source: trunk/server/source3/libsmb/ntlmssp.c

Last change on this file was 920, checked in by Silvan Scherrer, 9 years ago

Samba Server: apply latest security patches to trunk
File size: 26.3 KB
RevLine 
[918]1/*
2 Unix SMB/Netbios implementation.
3 Version 3.0
4 handle NLTMSSP, server side
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2010
8 Copyright (C) Stefan Metzmacher 2005
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22*/
23
24#include "includes.h"
25#include "../libcli/auth/ntlmssp.h"
26#include "../libcli/auth/ntlmssp_private.h"
27#include "../libcli/auth/libcli_auth.h"
28#include "../librpc/gen_ndr/ndr_ntlmssp.h"
29#include "../libcli/auth/ntlmssp_ndr.h"
30#include "../lib/crypto/md5.h"
31#include "../lib/crypto/arcfour.h"
32#include "../lib/crypto/hmacmd5.h"
33#include "../nsswitch/libwbclient/wbclient.h"
34
35static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state,
36 TALLOC_CTX *out_mem_ctx, /* Unused at this time */
37 DATA_BLOB reply, DATA_BLOB *next_request);
38static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state,
39 TALLOC_CTX *out_mem_ctx, /* Unused at this time */
40 const DATA_BLOB reply, DATA_BLOB *next_request);
41/**
42 * Callbacks for NTLMSSP - for both client and server operating modes
43 *
44 */
45
46static const struct ntlmssp_callbacks {
47 enum ntlmssp_role role;
48 enum ntlmssp_message_type ntlmssp_command;
49 NTSTATUS (*fn)(struct ntlmssp_state *ntlmssp_state,
50 TALLOC_CTX *out_mem_ctx,
51 DATA_BLOB in, DATA_BLOB *out);
52} ntlmssp_callbacks[] = {
53 {NTLMSSP_CLIENT, NTLMSSP_INITIAL, ntlmssp_client_initial},
54 {NTLMSSP_SERVER, NTLMSSP_NEGOTIATE, ntlmssp_server_negotiate},
55 {NTLMSSP_CLIENT, NTLMSSP_CHALLENGE, ntlmssp_client_challenge},
56 {NTLMSSP_SERVER, NTLMSSP_AUTH, ntlmssp_server_auth},
57 {NTLMSSP_CLIENT, NTLMSSP_UNKNOWN, NULL},
58 {NTLMSSP_SERVER, NTLMSSP_UNKNOWN, NULL}
59};
60
61
62/**
63 * Default challenge generation code.
64 *
65 */
66
67static NTSTATUS get_challenge(const struct ntlmssp_state *ntlmssp_state,
68 uint8_t chal[8])
69{
70 generate_random_buffer(chal, 8);
71 return NT_STATUS_OK;
72}
73
74/**
75 * Default 'we can set the challenge to anything we like' implementation
76 *
77 */
78
79static bool may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
80{
81 return True;
82}
83
84/**
85 * Default 'we can set the challenge to anything we like' implementation
86 *
87 * Does not actually do anything, as the value is always in the structure anyway.
88 *
89 */
90
91static NTSTATUS set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
92{
93 SMB_ASSERT(challenge->length == 8);
94 return NT_STATUS_OK;
95}
96
97/**
98 * Set a username on an NTLMSSP context - ensures it is talloc()ed
99 *
100 */
101
102NTSTATUS ntlmssp_set_username(struct ntlmssp_state *ntlmssp_state, const char *user)
103{
104 ntlmssp_state->user = talloc_strdup(ntlmssp_state, user ? user : "" );
105 if (!ntlmssp_state->user) {
106 return NT_STATUS_NO_MEMORY;
107 }
108 return NT_STATUS_OK;
109}
110
111/**
112 * Store NT and LM hashes on an NTLMSSP context - ensures they are talloc()ed
113 *
114 */
115NTSTATUS ntlmssp_set_hashes(struct ntlmssp_state *ntlmssp_state,
116 const uint8_t lm_hash[16],
117 const uint8_t nt_hash[16])
118{
119 ntlmssp_state->lm_hash = (uint8_t *)
120 TALLOC_MEMDUP(ntlmssp_state, lm_hash, 16);
121 ntlmssp_state->nt_hash = (uint8_t *)
122 TALLOC_MEMDUP(ntlmssp_state, nt_hash, 16);
123 if (!ntlmssp_state->lm_hash || !ntlmssp_state->nt_hash) {
124 TALLOC_FREE(ntlmssp_state->lm_hash);
125 TALLOC_FREE(ntlmssp_state->nt_hash);
126 return NT_STATUS_NO_MEMORY;
127 }
128 return NT_STATUS_OK;
129}
130
131/**
132 * Converts a password to the hashes on an NTLMSSP context.
