?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
include: Make sure __int64 is correctly defined on PPC64.
[wine.git] / dlls / secur32 / ntlm.c
blob4e3fda3ea988dd851acc8692d6adbe5d3c8255ac
1 /*
2 * Copyright 2005, 2006 Kai Blin
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
17 *
18 * This file implements the NTLM security provider.
19 */
20
21 #include <assert.h>
22 #include <stdarg.h>
23 #include <stdio.h>
24 #include "windef.h"
25 #include "winbase.h"
26 #include "winnls.h"
27 #include "wincred.h"
28 #include "winternl.h"
29 #include "rpc.h"
30 #include "sspi.h"
31 #include "lm.h"
32 #include "secur32_priv.h"
33 #include "hmac_md5.h"
34 #include "wine/unicode.h"
35 #include "wine/debug.h"
36
37 WINE_DEFAULT_DEBUG_CHANNEL(ntlm);
38 WINE_DECLARE_DEBUG_CHANNEL(winediag);
39
40 #define NTLM_MAX_BUF 1904
41 #define MIN_NTLM_AUTH_MAJOR_VERSION 3
42 #define MIN_NTLM_AUTH_MINOR_VERSION 0
43 #define MIN_NTLM_AUTH_MICRO_VERSION 25
44
45 static CHAR ntlm_auth[] = "ntlm_auth";
46
47 /***********************************************************************
48 * QueryCredentialsAttributesA
49 */
50 static SECURITY_STATUS SEC_ENTRY ntlm_QueryCredentialsAttributesA(
51 PCredHandle phCredential, ULONG ulAttribute, PVOID pBuffer)
52 {
53 SECURITY_STATUS ret;
54
55 TRACE("(%p, %d, %p)\n", phCredential, ulAttribute, pBuffer);
56
57 if(ulAttribute == SECPKG_ATTR_NAMES)
58 {
59 FIXME("SECPKG_CRED_ATTR_NAMES: stub\n");
60 ret = SEC_E_UNSUPPORTED_FUNCTION;
61 }
62 else
63 ret = SEC_E_UNSUPPORTED_FUNCTION;
64
65 return ret;
66 }
67
68 /***********************************************************************
69 * QueryCredentialsAttributesW
70 */
71 static SECURITY_STATUS SEC_ENTRY ntlm_QueryCredentialsAttributesW(
72 PCredHandle phCredential, ULONG ulAttribute, PVOID pBuffer)
73 {
74 SECURITY_STATUS ret;
75
76 TRACE("(%p, %d, %p)\n", phCredential, ulAttribute, pBuffer);
77
78 if(ulAttribute == SECPKG_ATTR_NAMES)
79 {
80 FIXME("SECPKG_CRED_ATTR_NAMES: stub\n");
81 ret = SEC_E_UNSUPPORTED_FUNCTION;
82 }
83 else
84 ret = SEC_E_UNSUPPORTED_FUNCTION;
85
86 return ret;
87 }
88
89 static char *ntlm_GetUsernameArg(LPCWSTR userW, INT userW_length)
90 {
91 static const char username_arg[] = "--username=";
92 char *user;
93 int unixcp_size;
94
95 unixcp_size = WideCharToMultiByte(CP_UNIXCP, WC_NO_BEST_FIT_CHARS,
96 userW, userW_length, NULL, 0, NULL, NULL) + sizeof(username_arg);
97 if (!(user = heap_alloc(unixcp_size))) return NULL;
98 memcpy(user, username_arg, sizeof(username_arg) - 1);
99 WideCharToMultiByte(CP_UNIXCP, WC_NO_BEST_FIT_CHARS, userW, userW_length,
100 user + sizeof(username_arg) - 1,
101 unixcp_size - sizeof(username_arg) + 1, NULL, NULL);
102 user[unixcp_size - 1] = '\0';
103 return user;
104 }
105
106 static char *ntlm_GetDomainArg(LPCWSTR domainW, INT domainW_length)
107 {
108 static const char domain_arg[] = "--domain=";
109 char *domain;
110 int unixcp_size;
111
112 unixcp_size = WideCharToMultiByte(CP_UNIXCP, WC_NO_BEST_FIT_CHARS,
113 domainW, domainW_length, NULL, 0, NULL, NULL) + sizeof(domain_arg);
114 if (!(domain = heap_alloc(unixcp_size))) return NULL;
115 memcpy(domain, domain_arg, sizeof(domain_arg) - 1);
116 WideCharToMultiByte(CP_UNIXCP, WC_NO_BEST_FIT_CHARS, domainW,
117 domainW_length, domain + sizeof(domain_arg) - 1,
118 unixcp_size - sizeof(domain) + 1, NULL, NULL);
119 domain[unixcp_size - 1] = '\0';
120 return domain;
121 }
122
123 /***********************************************************************
124 * AcquireCredentialsHandleW
125 */
126 static SECURITY_STATUS SEC_ENTRY ntlm_AcquireCredentialsHandleW(
127 SEC_WCHAR *pszPrincipal, SEC_WCHAR *pszPackage, ULONG fCredentialUse,
128 PLUID pLogonID, PVOID pAuthData, SEC_GET_KEY_FN pGetKeyFn,
129 PVOID pGetKeyArgument, PCredHandle phCredential, PTimeStamp ptsExpiry)
130 {
131 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
132 PNtlmCredentials ntlm_cred = NULL;
133 LPWSTR domain = NULL, user = NULL, password = NULL;
134 PSEC_WINNT_AUTH_IDENTITY_W auth_data = NULL;
135
136 TRACE("(%s, %s, 0x%08x, %p, %p, %p, %p, %p, %p)\n",
137 debugstr_w(pszPrincipal), debugstr_w(pszPackage), fCredentialUse,
138 pLogonID, pAuthData, pGetKeyFn, pGetKeyArgument, phCredential, ptsExpiry);
139
140 switch (fCredentialUse)
141 {
142 case SECPKG_CRED_INBOUND:
143 if (!(ntlm_cred = heap_alloc(sizeof(*ntlm_cred)))) return SEC_E_INSUFFICIENT_MEMORY;
144 ntlm_cred->mode = NTLM_SERVER;
145 ntlm_cred->username_arg = NULL;
146 ntlm_cred->domain_arg = NULL;
147 ntlm_cred->password = NULL;
148 ntlm_cred->pwlen = 0;
149 ntlm_cred->no_cached_credentials = 0;
150
151 phCredential->dwUpper = fCredentialUse;
152 phCredential->dwLower = (ULONG_PTR)ntlm_cred;
153 ret = SEC_E_OK;
154 break;
155
156 case SECPKG_CRED_OUTBOUND:
157 auth_data = pAuthData;
158 if (!(ntlm_cred = heap_alloc(sizeof(*ntlm_cred)))) return SEC_E_INSUFFICIENT_MEMORY;
159
160 ntlm_cred->mode = NTLM_CLIENT;
161 ntlm_cred->username_arg = NULL;
162 ntlm_cred->domain_arg = NULL;
163 ntlm_cred->password = NULL;
164 ntlm_cred->pwlen = 0;
165 ntlm_cred->no_cached_credentials = 0;
166
167 if (pAuthData)
168 {
169 int domain_len = 0, user_len = 0, password_len = 0;
170
171 if (auth_data->Flags & SEC_WINNT_AUTH_IDENTITY_ANSI)
172 {
173 if (auth_data->DomainLength)
174 {
175 domain_len = MultiByteToWideChar(CP_ACP, 0, (char *)auth_data->Domain,
176 auth_data->DomainLength, NULL, 0);
177 if (!(domain = heap_alloc(sizeof(WCHAR) * domain_len))) goto done;
178 MultiByteToWideChar(CP_ACP, 0, (char *)auth_data->Domain, auth_data->DomainLength,
179 domain, domain_len);
180 }
181 if (auth_data->UserLength)
182 {
183 user_len = MultiByteToWideChar(CP_ACP, 0, (char *)auth_data->User,
184 auth_data->UserLength, NULL, 0);
185 if (!(user = heap_alloc(sizeof(WCHAR) * user_len))) goto done;
186 MultiByteToWideChar(CP_ACP, 0, (char *)auth_data->User, auth_data->UserLength,
187 user, user_len);
188 }
189 if (auth_data->PasswordLength)
190 {
191 password_len = MultiByteToWideChar(CP_ACP, 0,(char *)auth_data->Password,
192 auth_data->PasswordLength, NULL, 0);
193 if (!(password = heap_alloc(sizeof(WCHAR) * password_len))) goto done;
194 MultiByteToWideChar(CP_ACP, 0, (char *)auth_data->Password, auth_data->PasswordLength,
195 password, password_len);
196 }
197 }
198 else
199 {
200 domain = auth_data->Domain;
201 domain_len = auth_data->DomainLength;
202
203 user = auth_data->User;
204 user_len = auth_data->UserLength;
205
206 password = auth_data->Password;
207 password_len = auth_data->PasswordLength;
208 }
209
210 TRACE("Username is %s\n", debugstr_wn(user, user_len));
211 TRACE("Domain name is %s\n", debugstr_wn(domain, domain_len));
212
213 ntlm_cred->username_arg = ntlm_GetUsernameArg(user, user_len);
214 ntlm_cred->domain_arg = ntlm_GetDomainArg(domain, domain_len);
215
216 if (password_len)
217 {
218 ntlm_cred->pwlen = WideCharToMultiByte(CP_UNIXCP, WC_NO_BEST_FIT_CHARS, password,
219 password_len, NULL, 0, NULL, NULL);
220 if (!(ntlm_cred->password = heap_alloc(ntlm_cred->pwlen))) goto done;
221 WideCharToMultiByte(CP_UNIXCP, WC_NO_BEST_FIT_CHARS, password, password_len,
222 ntlm_cred->password, ntlm_cred->pwlen, NULL, NULL);
223 }
224 }
225
226 phCredential->dwUpper = fCredentialUse;
227 phCredential->dwLower = (ULONG_PTR)ntlm_cred;
228 TRACE("ACH phCredential->dwUpper: 0x%08lx, dwLower: 0x%08lx\n", phCredential->dwUpper,
229 phCredential->dwLower);
230 ret = SEC_E_OK;
231 break;
232
233 case SECPKG_CRED_BOTH:
234 FIXME("AcquireCredentialsHandle: SECPKG_CRED_BOTH stub\n");
235 ret = SEC_E_UNSUPPORTED_FUNCTION;
236 break;
237
238 default:
239 ret = SEC_E_UNKNOWN_CREDENTIALS;
240 }
241
242 done:
243 if (auth_data && (auth_data->Flags & SEC_WINNT_AUTH_IDENTITY_ANSI))
244 {
