source: vendor/current/auth/ntlmssp/ntlmssp.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 9.2 KB
Line 
1/*
2 Unix SMB/Netbios implementation.
3 Version 3.0
4 handle NLTMSSP, client server side parsing
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2005
8 Copyright (C) Stefan Metzmacher 2005
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22*/
23
24struct auth_session_info;
25
26#include "includes.h"
27#include "auth/ntlmssp/ntlmssp.h"
28#include "auth/ntlmssp/ntlmssp_private.h"
29#include "../libcli/auth/libcli_auth.h"
30#include "librpc/gen_ndr/ndr_dcerpc.h"
31#include "auth/gensec/gensec.h"
32#include "auth/gensec/gensec_internal.h"
33
34/**
35 * Callbacks for NTLMSSP - for both client and server operating modes
36 *
37 */
38
39static const struct ntlmssp_callbacks {
40 enum ntlmssp_role role;
41 enum ntlmssp_message_type command;
42 NTSTATUS (*sync_fn)(struct gensec_security *gensec_security,
43 TALLOC_CTX *out_mem_ctx,
44 DATA_BLOB in, DATA_BLOB *out);
45} ntlmssp_callbacks[] = {
46 {
47 .role = NTLMSSP_CLIENT,
48 .command = NTLMSSP_INITIAL,
49 .sync_fn = ntlmssp_client_initial,
50 },{
51 .role = NTLMSSP_CLIENT,
52 .command = NTLMSSP_NEGOTIATE,
53 .sync_fn = gensec_ntlmssp_resume_ccache,
54 },{
55 .role = NTLMSSP_SERVER,
56 .command = NTLMSSP_NEGOTIATE,
57 .sync_fn = gensec_ntlmssp_server_negotiate,
58 },{
59 .role = NTLMSSP_CLIENT,
60 .command = NTLMSSP_CHALLENGE,
61 .sync_fn = ntlmssp_client_challenge,
62 },{
63 .role = NTLMSSP_SERVER,
64 .command = NTLMSSP_AUTH,
65 .sync_fn = gensec_ntlmssp_server_auth,
66 }
67};
68
69
70static NTSTATUS gensec_ntlmssp_update_find(struct gensec_security *gensec_security,
71 struct gensec_ntlmssp_context *gensec_ntlmssp,
72 const DATA_BLOB input, uint32_t *idx)
73{
74 uint32_t ntlmssp_command;
75 uint32_t i;
76
77 if (gensec_ntlmssp->ntlmssp_state->expected_state == NTLMSSP_DONE) {
78 /* We are strict here because other modules, which we
79 * don't fully control (such as GSSAPI) are also
80 * strict, but are tested less often */
81
82 DEBUG(1, ("Called NTLMSSP after state machine was 'done'\n"));
83 return NT_STATUS_INVALID_PARAMETER;
84 }
85
86 if (!input.length) {
87 switch (gensec_ntlmssp->ntlmssp_state->role) {
88 case NTLMSSP_CLIENT:
89 if (gensec_ntlmssp->ntlmssp_state->resume_ccache) {
90 /*
91 * make sure gensec_ntlmssp_resume_ccache()
92 * will be called
93 */
94 ntlmssp_command = NTLMSSP_NEGOTIATE;
95 break;
96 }
97
98 ntlmssp_command = NTLMSSP_INITIAL;
99 break;
100 case NTLMSSP_SERVER:
101 if (gensec_security->want_features & GENSEC_FEATURE_DATAGRAM_MODE) {
102 /* 'datagram' mode - no neg packet */
103 ntlmssp_command = NTLMSSP_NEGOTIATE;
104 } else {
105 /* This is normal in SPNEGO mech negotiation fallback */
106 DEBUG(2, ("Failed to parse NTLMSSP packet: zero length\n"));
107 return NT_STATUS_INVALID_PARAMETER;
108 }
109 break;
110 }
111 } else {
112 if (!msrpc_parse(gensec_ntlmssp->ntlmssp_state,
113 &input, "Cd",
114 "NTLMSSP",
115 &ntlmssp_command)) {
116 DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
117 dump_data(2, input.data, input.length);
