Many fixes, most of them based on comments by Eric Glass

1 files changed, 131 insertions, 179 deletions

diff --git a/lib/http_ntlm.c b/lib/http_ntlm.c
index 066807784..c874ca8a2 100644
--- a/lib/http_ntlm.c
+++ b/lib/http_ntlm.c
@@ -22,7 +22,12 @@
  ***************************************************************************/
 #include "setup.h"
 
-/* All NTLM details here: http://www.innovation.ch/java/ntlm.html */
+/* NTLM details:
+   
+   http://davenport.sourceforge.net/ntlm.html
+   http://www.innovation.ch/java/ntlm.html
+
+*/
 
 #ifndef CURL_DISABLE_HTTP
 #ifdef USE_SSLEAY
@@ -65,23 +70,23 @@
 #endif
 
 /* The last #include file should be: */
-#ifdef MALLOCDEBUG
+#ifdef CURLDEBUG
 #include "memdebug.h"
 #endif
 
-/*
-  The one and only master resource for NTLM "hacking":
+/* Define this to make the type-3 message include the NT response message */
+#undef USE_NTRESPONSES
 
-  ====> http://www.innovation.ch/java/ntlm.html <====
+/*
+  (*) = A "security buffer" is a triplet consisting of two shorts and one
+  long:
 
-  Brought to the world by Ronald Tschalär.
+  1. a 'short' containing the length of the buffer in bytes
+  2. a 'short' containing the allocated space for the buffer in bytes
+  3. a 'long' containing the offset to the start of the buffer from the
+     beginning of the NTLM message, in bytes.
 */
 
-/* Test example header:
-
-WWW-Authenticate: NTLM
-
-*/
 
 CURLntlm Curl_input_ntlm(struct connectdata *conn,
                          char *header) /* rest of the www-authenticate:
@@ -101,31 +106,18 @@ CURLntlm Curl_input_ntlm(struct connectdata *conn,
       header++;
 
     if(*header) {
-      /* we got a type-2 message here */
-
-      /* My test-IE session reveived this type-2:
-
-      TlRMTVNTUAACAAAAAgACADAAAAAGgoEAc51AYVDgyNcAAAAAAAAAAG4AbgA\
-      yAAAAQ0MCAAQAQwBDAAEAEgBFAEwASQBTAEEAQgBFAFQASAAEABgAYwBjAC4\
-      AaQBjAGUAZABlAHYALgBuAHUAAwAsAGUAbABpAHMAYQBiAGUAdABoAC4AYwB\
-      jAC4AaQBjAGUAZABlAHYALgBuAHUAAAAAAA==
-
-      which translates to this:
-
-0x00: 4e 54 4c 4d 53 53 50 00 02 00 00 00 02 00 02 00  | NTLMSSP.........
-0x10: 30 00 00 00 06 82 81 00 73 9d 40 61 50 e0 c8 d7  | 0.......s.@aP...
-0x20: 00 00 00 00 00 00 00 00 6e 00 6e 00 32 00 00 00  | ........n.n.2...
-0x30: 43 43 02 00 04 00 43 00 43 00 01 00 12 00 45 00  | CC....C.C.....E.
-0x40: 4c 00 49 00 53 00 41 00 42 00 45 00 54 00 48 00  | L.I.S.A.B.E.T.H.
-0x50: 04 00 18 00 63 00 63 00 2e 00 69 00 63 00 65 00  | ....c.c...i.c.e.
-0x60: 64 00 65 00 76 00 2e 00 6e 00 75 00 03 00 2c 00  | d.e.v...n.u...,.
-0x70: 65 00 6c 00 69 00 73 00 61 00 62 00 65 00 74 00  | e.l.i.s.a.b.e.t.
-0x80: 68 00 2e 00 63 00 63 00 2e 00 69 00 63 00 65 00  | h...c.c...i.c.e.
-0x90: 64 00 65 00 76 00 2e 00 6e 00 75 00 00 00 00 00  | d.e.v...n.u.....
-
-This is not the same format as described on the web page, but doing repeated
-requests show that 0x18-0x1f seems to be the nonce anyway.
-
+      /* We got a type-2 message here:
+
+         Index   Description         Content
+         0       NTLMSSP Signature   Null-terminated ASCII "NTLMSSP"
+                                     (0x4e544c4d53535000)
+         8       NTLM Message Type   long (0x02000000)
+         12      Target Name         security buffer(*)
+         20      Flags               long
+         24      Challenge           8 bytes
+         (32)    Context (optional)  8 bytes (two consecutive longs)
+         (40)    Target Information  (optional) security buffer(*)
+         32 (48) start of data block
       */
 
