usr.sbin/ppp/chap_ms.c

   1 /*-
   2  * Copyright (c) 1997        Gabor Kincses <gabor@acm.org>
   3  *               1997 - 2001 Brian Somers <brian@Awfulhak.org>
   4  *          based on work by Eric Rosenquist
   5  *                           Strata Software Limited.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  *
  29  * $FreeBSD: src/usr.sbin/ppp/chap_ms.c,v 1.9.2.6 2002/09/01 02:12:23 brian Exp $
  30  */
  31
  32 #include <ctype.h>
  33 #ifdef __DragonFly__
  34 #include <sys/types.h>
  35 #include <openssl/des.h>
  36 #include <sha.h>
  37 #include <stdlib.h>
  38 #else
  39 #include <sys/types.h>
  40 #include <stdlib.h>
  41 #ifdef __NetBSD__
  42 #include <openssl/des.h>
  43 #else
  44 #include <des.h>
  45 #endif
  46 #include <openssl/sha.h>
  47 #endif
  48 #include <md4.h>
  49 #include <string.h>
  50
  51 #include "chap_ms.h"
  52
  53 /*
  54  * Documentation & specifications:
  55  *
  56  * MS-CHAP (CHAP80)     rfc2433
  57  * MS-CHAP-V2 (CHAP81)  rfc2759
  58  * MPPE key management  draft-ietf-pppext-mppe-keys-02.txt
  59  */
  60
  61 static char SHA1_Pad1[40] =
  62   {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  63    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  64    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  65    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
  66
  67 static char SHA1_Pad2[40] =
  68   {0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2,
  69    0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2,
  70    0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2,
  71    0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2};
  72
  73 /* unused, for documentation only */
  74 /* only NTResp is filled in for FreeBSD */
  75 struct MS_ChapResponse {
  76     u_char LANManResp[24];
  77     u_char NTResp[24];
  78     u_char UseNT;       /* If 1, ignore the LANMan response field */
  79 };
  80
  81 static u_char
  82 Get7Bits(u_char *input, int startBit)
  83 {
  84     unsigned int word;
  85
  86     word  = (unsigned)input[startBit / 8] << 8;
  87     word |= (unsigned)input[startBit / 8 + 1];
  88
  89     word >>= 15 - (startBit % 8 + 7);
  90
  91     return word & 0xFE;
  92 }
  93
  94 /* IN  56 bit DES key missing parity bits
  95    OUT 64 bit DES key with parity bits added */
  96 static void
  97 MakeKey(u_char *key, u_char *des_key)
  98 {
  99     des_key[0] = Get7Bits(key,  0);
 100     des_key[1] = Get7Bits(key,  7);
 101     des_key[2] = Get7Bits(key, 14);
 102     des_key[3] = Get7Bits(key, 21);
 103     des_key[4] = Get7Bits(key, 28);
 104     des_key[5] = Get7Bits(key, 35);
 105     des_key[6] = Get7Bits(key, 42);
 106     des_key[7] = Get7Bits(key, 49);
 107
 108     DES_set_odd_parity((DES_cblock *)des_key);
 109 }
 110
 111 static void /* IN 8 octets IN 7 octest OUT 8 octets */
 112 DesEncrypt(u_char *clear, u_char *key, u_char *cipher)
 113 {
 114     DES_cblock          des_key;
 115     DES_key_schedule    key_schedule;
 116
 117     MakeKey(key, des_key);
 118     DES_set_key(&des_key, &key_schedule);
 119     DES_ecb_encrypt((DES_cblock *)clear, (DES_cblock *)cipher, &key_schedule, 1);
 120 }
 121
 122 static void      /* IN 8 octets      IN 16 octets     OUT 24 octets */
 123 ChallengeResponse(u_char *challenge, u_char *pwHash, u_char *response)
 124 {
 125     char    ZPasswordHash[21];
 126
 127     memset(ZPasswordHash, '\0', sizeof ZPasswordHash);
 128     memcpy(ZPasswordHash, pwHash, 16);
 129
 130     DesEncrypt(challenge, ZPasswordHash +  0, response + 0);
 131     DesEncrypt(challenge, ZPasswordHash +  7, response + 8);
 132     DesEncrypt(challenge, ZPasswordHash + 14, response + 16);
 133 }
 134
 135 void
 136 NtPasswordHash(char *key, int keylen, char *hash)
 137 {
 138   MD4_CTX MD4context;
 139
 140   MD4Init(&MD4context);
 141   MD4Update(&MD4context, key, keylen);
 142   MD4Final(hash, &MD4context);
 143 }
 144
 145 void
 146 HashNtPasswordHash(char *hash, char *hashhash)
