kio Library API Documentation

kntlm.cpp

00001 /* This file is part of the KDE libraries
00002    Copyright (c) 2004 Szombathelyi Gy�gy <gyurco@freemail.hu>
00003 
00004    The implementation is based on the documentation and sample code
00005    at http://davenport.sourceforge.net/ntlm.html
00006    The DES encryption functions are from libntlm 
00007    at http://josefsson.org/libntlm/
00008 
00009    This library is free software; you can redistribute it and/or
00010    modify it under the terms of the GNU Library General Public
00011    License version 2 as published by the Free Software Foundation.
00012 
00013    This library is distributed in the hope that it will be useful,
00014    but WITHOUT ANY WARRANTY; without even the implied warranty of
00015    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
00016    Library General Public License for more details.
00017 
00018    You should have received a copy of the GNU Library General Public License
00019    along with this library; see the file COPYING.LIB.  If not, write to
00020    the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
00021    Boston, MA 02111-1307, USA.
00022 */
00023 
00024 #include <string.h>
00025 
00026 #include <qdatetime.h>
00027 #include <kapplication.h>
00028 #include <kswap.h>
00029 #include <kmdcodec.h>
00030 #include <kdebug.h>
00031 
00032 #include "des.h"
00033 #include "kntlm.h"
00034 
00035 QString KNTLM::getString( const QByteArray &buf, const SecBuf &secbuf, bool unicode )
00036 {
00037   //watch for buffer overflows
00038   Q_UINT32 offset;
00039   Q_UINT16 len;
00040   offset = KFromToLittleEndian((Q_UINT32)secbuf.offset);
00041   len = KFromToLittleEndian(secbuf.len);
00042   if ( offset > buf.size() ||
00043        offset + len > buf.size() ) return QString::null;
00044 
00045   QString str;
00046   const char *c = buf.data() + offset;
00047   
00048   if ( unicode ) {
00049     str = UnicodeLE2QString( (QChar*) c, len >> 1 );
00050   } else {
00051     str = QString::fromLatin1( c, len );
00052   }
00053   return str;
00054 }
00055 
00056 QByteArray KNTLM::getBuf( const QByteArray &buf, const SecBuf &secbuf )
00057 {
00058   QByteArray ret;
00059   Q_UINT32 offset;
00060   Q_UINT16 len;
00061   offset = KFromToLittleEndian((Q_UINT32)secbuf.offset);
00062   len = KFromToLittleEndian(secbuf.len);
00063   //watch for buffer overflows
00064   if ( offset > buf.size() ||
00065        offset + len > buf.size() ) return ret;
00066   ret.duplicate( buf.data() + offset, buf.size() );
00067   return ret;
00068 }
00069 
00070 void KNTLM::addString( QByteArray &buf, SecBuf &secbuf, const QString &str, bool unicode )
00071 {
00072   QByteArray tmp;
00073 
00074   if ( unicode ) {
00075     tmp = QString2UnicodeLE( str );
00076     addBuf( buf, secbuf, tmp );
00077   } else {
00078     const char *c;
00079     c = str.latin1();
00080     tmp.setRawData( c, str.length() );
00081     addBuf( buf, secbuf, tmp );
00082     tmp.resetRawData( c, str.length() );
00083   }
00084 }
00085 
00086 void KNTLM::addBuf( QByteArray &buf, SecBuf &secbuf, QByteArray &data )
00087 {
00088   Q_UINT32 offset;
00089   Q_UINT16 len, maxlen;
00090   offset = (buf.size() + 1) & 0xfffffffe;
00091   len = data.size();
00092   maxlen = data.size();
00093   
00094   secbuf.offset = KFromToLittleEndian((Q_UINT32)offset);
00095   secbuf.len = KFromToLittleEndian(len);
00096   secbuf.maxlen = KFromToLittleEndian(maxlen);
00097   buf.resize( offset + len );
00098   memcpy( buf.data() + offset, data.data(), data.size() );
00099 }
00100 
00101 bool KNTLM::getNegotiate( QByteArray &negotiate, const QString &domain, const QString &workstation, Q_UINT32 flags )
00102 {
00103   QByteArray rbuf( sizeof(Negotiate) );
