ntlm/ntlmBlobPriv.h

   1 /*
   2  * Copyright (c) 2000-2004,2006-2008,2010,2013 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * ntlmBlobPriv.h - Private routines used by NtlmGenerator module.
  26  */
  27
  28 #ifndef _NTLM_BLOB_PRIV_H_
  29 #define _NTLM_BLOB_PRIV_H_
  30
  31 #include <CoreFoundation/CFData.h>
  32 #include <CoreFoundation/CFString.h>
  33 #include <stdint.h>
  34 #include <Security/SecBase.h>
  35 #include <Security/SecBasePriv.h>
  36 #include <libkern/OSByteOrder.h>
  37
  38 #ifdef  __cplusplus
  39 extern "C" {
  40 #endif
  41
  42 #ifndef NDEBUG
  43
  44 #include <stdio.h>
  45
  46 #define dprintf(args...) printf(args)
  47 #else
  48 #define dprintf(args...)
  49 #endif
  50
  51 /*
  52  * Common error returns.
  53  *
  54  * This one for "I don't understand the server blob".
  55  */
  56 #define NTLM_ERR_PARSE_ERR                      errSecParam
  57
  58 /*
  59  * This one for protocol variant mismatch (e.g., app requires NTLMv2 but server
  60  * doesn't accept that).
  61  */
  62 #define NTLM_ERR_PROTOCOL_MISMATCH  errSecAuthFailed
  63
  64 /*
  65  * For debugging using fixed pamaters via sourceforge "test vectors".
  66  */
  67 #define DEBUG_FIXED_CHALLENGE   0
  68
  69 /* handy portable NULL-tolerant free() */
  70 #define CFREE(p)                if(p != NULL) { free(p); }
  71
  72 #define NTLM_SIGNATURE                          "NTLMSSP"
  73 #define NTLM_SIGNATURE_LEN                      8                       /* including NULL! */
  74
  75 #define NTLM_MSG_MARKER_TYPE1           1                       /* first client msg */
  76 #define NTLM_MSG_MARKER_TYPE2           2                       /* server challenge */
  77 #define NTLM_MSG_MARKER_TYPE3           3                       /* client response */
  78
  79 /* Size of a security buffer */
  80 #define NTLM_SIZEOF_SEC_BUF             (sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t))
  81
  82 /* length of server challenge in bytes */
  83 #define NTLM_CHALLENGE_LEN                      8
  84
  85 /* length of client nonce in bytes */
  86 #define NTLM_CLIENT_NONCE_LEN           8
  87
  88 /* length of LM and NTLM responses */
  89 #define NTLM_LM_RESPONSE_LEN            24
  90
  91 /* foreced length of LM-style uppper case password */
  92 #define NTLM_LM_PASSWORD_LEN            14
  93
  94 /*
  95  * Flags - defined here in native endianness; sent over the wire little-endian
  96  */
  97 #define NTLM_NegotiateUnicode           0x00000001
  98 #define NTLM_NegotiateOEM                       0x00000002
  99 #define NTLM_RequestTarget                      0x00000004
 100 #define NTLM_Unknown1                           0x00000008
 101 #define NTLM_NegotiateSign                      0x00000010
 102 #define NTLM_NegotiateSeal                      0x00000020
 103 #define NTLM_NegotiateDatagram          0x00000040
 104 #define NTLM_NegotiateLMKey                     0x00000080
 105 #define NTLM_NegotiateNetware           0x00000100
 106 #define NTLM_NegotiateNTLM                      0x00000200
 107 #define NTLM_Unknown2                           0x00000400
 108 #define NTLM_Unknown3                           0x00000800
 109 #define NTLM_DomainSupplied                     0x00001000
 110 #define NTLM_WorkstationSupplies        0x00002000
 111 #define NTLM_LocalCall                          0x00004000
 112 #define NTLM_AlwaysSign                         0x00008000
 113 #define NTLM_TargetTypeDomain           0x00010000
 114 #define NTLM_TargetTypeServer           0x00020000
 115 #define NTLM_TargetTypeShare            0x00040000
 116 #define NTLM_NegotiateNTLM2Key          0x00080000
 117 #define NTLM_RequestInitResp            0x00100000
 118 #define NTLM_RequestAcceptResp          0x00200000
 119 #define NTLM_RequestNonNTSessionKey 0x00400000
 120 #define NTLM_NegotiateTargetInfo        0x00800000
 121 #define NTLM_Unknown4                           0x01000000
 122 #define NTLM_Unknown5                           0x02000000
 123 #define NTLM_Unknown6                           0x04000000
 124 #define NTLM_Unknown7                           0x08000000
 125 #define NTLM_Unknown8                           0x10000000
 126 #define NTLM_Negotiate128Bit            0x20000000
 127 #define NTLM_NegotiateKeyExchange   0x40000000
 128 #define NTLM_Negotiate56Bit                     0x80000000
 129
 130
 131 /* write a 64-bit word, little endian */
 132 void appendUint64(
 133         CFMutableDataRef        buf,
 134         uint64_t                        word);
 135
 136 /* write a 32-bit word, little endian */
 137 void appendUint32(
 138         CFMutableDataRef        buf,
 139         uint32_t                        word);
 140
 141 /* write a 16-bit word, little endian */
 142 void appendUint16(
 143         CFMutableDataRef        buf,
 144         uint16_t                        word);
 145
 146 /*
 147  * Write a security buffer, providing the index into the CFData at which
 148  * this security buffer's offset is located. Just before the actual data is written,
 149  * go back and update the offset with the start of that data using secBufOffset().