       int size = Curl_base64_decode(header, buffer);
@@ -135,6 +127,9 @@ requests show that 0x18-0x1f seems to be the nonce anyway.
       if(size >= 48)
         /* the nonce of interest is index [24 .. 31], 8 bytes */
         memcpy(data->state.ntlm.nonce, &buffer[24], 8);
+
+      /* at index decimal 20, there's a 32bit NTLM flag field */
+
     }
     else {
       if(data->state.ntlm.state >= NTLMSTATE_TYPE1)
@@ -198,12 +193,16 @@ static void calc_resp(unsigned char *keys,
  */
 static void mkhash(char *password,
                    unsigned char *nonce,  /* 8 bytes */
-                   unsigned char *lmresp, /* must fit 0x18 bytes */
-                   unsigned char *ntresp) /* must fit 0x18 bytes */
+                   unsigned char *lmresp  /* must fit 0x18 bytes */
+#ifdef USE_NTRESPONSES
+                   , unsigned char *ntresp  /* must fit 0x18 bytes */
+#endif
+  )
 {
   unsigned char lmbuffer[21];
+#ifdef USE_NTRESPONSES
   unsigned char ntbuffer[21];
-  
+#endif
   unsigned char *pw;
   static const unsigned char magic[] = {
     0x4B, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25
@@ -239,7 +238,10 @@ static void mkhash(char *password,
 
     memset(lmbuffer+16, 0, 5);
   }
+  /* create LM responses */
+  calc_resp(lmbuffer, nonce, lmresp);
 
+#ifdef USE_NTRESPONSES
   {
     /* create NT hashed password */
     MD4_CTX MD4;
@@ -258,35 +260,22 @@ static void mkhash(char *password,
     memset(ntbuffer+16, 0, 8);
   }
 
-  /* create responses */
-  calc_resp(lmbuffer, nonce, lmresp);
   calc_resp(ntbuffer, nonce, ntresp);
+#endif
 
   free(pw);
 }
 
-/* convert an ascii string to upper case unicode, the destination buffer
-   must fit twice the source size */
-static void ascii_to_unicode(unsigned char *destunicode,
-                             unsigned char *sourceascii,
-                             bool conv)
-{
-  while (*sourceascii) {
-    destunicode[0] = conv?toupper(*sourceascii):*sourceascii;
-    destunicode[1] = '\0';
-    destunicode += 2;
-    sourceascii++;
-  }
-}
-
 #define SHORTPAIR(x) ((x) & 0xff), ((x) >> 8)
+#define LONGQUARTET(x) ((x) & 0xff), (((x) >> 8)&0xff), \
+  (((x) >>16)&0xff), ((x)>>24)
 
 /* this is for creating ntlm header output */
 CURLcode Curl_output_ntlm(struct connectdata *conn)
 {
   struct SessionHandle *data=conn->data;
-  const char *domain="CURL";
-  const char *host="HAXX";
+  const char *domain=""; /* empty */
+  const char *host=""; /* empty */
   int domlen=strlen(domain);
   int hostlen = strlen(host);
   int hostoff; /* host name offset */
@@ -295,49 +284,46 @@ CURLcode Curl_output_ntlm(struct connectdata *conn)
   char *base64=NULL;
 
   unsigned char ntlm[256]; /* enough, unless the host/domain is very long */
-  if(NTLMSTATE_TYPE1 == data->state.ntlm.state) {
+  switch(data->state.ntlm.state) {
+  case NTLMSTATE_TYPE1:
+  default: /* for the weird cases we (re)start here */
     hostoff = 32;
     domoff = hostoff + hostlen;
     
-    /* IE used this as type-1 maessage:
+    /* Create and send a type-1 message:
 