118 return NT_STATUS_INVALID_PARAMETER;
119 }
120 }
121
122 if (ntlmssp_command != gensec_ntlmssp->ntlmssp_state->expected_state) {
123 DEBUG(2, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command,
124 gensec_ntlmssp->ntlmssp_state->expected_state));
125 return NT_STATUS_INVALID_PARAMETER;
126 }
127
128 for (i=0; i < ARRAY_SIZE(ntlmssp_callbacks); i++) {
129 if (ntlmssp_callbacks[i].role == gensec_ntlmssp->ntlmssp_state->role &&
130 ntlmssp_callbacks[i].command == ntlmssp_command) {
131 *idx = i;
132 return NT_STATUS_OK;
133 }
134 }
135
136 DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
137 gensec_ntlmssp->ntlmssp_state->role, ntlmssp_command));
138
139 return NT_STATUS_INVALID_PARAMETER;
140}
141
142/**
143 * Next state function for the wrapped NTLMSSP state machine
144 *
145 * @param gensec_security GENSEC state, initialised to NTLMSSP
146 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
147 * @param in The request, as a DATA_BLOB
148 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
149 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
150 * or NT_STATUS_OK if the user is authenticated.
151 */
152
153NTSTATUS gensec_ntlmssp_update(struct gensec_security *gensec_security,
154 TALLOC_CTX *out_mem_ctx,
155 struct tevent_context *ev,
156 const DATA_BLOB input, DATA_BLOB *out)
157{
158 struct gensec_ntlmssp_context *gensec_ntlmssp =
159 talloc_get_type_abort(gensec_security->private_data,
160 struct gensec_ntlmssp_context);
161 struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
162 NTSTATUS status;
163 uint32_t i;
164
165 *out = data_blob(NULL, 0);
166
167 if (!out_mem_ctx) {
168 /* if the caller doesn't want to manage/own the memory,
169 we can put it on our context */
170 out_mem_ctx = ntlmssp_state;
171 }
172
173 status = gensec_ntlmssp_update_find(gensec_security, gensec_ntlmssp, input, &i);
174 NT_STATUS_NOT_OK_RETURN(status);
175
176 status = ntlmssp_callbacks[i].sync_fn(gensec_security, out_mem_ctx, input, out);
177 NT_STATUS_NOT_OK_RETURN(status);
178
179 return NT_STATUS_OK;
180}
181
182static NTSTATUS gensec_ntlmssp_may_reset_crypto(struct gensec_security *gensec_security,
183 bool full_reset)
184{
185 struct gensec_ntlmssp_context *gensec_ntlmssp =
186 talloc_get_type_abort(gensec_security->private_data,
187 struct gensec_ntlmssp_context);
188 struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
189 NTSTATUS status;
190 bool reset_seqnums = full_reset;
191
192 if (!gensec_ntlmssp_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
193 return NT_STATUS_OK;
194 }
195
196 status = ntlmssp_sign_reset(ntlmssp_state, reset_seqnums);
197 if (!NT_STATUS_IS_OK(status)) {
198 DEBUG(1, ("Could not reset NTLMSSP signing/sealing system (error was: %s)\n",
199 nt_errstr(status)));
200 return status;
201 }
202
203 return NT_STATUS_OK;
204}
205
206static const char *gensec_ntlmssp_oids[] = {
207 GENSEC_OID_NTLMSSP,
208 NULL
209};
210
211static const struct gensec_security_ops gensec_ntlmssp_security_ops = {
212 .name = "ntlmssp",
213 .sasl_name = GENSEC_SASL_NAME_NTLMSSP, /* "NTLM" */
