ntlm_constants.h 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_NTLM_NTLM_CONSTANTS_H_
  5. #define NET_NTLM_NTLM_CONSTANTS_H_
  6. #include <stddef.h>
  7. #include <stdint.h>
  8. #include <vector>
  9. #include "net/base/net_export.h"
  10. namespace net::ntlm {
  11. // A security buffer is a structure within an NTLM message that indicates
  12. // the offset from the beginning of the message and the length of a payload
  13. // that occurs later in the message. Within the raw message there is also
  14. // an additional field, however the field is always written with the same
  15. // value as length, and readers must always ignore it.
  16. struct SecurityBuffer {
  17. SecurityBuffer(uint32_t offset, uint16_t length)
  18. : offset(offset), length(length) {}
  19. SecurityBuffer() : SecurityBuffer(0, 0) {}
  20. uint32_t offset;
  21. uint16_t length;
  22. };
  23. struct NtlmFeatures {
  24. explicit NtlmFeatures(bool enable_NTLMv2) : enable_NTLMv2(enable_NTLMv2) {}
  25. // Whether the use NTLMv2.
  26. bool enable_NTLMv2 = true;
  27. // Enables Message Integrity Check (MIC). This flag is ignored if
  28. // enable_NTLMv2 is false.
  29. bool enable_MIC = true;
  30. // Enables Extended Protection for Authentication (EPA). This flag is
  31. // ignored if enable_NTLMv2 is false.
  32. bool enable_EPA = true;
  33. };
  34. // There are 3 types of messages in NTLM. The message type is a field in
  35. // every NTLM message header. See [MS-NLMP] Section 2.2.
  36. enum class MessageType : uint32_t {
  37. kNegotiate = 0x01,
  38. kChallenge = 0x02,
  39. kAuthenticate = 0x03,
  40. };
  41. // Defined in [MS-NLMP] Section 2.2.2.5
  42. // Only the used subset is defined.
  43. enum class NegotiateFlags : uint32_t {
  44. kNone = 0,
  45. kUnicode = 0x01,
  46. kOem = 0x02,
  47. kRequestTarget = 0x04,
  48. kNtlm = 0x200,
  49. kAlwaysSign = 0x8000,
  50. kExtendedSessionSecurity = 0x80000,
  51. kTargetInfo = 0x800000,
  52. };
  53. constexpr NegotiateFlags operator|(NegotiateFlags lhs, NegotiateFlags rhs) {
  54. using TFlagsInt = std::underlying_type<NegotiateFlags>::type;
  55. return static_cast<NegotiateFlags>(static_cast<TFlagsInt>(lhs) |
  56. static_cast<TFlagsInt>(rhs));
  57. }
  58. constexpr NegotiateFlags operator&(NegotiateFlags lhs, NegotiateFlags rhs) {
  59. using TFlagsInt = std::underlying_type<NegotiateFlags>::type;
  60. return static_cast<NegotiateFlags>(static_cast<TFlagsInt>(lhs) &
  61. static_cast<TFlagsInt>(rhs));
  62. }
  63. // Identifies the payload type in an AV Pair. See [MS-NLMP] 2.2.2.1
  64. enum class TargetInfoAvId : uint16_t {
  65. kEol = 0x0000,
  66. kServerName = 0x00001,
  67. kDomainName = 0x00002,
  68. kFlags = 0x0006,
  69. kTimestamp = 0x0007,
  70. kTargetName = 0x0009,
  71. kChannelBindings = 0x000A,
  72. };
  73. // Flags used in an TargetInfoAvId::kFlags AV Pair. See [MS-NLMP] 2.2.2.1
  74. enum class TargetInfoAvFlags : uint32_t {
  75. kNone = 0,
  76. kMicPresent = 0x00000002,
  77. };
  78. using TAvFlagsInt = std::underlying_type<TargetInfoAvFlags>::type;
  79. constexpr TargetInfoAvFlags operator|(TargetInfoAvFlags lhs,
  80. TargetInfoAvFlags rhs) {
  81. return static_cast<TargetInfoAvFlags>(static_cast<TAvFlagsInt>(lhs) |
  82. static_cast<TAvFlagsInt>(rhs));
  83. }
  84. constexpr TargetInfoAvFlags operator&(TargetInfoAvFlags lhs,
  85. TargetInfoAvFlags rhs) {
  86. return static_cast<TargetInfoAvFlags>(static_cast<TAvFlagsInt>(lhs) &
  87. static_cast<TAvFlagsInt>(rhs));
  88. }
  89. // An AV Pair is a structure that appears inside the target info field. It
  90. // consists of an |avid| to identify the data type and an |avlen| specifying
  91. // the size of the payload. Following that is |avlen| bytes of inline payload.
