OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/http/http_auth_handler_ntlm.h" | 5 #include "net/http/http_auth_handler_ntlm.h" |
6 | 6 |
7 #include <stdlib.h> | 7 #include <stdlib.h> |
8 // For gethostname | 8 // For gethostname |
9 #if defined(OS_POSIX) | 9 #if defined(OS_POSIX) |
10 #include <unistd.h> | 10 #include <unistd.h> |
(...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
65 * use your version of this file under the terms of the MPL, indicate your | 65 * use your version of this file under the terms of the MPL, indicate your |
66 * decision by deleting the provisions above and replace them with the notice | 66 * decision by deleting the provisions above and replace them with the notice |
67 * and other provisions required by the GPL or the LGPL. If you do not delete | 67 * and other provisions required by the GPL or the LGPL. If you do not delete |
68 * the provisions above, a recipient may use your version of this file under | 68 * the provisions above, a recipient may use your version of this file under |
69 * the terms of any one of the MPL, the GPL or the LGPL. | 69 * the terms of any one of the MPL, the GPL or the LGPL. |
70 * | 70 * |
71 * ***** END LICENSE BLOCK ***** */ | 71 * ***** END LICENSE BLOCK ***** */ |
72 | 72 |
73 #if defined(ARCH_CPU_LITTLE_ENDIAN) | 73 #if defined(ARCH_CPU_LITTLE_ENDIAN) |
74 #define IS_LITTLE_ENDIAN 1 | 74 #define IS_LITTLE_ENDIAN 1 |
75 #undef IS_BIG_ENDIAN | 75 #undef IS_BIG_ENDIAN |
76 #elif defined(ARCH_CPU_BIG_ENDIAN) | 76 #elif defined(ARCH_CPU_BIG_ENDIAN) |
77 #define IS_BIG_ENDIAN 1 | 77 #define IS_BIG_ENDIAN 1 |
78 #undef IS_LITTLE_ENDIAN | 78 #undef IS_LITTLE_ENDIAN |
79 #else | 79 #else |
80 #error "Unknown endianness" | 80 #error "Unknown endianness" |
81 #endif | 81 #endif |
82 | 82 |
83 #define NTLM_LOG(x) ((void) 0) | 83 #define NTLM_LOG(x) ((void)0) |
84 | 84 |
85 //----------------------------------------------------------------------------- | 85 //----------------------------------------------------------------------------- |
86 // This file contains a cross-platform NTLM authentication implementation. It | 86 // This file contains a cross-platform NTLM authentication implementation. It |
87 // is based on documentation from: http://davenport.sourceforge.net/ntlm.html | 87 // is based on documentation from: http://davenport.sourceforge.net/ntlm.html |
88 //----------------------------------------------------------------------------- | 88 //----------------------------------------------------------------------------- |
89 | 89 |
90 enum { | 90 enum { |
91 NTLM_NegotiateUnicode = 0x00000001, | 91 NTLM_NegotiateUnicode = 0x00000001, |
92 NTLM_NegotiateOEM = 0x00000002, | 92 NTLM_NegotiateOEM = 0x00000002, |
93 NTLM_RequestTarget = 0x00000004, | 93 NTLM_RequestTarget = 0x00000004, |
94 NTLM_Unknown1 = 0x00000008, | 94 NTLM_Unknown1 = 0x00000008, |
95 NTLM_NegotiateSign = 0x00000010, | 95 NTLM_NegotiateSign = 0x00000010, |
96 NTLM_NegotiateSeal = 0x00000020, | 96 NTLM_NegotiateSeal = 0x00000020, |
97 NTLM_NegotiateDatagramStyle = 0x00000040, | 97 NTLM_NegotiateDatagramStyle = 0x00000040, |
98 NTLM_NegotiateLanManagerKey = 0x00000080, | 98 NTLM_NegotiateLanManagerKey = 0x00000080, |
99 NTLM_NegotiateNetware = 0x00000100, | 99 NTLM_NegotiateNetware = 0x00000100, |
100 NTLM_NegotiateNTLMKey = 0x00000200, | 100 NTLM_NegotiateNTLMKey = 0x00000200, |
101 NTLM_Unknown2 = 0x00000400, | 101 NTLM_Unknown2 = 0x00000400, |
102 NTLM_Unknown3 = 0x00000800, | 102 NTLM_Unknown3 = 0x00000800, |
103 NTLM_NegotiateDomainSupplied = 0x00001000, | 103 NTLM_NegotiateDomainSupplied = 0x00001000, |
104 NTLM_NegotiateWorkstationSupplied = 0x00002000, | 104 NTLM_NegotiateWorkstationSupplied = 0x00002000, |
105 NTLM_NegotiateLocalCall = 0x00004000, | 105 NTLM_NegotiateLocalCall = 0x00004000, |
106 NTLM_NegotiateAlwaysSign = 0x00008000, | 106 NTLM_NegotiateAlwaysSign = 0x00008000, |
107 NTLM_TargetTypeDomain = 0x00010000, | 107 NTLM_TargetTypeDomain = 0x00010000, |
108 NTLM_TargetTypeServer = 0x00020000, | 108 NTLM_TargetTypeServer = 0x00020000, |
109 NTLM_TargetTypeShare = 0x00040000, | 109 NTLM_TargetTypeShare = 0x00040000, |
110 NTLM_NegotiateNTLM2Key = 0x00080000, | 110 NTLM_NegotiateNTLM2Key = 0x00080000, |
111 NTLM_RequestInitResponse = 0x00100000, | 111 NTLM_RequestInitResponse = 0x00100000, |
112 NTLM_RequestAcceptResponse = 0x00200000, | 112 NTLM_RequestAcceptResponse = 0x00200000, |
