[sserapion] 52014: [NTLMSSP] - Implement NtlmHandleNegotiateMessage NtlmHandleChallengeMessage and NtlmHandleAuthenticateMessage - all wine client server tests pass - still missing a lot of stuff (...
Author: sserapion Date: Mon May 30 21:02:50 2011 New Revision: 52014
URL: http://svn.reactos.org/svn/reactos?rev=52014&view=rev Log: [NTLMSSP] - Implement NtlmHandleNegotiateMessage NtlmHandleChallengeMessage and NtlmHandleAuthenticateMessage - all wine client server tests pass - still missing a lot of stuff (WIP code)
Modified: branches/sspi-bringup/reactos/dll/win32/ntlmssp/context.c branches/sspi-bringup/reactos/dll/win32/ntlmssp/credentials.c branches/sspi-bringup/reactos/dll/win32/ntlmssp/ntlmssp.h branches/sspi-bringup/reactos/dll/win32/ntlmssp/protocol.c branches/sspi-bringup/reactos/dll/win32/ntlmssp/protocol.h
Modified: branches/sspi-bringup/reactos/dll/win32/ntlmssp/context.c URL: http://svn.reactos.org/svn/reactos/branches/sspi-bringup/reactos/dll/win32/n... ============================================================================== --- branches/sspi-bringup/reactos/dll/win32/ntlmssp/context.c [iso-8859-1] (original) +++ branches/sspi-bringup/reactos/dll/win32/ntlmssp/context.c [iso-8859-1] Mon May 30 21:02:50 2011 @@ -391,13 +391,7 @@ ret = NtlmGenerateNegotiateMessage(newContext, fContextReq, InputToken1, - &OutputToken1); - - if(!NT_SUCCESS(ret)) - { - ERR("NtlmGenerateNegotiateMessage failed with %lx\n", ret); - goto fail; - } + OutputToken1);
/* set result */ phNewContext->dwUpper = NegotiateFlags; @@ -406,7 +400,6 @@ else /* challenge! */ { TRACE("ISC challenged!\n"); - *phNewContext = *phContext; if (fContextReq & ISC_REQ_USE_SUPPLIED_CREDS) { /* get second input token */ @@ -421,6 +414,7 @@ } }
+ *phNewContext = *phContext; ret = NtlmHandleChallengeMessage(phNewContext->dwLower, fContextReq, InputToken1, @@ -430,13 +424,12 @@ pfContextAttr, ptsExpiry, &NegotiateFlags); - - if(!NT_SUCCESS(ret)) - { - ERR("NtlmHandleChallengeMessage failed with %lx\n", ret); - goto fail; - } - + } + + if(!NT_SUCCESS(ret)) + { + ERR("failed with %lx\n", ret); + goto fail; }
/* build blob with the output message */ @@ -575,7 +568,7 @@ { SECURITY_STATUS ret = SEC_E_OK; PSecBuffer InputToken1, InputToken2; - PSecBuffer OutputToken1; + PSecBuffer OutputToken1, OutputToken2;
TRACE("AcceptSecurityContext %p %p %p %lx %lx %p %p %p %p\n", phCredential, phContext, pInput, fContextReq, TargetDataRep, phNewContext, pOutput, pfContextAttr, ptsExpiry); @@ -614,29 +607,56 @@ }
/* first call */ - if(!phContext && !InputToken2) + if(!phContext)// && !InputToken2) { if(!phCredential) { ret = SEC_E_INVALID_HANDLE; goto fail; } - + TRACE("phNewContext->dwLower %lx\n", phNewContext->dwLower); ret = NtlmHandleNegotiateMessage(phCredential->dwLower, - &phNewContext->dwLower, + phNewContext->dwLower, fContextReq, InputToken1, - &OutputToken1, + InputToken2, + OutputToken1, + OutputToken2, pfContextAttr, ptsExpiry); } else { - WARN("Handle Authenticate UNIMPLEMENTED!\n"); - } - //if(!NT_SUCCESS(ret)) - - UNIMPLEMENTED; + *phNewContext = *phContext; + USER_SESSION_KEY sessionKey; + ULONG userflags; + TRACE("phNewContext->dwLower %lx\n", phNewContext->dwLower); + ret = NtlmHandleAuthenticateMessage(phNewContext->dwLower, + fContextReq, + InputToken1, + OutputToken1, + pfContextAttr, + ptsExpiry, + (PUCHAR)&sessionKey, + &userflags); + } + + if(!NT_SUCCESS(ret)) + { + ERR("failed with %lx\n", ret); + goto fail; + } + + /* build blob with the output message */ + SecBufferDesc BufferDesc; + BufferDesc.ulVersion = SECBUFFER_VERSION; + BufferDesc.cBuffers = 1; + BufferDesc.pBuffers = OutputToken1; + + if(fContextReq & ASC_REQ_ALLOCATE_MEMORY) + *pfContextAttr |= ASC_RET_ALLOCATED_MEMORY; + + *pOutput = BufferDesc; return ret; fail: return ret; @@ -703,7 +723,6 @@ ApplyControlToken(IN PCtxtHandle phContext, IN PSecBufferDesc pInput) { - UNIMPLEMENTED; return SEC_E_UNSUPPORTED_FUNCTION; }
