2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2005,2011
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../auth/ntlmssp/ntlmssp.h"
27 #include "../auth/ntlmssp/ntlmssp_private.h"
28 #include "../librpc/gen_ndr/netlogon.h"
29 #include "../librpc/gen_ndr/dcerpc.h"
30 #include "../lib/tsocket/tsocket.h"
31 #include "auth/gensec/gensec.h"
32 #include "librpc/rpc/dcerpc.h"
33 #include "lib/param/param.h"
35 NTSTATUS
auth3_generate_session_info(TALLOC_CTX
*mem_ctx
,
36 struct auth4_context
*auth_context
,
37 void *server_returned_info
,
38 const char *original_user_name
,
39 uint32_t session_info_flags
,
40 struct auth_session_info
**session_info
)
42 struct auth_serversupplied_info
*server_info
= talloc_get_type_abort(server_returned_info
,
43 struct auth_serversupplied_info
);
46 nt_status
= create_local_token(mem_ctx
,
51 if (!NT_STATUS_IS_OK(nt_status
)) {
52 DEBUG(10, ("create_local_token failed: %s\n",
53 nt_errstr(nt_status
)));
60 static NTSTATUS
gensec_ntlmssp3_server_update(struct gensec_security
*gensec_security
,
61 TALLOC_CTX
*out_mem_ctx
,
62 struct tevent_context
*ev
,
63 const DATA_BLOB request
,
67 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
68 talloc_get_type_abort(gensec_security
->private_data
,
69 struct gensec_ntlmssp_context
);
71 status
= ntlmssp_update(gensec_ntlmssp
->ntlmssp_state
, request
, reply
);
72 if (NT_STATUS_IS_OK(status
) ||
73 NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
74 talloc_steal(out_mem_ctx
, reply
->data
);
81 * Return the challenge as determined by the authentication subsystem
82 * @return an 8 byte random challenge
85 NTSTATUS
auth3_get_challenge(struct auth4_context
*auth4_context
,
88 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
90 auth_context
->get_ntlm_challenge(auth_context
, chal
);
95 * Some authentication methods 'fix' the challenge, so we may not be able to set it
97 * @return If the effective challenge used by the auth subsystem may be modified
99 bool auth3_may_set_challenge(struct auth4_context
*auth4_context
)
101 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
102 struct auth_context
);
103 return auth_context
->challenge_may_be_modified
;
107 * NTLM2 authentication modifies the effective challenge,
108 * @param challenge The new challenge value
110 NTSTATUS
auth3_set_challenge(struct auth4_context
*auth4_context
, const uint8_t *chal
,
111 const char *challenge_set_by
)
113 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
114 struct auth_context
);
116 auth_context
->challenge
= data_blob_talloc(auth_context
,
118 NT_STATUS_HAVE_NO_MEMORY(auth_context
->challenge
.data
);
120 auth_context
->challenge_set_by
= talloc_strdup(auth_context
, challenge_set_by
);
121 NT_STATUS_HAVE_NO_MEMORY(auth_context
->challenge_set_by
);
123 DEBUG(5, ("auth_context challenge set by %s\n", auth_context
->challenge_set_by
));
124 DEBUG(5, ("challenge is: \n"));
125 dump_data(5, auth_context
->challenge
.data
, auth_context
->challenge
.length
);
130 * Check the password on an NTLMSSP login.
132 * Return the session keys used on the connection.
135 NTSTATUS
auth3_check_password(struct auth4_context
*auth4_context
,
137 const struct auth_usersupplied_info
*user_info
,
138 void **server_returned_info
,
139 DATA_BLOB
*session_key
, DATA_BLOB
*lm_session_key
)
141 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
142 struct auth_context
);
143 struct auth_usersupplied_info
*mapped_user_info
= NULL
;
144 struct auth_serversupplied_info
*server_info
;
146 bool username_was_mapped
;
148 /* The client has given us its machine name (which we only get over NBT transport).
