source: trunk/server/source3/utils/ntlm_auth_diagnostics.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 14.3 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Winbind status program.
5
6 Copyright (C) Tim Potter 2000-2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
8 Copyright (C) Francesco Chemolli <kinkie@kame.usr.dsi.unimi.it> 2000
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22*/
23
24#include "includes.h"
25#include "utils/ntlm_auth.h"
26#include "../libcli/auth/libcli_auth.h"
27#include "nsswitch/winbind_client.h"
28
29#undef DBGC_CLASS
30#define DBGC_CLASS DBGC_WINBIND
31
32enum ntlm_break {
33 BREAK_NONE,
34 BREAK_LM,
35 BREAK_NT,
36 NO_LM,
37 NO_NT
38};
39
40/*
41 Authenticate a user with a challenge/response, checking session key
42 and valid authentication types
43*/
44
45/*
46 * Test the normal 'LM and NTLM' combination
47 */
48
49static bool test_lm_ntlm_broken(enum ntlm_break break_which)
50{
51 bool pass = True;
52 NTSTATUS nt_status;
53 uint32 flags = 0;
54 DATA_BLOB lm_response = data_blob(NULL, 24);
55 DATA_BLOB nt_response = data_blob(NULL, 24);
56 DATA_BLOB session_key = data_blob(NULL, 16);
57
58 uchar lm_key[8];
59 uchar user_session_key[16];
60 uchar lm_hash[16];
61 uchar nt_hash[16];
62 DATA_BLOB chall = get_challenge();
63 char *error_string;
64
65 ZERO_STRUCT(lm_key);
66 ZERO_STRUCT(user_session_key);
67
68 flags |= WBFLAG_PAM_LMKEY;
69 flags |= WBFLAG_PAM_USER_SESSION_KEY;
70
71 SMBencrypt(opt_password,chall.data,lm_response.data);
72 E_deshash(opt_password, lm_hash);
73
74 SMBNTencrypt(opt_password,chall.data,nt_response.data);
75
76 E_md4hash(opt_password, nt_hash);
77 SMBsesskeygen_ntv1(nt_hash, session_key.data);
78
79 switch (break_which) {
80 case BREAK_NONE:
81 break;
82 case BREAK_LM:
83 lm_response.data[0]++;
84 break;
85 case BREAK_NT:
86 nt_response.data[0]++;
87 break;
88 case NO_LM:
89 data_blob_free(&lm_response);
90 break;
91 case NO_NT:
92 data_blob_free(&nt_response);
93 break;
94 }
95
96 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
97 opt_workstation,
98 &chall,
99 &lm_response,
100 &nt_response,
101 flags,
102 lm_key,
103 user_session_key,
104 &error_string, NULL);
105
106 data_blob_free(&lm_response);
107
108 if (!NT_STATUS_IS_OK(nt_status)) {
109 d_printf("%s (0x%x)\n",
110 error_string,
111 NT_STATUS_V(nt_status));
112 SAFE_FREE(error_string);
113 return break_which == BREAK_NT;
114 }
115
116 if (memcmp(lm_hash, lm_key,
117 sizeof(lm_key)) != 0) {
118 DEBUG(1, ("LM Key does not match expectations!\n"));
119 DEBUG(1, ("lm_key:\n"));
120 dump_data(1, lm_key, 8);
121 DEBUG(1, ("expected:\n"));
122 dump_data(1, lm_hash, 8);
123 pass = False;
124 }
125
126 if (break_which == NO_NT) {
127 if (memcmp(lm_hash, user_session_key,
128 8) != 0) {
129 DEBUG(1, ("NT Session Key does not match expectations (should be LM hash)!\n"));
130 DEBUG(1, ("user_session_key:\n"));
131 dump_data(1, user_session_key, sizeof(user_session_key));
132 DEBUG(1, ("expected:\n"));
133 dump_data(1, lm_hash, sizeof(lm_hash));
134 pass = False;
135 }
136 } else {
137 if (memcmp(session_key.data, user_session_key,
138 sizeof(user_session_key)) != 0) {
139 DEBUG(1, ("NT Session Key does not match expectations!\n"));
140 DEBUG(1, ("user_session_key:\n"));
141 dump_data(1, user_session_key, 16);
142 DEBUG(1, ("expected:\n"));
143 dump_data(1, session_key.data, session_key.length);
144 pass = False;
145 }
146 }
147 return pass;
148}
149
150/*
151 * Test LM authentication, no NT response supplied
152 */
153
154static bool test_lm(void)
155{
156
157 return test_lm_ntlm_broken(NO_NT);
158}
159
160/*
161 * Test the NTLM response only, no LM.
162 */
163
164static bool test_ntlm(void)
165{
166 return test_lm_ntlm_broken(NO_LM);
167}
168
169/*
170 * Test the NTLM response only, but in the LM field.
