2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, client server side parsing
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2005
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "system/network.h"
26 #include "lib/tsocket/tsocket.h"
27 #include "auth/ntlmssp/ntlmssp.h"
28 #include "../librpc/gen_ndr/ndr_ntlmssp.h"
29 #include "auth/ntlmssp/ntlmssp_ndr.h"
30 #include "auth/ntlmssp/ntlmssp_private.h"
31 #include "../libcli/auth/libcli_auth.h"
32 #include "../lib/crypto/crypto.h"
33 #include "auth/gensec/gensec.h"
34 #include "auth/common_auth.h"
35 #include "param/param.h"
38 * Next state function for the Negotiate packet (GENSEC wrapper)
40 * @param gensec_security GENSEC state
41 * @param out_mem_ctx Memory context for *out
42 * @param in The request, as a DATA_BLOB. reply.data must be NULL
43 * @param out The reply, as an allocated DATA_BLOB, caller to free.
44 * @return Errors or MORE_PROCESSING_REQUIRED if (normal) a reply is required.
47 NTSTATUS
gensec_ntlmssp_server_negotiate(struct gensec_security
*gensec_security
,
48 TALLOC_CTX
*out_mem_ctx
,
49 const DATA_BLOB request
, DATA_BLOB
*reply
)
51 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
52 talloc_get_type_abort(gensec_security
->private_data
,
53 struct gensec_ntlmssp_context
);
54 struct ntlmssp_state
*ntlmssp_state
= gensec_ntlmssp
->ntlmssp_state
;
55 return ntlmssp_server_negotiate(ntlmssp_state
, out_mem_ctx
, request
, reply
);
59 * Next state function for the Authenticate packet (GENSEC wrapper)
61 * @param gensec_security GENSEC state
62 * @param out_mem_ctx Memory context for *out
63 * @param in The request, as a DATA_BLOB. reply.data must be NULL
64 * @param out The reply, as an allocated DATA_BLOB, caller to free.
65 * @return Errors or NT_STATUS_OK if authentication sucessful
68 NTSTATUS
gensec_ntlmssp_server_auth(struct gensec_security
*gensec_security
,
69 TALLOC_CTX
*out_mem_ctx
,
70 const DATA_BLOB in
, DATA_BLOB
*out
)
72 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
73 talloc_get_type_abort(gensec_security
->private_data
,
74 struct gensec_ntlmssp_context
);
75 struct ntlmssp_state
*ntlmssp_state
= gensec_ntlmssp
->ntlmssp_state
;
76 return ntlmssp_server_auth(ntlmssp_state
, out_mem_ctx
, in
, out
);
80 * Return the challenge as determined by the authentication subsystem
81 * @return an 8 byte random challenge
84 NTSTATUS
auth_ntlmssp_get_challenge(const struct ntlmssp_state
*ntlmssp_state
,
87 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
88 talloc_get_type_abort(ntlmssp_state
->callback_private
,
89 struct gensec_ntlmssp_context
);
90 struct auth4_context
*auth_context
= gensec_ntlmssp
->gensec_security
->auth_context
;
91 NTSTATUS status
= NT_STATUS_NOT_IMPLEMENTED
;
93 if (auth_context
->get_challenge
) {
94 status
= auth_context
->get_challenge(auth_context
, chal
);
95 if (!NT_STATUS_IS_OK(status
)) {
96 DEBUG(1, ("auth_ntlmssp_get_challenge: failed to get challenge: %s\n",
106 * Some authentication methods 'fix' the challenge, so we may not be able to set it
108 * @return If the effective challenge used by the auth subsystem may be modified
110 bool auth_ntlmssp_may_set_challenge(const struct ntlmssp_state
*ntlmssp_state
)
112 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
113 talloc_get_type_abort(ntlmssp_state
->callback_private
,
114 struct gensec_ntlmssp_context
);
115 struct auth4_context
*auth_context
= gensec_ntlmssp
->gensec_security
->auth_context
;
117 if (auth_context
->challenge_may_be_modified
) {
118 return auth_context
->challenge_may_be_modified(auth_context
);
124 * NTLM2 authentication modifies the effective challenge,
125 * @param challenge The new challenge value
127 NTSTATUS
auth_ntlmssp_set_challenge(struct ntlmssp_state
*ntlmssp_state
, DATA_BLOB
*challenge
)
129 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
130 talloc_get_type_abort(ntlmssp_state
->callback_private
,
131 struct gensec_ntlmssp_context
);
132 struct auth4_context
*auth_context
= gensec_ntlmssp
->gensec_security
->auth_context
;
133 NTSTATUS nt_status
= NT_STATUS_NOT_IMPLEMENTED
;
136 if (challenge
->length
!= 8) {
137 return NT_STATUS_INVALID_PARAMETER
;
140 chal
= challenge
->data
;
142 if (auth_context
->set_challenge
) {
143 nt_status
= auth_context
->set_challenge(auth_context
,
145 "NTLMSSP callback (NTLM2)");
151 * Check the password on an NTLMSSP login.