133 *
134 */
135NTSTATUS ntlmssp_set_password(struct ntlmssp_state *ntlmssp_state, const char *password)
136{
137 if (!password) {
138 ntlmssp_state->lm_hash = NULL;
139 ntlmssp_state->nt_hash = NULL;
140 } else {
141 uint8_t lm_hash[16];
142 uint8_t nt_hash[16];
143
144 E_deshash(password, lm_hash);
145 E_md4hash(password, nt_hash);
146 return ntlmssp_set_hashes(ntlmssp_state, lm_hash, nt_hash);
147 }
148 return NT_STATUS_OK;
149}
150
151/**
152 * Set a domain on an NTLMSSP context - ensures it is talloc()ed
153 *
154 */
155NTSTATUS ntlmssp_set_domain(struct ntlmssp_state *ntlmssp_state, const char *domain)
156{
157 ntlmssp_state->domain = talloc_strdup(ntlmssp_state,
158 domain ? domain : "" );
159 if (!ntlmssp_state->domain) {
160 return NT_STATUS_NO_MEMORY;
161 }
162 return NT_STATUS_OK;
163}
164
[920]165bool ntlmssp_have_feature(struct ntlmssp_state *ntlmssp_state,
166 uint32_t feature)
167{
168 if (feature & NTLMSSP_FEATURE_SIGN) {
169 if (ntlmssp_state->session_key.length == 0) {
170 return false;
171 }
172 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
173 return true;
174 }
175 }
176
177 if (feature & NTLMSSP_FEATURE_SEAL) {
178 if (ntlmssp_state->session_key.length == 0) {
179 return false;
180 }
181 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
182 return true;
183 }
184 }
185
186 if (feature & NTLMSSP_FEATURE_SESSION_KEY) {
187 if (ntlmssp_state->session_key.length > 0) {
188 return true;
189 }
190 }
191
192 return false;
193}
194
[918]195/**
196 * Request features for the NTLMSSP negotiation
197 *
198 * @param ntlmssp_state NTLMSSP state
199 * @param feature_list List of space seperated features requested from NTLMSSP.
200 */
201void ntlmssp_want_feature_list(struct ntlmssp_state *ntlmssp_state, char *feature_list)
202{
203 /*
204 * We need to set this to allow a later SetPassword
205 * via the SAMR pipe to succeed. Strange.... We could
206 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
207 */
208 if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list, True)) {
[920]209 ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
[918]210 }
211 if (in_list("NTLMSSP_FEATURE_SIGN", feature_list, True)) {
[920]212 ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
[918]213 }
214 if(in_list("NTLMSSP_FEATURE_SEAL", feature_list, True)) {
[920]215 ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SEAL;
[918]216 }
217 if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list, true)) {
218 ntlmssp_state->use_ccache = true;
219 }
[920]220
221 ntlmssp_state->neg_flags |= ntlmssp_state->required_flags;
[918]222}
223
224/**
225 * Request a feature for the NTLMSSP negotiation
226 *
227 * @param ntlmssp_state NTLMSSP state
228 * @param feature Bit flag specifying the requested feature
229 */
230void ntlmssp_want_feature(struct ntlmssp_state *ntlmssp_state, uint32_t feature)
231{
232 /* As per JRA's comment above */
233 if (feature & NTLMSSP_FEATURE_SESSION_KEY) {
[920]234 ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
[918]235 }
236 if (feature & NTLMSSP_FEATURE_SIGN) {
[920]237 ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
[918]238 }
239 if (feature & NTLMSSP_FEATURE_SEAL) {
[920]240 ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
241 ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SEAL;
[918]242 }
243 if (feature & NTLMSSP_FEATURE_CCACHE) {
244 ntlmssp_state->use_ccache = true;
245 }
[920]246
247 ntlmssp_state->neg_flags |= ntlmssp_state->required_flags;
[918]248}
249
250/**
251 * Next state function for the NTLMSSP state machine
252 *
253 * @param ntlmssp_state NTLMSSP State
254 * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB
255 * @param out The reply, as an allocated DATA_BLOB, caller to free.