-    Authorization: NTLM \
-    TlRMTVNTUAABAAAABoIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAAAAAAAAwAAAA\r\n
-
-    This translates into:
-
-0x00: 4e 54 4c 4d 53 53 50 00 01 00 00 00 06 82 00 00  | NTLMSSP.........
-0x10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  | ................
-0x20: 00 00 00 00 30 00 00 00 00 00 00 00 30 00 00 00  | ....0.......0...
-
-    Which isn't following the web spec. This uses 0x8206 instead of 0xb203
-    and sends a longer chunk of data than we do! Interestingly, there's no
-    host or domain either.
-
-    We want to send something like this:
-
-0x00: 4e 54 4c 4d 53 53 50 00 01 00 00 00 03 b2 00 00  | NTLMSSP.........
-0x10: 05 00 05 00 2b 00 00 00 0b 00 0b 00 20 00 00 00  | ....+...........
-0x20: 4c 49 4c 4c 41 53 59 53 54 45 52 48 45 4d 4d 41  | LILLASYSTERHEMMA
+    Index Description          Content
+    0     NTLMSSP Signature    Null-terminated ASCII "NTLMSSP"
+                               (0x4e544c4d53535000)
+    8     NTLM Message Type    long (0x01000000)
+    12    Flags                long
+    16    Supplied Domain      security buffer(*)
+    24    Supplied Workstation security buffer(*)
+    32    start of data block
 
     */
 
     snprintf((char *)ntlm, sizeof(ntlm), "NTLMSSP%c"
-             "\x01" /* type 1 */
-             "%c%c%c"
-             "\x03\xb2"
-             "%c%c"
-             "%c%c"  /* domain length */
+             "\x01%c%c%c" /* 32-bit type = 1 */
+             "%c%c%c%c"   /* 32-bit NTLM flag field */
              "%c%c"  /* domain length */
+             "%c%c"  /* domain allocated space */
              "%c%c"  /* domain name offset */
              "%c%c"  /* 2 zeroes */
              "%c%c"  /* host length */
-             "%c%c"  /* host length */
+             "%c%c"  /* host allocated space */
              "%c%c"  /* host name offset */
              "%c%c"  /* 2 zeroes */
-             "%s" /* host name */
-             "%s", /* domain string */
-             0,0,0,0,0,0,
+             "%s"   /* host name */
+             "%s",  /* domain string */
+             0,     /* trailing zero */
+             0,0,0, /* part of type-1 long */
+
+             LONGQUARTET(
+               NTLMFLAG_NEGOTIATE_OEM|      /*   2 */
+               NTLMFLAG_NEGOTIATE_NTLM_KEY  /* 200 */
+               /* equals 0x0202 */
+               ),
              SHORTPAIR(domlen),
              SHORTPAIR(domlen),
              SHORTPAIR(domoff),
@@ -350,11 +336,7 @@ CURLcode Curl_output_ntlm(struct connectdata *conn)
 
     /* initial packet length */
     size = 32 + hostlen + domlen;
-#if 0
-    #define CHUNK "\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x06\x82\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x30\x00\x00\x00\x00\x00\x00\x00\x30\x00\x00\x00"
-    memcpy(ntlm, CHUNK, sizeof(CHUNK)-1);
-    size = sizeof(CHUNK)-1;
-#endif    
+
     /* now keeper of the base64 encoded package size */
     size = Curl_base64_encode(ntlm, size, &base64);
 
@@ -365,55 +347,43 @@ CURLcode Curl_output_ntlm(struct connectdata *conn)
     }
     else
       return CURLE_OUT_OF_MEMORY; /* FIX TODO */
-  }
-  else {
-    if(NTLMSTATE_TYPE2 == data->state.ntlm.state) {
-      /* We received the type-2 already, create a type-3 message */
-
-    /*
-      My test-IE session sent this type-3:
-
-      TlRMTVNTUAADAAAAGAAYAEoAAAAAAAAAYgAAAAUABQA0AAAABgAGADk\
-      AAAALAAsAPwAAAEhFTU1BZGFuaWVsTElMTEFTWVNURVJPVPJELoebUg\
-      4SvW0ed2QmKu0SjX4qNrI=
-
-      Which translates to:
-
-0x00: 4e 54 4c 4d 53 53 50 00 03 00 00 00 18 00 18 00  | NTLMSSP.........
-0x10: 4a 00 00 00 00 00 00 00 62 00 00 00 05 00 05 00  | J.......b.......
-0x20: 34 00 00 00 06 00 06 00 39 00 00 00 0b 00 0b 00  | 4.......9.......
-0x30: 3f 00 00 00 48 45 4d 4d 41 64 61 6e 69 65 6c 4c  | ?...HEMMAdanielL
-0x40: 49 4c 4c 41 53 59 53 54 45 52 4f 54 f2 44 2e 87  | ILLASYSTEROT.D..
-0x50: 9b 52 0e 12 bd 6d 1e 77 64 26 2a ed 12 8d 7e 2a  | .R...m.wd&*...~*
-0x60: 36 b2                                            | 6.
-
-      Note how the domain + username + hostname ARE NOT unicoded in any way.
-      Domain and hostname are uppercase, while username are case sensitive.
-
-      We send something like this:
-
-0x00: 4e 54 4c 4d 53 53 50 00 03 00 00 00 18 00 18 00  | NTLMSSP.........
-0x10: 6c 00 00 00 18 00 18 00 84 00 00 00 0a 00 0a 00  | l...............
-0x20: 40 00 00 00 0c 00 0c 00 4a 00 00 00 16 00 16 00  | @.......J.......
-0x30: 56 00 00 00 00 00 00 00 9c 00 00 00 01 82 00 00  | V...............
-0x40: 48 00 45 00 4d 00 4d 00 41 00 64 00 61 00 6e 00  | H.E.M.M.A.d.a.n.
-0x50: 69 00 65 00 6c 00 4c 00 49 00 4c 00 4c 00 41 00  | i.e.l.L.I.L.L.A.
-0x60: 53 00 59 00 53 00 54 00 45 00 52 00 bc ed 28 c9  | S.Y.S.T.E.R...(.
-0x70: 16 c4 1b 16 d7 c9 b4 0e ef ef 02 6d 26 8d c0 ba  | ...........m&...
-0x80: ac b6 5a c1 26 8d c0 ba ac b6 5a c1 26 8d c0 ba  | ..Z.&.....Z.&...
-0x90: ac b6 5a c1 26 8d c0 ba ac b6 5a c1              | ..Z.&.....Z.
 
