/* X-Chat
* Copyright (C) 1998 Peter Zelezny.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
*
* MS Proxy (ISA server) support is (c) 2006 Pavel Fedin <sonic_amiga@rambler.ru>
* based on Dante source code
* Copyright (c) 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006
* Inferno Nettverk A/S, Norway. All rights reserved.
*/
/*#define DEBUG_MSPROXY*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#define WANTSOCKET
#define WANTARPA
#include "inet.h"
#include "xchat.h"
#include "network.h"
#include "xchatc.h"
#include "server.h"
#include "msproxy.h"
#ifdef USE_MSPROXY
#include <ntlm.h>
static int
send_msprequest(s, state, request, end)
int s;
struct msproxy_state_t *state;
struct msproxy_request_t *request;
char *end;
{
ssize_t w;
size_t l;
request->magic25 = htonl(MSPROXY_VERSION);
request->serverack = state->seq_recv;
/* don't start incrementing sequence until we are acking packet #2. */
request->sequence = (unsigned char)(request->serverack >= 2 ? state->seq_sent + 1 : 0);
memcpy(request->RWSP, "RWSP", sizeof(request->RWSP));
l = end - (char *)request;
/* all requests must be atleast MSPROXY_MINLENGTH it seems. */
if (l < MSPROXY_MINLENGTH) {
bzero(end, (size_t)(MSPROXY_MINLENGTH - l));
l = MSPROXY_MINLENGTH;
}
if ((w = send(s, request, l, 0)) != l) {
#ifdef DEBUG_MSPROXY
printf ("send_msprequest(): send() failed (%d bytes sent instead of %d\n", w, l);
perror ("Error is");
#endif
return -1;
}
state->seq_sent = request->sequence;
return w;
}
static int
recv_mspresponse(s, state, response)
int s;
struct msproxy_state_t *state;
struct msproxy_response_t *response;
{
ssize_t r;
do {
if ((r = recv (s, response, sizeof (*response), 0)) < MSPROXY_MINLENGTH) {
#ifdef DEBUG_MSPROXY
printf ("recv_mspresponse(): expected to read atleast %d, read %d\n", MSPROXY_MINLENGTH, r);
#endif
return -1;
}
if (state->seq_recv == 0)
break; /* not started incrementing yet. */
#ifdef DEBUG_MSPROXY
if (response->sequence == state->seq_recv)
printf ("seq_recv: %d, dup response, seqnumber: 0x%x\n", state->seq_recv, response->sequence);
#endif
} while (response->sequence == state->seq_recv);
state->seq_recv = response->sequence;
return r;
}
int
traverse_msproxy (int sok, char *serverAddr, int port, struct msproxy_state_t *state, netstore *ns_proxy, int csok4, int csok6, int *csok, char bound)
{
struct msproxy_request_t req;
struct msproxy_response_t res;
char *data, *p;
char hostname[NT_MAXNAMELEN];
char ntdomain[NT_MAXNAMELEN];
char challenge[8];
netstore *ns_client;
int clientport;
guint32 destaddr;
guint32 flags;
if (!prefs.proxy_auth || !prefs.proxy_user[0] || !prefs.proxy_pass[0] )
return 1;
/* MS proxy protocol implementation currently doesn't support IPv6 */
destaddr = net_getsockaddr_v4 (ns_proxy);
if (!destaddr)
return 1;
state->seq_recv = 0;
state->seq_sent = 0;
#ifdef DEBUG_MSPROXY
printf ("Connecting to %s:%d via MS proxy\n", serverAddr, port);
#endif
gethostname (hostname, NT_MAXNAMELEN);
p = strchr (hostname, '.');
if (p)
*p = '\0';
bzero (&req, sizeof(req));
req.clientid = htonl(0x0a000000); /* Initial client ID is always 0x0a */
req.command = htons(MSPROXY_HELLO); /* HELLO command */