00104   
00105   rbuf.fill( 0 );
00106   memcpy( rbuf.data(), "NTLMSSP", 8 );
00107   ((Negotiate*) rbuf.data())->msgType = KFromToLittleEndian( (Q_UINT32)1 );
00108   if ( !domain.isEmpty() ) {
00109     flags |= Negotiate_Domain_Supplied;
00110     addString( rbuf, ((Negotiate*) rbuf.data())->domain, domain );
00111   }
00112   if ( !workstation.isEmpty() ) {
00113     flags |= Negotiate_WS_Supplied;
00114     addString( rbuf, ((Negotiate*) rbuf.data())->domain, workstation );
00115   }
00116   ((Negotiate*) rbuf.data())->flags = KFromToLittleEndian( flags );
00117   negotiate = rbuf;
00118   return true;
00119 }
00120 
00121 bool KNTLM::getAuth( QByteArray &auth, const QByteArray &challenge, const QString &user, 
00122   const QString &password, const QString &domain, const QString &workstation, 
00123   bool forceNTLM, bool forceNTLMv2 )
00124 {
00125   QByteArray rbuf( sizeof(Auth) );
00126   Challenge *ch = (Challenge *) challenge.data();
00127   QByteArray response;
00128   uint chsize = challenge.size();
00129   bool unicode = false;
00130   QString dom;
00131 
00132   //challenge structure too small
00133   if ( chsize < 32 ) return false;
00134 
00135   unicode = KFromToLittleEndian(ch->flags) & Negotiate_Unicode;
00136   if ( domain.isEmpty() )
00137     dom = getString( challenge, ch->targetName, unicode );
00138   else
00139     dom = domain;
00140     
00141   rbuf.fill( 0 );
00142   memcpy( rbuf.data(), "NTLMSSP", 8 );
00143   ((Auth*) rbuf.data())->msgType = KFromToLittleEndian( (Q_UINT32)3 );
00144   ((Auth*) rbuf.data())->flags = ch->flags;
00145   QByteArray targetInfo = getBuf( challenge, ch->targetInfo );
00146 
00147 //  if ( forceNTLMv2 || (!targetInfo.isEmpty() && (KFromToLittleEndian(ch->flags) & Negotiate_Target_Info)) /* may support NTLMv2 */ ) {
00148 //    if ( KFromToLittleEndian(ch->flags) & Negotiate_NTLM ) {
00149 //      if ( targetInfo.isEmpty() ) return false;
00150 //      response = getNTLMv2Response( dom, user, password, targetInfo, ch->challengeData );
00151 //      addBuf( rbuf, ((Auth*) rbuf.data())->ntResponse, response );
00152 //    } else {
00153 //      if ( !forceNTLM ) {
00154 //        response = getLMv2Response( dom, user, password, ch->challengeData );
00155 //        addBuf( rbuf, ((Auth*) rbuf.data())->lmResponse, response );
00156 //      } else 
00157 //        return false;
00158 //    }
00159 //  } else { //if no targetinfo structure and NTLMv2 or LMv2 not forced, try the older methods
00160 
00161     if ( KFromToLittleEndian(ch->flags) & Negotiate_NTLM ) {
00162       response = getNTLMResponse( password, ch->challengeData );
00163       addBuf( rbuf, ((Auth*) rbuf.data())->ntResponse, response );
00164     } else {
00165       if ( !forceNTLM ) {
00166         response = getLMResponse( password, ch->challengeData );
00167         addBuf( rbuf, ((Auth*) rbuf.data())->lmResponse, response );
00168       } else
00169         return false;
00170     }
00171 //  }
00172   if ( !dom.isEmpty() )
00173     addString( rbuf, ((Auth*) rbuf.data())->domain, dom, unicode );
00174   addString( rbuf, ((Auth*) rbuf.data())->user, user, unicode );
00175   if ( !workstation.isEmpty() )
00176     addString( rbuf, ((Auth*) rbuf.data())->workstation, workstation, unicode );
00177 
00178   auth = rbuf;
00179 
00180   return true;
00181 }
00182 
00183 QByteArray KNTLM::getLMResponse( const QString &password, const unsigned char *challenge )
00184 {
00185   QByteArray hash, answer;
00186 
00187   hash = lmHash( password );
00188   hash.resize( 21 );
00189   memset( hash.data() + 16, 0, 5 );
00190   answer = lmResponse( hash, challenge );
00191   hash.fill( 0 );
00192   return answer;
00193 }
00194 