Modified: branches/sspi-bringup/reactos/dll/win32/ntlmssp/credentials.c URL: http://svn.reactos.org/svn/reactos/branches/sspi-bringup/reactos/dll/win32/n... ============================================================================== --- branches/sspi-bringup/reactos/dll/win32/ntlmssp/credentials.c [iso-8859-1] (original) +++ branches/sspi-bringup/reactos/dll/win32/ntlmssp/credentials.c [iso-8859-1] Mon May 30 21:02:50 2011 @@ -53,7 +53,7 @@
/* sanity */ ASSERT(cred); - TRACE("%p refcount %d\n",cred, cred->RefCount); + TRACE("%p refcount %lx\n",cred, cred->RefCount); ASSERT(cred->RefCount > 0);
/* reference */ @@ -73,7 +73,7 @@
/* sanity */ ASSERT(cred); - TRACE("%p refcount %d\n",cred, cred->RefCount); + TRACE("%p refcount %lx\n",cred, cred->RefCount); ASSERT(cred->RefCount >= 1);
/* decrement reference */ @@ -137,7 +137,7 @@ { SECURITY_STATUS ret;
- TRACE("(%p, %d, %p)\n", phCredential, ulAttribute, pBuffer); + TRACE("(%p, %lx, %p)\n", phCredential, ulAttribute, pBuffer);
if(ulAttribute == SECPKG_ATTR_NAMES) { @@ -158,7 +158,7 @@ { SECURITY_STATUS ret;
- TRACE("(%p, %d, %p)\n", phCredential, ulAttribute, pBuffer); + TRACE("(%p, %lx, %p)\n", phCredential, ulAttribute, pBuffer);
if(ulAttribute == SECPKG_ATTR_NAMES) {
Modified: branches/sspi-bringup/reactos/dll/win32/ntlmssp/ntlmssp.h URL: http://svn.reactos.org/svn/reactos/branches/sspi-bringup/reactos/dll/win32/n... ============================================================================== --- branches/sspi-bringup/reactos/dll/win32/ntlmssp/ntlmssp.h [iso-8859-1] (original) +++ branches/sspi-bringup/reactos/dll/win32/ntlmssp/ntlmssp.h [iso-8859-1] Mon May 30 21:02:50 2011 @@ -46,9 +46,12 @@
extern UNICODE_STRING NtlmComputerNameString; extern UNICODE_STRING NtlmDomainNameString; +extern UNICODE_STRING NtlmDnsNameString; extern OEM_STRING NtlmOemComputerNameString; extern OEM_STRING NtlmOemDomainNameString; +extern OEM_STRING NtlmOemDnsNameString; extern HANDLE NtlmSystemSecurityToken; +extern UNICODE_STRING NtlmAvTargetInfo; // contains AV pairs with local info
typedef enum _NTLM_MODE { NtlmLsaMode = 1,
Modified: branches/sspi-bringup/reactos/dll/win32/ntlmssp/protocol.c URL: http://svn.reactos.org/svn/reactos/branches/sspi-bringup/reactos/dll/win32/n... ============================================================================== --- branches/sspi-bringup/reactos/dll/win32/ntlmssp/protocol.c [iso-8859-1] (original) +++ branches/sspi-bringup/reactos/dll/win32/ntlmssp/protocol.c [iso-8859-1] Mon May 30 21:02:50 2011 @@ -26,7 +26,7 @@ NtlmGenerateNegotiateMessage(IN ULONG_PTR Context, IN ULONG ContextReq, IN PSecBuffer InputToken, - OUT PSecBuffer *OutputToken) + OUT PSecBuffer OutputToken) { PNTLMSSP_CONTEXT context = (PNTLMSSP_CONTEXT)Context; PNTLMSSP_CREDENTIAL cred = context->Credential; @@ -35,13 +35,13 @@ ULONG_PTR offset; NTLM_BLOB blobBuffer[2]; //nego contains 2 blobs
- if(!*OutputToken) + if(!OutputToken) { ERR("No output token!\n"); return SEC_E_BUFFER_TOO_SMALL; }
- if(!((*OutputToken)->pvBuffer)) + if(!(OutputToken->pvBuffer)) { /* according to wine test */ ERR("No output buffer!\n"); @@ -56,23 +56,21 @@ if (!(ContextReq & ISC_REQ_ALLOCATE_MEMORY)) { /* not enough space */ - if(messageSize > (*OutputToken)->cbBuffer) + if(messageSize > OutputToken->cbBuffer) return SEC_E_BUFFER_TOO_SMALL; } else { /* allocate */ - (*OutputToken)->pvBuffer = NtlmAllocate(messageSize); - (*OutputToken)->cbBuffer = messageSize; - - if(!(*OutputToken)->pvBuffer) + OutputToken->pvBuffer = NtlmAllocate(messageSize); + OutputToken->cbBuffer = messageSize; + + if(!OutputToken->pvBuffer) return SEC_E_INSUFFICIENT_MEMORY; }
/* allocate a negotiate message */ - message = (PNEGOTIATE_MESSAGE) NtlmAllocate(messageSize); - - if(!message) + if(!(message = (PNEGOTIATE_MESSAGE) NtlmAllocate(messageSize))) return SEC_E_INSUFFICIENT_MEMORY;