113 NTLM_RequestNonNTSessionKey = 0x00400000, | 113 NTLM_RequestNonNTSessionKey = 0x00400000, |
114 NTLM_NegotiateTargetInfo = 0x00800000, | 114 NTLM_NegotiateTargetInfo = 0x00800000, |
115 NTLM_Unknown4 = 0x01000000, | 115 NTLM_Unknown4 = 0x01000000, |
116 NTLM_Unknown5 = 0x02000000, | 116 NTLM_Unknown5 = 0x02000000, |
117 NTLM_Unknown6 = 0x04000000, | 117 NTLM_Unknown6 = 0x04000000, |
118 NTLM_Unknown7 = 0x08000000, | 118 NTLM_Unknown7 = 0x08000000, |
119 NTLM_Unknown8 = 0x10000000, | 119 NTLM_Unknown8 = 0x10000000, |
120 NTLM_Negotiate128 = 0x20000000, | 120 NTLM_Negotiate128 = 0x20000000, |
121 NTLM_NegotiateKeyExchange = 0x40000000, | 121 NTLM_NegotiateKeyExchange = 0x40000000, |
122 NTLM_Negotiate56 = 0x80000000 | 122 NTLM_Negotiate56 = 0x80000000 |
123 }; | 123 }; |
124 | 124 |
125 // We send these flags with our type 1 message. | 125 // We send these flags with our type 1 message. |
126 enum { | 126 enum { |
127 NTLM_TYPE1_FLAGS = (NTLM_NegotiateUnicode | | 127 NTLM_TYPE1_FLAGS = |
128 NTLM_NegotiateOEM | | 128 (NTLM_NegotiateUnicode | NTLM_NegotiateOEM | NTLM_RequestTarget | |
129 NTLM_RequestTarget | | 129 NTLM_NegotiateNTLMKey | |
130 NTLM_NegotiateNTLMKey | | 130 NTLM_NegotiateAlwaysSign | |
131 NTLM_NegotiateAlwaysSign | | 131 NTLM_NegotiateNTLM2Key) |
132 NTLM_NegotiateNTLM2Key) | |
133 }; | 132 }; |
134 | 133 |
135 static const char NTLM_SIGNATURE[] = "NTLMSSP"; | 134 static const char NTLM_SIGNATURE[] = "NTLMSSP"; |
136 static const char NTLM_TYPE1_MARKER[] = { 0x01, 0x00, 0x00, 0x00 }; | 135 static const char NTLM_TYPE1_MARKER[] = {0x01, 0x00, 0x00, 0x00}; |
137 static const char NTLM_TYPE2_MARKER[] = { 0x02, 0x00, 0x00, 0x00 }; | 136 static const char NTLM_TYPE2_MARKER[] = {0x02, 0x00, 0x00, 0x00}; |
138 static const char NTLM_TYPE3_MARKER[] = { 0x03, 0x00, 0x00, 0x00 }; | 137 static const char NTLM_TYPE3_MARKER[] = {0x03, 0x00, 0x00, 0x00}; |
139 | 138 |
140 enum { | 139 enum { |
141 NTLM_TYPE1_HEADER_LEN = 32, | 140 NTLM_TYPE1_HEADER_LEN = 32, |
142 NTLM_TYPE2_HEADER_LEN = 32, | 141 NTLM_TYPE2_HEADER_LEN = 32, |
143 NTLM_TYPE3_HEADER_LEN = 64, | 142 NTLM_TYPE3_HEADER_LEN = 64, |
144 | |
145 LM_HASH_LEN = 16, | 143 LM_HASH_LEN = 16, |
146 LM_RESP_LEN = 24, | 144 LM_RESP_LEN = 24, |
147 | |
148 NTLM_HASH_LEN = 16, | 145 NTLM_HASH_LEN = 16, |
149 NTLM_RESP_LEN = 24 | 146 NTLM_RESP_LEN = 24 |
150 }; | 147 }; |
151 | 148 |
152 //----------------------------------------------------------------------------- | 149 //----------------------------------------------------------------------------- |
153 | 150 |
154 // The return value of this function controls whether or not the LM hash will | 151 // The return value of this function controls whether or not the LM hash will |
155 // be included in response to a NTLM challenge. | 152 // be included in response to a NTLM challenge. |
156 // | 153 // |
157 // In Mozilla, this function returns the value of the boolean preference | 154 // In Mozilla, this function returns the value of the boolean preference |
158 // "network.ntlm.send-lm-response". By default, the preference is disabled | 155 // "network.ntlm.send-lm-response". By default, the preference is disabled |
159 // since servers should almost never need the LM hash, and the LM hash is what | 156 // since servers should almost never need the LM hash, and the LM hash is what |
160 // makes NTLM authentication less secure. See | 157 // makes NTLM authentication less secure. See |
161 // https://bugzilla.mozilla.org/show_bug.cgi?id=250691 for further details. | 158 // https://bugzilla.mozilla.org/show_bug.cgi?id=250691 for further details. |
162 // | 159 // |
163 // We just return a hardcoded false. | 160 // We just return a hardcoded false. |
164 static bool SendLM() { | 161 static bool SendLM() { |
165 return false; | 162 return false; |
166 } | 163 } |
167 | 164 |
168 //----------------------------------------------------------------------------- | 165 //----------------------------------------------------------------------------- |
169 | 166 |
170 #define LogFlags(x) ((void) 0) | 167 #define LogFlags(x) ((void)0) |
171 #define LogBuf(a, b, c) ((void) 0) | 168 #define LogBuf(a, b, c) ((void)0) |
172 #define LogToken(a, b, c) ((void) 0) | 169 #define LogToken(a, b, c) ((void)0) |
173 | 170 |
174 //----------------------------------------------------------------------------- | 171 //----------------------------------------------------------------------------- |
