Functions for handling authentication. More...

Collaboration diagram for Authentication:

Classes
struct	asn1_der_iterator
struct	mpz_t
struct	names_blob_prefix_t
struct	rsa_public_key
struct	tds_answer
struct	TDSNTLMAUTH

Macros
#define	AV_PAIR_CBT_BYTES 20
#define	dump(b)
#define	dumpl(b, l)
#define	hash_func sha1
#define	HAVE_GMP 1
#define	HAVE_NETTLE 1
#define	mpz_clear(n)
#define	mpz_init(n)
#define	mpz_powm(w, n, e, m)
#define	MSV_AV_CHANNEL_BINDINGS 0x000A
#define	MSV_AV_EOL 0x0000
#define	MSV_AV_FLAG_MIC 0x00000002u
#define	MSV_AV_FLAGS 0x0006
#define	MSV_AV_TARGET_NAME 0x0009
#define	MSV_AV_TIMESTAMP 0x0007
#define	NTLM_AUTH_HEADER_LEN 64
#define	NTLM_AUTH_HEADER_MIC_LEN 88
#define	NTLM_AUTH_MIC_OFFSET 72
#define	NTLMSSP_NEGOTIATE_128 0x20000000u
#define	NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0x00008000u
#define	NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0x00080000u
#define	NTLMSSP_NEGOTIATE_KEY_EXCH 0x40000000u
#define	NTLMSSP_NEGOTIATE_LOCAL_CALL 0x00004000u
#define	NTLMSSP_NEGOTIATE_NTLM 0x00000200u
#define	NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0x00001000u
#define	NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0x00002000u
#define	NTLMSSP_NEGOTIATE_SEAL 0x00000020u
#define	NTLMSSP_NEGOTIATE_SIGN 0x00000010u
#define	NTLMSSP_NEGOTIATE_UNICODE 0x00000001u
#define	NTLMSSP_NEGOTIATE_VERSION 0x02000000u

Typedefs
typedef void	nettle_random_func(void ctx, size_t len, uint8_t out)
typedef struct tds_answer	TDSANSWER

Enumerations
enum	{ ASN1_SEQUENCE = ASN1_TAG_SEQUENCE }
enum	{ hash_len = 20 }
enum	{ key_size_max = 1024 }
enum	asn1_iterator_result { ASN1_ITERATOR_ERROR , ASN1_ITERATOR_PRIMITIVE , ASN1_ITERATOR_CONSTRUCTED , ASN1_ITERATOR_END }