245 heap_free(domain);
246 heap_free(user);
247 heap_free(password);
248 }
249 if (ret != SEC_E_OK) heap_free( ntlm_cred );
250
251 return ret;
252 }
253
254 /***********************************************************************
255 * AcquireCredentialsHandleA
256 */
257 static SECURITY_STATUS SEC_ENTRY ntlm_AcquireCredentialsHandleA(
258 SEC_CHAR *pszPrincipal, SEC_CHAR *pszPackage, ULONG fCredentialUse,
259 PLUID pLogonID, PVOID pAuthData, SEC_GET_KEY_FN pGetKeyFn,
260 PVOID pGetKeyArgument, PCredHandle phCredential, PTimeStamp ptsExpiry)
261 {
262 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
263 int user_sizeW, domain_sizeW, passwd_sizeW;
264 SEC_WCHAR *user = NULL, *domain = NULL, *passwd = NULL, *package = NULL;
265 PSEC_WINNT_AUTH_IDENTITY_W pAuthDataW = NULL;
266 PSEC_WINNT_AUTH_IDENTITY_A id = NULL;
267
268 TRACE("(%s, %s, 0x%08x, %p, %p, %p, %p, %p, %p)\n",
269 debugstr_a(pszPrincipal), debugstr_a(pszPackage), fCredentialUse,
270 pLogonID, pAuthData, pGetKeyFn, pGetKeyArgument, phCredential, ptsExpiry);
271
272 if (pszPackage)
273 {
274 int package_sizeW = MultiByteToWideChar(CP_ACP, 0, pszPackage, -1, NULL, 0);
275 if (!(package = heap_alloc(package_sizeW * sizeof(SEC_WCHAR)))) return SEC_E_INSUFFICIENT_MEMORY;
276 MultiByteToWideChar(CP_ACP, 0, pszPackage, -1, package, package_sizeW);
277 }
278
279 if (pAuthData)
280 {
281 id = pAuthData;
282 if (id->Flags == SEC_WINNT_AUTH_IDENTITY_ANSI)
283 {
284 if (!(pAuthDataW = heap_alloc(sizeof(SEC_WINNT_AUTH_IDENTITY_W)))) goto done;
285
286 if (!id->UserLength) user_sizeW = 0;
287 else
288 {
289 user_sizeW = MultiByteToWideChar(CP_ACP, 0, (LPCSTR)id->User, id->UserLength, NULL, 0);
290 if (!(user = heap_alloc(user_sizeW * sizeof(SEC_WCHAR)))) goto done;
291 MultiByteToWideChar(CP_ACP, 0, (LPCSTR)id->User, id->UserLength, user, user_sizeW);
292 }
293
294 if (!id->DomainLength) domain_sizeW = 0;
295 else
296 {
297 domain_sizeW = MultiByteToWideChar(CP_ACP, 0, (LPCSTR)id->Domain, id->DomainLength, NULL, 0);
298 if (!(domain = heap_alloc(domain_sizeW * sizeof(SEC_WCHAR)))) goto done;
299 MultiByteToWideChar(CP_ACP, 0, (LPCSTR)id->Domain, id->DomainLength, domain, domain_sizeW);
300 }
301
302 if (!id->PasswordLength) passwd_sizeW = 0;
303 else
304 {
305 passwd_sizeW = MultiByteToWideChar(CP_ACP, 0, (LPCSTR)id->Password, id->PasswordLength, NULL, 0);
306 if (!(passwd = heap_alloc(passwd_sizeW * sizeof(SEC_WCHAR)))) goto done;
307 MultiByteToWideChar(CP_ACP, 0, (LPCSTR)id->Password, id->PasswordLength, passwd, passwd_sizeW);
308 }
309
310 pAuthDataW->Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;
311 pAuthDataW->User = user;
312 pAuthDataW->UserLength = user_sizeW;
313 pAuthDataW->Domain = domain;
314 pAuthDataW->DomainLength = domain_sizeW;
315 pAuthDataW->Password = passwd;
316 pAuthDataW->PasswordLength = passwd_sizeW;
317 }
318 else pAuthDataW = (PSEC_WINNT_AUTH_IDENTITY_W)id;
319 }
320
321 ret = ntlm_AcquireCredentialsHandleW(NULL, package, fCredentialUse,
322 pLogonID, pAuthDataW, pGetKeyFn, pGetKeyArgument, phCredential,
323 ptsExpiry);
324
325 done:
326 heap_free(package);
327 heap_free(user);
328 heap_free(domain);
329 heap_free(passwd);
330 if (pAuthDataW != (PSEC_WINNT_AUTH_IDENTITY_W)id) heap_free(pAuthDataW);
331
332 return ret;
333 }
334
335 /*************************************************************************
336 * ntlm_GetTokenBufferIndex
337 * Calculates the index of the secbuffer with BufferType == SECBUFFER_TOKEN
338 * Returns index if found or -1 if not found.
339 */
340 static int ntlm_GetTokenBufferIndex(PSecBufferDesc pMessage)
341 {
342 UINT i;
343
344 TRACE("%p\n", pMessage);
345
346 for( i = 0; i < pMessage->cBuffers; ++i )
347 {
348 if(pMessage->pBuffers[i].BufferType == SECBUFFER_TOKEN)
349 return i;
350 }
351
352 return -1;
353 }
354
355 /*************************************************************************
356 * ntlm_GetDataBufferIndex
357 * Calculates the index of the first secbuffer with BufferType == SECBUFFER_DATA
358 * Returns index if found or -1 if not found.
359 */
360 static int ntlm_GetDataBufferIndex(PSecBufferDesc pMessage)
361 {
362 UINT i;
363
364 TRACE("%p\n", pMessage);
365
366 for( i = 0; i < pMessage->cBuffers; ++i )
367 {
368 if(pMessage->pBuffers[i].BufferType == SECBUFFER_DATA)
369 return i;
370 }
371
372 return -1;
373 }
374
375 static BOOL ntlm_GetCachedCredential(const SEC_WCHAR *pszTargetName, PCREDENTIALW *cred)
376 {
377 LPCWSTR p;
378 LPCWSTR pszHost;
379 LPWSTR pszHostOnly;
380 BOOL ret;
381
382 if (!pszTargetName)
383 return FALSE;
384
385 /* try to get the start of the hostname from service principal name (SPN) */
386 pszHost = strchrW(pszTargetName, '/');
387 if (pszHost)
388 {
389 /* skip slash character */
390 pszHost++;
391
392 /* find end of host by detecting start of instance port or start of referrer */
393 p = strchrW(pszHost, ':');
394 if (!p)
395 p = strchrW(pszHost, '/');
396 if (!p)
397 p = pszHost + strlenW(pszHost);
398 }
399 else /* otherwise not an SPN, just a host */
400 {
401 pszHost = pszTargetName;
402 p = pszHost + strlenW(pszHost);
403 }
404
405 if (!(pszHostOnly = heap_alloc((p - pszHost + 1) * sizeof(WCHAR)))) return FALSE;
406 memcpy(pszHostOnly, pszHost, (p - pszHost) * sizeof(WCHAR));
407 pszHostOnly[p - pszHost] = '\0';
408
409 ret = CredReadW(pszHostOnly, CRED_TYPE_DOMAIN_PASSWORD, 0, cred);
410
411 heap_free(pszHostOnly);
412 return ret;
413 }
414
415 /***********************************************************************
416 * InitializeSecurityContextW
417 */
418 static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextW(
419 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR *pszTargetName,
420 ULONG fContextReq, ULONG Reserved1, ULONG TargetDataRep,
421 PSecBufferDesc pInput, ULONG Reserved2, PCtxtHandle phNewContext,
422 PSecBufferDesc pOutput, ULONG *pfContextAttr, PTimeStamp ptsExpiry)
423 {
424 SECURITY_STATUS ret;
425 PNtlmCredentials ntlm_cred;
426 PNegoHelper helper = NULL;
427 ULONG ctxt_attr = 0;
428 char* buffer, *want_flags = NULL;
429 PBYTE bin;
430 int buffer_len, bin_len, max_len = NTLM_MAX_BUF;
431 int token_idx;
432 SEC_CHAR *username = NULL;
433 SEC_CHAR *domain = NULL;
434 SEC_CHAR *password = NULL;
435
436 TRACE("%p %p %s 0x%08x %d %d %p %d %p %p %p %p\n", phCredential, phContext,
437 debugstr_w(pszTargetName), fContextReq, Reserved1, TargetDataRep, pInput,
438 Reserved1, phNewContext, pOutput, pfContextAttr, ptsExpiry);
439
440 /****************************************
441 * When communicating with the client, there can be the
442 * following reply packets:
443 * YR <base64 blob> should be sent to the server
444 * PW should be sent back to helper with
445 * base64 encoded password
446 * AF <base64 blob> client is done, blob should be
447 * sent to server with KK prefixed
448 * GF <string list> A string list of negotiated flags
449 * GK <base64 blob> base64 encoded session key
450 * BH <char reason> something broke
451 */
452 /* The squid cache size is 2010 chars, and that's what ntlm_auth uses */
453
454 if(TargetDataRep == SECURITY_NETWORK_DREP){
455 TRACE("Setting SECURITY_NETWORK_DREP\n");
456 }
457
458 buffer = heap_alloc(sizeof(char) * NTLM_MAX_BUF);
459 bin = heap_alloc(sizeof(BYTE) * NTLM_MAX_BUF);
460
461 if((phContext == NULL) && (pInput == NULL))
462 {
463 static char helper_protocol[] = "--helper-protocol=ntlmssp-client-1";
464 static CHAR credentials_argv[] = "--use-cached-creds";
465 SEC_CHAR *client_argv[5];
466 int pwlen = 0;
467
468 TRACE("First time in ISC()\n");
469
470 if(!phCredential)
471 {
472 ret = SEC_E_INVALID_HANDLE;
473 goto isc_end;
474 }
475
476 /* As the server side of sspi never calls this, make sure that
477 * the handler is a client handler.