175 | 172 |
176 // Byte order swapping. | 173 // Byte order swapping. |
177 #define SWAP16(x) ((((x) & 0xff) << 8) | (((x) >> 8) & 0xff)) | 174 #define SWAP16(x) ((((x) & 0xff) << 8) | (((x) >> 8) & 0xff)) |
178 #define SWAP32(x) ((SWAP16((x) & 0xffff) << 16) | (SWAP16((x) >> 16))) | 175 #define SWAP32(x) ((SWAP16((x) & 0xffff) << 16) | (SWAP16((x) >> 16))) |
179 | 176 |
180 static void* WriteBytes(void* buf, const void* data, uint32 data_len) { | 177 static void* WriteBytes(void* buf, const void* data, uint32 data_len) { |
181 memcpy(buf, data, data_len); | 178 memcpy(buf, data, data_len); |
182 return static_cast<char*>(buf) + data_len; | 179 return static_cast<char*>(buf) + data_len; |
(...skipping 19 matching lines...) Expand all Loading... |
202 } | 199 } |
203 | 200 |
204 #ifdef IS_BIG_ENDIAN | 201 #ifdef IS_BIG_ENDIAN |
205 /** | 202 /** |
206 * WriteUnicodeLE copies a unicode string from one buffer to another. The | 203 * WriteUnicodeLE copies a unicode string from one buffer to another. The |
207 * resulting unicode string is in little-endian format. The input string is | 204 * resulting unicode string is in little-endian format. The input string is |
208 * assumed to be in the native endianness of the local machine. It is safe | 205 * assumed to be in the native endianness of the local machine. It is safe |
209 * to pass the same buffer as both input and output, which is a handy way to | 206 * to pass the same buffer as both input and output, which is a handy way to |
210 * convert the unicode buffer to little-endian on big-endian platforms. | 207 * convert the unicode buffer to little-endian on big-endian platforms. |
211 */ | 208 */ |
212 static void* WriteUnicodeLE( | 209 static void* WriteUnicodeLE(void* buf, |
213 void* buf, const base::char16* str, uint32 str_len) { | 210 const base::char16* str, |
| 211 uint32 str_len) { |
214 // Convert input string from BE to LE. | 212 // Convert input string from BE to LE. |
215 uint8* cursor = static_cast<uint8*>(buf); | 213 uint8* cursor = static_cast<uint8*>(buf); |
216 const uint8* input = reinterpret_cast<const uint8*>(str); | 214 const uint8* input = reinterpret_cast<const uint8*>(str); |
217 for (uint32 i = 0; i < str_len; ++i, input += 2, cursor += 2) { | 215 for (uint32 i = 0; i < str_len; ++i, input += 2, cursor += 2) { |
218 // Allow for the case where |buf == str|. | 216 // Allow for the case where |buf == str|. |
219 uint8 temp = input[0]; | 217 uint8 temp = input[0]; |
220 cursor[0] = input[1]; | 218 cursor[0] = input[1]; |
221 cursor[1] = temp; | 219 cursor[1] = temp; |
222 } | 220 } |
223 return buf; | 221 return buf; |
224 } | 222 } |
225 #endif | 223 #endif |
226 | 224 |
227 static uint16 ReadUint16(const uint8*& buf) { | 225 static uint16 ReadUint16(const uint8*& buf) { |
228 uint16 x = (static_cast<uint16>(buf[0])) | | 226 uint16 x = (static_cast<uint16>(buf[0])) | (static_cast<uint16>(buf[1]) << 8); |
229 (static_cast<uint16>(buf[1]) << 8); | |
230 buf += sizeof(x); | 227 buf += sizeof(x); |
231 return x; | 228 return x; |
232 } | 229 } |
233 | 230 |
234 static uint32 ReadUint32(const uint8*& buf) { | 231 static uint32 ReadUint32(const uint8*& buf) { |
235 uint32 x = (static_cast<uint32>(buf[0])) | | 232 uint32 x = |
236 (static_cast<uint32>(buf[1]) << 8) | | 233 (static_cast<uint32>(buf[0])) | (static_cast<uint32>(buf[1]) << 8) | |
237 (static_cast<uint32>(buf[2]) << 16) | | 234 (static_cast<uint32>(buf[2]) << 16) | (static_cast<uint32>(buf[3]) << 24); |
238 (static_cast<uint32>(buf[3]) << 24); | |
239 buf += sizeof(x); | 235 buf += sizeof(x); |
240 return x; | 236 return x; |
241 } | 237 } |
242 | 238 |
243 //----------------------------------------------------------------------------- | 239 //----------------------------------------------------------------------------- |
244 | 240 |
245 // LM_Hash computes the LM hash of the given password. | 241 // LM_Hash computes the LM hash of the given password. |
246 // | 242 // |
247 // param password | 243 // param password |
248 // unicode password. | 244 // unicode password. |
249 // param hash | 245 // param hash |
250 // 16-byte result buffer | 246 // 16-byte result buffer |
251 // | 247 // |
252 // Note: This function is not being used because our SendLM() function always | 248 // Note: This function is not being used because our SendLM() function always |