214 .auth_type = DCERPC_AUTH_TYPE_NTLMSSP,
215 .oid = gensec_ntlmssp_oids,
216 .client_start = gensec_ntlmssp_client_start,
217 .server_start = gensec_ntlmssp_server_start,
218 .magic = gensec_ntlmssp_magic,
219 .update = gensec_ntlmssp_update,
220 .may_reset_crypto= gensec_ntlmssp_may_reset_crypto,
221 .sig_size = gensec_ntlmssp_sig_size,
222 .sign_packet = gensec_ntlmssp_sign_packet,
223 .check_packet = gensec_ntlmssp_check_packet,
224 .seal_packet = gensec_ntlmssp_seal_packet,
225 .unseal_packet = gensec_ntlmssp_unseal_packet,
226 .wrap = gensec_ntlmssp_wrap,
227 .unwrap = gensec_ntlmssp_unwrap,
228 .session_key = gensec_ntlmssp_session_key,
229 .session_info = gensec_ntlmssp_session_info,
230 .have_feature = gensec_ntlmssp_have_feature,
231 .enabled = true,
232 .priority = GENSEC_NTLMSSP
233};
234
235static const struct gensec_security_ops gensec_ntlmssp_resume_ccache_ops = {
236 .name = "ntlmssp_resume_ccache",
237 .client_start = gensec_ntlmssp_resume_ccache_start,
238 .update = gensec_ntlmssp_update,
239 .session_key = gensec_ntlmssp_session_key,
240 .have_feature = gensec_ntlmssp_have_feature,
241 .enabled = true,
242 .priority = GENSEC_NTLMSSP
243};
244
245_PUBLIC_ NTSTATUS gensec_ntlmssp_init(void)
246{
247 NTSTATUS ret;
248
249 ret = gensec_register(&gensec_ntlmssp_security_ops);
250 if (!NT_STATUS_IS_OK(ret)) {
251 DEBUG(0,("Failed to register '%s' gensec backend!\n",
252 gensec_ntlmssp_security_ops.name));
253 return ret;
254 }
255
256 ret = gensec_register(&gensec_ntlmssp_resume_ccache_ops);
257 if (!NT_STATUS_IS_OK(ret)) {
258 DEBUG(0,("Failed to register '%s' gensec backend!\n",
259 gensec_ntlmssp_resume_ccache_ops.name));
260 return ret;
261 }
262
263 return ret;
264}
265
266static struct gensec_security *gensec_find_child_by_ops(struct gensec_security *gensec_security,
267 const struct gensec_security_ops *ops)
268{
269 struct gensec_security *current = gensec_security;
270
271 while (current != NULL) {
272 if (current->ops == ops) {
273 return current;
274 }
275
276 current = current->child_security;
277 }
278
279 return NULL;
280}
281
282uint32_t gensec_ntlmssp_neg_flags(struct gensec_security *gensec_security)
283{
284 struct gensec_ntlmssp_context *gensec_ntlmssp;
285
286 gensec_security = gensec_find_child_by_ops(gensec_security,
287 &gensec_ntlmssp_security_ops);
288 if (gensec_security == NULL) {
289 return 0;
290 }
291
292 gensec_ntlmssp = talloc_get_type_abort(gensec_security->private_data,
293 struct gensec_ntlmssp_context);
294 return gensec_ntlmssp->ntlmssp_state->neg_flags;
295}
296
297const char *gensec_ntlmssp_server_domain(struct gensec_security *gensec_security)
298{
299 struct gensec_ntlmssp_context *gensec_ntlmssp;
300
301 gensec_security = gensec_find_child_by_ops(gensec_security,
302 &gensec_ntlmssp_security_ops);
303 if (gensec_security == NULL) {
304 return NULL;
305 }
306
307 gensec_ntlmssp = talloc_get_type_abort(gensec_security->private_data,
308 struct gensec_ntlmssp_context);
309 return gensec_ntlmssp->ntlmssp_state->server.netbios_domain;
310}
Note: See TracBrowser for help on using the repository browser.