153 * Return the session keys used on the connection.
156 NTSTATUS
auth_ntlmssp_check_password(struct ntlmssp_state
*ntlmssp_state
,
158 DATA_BLOB
*user_session_key
, DATA_BLOB
*lm_session_key
)
160 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
161 talloc_get_type_abort(ntlmssp_state
->callback_private
,
162 struct gensec_ntlmssp_context
);
163 struct auth4_context
*auth_context
= gensec_ntlmssp
->gensec_security
->auth_context
;
164 NTSTATUS nt_status
= NT_STATUS_NOT_IMPLEMENTED
;
165 struct auth_usersupplied_info
*user_info
;
167 user_info
= talloc_zero(ntlmssp_state
, struct auth_usersupplied_info
);
169 return NT_STATUS_NO_MEMORY
;
172 user_info
->logon_parameters
= MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT
| MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT
;
173 user_info
->flags
= 0;
174 user_info
->mapped_state
= false;
175 user_info
->client
.account_name
= ntlmssp_state
->user
;
176 user_info
->client
.domain_name
= ntlmssp_state
->domain
;
177 user_info
->workstation_name
= ntlmssp_state
->client
.netbios_name
;
178 user_info
->remote_host
= gensec_get_remote_address(gensec_ntlmssp
->gensec_security
);
180 user_info
->password_state
= AUTH_PASSWORD_RESPONSE
;
181 user_info
->password
.response
.lanman
= ntlmssp_state
->lm_resp
;
182 user_info
->password
.response
.lanman
.data
= talloc_steal(user_info
, ntlmssp_state
->lm_resp
.data
);
183 user_info
->password
.response
.nt
= ntlmssp_state
->nt_resp
;
184 user_info
->password
.response
.nt
.data
= talloc_steal(user_info
, ntlmssp_state
->nt_resp
.data
);
186 if (auth_context
->check_password
) {
187 nt_status
= auth_context
->check_password(auth_context
,
190 &gensec_ntlmssp
->server_returned_info
,
191 user_session_key
, lm_session_key
);
193 talloc_free(user_info
);
195 if (!NT_STATUS_IS_OK(nt_status
)) {
196 DEBUG(5,("%s: Checking NTLMSSP password for %s\\%s failed: %s\n",
198 user_info
->client
.domain_name
,
199 user_info
->client
.account_name
,
200 nt_errstr(nt_status
)));
203 NT_STATUS_NOT_OK_RETURN(nt_status
);
205 talloc_steal(mem_ctx
, user_session_key
->data
);
206 talloc_steal(mem_ctx
, lm_session_key
->data
);
212 * Return the credentials of a logged on user, including session keys
215 * Only valid after a successful authentication
217 * May only be called once per authentication.
