| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/http/http_auth_handler_ntlm.h" | 5 #include "net/http/http_auth_handler_ntlm.h" |
| 6 | 6 |
| 7 #include <stdlib.h> | 7 #include <stdlib.h> |
| 8 // For gethostname | 8 // For gethostname |
| 9 #if defined(OS_POSIX) | 9 #if defined(OS_POSIX) |
| 10 #include <unistd.h> | 10 #include <unistd.h> |
| (...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 65 * use your version of this file under the terms of the MPL, indicate your | 65 * use your version of this file under the terms of the MPL, indicate your |
| 66 * decision by deleting the provisions above and replace them with the notice | 66 * decision by deleting the provisions above and replace them with the notice |
| 67 * and other provisions required by the GPL or the LGPL. If you do not delete | 67 * and other provisions required by the GPL or the LGPL. If you do not delete |
| 68 * the provisions above, a recipient may use your version of this file under | 68 * the provisions above, a recipient may use your version of this file under |
| 69 * the terms of any one of the MPL, the GPL or the LGPL. | 69 * the terms of any one of the MPL, the GPL or the LGPL. |
| 70 * | 70 * |
| 71 * ***** END LICENSE BLOCK ***** */ | 71 * ***** END LICENSE BLOCK ***** */ |
| 72 | 72 |
| 73 #if defined(ARCH_CPU_LITTLE_ENDIAN) | 73 #if defined(ARCH_CPU_LITTLE_ENDIAN) |
| 74 #define IS_LITTLE_ENDIAN 1 | 74 #define IS_LITTLE_ENDIAN 1 |
| 75 #undef IS_BIG_ENDIAN | 75 #undef IS_BIG_ENDIAN |
| 76 #elif defined(ARCH_CPU_BIG_ENDIAN) | 76 #elif defined(ARCH_CPU_BIG_ENDIAN) |
| 77 #define IS_BIG_ENDIAN 1 | 77 #define IS_BIG_ENDIAN 1 |
| 78 #undef IS_LITTLE_ENDIAN | 78 #undef IS_LITTLE_ENDIAN |
| 79 #else | 79 #else |
| 80 #error "Unknown endianness" | 80 #error "Unknown endianness" |
| 81 #endif | 81 #endif |
| 82 | 82 |
| 83 #define NTLM_LOG(x) ((void) 0) | 83 #define NTLM_LOG(x) ((void)0) |
| 84 | 84 |
| 85 //----------------------------------------------------------------------------- | 85 //----------------------------------------------------------------------------- |
| 86 // This file contains a cross-platform NTLM authentication implementation. It | 86 // This file contains a cross-platform NTLM authentication implementation. It |
| 87 // is based on documentation from: http://davenport.sourceforge.net/ntlm.html | 87 // is based on documentation from: http://davenport.sourceforge.net/ntlm.html |
| 88 //----------------------------------------------------------------------------- | 88 //----------------------------------------------------------------------------- |
| 89 | 89 |
| 90 enum { | 90 enum { |
| 91 NTLM_NegotiateUnicode = 0x00000001, | 91 NTLM_NegotiateUnicode = 0x00000001, |
| 92 NTLM_NegotiateOEM = 0x00000002, | 92 NTLM_NegotiateOEM = 0x00000002, |
| 93 NTLM_RequestTarget = 0x00000004, | 93 NTLM_RequestTarget = 0x00000004, |
| 94 NTLM_Unknown1 = 0x00000008, | 94 NTLM_Unknown1 = 0x00000008, |
| 95 NTLM_NegotiateSign = 0x00000010, | 95 NTLM_NegotiateSign = 0x00000010, |
| 96 NTLM_NegotiateSeal = 0x00000020, | 96 NTLM_NegotiateSeal = 0x00000020, |
| 97 NTLM_NegotiateDatagramStyle = 0x00000040, | 97 NTLM_NegotiateDatagramStyle = 0x00000040, |
| 98 NTLM_NegotiateLanManagerKey = 0x00000080, | 98 NTLM_NegotiateLanManagerKey = 0x00000080, |
| 99 NTLM_NegotiateNetware = 0x00000100, | 99 NTLM_NegotiateNetware = 0x00000100, |
| 100 NTLM_NegotiateNTLMKey = 0x00000200, | 100 NTLM_NegotiateNTLMKey = 0x00000200, |
| 101 NTLM_Unknown2 = 0x00000400, | 101 NTLM_Unknown2 = 0x00000400, |
| 102 NTLM_Unknown3 = 0x00000800, | 102 NTLM_Unknown3 = 0x00000800, |
| 103 NTLM_NegotiateDomainSupplied = 0x00001000, | 103 NTLM_NegotiateDomainSupplied = 0x00001000, |
| 104 NTLM_NegotiateWorkstationSupplied = 0x00002000, | 104 NTLM_NegotiateWorkstationSupplied = 0x00002000, |
| 105 NTLM_NegotiateLocalCall = 0x00004000, | 105 NTLM_NegotiateLocalCall = 0x00004000, |
| 106 NTLM_NegotiateAlwaysSign = 0x00008000, | 106 NTLM_NegotiateAlwaysSign = 0x00008000, |
| 107 NTLM_TargetTypeDomain = 0x00010000, | 107 NTLM_TargetTypeDomain = 0x00010000, |
| 108 NTLM_TargetTypeServer = 0x00020000, | 108 NTLM_TargetTypeServer = 0x00020000, |
| 109 NTLM_TargetTypeShare = 0x00040000, | 109 NTLM_TargetTypeShare = 0x00040000, |
| 110 NTLM_NegotiateNTLM2Key = 0x00080000, | 110 NTLM_NegotiateNTLM2Key = 0x00080000, |
| 111 NTLM_RequestInitResponse = 0x00100000, | 111 NTLM_RequestInitResponse = 0x00100000, |
| 112 NTLM_RequestAcceptResponse = 0x00200000, | 112 NTLM_RequestAcceptResponse = 0x00200000, |