253 // returns false. | 249 // returns false. |
254 static void LM_Hash(const base::string16& password, uint8* hash) { | 250 static void LM_Hash(const base::string16& password, uint8* hash) { |
255 static const uint8 LM_MAGIC[] = "KGS!@#$%"; | 251 static const uint8 LM_MAGIC[] = "KGS!@#$%"; |
256 | 252 |
257 // Convert password to OEM character set. We'll just use the native | 253 // Convert password to OEM character set. We'll just use the native |
258 // filesystem charset. | 254 // filesystem charset. |
259 std::string passbuf = base::SysWideToNativeMB(base::UTF16ToWide(password)); | 255 std::string passbuf = base::SysWideToNativeMB(base::UTF16ToWide(password)); |
260 StringToUpperASCII(&passbuf); | 256 StringToUpperASCII(&passbuf); |
261 passbuf.resize(14, '\0'); | 257 passbuf.resize(14, '\0'); |
262 | 258 |
263 uint8 k1[8], k2[8]; | 259 uint8 k1[8], k2[8]; |
264 DESMakeKey(reinterpret_cast<const uint8*>(passbuf.data()) , k1); | 260 DESMakeKey(reinterpret_cast<const uint8*>(passbuf.data()), k1); |
265 DESMakeKey(reinterpret_cast<const uint8*>(passbuf.data()) + 7, k2); | 261 DESMakeKey(reinterpret_cast<const uint8*>(passbuf.data()) + 7, k2); |
266 ZapString(&passbuf); | 262 ZapString(&passbuf); |
267 | 263 |
268 // Use password keys to hash LM magic string twice. | 264 // Use password keys to hash LM magic string twice. |
269 DESEncrypt(k1, LM_MAGIC, hash); | 265 DESEncrypt(k1, LM_MAGIC, hash); |
270 DESEncrypt(k2, LM_MAGIC, hash + 8); | 266 DESEncrypt(k2, LM_MAGIC, hash + 8); |
271 } | 267 } |
272 | 268 |
273 // NTLM_Hash computes the NTLM hash of the given password. | 269 // NTLM_Hash computes the NTLM hash of the given password. |
274 // | 270 // |
275 // param password | 271 // param password |
276 // null-terminated unicode password. | 272 // null-terminated unicode password. |
277 // param hash | 273 // param hash |
278 // 16-byte result buffer | 274 // 16-byte result buffer |
279 static void NTLM_Hash(const base::string16& password, uint8* hash) { | 275 static void NTLM_Hash(const base::string16& password, uint8* hash) { |
280 #ifdef IS_BIG_ENDIAN | 276 #ifdef IS_BIG_ENDIAN |
281 uint32 len = password.length(); | 277 uint32 len = password.length(); |
282 uint8* passbuf; | 278 uint8* passbuf; |
283 | 279 |
284 passbuf = static_cast<uint8*>(malloc(len * 2)); | 280 passbuf = static_cast<uint8*>(malloc(len * 2)); |
285 WriteUnicodeLE(passbuf, password.data(), len); | 281 WriteUnicodeLE(passbuf, password.data(), len); |
286 weak_crypto::MD4Sum(passbuf, len * 2, hash); | 282 weak_crypto::MD4Sum(passbuf, len * 2, hash); |
287 | 283 |
288 ZapBuf(passbuf, len * 2); | 284 ZapBuf(passbuf, len * 2); |
289 free(passbuf); | 285 free(passbuf); |
290 #else | 286 #else |
291 weak_crypto::MD4Sum(reinterpret_cast<const uint8*>(password.data()), | 287 weak_crypto::MD4Sum(reinterpret_cast<const uint8*>(password.data()), |
292 password.length() * 2, hash); | 288 password.length() * 2, |
| 289 hash); |
293 #endif | 290 #endif |
294 } | 291 } |
295 | 292 |
296 //----------------------------------------------------------------------------- | 293 //----------------------------------------------------------------------------- |
297 | 294 |
298 // LM_Response generates the LM response given a 16-byte password hash and the | 295 // LM_Response generates the LM response given a 16-byte password hash and the |
299 // challenge from the Type-2 message. | 296 // challenge from the Type-2 message. |
300 // | 297 // |
301 // param hash | 298 // param hash |
302 // 16-byte password hash | 299 // 16-byte password hash |
303 // param challenge | 300 // param challenge |
304 // 8-byte challenge from Type-2 message | 301 // 8-byte challenge from Type-2 message |
305 // param response | 302 // param response |
306 // 24-byte buffer to contain the LM response upon return | 303 // 24-byte buffer to contain the LM response upon return |
307 static void LM_Response(const uint8* hash, | 304 static void LM_Response(const uint8* hash, |
308 const uint8* challenge, | 305 const uint8* challenge, |
309 uint8* response) { | 306 uint8* response) { |
310 uint8 keybytes[21], k1[8], k2[8], k3[8]; | 307 uint8 keybytes[21], k1[8], k2[8], k3[8]; |
311 | 308 |
312 memcpy(keybytes, hash, 16); | 309 memcpy(keybytes, hash, 16); |
313 ZapBuf(keybytes + 16, 5); | 310 ZapBuf(keybytes + 16, 5); |
314 | 311 |
315 DESMakeKey(keybytes , k1); | 312 DESMakeKey(keybytes, k1); |
