OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2017 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef NET_BASE_NTLM_BUFFER_WRITER_H_ | |
6 #define NET_BASE_NTLM_BUFFER_WRITER_H_ | |
7 | |
8 #include <stddef.h> | |
9 #include <stdint.h> | |
10 | |
11 #include <memory> | |
12 #include <string> | |
13 | |
14 #include "base/strings/string16.h" | |
15 #include "base/strings/string_piece.h" | |
16 #include "net/base/net_export.h" | |
17 #include "net/http/ntlm.h" | |
18 | |
19 namespace net { | |
20 | |
21 // Supports various bounds checked low level buffer operations required by an | |
22 // NTLM implementation. | |
23 // | |
24 // The class supports sequential write to an internally managed buffer. All | |
25 // writes perform bounds checking to ensure enough space is remaining in the | |
26 // buffer. | |
27 // | |
28 // The internal buffer is allocated in the constructor with size |buffer_len| | |
29 // and owned by the class. Use |ReleaseBufferPtr| to take ownership of the | |
30 // internal buffer. Thereafter all operations on the class will fail. | |
31 // | |
32 // Write* methods write the buffer at the current cursor position and perform | |
33 // any necessary type conversion and provide the data in out params. After a | |
34 // successful write the cursor position is advanced past the written field. | |
35 // | |
36 // Failed writes leave the internal cursor at the same position as before the | |
37 // call. | |
38 // | |
39 // Based on [MS-NLMP]: NT LAN Manager (NTLM) Authentication Protocol | |
40 // Specification version 28.0 [1] | |
41 // | |
42 // [1] https://msdn.microsoft.com/en-us/library/cc236621.aspx | |
43 class NET_EXPORT_PRIVATE NtlmBufferWriter { | |
44 public: | |
45 explicit NtlmBufferWriter(size_t buffer_len); | |
46 ~NtlmBufferWriter(); | |
47 | |
48 size_t GetLength() const { return buffer_len_; } | |
49 size_t GetCursor() const { return cursor_; } | |
50 bool IsEndOfBuffer() const { return cursor_ >= GetLength(); } | |
51 | |
52 // Releases ownership of the internal buffer. Subsequent writes | |
53 // will all fail. | |
54 uint8_t* ReleaseBufferPtr() { | |
55 buffer_len_ = 0; | |
56 cursor_ = 0; | |
57 return buffer_.release(); | |
58 } | |
59 | |
60 // Gets a base::StringPiece view over the entire buffer. | |
61 base::StringPiece GetBuffer() const { | |
62 return base::StringPiece(reinterpret_cast<const char*>(buffer_.get()), | |
63 buffer_len_); | |
64 } | |
65 | |
66 // Returns true if there are |len| more bytes between the current cursor | |
67 // position and the end of the buffer. | |
68 bool CanWrite(size_t len) const; | |
69 | |
70 // Writes a 16 bit unsigned value (little endian). If there are not 16 | |
71 // more bits available in the buffer it returns false. | |
72 bool WriteUInt16(uint16_t value); | |
asanka
2017/06/16 03:21:29
Same comment about WARN_UNUSED_RESULT. The buffer
zentaro
2017/06/21 00:38:47
Done.
| |
73 | |
74 // Writes a 32 bit unsigned value (little endian). If there are not 32 | |
75 // more bits available in the buffer it returns false. | |
76 bool WriteUInt32(uint32_t value); | |
77 | |
78 // Writes a 64 bit unsigned value (little endian). If there are not 64 | |
79 // more bits available in the buffer it returns false. | |
80 bool WriteUInt64(uint64_t value); | |
81 | |
82 // Casts |flags| to |uint32_t| and calls |WriteUInt32|. | |
asanka
2017/06/16 03:21:29
Unnecessary to describe an implementation detail.
zentaro
2017/06/21 00:38:47
Done.