| 113 NTLM_RequestNonNTSessionKey = 0x00400000, | 113 NTLM_RequestNonNTSessionKey = 0x00400000, |
| 114 NTLM_NegotiateTargetInfo = 0x00800000, | 114 NTLM_NegotiateTargetInfo = 0x00800000, |
| 115 NTLM_Unknown4 = 0x01000000, | 115 NTLM_Unknown4 = 0x01000000, |
| 116 NTLM_Unknown5 = 0x02000000, | 116 NTLM_Unknown5 = 0x02000000, |
| 117 NTLM_Unknown6 = 0x04000000, | 117 NTLM_Unknown6 = 0x04000000, |
| 118 NTLM_Unknown7 = 0x08000000, | 118 NTLM_Unknown7 = 0x08000000, |
| 119 NTLM_Unknown8 = 0x10000000, | 119 NTLM_Unknown8 = 0x10000000, |
| 120 NTLM_Negotiate128 = 0x20000000, | 120 NTLM_Negotiate128 = 0x20000000, |
| 121 NTLM_NegotiateKeyExchange = 0x40000000, | 121 NTLM_NegotiateKeyExchange = 0x40000000, |
| 122 NTLM_Negotiate56 = 0x80000000 | 122 NTLM_Negotiate56 = 0x80000000 |
| 123 }; | 123 }; |
| 124 | 124 |
| 125 // We send these flags with our type 1 message. | 125 // We send these flags with our type 1 message. |
| 126 enum { | 126 enum { |
| 127 NTLM_TYPE1_FLAGS = (NTLM_NegotiateUnicode | | 127 NTLM_TYPE1_FLAGS = |
| 128 NTLM_NegotiateOEM | | 128 (NTLM_NegotiateUnicode | NTLM_NegotiateOEM | NTLM_RequestTarget | |
| 129 NTLM_RequestTarget | | 129 NTLM_NegotiateNTLMKey | |
| 130 NTLM_NegotiateNTLMKey | | 130 NTLM_NegotiateAlwaysSign | |
| 131 NTLM_NegotiateAlwaysSign | | 131 NTLM_NegotiateNTLM2Key) |
| 132 NTLM_NegotiateNTLM2Key) | |
| 133 }; | 132 }; |
| 134 | 133 |
| 135 static const char NTLM_SIGNATURE[] = "NTLMSSP"; | 134 static const char NTLM_SIGNATURE[] = "NTLMSSP"; |
| 136 static const char NTLM_TYPE1_MARKER[] = { 0x01, 0x00, 0x00, 0x00 }; | 135 static const char NTLM_TYPE1_MARKER[] = {0x01, 0x00, 0x00, 0x00}; |
| 137 static const char NTLM_TYPE2_MARKER[] = { 0x02, 0x00, 0x00, 0x00 }; | 136 static const char NTLM_TYPE2_MARKER[] = {0x02, 0x00, 0x00, 0x00}; |
| 138 static const char NTLM_TYPE3_MARKER[] = { 0x03, 0x00, 0x00, 0x00 }; | 137 static const char NTLM_TYPE3_MARKER[] = {0x03, 0x00, 0x00, 0x00}; |
| 139 | 138 |
| 140 enum { | 139 enum { |
| 141 NTLM_TYPE1_HEADER_LEN = 32, | 140 NTLM_TYPE1_HEADER_LEN = 32, |
| 142 NTLM_TYPE2_HEADER_LEN = 32, | 141 NTLM_TYPE2_HEADER_LEN = 32, |
| 143 NTLM_TYPE3_HEADER_LEN = 64, | 142 NTLM_TYPE3_HEADER_LEN = 64, |
| 144 | |
| 145 LM_HASH_LEN = 16, | 143 LM_HASH_LEN = 16, |
| 146 LM_RESP_LEN = 24, | 144 LM_RESP_LEN = 24, |
| 147 | |
| 148 NTLM_HASH_LEN = 16, | 145 NTLM_HASH_LEN = 16, |
| 149 NTLM_RESP_LEN = 24 | 146 NTLM_RESP_LEN = 24 |
| 150 }; | 147 }; |
| 151 | 148 |
| 152 //----------------------------------------------------------------------------- | 149 //----------------------------------------------------------------------------- |
| 153 | 150 |
| 154 // The return value of this function controls whether or not the LM hash will | 151 // The return value of this function controls whether or not the LM hash will |
| 155 // be included in response to a NTLM challenge. | 152 // be included in response to a NTLM challenge. |
| 156 // | 153 // |
| 157 // In Mozilla, this function returns the value of the boolean preference | 154 // In Mozilla, this function returns the value of the boolean preference |
| 158 // "network.ntlm.send-lm-response". By default, the preference is disabled | 155 // "network.ntlm.send-lm-response". By default, the preference is disabled |
| 159 // since servers should almost never need the LM hash, and the LM hash is what | 156 // since servers should almost never need the LM hash, and the LM hash is what |
| 160 // makes NTLM authentication less secure. See | 157 // makes NTLM authentication less secure. See |
| 161 // https://bugzilla.mozilla.org/show_bug.cgi?id=250691 for further details. | 158 // https://bugzilla.mozilla.org/show_bug.cgi?id=250691 for further details. |
| 162 // | 159 // |
| 163 // We just return a hardcoded false. | 160 // We just return a hardcoded false. |
| 164 static bool SendLM() { | 161 static bool SendLM() { |
| 165 return false; | 162 return false; |
| 166 } | 163 } |
| 167 | 164 |
| 168 //----------------------------------------------------------------------------- | 165 //----------------------------------------------------------------------------- |
| 169 | 166 |
| 170 #define LogFlags(x) ((void) 0) | 167 #define LogFlags(x) ((void)0) |
| 171 #define LogBuf(a, b, c) ((void) 0) | 168 #define LogBuf(a, b, c) ((void)0) |
| 172 #define LogToken(a, b, c) ((void) 0) | 169 #define LogToken(a, b, c) ((void)0) |
| 173 | 170 |
| 174 //----------------------------------------------------------------------------- | 171 //----------------------------------------------------------------------------- |