 147 {
 148   MD4_CTX MD4context;
 149
 150   MD4Init(&MD4context);
 151   MD4Update(&MD4context, hash, 16);
 152   MD4Final(hashhash, &MD4context);
 153 }
 154
 155 static void
 156 ChallengeHash(char *PeerChallenge, char *AuthenticatorChallenge,
 157               char *UserName, char *Challenge)
 158 {
 159   SHA_CTX Context;
 160   char Digest[SHA_DIGEST_LENGTH];
 161   char *Name;
 162
 163   Name = strrchr(UserName, '\\');
 164   if(NULL == Name)
 165     Name = UserName;
 166   else
 167     Name++;
 168
 169   SHA1_Init(&Context);
 170
 171   SHA1_Update(&Context, PeerChallenge, 16);
 172   SHA1_Update(&Context, AuthenticatorChallenge, 16);
 173   SHA1_Update(&Context, Name, strlen(Name));
 174
 175   SHA1_Final(Digest, &Context);
 176   memcpy(Challenge, Digest, 8);
 177 }
 178
 179 void
 180 GenerateNTResponse(char *AuthenticatorChallenge, char *PeerChallenge,
 181                    char *UserName, char *Password,
 182                    int PasswordLen, char *Response)
 183 {
 184   char Challenge[8];
 185   char PasswordHash[16];
 186
 187   ChallengeHash(PeerChallenge, AuthenticatorChallenge, UserName, Challenge);
 188   NtPasswordHash(Password, PasswordLen, PasswordHash);
 189   ChallengeResponse(Challenge, PasswordHash, Response);
 190 }
 191
 192 #define LENGTH 20
 193 static char *
 194 SHA1_End(SHA_CTX *ctx, char *buf)
 195 {
 196     int i;
 197     unsigned char digest[LENGTH];
 198     static const char hex[]="0123456789abcdef";
 199
 200     if (!buf)
 201         buf = malloc(2*LENGTH + 1);
 202     if (!buf)
 203         return 0;
 204     SHA1_Final(digest, ctx);
 205     for (i = 0; i < LENGTH; i++) {
 206         buf[i+i] = hex[digest[i] >> 4];
 207         buf[i+i+1] = hex[digest[i] & 0x0f];
 208     }
 209     buf[i+i] = '\0';
 210     return buf;
 211 }
 212
 213 void
 214 GenerateAuthenticatorResponse(char *Password, int PasswordLen,
 215                               char *NTResponse, char *PeerChallenge,
 216                               char *AuthenticatorChallenge, char *UserName,
 217                               char *AuthenticatorResponse)
 218 {
 219   SHA_CTX Context;
 220   char PasswordHash[16];
 221   char PasswordHashHash[16];
 222   char Challenge[8];
 223   u_char Digest[SHA_DIGEST_LENGTH];
 224   int i;
 225
 226       /*
 227        * "Magic" constants used in response generation
 228        */
 229   char Magic1[39] =
 230          {0x4D, 0x61, 0x67, 0x69, 0x63, 0x20, 0x73, 0x65, 0x72, 0x76,
 231           0x65, 0x72, 0x20, 0x74, 0x6F, 0x20, 0x63, 0x6C, 0x69, 0x65,
 232           0x6E, 0x74, 0x20, 0x73, 0x69, 0x67, 0x6E, 0x69, 0x6E, 0x67,
 233           0x20, 0x63, 0x6F, 0x6E, 0x73, 0x74, 0x61, 0x6E, 0x74};
 234
 235
 236   char Magic2[41] =
 237          {0x50, 0x61, 0x64, 0x20, 0x74, 0x6F, 0x20, 0x6D, 0x61, 0x6B,
 238           0x65, 0x20, 0x69, 0x74, 0x20, 0x64, 0x6F, 0x20, 0x6D, 0x6F,
 239           0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6E, 0x20, 0x6F, 0x6E,
 240           0x65, 0x20, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6F,
 241           0x6E};
 242       /*
 243        * Hash the password with MD4
 244        */
 245   NtPasswordHash(Password, PasswordLen, PasswordHash);
 246       /*
 247        * Now hash the hash
 248        */
 249   HashNtPasswordHash(PasswordHash, PasswordHashHash);
 250
 251   SHA1_Init(&Context);
 252   SHA1_Update(&Context, PasswordHashHash, 16);
 253   SHA1_Update(&Context, NTResponse, 24);
 254   SHA1_Update(&Context, Magic1, 39);
 255   SHA1_Final(Digest, &Context);
 256   ChallengeHash(PeerChallenge, AuthenticatorChallenge, UserName, Challenge);
 257   SHA1_Init(&Context);
 258   SHA1_Update(&Context, Digest, 20);
 259   SHA1_Update(&Context, Challenge, 8);
 260   SHA1_Update(&Context, Magic2, 41);
 261
 262       /*
 263        * Encode the value of 'Digest' as "S=" followed by
 264        * 40 ASCII hexadecimal digits and return it in
 265        * AuthenticatorResponse.