-    */
+    break;
+    
+  case NTLMSTATE_TYPE2:
+    /* We received the type-2 already, create a type-3 message:
+
+    Index   Description            Content
+    0       NTLMSSP Signature      Null-terminated ASCII "NTLMSSP"
+                                   (0x4e544c4d53535000)
+    8       NTLM Message Type      long (0x03000000)
+    12      LM/LMv2 Response       security buffer(*)
+    20      NTLM/NTLMv2 Response   security buffer(*)
+    28      Domain Name            security buffer(*)
+    36      User Name              security buffer(*)
+    44      Workstation Name       security buffer(*)
+    (52)    Session Key (optional) security buffer(*)
+    (60)    Flags (optional)       long
+    52 (64) start of data block
 
+    */
+  
+  {
     int lmrespoff;
     int ntrespoff;
     int useroff;
     unsigned char lmresp[0x18]; /* fixed-size */
+#ifdef USE_NTRESPONSES
     unsigned char ntresp[0x18]; /* fixed-size */
-
+#endif
     int userlen = strlen(data->state.user);
     
-    mkhash(data->state.passwd, &data->state.ntlm.nonce[0], lmresp, ntresp);
+    mkhash(data->state.passwd, &data->state.ntlm.nonce[0], lmresp
+#ifdef USE_NTRESPONSES
+           , ntresp
+#endif
+
+);
 
     /* these are going unicode */
     domlen *= 2;
@@ -429,29 +399,29 @@ CURLcode Curl_output_ntlm(struct connectdata *conn)
     /* Create the big type-3 message binary blob */
     size = snprintf((char *)ntlm, sizeof(ntlm),
                     "NTLMSSP%c"
-                    "\x03" /* type 3 */
-                    "%c%c%c" /* 3 zeroes */
+                    "\x03%c%c%c" /* type-3, 32 bits */
 
-                    "%c%c%c%c" /* LanManager length twice */
+                    "%c%c%c%c" /* LanManager length + allocated space */
                     "%c%c" /* LanManager offset */
                     "%c%c" /* 2 zeroes */
 
-                    "%c%c%c%c" /* NT-response length twice */
+                    "%c%c" /* NT-response length */
+                    "%c%c" /* NT-response allocated space */
                     "%c%c" /* NT-response offset */
                     "%c%c" /* 2 zeroes */
                     
                     "%c%c"  /* domain length */
-                    "%c%c"  /* domain length */
+                    "%c%c"  /* domain allocated space */
                     "%c%c"  /* domain name offset */
                     "%c%c"  /* 2 zeroes */
                     
                     "%c%c"  /* user length */
-                    "%c%c"  /* user length */
+                    "%c%c"  /* user allocated space */
                     "%c%c"  /* user offset */
                     "%c%c"  /* 2 zeroes */
                     
                     "%c%c"  /* host length */
-                    "%c%c"  /* host length */
+                    "%c%c"  /* host allocated space */
                     "%c%c"  /* host offset */
                     "%c%c%c%c%c%c"  /* 6 zeroes */
                     