/* build message */ @@ -110,11 +108,12 @@ blobBuffer[1].Offset = offset+1; }
+ /* zero struct */ memset(&message->Version, 0, sizeof(NTLM_WINDOWS_VERSION));
/* send it back */ - memcpy((*OutputToken)->pvBuffer, message, messageSize); - (*OutputToken)->cbBuffer = messageSize; + memcpy(OutputToken->pvBuffer, message, messageSize); + OutputToken->cbBuffer = messageSize; context->State = NegotiateSent;
TRACE("context %p context->NegotiateFlags:\n",context); @@ -128,40 +127,53 @@
SECURITY_STATUS NtlmHandleNegotiateMessage(IN ULONG_PTR hCredential, - IN OUT PULONG_PTR phContext, + IN OUT ULONG_PTR hContext, IN ULONG ContextReq, IN PSecBuffer InputToken, - OUT PSecBuffer *pOutputToken, + IN PSecBuffer InputToken2, + OUT PSecBuffer OutputToken, + OUT PSecBuffer OutputToken2, OUT PULONG pContextAttr, OUT PTimeStamp ptsExpiry) { SECURITY_STATUS ret = SEC_E_OK; PNEGOTIATE_MESSAGE negoMessage = NULL; PNTLMSSP_CREDENTIAL cred = NULL; - PNTLMSSP_CONTEXT newContext = NULL; - - ERR("NtlmHandleNegotiateMessage called!\n"); - - /* InputToken should contain a negotiate message*/ + PNTLMSSP_CONTEXT context = NULL; + UNICODE_STRING targetName; + OEM_STRING OemDomainName, OemWorkstationName; + ULONG targetFlags = 0; + BOOLEAN isUnicode; + + TRACE("NtlmHandleNegotiateMessage hContext %lx\n", hContext); + if(!(context = NtlmAllocateContext())) + { + ret = SEC_E_INSUFFICIENT_MEMORY; + ERR("SEC_E_INSUFFICIENT_MEMORY!\n"); + goto exit; + } + + hContext = (ULONG_PTR)context; + TRACE("NtlmHandleNegotiateMessage hContext %lx\n", hContext); + + /* InputToken should contain a negotiate message */ if(InputToken->cbBuffer > NTLM_MAX_BUF || InputToken->cbBuffer < sizeof(NEGOTIATE_MESSAGE)) { - ERR("Input token too big!!\n"); + ERR("Input wrong size!!\n"); ret = SEC_E_INVALID_TOKEN; goto exit; }
/* allocate a buffer for it */ - negoMessage = NtlmAllocate(InputToken->cbBuffer); - - if(!negoMessage) + if(!(negoMessage = NtlmAllocate(sizeof(NEGOTIATE_MESSAGE)))) { ret = SEC_E_INSUFFICIENT_MEMORY; goto exit; }
/* copy it */ - memcpy(negoMessage, InputToken->pvBuffer, InputToken->cbBuffer); + memcpy(negoMessage, InputToken->pvBuffer, sizeof(NEGOTIATE_MESSAGE));
/* validate it */ if(strncmp(negoMessage->Signature, NTLMSSP_SIGNATURE, 8) && @@ -176,9 +188,11 @@ NtlmPrintNegotiateFlags(negoMessage->NegotiateFlags);
/* get credentials */ - cred = NtlmReferenceCredential(hCredential); - if(!cred) + if(!(cred = NtlmReferenceCredential(hCredential))) + { + ret = SEC_E_INVALID_TOKEN; goto exit; + }
/* must be an incomming request */ if(!(cred->UseFlags & SECPKG_CRED_INBOUND)) @@ -187,72 +201,199 @@ goto exit; }
- /* create new context */ - newContext = NtlmAllocateContext(); - if(!newContext) + /* convert flags */ + if(ContextReq & ASC_REQ_IDENTIFY) + { + *pContextAttr |= ASC_RET_IDENTIFY; + context->ContextFlags |= ASC_RET_IDENTIFY; + } + + if(ContextReq & ASC_REQ_DATAGRAM) + { + *pContextAttr |= ASC_RET_DATAGRAM; + context->ContextFlags |= ASC_RET_DATAGRAM; + } + + if(ContextReq & ASC_REQ_CONNECTION) + { + *pContextAttr |= ASC_RET_CONNECTION; + context->ContextFlags |= ASC_RET_CONNECTION; + } + + if(ContextReq & ASC_REQ_INTEGRITY) + { + *pContextAttr |= ASC_RET_INTEGRITY; + context->ContextFlags |= ASC_RET_INTEGRITY; + } + + if(ContextReq & ASC_REQ_REPLAY_DETECT) + { + *pContextAttr |= ASC_RET_REPLAY_DETECT; + context->ContextFlags |= ASC_RET_REPLAY_DETECT; + } + + if(ContextReq & ASC_REQ_SEQUENCE_DETECT) + { + *pContextAttr |= ASC_RET_SEQUENCE_DETECT; + context->ContextFlags |= ASC_RET_SEQUENCE_DETECT; + } + + if(ContextReq & ASC_REQ_ALLOW_NULL_SESSION) + { + context->ContextFlags |= ASC_REQ_ALLOW_NULL_SESSION; + } + + if(ContextReq & ASC_REQ_ALLOW_NON_USER_LOGONS) + { + *pContextAttr |= ASC_RET_ALLOW_NON_USER_LOGONS; + context->ContextFlags |= ASC_RET_ALLOW_NON_USER_LOGONS; + } + + /* encryption */ + if(ContextReq & ASC_REQ_CONFIDENTIALITY) + { + *pContextAttr |= ASC_RET_CONFIDENTIALITY; + context->ContextFlags |= ASC_RET_CONFIDENTIALITY; + } + + if (negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY || + negoMessage->NegotiateFlags & NTLMSSP_REQUEST_TARGET) + { + targetFlags |= NTLMSSP_TARGET_TYPE_SERVER | NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO; + + if (negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_UNICODE) + { + isUnicode = TRUE; + targetFlags |= NTLMSSP_NEGOTIATE_UNICODE; + RtlInitUnicodeString(&targetName, NtlmComputerNameString.Buffer); + } + else if(negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_OEM) + { + isUnicode = FALSE; + targetFlags |= NTLMSSP_NEGOTIATE_OEM; + RtlInitUnicodeString(&targetName, (PWCHAR)&NtlmOemComputerNameString.Buffer); + } + else + { + ret = SEC_E_INVALID_TOKEN; + ERR("flags invalid!\n"); + goto exit; + } + } + + /* create a challenge message */ + PCHALLENGE_MESSAGE chaMessage = NULL; + ULONG messageSize = sizeof(CHALLENGE_MESSAGE)+ targetName.Length + 1 + NtlmAvTargetInfo.Length; + ULONG offset; + + /* ntlm does not listen to ASC_REQ_ALLOCATE_MEMORY or lack thereof */ + /* further more the buffer size is always NTLM_MAX_BUF */ + /* allocate output buffer */ + OutputToken->pvBuffer = NtlmAllocate(NTLM_MAX_BUF); + OutputToken->cbBuffer = messageSize; + + if(!OutputToken->pvBuffer) { ret = SEC_E_INSUFFICIENT_MEMORY; goto exit; }
- *phContext = (ULONG_PTR)newContext; - - if(ContextReq & ASC_REQ_IDENTIFY) - { + /* allocate message */ + if (!(chaMessage = (PCHALLENGE_MESSAGE)NtlmAllocate(messageSize))) + { + ret = SEC_E_INSUFFICIENT_MEMORY; + goto exit; + } + + TRACE("message %p size %lu\n", chaMessage, messageSize); + + /* build message */ + strcpy(chaMessage->Signature, NTLMSSP_SIGNATURE); + chaMessage->MsgType = NtlmChallenge; + chaMessage->NegotiateFlags = context->NegotiateFlags; + chaMessage->NegotiateFlags |= NTLMSSP_NEGOTIATE_NTLM; + + /* generate challenge */ + NtlmGenerateRandomBits(chaMessage->ServerChallenge, MSV1_0_CHALLENGE_LENGTH); + memcpy(context->Challenge, chaMessage->ServerChallenge, MSV1_0_CHALLENGE_LENGTH); + + offset = (ULONG_PTR)(chaMessage+1); + + if(negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) + { + negoMessage->NegotiateFlags &= ~NTLMSSP_NEGOTIATE_LM_KEY; + chaMessage->NegotiateFlags |= NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY; + } + else if(negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_LM_KEY) + { + chaMessage->NegotiateFlags |= NTLMSSP_NEGOTIATE_LM_KEY; + } + + if(negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN) + chaMessage->NegotiateFlags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN; + + if(negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_SIGN) + { + chaMessage->NegotiateFlags |= NTLMSSP_NEGOTIATE_SIGN; + *pContextAttr |= (ASC_RET_SEQUENCE_DETECT | ASC_RET_REPLAY_DETECT); + context->ContextFlags |= (ASC_RET_SEQUENCE_DETECT | ASC_RET_REPLAY_DETECT); + } + + if (negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_SEAL) + { + chaMessage->NegotiateFlags |= NTLMSSP_NEGOTIATE_SEAL; + *pContextAttr |= ASC_RET_CONFIDENTIALITY; + context->ContextFlags |= ASC_RET_CONFIDENTIALITY; + } + + if(negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_KEY_EXCH) + chaMessage->NegotiateFlags |= NTLMSSP_NEGOTIATE_KEY_EXCH; + + /* client requested encryption */ + if(negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_128) + chaMessage->NegotiateFlags |= NTLMSSP_NEGOTIATE_128; + else if(negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_56) + chaMessage->NegotiateFlags |= NTLMSSP_NEGOTIATE_56; + + if(negoMessage->NegotiateFlags & NTLMSSP_REQUEST_INIT_RESP) + { + chaMessage->NegotiateFlags |= NTLMSSP_REQUEST_INIT_RESP; *pContextAttr |= ASC_RET_IDENTIFY; - newContext->ContextFlags |= ASC_RET_IDENTIFY; - } - - if(ContextReq & ASC_REQ_DATAGRAM) - { - *pContextAttr |= ASC_RET_DATAGRAM; - newContext->ContextFlags |= ASC_RET_DATAGRAM; - } - - if(ContextReq & ASC_REQ_CONNECTION) - { - *pContextAttr |= ASC_RET_CONNECTION; - newContext->ContextFlags |= ASC_RET_CONNECTION; - } - - if(ContextReq & ASC_REQ_INTEGRITY) - { - *pContextAttr |= ASC_RET_INTEGRITY; - newContext->ContextFlags |= ASC_RET_INTEGRITY; - } - - if(ContextReq & ASC_REQ_REPLAY_DETECT) - { - *pContextAttr |= ASC_RET_REPLAY_DETECT; - newContext->ContextFlags |= ASC_RET_REPLAY_DETECT; - } - - if(ContextReq & ASC_REQ_SEQUENCE_DETECT) - { - *pContextAttr |= ASC_RET_SEQUENCE_DETECT; - newContext->ContextFlags |= ASC_RET_SEQUENCE_DETECT; - } - - if(ContextReq & ASC_REQ_ALLOW_NULL_SESSION) - { - newContext->ContextFlags |= ASC_REQ_ALLOW_NULL_SESSION; - } - - if(ContextReq & ASC_REQ_ALLOW_NON_USER_LOGONS) - { - *pContextAttr |= ASC_RET_ALLOW_NON_USER_LOGONS; - newContext->ContextFlags |= ASC_RET_ALLOW_NON_USER_LOGONS; - } - - /* encryption */ - if(ContextReq & ASC_REQ_CONFIDENTIALITY) - { - *pContextAttr |= ASC_RET_CONFIDENTIALITY; - newContext->ContextFlags |= ASC_RET_CONFIDENTIALITY; - } + context->ContextFlags |= ASC_RET_IDENTIFY; + } + + /* check for local call */ + if((negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED) && + (negoMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED)) + { + NtlmBlobToUnicodeString(InputToken, negoMessage->OemDomainName, (PUNICODE_STRING)&OemDomainName); + NtlmBlobToUnicodeString(InputToken, negoMessage->OemWorkstationName, (PUNICODE_STRING)&OemWorkstationName); + + if (RtlEqualString(&OemWorkstationName, &NtlmOemComputerNameString, FALSE)&& + RtlEqualString(&OemDomainName, &NtlmOemDomainNameString, FALSE)) + { + TRACE("local negotiate detected!\n"); + chaMessage->NegotiateFlags |= NTLMSSP_NEGOTIATE_LOCAL_CALL; + } + } + + NtlmUnicodeStringToBlob((PVOID)chaMessage, &targetName, &chaMessage->TargetName, &offset); + NtlmUnicodeStringToBlob((PVOID)chaMessage, &NtlmAvTargetInfo, &chaMessage->TargetInfo, &offset); + chaMessage->NegotiateFlags |= targetFlags; + + memcpy(OutputToken->pvBuffer, chaMessage, messageSize); + OutputToken->cbBuffer = messageSize; + context->State = ChallengeSent; + ret = SEC_I_CONTINUE_NEEDED;
exit: - ERR("FIXME: HERE!!!!!!!!!!!!!!!"); + if(chaMessage) NtlmFree(chaMessage); + if(negoMessage) NtlmFree(negoMessage); + if(cred) NtlmDereferenceCredential((ULONG_PTR)cred); + if(targetName.Buffer) NtlmFree(targetName.Buffer); + if(OemDomainName.Buffer) NtlmFree(OemDomainName.Buffer); + if(OemWorkstationName.Buffer) NtlmFree(OemWorkstationName.Buffer); + return ret; }
@@ -261,59 +402,60 @@ IN ULONG ContextReq, IN PSecBuffer InputToken1, IN PSecBuffer InputToken2, - IN OUT PSecBuffer *OutputToken1, - IN OUT PSecBuffer *OutputToken2, + IN OUT PSecBuffer OutputToken1, + IN OUT PSecBuffer OutputToken2, OUT PULONG pContextAttr, OUT PTimeStamp ptsExpiry, OUT PULONG NegotiateFlags) { SECURITY_STATUS ret = SEC_E_OK; - PNTLMSSP_CONTEXT context; - PCHALLENGE_MESSAGE challenge; + PNTLMSSP_CONTEXT context = NULL; + PCHALLENGE_MESSAGE challenge = NULL; + PNTLMSSP_CREDENTIAL cred = NULL; BOOLEAN isUnicode;
+ TRACE("NtlmHandleChallengeMessage hContext %lx\n", hContext); /* get context */ context = NtlmReferenceContext(hContext); if(!context || !context->Credential) { ERR("NtlmHandleChallengeMessage invalid handle!\n"); ret = SEC_E_INVALID_HANDLE; - goto exit; + goto fail; }
/* re-authenticate call */ if(context->State == AuthenticateSent) { UNIMPLEMENTED; + goto fail; } else if(context->State != NegotiateSent) { - ERR("Context not in negotiate sent state!\n"); + ERR("Context not in correct state!\n"); ret = SEC_E_OUT_OF_SEQUENCE; - goto exit; + goto fail; }