478 */
479 ntlm_cred = (PNtlmCredentials)phCredential->dwLower;
480 if(ntlm_cred->mode != NTLM_CLIENT)
481 {
482 TRACE("Cred mode = %d\n", ntlm_cred->mode);
483 ret = SEC_E_INVALID_HANDLE;
484 goto isc_end;
485 }
486
487 client_argv[0] = ntlm_auth;
488 client_argv[1] = helper_protocol;
489 if (!ntlm_cred->username_arg && !ntlm_cred->domain_arg)
490 {
491 LPWKSTA_USER_INFO_1 ui = NULL;
492 NET_API_STATUS status;
493 PCREDENTIALW cred;
494
495 if (ntlm_GetCachedCredential(pszTargetName, &cred))
496 {
497 LPWSTR p;
498 p = strchrW(cred->UserName, '\\');
499 if (p)
500 {
501 domain = ntlm_GetDomainArg(cred->UserName, p - cred->UserName);
502 p++;
503 }
504 else
505 {
506 domain = ntlm_GetDomainArg(NULL, 0);
507 p = cred->UserName;
508 }
509
510 username = ntlm_GetUsernameArg(p, -1);
511
512 if(cred->CredentialBlobSize != 0)
513 {
514 pwlen = WideCharToMultiByte(CP_UNIXCP,
515 WC_NO_BEST_FIT_CHARS, (LPWSTR)cred->CredentialBlob,
516 cred->CredentialBlobSize / sizeof(WCHAR), NULL, 0,
517 NULL, NULL);
518
519 password = heap_alloc(pwlen);
520 WideCharToMultiByte(CP_UNIXCP, WC_NO_BEST_FIT_CHARS,
521 (LPWSTR)cred->CredentialBlob,
522 cred->CredentialBlobSize / sizeof(WCHAR),
523 password, pwlen, NULL, NULL);
524 }
525
526 CredFree(cred);
527
528 client_argv[2] = username;
529 client_argv[3] = domain;
530 client_argv[4] = NULL;
531 }
532 else
533 {
534 status = NetWkstaUserGetInfo(NULL, 1, (LPBYTE *)&ui);
535 if (status != NERR_Success || ui == NULL || ntlm_cred->no_cached_credentials)
536 {
537 ret = SEC_E_NO_CREDENTIALS;
538 goto isc_end;
539 }
540 username = ntlm_GetUsernameArg(ui->wkui1_username, -1);
541 NetApiBufferFree(ui);
542
543 TRACE("using cached credentials\n");
544
545 client_argv[2] = username;
546 client_argv[3] = credentials_argv;
547 client_argv[4] = NULL;
548 }
549 }
550 else
551 {
552 client_argv[2] = ntlm_cred->username_arg;
553 client_argv[3] = ntlm_cred->domain_arg;
554 client_argv[4] = NULL;
555 }
556
557 if((ret = fork_helper(&helper, ntlm_auth, client_argv)) != SEC_E_OK)
558 goto isc_end;
559
560 helper->mode = NTLM_CLIENT;
561 helper->session_key = heap_alloc(16);
562 if (!helper->session_key)
563 {
564 cleanup_helper(helper);
565 ret = SEC_E_INSUFFICIENT_MEMORY;
566 goto isc_end;
567 }
568
569 /* Generate the dummy session key = MD4(MD4(password))*/
570 if(password || ntlm_cred->password)
571 {
572 SEC_WCHAR *unicode_password;
573 int passwd_lenW;
574
575 TRACE("Converting password to unicode.\n");
576 passwd_lenW = MultiByteToWideChar(CP_ACP, 0,
577 password ? password : ntlm_cred->password,
578 password ? pwlen : ntlm_cred->pwlen,
579 NULL, 0);
580 unicode_password = heap_alloc(passwd_lenW * sizeof(SEC_WCHAR));
581 MultiByteToWideChar(CP_ACP, 0, password ? password : ntlm_cred->password,
582 password ? pwlen : ntlm_cred->pwlen, unicode_password, passwd_lenW);
583
584 SECUR32_CreateNTLM1SessionKey((PBYTE)unicode_password,
585 passwd_lenW * sizeof(SEC_WCHAR), helper->session_key);
586 heap_free(unicode_password);
587 }
588 else
589 memset(helper->session_key, 0, 16);
590
591 /* Allocate space for a maximal string of
592 * "SF NTLMSSP_FEATURE_SIGN NTLMSSP_FEATURE_SEAL
593 * NTLMSSP_FEATURE_SESSION_KEY"
594 */
595 if (!(want_flags = heap_alloc(73)))
596 {
597 cleanup_helper(helper);
598 ret = SEC_E_INSUFFICIENT_MEMORY;
599 goto isc_end;
600 }
601 lstrcpyA(want_flags, "SF");
602 if(fContextReq & ISC_REQ_CONFIDENTIALITY)
603 {
604 if(strstr(want_flags, "NTLMSSP_FEATURE_SEAL") == NULL)
605 lstrcatA(want_flags, " NTLMSSP_FEATURE_SEAL");
606 }
607 if(fContextReq & ISC_REQ_CONNECTION)
608 ctxt_attr |= ISC_RET_CONNECTION;
609 if(fContextReq & ISC_REQ_EXTENDED_ERROR)
610 ctxt_attr |= ISC_RET_EXTENDED_ERROR;
611 if(fContextReq & ISC_REQ_INTEGRITY)
612 {
613 if(strstr(want_flags, "NTLMSSP_FEATURE_SIGN") == NULL)
614 lstrcatA(want_flags, " NTLMSSP_FEATURE_SIGN");
615 }
616 if(fContextReq & ISC_REQ_MUTUAL_AUTH)
617 ctxt_attr |= ISC_RET_MUTUAL_AUTH;
618 if(fContextReq & ISC_REQ_REPLAY_DETECT)
619 {
620 if(strstr(want_flags, "NTLMSSP_FEATURE_SIGN") == NULL)
621 lstrcatA(want_flags, " NTLMSSP_FEATURE_SIGN");
622 }
623 if(fContextReq & ISC_REQ_SEQUENCE_DETECT)
624 {
625 if(strstr(want_flags, "NTLMSSP_FEATURE_SIGN") == NULL)
626 lstrcatA(want_flags, " NTLMSSP_FEATURE_SIGN");
627 }
628 if(fContextReq & ISC_REQ_STREAM)
629 FIXME("ISC_REQ_STREAM\n");
630 if(fContextReq & ISC_REQ_USE_DCE_STYLE)
631 ctxt_attr |= ISC_RET_USED_DCE_STYLE;
632 if(fContextReq & ISC_REQ_DELEGATE)
633 ctxt_attr |= ISC_RET_DELEGATE;
634
635 /* If no password is given, try to use cached credentials. Fall back to an empty
636 * password if this failed. */
637 if(!password && !ntlm_cred->password)
638 {
639 lstrcpynA(buffer, "OK", max_len-1);
640 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) != SEC_E_OK)
641 {
642 cleanup_helper(helper);
643 goto isc_end;
644 }
645 /* If the helper replied with "PW", using cached credentials failed */
646 if(!strncmp(buffer, "PW", 2))
647 {
648 TRACE("Using cached credentials failed.\n");
649 lstrcpynA(buffer, "PW AA==", max_len-1);
650 }
651 else /* Just do a noop on the next run */
652 lstrcpynA(buffer, "OK", max_len-1);
653 }
654 else
655 {
656 lstrcpynA(buffer, "PW ", max_len-1);
657 if((ret = encodeBase64(password ? (unsigned char *)password : (unsigned char *)ntlm_cred->password,
658 password ? pwlen : ntlm_cred->pwlen, buffer+3,
659 max_len-3, &buffer_len)) != SEC_E_OK)
660 {
661 cleanup_helper(helper);
662 goto isc_end;
663 }
664
665 }
666
667 TRACE("Sending to helper: %s\n", debugstr_a(buffer));
668 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) != SEC_E_OK)
669 {
670 cleanup_helper(helper);
671 goto isc_end;
672 }
673
674 TRACE("Helper returned %s\n", debugstr_a(buffer));
675
676 if(lstrlenA(want_flags) > 2)
677 {
678 TRACE("Want flags are %s\n", debugstr_a(want_flags));
679 lstrcpynA(buffer, want_flags, max_len-1);
680 if((ret = run_helper(helper, buffer, max_len, &buffer_len))
681 != SEC_E_OK)
682 {
683 cleanup_helper(helper);
684 goto isc_end;
685 }
686 if(!strncmp(buffer, "BH", 2))
687 ERR("Helper doesn't understand new command set. Expect more things to fail.\n");
688 }
689
690 lstrcpynA(buffer, "YR", max_len-1);
691
692 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) != SEC_E_OK)
693 {
694 cleanup_helper(helper);
695 goto isc_end;
696 }
697
698 TRACE("%s\n", buffer);
699
700 if(strncmp(buffer, "YR ", 3) != 0)
701 {
702 /* Something borked */
703 TRACE("Helper returned %c%c\n", buffer[0], buffer[1]);
704 ret = SEC_E_INTERNAL_ERROR;
705 cleanup_helper(helper);
706 goto isc_end;
707 }
708 if((ret = decodeBase64(buffer+3, buffer_len-3, bin,
709 max_len-1, &bin_len)) != SEC_E_OK)
710 {
711 cleanup_helper(helper);
712 goto isc_end;
713 }
714
715 /* put the decoded client blob into the out buffer */
716
717 phNewContext->dwUpper = ctxt_attr;
718 phNewContext->dwLower = (ULONG_PTR)helper;
719
720 ret = SEC_I_CONTINUE_NEEDED;
721 }
722 else
723 {
724 int input_token_idx;
725
726 /* handle second call here */
727 /* encode server data to base64 */
728 if (!pInput || ((input_token_idx = ntlm_GetTokenBufferIndex(pInput)) == -1))
729 {
730 ret = SEC_E_INVALID_TOKEN;
731 goto isc_end;
732 }
733
734 if(!phContext)
735 {
736 ret = SEC_E_INVALID_HANDLE;
737 goto isc_end;
738 }
739
740 /* As the server side of sspi never calls this, make sure that
741 * the handler is a client handler.