| 175 | 172 |
| 176 // Byte order swapping. | 173 // Byte order swapping. |
| 177 #define SWAP16(x) ((((x) & 0xff) << 8) | (((x) >> 8) & 0xff)) | 174 #define SWAP16(x) ((((x) & 0xff) << 8) | (((x) >> 8) & 0xff)) |
| 178 #define SWAP32(x) ((SWAP16((x) & 0xffff) << 16) | (SWAP16((x) >> 16))) | 175 #define SWAP32(x) ((SWAP16((x) & 0xffff) << 16) | (SWAP16((x) >> 16))) |
| 179 | 176 |
| 180 static void* WriteBytes(void* buf, const void* data, uint32 data_len) { | 177 static void* WriteBytes(void* buf, const void* data, uint32 data_len) { |
| 181 memcpy(buf, data, data_len); | 178 memcpy(buf, data, data_len); |
| 182 return static_cast<char*>(buf) + data_len; | 179 return static_cast<char*>(buf) + data_len; |
| (...skipping 19 matching lines...) Expand all Loading... |
| 202 } | 199 } |
| 203 | 200 |
| 204 #ifdef IS_BIG_ENDIAN | 201 #ifdef IS_BIG_ENDIAN |
| 205 /** | 202 /** |
| 206 * WriteUnicodeLE copies a unicode string from one buffer to another. The | 203 * WriteUnicodeLE copies a unicode string from one buffer to another. The |
| 207 * resulting unicode string is in little-endian format. The input string is | 204 * resulting unicode string is in little-endian format. The input string is |
| 208 * assumed to be in the native endianness of the local machine. It is safe | 205 * assumed to be in the native endianness of the local machine. It is safe |
| 209 * to pass the same buffer as both input and output, which is a handy way to | 206 * to pass the same buffer as both input and output, which is a handy way to |
| 210 * convert the unicode buffer to little-endian on big-endian platforms. | 207 * convert the unicode buffer to little-endian on big-endian platforms. |
| 211 */ | 208 */ |
| 212 static void* WriteUnicodeLE( | 209 static void* WriteUnicodeLE(void* buf, |
| 213 void* buf, const base::char16* str, uint32 str_len) { | 210 const base::char16* str, |
| 211 uint32 str_len) { |
| 214 // Convert input string from BE to LE. | 212 // Convert input string from BE to LE. |
| 215 uint8* cursor = static_cast<uint8*>(buf); | 213 uint8* cursor = static_cast<uint8*>(buf); |
| 216 const uint8* input = reinterpret_cast<const uint8*>(str); | 214 const uint8* input = reinterpret_cast<const uint8*>(str); |
| 217 for (uint32 i = 0; i < str_len; ++i, input += 2, cursor += 2) { | 215 for (uint32 i = 0; i < str_len; ++i, input += 2, cursor += 2) { |
| 218 // Allow for the case where |buf == str|. | 216 // Allow for the case where |buf == str|. |
| 219 uint8 temp = input[0]; | 217 uint8 temp = input[0]; |
| 220 cursor[0] = input[1]; | 218 cursor[0] = input[1]; |
| 221 cursor[1] = temp; | 219 cursor[1] = temp; |
| 222 } | 220 } |
| 223 return buf; | 221 return buf; |
| 224 } | 222 } |
| 225 #endif | 223 #endif |
| 226 | 224 |
| 227 static uint16 ReadUint16(const uint8*& buf) { | 225 static uint16 ReadUint16(const uint8*& buf) { |
| 228 uint16 x = (static_cast<uint16>(buf[0])) | | 226 uint16 x = (static_cast<uint16>(buf[0])) | (static_cast<uint16>(buf[1]) << 8); |
| 229 (static_cast<uint16>(buf[1]) << 8); | |
| 230 buf += sizeof(x); | 227 buf += sizeof(x); |
| 231 return x; | 228 return x; |
| 232 } | 229 } |
| 233 | 230 |
| 234 static uint32 ReadUint32(const uint8*& buf) { | 231 static uint32 ReadUint32(const uint8*& buf) { |
| 235 uint32 x = (static_cast<uint32>(buf[0])) | | 232 uint32 x = |
| 236 (static_cast<uint32>(buf[1]) << 8) | | 233 (static_cast<uint32>(buf[0])) | (static_cast<uint32>(buf[1]) << 8) | |
| 237 (static_cast<uint32>(buf[2]) << 16) | | 234 (static_cast<uint32>(buf[2]) << 16) | (static_cast<uint32>(buf[3]) << 24); |
| 238 (static_cast<uint32>(buf[3]) << 24); | |
| 239 buf += sizeof(x); | 235 buf += sizeof(x); |
| 240 return x; | 236 return x; |
| 241 } | 237 } |
| 242 | 238 |
| 243 //----------------------------------------------------------------------------- | 239 //----------------------------------------------------------------------------- |
| 244 | 240 |
| 245 // LM_Hash computes the LM hash of the given password. | 241 // LM_Hash computes the LM hash of the given password. |
| 246 // | 242 // |
| 247 // param password | 243 // param password |
| 248 // unicode password. | 244 // unicode password. |
| 249 // param hash | 245 // param hash |
| 250 // 16-byte result buffer | 246 // 16-byte result buffer |
| 251 // | 247 // |
| 252 // Note: This function is not being used because our SendLM() function always | 248 // Note: This function is not being used because our SendLM() function always |
| 253 // returns false. | 249 // returns false. |
