/* parse a spnego NTLMSSP challenge packet giving two security blobs */ bool spnego_parse_challenge(TALLOC_CTX *ctx, const DATA_BLOB blob, DATA_BLOB *chal1, DATA_BLOB *chal2) { bool ret = false; ASN1_DATA *data; ZERO_STRUCTP(chal1); ZERO_STRUCTP(chal2); data = asn1_init(talloc_tos()); if (data == NULL) { return false; } if (!asn1_load(data, blob)) goto err; if (!asn1_start_tag(data,ASN1_CONTEXT(1))) goto err; if (!asn1_start_tag(data,ASN1_SEQUENCE(0))) goto err; if (!asn1_start_tag(data,ASN1_CONTEXT(0))) goto err; if (!asn1_check_enumerated(data,1)) goto err; if (!asn1_end_tag(data)) goto err; if (!asn1_start_tag(data,ASN1_CONTEXT(1))) goto err; if (!asn1_check_OID(data, OID_NTLMSSP)) goto err; if (!asn1_end_tag(data)) goto err; if (!asn1_start_tag(data,ASN1_CONTEXT(2))) goto err; if (!asn1_read_OctetString(data, ctx, chal1)) goto err; if (!asn1_end_tag(data)) goto err; /* the second challenge is optional (XP doesn't send it) */ if (asn1_tag_remaining(data)) { if (!asn1_start_tag(data,ASN1_CONTEXT(3))) goto err; if (!asn1_read_OctetString(data, ctx, chal2)) goto err; if (!asn1_end_tag(data)) goto err; } if (!asn1_end_tag(data)) goto err; if (!asn1_end_tag(data)) goto err; ret = !asn1_has_error(data); err: if (asn1_has_error(data)) { data_blob_free(chal1); data_blob_free(chal2); } asn1_free(data); return ret; }
/* parse a SPNEGO NTLMSSP auth packet. This contains the encrypted passwords */ BOOL spnego_parse_auth_response(DATA_BLOB blob, NTSTATUS nt_status, DATA_BLOB *auth) { ASN1_DATA data; uint8 negResult; if (NT_STATUS_IS_OK(nt_status)) { negResult = SPNEGO_NEG_RESULT_ACCEPT; } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { negResult = SPNEGO_NEG_RESULT_INCOMPLETE; } else { negResult = SPNEGO_NEG_RESULT_REJECT; } asn1_load(&data, blob); asn1_start_tag(&data, ASN1_CONTEXT(1)); asn1_start_tag(&data, ASN1_SEQUENCE(0)); asn1_start_tag(&data, ASN1_CONTEXT(0)); asn1_check_enumerated(&data, negResult); asn1_end_tag(&data); if (negResult == SPNEGO_NEG_RESULT_INCOMPLETE) { asn1_start_tag(&data,ASN1_CONTEXT(1)); asn1_check_OID(&data, OID_NTLMSSP); asn1_end_tag(&data); asn1_start_tag(&data,ASN1_CONTEXT(2)); asn1_read_OctetString(&data, auth); asn1_end_tag(&data); } asn1_end_tag(&data); asn1_end_tag(&data); if (data.has_error) { DEBUG(3,("spnego_parse_auth_response failed at %d\n", (int)data.ofs)); asn1_free(&data); data_blob_free(auth); return False; } asn1_free(&data); return True; }
/* parse a spnego NTLMSSP challenge packet giving two security blobs */ BOOL spnego_parse_challenge(const DATA_BLOB blob, DATA_BLOB *chal1, DATA_BLOB *chal2) { BOOL ret; ASN1_DATA data; ZERO_STRUCTP(chal1); ZERO_STRUCTP(chal2); asn1_load(&data, blob); asn1_start_tag(&data,ASN1_CONTEXT(1)); asn1_start_tag(&data,ASN1_SEQUENCE(0)); asn1_start_tag(&data,ASN1_CONTEXT(0)); asn1_check_enumerated(&data,1); asn1_end_tag(&data); asn1_start_tag(&data,ASN1_CONTEXT(1)); asn1_check_OID(&data, OID_NTLMSSP); asn1_end_tag(&data); asn1_start_tag(&data,ASN1_CONTEXT(2)); asn1_read_OctetString(&data, chal1); asn1_end_tag(&data); /* the second challenge is optional (XP doesn't send it) */ if (asn1_tag_remaining(&data)) { asn1_start_tag(&data,ASN1_CONTEXT(3)); asn1_read_OctetString(&data, chal2); asn1_end_tag(&data); } asn1_end_tag(&data); asn1_end_tag(&data); ret = !data.has_error; asn1_free(&data); return ret; }
/* parse a SPNEGO auth packet. This contains the encrypted passwords */ bool spnego_parse_auth_response(TALLOC_CTX *ctx, DATA_BLOB blob, NTSTATUS nt_status, const char *mechOID, DATA_BLOB *auth) { ASN1_DATA *data; uint8 negResult; if (NT_STATUS_IS_OK(nt_status)) { negResult = SPNEGO_ACCEPT_COMPLETED; } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { negResult = SPNEGO_ACCEPT_INCOMPLETE; } else { negResult = SPNEGO_REJECT; } data = asn1_init(talloc_tos()); if (data == NULL) { return false; } asn1_load(data, blob); asn1_start_tag(data, ASN1_CONTEXT(1)); asn1_start_tag(data, ASN1_SEQUENCE(0)); asn1_start_tag(data, ASN1_CONTEXT(0)); asn1_check_enumerated(data, negResult); asn1_end_tag(data); *auth = data_blob_null; if (asn1_tag_remaining(data)) { asn1_start_tag(data,ASN1_CONTEXT(1)); asn1_check_OID(data, mechOID); asn1_end_tag(data); if (asn1_tag_remaining(data)) { asn1_start_tag(data,ASN1_CONTEXT(2)); asn1_read_OctetString(data, ctx, auth); asn1_end_tag(data); } } else if (negResult == SPNEGO_ACCEPT_INCOMPLETE) { data->has_error = 1; } /* Binding against Win2K DC returns a duplicate of the responseToken in * the optional mechListMIC field. This is a bug in Win2K. We ignore * this field if it exists. Win2K8 may return a proper mechListMIC at * which point we need to implement the integrity checking. */ if (asn1_tag_remaining(data)) { DATA_BLOB mechList = data_blob_null; asn1_start_tag(data, ASN1_CONTEXT(3)); asn1_read_OctetString(data, ctx, &mechList); asn1_end_tag(data); data_blob_free(&mechList); DEBUG(5,("spnego_parse_auth_response received mechListMIC, " "ignoring.\n")); } asn1_end_tag(data); asn1_end_tag(data); if (data->has_error) { DEBUG(3,("spnego_parse_auth_response failed at %d\n", (int)data->ofs)); asn1_free(data); data_blob_free(auth); return False; } asn1_free(data); return True; }