source: branches/samba-3.5.x/source4/auth/credentials/credentials_ntlm.c

Last change on this file was 414, checked in by Herwig Bauernfeind, 16 years ago

Samba 3.5.0: Initial import
File size: 8.3 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 User credentials handling
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2005
8 Copyright (C) Stefan Metzmacher 2005
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22*/
23
24#include "includes.h"
25#include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
26#include "../lib/crypto/crypto.h"
27#include "libcli/auth/libcli_auth.h"
28#include "auth/credentials/credentials.h"
29
30_PUBLIC_ void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx,
31 const char **username,
32 const char **domain)
33{
34 if (cred->principal_obtained > cred->username_obtained) {
35 *domain = talloc_strdup(mem_ctx, "");
36 *username = cli_credentials_get_principal(cred, mem_ctx);
37 } else {
38 *domain = cli_credentials_get_domain(cred);
39 *username = cli_credentials_get_username(cred);
40 }
41}
42
43_PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_CTX *mem_ctx,
44 int *flags,
45 DATA_BLOB challenge, DATA_BLOB target_info,
46 DATA_BLOB *_lm_response, DATA_BLOB *_nt_response,
47 DATA_BLOB *_lm_session_key, DATA_BLOB *_session_key)
48{
49 const char *user, *domain;
50 DATA_BLOB lm_response, nt_response;
51 DATA_BLOB lm_session_key, session_key;
52 const struct samr_Password *nt_hash;
53 lm_session_key = data_blob(NULL, 0);
54
55 /* We may already have an NTLM response we prepared earlier.
56 * This is used for NTLM pass-though authentication */
57 if (cred->nt_response.data || cred->lm_response.data) {
58 *_nt_response = cred->nt_response;
59 *_lm_response = cred->lm_response;
60
61 if (!cred->lm_response.data) {
62 *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
63 }
64 *_lm_session_key = data_blob(NULL, 0);
65 *_session_key = data_blob(NULL, 0);
66 return NT_STATUS_OK;
67 }
68
69 nt_hash = cli_credentials_get_nt_hash(cred, mem_ctx);
70
71 cli_credentials_get_ntlm_username_domain(cred, mem_ctx, &user, &domain);
72
73 /* If we are sending a username@realm login (see function
74 * above), then we will not send LM, it will not be
75 * accepted */
76 if (cred->principal_obtained > cred->username_obtained) {
77 *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
78 }
79
80 /* Likewise if we are a machine account (avoid protocol downgrade attacks) */
81 if (cred->machine_account) {
82 *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
83 }
84
85 if (cred->use_kerberos == CRED_MUST_USE_KERBEROS) {
86 return NT_STATUS_ACCESS_DENIED;
87 }
88
89 if (!nt_hash) {
90 static const uint8_t zeros[16];
91 /* do nothing - blobs are zero length */
92
93 /* session key is all zeros */
94 session_key = data_blob_talloc(mem_ctx, zeros, 16);
95 lm_session_key = data_blob_talloc(mem_ctx, zeros, 16);
96
97 lm_response = data_blob(NULL, 0);
98 nt_response = data_blob(NULL, 0);
99
100 /* not doing NTLM2 without a password */
101 *flags &= ~CLI_CRED_NTLM2;
102 } else if (*flags & CLI_CRED_NTLMv2_AUTH) {
103
104 if (!target_info.length) {
105 /* be lazy, match win2k - we can't do NTLMv2 without it */
106 DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
107 return NT_STATUS_INVALID_PARAMETER;
108 }
109
110 /* TODO: if the remote server is standalone, then we should replace 'domain'
111 with the server name as supplied above */
112
113 if (!SMBNTLMv2encrypt_hash(mem_ctx,
114 user,
115 domain,
116 nt_hash->hash, &challenge,
117 &target_info,
118 &lm_response, &nt_response,
119 NULL, &session_key)) {
120 return NT_STATUS_NO_MEMORY;
121 }
122
123 /* LM Key is incompatible... */
124 *flags &= ~CLI_CRED_LANMAN_AUTH;
125 } else if (*flags & CLI_CRED_NTLM2) {
126 struct MD5Context md5_session_nonce_ctx;
127 uint8_t session_nonce[16];
128 uint8_t session_nonce_hash[16];
129 uint8_t user_session_key[16];
130
131 lm_response = data_blob_talloc(mem_ctx, NULL, 24);
132 generate_random_buffer(lm_response.data, 8);
133 memset(lm_response.data+8, 0, 16);
134
135 memcpy(session_nonce, challenge.data, 8);
136 memcpy(&session_nonce[8], lm_response.data, 8);
137
138 MD5Init(&md5_session_nonce_ctx);
139 MD5Update(&md5_session_nonce_ctx, challenge.data, 8);
140 MD5Update(&md5_session_nonce_ctx, lm_response.data, 8);
141 MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
142
143 DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
144 DEBUG(5, ("challenge is: \n"));
145 dump_data(5, session_nonce_hash, 8);
146
147 nt_response = data_blob_talloc(mem_ctx, NULL, 24);
148 SMBOWFencrypt(nt_hash->hash,
149 session_nonce_hash,
150 nt_response.data);
151
152 session_key = data_blob_talloc(mem_ctx, NULL, 16);
153
154 SMBsesskeygen_ntv1(nt_hash->hash, user_session_key);
155 hmac_md5(user_session_key, session_nonce, sizeof(session_nonce), session_key.data);
156 dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
157
158 /* LM Key is incompatible... */
159 *flags &= ~CLI_CRED_LANMAN_AUTH;
160 } else {
161 uint8_t lm_hash[16];
162 nt_response = data_blob_talloc(mem_ctx, NULL, 24);
163 SMBOWFencrypt(nt_hash->hash, challenge.data,
164 nt_response.data);
165
166 session_key = data_blob_talloc(mem_ctx, NULL, 16);
167 SMBsesskeygen_ntv1(nt_hash->hash, session_key.data);
168 dump_data_pw("NT session key:\n", session_key.data, session_key.length);
169
170 /* lanman auth is insecure, it may be disabled.