| 254 static void LM_Hash(const base::string16& password, uint8* hash) { | 250 static void LM_Hash(const base::string16& password, uint8* hash) { |
| 255 static const uint8 LM_MAGIC[] = "KGS!@#$%"; | 251 static const uint8 LM_MAGIC[] = "KGS!@#$%"; |
| 256 | 252 |
| 257 // Convert password to OEM character set. We'll just use the native | 253 // Convert password to OEM character set. We'll just use the native |
| 258 // filesystem charset. | 254 // filesystem charset. |
| 259 std::string passbuf = base::SysWideToNativeMB(base::UTF16ToWide(password)); | 255 std::string passbuf = base::SysWideToNativeMB(base::UTF16ToWide(password)); |
| 260 StringToUpperASCII(&passbuf); | 256 StringToUpperASCII(&passbuf); |
| 261 passbuf.resize(14, '\0'); | 257 passbuf.resize(14, '\0'); |
| 262 | 258 |
| 263 uint8 k1[8], k2[8]; | 259 uint8 k1[8], k2[8]; |
| 264 DESMakeKey(reinterpret_cast<const uint8*>(passbuf.data()) , k1); | 260 DESMakeKey(reinterpret_cast<const uint8*>(passbuf.data()), k1); |
| 265 DESMakeKey(reinterpret_cast<const uint8*>(passbuf.data()) + 7, k2); | 261 DESMakeKey(reinterpret_cast<const uint8*>(passbuf.data()) + 7, k2); |
| 266 ZapString(&passbuf); | 262 ZapString(&passbuf); |
| 267 | 263 |
| 268 // Use password keys to hash LM magic string twice. | 264 // Use password keys to hash LM magic string twice. |
| 269 DESEncrypt(k1, LM_MAGIC, hash); | 265 DESEncrypt(k1, LM_MAGIC, hash); |
| 270 DESEncrypt(k2, LM_MAGIC, hash + 8); | 266 DESEncrypt(k2, LM_MAGIC, hash + 8); |
| 271 } | 267 } |
| 272 | 268 |
| 273 // NTLM_Hash computes the NTLM hash of the given password. | 269 // NTLM_Hash computes the NTLM hash of the given password. |
| 274 // | 270 // |
| 275 // param password | 271 // param password |
| 276 // null-terminated unicode password. | 272 // null-terminated unicode password. |
| 277 // param hash | 273 // param hash |
| 278 // 16-byte result buffer | 274 // 16-byte result buffer |
| 279 static void NTLM_Hash(const base::string16& password, uint8* hash) { | 275 static void NTLM_Hash(const base::string16& password, uint8* hash) { |
| 280 #ifdef IS_BIG_ENDIAN | 276 #ifdef IS_BIG_ENDIAN |
| 281 uint32 len = password.length(); | 277 uint32 len = password.length(); |
| 282 uint8* passbuf; | 278 uint8* passbuf; |
| 283 | 279 |
| 284 passbuf = static_cast<uint8*>(malloc(len * 2)); | 280 passbuf = static_cast<uint8*>(malloc(len * 2)); |
| 285 WriteUnicodeLE(passbuf, password.data(), len); | 281 WriteUnicodeLE(passbuf, password.data(), len); |
| 286 weak_crypto::MD4Sum(passbuf, len * 2, hash); | 282 weak_crypto::MD4Sum(passbuf, len * 2, hash); |
| 287 | 283 |
| 288 ZapBuf(passbuf, len * 2); | 284 ZapBuf(passbuf, len * 2); |
| 289 free(passbuf); | 285 free(passbuf); |
| 290 #else | 286 #else |
| 291 weak_crypto::MD4Sum(reinterpret_cast<const uint8*>(password.data()), | 287 weak_crypto::MD4Sum(reinterpret_cast<const uint8*>(password.data()), |
| 292 password.length() * 2, hash); | 288 password.length() * 2, |
| 289 hash); |
| 293 #endif | 290 #endif |
| 294 } | 291 } |
| 295 | 292 |
| 296 //----------------------------------------------------------------------------- | 293 //----------------------------------------------------------------------------- |
| 297 | 294 |
| 298 // LM_Response generates the LM response given a 16-byte password hash and the | 295 // LM_Response generates the LM response given a 16-byte password hash and the |
| 299 // challenge from the Type-2 message. | 296 // challenge from the Type-2 message. |
| 300 // | 297 // |
| 301 // param hash | 298 // param hash |
| 302 // 16-byte password hash | 299 // 16-byte password hash |
| 303 // param challenge | 300 // param challenge |
| 304 // 8-byte challenge from Type-2 message | 301 // 8-byte challenge from Type-2 message |
| 305 // param response | 302 // param response |
| 306 // 24-byte buffer to contain the LM response upon return | 303 // 24-byte buffer to contain the LM response upon return |
| 307 static void LM_Response(const uint8* hash, | 304 static void LM_Response(const uint8* hash, |
| 308 const uint8* challenge, | 305 const uint8* challenge, |
| 309 uint8* response) { | 306 uint8* response) { |
| 310 uint8 keybytes[21], k1[8], k2[8], k3[8]; | 307 uint8 keybytes[21], k1[8], k2[8], k3[8]; |
| 311 | 308 |
| 312 memcpy(keybytes, hash, 16); | 309 memcpy(keybytes, hash, 16); |
| 313 ZapBuf(keybytes + 16, 5); | 310 ZapBuf(keybytes + 16, 5); |
| 314 | 311 |
| 315 DESMakeKey(keybytes , k1); | 312 DESMakeKey(keybytes, k1); |
| 316 DESMakeKey(keybytes + 7, k2); | 313 DESMakeKey(keybytes + 7, k2); |