/* InputToken1 should contain a challenge message */ - TRACE("input token size %lx\n", InputToken1->cbBuffer); if(InputToken1->cbBuffer > NTLM_MAX_BUF || InputToken1->cbBuffer < sizeof(CHALLENGE_MESSAGE)) { ERR("Input token invalid!\n"); ret = SEC_E_INVALID_TOKEN; - goto exit; + goto fail; }
/* allocate a buffer for it */ - challenge = NtlmAllocate(InputToken1->cbBuffer); - if(!challenge) + if(!(challenge = NtlmAllocate(sizeof(CHALLENGE_MESSAGE)))) { ERR("failed to allocate challenge buffer!\n"); ret = SEC_E_INSUFFICIENT_MEMORY; - goto exit; + goto fail; }
/* copy it */ - memcpy(challenge, InputToken1->pvBuffer, InputToken1->cbBuffer); + memcpy(challenge, InputToken1->pvBuffer, sizeof(CHALLENGE_MESSAGE));
/* validate it */ if(strncmp(challenge->Signature, NTLMSSP_SIGNATURE, 8) && @@ -321,14 +463,14 @@ { ERR("Input message not valid!\n"); ret = SEC_E_INVALID_TOKEN; - goto exit; + goto fail; }
TRACE("Got valid challege message! with flags:\n"); NtlmPrintNegotiateFlags(challenge->NegotiateFlags);
/* print challenge message and payloads */ - NtlmPrintHexDump((PBYTE)challenge, InputToken1->cbBuffer); + NtlmPrintHexDump((PBYTE)InputToken1->pvBuffer, InputToken1->cbBuffer);
if(challenge->NegotiateFlags & NTLMSSP_NEGOTIATE_DATAGRAM) { @@ -364,14 +506,14 @@ /* these flags must be bad! */ ERR("challenge flags did not specify unicode or oem!\n"); ret = SEC_E_INVALID_TOKEN; - goto exit; + goto fail; }
/* support ntlm2 */ if(challenge->NegotiateFlags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) { challenge->NegotiateFlags &= ~NTLMSSP_NEGOTIATE_LM_KEY; - context->NegotiateFlags &= ~(NTLMSSP_NEGOTIATE_LM_KEY); + context->NegotiateFlags &= ~NTLMSSP_NEGOTIATE_LM_KEY; } else { @@ -383,7 +525,7 @@ { ERR("netware authentication not supported!!!\n"); ret = SEC_E_UNSUPPORTED_FUNCTION; - goto exit; + goto fail; } }
@@ -430,7 +572,7 @@ if(!NT_SUCCESS(ret)) { ERR("could not get target info!\n"); - goto exit; + goto fail; } } else @@ -444,20 +586,23 @@ if(!NT_SUCCESS(ret)) { ERR("could not get target info!\n"); - goto exit; + goto fail; } if(isUnicode) FIXME("convert to unicode!\n"); } - TRACE("ServerName %s\n", debugstr_w(ServerName.Buffer)); - - PNTLMSSP_CREDENTIAL cred = NtlmReferenceCredential((ULONG_PTR)context->Credential); + + MSV1_0_NTLM3_RESPONSE NtResponse; LM2_RESPONSE Lm2Response; USER_SESSION_KEY UserSessionKey; LM_SESSION_KEY LmSessionKey;
- NtlmUnProtectMemory(cred->Password.Buffer, cred->Password.Length * sizeof(WCHAR)); + if(!(cred = NtlmReferenceCredential((ULONG_PTR)context->Credential))) + goto fail; + + /* unscramble password */ + NtlmUnProtectMemory(cred->Password.Buffer, cred->Password.Length);
TRACE("cred: %s %s %s\n", debugstr_w(cred->UserName.Buffer), debugstr_w(cred->Password.Buffer), debugstr_w(cred->DomainName.Buffer)); @@ -472,9 +617,255 @@ &UserSessionKey, &LmSessionKey);
-exit: + PAUTHENTICATE_MESSAGE authmessage = NULL; + ULONG_PTR offset; + + UNICODE_STRING NtResponseString; + //UNICODE_STRING LmResponseString; + UNICODE_STRING UserSessionKeyString; + UNICODE_STRING LmSessionKeyString; + +#define InitString(str, input) str.MaximumLength = str.Length = sizeof(input)*sizeof(WCHAR); str.Buffer = (WCHAR*)&input + InitString(NtResponseString, NtResponse); + //InitString(LmResponseString, Lm2Response); + InitString(UserSessionKeyString, UserSessionKey); + InitString(LmSessionKeyString, LmSessionKey); + + ULONG messageSize = sizeof(AUTHENTICATE_MESSAGE) + + ServerName.Length + cred->UserName.Length + cred->DomainName.Length + + NtResponseString.Length + UserSessionKeyString.Length + LmSessionKeyString.Length; + //LmResponseString.Length; + + if(!