crypt_openssl.c 6.59 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11
/*
 * Copyright (c) Edward Thomson.  All rights reserved.
 *
 * This file is part of ntlmclient, distributed under the MIT license.
 * For full terms and copyright information, and for third-party
 * copyright information, see the included LICENSE.txt file.
 */

#include <stdlib.h>
#include <string.h>

12 13 14 15 16 17 18 19 20
#ifdef CRYPT_OPENSSL_DYNAMIC
# include <dlfcn.h>
#else
# include <openssl/rand.h>
# include <openssl/des.h>
# include <openssl/md4.h>
# include <openssl/hmac.h>
# include <openssl/err.h>
#endif
21 22 23 24 25 26

#include "ntlm.h"
#include "compat.h"
#include "util.h"
#include "crypt.h"

27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(CRYPT_OPENSSL_DYNAMIC)

static inline HMAC_CTX *HMAC_CTX_new(void)
{
	return calloc(1, sizeof(HMAC_CTX));
}

static inline int HMAC_CTX_reset(HMAC_CTX *ctx)
{
	ntlm_memzero(ctx, sizeof(HMAC_CTX));
	return 1;
}

static inline void HMAC_CTX_free(HMAC_CTX *ctx)
{
	free(ctx);
}

#endif

#if OPENSSL_VERSION_NUMBER >= 0x10100000L || defined(CRYPT_OPENSSL_DYNAMIC)

static inline void HMAC_CTX_cleanup(HMAC_CTX *ctx)
{
	NTLM_UNUSED(ctx);
}

#endif


#ifdef CRYPT_OPENSSL_DYNAMIC

static bool ntlm_crypt_init_functions(ntlm_client *ntlm)
{
	void *handle;

	if ((handle = dlopen("libssl.so.1.1", RTLD_NOW)) == NULL &&
	    (handle = dlopen("libssl.1.1.dylib", RTLD_NOW)) == NULL &&
	    (handle = dlopen("libssl.so.1.0.0", RTLD_NOW)) == NULL &&
	    (handle = dlopen("libssl.1.0.0.dylib", RTLD_NOW)) == NULL &&
	    (handle = dlopen("libssl.so.10", RTLD_NOW)) == NULL) {
		ntlm_client_set_errmsg(ntlm, "could not open libssl");
		return false;
	}

	ntlm->crypt_ctx.des_set_key_fn = dlsym(handle, "DES_set_key");
	ntlm->crypt_ctx.des_ecb_encrypt_fn = dlsym(handle, "DES_ecb_encrypt");
	ntlm->crypt_ctx.err_get_error_fn = dlsym(handle, "ERR_get_error");
	ntlm->crypt_ctx.err_lib_error_string_fn = dlsym(handle, "ERR_lib_error_string");
	ntlm->crypt_ctx.evp_md5_fn = dlsym(handle, "EVP_md5");
	ntlm->crypt_ctx.hmac_ctx_new_fn = dlsym(handle, "HMAC_CTX_new");
	ntlm->crypt_ctx.hmac_ctx_free_fn = dlsym(handle, "HMAC_CTX_free");
	ntlm->crypt_ctx.hmac_ctx_reset_fn = dlsym(handle, "HMAC_CTX_reset");
	ntlm->crypt_ctx.hmac_init_ex_fn = dlsym(handle, "HMAC_Init_ex");
	ntlm->crypt_ctx.hmac_update_fn = dlsym(handle, "HMAC_Update");
	ntlm->crypt_ctx.hmac_final_fn = dlsym(handle, "HMAC_Final");
	ntlm->crypt_ctx.md4_fn = dlsym(handle, "MD4");
	ntlm->crypt_ctx.rand_bytes_fn = dlsym(handle, "RAND_bytes");

	if (!ntlm->crypt_ctx.des_set_key_fn ||
	    !ntlm->crypt_ctx.des_ecb_encrypt_fn ||
	    !ntlm->crypt_ctx.err_get_error_fn ||
	    !ntlm->crypt_ctx.err_lib_error_string_fn ||
	    !ntlm->crypt_ctx.evp_md5_fn ||
	    !ntlm->crypt_ctx.hmac_init_ex_fn ||
	    !ntlm->crypt_ctx.hmac_update_fn ||
	    !ntlm->crypt_ctx.hmac_final_fn ||
	    !ntlm->crypt_ctx.md4_fn ||
	    !ntlm->crypt_ctx.rand_bytes_fn) {
		ntlm_client_set_errmsg(ntlm, "could not load libssl functions");
		dlclose(handle);
		return false;
	}

	/* Toggle legacy HMAC context functions */
	if (ntlm->crypt_ctx.hmac_ctx_new_fn &&
	    ntlm->crypt_ctx.hmac_ctx_free_fn &&
	    ntlm->crypt_ctx.hmac_ctx_reset_fn) {
		ntlm->crypt_ctx.hmac_ctx_cleanup_fn = HMAC_CTX_cleanup;
	} else {
		ntlm->crypt_ctx.hmac_ctx_cleanup_fn = dlsym(handle, "HMAC_CTX_cleanup");

		if (!ntlm->crypt_ctx.hmac_ctx_cleanup_fn) {
			ntlm_client_set_errmsg(ntlm, "could not load legacy libssl functions");
			dlclose(handle);
			return false;
		}

		ntlm->crypt_ctx.hmac_ctx_new_fn = HMAC_CTX_new;
		ntlm->crypt_ctx.hmac_ctx_free_fn = HMAC_CTX_free;
		ntlm->crypt_ctx.hmac_ctx_reset_fn = HMAC_CTX_reset;
	}