742 */
743 helper = (PNegoHelper)phContext->dwLower;
744 if(helper->mode != NTLM_CLIENT)
745 {
746 TRACE("Helper mode = %d\n", helper->mode);
747 ret = SEC_E_INVALID_HANDLE;
748 goto isc_end;
749 }
750
751 if (!pInput->pBuffers[input_token_idx].pvBuffer)
752 {
753 ret = SEC_E_INTERNAL_ERROR;
754 goto isc_end;
755 }
756
757 if(pInput->pBuffers[input_token_idx].cbBuffer > max_len)
758 {
759 TRACE("pInput->pBuffers[%d].cbBuffer is: %d\n",
760 input_token_idx,
761 pInput->pBuffers[input_token_idx].cbBuffer);
762 ret = SEC_E_INVALID_TOKEN;
763 goto isc_end;
764 }
765 else
766 bin_len = pInput->pBuffers[input_token_idx].cbBuffer;
767
768 memcpy(bin, pInput->pBuffers[input_token_idx].pvBuffer, bin_len);
769
770 lstrcpynA(buffer, "TT ", max_len-1);
771
772 if((ret = encodeBase64(bin, bin_len, buffer+3,
773 max_len-3, &buffer_len)) != SEC_E_OK)
774 goto isc_end;
775
776 TRACE("Server sent: %s\n", debugstr_a(buffer));
777
778 /* send TT base64 blob to ntlm_auth */
779 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) != SEC_E_OK)
780 goto isc_end;
781
782 TRACE("Helper replied: %s\n", debugstr_a(buffer));
783
784 if( (strncmp(buffer, "KK ", 3) != 0) &&
785 (strncmp(buffer, "AF ", 3) !=0))
786 {
787 TRACE("Helper returned %c%c\n", buffer[0], buffer[1]);
788 ret = SEC_E_INVALID_TOKEN;
789 goto isc_end;
790 }
791
792 /* decode the blob and send it to server */
793 if((ret = decodeBase64(buffer+3, buffer_len-3, bin, max_len,
794 &bin_len)) != SEC_E_OK)
795 {
796 goto isc_end;
797 }
798
799 phNewContext->dwUpper = ctxt_attr;
800 phNewContext->dwLower = (ULONG_PTR)helper;
801
802 ret = SEC_E_OK;
803 }
804
805 /* put the decoded client blob into the out buffer */
806
807 if (!pOutput || ((token_idx = ntlm_GetTokenBufferIndex(pOutput)) == -1))
808 {
809 TRACE("no SECBUFFER_TOKEN buffer could be found\n");
810 ret = SEC_E_BUFFER_TOO_SMALL;
811 if ((phContext == NULL) && (pInput == NULL))
812 {
813 cleanup_helper(helper);
814 phNewContext->dwUpper = 0;
815 phNewContext->dwLower = 0;
816 }
817 goto isc_end;
818 }
819
820 if (fContextReq & ISC_REQ_ALLOCATE_MEMORY)
821 {
822 pOutput->pBuffers[token_idx].pvBuffer = heap_alloc(bin_len);
823 pOutput->pBuffers[token_idx].cbBuffer = bin_len;
824 }
825 else if (pOutput->pBuffers[token_idx].cbBuffer < bin_len)
826 {
827 TRACE("out buffer is NULL or has not enough space\n");
828 ret = SEC_E_BUFFER_TOO_SMALL;
829 if ((phContext == NULL) && (pInput == NULL))
830 {
831 cleanup_helper(helper);
832 phNewContext->dwUpper = 0;
833 phNewContext->dwLower = 0;
834 }
835 goto isc_end;
836 }
837
838 if (!pOutput->pBuffers[token_idx].pvBuffer)
839 {
840 TRACE("out buffer is NULL\n");
841 ret = SEC_E_INTERNAL_ERROR;
842 if ((phContext == NULL) && (pInput == NULL))
843 {
844 cleanup_helper(helper);
845 phNewContext->dwUpper = 0;
846 phNewContext->dwLower = 0;
847 }
848 goto isc_end;
849 }
850
851 pOutput->pBuffers[token_idx].cbBuffer = bin_len;
852 memcpy(pOutput->pBuffers[token_idx].pvBuffer, bin, bin_len);
853
854 if(ret == SEC_E_OK)
855 {
856 TRACE("Getting negotiated flags\n");
857 lstrcpynA(buffer, "GF", max_len - 1);
858 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) != SEC_E_OK)
859 goto isc_end;
860
861 if(buffer_len < 3)
862 {
863 TRACE("No flags negotiated.\n");
864 helper->neg_flags = 0l;
865 }
866 else
867 {
868 TRACE("Negotiated %s\n", debugstr_a(buffer));
869 sscanf(buffer + 3, "%x", &(helper->neg_flags));
870 TRACE("Stored 0x%08x as flags\n", helper->neg_flags);
871 }
872
873 TRACE("Getting session key\n");
874 lstrcpynA(buffer, "GK", max_len - 1);
875 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) != SEC_E_OK)
876 goto isc_end;
877
878 if(strncmp(buffer, "BH", 2) == 0)
879 TRACE("No key negotiated.\n");
880 else if(strncmp(buffer, "GK ", 3) == 0)
881 {
882 if((ret = decodeBase64(buffer+3, buffer_len-3, bin, max_len,
883 &bin_len)) != SEC_E_OK)
884 {
885 TRACE("Failed to decode session key\n");
886 }
887 TRACE("Session key is %s\n", debugstr_a(buffer+3));
888 heap_free(helper->session_key);
889 if (!(helper->session_key = heap_alloc(bin_len)))
890 {
891 ret = SEC_E_INSUFFICIENT_MEMORY;
892 goto isc_end;
893 }
894 memcpy(helper->session_key, bin, bin_len);
895 }
896
897 helper->crypt.ntlm.a4i = SECUR32_arc4Alloc();
898 SECUR32_arc4Init(helper->crypt.ntlm.a4i, helper->session_key, 16);
899 helper->crypt.ntlm.seq_num = 0l;
900 SECUR32_CreateNTLM2SubKeys(helper);
901 helper->crypt.ntlm2.send_a4i = SECUR32_arc4Alloc();
902 helper->crypt.ntlm2.recv_a4i = SECUR32_arc4Alloc();
903 SECUR32_arc4Init(helper->crypt.ntlm2.send_a4i,
904 helper->crypt.ntlm2.send_seal_key, 16);
905 SECUR32_arc4Init(helper->crypt.ntlm2.recv_a4i,
906 helper->crypt.ntlm2.recv_seal_key, 16);
907 helper->crypt.ntlm2.send_seq_no = 0l;
908 helper->crypt.ntlm2.recv_seq_no = 0l;
909 }
910
911 isc_end:
912 heap_free(username);
913 heap_free(domain);
914 heap_free(password);
915 heap_free(want_flags);
916 heap_free(buffer);
917 heap_free(bin);
918 return ret;
919 }
920
921 /***********************************************************************
922 * InitializeSecurityContextA
923 */
924 static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextA(
925 PCredHandle phCredential, PCtxtHandle phContext, SEC_CHAR *pszTargetName,
926 ULONG fContextReq, ULONG Reserved1, ULONG TargetDataRep,
927 PSecBufferDesc pInput,ULONG Reserved2, PCtxtHandle phNewContext,
928 PSecBufferDesc pOutput, ULONG *pfContextAttr, PTimeStamp ptsExpiry)
929 {
930 SECURITY_STATUS ret;
931 SEC_WCHAR *target = NULL;
932
933 TRACE("%p %p %s %d %d %d %p %d %p %p %p %p\n", phCredential, phContext,
934 debugstr_a(pszTargetName), fContextReq, Reserved1, TargetDataRep, pInput,
935 Reserved1, phNewContext, pOutput, pfContextAttr, ptsExpiry);
936
937 if (pszTargetName)
938 {
939 int target_size = MultiByteToWideChar(CP_ACP, 0, pszTargetName, -1, NULL, 0);
940 if (!(target = heap_alloc(target_size * sizeof(SEC_WCHAR)))) return SEC_E_INSUFFICIENT_MEMORY;
941 MultiByteToWideChar(CP_ACP, 0, pszTargetName, -1, target, target_size);
942 }
943
944 ret = ntlm_InitializeSecurityContextW(phCredential, phContext, target,
945 fContextReq, Reserved1, TargetDataRep, pInput, Reserved2,
946 phNewContext, pOutput, pfContextAttr, ptsExpiry);
947
948 heap_free(target);
949 return ret;
950 }
951
952 /***********************************************************************
953 * AcceptSecurityContext
954 */
955 static SECURITY_STATUS SEC_ENTRY ntlm_AcceptSecurityContext(
956 PCredHandle phCredential, PCtxtHandle phContext, PSecBufferDesc pInput,
957 ULONG fContextReq, ULONG TargetDataRep, PCtxtHandle phNewContext,
958 PSecBufferDesc pOutput, ULONG *pfContextAttr, PTimeStamp ptsExpiry)
959 {
960 SECURITY_STATUS ret;
961 char *buffer, *want_flags = NULL;
962 PBYTE bin;
963 int buffer_len, bin_len, max_len = NTLM_MAX_BUF;
964 ULONG ctxt_attr = 0;
965 PNegoHelper helper;
966 PNtlmCredentials ntlm_cred;
967
968 TRACE("%p %p %p %d %d %p %p %p %p\n", phCredential, phContext, pInput,
969 fContextReq, TargetDataRep, phNewContext, pOutput, pfContextAttr,
970 ptsExpiry);
971
972 buffer = heap_alloc(sizeof(char) * NTLM_MAX_BUF);
973 bin = heap_alloc(sizeof(BYTE) * NTLM_MAX_BUF);
974
975 if(TargetDataRep == SECURITY_NETWORK_DREP){
976 TRACE("Using SECURITY_NETWORK_DREP\n");
977 }
978
979 if(phContext == NULL)
980 {
981 static CHAR server_helper_protocol[] = "--helper-protocol=squid-2.5-ntlmssp";
982 SEC_CHAR *server_argv[] = { ntlm_auth,
983 server_helper_protocol,
984 NULL };
985
986 if (!phCredential)
987 {
988 ret = SEC_E_INVALID_HANDLE;
989 goto asc_end;
990 }
991
992 ntlm_cred = (PNtlmCredentials)phCredential->dwLower;
993
994 if(ntlm_cred->mode != NTLM_SERVER)
995 {
996 ret = SEC_E_INVALID_HANDLE;
997 goto asc_end;
998 }
999
1000 /* This is the first call to AcceptSecurityHandle */
1001 if(pInput == NULL)
1002 {
1003 ret = SEC_E_INCOMPLETE_MESSAGE;
1004 goto asc_end;
1005 }
1006
1007 if(pInput->cBuffers < 1)
1008 {
1009 ret = SEC_E_INCOMPLETE_MESSAGE;
