2 // Mono.Security.Protocol.Ntlm.Type3Message - Authentication
5 // Sebastien Pouliot <sebastien@ximian.com>
7 // (C) 2003 Motus Technologies Inc. (http://www.motus.com)
8 // Copyright (C) 2004 Novell, Inc (http://www.novell.com)
11 // a. NTLM Authentication Scheme for HTTP, Ronald Tschalär
12 // http://www.innovation.ch/java/ntlm.html
13 // b. The NTLM Authentication Protocol, Copyright © 2003 Eric Glass
14 // http://davenport.sourceforge.net/ntlm.html
16 // Permission is hereby granted, free of charge, to any person obtaining
17 // a copy of this software and associated documentation files (the
18 // "Software"), to deal in the Software without restriction, including
19 // without limitation the rights to use, copy, modify, merge, publish,
20 // distribute, sublicense, and/or sell copies of the Software, and to
21 // permit persons to whom the Software is furnished to do so, subject to
22 // the following conditions:
24 // The above copyright notice and this permission notice shall be
25 // included in all copies or substantial portions of the Software.
27 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
28 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
29 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
30 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
31 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
32 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
33 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
37 using System.Globalization;
40 namespace Mono.Security.Protocol.Ntlm {
42 public class Type3Message : MessageBase {
44 private NtlmAuthLevel _level;
45 private byte[] _challenge;
47 private string _domain;
48 private string _username;
49 private string _password;
50 private Type2Message _type2;
54 internal const string LegacyAPIWarning =
55 "Use of this API is highly discouraged, " +
56 "it selects legacy-mode LM/NTLM authentication, which sends " +
57 "your password in very weak encryption over the wire even if " +
58 "the server supports the more secure NTLMv2 / NTLMv2 Session. " +
59 "You need to use the new `Type3Message (Type2Message)' constructor " +
60 "to use the more secure NTLMv2 / NTLMv2 Session authentication modes. " +
61 "These require the Type 2 message from the server to compute the response.";
63 [Obsolete (LegacyAPIWarning)]
64 public Type3Message () : base (3)
66 if (DefaultAuthLevel != NtlmAuthLevel.LM_and_NTLM)
67 throw new InvalidOperationException (
68 "Refusing to use legacy-mode LM/NTLM authentication " +
69 "unless explicitly enabled using DefaultAuthLevel.");
72 _domain = Environment.UserDomainName;
73 _host = Environment.MachineName;
74 _username = Environment.UserName;
75 _level = NtlmAuthLevel.LM_and_NTLM;
76 Flags = (NtlmFlags) 0x8201;
79 public Type3Message (byte[] message) : base (3)
84 public Type3Message (Type2Message type2) : base (3)
87 _level = NtlmSettings.DefaultAuthLevel;
88 _challenge = (byte[]) type2.Nonce.Clone ();
90 _domain = type2.TargetName;
91 _host = Environment.MachineName;
92 _username = Environment.UserName;
94 Flags = (NtlmFlags) 0x8200;
95 if ((type2.Flags & NtlmFlags.NegotiateUnicode) != 0)
96 Flags |= NtlmFlags.NegotiateUnicode;
98 Flags |= NtlmFlags.NegotiateOem;
100 if ((type2.Flags & NtlmFlags.NegotiateNtlm2Key) != 0)
101 Flags |= NtlmFlags.NegotiateNtlm2Key;
106 if (_challenge != null)
107 Array.Clear (_challenge, 0, _challenge.Length);
109 Array.Clear (_lm, 0, _lm.Length);
111 Array.Clear (_nt, 0, _nt.Length);
114 // Default auth level
115 [Obsolete ("Use NtlmSettings.DefaultAuthLevel")]
116 public static NtlmAuthLevel DefaultAuthLevel {
117 get { return NtlmSettings.DefaultAuthLevel; }
118 set { NtlmSettings.DefaultAuthLevel = value; }
121 public NtlmAuthLevel Level {
122 get { return _level; }
123 set { _level = value; }
128 [Obsolete (LegacyAPIWarning)]
129 public byte[] Challenge {
131 if (_challenge == null)
133 return (byte[]) _challenge.Clone (); }
135 if ((_type2 != null) || (_level != NtlmAuthLevel.LM_and_NTLM))
136 throw new InvalidOperationException (
137 "Refusing to use legacy-mode LM/NTLM authentication " +
138 "unless explicitly enabled using DefaultAuthLevel.");
141 throw new ArgumentNullException ("Challenge");
142 if (value.Length != 8) {
143 string msg = Locale.GetText ("Invalid Challenge Length (should be 8 bytes).");
144 throw new ArgumentException (msg, "Challenge");
146 _challenge = (byte[]) value.Clone ();
150 public string Domain {
151 get { return _domain; }
156 Flags &= ~NtlmFlags.NegotiateDomainSupplied;
158 Flags |= NtlmFlags.NegotiateDomainSupplied;
165 get { return _host; }
170 Flags &= ~NtlmFlags.NegotiateWorkstationSupplied;
172 Flags |= NtlmFlags.NegotiateWorkstationSupplied;
178 public string Password {
179 get { return _password; }
180 set { _password = value; }
183 public string Username {
184 get { return _username; }
185 set { _username = value; }
199 protected override void Decode (byte[] message)
201 base.Decode (message);
205 if (message.Length >= 64)
206 Flags = (NtlmFlags)BitConverterLE.ToUInt32 (message, 60);
208 Flags = (NtlmFlags)0x8201;
210 int lm_len = BitConverterLE.ToUInt16 (message, 12);
211 int lm_off = BitConverterLE.ToUInt16 (message, 16);
212 _lm = new byte [lm_len];
213 Buffer.BlockCopy (message, lm_off, _lm, 0, lm_len);
215 int nt_len = BitConverterLE.ToUInt16 (message, 20);
216 int nt_off = BitConverterLE.ToUInt16 (message, 24);
217 _nt = new byte [nt_len];
218 Buffer.BlockCopy (message, nt_off, _nt, 0, nt_len);
220 int dom_len = BitConverterLE.ToUInt16 (message, 28);
221 int dom_off = BitConverterLE.ToUInt16 (message, 32);
222 _domain = DecodeString (message, dom_off, dom_len);
224 int user_len = BitConverterLE.ToUInt16 (message, 36);
225 int user_off = BitConverterLE.ToUInt16 (message, 40);
226 _username = DecodeString (message, user_off, user_len);
228 int host_len = BitConverterLE.ToUInt16 (message, 44);
229 int host_off = BitConverterLE.ToUInt16 (message, 48);
230 _host = DecodeString (message, host_off, host_len);
232 // Session key. We don't use it yet.