171 */
172
173static bool test_ntlm_in_lm(void)
174{
175 bool pass = True;
176 NTSTATUS nt_status;
177 uint32 flags = 0;
178 DATA_BLOB nt_response = data_blob(NULL, 24);
179
180 uchar lm_key[8];
181 uchar lm_hash[16];
182 uchar user_session_key[16];
183 DATA_BLOB chall = get_challenge();
184 char *error_string;
185
186 ZERO_STRUCT(user_session_key);
187
188 flags |= WBFLAG_PAM_LMKEY;
189 flags |= WBFLAG_PAM_USER_SESSION_KEY;
190
191 SMBNTencrypt(opt_password,chall.data,nt_response.data);
192
193 E_deshash(opt_password, lm_hash);
194
195 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
196 opt_workstation,
197 &chall,
198 &nt_response,
199 NULL,
200 flags,
201 lm_key,
202 user_session_key,
203 &error_string, NULL);
204
205 data_blob_free(&nt_response);
206
207 if (!NT_STATUS_IS_OK(nt_status)) {
208 d_printf("%s (0x%x)\n",
209 error_string,
210 NT_STATUS_V(nt_status));
211 SAFE_FREE(error_string);
212 return False;
213 }
214
215 if (memcmp(lm_hash, lm_key,
216 sizeof(lm_key)) != 0) {
217 DEBUG(1, ("LM Key does not match expectations!\n"));
218 DEBUG(1, ("lm_key:\n"));
219 dump_data(1, lm_key, 8);
220 DEBUG(1, ("expected:\n"));
221 dump_data(1, lm_hash, 8);
222 pass = False;
223 }
224 if (memcmp(lm_hash, user_session_key, 8) != 0) {
225 DEBUG(1, ("Session Key (first 8 lm hash) does not match expectations!\n"));
226 DEBUG(1, ("user_session_key:\n"));
227 dump_data(1, user_session_key, 16);
228 DEBUG(1, ("expected:\n"));
229 dump_data(1, lm_hash, 8);
230 pass = False;
231 }
232 return pass;
233}
234
235/*
236 * Test the NTLM response only, but in the both the NT and LM fields.
237 */
238
239static bool test_ntlm_in_both(void)
240{
241 bool pass = True;
242 NTSTATUS nt_status;
243 uint32 flags = 0;
244 DATA_BLOB nt_response = data_blob(NULL, 24);
245 DATA_BLOB session_key = data_blob(NULL, 16);
246
247 uint8 lm_key[8];
248 uint8 lm_hash[16];
249 uint8 user_session_key[16];
250 uint8 nt_hash[16];
251 DATA_BLOB chall = get_challenge();
252 char *error_string;
253
254 ZERO_STRUCT(lm_key);
255 ZERO_STRUCT(user_session_key);
256
257 flags |= WBFLAG_PAM_LMKEY;
258 flags |= WBFLAG_PAM_USER_SESSION_KEY;
259
260 SMBNTencrypt(opt_password,chall.data,nt_response.data);
261 E_md4hash(opt_password, nt_hash);
262 SMBsesskeygen_ntv1(nt_hash, session_key.data);
263
264 E_deshash(opt_password, lm_hash);
265
266 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
267 opt_workstation,
268 &chall,
269 &nt_response,
270 &nt_response,
271 flags,
272 lm_key,
273 user_session_key,
274 &error_string, NULL);
275
276 data_blob_free(&nt_response);
277
278 if (!NT_STATUS_IS_OK(nt_status)) {
279 d_printf("%s (0x%x)\n",
280 error_string,
281 NT_STATUS_V(nt_status));
282 SAFE_FREE(error_string);
283 return False;
284 }
285
286 if (memcmp(lm_hash, lm_key,
287 sizeof(lm_key)) != 0) {
288 DEBUG(1, ("LM Key does not match expectations!\n"));
289 DEBUG(1, ("lm_key:\n"));
290 dump_data(1, lm_key, 8);
291 DEBUG(1, ("expected:\n"));
292 dump_data(1, lm_hash, 8);
293 pass = False;
294 }
295 if (memcmp(session_key.data, user_session_key,
296 sizeof(user_session_key)) != 0) {
297 DEBUG(1, ("NT Session Key does not match expectations!\n"));
298 DEBUG(1, ("user_session_key:\n"));
299 dump_data(1, user_session_key, 16);
300 DEBUG(1, ("expected:\n"));
301 dump_data(1, session_key.data, session_key.length);
302 pass = False;
303 }
304
305
306 return pass;
307}
308
309/*
310 * Test the NTLMv2 and LMv2 responses
311 */
312
313static bool test_lmv2_ntlmv2_broken(enum ntlm_break break_which)
314{
315 bool pass = True;
316 NTSTATUS nt_status;