00195 QByteArray KNTLM::lmHash( const QString &password )
00196 {
00197   QByteArray keyBytes( 14 );
00198   QByteArray hash( 16 );
00199   DES_KEY ks;
00200   const char *magic = "KGS!@#$%";
00201 
00202   keyBytes.fill( 0 );
00203   strncpy( keyBytes.data(), password.upper().latin1(), 14 );
00204 
00205   convertKey( (unsigned char*) keyBytes.data(), &ks );
00206   ntlm_des_ecb_encrypt( magic, 8, &ks, (unsigned char*) hash.data() );
00207 
00208   convertKey( (unsigned char*) keyBytes.data() + 7, &ks );
00209   ntlm_des_ecb_encrypt( magic, 8, &ks, (unsigned char*) hash.data() + 8 );
00210 
00211   keyBytes.fill( 0 );
00212   memset( &ks, 0, sizeof (ks) );
00213 
00214   return hash;
00215 }
00216 
00217 QByteArray KNTLM::lmResponse( const QByteArray &hash, const unsigned char *challenge )
00218 {
00219   DES_KEY ks;
00220   QByteArray answer( 24 );
00221 
00222   convertKey( (unsigned char*) hash.data(), &ks );
00223   ntlm_des_ecb_encrypt( challenge, 8, &ks, (unsigned char*) answer.data() );
00224 
00225   convertKey( (unsigned char*) hash.data() + 7, &ks );
00226   ntlm_des_ecb_encrypt( challenge, 8, &ks, (unsigned char*) answer.data() + 8 );
00227 
00228   convertKey( (unsigned char*) hash.data() + 14, &ks );
00229   ntlm_des_ecb_encrypt( challenge, 8, &ks, (unsigned char*) answer.data() + 16 );
00230 
00231   memset( &ks, 0, sizeof (ks) );
00232   return answer;
00233 }
00234 
00235 QByteArray KNTLM::getNTLMResponse( const QString &password, const unsigned char *challenge )
00236 {
00237   QByteArray hash, answer;
00238 
00239   hash = ntlmHash( password );
00240   hash.resize( 21 );
00241   memset( hash.data() + 16, 0, 5 );
00242   answer = lmResponse( hash, challenge );
00243   hash.fill( 0 );
00244   return answer;
00245 }
00246 
00247 QByteArray KNTLM::ntlmHash( const QString &password )
00248 {
00249   KMD4::Digest digest;
00250   QByteArray ret, unicode;
00251   unicode = QString2UnicodeLE( password );
00252 
00253   KMD4 md4( unicode );
00254   md4.rawDigest( digest );
00255   ret.duplicate( (const char*) digest, sizeof( digest ) );
00256   return ret;
00257 }
00258 
00259 QByteArray KNTLM::getNTLMv2Response( const QString &target, const QString &user,
00260   const QString &password, const QByteArray &targetInformation,
00261   const unsigned char *challenge )
00262 {
00263   QByteArray hash = ntlmv2Hash( target, user, password );
00264   QByteArray blob = createBlob( targetInformation );
00265   return lmv2Response( hash, blob, challenge );
00266 }
00267 
00268 QByteArray KNTLM::getLMv2Response( const QString &target, const QString &user,
00269   const QString &password, const unsigned char *challenge )
00270 {
00271   QByteArray hash = ntlmv2Hash( target, user, password );
00272   QByteArray clientChallenge( 8 );
00273   for ( uint i = 0; i<8; i++ ) {
00274     clientChallenge.data()[i] = KApplication::random() % 0xff;
00275   }
00276   return lmv2Response( hash, clientChallenge, challenge );
00277 }
00278 
00279 QByteArray KNTLM::ntlmv2Hash( const QString &target, const QString &user, const QString &password )
00280 {
00281   QByteArray hash1 = ntlmHash( password );
00282   QByteArray key, ret;
00283   QString id = user.upper() + target.upper();
00284   key = QString2UnicodeLE( id );
00285   ret = hmacMD5( key, hash1 );
00286   return ret;  
00287 }
00288 
00289 QByteArray KNTLM::lmv2Response( const QByteArray &hash, 
00290   const QByteArray &clientData, const unsigned char *challenge )
00291 {
00292   QByteArray data( 8 + clientData.size() );
00293   memcpy( data.data(), challenge, 8 );
00294   memcpy( data.data() + 8, clientData.data(), clientData.size() );
00295   QByteArray mac = hmacMD5( data, hash );
00296   mac.resize( 16 + clientData.size() );
