4475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 in_len, 4485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void** out_buf, 4495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32* out_len) { 4505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // in_buf contains Type-2 msg (the challenge) from server. 4515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int rv; 4535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) Type2Msg msg; 4545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) rv = ParseType2Msg(in_buf, in_len, &msg); 4565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (rv != OK) 4575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return rv; 4585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool unicode = (msg.flags & NTLM_NegotiateUnicode) != 0; 4605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Temporary buffers for unicode strings 4625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#ifdef IS_BIG_ENDIAN 463c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) base::string16 ucs_domain_buf, ucs_user_buf; 4645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 465c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) base::string16 ucs_host_buf; 4665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Temporary buffers for oem strings 4675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string oem_domain_buf, oem_user_buf; 4685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Pointers and lengths for the string buffers; encoding is unicode if 4695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the "negotiate unicode" flag was set in the Type-2 message. 4705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const void* domain_ptr; 4715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const void* user_ptr; 4725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const void* host_ptr; 4735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 domain_len, user_len, host_len; 4745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 4765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Get domain name. 4775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 4785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (unicode) { 4795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#ifdef IS_BIG_ENDIAN 4805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ucs_domain_buf = domain; 4815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) domain_ptr = ucs_domain_buf.data(); 4825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) domain_len = ucs_domain_buf.length() * 2; 4835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) WriteUnicodeLE(const_cast<void*>(domain_ptr), (const char16*) domain_ptr, 4845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ucs_domain_buf.length()); 4855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#else 4865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) domain_ptr = domain.data(); 4875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) domain_len = domain.length() * 2; 4885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 4895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 4905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) oem_domain_buf = base::SysWideToNativeMB(UTF16ToWide(domain)); 4915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) domain_ptr = oem_domain_buf.data(); 4925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) domain_len = oem_domain_buf.length(); 4935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 4965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Get user name. 4975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 4985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (unicode) { 4995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#ifdef IS_BIG_ENDIAN 5005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ucs_user_buf = username; 5015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) user_ptr = ucs_user_buf.data(); 5025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) user_len = ucs_user_buf.length() * 2; 5035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) WriteUnicodeLE(const_cast<void*>(user_ptr), (const char16*) user_ptr, 5045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ucs_user_buf.length()); 5055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#else 5065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) user_ptr = username.data(); 5075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) user_len = username.length() * 2; 5085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 5095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 5105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) oem_user_buf = base::SysWideToNativeMB(UTF16ToWide(username)); 5115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) user_ptr = oem_user_buf.data(); 5125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) user_len = oem_user_buf.length(); 5135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 5165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Get workstation name (use local machine's hostname). 5175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 5185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (unicode) { 5195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // hostname is ASCII, so we can do a simple zero-pad expansion: 5205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ucs_host_buf.assign(hostname.begin(), hostname.end()); 5215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) host_ptr = ucs_host_buf.data(); 5225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) host_len = ucs_host_buf.length() * 2; 5235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#ifdef IS_BIG_ENDIAN 5245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) WriteUnicodeLE(const_cast<void*>(host_ptr), (const char16*) host_ptr, 5255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ucs_host_buf.length()); 5265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 5275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 5285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) host_ptr = hostname.data(); 5295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) host_len = hostname.length(); 5305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 5335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Now that we have generated all of the strings, we can allocate out_buf. 5345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 5355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *out_len = NTLM_TYPE3_HEADER_LEN + host_len + domain_len + user_len + 5365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LM_RESP_LEN + NTLM_RESP_LEN; 5375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *out_buf = malloc(*out_len); 5385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!*out_buf) 5395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return ERR_OUT_OF_MEMORY; 5405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 5425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Next, we compute the LM and NTLM responses. 5435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 5445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8 lm_resp[LM_RESP_LEN]; 5455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8 ntlm_resp[NTLM_RESP_LEN]; 5465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8 ntlm_hash[NTLM_HASH_LEN]; 5475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (msg.flags & NTLM_NegotiateNTLM2Key) { 5485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // compute NTLM2 session response 5495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::MD5Digest session_hash; 5505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8 temp[16]; 5515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(lm_resp, rand_8_bytes, 8); 5535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memset(lm_resp + 8, 0, LM_RESP_LEN - 8); 5545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(temp, msg.challenge, 8); 5565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(temp + 8, lm_resp, 8); 5575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::MD5Sum(temp, 16, &session_hash); 5585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Hash(password, ntlm_hash); 5605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LM_Response(ntlm_hash, session_hash.a, ntlm_resp); 5615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 5625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NTLM_Hash(password, ntlm_hash); 5635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LM_Response(ntlm_hash, msg.challenge, ntlm_resp); 5645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (SendLM()) { 5665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8 lm_hash[LM_HASH_LEN]; 5675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LM_Hash(password, lm_hash); 5685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LM_Response(lm_hash, msg.challenge, lm_resp); 5695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 5705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // According to http://davenport.sourceforge.net/ntlm.html#ntlmVersion2, 5715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the correct way to not send the LM hash is to send the NTLM hash twice 5725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // in both the LM and NTLM response fields. 