317 uint32 flags = 0;
318 DATA_BLOB ntlmv2_response = data_blob_null;
319 DATA_BLOB lmv2_response = data_blob_null;
320 DATA_BLOB ntlmv2_session_key = data_blob_null;
321 DATA_BLOB names_blob = NTLMv2_generate_names_blob(NULL, get_winbind_netbios_name(), get_winbind_domain());
322
323 uchar user_session_key[16];
324 DATA_BLOB chall = get_challenge();
325 char *error_string;
326
327 ZERO_STRUCT(user_session_key);
328
329 flags |= WBFLAG_PAM_USER_SESSION_KEY;
330
331 if (!SMBNTLMv2encrypt(NULL, opt_username, opt_domain, opt_password, &chall,
332 &names_blob,
333 &lmv2_response, &ntlmv2_response, NULL,
334 &ntlmv2_session_key)) {
335 data_blob_free(&names_blob);
336 return False;
337 }
338 data_blob_free(&names_blob);
339
340 switch (break_which) {
341 case BREAK_NONE:
342 break;
343 case BREAK_LM:
344 lmv2_response.data[0]++;
345 break;
346 case BREAK_NT:
347 ntlmv2_response.data[0]++;
348 break;
349 case NO_LM:
350 data_blob_free(&lmv2_response);
351 break;
352 case NO_NT:
353 data_blob_free(&ntlmv2_response);
354 break;
355 }
356
357 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
358 opt_workstation,
359 &chall,
360 &lmv2_response,
361 &ntlmv2_response,
362 flags,
363 NULL,
364 user_session_key,
365 &error_string, NULL);
366
367 data_blob_free(&lmv2_response);
368 data_blob_free(&ntlmv2_response);
369
370 if (!NT_STATUS_IS_OK(nt_status)) {
371 d_printf("%s (0x%x)\n",
372 error_string,
373 NT_STATUS_V(nt_status));
374 SAFE_FREE(error_string);
375 return break_which == BREAK_NT;
376 }
377
378 if (break_which != NO_NT && break_which != BREAK_NT && memcmp(ntlmv2_session_key.data, user_session_key,
379 sizeof(user_session_key)) != 0) {
380 DEBUG(1, ("USER (NTLMv2) Session Key does not match expectations!\n"));
381 DEBUG(1, ("user_session_key:\n"));
382 dump_data(1, user_session_key, 16);
383 DEBUG(1, ("expected:\n"));
384 dump_data(1, ntlmv2_session_key.data, ntlmv2_session_key.length);
385 pass = False;
386 }
387 return pass;
388}
389
390/*
391 * Test the NTLMv2 and LMv2 responses
392 */
393
394static bool test_lmv2_ntlmv2(void)
395{
396 return test_lmv2_ntlmv2_broken(BREAK_NONE);
397}
398
399/*
400 * Test the LMv2 response only
401 */
402
403static bool test_lmv2(void)
404{
405 return test_lmv2_ntlmv2_broken(NO_NT);
406}
407
408/*
409 * Test the NTLMv2 response only
410 */
411
412static bool test_ntlmv2(void)
413{
414 return test_lmv2_ntlmv2_broken(NO_LM);
415}
416
417static bool test_lm_ntlm(void)
418{
419 return test_lm_ntlm_broken(BREAK_NONE);
420}
421
422static bool test_ntlm_lm_broken(void)
423{
424 return test_lm_ntlm_broken(BREAK_LM);
425}
426
427static bool test_ntlm_ntlm_broken(void)
428{
429 return test_lm_ntlm_broken(BREAK_NT);
430}
431
432static bool test_ntlmv2_lmv2_broken(void)
433{
434 return test_lmv2_ntlmv2_broken(BREAK_LM);
435}
436
437static bool test_ntlmv2_ntlmv2_broken(void)
438{
439 return test_lmv2_ntlmv2_broken(BREAK_NT);
440}
441
442static bool test_plaintext(enum ntlm_break break_which)
443{
444 NTSTATUS nt_status;
445 uint32 flags = 0;
446 DATA_BLOB nt_response = data_blob_null;
447 DATA_BLOB lm_response = data_blob_null;
448 char *password;
449 smb_ucs2_t *nt_response_ucs2;
450 size_t converted_size;
451
452 uchar user_session_key[16];
453 uchar lm_key[16];
454 static const uchar zeros[8] = { 0, };
455 DATA_BLOB chall = data_blob(zeros, sizeof(zeros));
456 char *error_string;
457
458 ZERO_STRUCT(user_session_key);
459
460 flags |= WBFLAG_PAM_LMKEY;
461 flags |= WBFLAG_PAM_USER_SESSION_KEY;
462
463 if (!push_ucs2_talloc(talloc_tos(), &nt_response_ucs2, opt_password,