| 317 DESMakeKey(keybytes + 14, k3); | 314 DESMakeKey(keybytes + 14, k3); |
| 318 | 315 |
| 319 DESEncrypt(k1, challenge, response); | 316 DESEncrypt(k1, challenge, response); |
| 320 DESEncrypt(k2, challenge, response + 8); | 317 DESEncrypt(k2, challenge, response + 8); |
| 321 DESEncrypt(k3, challenge, response + 16); | 318 DESEncrypt(k3, challenge, response + 16); |
| 322 } | 319 } |
| 323 | 320 |
| 324 //----------------------------------------------------------------------------- | 321 //----------------------------------------------------------------------------- |
| 325 | 322 |
| 326 // Returns OK or a network error code. | 323 // Returns OK or a network error code. |
| (...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 358 // 16 : supplied domain security buffer (empty) | 355 // 16 : supplied domain security buffer (empty) |
| 359 cursor = WriteSecBuf(cursor, 0, 0); | 356 cursor = WriteSecBuf(cursor, 0, 0); |
| 360 | 357 |
| 361 // 24 : supplied workstation security buffer (empty) | 358 // 24 : supplied workstation security buffer (empty) |
| 362 cursor = WriteSecBuf(cursor, 0, 0); | 359 cursor = WriteSecBuf(cursor, 0, 0); |
| 363 | 360 |
| 364 return OK; | 361 return OK; |
| 365 } | 362 } |
| 366 | 363 |
| 367 struct Type2Msg { | 364 struct Type2Msg { |
| 368 uint32 flags; // NTLM_Xxx bitwise combination | 365 uint32 flags; // NTLM_Xxx bitwise combination |
| 369 uint8 challenge[8]; // 8 byte challenge | 366 uint8 challenge[8]; // 8 byte challenge |
| 370 const void* target; // target string (type depends on flags) | 367 const void* target; // target string (type depends on flags) |
| 371 uint32 target_len; // target length in bytes | 368 uint32 target_len; // target length in bytes |
| 372 }; | 369 }; |
| 373 | 370 |
| 374 // Returns OK or a network error code. | 371 // Returns OK or a network error code. |
| 375 // TODO(wtc): This function returns ERR_UNEXPECTED when the input message is | 372 // TODO(wtc): This function returns ERR_UNEXPECTED when the input message is |
| 376 // invalid. We should return a better error code. | 373 // invalid. We should return a better error code. |
| 377 static int ParseType2Msg(const void* in_buf, uint32 in_len, Type2Msg* msg) { | 374 static int ParseType2Msg(const void* in_buf, uint32 in_len, Type2Msg* msg) { |
| 378 // Make sure in_buf is long enough to contain a meaningful type2 msg. | 375 // Make sure in_buf is long enough to contain a meaningful type2 msg. |
| 379 // | 376 // |
| 380 // 0 NTLMSSP Signature | 377 // 0 NTLMSSP Signature |
| 381 // 8 NTLM Message Type | 378 // 8 NTLM Message Type |
| 382 // 12 Target Name | 379 // 12 Target Name |
| 383 // 20 Flags | 380 // 20 Flags |
| 384 // 24 Challenge | 381 // 24 Challenge |
| 385 // 32 end of header, start of optional data blocks | 382 // 32 end of header, start of optional data blocks |
| 386 // | 383 // |
| 387 if (in_len < NTLM_TYPE2_HEADER_LEN) | 384 if (in_len < NTLM_TYPE2_HEADER_LEN) |
| 388 return ERR_UNEXPECTED; | 385 return ERR_UNEXPECTED; |
| 389 | 386 |
| 390 const uint8* cursor = (const uint8*) in_buf; | 387 const uint8* cursor = (const uint8*)in_buf; |
| 391 | 388 |
| 392 // verify NTLMSSP signature | 389 // verify NTLMSSP signature |
| 393 if (memcmp(cursor, NTLM_SIGNATURE, sizeof(NTLM_SIGNATURE)) != 0) | 390 if (memcmp(cursor, NTLM_SIGNATURE, sizeof(NTLM_SIGNATURE)) != 0) |
| 394 return ERR_UNEXPECTED; | 391 return ERR_UNEXPECTED; |
| 395 cursor += sizeof(NTLM_SIGNATURE); | 392 cursor += sizeof(NTLM_SIGNATURE); |
| 396 | 393 |
| 397 // verify Type-2 marker | 394 // verify Type-2 marker |
| 398 if (memcmp(cursor, NTLM_TYPE2_MARKER, sizeof(NTLM_TYPE2_MARKER)) != 0) | 395 if (memcmp(cursor, NTLM_TYPE2_MARKER, sizeof(NTLM_TYPE2_MARKER)) != 0) |
| 399 return ERR_UNEXPECTED; | 396 return ERR_UNEXPECTED; |
| 400 cursor += sizeof(NTLM_TYPE2_MARKER); | 397 cursor += sizeof(NTLM_TYPE2_MARKER); |
| 401 | 398 |
| 402 // read target name security buffer | 399 // read target name security buffer |
| 403 uint32 target_len = ReadUint16(cursor); | 400 uint32 target_len = ReadUint16(cursor); |
| 404 ReadUint16(cursor); // discard next 16-bit value | 401 ReadUint16(cursor); // discard next 16-bit value |
| 405 uint32 offset = ReadUint32(cursor); // get offset from in_buf | 402 uint32 offset = ReadUint32(cursor); // get offset from in_buf |
| 406 msg->target_len = 0; | 403 msg->target_len = 0; |
| 407 msg->target = NULL; | 404 msg->target = NULL; |
| 408 // Check the offset / length combo is in range of the input buffer, including | 405 // Check the offset / length combo is in range of the input buffer, including |