1010 goto asc_end;
1011 }
1012
1013 if(pInput->pBuffers[0].cbBuffer > max_len)
1014 {
1015 ret = SEC_E_INVALID_TOKEN;
1016 goto asc_end;
1017 }
1018 else
1019 bin_len = pInput->pBuffers[0].cbBuffer;
1020
1021 if( (ret = fork_helper(&helper, ntlm_auth, server_argv)) !=
1022 SEC_E_OK)
1023 {
1024 ret = SEC_E_INTERNAL_ERROR;
1025 goto asc_end;
1026 }
1027 helper->mode = NTLM_SERVER;
1028
1029 /* Handle all the flags */
1030 if (!(want_flags = heap_alloc(73)))
1031 {
1032 TRACE("Failed to allocate memory for the want_flags!\n");
1033 ret = SEC_E_INSUFFICIENT_MEMORY;
1034 cleanup_helper(helper);
1035 goto asc_end;
1036 }
1037 lstrcpyA(want_flags, "SF");
1038 if(fContextReq & ASC_REQ_ALLOCATE_MEMORY)
1039 {
1040 FIXME("ASC_REQ_ALLOCATE_MEMORY stub\n");
1041 }
1042 if(fContextReq & ASC_REQ_CONFIDENTIALITY)
1043 {
1044 lstrcatA(want_flags, " NTLMSSP_FEATURE_SEAL");
1045 }
1046 if(fContextReq & ASC_REQ_CONNECTION)
1047 {
1048 /* This is default, so we'll enable it */
1049 lstrcatA(want_flags, " NTLMSSP_FEATURE_SESSION_KEY");
1050 ctxt_attr |= ASC_RET_CONNECTION;
1051 }
1052 if(fContextReq & ASC_REQ_EXTENDED_ERROR)
1053 {
1054 FIXME("ASC_REQ_EXTENDED_ERROR stub\n");
1055 }
1056 if(fContextReq & ASC_REQ_INTEGRITY)
1057 {
1058 lstrcatA(want_flags, " NTLMSSP_FEATURE_SIGN");
1059 }
1060 if(fContextReq & ASC_REQ_MUTUAL_AUTH)
1061 {
1062 FIXME("ASC_REQ_MUTUAL_AUTH stub\n");
1063 }
1064 if(fContextReq & ASC_REQ_REPLAY_DETECT)
1065 {
1066 FIXME("ASC_REQ_REPLAY_DETECT stub\n");
1067 }
1068 if(fContextReq & ISC_REQ_SEQUENCE_DETECT)
1069 {
1070 FIXME("ASC_REQ_SEQUENCE_DETECT stub\n");
1071 }
1072 if(fContextReq & ISC_REQ_STREAM)
1073 {
1074 FIXME("ASC_REQ_STREAM stub\n");
1075 }
1076 /* Done with the flags */
1077
1078 if(lstrlenA(want_flags) > 3)
1079 {
1080 TRACE("Server set want_flags: %s\n", debugstr_a(want_flags));
1081 lstrcpynA(buffer, want_flags, max_len - 1);
1082 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) !=
1083 SEC_E_OK)
1084 {
1085 cleanup_helper(helper);
1086 goto asc_end;
1087 }
1088 if(!strncmp(buffer, "BH", 2))
1089 TRACE("Helper doesn't understand new command set\n");
1090 }
1091
1092 /* This is the YR request from the client, encode to base64 */
1093
1094 memcpy(bin, pInput->pBuffers[0].pvBuffer, bin_len);
1095
1096 lstrcpynA(buffer, "YR ", max_len-1);
1097
1098 if((ret = encodeBase64(bin, bin_len, buffer+3, max_len-3,
1099 &buffer_len)) != SEC_E_OK)
1100 {
1101 cleanup_helper(helper);
1102 goto asc_end;
1103 }
1104
1105 TRACE("Client sent: %s\n", debugstr_a(buffer));
1106
1107 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) !=
1108 SEC_E_OK)
1109 {
1110 cleanup_helper(helper);
1111 goto asc_end;
1112 }
1113
1114 TRACE("Reply from ntlm_auth: %s\n", debugstr_a(buffer));
1115 /* The expected answer is TT <base64 blob> */
1116
1117 if(strncmp(buffer, "TT ", 3) != 0)
1118 {
1119 ret = SEC_E_INTERNAL_ERROR;
1120 cleanup_helper(helper);
1121 goto asc_end;
1122 }
1123
1124 if((ret = decodeBase64(buffer+3, buffer_len-3, bin, max_len,
1125 &bin_len)) != SEC_E_OK)
1126 {
1127 cleanup_helper(helper);
1128 goto asc_end;
1129 }
1130
1131 /* send this to the client */
1132 if(pOutput == NULL)
1133 {
1134 ret = SEC_E_INSUFFICIENT_MEMORY;
1135 cleanup_helper(helper);
1136 goto asc_end;
1137 }
1138
1139 if(pOutput->cBuffers < 1)
1140 {
1141 ret = SEC_E_INSUFFICIENT_MEMORY;
1142 cleanup_helper(helper);
1143 goto asc_end;
1144 }
1145
1146 pOutput->pBuffers[0].cbBuffer = bin_len;
1147 pOutput->pBuffers[0].BufferType = SECBUFFER_DATA;
1148 memcpy(pOutput->pBuffers[0].pvBuffer, bin, bin_len);
1149 ret = SEC_I_CONTINUE_NEEDED;
1150
1151 }
1152 else
1153 {
1154 /* we expect a KK request from client */
1155 if(pInput == NULL)
1156 {
1157 ret = SEC_E_INCOMPLETE_MESSAGE;
1158 goto asc_end;
1159 }
1160
1161 if(pInput->cBuffers < 1)
1162 {
1163 ret = SEC_E_INCOMPLETE_MESSAGE;
1164 goto asc_end;
1165 }
1166
1167 helper = (PNegoHelper)phContext->dwLower;
1168
1169 if(helper->mode != NTLM_SERVER)
1170 {
1171 ret = SEC_E_INVALID_HANDLE;
1172 goto asc_end;
1173 }
1174
1175 if(pInput->pBuffers[0].cbBuffer > max_len)
1176 {
1177 ret = SEC_E_INVALID_TOKEN;
1178 goto asc_end;
1179 }
1180 else
1181 bin_len = pInput->pBuffers[0].cbBuffer;
1182
1183 memcpy(bin, pInput->pBuffers[0].pvBuffer, bin_len);
1184
1185 lstrcpynA(buffer, "KK ", max_len-1);
1186
1187 if((ret = encodeBase64(bin, bin_len, buffer+3, max_len-3,
1188 &buffer_len)) != SEC_E_OK)
1189 {
1190 goto asc_end;
1191 }
1192
1193 TRACE("Client sent: %s\n", debugstr_a(buffer));
1194
1195 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) !=
1196 SEC_E_OK)
1197 {
1198 goto asc_end;
1199 }
1200
1201 TRACE("Reply from ntlm_auth: %s\n", debugstr_a(buffer));
1202
1203 /* At this point, we get a NA if the user didn't authenticate, but a BH
1204 * if ntlm_auth could not connect to winbindd. Apart from running Wine
1205 * as root, there is no way to fix this for now, so just handle this as
1206 * a failed login. */
1207 if(strncmp(buffer, "AF ", 3) != 0)
1208 {
1209 if(strncmp(buffer, "NA ", 3) == 0)
1210 {
1211 ret = SEC_E_LOGON_DENIED;
1212 goto asc_end;
1213 }
1214 else
1215 {
1216 size_t ntlm_pipe_err_v3_len = strlen("BH NT_STATUS_ACCESS_DENIED");
1217 size_t ntlm_pipe_err_v4_len = strlen("BH NT_STATUS_UNSUCCESSFUL");
1218
1219 if( (buffer_len >= ntlm_pipe_err_v3_len &&
1220 strncmp(buffer, "BH NT_STATUS_ACCESS_DENIED", ntlm_pipe_err_v3_len) == 0) ||
1221 (buffer_len >= ntlm_pipe_err_v4_len &&
1222 strncmp(buffer, "BH NT_STATUS_UNSUCCESSFUL", ntlm_pipe_err_v4_len) == 0) )
1223 {
1224 TRACE("Connection to winbindd failed\n");
1225 ret = SEC_E_LOGON_DENIED;
1226 }
1227 else
1228 ret = SEC_E_INTERNAL_ERROR;
1229
1230 goto asc_end;
1231 }
1232 }
1233 pOutput->pBuffers[0].cbBuffer = 0;
1234
1235 TRACE("Getting negotiated flags\n");
1236 lstrcpynA(buffer, "GF", max_len - 1);
1237 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) != SEC_E_OK)
1238 goto asc_end;
1239
1240 if(buffer_len < 3)
1241 {
1242 TRACE("No flags negotiated, or helper does not support GF command\n");
1243 }
1244 else
1245 {
1246 TRACE("Negotiated %s\n", debugstr_a(buffer));
1247 sscanf(buffer + 3, "%x", &(helper->neg_flags));
1248 TRACE("Stored 0x%08x as flags\n", helper->neg_flags);
1249 }
1250
1251 TRACE("Getting session key\n");
1252 lstrcpynA(buffer, "GK", max_len - 1);
1253 if((ret = run_helper(helper, buffer, max_len, &buffer_len)) != SEC_E_OK)
1254 goto asc_end;
1255
1256 if(buffer_len < 3)
1257 TRACE("Helper does not support GK command\n");
1258 else
1259 {
1260 if(strncmp(buffer, "BH ", 3) == 0)
1261 {
1262 TRACE("Helper sent %s\n", debugstr_a(buffer+3));
1263 heap_free(helper->session_key);
1264 if (!(helper->session_key = heap_alloc(16)))
1265 {
1266 ret = SEC_E_INSUFFICIENT_MEMORY;
1267 goto asc_end;
1268 }
1269 /*FIXME: Generate the dummy session key = MD4(MD4(password))*/
1270 memset(helper->session_key, 0 , 16);
1271 }
1272 else if(strncmp(buffer, "GK ", 3) == 0)
1273 {
1274 if((ret = decodeBase64(buffer+3, buffer_len-3, bin, max_len,
1275 &bin_len)) != SEC_E_OK)
1276 {
1277 TRACE("Failed to decode session key\n");
1278 }
1279 TRACE("Session key is %s\n", debugstr_a(buffer+3));
1280 heap_free(helper->session_key);
1281 if (!(helper->session_key = heap_alloc(16)))
1282 {
1283 ret = SEC_E_INSUFFICIENT_MEMORY;
1284 goto asc_end;
1285 }
1286 memcpy(helper->session_key, bin, 16);
1287 }
1288 }
1289 helper->crypt.ntlm.a4i = SECUR32_arc4Alloc();
1290 SECUR32_arc4Init(helper->crypt.ntlm.a4i, helper->session_key, 16);
1291 helper->crypt.ntlm.seq_num = 0l;
1292 }
1293
1294 phNewContext->dwUpper = ctxt_attr;
1295 phNewContext->dwLower = (ULONG_PTR)helper;
1296
1297 asc_end:
1298 heap_free(want_flags);
1299 heap_free(buffer);
1300 heap_free(bin);
1301 return ret;
1302 }
1303
1304 /***********************************************************************
1305 * CompleteAuthToken
1306 */
1307 static SECURITY_STATUS SEC_ENTRY ntlm_CompleteAuthToken(PCtxtHandle phContext,