	ntlm->crypt_ctx.openssl_handle = handle;
	return true;
}

#else /* CRYPT_OPENSSL_DYNAMIC */

static bool ntlm_crypt_init_functions(ntlm_client *ntlm)
{
	ntlm->crypt_ctx.des_set_key_fn = DES_set_key;
	ntlm->crypt_ctx.des_ecb_encrypt_fn = DES_ecb_encrypt;
	ntlm->crypt_ctx.err_get_error_fn = ERR_get_error;
	ntlm->crypt_ctx.err_lib_error_string_fn = ERR_lib_error_string;
	ntlm->crypt_ctx.evp_md5_fn = EVP_md5;
	ntlm->crypt_ctx.hmac_ctx_new_fn = HMAC_CTX_new;
	ntlm->crypt_ctx.hmac_ctx_free_fn = HMAC_CTX_free;
	ntlm->crypt_ctx.hmac_ctx_reset_fn = HMAC_CTX_reset;
	ntlm->crypt_ctx.hmac_ctx_cleanup_fn = HMAC_CTX_cleanup;
	ntlm->crypt_ctx.hmac_init_ex_fn = HMAC_Init_ex;
	ntlm->crypt_ctx.hmac_update_fn = HMAC_Update;
	ntlm->crypt_ctx.hmac_final_fn = HMAC_Final;
	ntlm->crypt_ctx.md4_fn = MD4;
	ntlm->crypt_ctx.rand_bytes_fn = RAND_bytes;

	return true;
}

#endif /* CRYPT_OPENSSL_DYNAMIC */

bool ntlm_crypt_init(ntlm_client *ntlm)
{
	if (!ntlm_crypt_init_functions(ntlm))
		return false;

	ntlm->crypt_ctx.hmac = ntlm->crypt_ctx.hmac_ctx_new_fn();

	if (ntlm->crypt_ctx.hmac == NULL) {
		ntlm_client_set_errmsg(ntlm, "out of memory");
		return false;
	}

	return true;
}

163 164
bool ntlm_random_bytes(
	unsigned char *out,
165
	ntlm_client *ntlm,
166 167
	size_t len)
{
168
	int rc = ntlm->crypt_ctx.rand_bytes_fn(out, len);
169 170

	if (rc != 1) {
171
		ntlm_client_set_errmsg(ntlm, ntlm->crypt_ctx.err_lib_error_string_fn(ntlm->crypt_ctx.err_get_error_fn()));
172 173 174 175 176 177 178 179
		return false;
	}

	return true;
}

bool ntlm_des_encrypt(
	ntlm_des_block *out,
180
	ntlm_client *ntlm,
181 182 183 184 185
	ntlm_des_block *plaintext,
	ntlm_des_block *key)
{
	DES_key_schedule keysched;

186 187
	NTLM_UNUSED(ntlm);

188 189
	memset(out, 0, sizeof(ntlm_des_block));

190 191
	ntlm->crypt_ctx.des_set_key_fn(key, &keysched);
	ntlm->crypt_ctx.des_ecb_encrypt_fn(plaintext, out, &keysched, DES_ENCRYPT);
192 193 194 195 196 197

	return true;
}

bool ntlm_md4_digest(
	unsigned char out[CRYPT_MD4_DIGESTSIZE],
198
	ntlm_client *ntlm,
199 200 201
	const unsigned char *in,
	size_t in_len)
{
202
	ntlm->crypt_ctx.md4_fn(in, in_len, out);
203 204 205 206
	return true;
}

bool ntlm_hmac_md5_init(
207
	ntlm_client *ntlm,
208 209 210
	const unsigned char *key,
	size_t key_len)
{
211 212 213 214 215 216
	const EVP_MD *md5 = ntlm->crypt_ctx.evp_md5_fn();

	ntlm->crypt_ctx.hmac_ctx_cleanup_fn(ntlm->crypt_ctx.hmac);

	return ntlm->crypt_ctx.hmac_ctx_reset_fn(ntlm->crypt_ctx.hmac) &&
	       ntlm->crypt_ctx.hmac_init_ex_fn(ntlm->crypt_ctx.hmac, key, key_len, md5, NULL);
217 218 219
}

bool ntlm_hmac_md5_update(
220
	ntlm_client *ntlm,
221 222 223
	const unsigned char *in,
	size_t in_len)
{
224
	return ntlm->crypt_ctx.hmac_update_fn(ntlm->crypt_ctx.hmac, in, in_len);
225 226 227 228 229
}

bool ntlm_hmac_md5_final(
	unsigned char *out,
	size_t *out_len,
230
	ntlm_client *ntlm)
231 232 233 234 235 236
{
	unsigned int len;

	if (*out_len < CRYPT_MD5_DIGESTSIZE)
		return false;

237
	if (!ntlm->crypt_ctx.hmac_final_fn(ntlm->crypt_ctx.hmac, out, &len))
238 239 240 241 242 243
		return false;

	*out_len = len;
	return true;
}

244
void ntlm_crypt_shutdown(ntlm_client *ntlm)
245
{
246 247 248 249 250 251 252 253 254 255 256
	if (ntlm->crypt_ctx.hmac) {
		ntlm->crypt_ctx.hmac_ctx_cleanup_fn(ntlm->crypt_ctx.hmac);
		ntlm->crypt_ctx.hmac_ctx_free_fn(ntlm->crypt_ctx.hmac);
	}

#ifdef CRYPT_OPENSSL_DYNAMIC
	if (ntlm->crypt_ctx.openssl_handle)
		dlclose(ntlm->crypt_ctx.openssl_handle);
#endif

	memset(&ntlm->crypt_ctx, 0, sizeof(ntlm_crypt_ctx));
257
}