| |
83 bool WriteFlags(ntlm::NegotiateFlags flags); | |
84 | |
85 // Writes |len| bytes from |buffer|. If there are not |len| more bytes in | |
86 // the buffer it returns false. | |
87 bool WriteBytes(const uint8_t* buffer, size_t len); | |
88 | |
89 // Writes the bytes from the |base::StringPiece|. If there are not enough | |
90 // bytes in the buffer it returns false. | |
91 bool WriteBytes(base::StringPiece bytes); | |
92 | |
93 // Writes |count| bytes of zeros to the buffer. If there are not |count| | |
94 // more bytes in available in the buffer it returns false. | |
95 bool WriteZeros(size_t count); | |
96 | |
97 // A security buffer is an 8 byte structure that defines the offset and | |
98 // length of a payload (string, struct, or byte array) that appears after | |
99 // the fixed part of the message. | |
100 // | |
101 // The structure in the NTLM message is (little endian fields): | |
102 // uint16 - |length| Length of payload | |
103 // uint16 - Allocation (ignored and always set to |length|) | |
104 // uint32 - |offset| Offset from start of message | |
105 bool WriteSecurityBuffer(ntlm::SecurityBuffer sec_buf); | |
106 | |
107 // Writes a security buffer with all fields zero. This implies there is | |
108 // no payload for this field. See |WriteSecurityBuffer|. | |
109 bool WriteEmptySecurityBuffer(); | |
110 | |
111 // Writes a string of 8 bit characters to the buffer. | |
112 // | |
113 // When unicode was not negotiated only the hostname string will go through | |
114 // this code path. The 8 bit bytes of the hostname are written to the buffer. | |
115 // The encoding is not relevant. | |
116 bool WriteUtf8String(const std::string& str); | |
117 | |
118 // Converts the 16 bit characters to UTF8 and writes the resulting 8 bit | |
119 // characters. | |
120 // | |
121 // If unicode was not negotiated, username and domain get converted to UTF8 | |
122 // in the message. Since they are just treated as additional bytes input to | |
123 // hash the encoding doesn't matter. In practice only a very old or non- | |
124 // windows server might trigger this code path since we always attempt to | |
125 // negotiate unicode and servers are supposed to honor that request. | |
126 bool WriteUtf16AsUtf8String(const base::string16& str); | |
127 | |
128 // Treats |str| as UTF8, converts to UTF-16 and writes it with little-endian | |
129 // byte order to the buffer. | |
130 // | |
131 // Two specific strings go through this code path. | |
132 // | |
133 // One case is the hostname. When the the unicode flag has been set during | |
134 // negotiation the hostname needs to appear in the message with 16 bit | |
135 // chars. The high byte of each char is just set to 0. | |
136 // | |
137 // The other case is the spn. With EPA enabled it appears in the target info | |
138 // inside an AV Pair where strings always have 16 bit chars. | |
139 bool WriteUtf8AsUtf16String(const std::string& str); | |
140 | |
141 // Writes UTF-16 LE characters to the buffer. For these strings such as | |
142 // username and domain the actual encoding isn't really important. They are | |
143 // just treated as additional bytes of input to the hash. | |
144 bool WriteUtf16String(const base::string16& str); | |
145 | |
146 // Writes the 8 byte NTLM signature "NTLMSSP\0" into the buffer. | |
147 bool WriteSignature(); | |
148 | |
149 // There are 3 message types Negotiate (sent by client), Challenge (sent by | |
150 // server), and Authenticate (sent by client). | |
151 // | |
152 // This writes |message_type| as a uint32_t into the buffer. | |
153 bool WriteMessageType(ntlm::MessageType message_type); | |
154 | |
155 // Performs |WriteSignature| then |WriteMessageType|. | |
156 bool WriteMessageHeader(ntlm::MessageType message_type); | |
157 | |
158 private: | |
159 // Writes |sizeof(T)| bytes little-endian of an integer type to the buffer. | |
160 template <typename T> | |
161 bool WriteUInt(T value); | |
162 | |
163 // Sets the cursor position. Will return false if outside the buffer. | |
164 void SetCursor(size_t cursor); | |
165 | |
166 // Advances the cursor by |count|. The caller is responsible for checking | |
167 // that the target location is within the buffer. | |
168 void AdvanceCursor(size_t count) { SetCursor(GetCursor() + count); } | |
169 | |
170 // Returns a pointer to the start of the buffer. | |
171 uint8_t* GetBufferPtr() const { return buffer_.get(); } | |
172 | |
173 // Returns pointer into the buffer at the current cursor location. | |
174 uint8_t* GetBufferPtrAtCursor() const { return buffer_.get() + GetCursor(); } | |
175 | |
176 std::unique_ptr<uint8_t[]> buffer_; | |
177 size_t buffer_len_; | |
178 size_t cursor_; | |
179 | |
180 DISALLOW_COPY_AND_ASSIGN(NtlmBufferWriter); | |
181 }; | |
182 | |
183 } // namespace net | |
184 | |
185 #endif // NET_BASE_NTLM_BUFFER_WRITER_H_ | |
OLD | NEW |