(authmessage = NtlmAllocate(messageSize))) + { + ret = SEC_E_INSUFFICIENT_MEMORY; + goto fail; + } + + strcpy(authmessage->Signature, NTLMSSP_SIGNATURE); + authmessage->MsgType = NtlmAuthenticate; + + offset = (ULONG_PTR)(authmessage+1); + + NtlmUnicodeStringToBlob((PVOID)authmessage, + &cred->DomainName, + &authmessage->DomainName, + &offset); + + NtlmUnicodeStringToBlob((PVOID)authmessage, + &cred->UserName, + &authmessage->UserName, + &offset); + + NtlmUnicodeStringToBlob((PVOID)authmessage, + &ServerName, + &authmessage->WorkstationName, + &offset); + + //if(targetinfo) + //NtlmUnicodeStringToBlob((PVOID)authmessage, + // &LmResponseString, + // &authmessage->LmChallengeResponse, + // &offset); + + NtlmUnicodeStringToBlob((PVOID)authmessage, + &NtResponseString, + &authmessage->NtChallengeResponse, + &offset); + + NtlmUnicodeStringToBlob((PVOID)authmessage, + &UserSessionKeyString, + &authmessage->EncryptedRandomSessionKey, + &offset); + + /* if should not allocate */ + if (!(ContextReq & ISC_REQ_ALLOCATE_MEMORY)) + { + /* not enough space */ + if(messageSize > OutputToken1->cbBuffer) + { + ret = SEC_E_BUFFER_TOO_SMALL; + goto fail; + } + } + else + { + /* allocate */ + if(!(OutputToken1->pvBuffer = NtlmAllocate(messageSize))) + { + ret = SEC_E_INSUFFICIENT_MEMORY; + goto fail; + } + } + + OutputToken1->cbBuffer = messageSize; /* says wine test */ + memcpy(OutputToken1->pvBuffer, authmessage, messageSize); + context->State = AuthenticateSent; + ret = SEC_E_OK; + +fail: + if(authmessage) NtlmFree(authmessage); + if(context) NtlmDereferenceContext((ULONG_PTR)context); + if(cred) NtlmDereferenceCredential((ULONG_PTR)cred); ERR("handle challenge end\n"); - return ret; }
+SECURITY_STATUS +NtlmHandleAuthenticateMessage(IN ULONG_PTR hContext, + IN ULONG ContextReq, + IN PSecBuffer InputToken, + OUT PSecBuffer OutputToken, + OUT PULONG pContextAttr, + OUT PTimeStamp ptsExpiry, + OUT PUCHAR pSessionKey, + OUT PULONG pfUserFlags) +{ + SECURITY_STATUS ret = SEC_E_OK; + PNTLMSSP_CONTEXT context = NULL; + PAUTHENTICATE_MESSAGE authMessage = NULL; + BOOLEAN isUnicode; + + TRACE("NtlmHandleAuthenticateMessage hContext %x!\n", hContext); + /* get context */ + if(!(context = NtlmReferenceContext(hContext))) + { + ret = SEC_E_INVALID_HANDLE; + goto fail; + } + + TRACE("context->State %d\n", context->State); + if(context->State != ChallengeSent || context->State != Authenticated) + { + ERR("Context not in correct state!\n"); + ret = SEC_E_OUT_OF_SEQUENCE; + goto fail; + } + + /* re-authorize */ + if(context->State == Authenticated) + UNIMPLEMENTED; + + /* InputToken1 should contain a authenticate message */ + TRACE("input token size %lx\n", InputToken->cbBuffer); + if(InputToken->cbBuffer > NTLM_MAX_BUF || + InputToken->cbBuffer < sizeof(AUTHENTICATE_MESSAGE)) + { + ERR("Input token invalid!\n"); + ret = SEC_E_INVALID_TOKEN; + goto fail; + } + + /* allocate a buffer for it */ + if(!(authMessage = NtlmAllocate(sizeof(AUTHENTICATE_MESSAGE)))) + { + ERR("failed to allocate authMessage buffer!\n"); + ret = SEC_E_INSUFFICIENT_MEMORY; + goto fail; + } + + /* copy it */ + memcpy(authMessage, InputToken->pvBuffer, sizeof(AUTHENTICATE_MESSAGE)); + + /* validate it */ + if(strncmp(authMessage->Signature, NTLMSSP_SIGNATURE, 8) && + authMessage->MsgType == NtlmAuthenticate) + { + ERR("Input message not valid!\n"); + ret = SEC_E_INVALID_TOKEN; + goto fail; + } + + /* datagram */ + if(context->NegotiateFlags & NTLMSSP_NEGOTIATE_DATAGRAM) + { + /* context and message dont agree on connection type! */ + if(!(authMessage->NegotiateFlags & NTLMSSP_NEGOTIATE_DATAGRAM)) + { + ret = SEC_E_INVALID_TOKEN; + goto fail; + } + + /* use message flags */ + context->NegotiateFlags = authMessage->NegotiateFlags; + + /* need a key */ + if(context->NegotiateFlags & (NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL)) + context->NegotiateFlags |= NTLMSSP_NEGOTIATE_KEY_EXCH; + + /* remove lm key */ + if (context->NegotiateFlags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) + context->NegotiateFlags &= ~NTLMSSP_NEGOTIATE_LM_KEY; + } + + /* supports unicode */ + if(context->NegotiateFlags & NTLMSSP_NEGOTIATE_UNICODE) + { + context->NegotiateFlags &= ~NTLMSSP_NEGOTIATE_OEM; + isUnicode = TRUE; + } + else if(context->NegotiateFlags & NTLMSSP_NEGOTIATE_OEM) + { + context->NegotiateFlags &= ~NTLMSSP_NEGOTIATE_UNICODE; + isUnicode = FALSE; + } + else + { + /* these flags must be bad! */ + ERR("authenticate flags did not specify unicode or oem!