256 * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK.
257 */
258
259NTSTATUS ntlmssp_update(struct ntlmssp_state *ntlmssp_state,
260 const DATA_BLOB input, DATA_BLOB *out)
261{
262 uint32_t ntlmssp_command;
263 int i;
264
265 if (ntlmssp_state->expected_state == NTLMSSP_DONE) {
266 /* Called update after negotiations finished. */
267 DEBUG(1, ("Called NTLMSSP after state machine was 'done'\n"));
268 return NT_STATUS_INVALID_PARAMETER;
269 }
270
271 *out = data_blob_null;
272
273 if (!input.length) {
274 switch (ntlmssp_state->role) {
275 case NTLMSSP_CLIENT:
276 ntlmssp_command = NTLMSSP_INITIAL;
277 break;
278 case NTLMSSP_SERVER:
279 /* 'datagram' mode - no neg packet */
280 ntlmssp_command = NTLMSSP_NEGOTIATE;
281 break;
282 default:
283 DEBUG(1, ("Invalid role: %d\n", ntlmssp_state->role));
284 return NT_STATUS_INVALID_PARAMETER;
285 }
286 } else {
287 if (!msrpc_parse(ntlmssp_state, &input, "Cd",
288 "NTLMSSP",
289 &ntlmssp_command)) {
290 DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
291 dump_data(2, input.data, input.length);
292 return NT_STATUS_INVALID_PARAMETER;
293 }
294 }
295
296 if (ntlmssp_command != ntlmssp_state->expected_state) {
297 DEBUG(1, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command, ntlmssp_state->expected_state));
298 return NT_STATUS_INVALID_PARAMETER;
299 }
300
301 for (i=0; ntlmssp_callbacks[i].fn; i++) {
302 if (ntlmssp_callbacks[i].role == ntlmssp_state->role
303 && ntlmssp_callbacks[i].ntlmssp_command == ntlmssp_command) {
304 return ntlmssp_callbacks[i].fn(ntlmssp_state, ntlmssp_state, input, out);
305 }
306 }
307
308 DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
309 ntlmssp_state->role, ntlmssp_command));
310
311 return NT_STATUS_INVALID_PARAMETER;
312}
313
314/**
315 * Create an NTLMSSP state machine
316 *
317 * @param ntlmssp_state NTLMSSP State, allocated by this function
318 */
319
320NTSTATUS ntlmssp_server_start(TALLOC_CTX *mem_ctx,
321 bool is_standalone,
322 const char *netbios_name,
323 const char *netbios_domain,
324 const char *dns_name,
325 const char *dns_domain,
326 struct ntlmssp_state **_ntlmssp_state)
327{
328 struct ntlmssp_state *ntlmssp_state;
329
330 if (!netbios_name) {
331 netbios_name = "";
332 }
333
334 if (!netbios_domain) {
335 netbios_domain = "";
336 }
337
338 if (!dns_domain) {
339 dns_domain = "";
340 }
341
342 if (!dns_name) {
343 dns_name = "";
344 }
345
346 ntlmssp_state = talloc_zero(mem_ctx, struct ntlmssp_state);
347 if (!ntlmssp_state) {
348 return NT_STATUS_NO_MEMORY;
349 }
350
351 ntlmssp_state->role = NTLMSSP_SERVER;
352
353 ntlmssp_state->get_challenge = get_challenge;
354 ntlmssp_state->set_challenge = set_challenge;
355 ntlmssp_state->may_set_challenge = may_set_challenge;
356
357 ntlmssp_state->server.is_standalone = is_standalone;
358
359 ntlmssp_state->expected_state = NTLMSSP_NEGOTIATE;
360
361 ntlmssp_state->allow_lm_key = lp_lanman_auth();
362
363 ntlmssp_state->neg_flags =
364 NTLMSSP_NEGOTIATE_128 |
365 NTLMSSP_NEGOTIATE_56 |
366 NTLMSSP_NEGOTIATE_VERSION |
367 NTLMSSP_NEGOTIATE_ALWAYS_SIGN |
368 NTLMSSP_NEGOTIATE_NTLM |
369 NTLMSSP_NEGOTIATE_NTLM2 |
370 NTLMSSP_NEGOTIATE_KEY_EXCH |
371 NTLMSSP_NEGOTIATE_SIGN |
372 NTLMSSP_NEGOTIATE_SEAL;
373
374 ntlmssp_state->server.netbios_name = talloc_strdup(ntlmssp_state, netbios_name);
375 if (!ntlmssp_state->server.netbios_name) {
376 talloc_free(ntlmssp_state);
377 return NT_STATUS_NO_MEMORY;
378 }
379 ntlmssp_state->server.netbios_domain = talloc_strdup(ntlmssp_state, netbios_domain);