| 409 // integer overflow checking. | 406 // integer overflow checking. |
| 410 if (offset + target_len > offset && offset + target_len <= in_len) { | 407 if (offset + target_len > offset && offset + target_len <= in_len) { |
| 411 msg->target_len = target_len; | 408 msg->target_len = target_len; |
| 412 msg->target = ((const uint8*) in_buf) + offset; | 409 msg->target = ((const uint8*)in_buf) + offset; |
| 413 } | 410 } |
| 414 | 411 |
| 415 // read flags | 412 // read flags |
| 416 msg->flags = ReadUint32(cursor); | 413 msg->flags = ReadUint32(cursor); |
| 417 | 414 |
| 418 // read challenge | 415 // read challenge |
| 419 memcpy(msg->challenge, cursor, sizeof(msg->challenge)); | 416 memcpy(msg->challenge, cursor, sizeof(msg->challenge)); |
| 420 cursor += sizeof(msg->challenge); | 417 cursor += sizeof(msg->challenge); |
| 421 | 418 |
| 422 NTLM_LOG(("NTLM type 2 message:\n")); | 419 NTLM_LOG(("NTLM type 2 message:\n")); |
| 423 LogBuf("target", (const uint8*) msg->target, msg->target_len); | 420 LogBuf("target", (const uint8*)msg->target, msg->target_len); |
| 424 LogBuf("flags", (const uint8*) &msg->flags, 4); | 421 LogBuf("flags", (const uint8*)&msg->flags, 4); |
| 425 LogFlags(msg->flags); | 422 LogFlags(msg->flags); |
| 426 LogBuf("challenge", msg->challenge, sizeof(msg->challenge)); | 423 LogBuf("challenge", msg->challenge, sizeof(msg->challenge)); |
| 427 | 424 |
| 428 // We currently do not implement LMv2/NTLMv2 or NTLM2 responses, | 425 // We currently do not implement LMv2/NTLMv2 or NTLM2 responses, |
| 429 // so we can ignore target information. We may want to enable | 426 // so we can ignore target information. We may want to enable |
| 430 // support for these alternate mechanisms in the future. | 427 // support for these alternate mechanisms in the future. |
| 431 return OK; | 428 return OK; |
| 432 } | 429 } |
| 433 | 430 |
| 434 static void GenerateRandom(uint8* output, size_t n) { | 431 static void GenerateRandom(uint8* output, size_t n) { |
| (...skipping 15 matching lines...) Expand all Loading... |
| 450 | 447 |
| 451 int rv; | 448 int rv; |
| 452 Type2Msg msg; | 449 Type2Msg msg; |
| 453 | 450 |
| 454 rv = ParseType2Msg(in_buf, in_len, &msg); | 451 rv = ParseType2Msg(in_buf, in_len, &msg); |
| 455 if (rv != OK) | 452 if (rv != OK) |
| 456 return rv; | 453 return rv; |
| 457 | 454 |
| 458 bool unicode = (msg.flags & NTLM_NegotiateUnicode) != 0; | 455 bool unicode = (msg.flags & NTLM_NegotiateUnicode) != 0; |
| 459 | 456 |
| 460 // Temporary buffers for unicode strings | 457 // Temporary buffers for unicode strings |
| 461 #ifdef IS_BIG_ENDIAN | 458 #ifdef IS_BIG_ENDIAN |
| 462 base::string16 ucs_domain_buf, ucs_user_buf; | 459 base::string16 ucs_domain_buf, ucs_user_buf; |
| 463 #endif | 460 #endif |
| 464 base::string16 ucs_host_buf; | 461 base::string16 ucs_host_buf; |
| 465 // Temporary buffers for oem strings | 462 // Temporary buffers for oem strings |
| 466 std::string oem_domain_buf, oem_user_buf; | 463 std::string oem_domain_buf, oem_user_buf; |
| 467 // Pointers and lengths for the string buffers; encoding is unicode if | 464 // Pointers and lengths for the string buffers; encoding is unicode if |
| 468 // the "negotiate unicode" flag was set in the Type-2 message. | 465 // the "negotiate unicode" flag was set in the Type-2 message. |
| 469 const void* domain_ptr; | 466 const void* domain_ptr; |
| 470 const void* user_ptr; | 467 const void* user_ptr; |
| 471 const void* host_ptr; | 468 const void* host_ptr; |
| 472 uint32 domain_len, user_len, host_len; | 469 uint32 domain_len, user_len, host_len; |
| 473 | 470 |
| 474 // | 471 // |
| 475 // Get domain name. | 472 // Get domain name. |
| 476 // | 473 // |
| 477 if (unicode) { | 474 if (unicode) { |
| 478 #ifdef IS_BIG_ENDIAN | 475 #ifdef IS_BIG_ENDIAN |
| 479 ucs_domain_buf = domain; | 476 ucs_domain_buf = domain; |
| 480 domain_ptr = ucs_domain_buf.data(); | 477 domain_ptr = ucs_domain_buf.data(); |
| 481 domain_len = ucs_domain_buf.length() * 2; | 478 domain_len = ucs_domain_buf.length() * 2; |
| 482 WriteUnicodeLE(const_cast<void*>(domain_ptr), | 479 WriteUnicodeLE(const_cast<void*>(domain_ptr), |
| 483 (const base::char16*) domain_ptr, | 480 (const base::char16*)domain_ptr, |
| 484 ucs_domain_buf.length()); | 481 ucs_domain_buf.length()); |
| 485 #else | 482 #else |
| 486 domain_ptr = domain.data(); | 483 domain_ptr = domain.data(); |
| 487 domain_len = domain.length() * 2; | 484 domain_len = domain.length() * 2; |