\n"); + ret = SEC_E_INVALID_TOKEN; + goto fail; + } + + UNICODE_STRING LmChallengeResponse, NtChallengeResponse, SessionKey; + UNICODE_STRING UserName, Workstation, DomainName; + + if(!NT_SUCCESS(NtlmBlobToUnicodeString(InputToken, + authMessage->LmChallengeResponse, &LmChallengeResponse))) + { + ret = SEC_E_INVALID_TOKEN; + goto fail; + } + + if(!NT_SUCCESS(NtlmBlobToUnicodeString(InputToken, + authMessage->NtChallengeResponse, &NtChallengeResponse))) + { + ret = SEC_E_INVALID_TOKEN; + goto fail; + } + + if(!NT_SUCCESS(NtlmBlobToUnicodeString(InputToken, + authMessage->UserName, &UserName))) + { + ret = SEC_E_INVALID_TOKEN; + goto fail; + } + + if(!NT_SUCCESS(NtlmBlobToUnicodeString(InputToken, + authMessage->WorkstationName, &Workstation))) + { + ret = SEC_E_INVALID_TOKEN; + goto fail; + } + + if(!NT_SUCCESS(NtlmBlobToUnicodeString(InputToken, + authMessage->DomainName, &DomainName))) + { + ret = SEC_E_INVALID_TOKEN; + goto fail; + } + + //if(NTLMSSP_NEGOTIATE_KEY_EXCHANGE) + if(!NT_SUCCESS(NtlmBlobToUnicodeString(InputToken, + authMessage->EncryptedRandomSessionKey, &SessionKey))) + { + ret = SEC_E_INVALID_TOKEN; + goto fail; + } + + ret = SEC_I_COMPLETE_NEEDED; + +fail: + NtlmDereferenceContext((ULONG_PTR)context); + return ret; +}
Modified: branches/sspi-bringup/reactos/dll/win32/ntlmssp/protocol.h URL: http://svn.reactos.org/svn/reactos/branches/sspi-bringup/reactos/dll/win32/n... ============================================================================== --- branches/sspi-bringup/reactos/dll/win32/ntlmssp/protocol.h [iso-8859-1] (original) +++ branches/sspi-bringup/reactos/dll/win32/ntlmssp/protocol.h [iso-8859-1] Mon May 30 21:02:50 2011 @@ -164,6 +164,14 @@ /* payload */ }AUTHENTICATE_MESSAGE, *PAUTHENTICATE_MESSAGE;
+typedef struct _MESSAGE_SIGNATURE +{ + ULONG Version; + ULONG RandomPad; + ULONG Checksum; + ULONG Nonce; +}MESSAGE_SIGNATURE, *PMESSAGE_SIGNATURE; + /* basic functions */
VOID @@ -173,14 +181,14 @@
VOID NTOWFv2( - PWCHAR password, - PWCHAR user, - PWCHAR domain, + const PWCHAR password, + const PWCHAR user, + const PWCHAR domain, PUCHAR result);
VOID LMOWFv1( - PCCHAR password, + const PCCHAR password, PUCHAR result);
VOID @@ -275,15 +283,17 @@ IN ULONG_PTR hContext, IN ULONG ContextReq, IN PSecBuffer InputToken, - OUT PSecBuffer *OutputToken); + OUT PSecBuffer OutputToken);
SECURITY_STATUS NtlmHandleNegotiateMessage( IN ULONG_PTR hCredential, - IN OUT PULONG_PTR phContext, + IN OUT ULONG_PTR hContext, IN ULONG fContextReq, - IN PSecBuffer InputToken, - OUT PSecBuffer *OutputToken, + IN PSecBuffer InputToken1, + IN PSecBuffer InputToken2, + OUT PSecBuffer OutputToken1, + OUT PSecBuffer OutputToken2, OUT PULONG pContextAttr, OUT PTimeStamp ptsExpiry);
@@ -293,8 +303,8 @@ IN ULONG ContextReq, IN PSecBuffer InputToken1, IN PSecBuffer InputToken2, - IN OUT PSecBuffer *OutputToken1, - IN OUT PSecBuffer *OutputToken2, + IN OUT PSecBuffer OutputToken1, + IN OUT PSecBuffer OutputToken2, OUT PULONG ContextAttr, OUT PTimeStamp ptsExpiry, OUT PULONG NegotiateFlags); @@ -303,15 +313,11 @@ NtlmHandleAuthenticateMessage( IN ULONG_PTR hContext, IN ULONG fContextReq, - IN PSecBuffer *pInputTokens, + IN PSecBuffer InputToken, OUT PSecBuffer OutputToken, OUT PULONG pContextAttr, OUT PTimeStamp ptsExpiry, OUT PUCHAR pSessionKey, - OUT PULONG pfNegotiateFlags, - OUT PHANDLE TokenHandle, - OUT PNTSTATUS pSubStatus, - OUT PTimeStamp ptsPasswordExpiry, OUT PULONG pfUserFlags);
/* helper functions */
-
sserapion＠svn.reactos.org