1308 PSecBufferDesc pToken)
1309 {
1310 /* We never need to call CompleteAuthToken anyway */
1311 TRACE("%p %p\n", phContext, pToken);
1312 if (!phContext)
1313 return SEC_E_INVALID_HANDLE;
1314
1315 return SEC_E_OK;
1316 }
1317
1318 /***********************************************************************
1319 * DeleteSecurityContext
1320 */
1321 static SECURITY_STATUS SEC_ENTRY ntlm_DeleteSecurityContext(PCtxtHandle phContext)
1322 {
1323 PNegoHelper helper;
1324
1325 TRACE("%p\n", phContext);
1326 if (!phContext)
1327 return SEC_E_INVALID_HANDLE;
1328
1329 helper = (PNegoHelper)phContext->dwLower;
1330
1331 phContext->dwUpper = 0;
1332 phContext->dwLower = 0;
1333
1334 SECUR32_arc4Cleanup(helper->crypt.ntlm.a4i);
1335 SECUR32_arc4Cleanup(helper->crypt.ntlm2.send_a4i);
1336 SECUR32_arc4Cleanup(helper->crypt.ntlm2.recv_a4i);
1337 heap_free(helper->crypt.ntlm2.send_sign_key);
1338 heap_free(helper->crypt.ntlm2.send_seal_key);
1339 heap_free(helper->crypt.ntlm2.recv_sign_key);
1340 heap_free(helper->crypt.ntlm2.recv_seal_key);
1341
1342 cleanup_helper(helper);
1343
1344 return SEC_E_OK;
1345 }
1346
1347 #define NTLM_COMMENT \
1348 { 'N', 'T', 'L', 'M', ' ', \
1349 'S', 'e', 'c', 'u', 'r', 'i', 't', 'y', ' ', \
1350 'P', 'a', 'c', 'k', 'a', 'g', 'e', 0}
1351
1352 static CHAR ntlm_comment_A[] = NTLM_COMMENT;
1353 static WCHAR ntlm_comment_W[] = NTLM_COMMENT;
1354
1355 #define NTLM_NAME {'N', 'T', 'L', 'M', 0}
1356
1357 static char ntlm_name_A[] = NTLM_NAME;
1358 static WCHAR ntlm_name_W[] = NTLM_NAME;
1359
1360 #define NTLM_CAPS ( \
1361 SECPKG_FLAG_INTEGRITY | \
1362 SECPKG_FLAG_PRIVACY | \
1363 SECPKG_FLAG_TOKEN_ONLY | \
1364 SECPKG_FLAG_CONNECTION | \
1365 SECPKG_FLAG_MULTI_REQUIRED | \
1366 SECPKG_FLAG_IMPERSONATION | \
1367 SECPKG_FLAG_ACCEPT_WIN32_NAME | \
1368 SECPKG_FLAG_NEGOTIABLE | \
1369 SECPKG_FLAG_LOGON | \
1370 SECPKG_FLAG_RESTRICTED_TOKENS )
1371
1372 static const SecPkgInfoW infoW = {
1373 NTLM_CAPS,
1374 1,
1375 RPC_C_AUTHN_WINNT,
1376 NTLM_MAX_BUF,
1377 ntlm_name_W,
1378 ntlm_comment_W
1379 };
1380
1381 static const SecPkgInfoA infoA = {
1382 NTLM_CAPS,
1383 1,
1384 RPC_C_AUTHN_WINNT,
1385 NTLM_MAX_BUF,
1386 ntlm_name_A,
1387 ntlm_comment_A
1388 };
1389
1390 static SecPkgInfoA *ntlm_package_infoA = (SecPkgInfoA *)&infoA;
1391 static SecPkgInfoW *ntlm_package_infoW = (SecPkgInfoW *)&infoW;
1392
1393 static SecPkgInfoW *build_package_infoW( const SecPkgInfoW *info )
1394 {
1395 SecPkgInfoW *ret;
1396 DWORD size_name = (strlenW(info->Name) + 1) * sizeof(WCHAR);
1397 DWORD size_comment = (strlenW(info->Comment) + 1) * sizeof(WCHAR);
1398
1399 if (!(ret = heap_alloc( sizeof(*ret) + size_name + size_comment ))) return NULL;
1400 ret->fCapabilities = info->fCapabilities;
1401 ret->wVersion = info->wVersion;
1402 ret->wRPCID = info->wRPCID;
1403 ret->cbMaxToken = info->cbMaxToken;
1404 ret->Name = (SEC_WCHAR *)(ret + 1);
1405 memcpy( ret->Name, info->Name, size_name );
1406 ret->Comment = (SEC_WCHAR *)((char *)ret->Name + size_name);
1407 memcpy( ret->Comment, info->Comment, size_comment );
1408 return ret;
1409 }
1410
1411 static SecPkgInfoA *build_package_infoA( const SecPkgInfoA *info )
1412 {
1413 SecPkgInfoA *ret;
1414 DWORD size_name = strlen(info->Name) + 1, size_comment = strlen(info->Comment) + 1;
1415
1416 if (!(ret = heap_alloc( sizeof(*ret) + size_name + size_comment ))) return NULL;
1417 ret->fCapabilities = info->fCapabilities;
1418 ret->wVersion = info->wVersion;
1419 ret->wRPCID = info->wRPCID;
1420 ret->cbMaxToken = info->cbMaxToken;
1421 ret->Name = (SEC_CHAR *)(ret + 1);
1422 memcpy( ret->Name, info->Name, size_name );
1423 ret->Comment = ret->Name + size_name;
1424 memcpy( ret->Comment, info->Comment, size_comment );
1425 return ret;
1426 }
1427
1428 /***********************************************************************
1429 * QueryContextAttributesW
1430 */
1431 static SECURITY_STATUS SEC_ENTRY ntlm_QueryContextAttributesW(PCtxtHandle phContext,
1432 ULONG ulAttribute, void *pBuffer)
1433 {
1434 TRACE("%p %d %p\n", phContext, ulAttribute, pBuffer);
1435 if (!phContext)
1436 return SEC_E_INVALID_HANDLE;
1437
1438 switch(ulAttribute)
1439 {
1440 #define _x(x) case (x) : FIXME(#x" stub\n"); break
1441 _x(SECPKG_ATTR_ACCESS_TOKEN);
1442 _x(SECPKG_ATTR_AUTHORITY);
1443 _x(SECPKG_ATTR_DCE_INFO);
1444 case SECPKG_ATTR_FLAGS:
1445 {
1446 PSecPkgContext_Flags spcf = (PSecPkgContext_Flags)pBuffer;
1447 PNegoHelper helper = (PNegoHelper)phContext->dwLower;
1448
1449 spcf->Flags = 0;
1450 if(helper->neg_flags & NTLMSSP_NEGOTIATE_SIGN)
1451 spcf->Flags |= ISC_RET_INTEGRITY;
1452 if(helper->neg_flags & NTLMSSP_NEGOTIATE_SEAL)
1453 spcf->Flags |= ISC_RET_CONFIDENTIALITY;
1454 return SEC_E_OK;
1455 }
1456 _x(SECPKG_ATTR_KEY_INFO);
1457 _x(SECPKG_ATTR_LIFESPAN);
1458 _x(SECPKG_ATTR_NAMES);
1459 _x(SECPKG_ATTR_NATIVE_NAMES);
1460 case SECPKG_ATTR_NEGOTIATION_INFO:
1461 {
1462 SecPkgContext_NegotiationInfoW *info = (SecPkgContext_NegotiationInfoW *)pBuffer;
1463 if (!(info->PackageInfo = build_package_infoW( &infoW ))) return SEC_E_INSUFFICIENT_MEMORY;
1464 info->NegotiationState = SECPKG_NEGOTIATION_COMPLETE;
1465 return SEC_E_OK;
1466 }
1467 _x(SECPKG_ATTR_PACKAGE_INFO);
1468 _x(SECPKG_ATTR_PASSWORD_EXPIRY);
1469 _x(SECPKG_ATTR_SESSION_KEY);
1470 case SECPKG_ATTR_SIZES:
1471 {
1472 PSecPkgContext_Sizes spcs = (PSecPkgContext_Sizes)pBuffer;
1473 spcs->cbMaxToken = NTLM_MAX_BUF;
1474 spcs->cbMaxSignature = 16;
1475 spcs->cbBlockSize = 0;
1476 spcs->cbSecurityTrailer = 16;
1477 return SEC_E_OK;
1478 }
1479 _x(SECPKG_ATTR_STREAM_SIZES);
1480 _x(SECPKG_ATTR_TARGET_INFORMATION);
1481 #undef _x
1482 default:
1483 TRACE("Unknown value %d passed for ulAttribute\n", ulAttribute);
1484 }
1485
1486 return SEC_E_UNSUPPORTED_FUNCTION;
1487 }
1488
1489 /***********************************************************************
1490 * QueryContextAttributesA
1491 */
1492 static SECURITY_STATUS SEC_ENTRY ntlm_QueryContextAttributesA(PCtxtHandle phContext,
1493 ULONG ulAttribute, void *pBuffer)
1494 {
1495 switch(ulAttribute)
1496 {
1497 case SECPKG_ATTR_NEGOTIATION_INFO:
1498 {
1499 SecPkgContext_NegotiationInfoA *info = (SecPkgContext_NegotiationInfoA *)pBuffer;
1500 if (!(info->PackageInfo = build_package_infoA( &infoA ))) return SEC_E_INSUFFICIENT_MEMORY;
1501 info->NegotiationState = SECPKG_NEGOTIATION_COMPLETE;
1502 return SEC_E_OK;
1503 }
1504 default:
1505 return ntlm_QueryContextAttributesW( phContext, ulAttribute, pBuffer );
1506 }
1507 }
1508
1509 /***********************************************************************
1510 * ImpersonateSecurityContext
1511 */
1512 static SECURITY_STATUS SEC_ENTRY ntlm_ImpersonateSecurityContext(PCtxtHandle phContext)
1513 {
1514 SECURITY_STATUS ret;
1515
1516 TRACE("%p\n", phContext);
1517 if (phContext)
1518 {
1519 ret = SEC_E_UNSUPPORTED_FUNCTION;
1520 }
1521 else
1522 {
1523 ret = SEC_E_INVALID_HANDLE;
1524 }
1525 return ret;
1526 }
1527
1528 /***********************************************************************
1529 * RevertSecurityContext
1530 */
1531 static SECURITY_STATUS SEC_ENTRY ntlm_RevertSecurityContext(PCtxtHandle phContext)
1532 {
1533 SECURITY_STATUS ret;
1534
1535 TRACE("%p\n", phContext);
1536 if (phContext)
1537 {
1538 ret = SEC_E_UNSUPPORTED_FUNCTION;
1539 }
1540 else
1541 {
1542 ret = SEC_E_INVALID_HANDLE;
1543 }
1544 return ret;
1545 }
1546
1547 /***********************************************************************
1548 * ntlm_CreateSignature
1549 * As both MakeSignature and VerifySignature need this, but different keys
1550 * are needed for NTLM2, the logic goes into a helper function.
1551 * To ensure maximal reusability, we can specify the direction as NTLM_SEND for
1552 * signing/encrypting and NTLM_RECV for verifying/decrypting. When encrypting,
1553 * the signature is encrypted after the message was encrypted, so
1554 * CreateSignature shouldn't do it. In this case, encrypt_sig can be set to
1555 * false.