00297   memcpy( mac.data() + 16, clientData.data(), clientData.size() );
00298   return mac;
00299 }
00300 
00301 QByteArray KNTLM::createBlob( const QByteArray &targetinfo )
00302 {
00303   QByteArray blob( sizeof(Blob) + 4 + targetinfo.size() );
00304   blob.fill( 0 );
00305   
00306   Blob *bl = (Blob *) blob.data();
00307   bl->signature = KFromToBigEndian( (Q_UINT32) 0x01010000 );
00308   Q_UINT64 now = QDateTime::currentDateTime().toTime_t();
00309   now += (Q_UINT64)3600*(Q_UINT64)24*(Q_UINT64)134774;
00310   now *= (Q_UINT64)10000000;
00311   bl->timestamp = KFromToLittleEndian( now );
00312   for ( uint i = 0; i<8; i++ ) {
00313     bl->challenge[i] = KApplication::random() % 0xff;
00314   }
00315   memcpy( blob.data() + sizeof(Blob), targetinfo.data(), targetinfo.size() );
00316   return blob;
00317 }
00318 
00319 QByteArray KNTLM::hmacMD5( const QByteArray &data, const QByteArray &key )
00320 {
00321   Q_UINT8 ipad[64], opad[64];
00322   KMD5::Digest digest;
00323   QByteArray ret;
00324   
00325   memset( ipad, 0x36, sizeof(ipad) );
00326   memset( opad, 0x5c, sizeof(opad) );
00327   for ( int i = key.size()-1; i >= 0; i-- ) {
00328     ipad[i] ^= key[i];
00329     opad[i] ^= key[i];
00330   }
00331 
00332   QByteArray content( data.size()+64 );
00333   memcpy( content.data(), ipad, 64 );
00334   memcpy( content.data() + 64, data.data(), data.size() );
00335   KMD5 md5( content );
00336   md5.rawDigest( digest );
00337   content.resize( sizeof(digest) + 64 );
00338   memcpy( content.data(), opad, 64 );
00339   memcpy( content.data() + 64, digest, sizeof(digest) );
00340   md5.reset();
00341   md5.update( content );
00342   md5.rawDigest( digest );
00343 
00344   ret.duplicate( (const char*) digest, sizeof( digest ) );
00345   return ret;
00346 }
00347 
00348 /*
00349 * turns a 56 bit key into the 64 bit, odd parity key and sets the key.
00350 * The key schedule ks is also set.
00351 */
00352 void KNTLM::convertKey( unsigned char *key_56, void* ks )
00353 {
00354   unsigned char key[8];
00355 
00356   key[0] = key_56[0];
00357   key[1] = ((key_56[0] << 7) & 0xFF) | (key_56[1] >> 1);
00358   key[2] = ((key_56[1] << 6) & 0xFF) | (key_56[2] >> 2);
00359   key[3] = ((key_56[2] << 5) & 0xFF) | (key_56[3] >> 3);
00360   key[4] = ((key_56[3] << 4) & 0xFF) | (key_56[4] >> 4);
00361   key[5] = ((key_56[4] << 3) & 0xFF) | (key_56[5] >> 5);
00362   key[6] = ((key_56[5] << 2) & 0xFF) | (key_56[6] >> 6);
00363   key[7] = (key_56[6] << 1) & 0xFF;
00364 
00365   for ( uint i=0; i<8; i++ ) {
00366     unsigned char b = key[i];
00367     bool needsParity = (((b>>7) ^ (b>>6) ^ (b>>5) ^ (b>>4) ^ (b>>3) ^ (b>>2) ^ (b>>1)) & 0x01) == 0;
00368     if ( needsParity ) 
00369       key[i] |= 0x01;
00370     else
00371       key[i] &= 0xfe;
00372   }
00373 
00374   ntlm_des_set_key ( (DES_KEY*) ks, (char*) &key, sizeof (key));
00375 
00376   memset (&key, 0, sizeof (key));
00377 }
00378 
00379 QByteArray KNTLM::QString2UnicodeLE( const QString &target )
00380 {
00381   QByteArray unicode( target.length() * 2 );
00382   for ( uint i = 0; i < target.length(); i++ ) {
00383     ((Q_UINT16*)unicode.data())[ i ] = KFromToLittleEndian( target[i].unicode() );
00384   }
00385   return unicode;
00386 }
00387 
00388 QString KNTLM::UnicodeLE2QString( const QChar* data, uint len )
00389 {
00390   QString ret;
00391   for ( uint i = 0; i < len; i++ ) {
00392     ret += KFromToLittleEndian( data[ i ].unicode() );
00393   }
00394   return ret;
00395 }
KDE Logo
This file is part of the documentation for kio Library Version 3.4.3.
Documentation copyright © 1996-2004 the KDE developers.
Generated on Sun Oct 9 08:00:05 2005 by doxygen 1.4.4 written by Dimitri van Heesch, © 1997-2003