using System;
using System.IO;
using System.Net;
using System.Net.NetworkInformation;
using System.Security.Cryptography;
using System.Text;
using Mono.Security;
using Mono.Security.Protocol.Ntlm;
namespace System.ServiceModel.Security{
internal abstract class SspiSession
{
internal static readonly byte [] NtlmSSP = new byte [] {
0x4E, 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00};
public long Challenge, Context, ClientOSVersion, ServerOSVersion;
public string ServerName, DomainName, DnsHostName, DnsDomainName;
public bool Verify (byte [] expected, byte [] actual, int offset, int length)
{
if (expected.Length != length)
return false;
for (int i = 0; i < length; i++)
if (expected [i] != actual [i + offset])
return false;
return true;
}
public SspiSecurityBufferStruct ReadSecurityBuffer (BinaryReader reader)
{
return new SspiSecurityBufferStruct (
reader.ReadInt16 (),
reader.ReadInt16 (),
reader.ReadInt32 ());
}
}
internal struct SspiSecurityBufferStruct
{
public SspiSecurityBufferStruct (short length, short allocatedSpace, int offset)
{
Length = length;
AllocatedSpace = allocatedSpace;
Offset = offset;
}
public readonly short Length;
public readonly short AllocatedSpace;
public readonly int Offset;
}
internal class SspiClientSession : SspiSession
{
Type2Message type2;
Type3Message type3;
// Class(60) {
// OID(spnego),
// Class(A0) {
// Class(30) {
// Class(A0) {
// Class(30) { OID,OID,OID} },
// Class(A2) { OctetStream } } } }
public byte [] ProcessSpnegoInitialContextTokenRequest ()
{
Type1Message type1 = new Type1Message (NtlmVersion.Version3);
type1.Flags = unchecked ((NtlmFlags) 0xE21882B7);
type1.Domain = "WORKGROUP"; // FIXME: remove it
ASN1 asn = new ASN1 (0x60);
ASN1 asn2 = new ASN1 (0xA0);
ASN1 asn21 = new ASN1 (0x30);
ASN1 asn211 = new ASN1 (0xA0);
ASN1 asn2111 = new ASN1 (0x30);
asn211.Add (asn2111);
asn2111.Add (ASN1Convert.FromOid (Constants.OidNtlmSsp));
asn2111.Add (ASN1Convert.FromOid (Constants.OidKerberos5));
asn2111.Add (ASN1Convert.FromOid (Constants.OidMIT));
ASN1 asn212 = new ASN1 (0xA2);
ASN1 asn2121 = new ASN1 (0x4);
asn2121.Value = type1.GetBytes ();
asn212.Add (asn2121);
asn21.Add (asn211);
asn21.Add (asn212);
asn2.Add (asn21);
asn.Add (ASN1Convert.FromOid (Constants.OidSpnego));
asn.Add (asn2);
return asn.GetBytes ();
}
// Example buffer:
// A18181 307F A003
// 0A0101
// A10C 060A2B06010401823702020A
// A26A 0468 NTLM
// NTLM = 4E544C4D53535000 0200000004000400 3800000035829AE2
// 0D1A7FF0F171F339 0000000000000000 2C002C003C000000
// 0501280A0000000F 5000430002000400 5000430001000400
// 5000430004000400 5000430003000400 5000430006000400
// 0100000000000000
public void ProcessSpnegoInitialContextTokenResponse (byte [] raw)
{
ASN1 asn1 = new ASN1 (raw);
// FIXME: check OIDs and structure
ProcessMessageType2 (asn1 [0] [2] [0].Value);
}
// Class { Class { Class { OctetStream } } }
public byte [] ProcessSpnegoProcessContextToken (string user, string pass)
{
ASN1 asn = new ASN1 (0xA1);
ASN1 asn2 = new ASN1 (0x30);
ASN1 asn3 = new ASN1 (0xA2);
asn3.Add (new ASN1 (0x04, ProcessMessageType3 (user, pass)));
asn2.Add (asn3);
asn.Add (asn2);
return asn.GetBytes ();
}
public byte [] ProcessMessageType1 ()
{
Type1Message type1 = new Type1Message (NtlmVersion.Version3);
type1.Flags = unchecked ((NtlmFlags) 0xE21882B7);
return type1.GetBytes ();
}
string TargetName;
public void ProcessMessageType2 (byte [] raw)
{
type2 = new Type2Message (raw);
}
public byte [] ProcessMessageType3 (string user, string password)
{
TargetName = Environment.MachineName;
ServerName = Environment.MachineName;
// FIXME
DomainName = ServerName;// IPGlobalProperties.GetIPGlobalProperties ().DomainName;
DnsHostName = Dns.GetHostName ();
DnsDomainName = DnsHostName; // FIXME
type3 = new Type3Message (NtlmVersion.Version3);
type3.Flags = (NtlmFlags) (unchecked ((int) 0xE2188235));
type3.Domain = DomainName;
type3.Host = DnsHostName;
type3.Challenge = type2.Nonce;
type3.Username = user;
type3.Password = password;
return type3.GetBytes ();
}
}
internal class SspiServerSession : SspiSession
{
public string TargetName;
public long SuppliedDomain, SuppliedWorkstation;
Type1Message type1;
Type2Message type2;
Type3Message type3;
// Example buffer:
// 6069 0606 2B0601050502 A05F 305D A024 3022
// 060A 2B06010401823702020A
// 0609 2A864882F712010202
// 0609 2A864886F712010202
// A235 0433 NTLM
// NTLM = 4E544C4D53535000 01000000 B7B218E2 090009002A000000
// 0200020028000000 0501280A0000000F 5043 574F524B47524F5550
public void ProcessSpnegoInitialContextTokenRequest (byte [] raw)
{
ASN1 asn1 = new ASN1 (raw);
// FIXME: check OIDs
ProcessMessageType1 (asn1 [1] [0] [1] [0].Value);
}
// Class {
// Class {
// Class { Enum },
// Class { OID(NTLMSSP) },
// Class { OctetStream } } }
public byte [] ProcessSpnegoInitialContextTokenResponse ()
{
ASN1 top = new ASN1 (0xA1);
ASN1 asn = new ASN1 (0x30);
ASN1 asn1 = new ASN1 (0xA0);
// FIXME: what is this enum?