Functions
static void	add_av_pair (unsigned char names_blob, int names_blob_len, uint16_t av_id, const void *data, size_t data_len)
	Add an AV_PAIR to target_info in names_blob.
static void	add_av_pairs (TDSNTLMAUTH auth, unsigned char names_blob, int *names_blob_len)
	Add channel binding token (CBT) and target name AV_PAIRs to target_info in names_blob.
static enum asn1_iterator_result	asn1_der_iterator_first (struct asn1_der_iterator der, int size, const void der_buf)
static enum asn1_iterator_result	asn1_der_iterator_next (struct asn1_der_iterator *der)
static TDSRET	build_names_blob (TDSNTLMAUTH auth, const unsigned char target_info, size_t target_info_len, bool mic_allowed, unsigned char *p_names_blob, int p_names_blob_len, bool *p_use_mic)
	Build NTLMv2 client blob (names_blob) from server target information.
static size_t	convert_to_usc2le_string (TDSSOCKET tds, const char s, size_t len, char *out)
static void	fill_names_blob_prefix (names_blob_prefix_t *prefix)
static void	get_cbt (TDSSOCKET tds, TDSNTLMAUTH auth)
static void	get_spn (TDSSOCKET tds, TDSNTLMAUTH auth)
	Compute the service principal name to send to the server.
static unsigned char *	make_lm_v2_response (const unsigned char ntlm_v2_hash[16], const unsigned char *client_data, int client_data_len, const unsigned char challenge[8])
static TDSRET	make_ntlm_hash (TDSSOCKET tds, const char passwd, unsigned char ntlm_hash[16])
static TDSRET	make_ntlm_v2_hash (TDSSOCKET tds, const char passwd, unsigned char ntlm_v2_hash[16])
static void	memxor (uint8_t dest, const uint8_t src, size_t len)
static void	mgf_mask (uint8_t dest, size_t dest_len, const uint8_t mask, size_t mask_len)
static void	nettle_mpz_get_str_256 (unsigned length, uint8_t *s, const mpz_t x)
static void	nettle_mpz_set_str_256_u (mpz_t x, unsigned length, const uint8_t *s)
static int	oaep_encrypt (size_t key_size, size_t length, const uint8_t *message, mpz_t m)
static void	put_ntlm_field (unsigned char msg, size_t field_pos, size_t data_pos, const void *data, size_t len)
	Fill a field (length, maximum length and offset) of a NTLM message header and copy its data in the payload.
static int	rsa_encrypt_oaep (const struct rsa_public_key key, size_t length, const uint8_t message, mpz_t gibberish)
static void	rsa_public_key_clear (struct rsa_public_key *key)
static int	rsa_public_key_from_der_iterator (struct rsa_public_key key, unsigned key_bits, struct asn1_der_iterator der)
static void	rsa_public_key_init (struct rsa_public_key *key)
static void	sha1 (uint8_t hash, const void data, size_t len)
TDSAUTHENTICATION *	tds5_negotiate_get_auth (TDSSOCKET *tds TDS_UNUSED)
static void *	tds5_rsa_encrypt (const void key, size_t key_len, const void nonce, size_t nonce_len, const char pwd, size_t em_size)
static TDSRET	tds7_send_auth (TDSSOCKET tds, TDSNTLMAUTH auth, const unsigned char challenge, uint32_t flags, const unsigned char names_blob, int names_blob_len, bool use_mic)
	Send AUTHENTICATE_MESSAGE.
static TDSRET	tds_answer_challenge (TDSSOCKET tds, TDSLOGIN login, const unsigned char challenge, uint32_t flags, const unsigned char names_blob, int names_blob_len, TDSANSWER answer, unsigned char **ntlm_v2_response)
	Crypt a given password using schema required for NTLMv1 or NTLM2 authentication.
static TDSRET	tds_answer_challenge_ntlmv2 (TDSSOCKET tds, TDSLOGIN login, const unsigned char challenge, uint32_t flags, const unsigned char names_blob, int names_blob_len, TDSANSWER answer, unsigned char **ntlm_v2_response)
static void	tds_calc_cbt (const void *app_data, size_t app_data_len, unsigned char cbt[16])
	Compute channel binding token (MD5 of gss_channel_bindings_struct).
static void	tds_convert_key (const unsigned char key_56, DES_KEY ks)
static void	tds_encrypt_answer (const unsigned char hash, const unsigned char challenge, unsigned char *answer)
static TDSRET	tds_ntlm_free (TDSCONNECTION conn TDS_UNUSED, TDSAUTHENTICATION tds_auth)
TDSAUTHENTICATION *	tds_ntlm_get_auth (TDSSOCKET *tds)
	Build a NTLMSPP packet to send to server.
static TDSRET	tds_ntlm_handle_next (TDSSOCKET tds, TDSAUTHENTICATION tds_auth, size_t len)
static bool	tds_ntlm_mic (const unsigned char key[16], const unsigned char negotiate, size_t negotiate_len, const unsigned char challenge, size_t challenge_len, const unsigned char *authenticate, size_t authenticate_len, unsigned char mic[16])
	Compute NTLM message integrity code.
static void	tds_rc4 (const unsigned char key, size_t key_len, const unsigned char in, size_t len, unsigned char *out)
	RC4 encryption, used to encrypt NTLM exported session key.
static uint16_t	ucs2_upper (uint16_t c)
	Convert a UTF-16 code unit to upper case, using Unicode simple case mapping like Windows does.
static void	ucs2le_to_upper (char *buf, size_t len)
	Convert a UTF-16LE string to upper case.
static void	unix_to_nt_time (uint64_t nt, struct timeval tv)
	put a 8 byte filetime from a time_t This takes GMT as input