316 DESMakeKey(keybytes + 7, k2); | 313 DESMakeKey(keybytes + 7, k2); |
317 DESMakeKey(keybytes + 14, k3); | 314 DESMakeKey(keybytes + 14, k3); |
318 | 315 |
319 DESEncrypt(k1, challenge, response); | 316 DESEncrypt(k1, challenge, response); |
320 DESEncrypt(k2, challenge, response + 8); | 317 DESEncrypt(k2, challenge, response + 8); |
321 DESEncrypt(k3, challenge, response + 16); | 318 DESEncrypt(k3, challenge, response + 16); |
322 } | 319 } |
323 | 320 |
324 //----------------------------------------------------------------------------- | 321 //----------------------------------------------------------------------------- |
325 | 322 |
326 // Returns OK or a network error code. | 323 // Returns OK or a network error code. |
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
358 // 16 : supplied domain security buffer (empty) | 355 // 16 : supplied domain security buffer (empty) |
359 cursor = WriteSecBuf(cursor, 0, 0); | 356 cursor = WriteSecBuf(cursor, 0, 0); |
360 | 357 |
361 // 24 : supplied workstation security buffer (empty) | 358 // 24 : supplied workstation security buffer (empty) |
362 cursor = WriteSecBuf(cursor, 0, 0); | 359 cursor = WriteSecBuf(cursor, 0, 0); |
363 | 360 |
364 return OK; | 361 return OK; |
365 } | 362 } |
366 | 363 |
367 struct Type2Msg { | 364 struct Type2Msg { |
368 uint32 flags; // NTLM_Xxx bitwise combination | 365 uint32 flags; // NTLM_Xxx bitwise combination |
369 uint8 challenge[8]; // 8 byte challenge | 366 uint8 challenge[8]; // 8 byte challenge |
370 const void* target; // target string (type depends on flags) | 367 const void* target; // target string (type depends on flags) |
371 uint32 target_len; // target length in bytes | 368 uint32 target_len; // target length in bytes |
372 }; | 369 }; |
373 | 370 |
374 // Returns OK or a network error code. | 371 // Returns OK or a network error code. |
375 // TODO(wtc): This function returns ERR_UNEXPECTED when the input message is | 372 // TODO(wtc): This function returns ERR_UNEXPECTED when the input message is |
376 // invalid. We should return a better error code. | 373 // invalid. We should return a better error code. |
377 static int ParseType2Msg(const void* in_buf, uint32 in_len, Type2Msg* msg) { | 374 static int ParseType2Msg(const void* in_buf, uint32 in_len, Type2Msg* msg) { |
378 // Make sure in_buf is long enough to contain a meaningful type2 msg. | 375 // Make sure in_buf is long enough to contain a meaningful type2 msg. |
379 // | 376 // |
380 // 0 NTLMSSP Signature | 377 // 0 NTLMSSP Signature |
381 // 8 NTLM Message Type | 378 // 8 NTLM Message Type |
382 // 12 Target Name | 379 // 12 Target Name |
383 // 20 Flags | 380 // 20 Flags |
384 // 24 Challenge | 381 // 24 Challenge |
385 // 32 end of header, start of optional data blocks | 382 // 32 end of header, start of optional data blocks |
386 // | 383 // |
387 if (in_len < NTLM_TYPE2_HEADER_LEN) | 384 if (in_len < NTLM_TYPE2_HEADER_LEN) |
388 return ERR_UNEXPECTED; | 385 return ERR_UNEXPECTED; |
389 | 386 |
390 const uint8* cursor = (const uint8*) in_buf; | 387 const uint8* cursor = (const uint8*)in_buf; |
391 | 388 |
392 // verify NTLMSSP signature | 389 // verify NTLMSSP signature |
393 if (memcmp(cursor, NTLM_SIGNATURE, sizeof(NTLM_SIGNATURE)) != 0) | 390 if (memcmp(cursor, NTLM_SIGNATURE, sizeof(NTLM_SIGNATURE)) != 0) |
394 return ERR_UNEXPECTED; | 391 return ERR_UNEXPECTED; |
395 cursor += sizeof(NTLM_SIGNATURE); | 392 cursor += sizeof(NTLM_SIGNATURE); |
396 | 393 |
397 // verify Type-2 marker | 394 // verify Type-2 marker |
398 if (memcmp(cursor, NTLM_TYPE2_MARKER, sizeof(NTLM_TYPE2_MARKER)) != 0) | 395 if (memcmp(cursor, NTLM_TYPE2_MARKER, sizeof(NTLM_TYPE2_MARKER)) != 0) |
399 return ERR_UNEXPECTED; | 396 return ERR_UNEXPECTED; |
400 cursor += sizeof(NTLM_TYPE2_MARKER); | 397 cursor += sizeof(NTLM_TYPE2_MARKER); |
401 | 398 |
402 // read target name security buffer | 399 // read target name security buffer |
403 uint32 target_len = ReadUint16(cursor); | 400 uint32 target_len = ReadUint16(cursor); |
404 ReadUint16(cursor); // discard next 16-bit value | 401 ReadUint16(cursor); // discard next 16-bit value |
405 uint32 offset = ReadUint32(cursor); // get offset from in_buf | 402 uint32 offset = ReadUint32(cursor); // get offset from in_buf |
406 msg->target_len = 0; | 403 msg->target_len = 0; |
407 msg->target = NULL; | 404 msg->target = NULL; |