req.packet.hello.magic5 = htons(0x4b00); /* Fill in magic values */
req.packet.hello.magic10 = htons(0x1400);
req.packet.hello.magic15 = htons(0x0400);
req.packet.hello.magic20 = htons(0x5704);
req.packet.hello.magic25 = htons(0x0004);
req.packet.hello.magic30 = htons(0x0100);
req.packet.hello.magic35 = htons(0x4a02);
req.packet.hello.magic40 = htons(0x3000);
req.packet.hello.magic45 = htons(0x4400);
req.packet.hello.magic50 = htons(0x3900);
data = req.packet.hello.data;
strcpy (data, prefs.proxy_user); /* Append a username */
data += strlen (prefs.proxy_user)+2; /* +2 automatically creates second empty string */
strcpy (data, MSPROXY_EXECUTABLE); /* Append an application name */
data += strlen (MSPROXY_EXECUTABLE)+1;
strcpy (data, hostname); /* Append a hostname */
data += strlen (hostname)+1;
if (send_msprequest(sok, state, &req, data) == -1)
return 1;
if (recv_mspresponse(sok, state, &res) == -1)
return 1;
if (strcmp(res.RWSP, "RWSP") != 0) {
#ifdef DEBUG_MSPROXY
printf ("Received mailformed packet (no RWSP signature)\n");
#endif
return 1;
}
if (ntohs(res.command) >> 8 != 0x10) {
#ifdef DEBUG_MSPROXY
printf ("expected res.command = 10??, is %x", ntohs(res.command));
#endif
return 1;
}
state->clientid = htonl(rand());
state->serverid = res.serverid;
#ifdef DEBUG_MSPROXY
printf ("clientid: 0x%x, serverid: 0x%0x\n", state->clientid, state->serverid);
printf ("packet #2\n");
#endif
/* almost identical. */
req.clientid = state->clientid;
req.serverid = state->serverid;
if (send_msprequest(sok, state, &req, data) == -1)
return 1;
if (recv_mspresponse(sok, state, &res) == -1)
return 1;
if (res.serverid != state->serverid) {
#ifdef DEBUG_MSPROXY
printf ("expected serverid = 0x%x, is 0x%x\n",state->serverid, res.serverid);
#endif
return 1;
}
if (res.sequence != 0x01) {
#ifdef DEBUG_MSPROXY
printf ("expected res.sequence = 0x01, is 0x%x\n", res.sequence);
#endif
return 1;
}
if (ntohs(res.command) != MSPROXY_USERINFO_ACK) {
#ifdef DEBUG_MSPROXY
printf ("expected res.command = 0x%x, is 0x%x\n", MSPROXY_USERINFO_ACK, ntohs(res.command));
#endif
return 1;
}
#ifdef DEBUG_MSPROXY
printf ("packet #3\n");
#endif
bzero(&req, sizeof(req));
req.clientid = state->clientid;
req.serverid = state->serverid;
req.command = htons(MSPROXY_AUTHENTICATE);
memcpy(req.packet.auth.NTLMSSP, "NTLMSSP", sizeof("NTLMSSP"));
req.packet.auth.bindaddr = htonl(0x02000000);
req.packet.auth.msgtype = htonl(0x01000000);
/* NTLM flags: 0x80000000 Negotiate LAN Manager key
0x10000000 Negotiate sign
0x04000000 Request target
0x02000000 Negotiate OEM
0x00800000 Always sign
0x00020000 Negotiate NTLM
*/
req.packet.auth.flags = htonl(0x06020000);
if (send_msprequest(sok, state, &req, &req.packet.auth.data) == -1)
return 1;
if (recv_mspresponse(sok, state, &res) == -1)
return 1;
if (res.serverid != state->serverid) {
#ifdef DEBUG_MSPROXY
printf ("expected serverid = 0x%x, is 0x%x\n", state->serverid, res.serverid);
#endif
return 1;
}
if (ntohs(res.command) != MSPROXY_AUTHENTICATE_ACK) {
#ifdef DEBUG_MSPROXY
printf ("expected res.command = 0x%x, is 0x%x\n", MSPROXY_AUTHENTICATE_ACK, ntohs(res.command));
#endif
return 1;
}