  92. // AV Pairs are concatenated together and a special terminator with |avid|
  93. // equal to |kEol| and |avlen| equal to zero signals that no further pairs
  94. // follow. See [MS-NLMP] 2.2.2.1
  95. //
  96. // AV Pairs from the Challenge message are read from the challenge message
  97. // and a potentially modified version is written into the authenticate
  98. // message. In some cases the existing AV Pair is modified, eg. flags. In
  99. // some cases new AV Pairs are add, eg. channel bindings and spn.
  100. //
  101. // For simplicity of processing two special fields |flags|, and |timestamp|
  102. // are populated during the initial parsing phase for AVIDs |kFlags| and
  103. // |kTimestamp| respectively. This avoids subsequent code having to
  104. // manipulate the payload value through the buffer directly. For all
  105. // other AvPairs the value of these 2 fields is undefined and the payload
  106. // is in the |buffer| field. For these fields the payload is copied verbatim
  107. // and it's content is not read or validated in any way.
  108. struct NET_EXPORT_PRIVATE AvPair {
  109. AvPair();
  110. AvPair(TargetInfoAvId avid, uint16_t avlen);
  111. AvPair(TargetInfoAvId avid, std::vector<uint8_t> buffer);
  112. AvPair(const AvPair& other);
  113. AvPair(AvPair&& other);
  114. ~AvPair();
  115. AvPair& operator=(const AvPair& other);
  116. AvPair& operator=(AvPair&& other);
  117. std::vector<uint8_t> buffer;
  118. uint64_t timestamp;
  119. TargetInfoAvFlags flags;
  120. TargetInfoAvId avid;
  121. uint16_t avlen;
  122. };
  123. static constexpr uint8_t kSignature[] = "NTLMSSP";
  124. static constexpr size_t kSignatureLen = std::size(kSignature);
  125. static constexpr uint16_t kProofInputVersionV2 = 0x0101;
  126. static constexpr size_t kSecurityBufferLen =
  127. (2 * sizeof(uint16_t)) + sizeof(uint32_t);
  128. static constexpr size_t kNegotiateMessageLen = 32;
  129. static constexpr size_t kMinChallengeHeaderLen = 32;
  130. static constexpr size_t kChallengeHeaderLen = 48;
  131. static constexpr size_t kResponseLenV1 = 24;
  132. static constexpr size_t kChallengeLen = 8;
  133. static constexpr size_t kVersionFieldLen = 8;
  134. static constexpr size_t kNtlmHashLen = 16;
  135. static constexpr size_t kNtlmProofLenV2 = kNtlmHashLen;
  136. static constexpr size_t kSessionKeyLenV2 = kNtlmHashLen;
  137. static constexpr size_t kMicLenV2 = kNtlmHashLen;
  138. static constexpr size_t kChannelBindingsHashLen = kNtlmHashLen;
  139. static constexpr size_t kEpaUnhashedStructHeaderLen = 20;
  140. static constexpr size_t kProofInputLenV2 = 28;
  141. static constexpr size_t kAvPairHeaderLen = 2 * sizeof(uint16_t);
  142. static constexpr size_t kNtlmResponseHeaderLenV2 =
  143. kNtlmProofLenV2 + kProofInputLenV2;
  144. static constexpr size_t kAuthenticateHeaderLenV1 = 64;
  145. static constexpr size_t kMicOffsetV2 = 72;
  146. static constexpr size_t kAuthenticateHeaderLenV2 = 88;
  147. static constexpr size_t kMaxFqdnLen = 255;
  148. static constexpr size_t kMaxUsernameLen = 104;
  149. static constexpr size_t kMaxPasswordLen = 256;
  150. static constexpr NegotiateFlags kNegotiateMessageFlags =
  151. NegotiateFlags::kUnicode | NegotiateFlags::kOem |
  152. NegotiateFlags::kRequestTarget | NegotiateFlags::kNtlm |
  153. NegotiateFlags::kAlwaysSign | NegotiateFlags::kExtendedSessionSecurity;
  154. } // namespace net::ntlm
  155. #endif // NET_NTLM_NTLM_CONSTANTS_H_