source4/lib/http/gensec/ntlm.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    HTTP library - NTLM authentication mechanism gensec module
   5
   6    Copyright (C) 2014 Samuel Cabrero <samuelcabrero@kernevil.me>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "auth/auth.h"
  24 #include "auth/gensec/gensec.h"
  25 #include "auth/gensec/gensec_internal.h"
  26 #include "lib/util/base64.h"
  27
  28 _PUBLIC_ NTSTATUS gensec_http_ntlm_init(TALLOC_CTX *);
  29
  30 struct gensec_http_ntlm_state {
  31         struct gensec_security *sub;
  32 };
  33
  34 static NTSTATUS gensec_http_ntlm_client_start(struct gensec_security *gensec)
  35 {
  36         NTSTATUS status;
  37         struct gensec_http_ntlm_state *state;
  38
  39         state = talloc_zero(gensec, struct gensec_http_ntlm_state);
  40         if (state == NULL) {
  41                 return NT_STATUS_NO_MEMORY;
  42         }
  43         gensec->private_data = state;
  44
  45         status = gensec_subcontext_start(state, gensec, &state->sub);
  46         if (!NT_STATUS_IS_OK(status)) {
  47                 return status;
  48         }
  49
  50         return gensec_start_mech_by_oid(state->sub, GENSEC_OID_NTLMSSP);
  51 }
  52
  53 static NTSTATUS gensec_http_ntlm_update(struct gensec_security *gensec_ctx,
  54                                         TALLOC_CTX *mem_ctx,
  55                                         struct tevent_context *ev,
  56                                         const DATA_BLOB in,
  57                                         DATA_BLOB *out)
  58 {
  59         NTSTATUS status;
  60         struct gensec_http_ntlm_state *state;
  61         DATA_BLOB ntlm_in;
  62
  63         state = talloc_get_type_abort(gensec_ctx->private_data,
  64                                       struct gensec_http_ntlm_state);
  65
  66         if (in.length) {
  67                 if (strncasecmp((char *)in.data, "NTLM ", 5) != 0) {
  68                         return NT_STATUS_INVALID_PARAMETER;
  69                 }
  70                 ntlm_in = base64_decode_data_blob_talloc(mem_ctx,
  71                                                          (char *)&in.data[5]);
  72         } else {
  73                 ntlm_in = data_blob_null;
  74         }
  75
  76         status = gensec_update_ev(state->sub, mem_ctx, ev, ntlm_in, out);
  77         if (NT_STATUS_IS_OK(status) ||
  78             NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
  79                 char *tmp, *b64;
  80                 b64 = base64_encode_data_blob(mem_ctx, *out);
  81                 if (b64 == NULL) {
  82                         return NT_STATUS_NO_MEMORY;
  83                 }
  84
  85                 tmp = talloc_asprintf(mem_ctx, "NTLM %s", b64);
  86                 TALLOC_FREE(b64);
  87                 if (tmp == NULL) {
  88                         return NT_STATUS_NO_MEMORY;
  89                 }
  90                 *out = data_blob_string_const(tmp);
  91         }
  92
  93         if (ntlm_in.data) {
  94                 data_blob_free(&ntlm_in);
  95         }
  96
  97         return status;
  98 }
  99
 100 static const struct gensec_security_ops gensec_http_ntlm_security_ops = {
 101         .name           = "http_ntlm",
 102         .auth_type      = 0,
 103         .client_start   = gensec_http_ntlm_client_start,
 104         .update         = gensec_http_ntlm_update,
 105         .enabled        = true,
 106         .priority       = GENSEC_EXTERNAL,
 107 };
 108
 109 _PUBLIC_ NTSTATUS gensec_http_ntlm_init(TALLOC_CTX *ctx)
 110 {
 111         NTSTATUS status;
 112
 113         status = gensec_register(&gensec_http_ntlm_security_ops);
 114         if (!NT_STATUS_IS_OK(status)) {
 115                 DEBUG(0, ("Failed to register '%s' gensec backend!\n",
 116                                 gensec_http_ntlm_security_ops.name));
 117                 return status;
 118         }
 119
 120         return status;
 121 }