flags = res.packet.auth.flags & htonl(0x00020000); /* Remember if the server supports NTLM */
memcpy(challenge, &res.packet.auth.challenge, sizeof(challenge));
memcpy(ntdomain, &res.packet.auth.NTLMSSP[res.packet.auth.target.offset], res.packet.auth.target.len);
ntdomain[res.packet.auth.target.len] = 0;
#ifdef DEBUG_MSPROXY
printf ("ntdomain: \"%s\"\n", ntdomain);
printf ("packet #4\n");
#endif
bzero(&req, sizeof(req));
req.clientid = state->clientid;
req.serverid = state->serverid;
req.command = htons(MSPROXY_AUTHENTICATE_2); /* Authentication response */
req.packet.auth2.magic3 = htons(0x0200); /* Something */
memcpy(req.packet.auth2.NTLMSSP, "NTLMSSP", sizeof("NTLMSSP")); /* Start of NTLM message */
req.packet.auth2.msgtype = htonl(0x03000000); /* Message type 2 */
req.packet.auth2.flags = flags | htonl(0x02000000); /* Choose authentication method */
data = req.packet.auth2.data;
if (flags) {
req.packet.auth2.lm_resp.len = 0; /* We are here if NTLM is supported, */
req.packet.auth2.lm_resp.alloc = 0; /* Do not fill in insecure LM response */
req.packet.auth2.lm_resp.offset = data - req.packet.auth2.NTLMSSP;
req.packet.auth2.ntlm_resp.len = 24; /* Fill in NTLM response security buffer */
req.packet.auth2.ntlm_resp.alloc = 24;
req.packet.auth2.ntlm_resp.offset = data - req.packet.auth2.NTLMSSP;
ntlm_smb_nt_encrypt(prefs.proxy_pass, challenge, data); /* Append an NTLM response */
data += 24;
} else {
req.packet.auth2.lm_resp.len = 24; /* Fill in LM response security buffer */
req.packet.auth2.lm_resp.alloc = 24;
req.packet.auth2.lm_resp.offset = data - req.packet.auth2.NTLMSSP;
ntlm_smb_encrypt(prefs.proxy_pass, challenge, data); /* Append an LM response */
data += 24;
req.packet.auth2.ntlm_resp.len = 0; /* NTLM response is empty */
req.packet.auth2.ntlm_resp.alloc = 0;
req.packet.auth2.ntlm_resp.offset = data - req.packet.auth2.NTLMSSP;
}
req.packet.auth2.ntdomain_buf.len = strlen(ntdomain); /* Domain name */
req.packet.auth2.ntdomain_buf.alloc = req.packet.auth2.ntdomain_buf.len;
req.packet.auth2.ntdomain_buf.offset = data - req.packet.auth2.NTLMSSP;
strcpy(data, ntdomain);
data += req.packet.auth2.ntdomain_buf.len;
req.packet.auth2.username_buf.len = strlen(prefs.proxy_user); /* Username */
req.packet.auth2.username_buf.alloc = req.packet.auth2.username_buf.len;
req.packet.auth2.username_buf.offset = data - req.packet.auth2.NTLMSSP;
strcpy(data, prefs.proxy_user);
data += req.packet.auth2.username_buf.len;
req.packet.auth2.clienthost_buf.len = strlen(hostname); /* Hostname */
req.packet.auth2.clienthost_buf.alloc = req.packet.auth2.clienthost_buf.len;
req.packet.auth2.clienthost_buf.offset = data - req.packet.auth2.NTLMSSP;
strcpy(data, hostname);
data += req.packet.auth2.clienthost_buf.len;
req.packet.auth2.sessionkey_buf.len = 0; /* Session key (we don't use it) */
req.packet.auth2.sessionkey_buf.alloc = 0;
req.packet.auth2.sessionkey_buf.offset = data - req.packet.auth2.NTLMSSP;
if (send_msprequest(sok, state, &req, data) == -1)
return 1;
if (recv_mspresponse(sok, state, &res) == -1)
return 1;
if (res.serverid != state->serverid) {
#ifdef DEBUG_MSPROXY