408 // Check the offset / length combo is in range of the input buffer, including | 405 // Check the offset / length combo is in range of the input buffer, including |
409 // integer overflow checking. | 406 // integer overflow checking. |
410 if (offset + target_len > offset && offset + target_len <= in_len) { | 407 if (offset + target_len > offset && offset + target_len <= in_len) { |
411 msg->target_len = target_len; | 408 msg->target_len = target_len; |
412 msg->target = ((const uint8*) in_buf) + offset; | 409 msg->target = ((const uint8*)in_buf) + offset; |
413 } | 410 } |
414 | 411 |
415 // read flags | 412 // read flags |
416 msg->flags = ReadUint32(cursor); | 413 msg->flags = ReadUint32(cursor); |
417 | 414 |
418 // read challenge | 415 // read challenge |
419 memcpy(msg->challenge, cursor, sizeof(msg->challenge)); | 416 memcpy(msg->challenge, cursor, sizeof(msg->challenge)); |
420 cursor += sizeof(msg->challenge); | 417 cursor += sizeof(msg->challenge); |
421 | 418 |
422 NTLM_LOG(("NTLM type 2 message:\n")); | 419 NTLM_LOG(("NTLM type 2 message:\n")); |
423 LogBuf("target", (const uint8*) msg->target, msg->target_len); | 420 LogBuf("target", (const uint8*)msg->target, msg->target_len); |
424 LogBuf("flags", (const uint8*) &msg->flags, 4); | 421 LogBuf("flags", (const uint8*)&msg->flags, 4); |
425 LogFlags(msg->flags); | 422 LogFlags(msg->flags); |
426 LogBuf("challenge", msg->challenge, sizeof(msg->challenge)); | 423 LogBuf("challenge", msg->challenge, sizeof(msg->challenge)); |
427 | 424 |
428 // We currently do not implement LMv2/NTLMv2 or NTLM2 responses, | 425 // We currently do not implement LMv2/NTLMv2 or NTLM2 responses, |
429 // so we can ignore target information. We may want to enable | 426 // so we can ignore target information. We may want to enable |
430 // support for these alternate mechanisms in the future. | 427 // support for these alternate mechanisms in the future. |
431 return OK; | 428 return OK; |
432 } | 429 } |
433 | 430 |
434 static void GenerateRandom(uint8* output, size_t n) { | 431 static void GenerateRandom(uint8* output, size_t n) { |
(...skipping 15 matching lines...) Expand all Loading... |
450 | 447 |
451 int rv; | 448 int rv; |
452 Type2Msg msg; | 449 Type2Msg msg; |
453 | 450 |
454 rv = ParseType2Msg(in_buf, in_len, &msg); | 451 rv = ParseType2Msg(in_buf, in_len, &msg); |
455 if (rv != OK) | 452 if (rv != OK) |
456 return rv; | 453 return rv; |
457 | 454 |
458 bool unicode = (msg.flags & NTLM_NegotiateUnicode) != 0; | 455 bool unicode = (msg.flags & NTLM_NegotiateUnicode) != 0; |
459 | 456 |
460 // Temporary buffers for unicode strings | 457 // Temporary buffers for unicode strings |
461 #ifdef IS_BIG_ENDIAN | 458 #ifdef IS_BIG_ENDIAN |
462 base::string16 ucs_domain_buf, ucs_user_buf; | 459 base::string16 ucs_domain_buf, ucs_user_buf; |
463 #endif | 460 #endif |
464 base::string16 ucs_host_buf; | 461 base::string16 ucs_host_buf; |
465 // Temporary buffers for oem strings | 462 // Temporary buffers for oem strings |
466 std::string oem_domain_buf, oem_user_buf; | 463 std::string oem_domain_buf, oem_user_buf; |
467 // Pointers and lengths for the string buffers; encoding is unicode if | 464 // Pointers and lengths for the string buffers; encoding is unicode if |
468 // the "negotiate unicode" flag was set in the Type-2 message. | 465 // the "negotiate unicode" flag was set in the Type-2 message. |
469 const void* domain_ptr; | 466 const void* domain_ptr; |
470 const void* user_ptr; | 467 const void* user_ptr; |
471 const void* host_ptr; | 468 const void* host_ptr; |
472 uint32 domain_len, user_len, host_len; | 469 uint32 domain_len, user_len, host_len; |
473 | 470 |
474 // | 471 // |
475 // Get domain name. | 472 // Get domain name. |
476 // | 473 // |
477 if (unicode) { | 474 if (unicode) { |
478 #ifdef IS_BIG_ENDIAN | 475 #ifdef IS_BIG_ENDIAN |
479 ucs_domain_buf = domain; | 476 ucs_domain_buf = domain; |
480 domain_ptr = ucs_domain_buf.data(); | 477 domain_ptr = ucs_domain_buf.data(); |
481 domain_len = ucs_domain_buf.length() * 2; | 478 domain_len = ucs_domain_buf.length() * 2; |
482 WriteUnicodeLE(const_cast<void*>(domain_ptr), | 479 WriteUnicodeLE(const_cast<void*>(domain_ptr), |
483 (const base::char16*) domain_ptr, | 480 (const base::char16*)domain_ptr, |
484 ucs_domain_buf.length()); | 481 ucs_domain_buf.length()); |
485 #else | 482 #else |
486 domain_ptr = domain.data(); | 483 domain_ptr = domain.data(); |