221 NTSTATUS
gensec_ntlmssp_session_info(struct gensec_security
*gensec_security
,
223 struct auth_session_info
**session_info
)
226 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
227 talloc_get_type_abort(gensec_security
->private_data
,
228 struct gensec_ntlmssp_context
);
229 uint32_t session_info_flags
= 0;
231 if (gensec_security
->want_features
& GENSEC_FEATURE_UNIX_TOKEN
) {
232 session_info_flags
|= AUTH_SESSION_INFO_UNIX_TOKEN
;
235 session_info_flags
|= AUTH_SESSION_INFO_DEFAULT_GROUPS
;
237 if (gensec_security
->auth_context
&& gensec_security
->auth_context
->generate_session_info
) {
238 nt_status
= gensec_security
->auth_context
->generate_session_info(mem_ctx
, gensec_security
->auth_context
,
239 gensec_ntlmssp
->server_returned_info
,
240 gensec_ntlmssp
->ntlmssp_state
->user
,
244 DEBUG(0, ("Cannot generate a session_info without the auth_context\n"));
245 return NT_STATUS_INTERNAL_ERROR
;
248 NT_STATUS_NOT_OK_RETURN(nt_status
);
250 nt_status
= gensec_ntlmssp_session_key(gensec_security
, *session_info
,
251 &(*session_info
)->session_key
);
252 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_USER_SESSION_KEY
)) {
253 (*session_info
)->session_key
= data_blob_null
;
254 nt_status
= NT_STATUS_OK
;
261 * Start NTLMSSP on the server side
264 NTSTATUS
gensec_ntlmssp_server_start(struct gensec_security
*gensec_security
)
267 struct ntlmssp_state
*ntlmssp_state
;
268 struct gensec_ntlmssp_context
*gensec_ntlmssp
;
270 nt_status
= gensec_ntlmssp_start(gensec_security
);
271 NT_STATUS_NOT_OK_RETURN(nt_status
);
274 talloc_get_type_abort(gensec_security
->private_data
,
275 struct gensec_ntlmssp_context
);
277 ntlmssp_state
= talloc_zero(gensec_ntlmssp
,
278 struct ntlmssp_state
);
279 if (!ntlmssp_state
) {
280 return NT_STATUS_NO_MEMORY
;
283 ntlmssp_state
->callback_private
= gensec_ntlmssp
;
285 gensec_ntlmssp
->ntlmssp_state
= ntlmssp_state
;
287 ntlmssp_state
= gensec_ntlmssp
->ntlmssp_state
;
289 ntlmssp_state
->role
= NTLMSSP_SERVER
;
291 ntlmssp_state
->expected_state
= NTLMSSP_NEGOTIATE
;
293 ntlmssp_state
->allow_lm_key
= (lpcfg_lanman_auth(gensec_security
->settings
->lp_ctx
)
294 && gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "allow_lm_key", false));
296 ntlmssp_state
->neg_flags
=
297 NTLMSSP_NEGOTIATE_NTLM
| NTLMSSP_NEGOTIATE_VERSION
;
299 ntlmssp_state
->lm_resp
= data_blob(NULL
, 0);
300 ntlmssp_state
->nt_resp
= data_blob(NULL
, 0);
302 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "128bit", true)) {
303 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_128
;
306 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "56bit", true)) {
307 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_56
;
310 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "keyexchange", true)) {
311 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_KEY_EXCH
;
314 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "alwayssign", true)) {
315 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_ALWAYS_SIGN
;
318 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "ntlm2", true)) {
319 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_NTLM2
;
322 if (gensec_security
->want_features
& GENSEC_FEATURE_SESSION_KEY
) {
323 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
325 if (gensec_security
->want_features
& GENSEC_FEATURE_SIGN
) {
326 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
328 if (gensec_security
->want_features
& GENSEC_FEATURE_SEAL
) {
329 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
330 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
333 ntlmssp_state
->get_challenge
= auth_ntlmssp_get_challenge
;
334 ntlmssp_state
->may_set_challenge
= auth_ntlmssp_may_set_challenge
;
335 ntlmssp_state
->set_challenge
= auth_ntlmssp_set_challenge
;
336 ntlmssp_state
->check_password
= auth_ntlmssp_check_password
;
337 if (lpcfg_server_role(gensec_security
->settings
->lp_ctx
) == ROLE_STANDALONE
) {
338 ntlmssp_state
->server
.is_standalone
= true;
340 ntlmssp_state
->server
.is_standalone
= false;
343 ntlmssp_state
->server
.netbios_name
= lpcfg_netbios_name(gensec_security
->settings
->lp_ctx
);
345 ntlmssp_state
->server
.netbios_domain
= lpcfg_workgroup(gensec_security
->settings
->lp_ctx
);
348 const char *dnsdomain
= lpcfg_dnsdomain(gensec_security
->settings
->lp_ctx
);
349 char *dnsname
, *lower_netbiosname
;
350 lower_netbiosname
= strlower_talloc(ntlmssp_state
, ntlmssp_state
->server
.netbios_name
);
352 /* Find out the DNS host name */
353 if (dnsdomain
&& dnsdomain
[0] != '\0') {
354 dnsname
= talloc_asprintf(ntlmssp_state
, "%s.%s",
357 talloc_free(lower_netbiosname
);
358 ntlmssp_state
->server
.dns_name
= dnsname
;
360 ntlmssp_state
->server
.dns_name
= lower_netbiosname
;
363 NT_STATUS_HAVE_NO_MEMORY(ntlmssp_state
->server
.dns_name
);
365 ntlmssp_state
->server
.dns_domain
366 = talloc_strdup(ntlmssp_state
,
367 lpcfg_dnsdomain(gensec_security
->settings
->lp_ctx
));
368 NT_STATUS_HAVE_NO_MEMORY(ntlmssp_state
->server
.dns_domain
);