asn1.Add (new ASN1 (0x0A, new byte [] {1})); // Enum whatever
ASN1 asn2 = new ASN1 (0xA1);
asn2.Add (ASN1Convert.FromOid (Constants.OidNtlmSsp));
ASN1 asn3 = new ASN1 (0xA2);
asn3.Add (new ASN1 (0x04, ProcessMessageType2 ()));
asn.Add (asn1);
asn.Add (asn2);
asn.Add (asn3);
top.Add (asn);
return top.GetBytes ();
}
// Example buffer:
// A181A7
// 3081A4
// A281A1
// 04819E
// 4E544C4D53535000 03000000
// 180018005E000000 1800180076000000 0400040048000000
// 0E000E004C000000 040004005A000000 100010008E000000
// 358218E2 0501280A0000000F
// 50004300 6100740073007500730068006900 50004300
// [8 bytes LM] [16 bytes of 0s]
// [24 bytes of NTLM]
// C94EE2ADE7E32244 BD60D3B33609C167
public void ProcessSpnegoProcessContextToken (byte [] raw)
{
ASN1 asn1 = new ASN1 (raw);
// FIXME: check structure
ProcessMessageType3 (asn1 [0] [0] [0].Value);
}
public void ProcessMessageType1 (byte [] raw)
{
type1 = new Type1Message (raw, NtlmVersion.Version3);
}
public byte [] ProcessMessageType2 ()
{
byte [] bytes = new byte [8];
RandomNumberGenerator.Create ().GetNonZeroBytes (bytes);
Challenge = bytes [0] << 24 + bytes [1] << 16 + bytes [2] << 8 + bytes [3];
Context = 0; // FIXME
ServerOSVersion = 0x0F00000A28010500; // FIXME
TargetName = Environment.MachineName;
ServerName = Environment.MachineName;
// FIXME
DomainName = ServerName;// IPGlobalProperties.GetIPGlobalProperties ().DomainName;
DnsHostName = Dns.GetHostName ();
DnsDomainName = DnsHostName; // FIXME
type2 = new Type2Message (NtlmVersion.Version3);
type2.Flags = (NtlmFlags) (unchecked ((int) 0xE21882B7));
type2.TargetName = TargetName;
type2.Target.ServerName = ServerName;
type2.Target.DomainName = DomainName;
type2.Target.DnsHostName = DnsHostName;
type2.Target.DnsDomainName = DnsDomainName;
return type2.GetBytes ();
}
public void ProcessMessageType3 (byte [] raw)
{
/*
MemoryStream ms = new MemoryStream (raw);
if (!Verify (NtlmSSP, raw, 0, 8))
throw new SecurityNegotiationException ("Expected NTLM SSPI header not found");
BinaryReader reader = new BinaryReader (ms);
reader.ReadInt64 (); // skip 8 bytes
if (reader.ReadInt32 () != 3)
throw new SecurityNegotiationException ("SSPI type 3 message is expected");
SspiSecurityBufferStruct lmResInfo = ReadSecurityBuffer (reader);
SspiSecurityBufferStruct ntlmResInfo = ReadSecurityBuffer (reader);
SspiSecurityBufferStruct targetNameInfo = ReadSecurityBuffer (reader);
SspiSecurityBufferStruct userNameInfo = ReadSecurityBuffer (reader);
SspiSecurityBufferStruct wsNameInfo = ReadSecurityBuffer (reader);
SspiSecurityBufferStruct sessionKeyInfo = ReadSecurityBuffer (reader);
int flags = reader.ReadInt32 ();
ServerOSVersion = reader.ReadInt64 ();
*/
type3 = new Type3Message (raw, NtlmVersion.Version3);
}
}
}
|