464 &converted_size))
465 {
466 DEBUG(0, ("push_ucs2_talloc failed!\n"));
467 exit(1);
468 }
469
470 nt_response.data = (unsigned char *)nt_response_ucs2;
471 nt_response.length = strlen_w(nt_response_ucs2)*sizeof(smb_ucs2_t);
472
473 if ((password = strupper_talloc(talloc_tos(), opt_password)) == NULL) {
474 DEBUG(0, ("strupper_talloc() failed!\n"));
475 exit(1);
476 }
477
478 if (!convert_string_talloc(talloc_tos(), CH_UNIX,
479 CH_DOS, password,
480 strlen(password)+1,
481 &lm_response.data,
482 &lm_response.length, True)) {
483 DEBUG(0, ("convert_string_talloc failed!\n"));
484 exit(1);
485 }
486
487 TALLOC_FREE(password);
488
489 switch (break_which) {
490 case BREAK_NONE:
491 break;
492 case BREAK_LM:
493 lm_response.data[0]++;
494 break;
495 case BREAK_NT:
496 nt_response.data[0]++;
497 break;
498 case NO_LM:
499 TALLOC_FREE(lm_response.data);
500 lm_response.length = 0;
501 break;
502 case NO_NT:
503 TALLOC_FREE(nt_response.data);
504 nt_response.length = 0;
505 break;
506 }
507
508 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
509 opt_workstation,
510 &chall,
511 &lm_response,
512 &nt_response,
513 flags,
514 lm_key,
515 user_session_key,
516 &error_string, NULL);
517
518 TALLOC_FREE(nt_response.data);
519 TALLOC_FREE(lm_response.data);
520 data_blob_free(&chall);
521
522 if (!NT_STATUS_IS_OK(nt_status)) {
523 d_printf("%s (0x%x)\n",
524 error_string,
525 NT_STATUS_V(nt_status));
526 SAFE_FREE(error_string);
527 return break_which == BREAK_NT;
528 }
529
530 return break_which != BREAK_NT;
531}
532
533static bool test_plaintext_none_broken(void) {
534 return test_plaintext(BREAK_NONE);
535}
536
537static bool test_plaintext_lm_broken(void) {
538 return test_plaintext(BREAK_LM);
539}
540
541static bool test_plaintext_nt_broken(void) {
542 return test_plaintext(BREAK_NT);
543}
544
545static bool test_plaintext_nt_only(void) {
546 return test_plaintext(NO_LM);
547}
548
549static bool test_plaintext_lm_only(void) {
550 return test_plaintext(NO_NT);
551}
552
553/*
554 Tests:
555
556 - LM only
557 - NT and LM
558 - NT
559 - NT in LM field
560 - NT in both fields
561 - NTLMv2
562 - NTLMv2 and LMv2
563 - LMv2
564 - plaintext tests (in challenge-response feilds)
565
566 check we get the correct session key in each case
567 check what values we get for the LM session key
568
569*/
570
571static const struct ntlm_tests {
572 bool (*fn)(void);
573 const char *name;
574} test_table[] = {
575 {test_lm, "LM"},
576 {test_lm_ntlm, "LM and NTLM"},
577 {test_ntlm, "NTLM"},
578 {test_ntlm_in_lm, "NTLM in LM"},
579 {test_ntlm_in_both, "NTLM in both"},
580 {test_ntlmv2, "NTLMv2"},
581 {test_lmv2_ntlmv2, "NTLMv2 and LMv2"},
582 {test_lmv2, "LMv2"},
583 {test_ntlmv2_lmv2_broken, "NTLMv2 and LMv2, LMv2 broken"},
584 {test_ntlmv2_ntlmv2_broken, "NTLMv2 and LMv2, NTLMv2 broken"},
585 {test_ntlm_lm_broken, "NTLM and LM, LM broken"},
586 {test_ntlm_ntlm_broken, "NTLM and LM, NTLM broken"},
587 {test_plaintext_none_broken, "Plaintext"},
588 {test_plaintext_lm_broken, "Plaintext LM broken"},
589 {test_plaintext_nt_broken, "Plaintext NT broken"},
590 {test_plaintext_nt_only, "Plaintext NT only"},
591 {test_plaintext_lm_only, "Plaintext LM only"},
592 {NULL, NULL}
593};
594
595bool diagnose_ntlm_auth(void)
596{
597 unsigned int i;
598 bool pass = True;
599
600 for (i=0; test_table[i].fn; i++) {
601 if (!test_table[i].fn()) {
602 DEBUG(1, ("Test %s failed!\n", test_table[i].name));
603 pass = False;
604 }
605 }
606
607 return pass;
608}
609
Note: See TracBrowser for help on using the repository browser.