5735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LM_Response(ntlm_hash, msg.challenge, lm_resp); 5745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 5785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Finally, we assemble the Type-3 msg :-) 5795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 5805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void* cursor = *out_buf; 5815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 offset; 5825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 0 : signature 5845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteBytes(cursor, NTLM_SIGNATURE, sizeof(NTLM_SIGNATURE)); 5855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 8 : marker 5875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteBytes(cursor, NTLM_TYPE3_MARKER, sizeof(NTLM_TYPE3_MARKER)); 5885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 12 : LM response sec buf 5905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) offset = NTLM_TYPE3_HEADER_LEN + domain_len + user_len + host_len; 5915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteSecBuf(cursor, LM_RESP_LEN, offset); 5925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(static_cast<uint8*>(*out_buf) + offset, lm_resp, LM_RESP_LEN); 5935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 20 : NTLM response sec buf 5955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) offset += LM_RESP_LEN; 5965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteSecBuf(cursor, NTLM_RESP_LEN, offset); 5975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(static_cast<uint8*>(*out_buf) + offset, ntlm_resp, NTLM_RESP_LEN); 5985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 28 : domain name sec buf 6005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) offset = NTLM_TYPE3_HEADER_LEN; 6015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteSecBuf(cursor, domain_len, offset); 6025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(static_cast<uint8*>(*out_buf) + offset, domain_ptr, domain_len); 6035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 36 : user name sec buf 6055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) offset += domain_len; 6065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteSecBuf(cursor, user_len, offset); 6075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(static_cast<uint8*>(*out_buf) + offset, user_ptr, user_len); 6085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 44 : workstation (host) name sec buf 6105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) offset += user_len; 6115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteSecBuf(cursor, host_len, offset); 6125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(static_cast<uint8*>(*out_buf) + offset, host_ptr, host_len); 6135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 52 : session key sec buf (not used) 6155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteSecBuf(cursor, 0, 0); 6165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 60 : negotiated flags 6185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cursor = WriteDWORD(cursor, msg.flags & NTLM_TYPE1_FLAGS); 6195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return OK; 6215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// NTLM authentication is specified in "NTLM Over HTTP Protocol Specification" 6245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// [MS-NTHT]. 6255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 6275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::GenerateRandomProc 6285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::generate_random_proc_ = GenerateRandom; 6295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 6315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::HostNameProc 6325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::get_host_name_proc_ = GetHostName; 6335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::HttpAuthHandlerNTLM() { 6355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool HttpAuthHandlerNTLM::NeedsIdentity() { 6385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This gets called for each round-trip. Only require identity on 6395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the first call (when auth_data_ is empty). On subsequent calls, 6405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // we use the initially established identity. 6415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return auth_data_.empty(); 6425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool HttpAuthHandlerNTLM::AllowsDefaultCredentials() { 6455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Default credentials are not supported in the portable implementation of 6465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NTLM, but are supported in the SSPI implementation. 6475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 6485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)int HttpAuthHandlerNTLM::InitializeBeforeFirstChallenge() { 6515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return OK; 6525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::~HttpAuthHandlerNTLM() { 6555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) credentials_.Zap(); 6565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 6595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::GenerateRandomProc 6605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::SetGenerateRandomProc( 6615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) GenerateRandomProc proc) { 6625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) GenerateRandomProc old_proc = generate_random_proc_; 6635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) generate_random_proc_ = proc; 6645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return old_proc; 6655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 6685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::HostNameProc HttpAuthHandlerNTLM::SetHostNameProc( 6695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) HostNameProc proc) { 6705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) HostNameProc old_proc = get_host_name_proc_; 6715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) get_host_name_proc_ = proc; 6725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return old_proc; 6735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::Factory::Factory() { 6765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)HttpAuthHandlerNTLM::Factory::~Factory() { 6795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)int HttpAuthHandlerNTLM::GetNextToken(const void* in_token, 6825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 in_token_len, 6835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void** out_token, 6845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32* out_token_len) { 6855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int rv = 0; 6865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If in_token is non-null, then assume it contains a type 2 message... 6885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (in_token) { 6895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LogToken("in-token", in_token, in_token_len); 6905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string hostname = get_host_name_proc_(); 6915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (hostname.empty()) 6925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return ERR_UNEXPECTED; 6935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint8 rand_buf[8]; 6945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) generate_random_proc_(rand_buf, 8); 6955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) rv = GenerateType3Msg(domain_, 6965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) credentials_.username(), credentials_.password(), 6975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) hostname, rand_buf, 6985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) in_token, in_token_len, out_token, out_token_len); 6995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 7005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) rv = GenerateType1Msg(out_token, out_token_len); 7015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (rv == OK) 7045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LogToken("out-token", *out_token, *out_token_len); 7055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return rv; 7075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)int HttpAuthHandlerNTLM::Factory::CreateAuthHandler( 7105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) HttpAuth::ChallengeTokenizer* challenge, 7115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) HttpAuth::Target target, 7125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const GURL& origin, 7135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CreateReason reason, 7145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int digest_nonce_count, 7155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const BoundNetLog& net_log, 7165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) scoped_ptr<HttpAuthHandler>* handler) { 7175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (reason == CREATE_PREEMPTIVE) 7185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return ERR_UNSUPPORTED_AUTH_SCHEME; 7195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // TODO(cbentzel): Move towards model of parsing in the factory 7205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // method and only constructing when valid. 7215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NOTE: Default credentials are not supported for the portable implementation 7225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // of NTLM. 7235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) scoped_ptr<HttpAuthHandler> tmp_handler(new HttpAuthHandlerNTLM); 7245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log)) 7255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return ERR_INVALID_RESPONSE; 7265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) handler->swap(tmp_handler); 7275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return OK; 7285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace net 731