Variables
static const char	label [] = ""
static const unsigned char	ntlm_id [] = "NTLMSSP"

Detailed Description

Functions for handling authentication.

Macro Definition Documentation

◆ dump

#define dump ( b )

Value:

dumpl(b, sizeof(b))

◆ dumpl

#define dumpl	(		b,
			l )

Value:

tdsdump_dump_buf(TDS_DBG_INFO1, #b, b, l)

◆ mpz_clear

#define mpz_clear ( n )

Value:

gcry_mpi_release((n)->num)

◆ mpz_init

#define mpz_init ( n )

Value:

do { (n)->num = NULL; } while(0)

◆ mpz_powm

#define mpz_powm	(	w,
		n,
		e,
		m )

Value:

gcry_mpi_powm((w)->num, (n)->num, (e)->num, (m)->num);

Function Documentation

◆ add_av_pair()

void add_av_pair	(	unsigned char *	names_blob,
		int *	names_blob_len,
		uint16_t	av_id,
		const void *	data,
		size_t	data_len )

static

Add an AV_PAIR to target_info in names_blob.

target_info is at the end of names_blob and ends with a MsvAvEOL terminator.

Parameters

names_blob	names_blob buffer, must have space for the new pair
names_blob_len	current length (will be updated)
av_id	AvId of the new pair
data	data of the new pair
data_len	length of data

Here is the caller graph for this function:

◆ add_av_pairs()

void add_av_pairs	(	TDSNTLMAUTH *	auth,
		unsigned char *	names_blob,
		int *	names_blob_len )

static

Add channel binding token (CBT) and target name AV_PAIRs to target_info in names_blob.

Parameters

Authentication	NTLM authentication data
names_blob	names_blob buffer
names_blob_len	current length (will be updated)

Here is the call graph for this function:

Here is the caller graph for this function:

◆ build_names_blob()

TDSRET build_names_blob	(	TDSNTLMAUTH *	auth,
		const unsigned char *	target_info,
		size_t	target_info_len,
		bool	mic_allowed,
		unsigned char **	p_names_blob,
		int *	p_names_blob_len,
		bool *	p_use_mic )

static

Build NTLMv2 client blob (names_blob) from server target information.

Server AV_PAIRs are kept, MsvAvFlags (if MIC is used), channel binding token and target name are added. The server timestamp, if present, is used.

Parameters

Authentication	NTLM authentication data
target_info	target information from CHALLENGE_MESSAGE
target_info_len	length of target_info
mic_allowed	whether we can provide a MIC
p_names_blob	output names_blob, to be freed
p_names_blob_len	output length of names_blob
p_use_mic	output, whether MIC should be sent

Here is the call graph for this function:

◆ get_spn()

void get_spn	(	TDSSOCKET *	tds,
		TDSNTLMAUTH *	auth )

static

Compute the service principal name to send to the server.

SQL Server checks it when Extended Protection is enabled.

Here is the caller graph for this function:

◆ put_ntlm_field()

void put_ntlm_field	(	unsigned char *	msg,
		size_t	field_pos,
		size_t *	data_pos,
		const void *	data,
		size_t	len )

static

Fill a field (length, maximum length and offset) of a NTLM message header and copy its data in the payload.