380 if (!ntlmssp_state->server.netbios_domain) {
381 talloc_free(ntlmssp_state);
382 return NT_STATUS_NO_MEMORY;
383 }
384 ntlmssp_state->server.dns_name = talloc_strdup(ntlmssp_state, dns_name);
385 if (!ntlmssp_state->server.dns_name) {
386 talloc_free(ntlmssp_state);
387 return NT_STATUS_NO_MEMORY;
388 }
389 ntlmssp_state->server.dns_domain = talloc_strdup(ntlmssp_state, dns_domain);
390 if (!ntlmssp_state->server.dns_domain) {
391 talloc_free(ntlmssp_state);
392 return NT_STATUS_NO_MEMORY;
393 }
394
395 *_ntlmssp_state = ntlmssp_state;
396 return NT_STATUS_OK;
397}
398
399/*********************************************************************
400 Client side NTLMSSP
401*********************************************************************/
402
403/**
404 * Next state function for the Initial packet
405 *
406 * @param ntlmssp_state NTLMSSP State
407 * @param request The request, as a DATA_BLOB. reply.data must be NULL
408 * @param request The reply, as an allocated DATA_BLOB, caller to free.
409 * @return Errors or NT_STATUS_OK.
410 */
411
412static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state,
413 TALLOC_CTX *out_mem_ctx, /* Unused at this time */
414 DATA_BLOB reply, DATA_BLOB *next_request)
415{
416 NTSTATUS status;
417
418 if (ntlmssp_state->unicode) {
419 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
420 } else {
421 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
422 }
423
424 if (ntlmssp_state->use_ntlmv2) {
[920]425 ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_NTLM2;
426 ntlmssp_state->allow_lm_key = false;
[918]427 }
428
[920]429 if (ntlmssp_state->allow_lm_key) {
430 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_LM_KEY;
431 }
432
[918]433 /* generate the ntlmssp negotiate packet */
434 status = msrpc_gen(ntlmssp_state, next_request, "CddAA",
435 "NTLMSSP",
436 NTLMSSP_NEGOTIATE,
437 ntlmssp_state->neg_flags,
438 ntlmssp_state->client.netbios_domain,
439 ntlmssp_state->client.netbios_name);
440 if (!NT_STATUS_IS_OK(status)) {
441 DEBUG(0, ("ntlmssp_client_initial: failed to generate "
442 "ntlmssp negotiate packet\n"));
443 return status;
444 }
445
446 if (DEBUGLEVEL >= 10) {
447 struct NEGOTIATE_MESSAGE *negotiate = talloc(
448 talloc_tos(), struct NEGOTIATE_MESSAGE);
449 if (negotiate != NULL) {
450 status = ntlmssp_pull_NEGOTIATE_MESSAGE(
451 next_request, negotiate, negotiate);
452 if (NT_STATUS_IS_OK(status)) {
453 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE,
454 negotiate);
455 }
456 TALLOC_FREE(negotiate);
457 }
458 }
459
460 ntlmssp_state->expected_state = NTLMSSP_CHALLENGE;
461
462 return NT_STATUS_MORE_PROCESSING_REQUIRED;
463}
464
[920]465static NTSTATUS ntlmssp3_handle_neg_flags(struct ntlmssp_state *ntlmssp_state,
466 uint32_t flags)
467{
468 uint32_t missing_flags = ntlmssp_state->required_flags;
469
470 if (flags & NTLMSSP_NEGOTIATE_UNICODE) {
471 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
472 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_OEM;
473 ntlmssp_state->unicode = true;
474 } else {
475 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_UNICODE;
476 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
477 ntlmssp_state->unicode = false;
478 }
479
480 /*
481 * NTLMSSP_NEGOTIATE_NTLM2 (NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY)
482 * has priority over NTLMSSP_NEGOTIATE_LM_KEY
483 */
484 if (!(flags & NTLMSSP_NEGOTIATE_NTLM2)) {
485 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
