2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2005,2011
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../auth/ntlmssp/ntlmssp.h"
27 #include "../auth/ntlmssp/ntlmssp_private.h"
28 #include "../librpc/gen_ndr/netlogon.h"
29 #include "../librpc/gen_ndr/dcerpc.h"
30 #include "../lib/tsocket/tsocket.h"
31 #include "auth/gensec/gensec.h"
32 #include "librpc/rpc/dcerpc.h"
33 #include "lib/param/param.h"
35 NTSTATUS
auth3_generate_session_info(TALLOC_CTX
*mem_ctx
,
36 struct auth4_context
*auth_context
,
37 void *server_returned_info
,
38 const char *original_user_name
,
39 uint32_t session_info_flags
,
40 struct auth_session_info
**session_info
)
42 struct auth_serversupplied_info
*server_info
= talloc_get_type_abort(server_returned_info
,
43 struct auth_serversupplied_info
);
46 nt_status
= create_local_token(mem_ctx
,
51 if (!NT_STATUS_IS_OK(nt_status
)) {
52 DEBUG(10, ("create_local_token failed: %s\n",
53 nt_errstr(nt_status
)));
61 * Return the challenge as determined by the authentication subsystem
62 * @return an 8 byte random challenge
65 NTSTATUS
auth3_get_challenge(struct auth4_context
*auth4_context
,
68 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
70 auth_context
->get_ntlm_challenge(auth_context
, chal
);
75 * Some authentication methods 'fix' the challenge, so we may not be able to set it
77 * @return If the effective challenge used by the auth subsystem may be modified
79 bool auth3_may_set_challenge(struct auth4_context
*auth4_context
)
81 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
83 return auth_context
->challenge_may_be_modified
;
87 * NTLM2 authentication modifies the effective challenge,
88 * @param challenge The new challenge value
90 NTSTATUS
auth3_set_challenge(struct auth4_context
*auth4_context
, const uint8_t *chal
,
91 const char *challenge_set_by
)
93 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
96 auth_context
->challenge
= data_blob_talloc(auth_context
,
98 NT_STATUS_HAVE_NO_MEMORY(auth_context
->challenge
.data
);
100 auth_context
->challenge_set_by
= talloc_strdup(auth_context
, challenge_set_by
);
101 NT_STATUS_HAVE_NO_MEMORY(auth_context
->challenge_set_by
);
103 DEBUG(5, ("auth_context challenge set by %s\n", auth_context
->challenge_set_by
));
104 DEBUG(5, ("challenge is: \n"));
105 dump_data(5, auth_context
->challenge
.data
, auth_context
->challenge
.length
);
110 * Check the password on an NTLMSSP login.
112 * Return the session keys used on the connection.
115 NTSTATUS
auth3_check_password(struct auth4_context
*auth4_context
,
117 const struct auth_usersupplied_info
*user_info
,
118 void **server_returned_info
,
119 DATA_BLOB
*session_key
, DATA_BLOB
*lm_session_key
)
121 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
122 struct auth_context
);
123 struct auth_usersupplied_info
*mapped_user_info
= NULL
;
124 struct auth_serversupplied_info
*server_info
;
126 bool username_was_mapped
;
128 /* The client has given us its machine name (which we only get over NBT transport).
129 We need to possibly reload smb.conf if smb.conf includes depend on the machine name. */
131 set_remote_machine_name(user_info
->workstation_name
, True
);
133 /* setup the string used by %U */
134 /* sub_set_smb_name checks for weird internally */
135 sub_set_smb_name(user_info
->client
.account_name
);
137 lp_load(get_dyn_CONFIGFILE(), false, false, true, true);
139 nt_status
= make_user_info_map(&mapped_user_info
,
140 user_info
->client
.account_name
,
141 user_info
->client
.domain_name
,
142 user_info
->workstation_name
,
143 user_info
->remote_host
,
144 user_info
->password
.response
.lanman
.data
? &user_info
->password
.response
.lanman
: NULL
,
145 user_info
->password
.response
.nt
.data
? &user_info
->password
.response
.nt
: NULL
,
147 AUTH_PASSWORD_RESPONSE
);
149 if (!NT_STATUS_IS_OK(nt_status
)) {
153 mapped_user_info
->logon_parameters
= user_info
->logon_parameters
;
155 mapped_user_info
->flags
= user_info
->flags
;
157 nt_status
= auth_context
->check_ntlm_password(auth_context
,
158 mapped_user_info
, &server_info
);
160 if (!NT_STATUS_IS_OK(nt_status
)) {
161 DEBUG(5,("Checking NTLMSSP password for %s\\%s failed: %s\n",
162 user_info
->client
.domain_name
,
163 user_info
->client
.account_name
,
164 nt_errstr(nt_status
)));
167 username_was_mapped
= mapped_user_info
->was_mapped
;
169 free_user_info(&mapped_user_info
);
171 if (!NT_STATUS_IS_OK(nt_status
)) {
172 nt_status
= do_map_to_guest_server_info(nt_status
,
174 user_info
->client
.account_name
,
175 user_info
->client
.domain_name
);
176 *server_returned_info
= talloc_steal(mem_ctx
, server_info
);
180 server_info
->nss_token
|= username_was_mapped
;
182 /* Clear out the session keys, and pass them to the caller.
183 * They will not be used in this form again - instead the
184 * NTLMSSP code will decide on the final correct session key,
185 * and supply it to create_local_token() */
187 DEBUG(10, ("Got NT session key of length %u\n",
188 (unsigned int)server_info
->session_key
.length
));
189 *session_key
= server_info
->session_key
;
190 talloc_steal(mem_ctx
, server_info
->session_key
.data
);
191 server_info
->session_key
= data_blob_null
;
193 if (lm_session_key
) {
194 DEBUG(10, ("Got LM session key of length %u\n",
195 (unsigned int)server_info
->lm_session_key
.length
));
196 *lm_session_key
= server_info
->lm_session_key
;
197 talloc_steal(mem_ctx
, server_info
->lm_session_key
.data
);
198 server_info
->lm_session_key
= data_blob_null
;
201 *server_returned_info
= talloc_steal(mem_ctx
, server_info
);
205 static const char *gensec_ntlmssp3_server_oids
[] = {
210 const struct gensec_security_ops gensec_ntlmssp3_server_ops
= {
211 .name
= "ntlmssp3_server",
212 .sasl_name
= GENSEC_SASL_NAME_NTLMSSP
, /* "NTLM" */
213 .auth_type
= DCERPC_AUTH_TYPE_NTLMSSP
,
214 .oid
= gensec_ntlmssp3_server_oids
,
215 .server_start
= gensec_ntlmssp_server_start
,
216 .magic
= gensec_ntlmssp_magic
,
217 .update
= gensec_ntlmssp_update
,
218 .sig_size
= gensec_ntlmssp_sig_size
,
219 .sign_packet
= gensec_ntlmssp_sign_packet
,
220 .check_packet
= gensec_ntlmssp_check_packet
,
221 .seal_packet
= gensec_ntlmssp_seal_packet
,
222 .unseal_packet
= gensec_ntlmssp_unseal_packet
,
223 .wrap
= gensec_ntlmssp_wrap
,
224 .unwrap
= gensec_ntlmssp_unwrap
,
225 .session_key
= gensec_ntlmssp_session_key
,
226 .session_info
= gensec_ntlmssp_session_info
,
227 .have_feature
= gensec_ntlmssp_have_feature
,
229 .priority
= GENSEC_NTLMSSP