233 // int skey_len = BitConverterLE.ToUInt16 (message, 52);
234 // int skey_off = BitConverterLE.ToUInt16 (message, 56);
237 string DecodeString (byte[] buffer, int offset, int len)
239 if ((Flags & NtlmFlags.NegotiateUnicode) != 0)
240 return Encoding.Unicode.GetString (buffer, offset, len);
242 return Encoding.ASCII.GetString (buffer, offset, len);
245 byte[] EncodeString (string text)
249 if ((Flags & NtlmFlags.NegotiateUnicode) != 0)
250 return Encoding.Unicode.GetBytes (text);
252 return Encoding.ASCII.GetBytes (text);
255 public override byte[] GetBytes ()
257 byte[] target = EncodeString (_domain);
258 byte[] user = EncodeString (_username);
259 byte[] host = EncodeString (_host);
262 if (_type2 == null) {
263 if (_level != NtlmAuthLevel.LM_and_NTLM)
264 throw new InvalidOperationException (
265 "Refusing to use legacy-mode LM/NTLM authentication " +
266 "unless explicitly enabled using DefaultAuthLevel.");
268 #pragma warning disable 618
269 using (var legacy = new ChallengeResponse (_password, _challenge)) {
273 #pragma warning restore 618
275 ChallengeResponse2.Compute (_type2, _level, _username, _password, _domain, out lm, out ntlm);
278 var lmresp_len = lm != null ? lm.Length : 0;
279 var ntresp_len = ntlm != null ? ntlm.Length : 0;
281 byte[] data = PrepareMessage (64 + target.Length + user.Length + host.Length + lmresp_len + ntresp_len);
284 short lmresp_off = (short)(64 + target.Length + user.Length + host.Length);
285 data [12] = (byte)lmresp_len;
286 data [13] = (byte)0x00;
287 data [14] = (byte)lmresp_len;
288 data [15] = (byte)0x00;
289 data [16] = (byte)lmresp_off;
290 data [17] = (byte)(lmresp_off >> 8);
293 short ntresp_off = (short)(lmresp_off + lmresp_len);
294 data [20] = (byte)ntresp_len;
295 data [21] = (byte)(ntresp_len >> 8);
296 data [22] = (byte)ntresp_len;
297 data [23] = (byte)(ntresp_len >> 8);
298 data [24] = (byte)ntresp_off;
299 data [25] = (byte)(ntresp_off >> 8);
302 short dom_len = (short)target.Length;
304 data [28] = (byte)dom_len;
305 data [29] = (byte)(dom_len >> 8);
306 data [30] = data [28];
307 data [31] = data [29];
308 data [32] = (byte)dom_off;
309 data [33] = (byte)(dom_off >> 8);
312 short uname_len = (short)user.Length;
313 short uname_off = (short)(dom_off + dom_len);
314 data [36] = (byte)uname_len;
315 data [37] = (byte)(uname_len >> 8);
316 data [38] = data [36];
317 data [39] = data [37];
318 data [40] = (byte)uname_off;
319 data [41] = (byte)(uname_off >> 8);
322 short host_len = (short)host.Length;
323 short host_off = (short)(uname_off + uname_len);
324 data [44] = (byte)host_len;
325 data [45] = (byte)(host_len >> 8);
326 data [46] = data [44];
327 data [47] = data [45];
328 data [48] = (byte)host_off;
329 data [49] = (byte)(host_off >> 8);
332 short msg_len = (short)data.Length;
333 data [56] = (byte)msg_len;
334 data [57] = (byte)(msg_len >> 8);
336 int flags = (int)Flags;
339 data [60] = (byte)flags;
340 data [61] = (byte)((uint)flags >> 8);
341 data [62] = (byte)((uint)flags >> 16);
342 data [63] = (byte)((uint)flags >> 24);
344 Buffer.BlockCopy (target, 0, data, dom_off, target.Length);
345 Buffer.BlockCopy (user, 0, data, uname_off, user.Length);
346 Buffer.BlockCopy (host, 0, data, host_off, host.Length);
349 Buffer.BlockCopy (lm, 0, data, lmresp_off, lm.Length);
350 Array.Clear (lm, 0, lm.Length);
352 Buffer.BlockCopy (ntlm, 0, data, ntresp_off, ntlm.Length);
353 Array.Clear (ntlm, 0, ntlm.Length);