| 488 #endif | 485 #endif |
| 489 } else { | 486 } else { |
| 490 oem_domain_buf = base::SysWideToNativeMB(base::UTF16ToWide(domain)); | 487 oem_domain_buf = base::SysWideToNativeMB(base::UTF16ToWide(domain)); |
| 491 domain_ptr = oem_domain_buf.data(); | 488 domain_ptr = oem_domain_buf.data(); |
| 492 domain_len = oem_domain_buf.length(); | 489 domain_len = oem_domain_buf.length(); |
| 493 } | 490 } |
| 494 | 491 |
| 495 // | 492 // |
| 496 // Get user name. | 493 // Get user name. |
| 497 // | 494 // |
| 498 if (unicode) { | 495 if (unicode) { |
| 499 #ifdef IS_BIG_ENDIAN | 496 #ifdef IS_BIG_ENDIAN |
| 500 ucs_user_buf = username; | 497 ucs_user_buf = username; |
| 501 user_ptr = ucs_user_buf.data(); | 498 user_ptr = ucs_user_buf.data(); |
| 502 user_len = ucs_user_buf.length() * 2; | 499 user_len = ucs_user_buf.length() * 2; |
| 503 WriteUnicodeLE(const_cast<void*>(user_ptr), (const base::char16*) user_ptr, | 500 WriteUnicodeLE(const_cast<void*>(user_ptr), |
| 501 (const base::char16*)user_ptr, |
| 504 ucs_user_buf.length()); | 502 ucs_user_buf.length()); |
| 505 #else | 503 #else |
| 506 user_ptr = username.data(); | 504 user_ptr = username.data(); |
| 507 user_len = username.length() * 2; | 505 user_len = username.length() * 2; |
| 508 #endif | 506 #endif |
| 509 } else { | 507 } else { |
| 510 oem_user_buf = base::SysWideToNativeMB(base::UTF16ToWide(username)); | 508 oem_user_buf = base::SysWideToNativeMB(base::UTF16ToWide(username)); |
| 511 user_ptr = oem_user_buf.data(); | 509 user_ptr = oem_user_buf.data(); |
| 512 user_len = oem_user_buf.length(); | 510 user_len = oem_user_buf.length(); |
| 513 } | 511 } |
| 514 | 512 |
| 515 // | 513 // |
| 516 // Get workstation name (use local machine's hostname). | 514 // Get workstation name (use local machine's hostname). |
| 517 // | 515 // |
| 518 if (unicode) { | 516 if (unicode) { |
| 519 // hostname is ASCII, so we can do a simple zero-pad expansion: | 517 // hostname is ASCII, so we can do a simple zero-pad expansion: |
| 520 ucs_host_buf.assign(hostname.begin(), hostname.end()); | 518 ucs_host_buf.assign(hostname.begin(), hostname.end()); |
| 521 host_ptr = ucs_host_buf.data(); | 519 host_ptr = ucs_host_buf.data(); |
| 522 host_len = ucs_host_buf.length() * 2; | 520 host_len = ucs_host_buf.length() * 2; |
| 523 #ifdef IS_BIG_ENDIAN | 521 #ifdef IS_BIG_ENDIAN |
| 524 WriteUnicodeLE(const_cast<void*>(host_ptr), (const base::char16*) host_ptr, | 522 WriteUnicodeLE(const_cast<void*>(host_ptr), |
| 523 (const base::char16*)host_ptr, |
| 525 ucs_host_buf.length()); | 524 ucs_host_buf.length()); |
| 526 #endif | 525 #endif |
| 527 } else { | 526 } else { |
| 528 host_ptr = hostname.data(); | 527 host_ptr = hostname.data(); |
| 529 host_len = hostname.length(); | 528 host_len = hostname.length(); |
| 530 } | 529 } |
| 531 | 530 |
| 532 // | 531 // |
| 533 // Now that we have generated all of the strings, we can allocate out_buf. | 532 // Now that we have generated all of the strings, we can allocate out_buf. |
| 534 // | 533 // |
| (...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 618 cursor = WriteDWORD(cursor, msg.flags & NTLM_TYPE1_FLAGS); | 617 cursor = WriteDWORD(cursor, msg.flags & NTLM_TYPE1_FLAGS); |
| 619 | 618 |
| 620 return OK; | 619 return OK; |
| 621 } | 620 } |
| 622 | 621 |
| 623 // NTLM authentication is specified in "NTLM Over HTTP Protocol Specification" | 622 // NTLM authentication is specified in "NTLM Over HTTP Protocol Specification" |
| 624 // [MS-NTHT]. | 623 // [MS-NTHT]. |
| 625 | 624 |
| 626 // static | 625 // static |
| 627 HttpAuthHandlerNTLM::GenerateRandomProc | 626 HttpAuthHandlerNTLM::GenerateRandomProc |
| 628 HttpAuthHandlerNTLM::generate_random_proc_ = GenerateRandom; | 627 HttpAuthHandlerNTLM::generate_random_proc_ = GenerateRandom; |
| 629 | 628 |
| 630 // static | 629 // static |
| 631 HttpAuthHandlerNTLM::HostNameProc | 630 HttpAuthHandlerNTLM::HostNameProc HttpAuthHandlerNTLM::get_host_name_proc_ = |
| 632 HttpAuthHandlerNTLM::get_host_name_proc_ = GetHostName; | 631 GetHostName; |
| 633 | 632 |
| 634 HttpAuthHandlerNTLM::HttpAuthHandlerNTLM() { | 633 HttpAuthHandlerNTLM::HttpAuthHandlerNTLM() { |
| 635 } | 634 } |
| 636 | 635 |
| 637 bool HttpAuthHandlerNTLM::NeedsIdentity() { | 636 bool HttpAuthHandlerNTLM::NeedsIdentity() { |
| 638 // This gets called for each round-trip. Only require identity on | 637 // This gets called for each round-trip. Only require identity on |
