source: trunk/server/source4/auth/credentials/credentials_ntlm.c

Last change on this file was 752, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.9 2nd part
File size: 8.1 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 User credentials handling
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2005
8 Copyright (C) Stefan Metzmacher 2005
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22*/
23
24#include "includes.h"
25#include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
26#include "../lib/crypto/crypto.h"
27#include "libcli/auth/libcli_auth.h"
28#include "auth/credentials/credentials.h"
29
30_PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_CTX *mem_ctx,
31 int *flags,
32 DATA_BLOB challenge, DATA_BLOB target_info,
33 DATA_BLOB *_lm_response, DATA_BLOB *_nt_response,
34 DATA_BLOB *_lm_session_key, DATA_BLOB *_session_key)
35{
36 const char *user, *domain;
37 DATA_BLOB lm_response, nt_response;
38 DATA_BLOB lm_session_key, session_key;
39 const struct samr_Password *nt_hash;
40 lm_session_key = data_blob(NULL, 0);
41
42 /* We may already have an NTLM response we prepared earlier.
43 * This is used for NTLM pass-though authentication */
44 if (cred->nt_response.data || cred->lm_response.data) {
45 *_nt_response = cred->nt_response;
46 *_lm_response = cred->lm_response;
47
48 if (!cred->lm_response.data) {
49 *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
50 }
51 *_lm_session_key = data_blob(NULL, 0);
52 *_session_key = data_blob(NULL, 0);
53 return NT_STATUS_OK;
54 }
55
56 nt_hash = cli_credentials_get_nt_hash(cred, mem_ctx);
57
58 cli_credentials_get_ntlm_username_domain(cred, mem_ctx, &user, &domain);
59
60 /* If we are sending a username@realm login (see function
61 * above), then we will not send LM, it will not be
62 * accepted */
63 if (cred->principal_obtained > cred->username_obtained) {
64 *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
65 }
66
67 /* Likewise if we are a machine account (avoid protocol downgrade attacks) */
68 if (cred->machine_account) {
69 *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
70 }
71
72 if (cred->use_kerberos == CRED_MUST_USE_KERBEROS) {
73 return NT_STATUS_ACCESS_DENIED;
74 }
75
76 if (!nt_hash) {
77 static const uint8_t zeros[16];
78 /* do nothing - blobs are zero length */
79
80 /* session key is all zeros */
81 session_key = data_blob_talloc(mem_ctx, zeros, 16);
82 lm_session_key = data_blob_talloc(mem_ctx, zeros, 16);
83
84 lm_response = data_blob(NULL, 0);
85 nt_response = data_blob(NULL, 0);
86
87 /* not doing NTLM2 without a password */
88 *flags &= ~CLI_CRED_NTLM2;
89 } else if (*flags & CLI_CRED_NTLMv2_AUTH) {
90
91 if (!target_info.length) {
92 /* be lazy, match win2k - we can't do NTLMv2 without it */
93 DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
94 return NT_STATUS_INVALID_PARAMETER;
95 }
96
97 /* TODO: if the remote server is standalone, then we should replace 'domain'
98 with the server name as supplied above */
99
100 if (!SMBNTLMv2encrypt_hash(mem_ctx,
101 user,
102 domain,
103 nt_hash->hash, &challenge,
104 &target_info,
105 &lm_response, &nt_response,
106 NULL, &session_key)) {
107 return NT_STATUS_NO_MEMORY;
108 }
109
110 /* LM Key is incompatible... */
111 *flags &= ~CLI_CRED_LANMAN_AUTH;
112 } else if (*flags & CLI_CRED_NTLM2) {
113 MD5_CTX md5_session_nonce_ctx;
114 uint8_t session_nonce[16];
115 uint8_t session_nonce_hash[16];
116 uint8_t user_session_key[16];
117
118 lm_response = data_blob_talloc(mem_ctx, NULL, 24);
119 generate_random_buffer(lm_response.data, 8);
120 memset(lm_response.data+8, 0, 16);
121
122 memcpy(session_nonce, challenge.data, 8);
123 memcpy(&session_nonce[8], lm_response.data, 8);
124
125 MD5Init(&md5_session_nonce_ctx);
126 MD5Update(&md5_session_nonce_ctx, challenge.data, 8);
127 MD5Update(&md5_session_nonce_ctx, lm_response.data, 8);
128 MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
129
130 DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
131 DEBUG(5, ("challenge is: \n"));
132 dump_data(5, session_nonce_hash, 8);
133
134 nt_response = data_blob_talloc(mem_ctx, NULL, 24);
135 SMBOWFencrypt(nt_hash->hash,
136 session_nonce_hash,
137 nt_response.data);
138
139 session_key = data_blob_talloc(mem_ctx, NULL, 16);
140
141 SMBsesskeygen_ntv1(nt_hash->hash, user_session_key);
142 hmac_md5(user_session_key, session_nonce, sizeof(session_nonce), session_key.data);
143 dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
144
145 /* LM Key is incompatible... */
146 *flags &= ~CLI_CRED_LANMAN_AUTH;
147 } else {
148 uint8_t lm_hash[16];
149 nt_response = data_blob_talloc(mem_ctx, NULL, 24);
150 SMBOWFencrypt(nt_hash->hash, challenge.data,
151 nt_response.data);
152
153 session_key = data_blob_talloc(mem_ctx, NULL, 16);
154 SMBsesskeygen_ntv1(nt_hash->hash, session_key.data);
155 dump_data_pw("NT session key:\n", session_key.data, session_key.length);
156
157 /* lanman auth is insecure, it may be disabled.