486 }
487
488 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
489 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
490 }
491
492 if (!(flags & NTLMSSP_NEGOTIATE_LM_KEY)) {
493 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
494 }
495
496 if (!(flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
497 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
498 }
499
500 if (!(flags & NTLMSSP_NEGOTIATE_128)) {
501 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_128;
502 }
503
504 if (!(flags & NTLMSSP_NEGOTIATE_56)) {
505 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_56;
506 }
507
508 if (!(flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
509 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_KEY_EXCH;
510 }
511
512 if (!(flags & NTLMSSP_NEGOTIATE_SIGN)) {
513 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SIGN;
514 }
515
516 if (!(flags & NTLMSSP_NEGOTIATE_SEAL)) {
517 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SEAL;
518 }
519
520 if ((flags & NTLMSSP_REQUEST_TARGET)) {
521 ntlmssp_state->neg_flags |= NTLMSSP_REQUEST_TARGET;
522 }
523
524 missing_flags &= ~ntlmssp_state->neg_flags;
525 if (missing_flags != 0) {
526 NTSTATUS status = NT_STATUS_RPC_SEC_PKG_ERROR;
527 DEBUG(1, ("%s: Got challenge flags[0x%08x] "
528 "- possible downgrade detected! "
529 "missing_flags[0x%08x] - %s\n",
530 __func__,
531 (unsigned)flags,
532 (unsigned)missing_flags,
533 nt_errstr(status)));
534 debug_ntlmssp_flags(missing_flags);
535 DEBUGADD(4, ("neg_flags[0x%08x]\n",
536 (unsigned)ntlmssp_state->neg_flags));
537 debug_ntlmssp_flags(ntlmssp_state->neg_flags);
538
539 return status;
540 }
541
542 return NT_STATUS_OK;
543}
544
[918]545/**
546 * Next state function for the Challenge Packet. Generate an auth packet.
547 *
548 * @param ntlmssp_state NTLMSSP State
549 * @param request The request, as a DATA_BLOB. reply.data must be NULL
550 * @param request The reply, as an allocated DATA_BLOB, caller to free.
551 * @return Errors or NT_STATUS_OK.
552 */
553
554static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state,
555 TALLOC_CTX *out_mem_ctx, /* Unused at this time */
556 const DATA_BLOB reply, DATA_BLOB *next_request)
557{
558 uint32_t chal_flags, ntlmssp_command, unkn1, unkn2;
559 DATA_BLOB server_domain_blob;
560 DATA_BLOB challenge_blob;
561 DATA_BLOB struct_blob = data_blob_null;
562 char *server_domain;
563 const char *chal_parse_string;
564 const char *auth_gen_string;
565 DATA_BLOB lm_response = data_blob_null;
566 DATA_BLOB nt_response = data_blob_null;
567 DATA_BLOB session_key = data_blob_null;
568 DATA_BLOB encrypted_session_key = data_blob_null;
569 NTSTATUS nt_status = NT_STATUS_OK;
570
[920]571 if (!msrpc_parse(ntlmssp_state, &reply, "CdBd",
572 "NTLMSSP",
573 &ntlmssp_command,
574 &server_domain_blob,
575 &chal_flags)) {
576 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
577 dump_data(2, reply.data, reply.length);
578
579 return NT_STATUS_INVALID_PARAMETER;
580 }
581 data_blob_free(&server_domain_blob);
582
583 DEBUG(3, ("Got challenge flags:\n"));
584 debug_ntlmssp_flags(chal_flags);
585
586 nt_status = ntlmssp3_handle_neg_flags(ntlmssp_state, chal_flags);
587 if (!NT_STATUS_IS_OK(nt_status)) {
588 return nt_status;
589 }
590
[918]591 if (ntlmssp_state->use_ccache) {
592 struct wbcCredentialCacheParams params;
593 struct wbcCredentialCacheInfo *info = NULL;
594 struct wbcAuthErrorInfo *error = NULL;
595 struct wbcNamedBlob auth_blob;