| 639 // the first call (when auth_data_ is empty). On subsequent calls, | 638 // the first call (when auth_data_ is empty). On subsequent calls, |
| 640 // we use the initially established identity. | 639 // we use the initially established identity. |
| 641 return auth_data_.empty(); | 640 return auth_data_.empty(); |
| 642 } | 641 } |
| 643 | 642 |
| 644 bool HttpAuthHandlerNTLM::AllowsDefaultCredentials() { | 643 bool HttpAuthHandlerNTLM::AllowsDefaultCredentials() { |
| 645 // Default credentials are not supported in the portable implementation of | 644 // Default credentials are not supported in the portable implementation of |
| 646 // NTLM, but are supported in the SSPI implementation. | 645 // NTLM, but are supported in the SSPI implementation. |
| 647 return false; | 646 return false; |
| 648 } | 647 } |
| 649 | 648 |
| 650 int HttpAuthHandlerNTLM::InitializeBeforeFirstChallenge() { | 649 int HttpAuthHandlerNTLM::InitializeBeforeFirstChallenge() { |
| 651 return OK; | 650 return OK; |
| 652 } | 651 } |
| 653 | 652 |
| 654 HttpAuthHandlerNTLM::~HttpAuthHandlerNTLM() { | 653 HttpAuthHandlerNTLM::~HttpAuthHandlerNTLM() { |
| 655 credentials_.Zap(); | 654 credentials_.Zap(); |
| 656 } | 655 } |
| 657 | 656 |
| 658 // static | 657 // static |
| 659 HttpAuthHandlerNTLM::GenerateRandomProc | 658 HttpAuthHandlerNTLM::GenerateRandomProc |
| 660 HttpAuthHandlerNTLM::SetGenerateRandomProc( | 659 HttpAuthHandlerNTLM::SetGenerateRandomProc(GenerateRandomProc proc) { |
| 661 GenerateRandomProc proc) { | |
| 662 GenerateRandomProc old_proc = generate_random_proc_; | 660 GenerateRandomProc old_proc = generate_random_proc_; |
| 663 generate_random_proc_ = proc; | 661 generate_random_proc_ = proc; |
| 664 return old_proc; | 662 return old_proc; |
| 665 } | 663 } |
| 666 | 664 |
| 667 // static | 665 // static |
| 668 HttpAuthHandlerNTLM::HostNameProc HttpAuthHandlerNTLM::SetHostNameProc( | 666 HttpAuthHandlerNTLM::HostNameProc HttpAuthHandlerNTLM::SetHostNameProc( |
| 669 HostNameProc proc) { | 667 HostNameProc proc) { |
| 670 HostNameProc old_proc = get_host_name_proc_; | 668 HostNameProc old_proc = get_host_name_proc_; |
| 671 get_host_name_proc_ = proc; | 669 get_host_name_proc_ = proc; |
| (...skipping 14 matching lines...) Expand all Loading... |
| 686 | 684 |
| 687 // If in_token is non-null, then assume it contains a type 2 message... | 685 // If in_token is non-null, then assume it contains a type 2 message... |
| 688 if (in_token) { | 686 if (in_token) { |
| 689 LogToken("in-token", in_token, in_token_len); | 687 LogToken("in-token", in_token, in_token_len); |
| 690 std::string hostname = get_host_name_proc_(); | 688 std::string hostname = get_host_name_proc_(); |
| 691 if (hostname.empty()) | 689 if (hostname.empty()) |
| 692 return ERR_UNEXPECTED; | 690 return ERR_UNEXPECTED; |
| 693 uint8 rand_buf[8]; | 691 uint8 rand_buf[8]; |
| 694 generate_random_proc_(rand_buf, 8); | 692 generate_random_proc_(rand_buf, 8); |
| 695 rv = GenerateType3Msg(domain_, | 693 rv = GenerateType3Msg(domain_, |
| 696 credentials_.username(), credentials_.password(), | 694 credentials_.username(), |
| 697 hostname, rand_buf, | 695 credentials_.password(), |
| 698 in_token, in_token_len, out_token, out_token_len); | 696 hostname, |
| 697 rand_buf, |
| 698 in_token, |
| 699 in_token_len, |
| 700 out_token, |
| 701 out_token_len); |
| 699 } else { | 702 } else { |
| 700 rv = GenerateType1Msg(out_token, out_token_len); | 703 rv = GenerateType1Msg(out_token, out_token_len); |
| 701 } | 704 } |
| 702 | 705 |
| 703 if (rv == OK) | 706 if (rv == OK) |
| 704 LogToken("out-token", *out_token, *out_token_len); | 707 LogToken("out-token", *out_token, *out_token_len); |
| 705 | 708 |
| 706 return rv; | 709 return rv; |
| 707 } | 710 } |
| 708 | 711 |
| (...skipping 12 matching lines...) Expand all Loading... |
| 721 // NOTE: Default credentials are not supported for the portable implementation | 724 // NOTE: Default credentials are not supported for the portable implementation |
| 722 // of NTLM. | 725 // of NTLM. |
| 723 scoped_ptr<HttpAuthHandler> tmp_handler(new HttpAuthHandlerNTLM); | 726 scoped_ptr<HttpAuthHandler> tmp_handler(new HttpAuthHandlerNTLM); |
| 724 if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log)) | 727 if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log)) |
| 725 return ERR_INVALID_RESPONSE; | 728 return ERR_INVALID_RESPONSE; |
| 726 handler->swap(tmp_handler); | 729 handler->swap(tmp_handler); |
| 727 return OK; | 730 return OK; |
| 728 } | 731 } |
| 729 | 732 |
| 730 } // namespace net | 733 } // namespace net |
| OLD | NEW |