171 We may also not have a password */
172 if (*flags & CLI_CRED_LANMAN_AUTH) {
173 const char *password;
174 password = cli_credentials_get_password(cred);
175 if (!password) {
176 lm_response = nt_response;
177 } else {
178 lm_response = data_blob_talloc(mem_ctx, NULL, 24);
179 if (!SMBencrypt(password,challenge.data,
180 lm_response.data)) {
181 /* If the LM password was too long (and therefore the LM hash being
182 of the first 14 chars only), don't send it.
183
184 We don't have any better options but to send the NT response
185 */
186 data_blob_free(&lm_response);
187 lm_response = nt_response;
188 /* LM Key is incompatible with 'long' passwords */
189 *flags &= ~CLI_CRED_LANMAN_AUTH;
190 } else {
191 E_deshash(password, lm_hash);
192 lm_session_key = data_blob_talloc(mem_ctx, NULL, 16);
193 memcpy(lm_session_key.data, lm_hash, 8);
194 memset(&lm_session_key.data[8], '\0', 8);
195
196 if (!(*flags & CLI_CRED_NTLM_AUTH)) {
197 session_key = lm_session_key;
198 }
199 }
200 }
201 } else {
202 const char *password;
203
204 /* LM Key is incompatible... */
205 lm_response = nt_response;
206 *flags &= ~CLI_CRED_LANMAN_AUTH;
207
208 password = cli_credentials_get_password(cred);
209 if (password) {
210 E_deshash(password, lm_hash);
211 lm_session_key = data_blob_talloc(mem_ctx, NULL, 16);
212 memcpy(lm_session_key.data, lm_hash, 8);
213 memset(&lm_session_key.data[8], '\0', 8);
214 }
215 }
216 }
217 if (_lm_response) {
218 *_lm_response = lm_response;
219 }
220 if (_nt_response) {
221 *_nt_response = nt_response;
222 }
223 if (_lm_session_key) {
224 *_lm_session_key = lm_session_key;
225 }
226 if (_session_key) {
227 *_session_key = session_key;
228 }
229 return NT_STATUS_OK;
230}
231
232_PUBLIC_ bool cli_credentials_set_nt_hash(struct cli_credentials *cred,
233 const struct samr_Password *nt_hash,
234 enum credentials_obtained obtained)
235{
236 if (obtained >= cred->password_obtained) {
237 cli_credentials_set_password(cred, NULL, obtained);
238 if (nt_hash) {
239 cred->nt_hash = talloc(cred, struct samr_Password);
240 *cred->nt_hash = *nt_hash;
241 } else {
242 cred->nt_hash = NULL;
243 }
244 return true;
245 }
246
247 return false;
248}
249
250_PUBLIC_ bool cli_credentials_set_ntlm_response(struct cli_credentials *cred,
251 const DATA_BLOB *lm_response,
252 const DATA_BLOB *nt_response,
253 enum credentials_obtained obtained)
254{
255 if (obtained >= cred->password_obtained) {
256 cli_credentials_set_password(cred, NULL, obtained);
257 if (nt_response) {
258 cred->nt_response = data_blob_talloc(cred, nt_response->data, nt_response->length);
259 talloc_steal(cred, cred->nt_response.data);
260 }
261 if (nt_response) {
262 cred->lm_response = data_blob_talloc(cred, lm_response->data, lm_response->length);
263 }
264 return true;
265 }
266
267 return false;
268}
269
Note: See TracBrowser for help on using the repository browser.