596 struct wbcBlob *wbc_next = NULL;
597 struct wbcBlob *wbc_session_key = NULL;
598 wbcErr wbc_status;
599 int i;
600
601 params.account_name = ntlmssp_state->user;
602 params.domain_name = ntlmssp_state->domain;
603 params.level = WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP;
604
605 auth_blob.name = "challenge_blob";
606 auth_blob.flags = 0;
607 auth_blob.blob.data = reply.data;
608 auth_blob.blob.length = reply.length;
609 params.num_blobs = 1;
610 params.blobs = &auth_blob;
611
612 wbc_status = wbcCredentialCache(&params, &info, &error);
613 wbcFreeMemory(error);
614 if (!WBC_ERROR_IS_OK(wbc_status)) {
615 goto noccache;
616 }
617
618 for (i=0; i<info->num_blobs; i++) {
619 if (strequal(info->blobs[i].name, "auth_blob")) {
620 wbc_next = &info->blobs[i].blob;
621 }
622 if (strequal(info->blobs[i].name, "session_key")) {
623 wbc_session_key = &info->blobs[i].blob;
624 }
625 }
626 if ((wbc_next == NULL) || (wbc_session_key == NULL)) {
627 wbcFreeMemory(info);
628 goto noccache;
629 }
630
631 *next_request = data_blob(wbc_next->data, wbc_next->length);
632 ntlmssp_state->session_key = data_blob(
633 wbc_session_key->data, wbc_session_key->length);
634
635 wbcFreeMemory(info);
636 goto done;
637 }
638
639noccache:
640
641 if (DEBUGLEVEL >= 10) {
642 struct CHALLENGE_MESSAGE *challenge = talloc(
643 talloc_tos(), struct CHALLENGE_MESSAGE);
644 if (challenge != NULL) {
645 NTSTATUS status;
646 challenge->NegotiateFlags = chal_flags;
647 status = ntlmssp_pull_CHALLENGE_MESSAGE(
648 &reply, challenge, challenge);
649 if (NT_STATUS_IS_OK(status)) {
650 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE,
651 challenge);
652 }
653 TALLOC_FREE(challenge);
654 }
655 }
656
657 if (ntlmssp_state->unicode) {
658 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
659 chal_parse_string = "CdUdbddB";
660 } else {
661 chal_parse_string = "CdUdbdd";
662 }
663 auth_gen_string = "CdBBUUUBd";
664 } else {
665 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
666 chal_parse_string = "CdAdbddB";
667 } else {
668 chal_parse_string = "CdAdbdd";
669 }
670
671 auth_gen_string = "CdBBAAABd";
672 }
673
674 DEBUG(3, ("NTLMSSP: Set final flags:\n"));
675 debug_ntlmssp_flags(ntlmssp_state->neg_flags);
676
677 if (!msrpc_parse(ntlmssp_state, &reply, chal_parse_string,
678 "NTLMSSP",
679 &ntlmssp_command,
680 &server_domain,
681 &chal_flags,
682 &challenge_blob, 8,
683 &unkn1, &unkn2,
684 &struct_blob)) {
685 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
686 dump_data(2, reply.data, reply.length);
687 return NT_STATUS_INVALID_PARAMETER;
688 }
689
690 if (chal_flags & NTLMSSP_TARGET_TYPE_SERVER) {
691 ntlmssp_state->server.is_standalone = true;
692 } else {
693 ntlmssp_state->server.is_standalone = false;
694 }
695 /* TODO: parse struct_blob and fill in the rest */
696 ntlmssp_state->server.netbios_name = "";
697 ntlmssp_state->server.netbios_domain = server_domain;
698 ntlmssp_state->server.dns_name = "";
699 ntlmssp_state->server.dns_domain = "";
700
701 if (challenge_blob.length != 8) {
702 data_blob_free(&struct_blob);
703 return NT_STATUS_INVALID_PARAMETER;
704 }
705
706 if (!ntlmssp_state->nt_hash || !ntlmssp_state->lm_hash) {
707 static const uint8_t zeros[16] = {0, };
708 /* do nothing - blobs are zero length */
709
710 /* session key is all zeros */
711 session_key = data_blob_talloc(ntlmssp_state, zeros, 16);
712
713 /* not doing NLTM2 without a password */
714 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