1556 */
1557 static SECURITY_STATUS ntlm_CreateSignature(PNegoHelper helper, PSecBufferDesc pMessage,
1558 int token_idx, SignDirection direction, BOOL encrypt_sig)
1559 {
1560 ULONG sign_version = 1;
1561 UINT i;
1562 PBYTE sig;
1563 TRACE("%p, %p, %d, %d, %d\n", helper, pMessage, token_idx, direction,
1564 encrypt_sig);
1565
1566 sig = pMessage->pBuffers[token_idx].pvBuffer;
1567
1568 if(helper->neg_flags & NTLMSSP_NEGOTIATE_NTLM2 &&
1569 helper->neg_flags & NTLMSSP_NEGOTIATE_SIGN)
1570 {
1571 BYTE digest[16];
1572 BYTE seq_no[4];
1573 HMAC_MD5_CTX hmac_md5_ctx;
1574
1575 TRACE("Signing NTLM2 style\n");
1576
1577 if(direction == NTLM_SEND)
1578 {
1579 seq_no[0] = (helper->crypt.ntlm2.send_seq_no >> 0) & 0xff;
1580 seq_no[1] = (helper->crypt.ntlm2.send_seq_no >> 8) & 0xff;
1581 seq_no[2] = (helper->crypt.ntlm2.send_seq_no >> 16) & 0xff;
1582 seq_no[3] = (helper->crypt.ntlm2.send_seq_no >> 24) & 0xff;
1583
1584 ++(helper->crypt.ntlm2.send_seq_no);
1585
1586 HMACMD5Init(&hmac_md5_ctx, helper->crypt.ntlm2.send_sign_key, 16);
1587 }
1588 else
1589 {
1590 seq_no[0] = (helper->crypt.ntlm2.recv_seq_no >> 0) & 0xff;
1591 seq_no[1] = (helper->crypt.ntlm2.recv_seq_no >> 8) & 0xff;
1592 seq_no[2] = (helper->crypt.ntlm2.recv_seq_no >> 16) & 0xff;
1593 seq_no[3] = (helper->crypt.ntlm2.recv_seq_no >> 24) & 0xff;
1594
1595 ++(helper->crypt.ntlm2.recv_seq_no);
1596
1597 HMACMD5Init(&hmac_md5_ctx, helper->crypt.ntlm2.recv_sign_key, 16);
1598 }
1599
1600 HMACMD5Update(&hmac_md5_ctx, seq_no, 4);
1601 for( i = 0; i < pMessage->cBuffers; ++i )
1602 {
1603 if(pMessage->pBuffers[i].BufferType & SECBUFFER_DATA)
1604 HMACMD5Update(&hmac_md5_ctx, pMessage->pBuffers[i].pvBuffer,
1605 pMessage->pBuffers[i].cbBuffer);
1606 }
1607
1608 HMACMD5Final(&hmac_md5_ctx, digest);
1609
1610 if(encrypt_sig && helper->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCHANGE)
1611 {
1612 if(direction == NTLM_SEND)
1613 SECUR32_arc4Process(helper->crypt.ntlm2.send_a4i, digest, 8);
1614 else
1615 SECUR32_arc4Process(helper->crypt.ntlm2.recv_a4i, digest, 8);
1616 }
1617
1618 /* The NTLM2 signature is the sign version */
1619 sig[ 0] = (sign_version >> 0) & 0xff;
1620 sig[ 1] = (sign_version >> 8) & 0xff;
1621 sig[ 2] = (sign_version >> 16) & 0xff;
1622 sig[ 3] = (sign_version >> 24) & 0xff;
1623 /* The first 8 bytes of the digest */
1624 memcpy(sig+4, digest, 8);
1625 /* And the sequence number */
1626 memcpy(sig+12, seq_no, 4);
1627
1628 pMessage->pBuffers[token_idx].cbBuffer = 16;
1629
1630 return SEC_E_OK;
1631 }
1632 if(helper->neg_flags & NTLMSSP_NEGOTIATE_SIGN)
1633 {
1634 ULONG crc = 0U;
1635 TRACE("Signing NTLM1 style\n");
1636
1637 for(i=0; i < pMessage->cBuffers; ++i)
1638 {
1639 if(pMessage->pBuffers[i].BufferType & SECBUFFER_DATA)
1640 crc = RtlComputeCrc32(crc, pMessage->pBuffers[i].pvBuffer, pMessage->pBuffers[i].cbBuffer);
1641 }
1642
1643 sig[ 0] = (sign_version >> 0) & 0xff;
1644 sig[ 1] = (sign_version >> 8) & 0xff;
1645 sig[ 2] = (sign_version >> 16) & 0xff;
1646 sig[ 3] = (sign_version >> 24) & 0xff;
1647 memset(sig+4, 0, 4);
1648 sig[ 8] = (crc >> 0) & 0xff;
1649 sig[ 9] = (crc >> 8) & 0xff;
1650 sig[10] = (crc >> 16) & 0xff;
1651 sig[11] = (crc >> 24) & 0xff;
1652 sig[12] = (helper->crypt.ntlm.seq_num >> 0) & 0xff;
1653 sig[13] = (helper->crypt.ntlm.seq_num >> 8) & 0xff;
1654 sig[14] = (helper->crypt.ntlm.seq_num >> 16) & 0xff;
1655 sig[15] = (helper->crypt.ntlm.seq_num >> 24) & 0xff;
1656
1657 ++(helper->crypt.ntlm.seq_num);
1658
1659 if(encrypt_sig)
1660 SECUR32_arc4Process(helper->crypt.ntlm.a4i, sig+4, 12);
1661 return SEC_E_OK;
1662 }
1663
1664 if(helper->neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN || helper->neg_flags == 0)
1665 {
1666 TRACE("Creating a dummy signature.\n");
1667 /* A dummy signature is 0x01 followed by 15 bytes of 0x00 */
1668 memset(pMessage->pBuffers[token_idx].pvBuffer, 0, 16);
1669 memset(pMessage->pBuffers[token_idx].pvBuffer, 0x01, 1);
1670 pMessage->pBuffers[token_idx].cbBuffer = 16;
1671 return SEC_E_OK;
1672 }
1673
1674 return SEC_E_UNSUPPORTED_FUNCTION;
1675 }
1676
1677 /***********************************************************************
1678 * MakeSignature
1679 */
1680 static SECURITY_STATUS SEC_ENTRY ntlm_MakeSignature(PCtxtHandle phContext,
1681 ULONG fQOP, PSecBufferDesc pMessage, ULONG MessageSeqNo)
1682 {
1683 PNegoHelper helper;
1684 int token_idx;
1685
1686 TRACE("%p %d %p %d\n", phContext, fQOP, pMessage, MessageSeqNo);
1687 if (!phContext)
1688 return SEC_E_INVALID_HANDLE;
1689
1690 if(fQOP)
1691 FIXME("Ignoring fQOP 0x%08x\n", fQOP);
1692
1693 if(MessageSeqNo)
1694 FIXME("Ignoring MessageSeqNo\n");
1695
1696 if(!pMessage || !pMessage->pBuffers || pMessage->cBuffers < 2)
1697 return SEC_E_INVALID_TOKEN;
1698
1699 /* If we didn't find a SECBUFFER_TOKEN type buffer */
1700 if((token_idx = ntlm_GetTokenBufferIndex(pMessage)) == -1)
1701 return SEC_E_INVALID_TOKEN;
1702
1703 if(pMessage->pBuffers[token_idx].cbBuffer < 16)
1704 return SEC_E_BUFFER_TOO_SMALL;
1705
1706 helper = (PNegoHelper)phContext->dwLower;
1707 TRACE("Negotiated flags are: 0x%08x\n", helper->neg_flags);
1708
1709 return ntlm_CreateSignature(helper, pMessage, token_idx, NTLM_SEND, TRUE);
1710 }
1711
1712 /***********************************************************************
1713 * VerifySignature
1714 */
1715 static SECURITY_STATUS SEC_ENTRY ntlm_VerifySignature(PCtxtHandle phContext,
1716 PSecBufferDesc pMessage, ULONG MessageSeqNo, PULONG pfQOP)
1717 {
1718 PNegoHelper helper;
1719 UINT i;
1720 int token_idx;
1721 SECURITY_STATUS ret;
1722 SecBufferDesc local_desc;
1723 PSecBuffer local_buff;
1724 BYTE local_sig[16];
1725
1726 TRACE("%p %p %d %p\n", phContext, pMessage, MessageSeqNo, pfQOP);
1727 if(!phContext)
1728 return SEC_E_INVALID_HANDLE;
1729
1730 if(!pMessage || !pMessage->pBuffers || pMessage->cBuffers < 2)
1731 return SEC_E_INVALID_TOKEN;
1732
1733 if((token_idx = ntlm_GetTokenBufferIndex(pMessage)) == -1)
1734 return SEC_E_INVALID_TOKEN;
1735
1736 if(pMessage->pBuffers[token_idx].cbBuffer < 16)
1737 return SEC_E_BUFFER_TOO_SMALL;
1738
1739 if(MessageSeqNo)
1740 FIXME("Ignoring MessageSeqNo\n");
1741
1742 helper = (PNegoHelper)phContext->dwLower;
1743 TRACE("Negotiated flags: 0x%08x\n", helper->neg_flags);
1744
1745 local_buff = heap_alloc(pMessage->cBuffers * sizeof(SecBuffer));
1746
1747 local_desc.ulVersion = SECBUFFER_VERSION;
1748 local_desc.cBuffers = pMessage->cBuffers;
1749 local_desc.pBuffers = local_buff;
1750
1751 for(i=0; i < pMessage->cBuffers; ++i)
1752 {
1753 if(pMessage->pBuffers[i].BufferType == SECBUFFER_TOKEN)
1754 {
1755 local_buff[i].BufferType = SECBUFFER_TOKEN;
1756 local_buff[i].cbBuffer = 16;
1757 local_buff[i].pvBuffer = local_sig;
1758 }
1759 else
1760 {
1761 local_buff[i].BufferType = pMessage->pBuffers[i].BufferType;
1762 local_buff[i].cbBuffer = pMessage->pBuffers[i].cbBuffer;
1763 local_buff[i].pvBuffer = pMessage->pBuffers[i].pvBuffer;
1764 }
1765 }
1766
1767 if((ret = ntlm_CreateSignature(helper, &local_desc, token_idx, NTLM_RECV, TRUE)) != SEC_E_OK)
1768 return ret;
1769
1770 if(memcmp(((PBYTE)local_buff[token_idx].pvBuffer) + 8,
1771 ((PBYTE)pMessage->pBuffers[token_idx].pvBuffer) + 8, 8))
1772 ret = SEC_E_MESSAGE_ALTERED;
1773 else
1774 ret = SEC_E_OK;
1775
1776 heap_free(local_buff);
1777 return ret;
1778
1779 }
1780
1781 /***********************************************************************
1782 * FreeCredentialsHandle
1783 */
1784 static SECURITY_STATUS SEC_ENTRY ntlm_FreeCredentialsHandle(PCredHandle phCredential)
1785 {
1786 if (phCredential)
1787 {
1788 PNtlmCredentials ntlm_cred = (PNtlmCredentials) phCredential->dwLower;
1789 phCredential->dwUpper = 0;
1790 phCredential->dwLower = 0;
1791 if (ntlm_cred->password) memset(ntlm_cred->password, 0, ntlm_cred->pwlen);
1792 heap_free(ntlm_cred->password);
1793 heap_free(ntlm_cred->username_arg);
1794 heap_free(ntlm_cred->domain_arg);
1795 heap_free(ntlm_cred);
1796 }
1797
1798 return SEC_E_OK;
1799 }
1800
1801 /***********************************************************************
1802 * EncryptMessage
1803 */