 150  */
 151 void appendSecBuf(
 152         CFMutableDataRef        buf,
 153         uint16_t                        len,
 154         CFIndex                         *offsetIndex);
 155
 156 /*
 157  * Update a security buffer's offset to be the current end of data in a CFData.
 158  */
 159 void secBufOffset(
 160         CFMutableDataRef        buf,
 161         CFIndex                         offsetIndex);           /* obtained from appendSecBuf() */
 162
 163 /*
 164  * Parse/validate a security buffer. Verifies that supplied offset/length don't go
 165  * past end of avaialble data. Returns ptr to actual data and its length. Returns
 166  * errSecParam on bogus values.
 167  */
 168 OSStatus ntlmParseSecBuffer(
 169         const unsigned char *cp,                        /* start of security buffer */
 170         const unsigned char *bufStart,          /* start of whole msg buffer */
 171         unsigned bufLen,                                        /* # of valid bytes starting at bufStart */
 172         const unsigned char **data,                     /* RETURNED, start of actual data */
 173         uint16_t *dataLen);                                     /* RETURNED, length of actual data */
 174
 175 /* random number generator */
 176 void ntlmRand(
 177         unsigned                len,
 178         void                    *buf);                          /* allocated by caller, random data RETURNED */
 179
 180 /* Obtain host name in appropriate encoding */
 181 OSStatus ntlmHostName(
 182         bool                    unicode,
 183         unsigned char   **flat,                         // mallocd and RETURNED
 184         unsigned                *flatLen);                      // RETURNED
 185
 186 void ntlmAppendTimestamp(
 187         CFMutableDataRef ntlmV2Blob);
 188
 189 /*
 190  * Convert CFString to little-endian unicode.
 191  */
 192 void ntlmStringToLE(
 193         CFStringRef             pwd,
 194         unsigned char   **ucode,                // mallocd and RETURNED
 195         unsigned                *ucodeLen);             // RETURNED
 196
 197 /*
 198  * Convert a CFStringRef into a mallocd array of chars suitable for the specified
 199  * encoding. This might return an error if the string can't be converted
 200  * appropriately.
 201  */
 202 OSStatus ntlmStringFlatten(
 203         CFStringRef str,
 204         bool unicode,
 205         unsigned char **flat,                           // mallocd and RETURNED
 206         unsigned *flatLen);                                     // RETURNED
 207
 208 /* MD4 and MD5 hash */
 209 #define NTLM_DIGEST_LENGTH   16
 210 void md4Hash(
 211         const unsigned char *data,
 212         unsigned                        dataLen,
 213         unsigned char           *digest);               // caller-supplied, NTLM_DIGEST_LENGTH */
 214 void md5Hash(
 215         const unsigned char *data,
 216         unsigned                        dataLen,
 217         unsigned char           *digest);               // caller-supplied, NTLM_DIGEST_LENGTH */
 218
 219 /*
 220  * Calculate LM-style password hash. This really only works if the password
 221  * is convertible to ASCII.
 222  */
 223 OSStatus lmPasswordHash(
 224         CFStringRef                     pwd,
 225         unsigned char           *digest);               // caller-supplied, NTLM_DIGEST_LENGTH
 226
 227 /*
 228  * Calculate NTLM password hash (MD4 on a unicode password).
 229  */
 230 void ntlmPasswordHash(
 231         CFStringRef                     pwd,
 232         unsigned char           *digest);               // caller-supplied, NTLM_DIGEST_LENGTH
 233
 234 /*
 235  * NTLM response: DES with three different keys.
 236  */
 237 OSStatus ntlmResponse(
 238         const unsigned char *digest,            // NTLM_DIGEST_LENGTH bytes
 239         const unsigned char *challenge,         // actually challenge or session hash
 240         unsigned char           *ntlmResp);             // caller-supplied NTLM_LM_RESPONSE_LEN
 241
 242 /* DES-related consts */
 243 #define DES_BLOCK_SIZE          8
 244 #define DES_RAW_KEY_SIZE        7
 245 #define DES_KEY_SIZE            8
 246
 247 /*
 248  * Given 7 bytes, create 8-byte DES key. Our implementation ignores the
 249  * parity bit (lsb), which simplifies this somewhat.
 250  */
 251 void ntlmMakeDesKey(
 252         const unsigned char *inKey,                     // DES_RAW_KEY_SIZE bytes
 253         unsigned char *outKey);                         // DES_KEY_SIZE bytes
 254
 255 /*
 256  * single block DES encrypt.
 257  * This would really benefit from a DES implementation in CommonCrypto.
 258  */
 259 OSStatus ntlmDesCrypt(
 260         const unsigned char *key,                       // DES_KEY_SIZE bytes
 261         const unsigned char *inData,            // DES_BLOCK_SIZE bytes
 262         unsigned char *outData);                        // DES_BLOCK_SIZE bytes
 263
 264 /*
 265  * HMAC/MD5.
 266  */
 267 OSStatus ntlmHmacMD5(
 268         const unsigned char *key,
 269         unsigned                        keyLen,
 270         const unsigned char *inData,
 271         unsigned                        inDataLen,
 272         unsigned char           *mac);                  // caller provided, NTLM_DIGEST_LENGTH
 273
 274 #if NTLM_DUMP
 275 void ntlmPrintFlags(
 276         const char *whereFrom,
 277         uint32_t flags);
 278 #else
 279 #define ntlmPrintFlags(w, f)
 280 #endif
 281
 282 #ifdef  __cplusplus
 283 }
 284 #endif
 285
 286 #endif  /* _NTLM_BLOB_PRIV_H_ */