715 } else if (ntlmssp_state->use_ntlmv2) {
716 if (!struct_blob.length) {
717 /* be lazy, match win2k - we can't do NTLMv2 without it */
718 DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
719 return NT_STATUS_INVALID_PARAMETER;
720 }
721
722 /* TODO: if the remote server is standalone, then we should replace 'domain'
723 with the server name as supplied above */
724
725 if (!SMBNTLMv2encrypt_hash(ntlmssp_state,
726 ntlmssp_state->user,
727 ntlmssp_state->domain,
728 ntlmssp_state->nt_hash, &challenge_blob,
729 &struct_blob,
730 &lm_response, &nt_response, NULL,
731 &session_key)) {
732 data_blob_free(&challenge_blob);
733 data_blob_free(&struct_blob);
734 return NT_STATUS_NO_MEMORY;
735 }
736 } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
737 MD5_CTX md5_session_nonce_ctx;
738 uint8_t session_nonce[16];
739 uint8_t session_nonce_hash[16];
740 uint8_t user_session_key[16];
741
742 lm_response = data_blob_talloc(ntlmssp_state, NULL, 24);
743 generate_random_buffer(lm_response.data, 8);
744 memset(lm_response.data+8, 0, 16);
745
746 memcpy(session_nonce, challenge_blob.data, 8);
747 memcpy(&session_nonce[8], lm_response.data, 8);
748
749 MD5Init(&md5_session_nonce_ctx);
750 MD5Update(&md5_session_nonce_ctx, challenge_blob.data, 8);
751 MD5Update(&md5_session_nonce_ctx, lm_response.data, 8);
752 MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
753
754 DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
755 DEBUG(5, ("challenge is: \n"));
756 dump_data(5, session_nonce_hash, 8);
757
758 nt_response = data_blob_talloc(ntlmssp_state, NULL, 24);
759 SMBNTencrypt_hash(ntlmssp_state->nt_hash,
760 session_nonce_hash,
761 nt_response.data);
762
763 session_key = data_blob_talloc(ntlmssp_state, NULL, 16);
764
765 SMBsesskeygen_ntv1(ntlmssp_state->nt_hash, user_session_key);
766 hmac_md5(user_session_key, session_nonce, sizeof(session_nonce), session_key.data);
767 dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
768 } else {
769 /* lanman auth is insecure, it may be disabled */
770 if (lp_client_lanman_auth()) {
771 lm_response = data_blob_talloc(ntlmssp_state,
772 NULL, 24);
773 SMBencrypt_hash(ntlmssp_state->lm_hash,challenge_blob.data,
774 lm_response.data);
775 }
776
777 nt_response = data_blob_talloc(ntlmssp_state, NULL, 24);
778 SMBNTencrypt_hash(ntlmssp_state->nt_hash,challenge_blob.data,
779 nt_response.data);
780
781 session_key = data_blob_talloc(ntlmssp_state, NULL, 16);
782 if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
783 && lp_client_lanman_auth()) {
784 SMBsesskeygen_lm_sess_key(ntlmssp_state->lm_hash, lm_response.data,
785 session_key.data);
786 dump_data_pw("LM session key\n", session_key.data, session_key.length);
787 } else {
788 SMBsesskeygen_ntv1(ntlmssp_state->nt_hash, session_key.data);
789 dump_data_pw("NT session key:\n", session_key.data, session_key.length);
790 }
791 }
792 data_blob_free(&struct_blob);
793
794 /* Key exchange encryptes a new client-generated session key with
795 the password-derived key */
796 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
797 /* Make up a new session key */
798 uint8_t client_session_key[16];
799 generate_random_buffer(client_session_key, sizeof(client_session_key));
800
801 /* Encrypt the new session key with the old one */
802 encrypted_session_key = data_blob(client_session_key, sizeof(client_session_key));
803 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length);