@@ -467,16 +437,21 @@ CURLcode Curl_output_ntlm(struct connectdata *conn)
                     /* LanManager response */
                     /* NT response */
                     ,
-                    0,
-                    0,0,0,
+                    0, /* zero termination */
+                    0,0,0, /* type-3 long, the 24 upper bits */
 
                     SHORTPAIR(0x18),  /* LanManager response length, twice */
                     SHORTPAIR(0x18),
                     SHORTPAIR(lmrespoff),
                     0x0, 0x0,
                     
+#ifdef USE_NTRESPONSES
                     SHORTPAIR(0x18),  /* NT-response length, twice */
                     SHORTPAIR(0x18),
+#else
+                    0x0, 0x0,
+                    0x0, 0x0,
+#endif
                     SHORTPAIR(ntrespoff),
                     0x0, 0x0,
 
@@ -503,50 +478,25 @@ CURLcode Curl_output_ntlm(struct connectdata *conn)
     size=64;
     ntlm[62]=ntlm[63]=0;
 
-#if 1
-    ascii_to_unicode(&ntlm[size], (unsigned char *)domain, TRUE);
-    size += domlen;
-    
-    ascii_to_unicode(&ntlm[size], (unsigned char *)data->state.user, FALSE);
-    size += userlen;
-
-    ascii_to_unicode(&ntlm[size], (unsigned char *)host, TRUE);
-    size += hostlen;
-#else
-    strcpy(&ntlm[size], (unsigned char *)domain);
-    size += domlen;
-
-    strcpy(&ntlm[size], (unsigned char *)data->state.user);
+    memcpy(&ntlm[size], data->state.user, userlen);
     size += userlen;
 
-    strcpy(&ntlm[size], (unsigned char *)host);
-    size += hostlen;
-#endif
-
     /* we append the binary hashes to the end of the blob */
     if(size < ((int)sizeof(ntlm) - 0x18)) {
       memcpy(&ntlm[size], lmresp, 0x18);
       size += 0x18;
     }
 
+#ifdef USE_NTRESPONSES
     if(size < ((int)sizeof(ntlm) - 0x18)) {      
       memcpy(&ntlm[size], ntresp, 0x18);
       size += 0x18;
     }
-
+#endif
 
     ntlm[56] = size & 0xff;
     ntlm[57] = size >> 8;
 
-#if 0
-#undef CHUNK
-
-#define CHUNK "\x4e\x54\x4c\x4d\x53\x53\x50\x00\x03\x00\x00\x00\x18\x00\x18\x00\x4a\x00\x00\x00\x00\x00\x00\x00\x62\x00\x00\x00\x05\x00\x05\x00\x34\x00\x00\x00\x06\x00\x06\x00\x39\x00\x00\x00\x0b\x00\x0b\x00\x3f\x00\x00\x00\x48\x45\x4d\x4d\x41\x64\x61\x6e\x69\x65\x6c\x4c\x49\x4c\x4c\x41\x53\x59\x53\x54\x45\x52\x4f\x54\xf2\x44\x2e\x87\x9b\x52\x0e\x12\xbd\x6d\x1e\x77\x64\x26\x2a\xed\x12\x8d\x7e\x2a\x36\xb2"
-    memcpy(ntlm, CHUNK, sizeof(CHUNK)-1);
-    size = sizeof(CHUNK)-1;
-#endif
-
-    
     /* convert the binary blob into base64 */
     size = Curl_base64_encode(ntlm, size, &base64);
 
@@ -558,17 +508,19 @@ CURLcode Curl_output_ntlm(struct connectdata *conn)
     else
       return CURLE_OUT_OF_MEMORY; /* FIX TODO */
 
-      data->state.ntlm.state = NTLMSTATE_TYPE3; /* we sent a type-3 */
-
-    } else 
-      if(NTLMSTATE_TYPE3 == data->state.ntlm.state) {
-        /* connection is already authenticated,
-         * don't send a header in future requests */
-          if(conn->allocptr.userpwd) {
-            free(conn->allocptr.userpwd);
-            conn->allocptr.userpwd=NULL;
-          }
-      }
+    data->state.ntlm.state = NTLMSTATE_TYPE3; /* we sent a type-3 */
+    
+  }
+  break;
+
+  case NTLMSTATE_TYPE3:
+    /* connection is already authenticated,
+     * don't send a header in future requests */
+    if(conn->allocptr.userpwd) {
+      free(conn->allocptr.userpwd);
+      conn->allocptr.userpwd=NULL;
+    }
+    break;
   }
 
   return CURLE_OK;