 266        * For example,
 267        *   "S=0123456789ABCDEF0123456789ABCDEF01234567"
 268        */
 269   AuthenticatorResponse[0] = 'S';
 270   AuthenticatorResponse[1] = '=';
 271   SHA1_End(&Context, AuthenticatorResponse + 2);
 272   for (i=2; i<42; i++)
 273     AuthenticatorResponse[i] = toupper(AuthenticatorResponse[i]);
 274
 275 }
 276
 277 void
 278 GetMasterKey(char *PasswordHashHash, char *NTResponse, char *MasterKey)
 279 {
 280   char Digest[SHA_DIGEST_LENGTH];
 281   SHA_CTX Context;
 282   static char Magic1[27] =
 283       {0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
 284        0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
 285        0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79};
 286
 287   SHA1_Init(&Context);
 288   SHA1_Update(&Context, PasswordHashHash, 16);
 289   SHA1_Update(&Context, NTResponse, 24);
 290   SHA1_Update(&Context, Magic1, 27);
 291   SHA1_Final(Digest, &Context);
 292   memcpy(MasterKey, Digest, 16);
 293 }
 294
 295 void
 296 GetAsymetricStartKey(char *MasterKey, char *SessionKey, int SessionKeyLength,
 297                      int IsSend, int IsServer)
 298 {
 299   char Digest[SHA_DIGEST_LENGTH];
 300   SHA_CTX Context;
 301   char *s;
 302
 303   static char Magic2[84] =
 304       {0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
 305        0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
 306        0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
 307        0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
 308        0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
 309        0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
 310        0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
 311        0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
 312        0x6b, 0x65, 0x79, 0x2e};
 313
 314   static char Magic3[84] =
 315       {0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
 316        0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
 317        0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
 318        0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
 319        0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
 320        0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
 321        0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
 322        0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
 323        0x6b, 0x65, 0x79, 0x2e};
 324
 325   if (IsSend) {
 326      if (IsServer) {
 327         s = Magic3;
 328      } else {
 329         s = Magic2;
 330      }
 331   } else {
 332      if (IsServer) {
 333         s = Magic2;
 334      } else {
 335         s = Magic3;
 336      }
 337   }
 338
 339   SHA1_Init(&Context);
 340   SHA1_Update(&Context, MasterKey, 16);
 341   SHA1_Update(&Context, SHA1_Pad1, 40);
 342   SHA1_Update(&Context, s, 84);
 343   SHA1_Update(&Context, SHA1_Pad2, 40);
 344   SHA1_Final(Digest, &Context);
 345
 346   memcpy(SessionKey, Digest, SessionKeyLength);
 347 }
 348
 349 void
 350 GetNewKeyFromSHA(char *StartKey, char *SessionKey, long SessionKeyLength,
 351                  char *InterimKey)
 352 {
 353   SHA_CTX Context;
 354   char Digest[SHA_DIGEST_LENGTH];
 355
 356   SHA1_Init(&Context);
 357   SHA1_Update(&Context, StartKey, SessionKeyLength);
 358   SHA1_Update(&Context, SHA1_Pad1, 40);
 359   SHA1_Update(&Context, SessionKey, SessionKeyLength);
 360   SHA1_Update(&Context, SHA1_Pad2, 40);
 361   SHA1_Final(Digest, &Context);
 362
 363   memcpy(InterimKey, Digest, SessionKeyLength);
 364 }
 365
 366 #if 0
 367 static void
 368 Get_Key(char *InitialSessionKey, char *CurrentSessionKey,
 369         int LengthOfDesiredKey)
 370 {
 371   SHA_CTX Context;
 372   char Digest[SHA_DIGEST_LENGTH];
 373
 374   SHA1_Init(&Context);
 375   SHA1_Update(&Context, InitialSessionKey, LengthOfDesiredKey);
 376   SHA1_Update(&Context, SHA1_Pad1, 40);
 377   SHA1_Update(&Context, CurrentSessionKey, LengthOfDesiredKey);
 378   SHA1_Update(&Context, SHA1_Pad2, 40);
 379   SHA1_Final(Digest, &Context);
 380
 381   memcpy(CurrentSessionKey, Digest, LengthOfDesiredKey);
 382 }
 383 #endif
 384
 385 /* passwordHash 16-bytes MD4 hashed password
 386    challenge    8-bytes peer CHAP challenge
 387    since passwordHash is in a 24-byte buffer, response is written in there */
 388 void
 389 mschap_NT(char *passwordHash, char *challenge)
 390 {
 391     u_char response[24];
 392
 393     ChallengeResponse(challenge, passwordHash, response);
 394     memcpy(passwordHash, response, 24);
 395     passwordHash[24] = 1;               /* NT-style response */
 396 }
 397
 398 void
 399 mschap_LANMan(char *digest, char *challenge, char *secret)
 400 {
 401   static u_char salt[] = "KGS!@#$%";    /* RASAPI32.dll */
 402   char SECRET[14], *ptr, *end;
 403   u_char hash[16];
 404
 405   end = SECRET + sizeof SECRET;
 406   for (ptr = SECRET; *secret && ptr < end; ptr++, secret++)
 407     *ptr = toupper(*secret);
 408   if (ptr < end)
 409     memset(ptr, '\0', end - ptr);
 410
 411   DesEncrypt(salt, SECRET, hash);
 412   DesEncrypt(salt, SECRET + 7, hash + 8);
 413
 414   ChallengeResponse(challenge, hash, digest);
 415 }