487 domain_len = domain.length() * 2; | 484 domain_len = domain.length() * 2; |
488 #endif | 485 #endif |
489 } else { | 486 } else { |
490 oem_domain_buf = base::SysWideToNativeMB(base::UTF16ToWide(domain)); | 487 oem_domain_buf = base::SysWideToNativeMB(base::UTF16ToWide(domain)); |
491 domain_ptr = oem_domain_buf.data(); | 488 domain_ptr = oem_domain_buf.data(); |
492 domain_len = oem_domain_buf.length(); | 489 domain_len = oem_domain_buf.length(); |
493 } | 490 } |
494 | 491 |
495 // | 492 // |
496 // Get user name. | 493 // Get user name. |
497 // | 494 // |
498 if (unicode) { | 495 if (unicode) { |
499 #ifdef IS_BIG_ENDIAN | 496 #ifdef IS_BIG_ENDIAN |
500 ucs_user_buf = username; | 497 ucs_user_buf = username; |
501 user_ptr = ucs_user_buf.data(); | 498 user_ptr = ucs_user_buf.data(); |
502 user_len = ucs_user_buf.length() * 2; | 499 user_len = ucs_user_buf.length() * 2; |
503 WriteUnicodeLE(const_cast<void*>(user_ptr), (const base::char16*) user_ptr, | 500 WriteUnicodeLE(const_cast<void*>(user_ptr), |
| 501 (const base::char16*)user_ptr, |
504 ucs_user_buf.length()); | 502 ucs_user_buf.length()); |
505 #else | 503 #else |
506 user_ptr = username.data(); | 504 user_ptr = username.data(); |
507 user_len = username.length() * 2; | 505 user_len = username.length() * 2; |
508 #endif | 506 #endif |
509 } else { | 507 } else { |
510 oem_user_buf = base::SysWideToNativeMB(base::UTF16ToWide(username)); | 508 oem_user_buf = base::SysWideToNativeMB(base::UTF16ToWide(username)); |
511 user_ptr = oem_user_buf.data(); | 509 user_ptr = oem_user_buf.data(); |
512 user_len = oem_user_buf.length(); | 510 user_len = oem_user_buf.length(); |
513 } | 511 } |
514 | 512 |
515 // | 513 // |
516 // Get workstation name (use local machine's hostname). | 514 // Get workstation name (use local machine's hostname). |
517 // | 515 // |
518 if (unicode) { | 516 if (unicode) { |
519 // hostname is ASCII, so we can do a simple zero-pad expansion: | 517 // hostname is ASCII, so we can do a simple zero-pad expansion: |
520 ucs_host_buf.assign(hostname.begin(), hostname.end()); | 518 ucs_host_buf.assign(hostname.begin(), hostname.end()); |
521 host_ptr = ucs_host_buf.data(); | 519 host_ptr = ucs_host_buf.data(); |
522 host_len = ucs_host_buf.length() * 2; | 520 host_len = ucs_host_buf.length() * 2; |
523 #ifdef IS_BIG_ENDIAN | 521 #ifdef IS_BIG_ENDIAN |
524 WriteUnicodeLE(const_cast<void*>(host_ptr), (const base::char16*) host_ptr, | 522 WriteUnicodeLE(const_cast<void*>(host_ptr), |
| 523 (const base::char16*)host_ptr, |
525 ucs_host_buf.length()); | 524 ucs_host_buf.length()); |
526 #endif | 525 #endif |
527 } else { | 526 } else { |
528 host_ptr = hostname.data(); | 527 host_ptr = hostname.data(); |
529 host_len = hostname.length(); | 528 host_len = hostname.length(); |
530 } | 529 } |
531 | 530 |
532 // | 531 // |
533 // Now that we have generated all of the strings, we can allocate out_buf. | 532 // Now that we have generated all of the strings, we can allocate out_buf. |
534 // | 533 // |
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
618 cursor = WriteDWORD(cursor, msg.flags & NTLM_TYPE1_FLAGS); | 617 cursor = WriteDWORD(cursor, msg.flags & NTLM_TYPE1_FLAGS); |
619 | 618 |
620 return OK; | 619 return OK; |
621 } | 620 } |
622 | 621 |
623 // NTLM authentication is specified in "NTLM Over HTTP Protocol Specification" | 622 // NTLM authentication is specified in "NTLM Over HTTP Protocol Specification" |
624 // [MS-NTHT]. | 623 // [MS-NTHT]. |
625 | 624 |
626 // static | 625 // static |
627 HttpAuthHandlerNTLM::GenerateRandomProc | 626 HttpAuthHandlerNTLM::GenerateRandomProc |
628 HttpAuthHandlerNTLM::generate_random_proc_ = GenerateRandom; | 627 HttpAuthHandlerNTLM::generate_random_proc_ = GenerateRandom; |
629 | 628 |
630 // static | 629 // static |
631 HttpAuthHandlerNTLM::HostNameProc | 630 HttpAuthHandlerNTLM::HostNameProc HttpAuthHandlerNTLM::get_host_name_proc_ = |
632 HttpAuthHandlerNTLM::get_host_name_proc_ = GetHostName; | 631 GetHostName; |
633 | 632 |
634 HttpAuthHandlerNTLM::HttpAuthHandlerNTLM() { | 633 HttpAuthHandlerNTLM::HttpAuthHandlerNTLM() { |
635 } | 634 } |
636 | 635 |
637 bool HttpAuthHandlerNTLM::NeedsIdentity() { | 636 bool HttpAuthHandlerNTLM::NeedsIdentity() { |
638 // This gets called for each round-trip. Only require identity on | 637 // This gets called for each round-trip. Only require identity on |