Parameters

msg	message buffer
field_pos	position of the field in the header
data_pos	position of data in the payload, updated
data	field data
len	field data length

Here is the caller graph for this function:

◆ tds7_send_auth()

TDSRET tds7_send_auth	(	TDSSOCKET *	tds,
		TDSNTLMAUTH *	auth,
		const unsigned char *	challenge,
		uint32_t	flags,
		const unsigned char *	names_blob,
		int	names_blob_len,
		bool	use_mic )

static

Send AUTHENTICATE_MESSAGE.

Parameters

challenge	server challenge (8 bytes)
flags	negotiate flags from server
names_blob	NTLMv2 client blob, NULL if not available
names_blob_len	length of names_blob
use_mic	add message integrity code, names_blob must have MsvAvFlags with MIC bit set

Here is the call graph for this function:

◆ tds_answer_challenge()

TDSRET tds_answer_challenge	(	TDSSOCKET *	tds,
		TDSLOGIN *	login,
		const unsigned char *	challenge,
		uint32_t *	flags,
		const unsigned char *	names_blob,
		int	names_blob_len,
		TDSANSWER *	answer,
		unsigned char **	ntlm_v2_response )

static

Crypt a given password using schema required for NTLMv1 or NTLM2 authentication.

Parameters

passwd	clear text domain password
challenge	challenge data given by server
flags	NTLM flags from server side
answer	buffer where to store crypted password

Here is the call graph for this function:

Here is the caller graph for this function:

◆ tds_calc_cbt()

void tds_calc_cbt	(	const void *	app_data,
		size_t	app_data_len,
		unsigned char	cbt[16] )

static

Compute channel binding token (MD5 of gss_channel_bindings_struct).

Parameters

app_data	channel binding application data, like "tls-unique:" followed by data
app_data_len	application data length
cbt	output token

◆ tds_ntlm_get_auth()

TDSAUTHENTICATION * tds_ntlm_get_auth ( TDSSOCKET * tds )

Build a NTLMSPP packet to send to server.

Parameters

tds	A pointer to the TDSSOCKET structure managing a client/server operation.

Returns: authentication info

Here is the call graph for this function:

◆ tds_ntlm_mic()

bool tds_ntlm_mic	(	const unsigned char	key[16],
		const unsigned char *	negotiate,
		size_t	negotiate_len,
		const unsigned char *	challenge,
		size_t	challenge_len,
		const unsigned char *	authenticate,
		size_t	authenticate_len,
		unsigned char	mic[16] )

static

Compute NTLM message integrity code.

MIC = HMAC_MD5(ExportedSessionKey, NEGOTIATE_MESSAGE + CHALLENGE_MESSAGE + AUTHENTICATE_MESSAGE) where AUTHENTICATE_MESSAGE has the MIC field set to zero.

Returns: false on memory error

Here is the caller graph for this function:

◆ tds_rc4()

void tds_rc4	(	const unsigned char *	key,
		size_t	key_len,
		const unsigned char *	in,
		size_t	len,
		unsigned char *	out )

static

RC4 encryption, used to encrypt NTLM exported session key.

Parameters

key	encryption key
key_len	encryption key length
in	data to encrypt
len	length of data
out	output buffer, len bytes

Here is the caller graph for this function:

◆ ucs2le_to_upper()

void ucs2le_to_upper	(	char *	buf,
		size_t	len )

static

Convert a UTF-16LE string to upper case.

Surrogates are not changed, characters outside the BMP have no simple mapping to upper case in Windows.

Here is the call graph for this function:

Classes

Macros

Typedefs

Enumerations

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ dump

◆ dumpl

◆ mpz_clear

◆ mpz_init

◆ mpz_powm

Function Documentation

◆ add_av_pair()

◆ add_av_pairs()

◆ build_names_blob()

◆ get_spn()

◆ put_ntlm_field()

◆ tds7_send_auth()

◆ tds_answer_challenge()

◆ tds_calc_cbt()

◆ tds_ntlm_get_auth()

◆ tds_ntlm_mic()

◆ tds_rc4()

◆ ucs2le_to_upper()