1804 static SECURITY_STATUS SEC_ENTRY ntlm_EncryptMessage(PCtxtHandle phContext,
1805 ULONG fQOP, PSecBufferDesc pMessage, ULONG MessageSeqNo)
1806 {
1807 PNegoHelper helper;
1808 int token_idx, data_idx;
1809
1810 TRACE("(%p %d %p %d)\n", phContext, fQOP, pMessage, MessageSeqNo);
1811
1812 if(!phContext)
1813 return SEC_E_INVALID_HANDLE;
1814
1815 if(fQOP)
1816 FIXME("Ignoring fQOP\n");
1817
1818 if(MessageSeqNo)
1819 FIXME("Ignoring MessageSeqNo\n");
1820
1821 if(!pMessage || !pMessage->pBuffers || pMessage->cBuffers < 2)
1822 return SEC_E_INVALID_TOKEN;
1823
1824 if((token_idx = ntlm_GetTokenBufferIndex(pMessage)) == -1)
1825 return SEC_E_INVALID_TOKEN;
1826
1827 if((data_idx = ntlm_GetDataBufferIndex(pMessage)) ==-1 )
1828 return SEC_E_INVALID_TOKEN;
1829
1830 if(pMessage->pBuffers[token_idx].cbBuffer < 16)
1831 return SEC_E_BUFFER_TOO_SMALL;
1832
1833 helper = (PNegoHelper) phContext->dwLower;
1834
1835 if(helper->neg_flags & NTLMSSP_NEGOTIATE_NTLM2 &&
1836 helper->neg_flags & NTLMSSP_NEGOTIATE_SEAL)
1837 {
1838 ntlm_CreateSignature(helper, pMessage, token_idx, NTLM_SEND, FALSE);
1839 SECUR32_arc4Process(helper->crypt.ntlm2.send_a4i,
1840 pMessage->pBuffers[data_idx].pvBuffer,
1841 pMessage->pBuffers[data_idx].cbBuffer);
1842
1843 if(helper->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCHANGE)
1844 SECUR32_arc4Process(helper->crypt.ntlm2.send_a4i,
1845 ((BYTE *)pMessage->pBuffers[token_idx].pvBuffer)+4, 8);
1846 }
1847 else
1848 {
1849 PBYTE sig;
1850 ULONG save_flags;
1851
1852 /* EncryptMessage always produces real signatures, so make sure
1853 * NTLMSSP_NEGOTIATE_SIGN is set*/
1854 save_flags = helper->neg_flags;
1855 helper->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
1856 ntlm_CreateSignature(helper, pMessage, token_idx, NTLM_SEND, FALSE);
1857 helper->neg_flags = save_flags;
1858
1859 sig = pMessage->pBuffers[token_idx].pvBuffer;
1860
1861 SECUR32_arc4Process(helper->crypt.ntlm.a4i,
1862 pMessage->pBuffers[data_idx].pvBuffer,
1863 pMessage->pBuffers[data_idx].cbBuffer);
1864 SECUR32_arc4Process(helper->crypt.ntlm.a4i, sig+4, 12);
1865
1866 if(helper->neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN || helper->neg_flags == 0)
1867 memset(sig+4, 0, 4);
1868 }
1869 return SEC_E_OK;
1870 }
1871
1872 /***********************************************************************
1873 * DecryptMessage
1874 */
1875 static SECURITY_STATUS SEC_ENTRY ntlm_DecryptMessage(PCtxtHandle phContext,
1876 PSecBufferDesc pMessage, ULONG MessageSeqNo, PULONG pfQOP)
1877 {
1878 SECURITY_STATUS ret;
1879 ULONG ntlmssp_flags_save;
1880 PNegoHelper helper;
1881 int token_idx, data_idx;
1882 TRACE("(%p %p %d %p)\n", phContext, pMessage, MessageSeqNo, pfQOP);
1883
1884 if(!phContext)
1885 return SEC_E_INVALID_HANDLE;
1886
1887 if(MessageSeqNo)
1888 FIXME("Ignoring MessageSeqNo\n");
1889
1890 if(!pMessage || !pMessage->pBuffers || pMessage->cBuffers < 2)
1891 return SEC_E_INVALID_TOKEN;
1892
1893 if((token_idx = ntlm_GetTokenBufferIndex(pMessage)) == -1)
1894 return SEC_E_INVALID_TOKEN;
1895
1896 if((data_idx = ntlm_GetDataBufferIndex(pMessage)) ==-1)
1897 return SEC_E_INVALID_TOKEN;
1898
1899 if(pMessage->pBuffers[token_idx].cbBuffer < 16)
1900 return SEC_E_BUFFER_TOO_SMALL;
1901
1902 helper = (PNegoHelper) phContext->dwLower;
1903
1904 if(helper->neg_flags & NTLMSSP_NEGOTIATE_NTLM2 && helper->neg_flags & NTLMSSP_NEGOTIATE_SEAL)
1905 {
1906 SECUR32_arc4Process(helper->crypt.ntlm2.recv_a4i,
1907 pMessage->pBuffers[data_idx].pvBuffer,
1908 pMessage->pBuffers[data_idx].cbBuffer);
1909 }
1910 else
1911 {
1912 SECUR32_arc4Process(helper->crypt.ntlm.a4i,
1913 pMessage->pBuffers[data_idx].pvBuffer,
1914 pMessage->pBuffers[data_idx].cbBuffer);
1915 }
1916
1917 /* Make sure we use a session key for the signature check, EncryptMessage
1918 * always does that, even in the dummy case */
1919 ntlmssp_flags_save = helper->neg_flags;
1920
1921 helper->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
1922 ret = ntlm_VerifySignature(phContext, pMessage, MessageSeqNo, pfQOP);
1923
1924 helper->neg_flags = ntlmssp_flags_save;
1925
1926 return ret;
1927 }
1928
1929 static const SecurityFunctionTableA ntlmTableA = {
1930 1,
1931 NULL, /* EnumerateSecurityPackagesA */
1932 ntlm_QueryCredentialsAttributesA, /* QueryCredentialsAttributesA */
1933 ntlm_AcquireCredentialsHandleA, /* AcquireCredentialsHandleA */
1934 ntlm_FreeCredentialsHandle, /* FreeCredentialsHandle */
1935 NULL, /* Reserved2 */
1936 ntlm_InitializeSecurityContextA, /* InitializeSecurityContextA */
1937 ntlm_AcceptSecurityContext, /* AcceptSecurityContext */
1938 ntlm_CompleteAuthToken, /* CompleteAuthToken */
1939 ntlm_DeleteSecurityContext, /* DeleteSecurityContext */
1940 NULL, /* ApplyControlToken */
1941 ntlm_QueryContextAttributesA, /* QueryContextAttributesA */
1942 ntlm_ImpersonateSecurityContext, /* ImpersonateSecurityContext */
1943 ntlm_RevertSecurityContext, /* RevertSecurityContext */
1944 ntlm_MakeSignature, /* MakeSignature */
1945 ntlm_VerifySignature, /* VerifySignature */
1946 FreeContextBuffer, /* FreeContextBuffer */
1947 NULL, /* QuerySecurityPackageInfoA */
1948 NULL, /* Reserved3 */
1949 NULL, /* Reserved4 */
1950 NULL, /* ExportSecurityContext */
1951 NULL, /* ImportSecurityContextA */
1952 NULL, /* AddCredentialsA */
1953 NULL, /* Reserved8 */
1954 NULL, /* QuerySecurityContextToken */
1955 ntlm_EncryptMessage, /* EncryptMessage */
1956 ntlm_DecryptMessage, /* DecryptMessage */
1957 NULL, /* SetContextAttributesA */
1958 };
1959
1960 static const SecurityFunctionTableW ntlmTableW = {
1961 1,
1962 NULL, /* EnumerateSecurityPackagesW */
1963 ntlm_QueryCredentialsAttributesW, /* QueryCredentialsAttributesW */
1964 ntlm_AcquireCredentialsHandleW, /* AcquireCredentialsHandleW */
1965 ntlm_FreeCredentialsHandle, /* FreeCredentialsHandle */
1966 NULL, /* Reserved2 */
1967 ntlm_InitializeSecurityContextW, /* InitializeSecurityContextW */
1968 ntlm_AcceptSecurityContext, /* AcceptSecurityContext */
1969 ntlm_CompleteAuthToken, /* CompleteAuthToken */
1970 ntlm_DeleteSecurityContext, /* DeleteSecurityContext */
1971 NULL, /* ApplyControlToken */
1972 ntlm_QueryContextAttributesW, /* QueryContextAttributesW */
1973 ntlm_ImpersonateSecurityContext, /* ImpersonateSecurityContext */
1974 ntlm_RevertSecurityContext, /* RevertSecurityContext */
1975 ntlm_MakeSignature, /* MakeSignature */
1976 ntlm_VerifySignature, /* VerifySignature */
1977 FreeContextBuffer, /* FreeContextBuffer */
1978 NULL, /* QuerySecurityPackageInfoW */
1979 NULL, /* Reserved3 */
1980 NULL, /* Reserved4 */
1981 NULL, /* ExportSecurityContext */
1982 NULL, /* ImportSecurityContextW */
1983 NULL, /* AddCredentialsW */
1984 NULL, /* Reserved8 */
1985 NULL, /* QuerySecurityContextToken */
1986 ntlm_EncryptMessage, /* EncryptMessage */
1987 ntlm_DecryptMessage, /* DecryptMessage */
1988 NULL, /* SetContextAttributesW */
1989 };
1990
1991 void SECUR32_initNTLMSP(void)
1992 {
1993 PNegoHelper helper;
1994 static CHAR version[] = "--version";
1995
1996 SEC_CHAR *args[] = {
1997 ntlm_auth,
1998 version,
1999 NULL };
2000
2001 if(fork_helper(&helper, ntlm_auth, args) != SEC_E_OK)
2002 helper = NULL;
2003 else
2004 check_version(helper);
2005
2006 if( helper &&
2007 ((helper->major > MIN_NTLM_AUTH_MAJOR_VERSION) ||
2008 (helper->major == MIN_NTLM_AUTH_MAJOR_VERSION &&
2009 helper->minor > MIN_NTLM_AUTH_MINOR_VERSION) ||
2010 (helper->major == MIN_NTLM_AUTH_MAJOR_VERSION &&
2011 helper->minor == MIN_NTLM_AUTH_MINOR_VERSION &&
2012 helper->micro >= MIN_NTLM_AUTH_MICRO_VERSION)) )
2013 {
2014 SecureProvider *provider = SECUR32_addProvider(&ntlmTableA, &ntlmTableW, NULL);
2015 SECUR32_addPackages(provider, 1L, ntlm_package_infoA, ntlm_package_infoW);
2016 }
2017 else
2018 {
2019 ERR_(winediag)("%s was not found or is outdated. "
2020 "Make sure that ntlm_auth >= %d.%d.%d is in your path. "
2021 "Usually, you can find it in the winbind package of your distribution.\n",
2022 ntlm_auth,
2023 MIN_NTLM_AUTH_MAJOR_VERSION,
2024 MIN_NTLM_AUTH_MINOR_VERSION,
2025 MIN_NTLM_AUTH_MICRO_VERSION);
2026
2027 }
2028 cleanup_helper(helper);
2029 }
Windows API implementation