158 We may also not have a password */
159 if (*flags & CLI_CRED_LANMAN_AUTH) {
160 const char *password;
161 password = cli_credentials_get_password(cred);
162 if (!password) {
163 lm_response = nt_response;
164 } else {
165 lm_response = data_blob_talloc(mem_ctx, NULL, 24);
166 if (!SMBencrypt(password,challenge.data,
167 lm_response.data)) {
168 /* If the LM password was too long (and therefore the LM hash being
169 of the first 14 chars only), don't send it.
170
171 We don't have any better options but to send the NT response
172 */
173 data_blob_free(&lm_response);
174 lm_response = nt_response;
175 /* LM Key is incompatible with 'long' passwords */
176 *flags &= ~CLI_CRED_LANMAN_AUTH;
177 } else {
178 E_deshash(password, lm_hash);
179 lm_session_key = data_blob_talloc(mem_ctx, NULL, 16);
180 memcpy(lm_session_key.data, lm_hash, 8);
181 memset(&lm_session_key.data[8], '\0', 8);
182
183 if (!(*flags & CLI_CRED_NTLM_AUTH)) {
184 session_key = lm_session_key;
185 }
186 }
187 }
188 } else {
189 const char *password;
190
191 /* LM Key is incompatible... */
192 lm_response = nt_response;
193 *flags &= ~CLI_CRED_LANMAN_AUTH;
194
195 password = cli_credentials_get_password(cred);
196 if (password) {
197 E_deshash(password, lm_hash);
198 lm_session_key = data_blob_talloc(mem_ctx, NULL, 16);
199 memcpy(lm_session_key.data, lm_hash, 8);
200 memset(&lm_session_key.data[8], '\0', 8);
201 }
202 }
203 }
204 if (_lm_response) {
205 *_lm_response = lm_response;
206 }
207 if (_nt_response) {
208 *_nt_response = nt_response;
209 }
210 if (_lm_session_key) {
211 *_lm_session_key = lm_session_key;
212 }
213 if (_session_key) {
214 *_session_key = session_key;
215 }
216 return NT_STATUS_OK;
217}
218
219_PUBLIC_ bool cli_credentials_set_nt_hash(struct cli_credentials *cred,
220 const struct samr_Password *nt_hash,
221 enum credentials_obtained obtained)
222{
223 if (obtained >= cred->password_obtained) {
224 cli_credentials_set_password(cred, NULL, obtained);
225 if (nt_hash) {
226 cred->nt_hash = talloc(cred, struct samr_Password);
227 *cred->nt_hash = *nt_hash;
228 } else {
229 cred->nt_hash = NULL;
230 }
231 return true;
232 }
233
234 return false;
235}
236
237_PUBLIC_ bool cli_credentials_set_ntlm_response(struct cli_credentials *cred,
238 const DATA_BLOB *lm_response,
239 const DATA_BLOB *nt_response,
240 enum credentials_obtained obtained)
241{
242 if (obtained >= cred->password_obtained) {
243 cli_credentials_set_password(cred, NULL, obtained);
244 if (nt_response) {
245 cred->nt_response = data_blob_talloc(cred, nt_response->data, nt_response->length);
246 talloc_steal(cred, cred->nt_response.data);
247 }
248 if (nt_response) {
249 cred->lm_response = data_blob_talloc(cred, lm_response->data, lm_response->length);
250 }
251 return true;
252 }
253
254 return false;
255}
256
Note: See TracBrowser for help on using the repository browser.