printf ("expected res.serverid = 0x%x, is 0x%x\n", state->serverid, res.serverid);
#endif
return 1;
}
if (res.clientack != 0x01) {
#ifdef DEBUG_MSPROXY
printf ("expected res.clientack = 0x01, is 0x%x\n", res.clientack);
#endif
return 1;
}
if (ntohs(res.command) >> 8 != 0x47) {
#ifdef DEBUG_MSPROXY
printf ("expected res.command = 47??, is 0x%x\n", ntohs(res.command));
#endif
return 1;
}
if (ntohs(res.command) == MSPROXY_AUTHENTICATE_2_NAK) {
#ifdef DEBUG_MSPROXY
printf ("Authentication failed\n");
#endif
return -1;
}
#ifdef DEBUG_MSPROXY
printf ("packet #5\n");
#endif
bzero(&req, sizeof(req));
req.clientid = state->clientid;
req.serverid = state->serverid;
req.command = htons(MSPROXY_CONNECT);
req.packet.connect.magic2 = htons(0x0200);
req.packet.connect.magic6 = htons(0x0200);
req.packet.connect.destport = htons(port);
req.packet.connect.destaddr = destaddr;
data = req.packet.connect.executable;
strcpy(data, MSPROXY_EXECUTABLE);
data += strlen(MSPROXY_EXECUTABLE) + 1;
/*
* need to tell server what port we will connect from, so we bind our sockets.
*/
ns_client = net_store_new ();
if (!bound) {
net_store_fill_any (ns_client);
net_bind(ns_client, csok4, csok6);
#ifdef DEBUG_MSPROXY
perror ("bind() result");
#endif
}
clientport = net_getsockport(csok4, csok6);
if (clientport == -1) {
#ifdef DEBUG_MSPROXY
printf ("Unable to obtain source port\n");
#endif
return 1;
}
req.packet.connect.srcport = clientport;
if (send_msprequest(sok, state, &req, data) == -1)
return 1;
if (recv_mspresponse(sok, state, &res) == -1)
return 1;
if (ntohs(res.command) != MSPROXY_CONNECT_ACK) {
#ifdef DEBUG_MSPROXY
printf ("expected res.command = 0x%x, is 0x%x\n",MSPROXY_CONNECT_ACK, ntohs(res.command));
#endif
return 1;
}
net_store_fill_v4 (ns_client, res.packet.connect.clientaddr, res.packet.connect.clientport);
#ifdef DEBUG_MSPROXY
printf ("Connecting...\n");
#endif
if (net_connect (ns_client, csok4, csok6, csok) != 0) {
#ifdef DEBUG_MSPROXY
printf ("Failed to connect to port %d\n", htons(res.packet.connect.clientport));
#endif
net_store_destroy (ns_client);
return 1;
}
net_store_destroy (ns_client);
#ifdef DEBUG_MSPROXY
printf ("packet #6\n");
#endif
req.clientid = state->clientid;
req.serverid = state->serverid;
req.command = htons(MSPROXY_USERINFO_ACK);
if (send_msprequest(sok, state, &req, req.packet.connack.data) == -1)
return 1;
return 0;
}
void
msproxy_keepalive (void)
{
server *serv;
GSList *list = serv_list;
struct msproxy_request_t req;
struct msproxy_response_t res;
while (list)
{
serv = list->data;
if (serv->connected && (serv->proxy_sok != -1))
{
#ifdef DEBUG_MSPROXY
printf ("sending MS proxy keepalive packet\n");
#endif
bzero(&req, sizeof(req));
req.clientid = serv->msp_state.clientid;
req.serverid = serv->msp_state.serverid;
req.command = htons(MSPROXY_HELLO);
if (send_msprequest(serv->proxy_sok, &serv->msp_state, &req, req.packet.hello.data) == -1)
continue;
recv_mspresponse(serv->proxy_sok, &serv->msp_state, &res);
#ifdef DEBUG_MSPROXY
if (ntohs(res.command) != MSPROXY_USERINFO_ACK)
printf ("expected res.command = 0x%x, is 0x%x\n", MSPROXY_USERINFO_ACK, ntohs(res.command));
#endif
}
list = list->next;
}
}
#endif