639 // the first call (when auth_data_ is empty). On subsequent calls, | 638 // the first call (when auth_data_ is empty). On subsequent calls, |
640 // we use the initially established identity. | 639 // we use the initially established identity. |
641 return auth_data_.empty(); | 640 return auth_data_.empty(); |
642 } | 641 } |
643 | 642 |
644 bool HttpAuthHandlerNTLM::AllowsDefaultCredentials() { | 643 bool HttpAuthHandlerNTLM::AllowsDefaultCredentials() { |
645 // Default credentials are not supported in the portable implementation of | 644 // Default credentials are not supported in the portable implementation of |
646 // NTLM, but are supported in the SSPI implementation. | 645 // NTLM, but are supported in the SSPI implementation. |
647 return false; | 646 return false; |
648 } | 647 } |
649 | 648 |
650 int HttpAuthHandlerNTLM::InitializeBeforeFirstChallenge() { | 649 int HttpAuthHandlerNTLM::InitializeBeforeFirstChallenge() { |
651 return OK; | 650 return OK; |
652 } | 651 } |
653 | 652 |
654 HttpAuthHandlerNTLM::~HttpAuthHandlerNTLM() { | 653 HttpAuthHandlerNTLM::~HttpAuthHandlerNTLM() { |
655 credentials_.Zap(); | 654 credentials_.Zap(); |
656 } | 655 } |
657 | 656 |
658 // static | 657 // static |
659 HttpAuthHandlerNTLM::GenerateRandomProc | 658 HttpAuthHandlerNTLM::GenerateRandomProc |
660 HttpAuthHandlerNTLM::SetGenerateRandomProc( | 659 HttpAuthHandlerNTLM::SetGenerateRandomProc(GenerateRandomProc proc) { |
661 GenerateRandomProc proc) { | |
662 GenerateRandomProc old_proc = generate_random_proc_; | 660 GenerateRandomProc old_proc = generate_random_proc_; |
663 generate_random_proc_ = proc; | 661 generate_random_proc_ = proc; |
664 return old_proc; | 662 return old_proc; |
665 } | 663 } |
666 | 664 |
667 // static | 665 // static |
668 HttpAuthHandlerNTLM::HostNameProc HttpAuthHandlerNTLM::SetHostNameProc( | 666 HttpAuthHandlerNTLM::HostNameProc HttpAuthHandlerNTLM::SetHostNameProc( |
669 HostNameProc proc) { | 667 HostNameProc proc) { |
670 HostNameProc old_proc = get_host_name_proc_; | 668 HostNameProc old_proc = get_host_name_proc_; |
671 get_host_name_proc_ = proc; | 669 get_host_name_proc_ = proc; |
(...skipping 14 matching lines...) Expand all Loading... |
686 | 684 |
687 // If in_token is non-null, then assume it contains a type 2 message... | 685 // If in_token is non-null, then assume it contains a type 2 message... |
688 if (in_token) { | 686 if (in_token) { |
689 LogToken("in-token", in_token, in_token_len); | 687 LogToken("in-token", in_token, in_token_len); |
690 std::string hostname = get_host_name_proc_(); | 688 std::string hostname = get_host_name_proc_(); |
691 if (hostname.empty()) | 689 if (hostname.empty()) |
692 return ERR_UNEXPECTED; | 690 return ERR_UNEXPECTED; |
693 uint8 rand_buf[8]; | 691 uint8 rand_buf[8]; |
694 generate_random_proc_(rand_buf, 8); | 692 generate_random_proc_(rand_buf, 8); |
695 rv = GenerateType3Msg(domain_, | 693 rv = GenerateType3Msg(domain_, |
696 credentials_.username(), credentials_.password(), | 694 credentials_.username(), |
697 hostname, rand_buf, | 695 credentials_.password(), |
698 in_token, in_token_len, out_token, out_token_len); | 696 hostname, |
| 697 rand_buf, |
| 698 in_token, |
| 699 in_token_len, |
| 700 out_token, |
| 701 out_token_len); |
699 } else { | 702 } else { |
700 rv = GenerateType1Msg(out_token, out_token_len); | 703 rv = GenerateType1Msg(out_token, out_token_len); |
701 } | 704 } |
702 | 705 |
703 if (rv == OK) | 706 if (rv == OK) |
704 LogToken("out-token", *out_token, *out_token_len); | 707 LogToken("out-token", *out_token, *out_token_len); |
705 | 708 |
706 return rv; | 709 return rv; |
707 } | 710 } |
708 | 711 |
(...skipping 12 matching lines...) Expand all Loading... |
721 // NOTE: Default credentials are not supported for the portable implementation | 724 // NOTE: Default credentials are not supported for the portable implementation |
722 // of NTLM. | 725 // of NTLM. |
723 scoped_ptr<HttpAuthHandler> tmp_handler(new HttpAuthHandlerNTLM); | 726 scoped_ptr<HttpAuthHandler> tmp_handler(new HttpAuthHandlerNTLM); |
724 if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log)) | 727 if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log)) |
725 return ERR_INVALID_RESPONSE; | 728 return ERR_INVALID_RESPONSE; |
726 handler->swap(tmp_handler); | 729 handler->swap(tmp_handler); |
727 return OK; | 730 return OK; |
728 } | 731 } |
729 | 732 |
730 } // namespace net | 733 } // namespace net |
OLD | NEW |