804 arcfour_crypt_blob(encrypted_session_key.data, encrypted_session_key.length, &session_key);
805 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
806
807 /* Mark the new session key as the 'real' session key */
808 data_blob_free(&session_key);
809 session_key = data_blob_talloc(ntlmssp_state,
810 client_session_key,
811 sizeof(client_session_key));
812 }
813
814 /* this generates the actual auth packet */
815 nt_status = msrpc_gen(ntlmssp_state, next_request, auth_gen_string,
816 "NTLMSSP",
817 NTLMSSP_AUTH,
818 lm_response.data, lm_response.length,
819 nt_response.data, nt_response.length,
820 ntlmssp_state->domain,
821 ntlmssp_state->user,
822 ntlmssp_state->client.netbios_name,
823 encrypted_session_key.data, encrypted_session_key.length,
824 ntlmssp_state->neg_flags);
825
826 if (!NT_STATUS_IS_OK(nt_status)) {
827 return NT_STATUS_NO_MEMORY;
828 }
829
830 if (DEBUGLEVEL >= 10) {
831 struct AUTHENTICATE_MESSAGE *authenticate = talloc(
832 talloc_tos(), struct AUTHENTICATE_MESSAGE);
833 if (authenticate != NULL) {
834 NTSTATUS status;
835 authenticate->NegotiateFlags =
836 ntlmssp_state->neg_flags;
837 status = ntlmssp_pull_AUTHENTICATE_MESSAGE(
838 next_request, authenticate, authenticate);
839 if (NT_STATUS_IS_OK(status)) {
840 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE,
841 authenticate);
842 }
843 TALLOC_FREE(authenticate);
844 }
845 }
846
847 data_blob_free(&encrypted_session_key);
848
849 data_blob_free(&ntlmssp_state->chal);
850
851 ntlmssp_state->session_key = session_key;
852
853 ntlmssp_state->chal = challenge_blob;
854 ntlmssp_state->lm_resp = lm_response;
855 ntlmssp_state->nt_resp = nt_response;
856
857done:
858
859 ntlmssp_state->expected_state = NTLMSSP_DONE;
860
861 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_sign_init(ntlmssp_state))) {
862 DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status)));
863 }
864
865 return nt_status;
866}
867
868NTSTATUS ntlmssp_client_start(TALLOC_CTX *mem_ctx,
869 const char *netbios_name,
870 const char *netbios_domain,
871 bool use_ntlmv2,
872 struct ntlmssp_state **_ntlmssp_state)
873{
874 struct ntlmssp_state *ntlmssp_state;
875
876 if (!netbios_name) {
877 netbios_name = "";
878 }
879
880 if (!netbios_domain) {
881 netbios_domain = "";
882 }
883
884 ntlmssp_state = talloc_zero(mem_ctx, struct ntlmssp_state);
885 if (!ntlmssp_state) {
886 return NT_STATUS_NO_MEMORY;
887 }
888
889 ntlmssp_state->role = NTLMSSP_CLIENT;
890
891 ntlmssp_state->unicode = True;
892
893 ntlmssp_state->use_ntlmv2 = use_ntlmv2;
[920]894 ntlmssp_state->allow_lm_key = lp_client_lanman_auth();
[918]895
896 ntlmssp_state->expected_state = NTLMSSP_INITIAL;
897
898 ntlmssp_state->neg_flags =
899 NTLMSSP_NEGOTIATE_128 |
900 NTLMSSP_NEGOTIATE_ALWAYS_SIGN |
901 NTLMSSP_NEGOTIATE_NTLM |
902 NTLMSSP_NEGOTIATE_NTLM2 |
903 NTLMSSP_NEGOTIATE_KEY_EXCH |
904 NTLMSSP_REQUEST_TARGET;
905
[920]906 if (ntlmssp_state->use_ntlmv2) {
907 ntlmssp_state->allow_lm_key = false;
908 }
909
[918]910 ntlmssp_state->client.netbios_name = talloc_strdup(ntlmssp_state, netbios_name);
911 if (!ntlmssp_state->client.netbios_name) {
912 talloc_free(ntlmssp_state);
913 return NT_STATUS_NO_MEMORY;
914 }
915 ntlmssp_state->client.netbios_domain = talloc_strdup(ntlmssp_state, netbios_domain);
916 if (!ntlmssp_state->client.netbios_domain) {
917 talloc_free(ntlmssp_state);
918 return NT_STATUS_NO_MEMORY;
919 }
920
921 *_ntlmssp_state = ntlmssp_state;
922 return NT_STATUS_OK;
923}
Note: See TracBrowser for help on using the repository browser.