149 We need to possibly reload smb.conf if smb.conf includes depend on the machine name. */
151 set_remote_machine_name(user_info
->workstation_name
, True
);
153 /* setup the string used by %U */
154 /* sub_set_smb_name checks for weird internally */
155 sub_set_smb_name(user_info
->client
.account_name
);
157 lp_load(get_dyn_CONFIGFILE(), false, false, true, true);
159 nt_status
= make_user_info_map(&mapped_user_info
,
160 user_info
->client
.account_name
,
161 user_info
->client
.domain_name
,
162 user_info
->workstation_name
,
163 user_info
->remote_host
,
164 user_info
->password
.response
.lanman
.data
? &user_info
->password
.response
.lanman
: NULL
,
165 user_info
->password
.response
.nt
.data
? &user_info
->password
.response
.nt
: NULL
,
167 AUTH_PASSWORD_RESPONSE
);
169 if (!NT_STATUS_IS_OK(nt_status
)) {
173 mapped_user_info
->logon_parameters
= user_info
->logon_parameters
;
175 mapped_user_info
->flags
= user_info
->flags
;
177 nt_status
= auth_context
->check_ntlm_password(auth_context
,
178 mapped_user_info
, &server_info
);
180 if (!NT_STATUS_IS_OK(nt_status
)) {
181 DEBUG(5,("Checking NTLMSSP password for %s\\%s failed: %s\n",
182 user_info
->client
.domain_name
,
183 user_info
->client
.account_name
,
184 nt_errstr(nt_status
)));
187 username_was_mapped
= mapped_user_info
->was_mapped
;
189 free_user_info(&mapped_user_info
);
191 if (!NT_STATUS_IS_OK(nt_status
)) {
192 nt_status
= do_map_to_guest_server_info(nt_status
,
194 user_info
->client
.account_name
,
195 user_info
->client
.domain_name
);
196 *server_returned_info
= talloc_steal(mem_ctx
, server_info
);
200 server_info
->nss_token
|= username_was_mapped
;
202 /* Clear out the session keys, and pass them to the caller.
203 * They will not be used in this form again - instead the
204 * NTLMSSP code will decide on the final correct session key,
205 * and supply it to create_local_token() */
207 DEBUG(10, ("Got NT session key of length %u\n",
208 (unsigned int)server_info
->session_key
.length
));
209 *session_key
= server_info
->session_key
;
210 talloc_steal(mem_ctx
, server_info
->session_key
.data
);
211 server_info
->session_key
= data_blob_null
;
213 if (lm_session_key
) {
214 DEBUG(10, ("Got LM session key of length %u\n",
215 (unsigned int)server_info
->lm_session_key
.length
));
216 *lm_session_key
= server_info
->lm_session_key
;
217 talloc_steal(mem_ctx
, server_info
->lm_session_key
.data
);
218 server_info
->lm_session_key
= data_blob_null
;
221 *server_returned_info
= talloc_steal(mem_ctx
, server_info
);
225 static NTSTATUS
gensec_ntlmssp3_server_start(struct gensec_security
*gensec_security
)
229 const char *netbios_name
;
230 const char *netbios_domain
;
231 const char *dns_name
;
233 struct gensec_ntlmssp_context
*gensec_ntlmssp
;
235 if ((enum server_role
)lp_server_role() == ROLE_STANDALONE
) {
236 is_standalone
= true;
238 is_standalone
= false;
241 netbios_name
= lp_netbios_name();
242 netbios_domain
= lp_workgroup();
243 /* This should be a 'netbios domain -> DNS domain' mapping */
244 dns_domain
= get_mydnsdomname(talloc_tos());
246 strlower_m(dns_domain
);
248 dns_name
= get_mydnsfullname();
250 nt_status
= gensec_ntlmssp_start(gensec_security
);
251 NT_STATUS_NOT_OK_RETURN(nt_status
);
254 talloc_get_type_abort(gensec_security
->private_data
,
255 struct gensec_ntlmssp_context
);
257 nt_status
= ntlmssp_server_start(gensec_ntlmssp
,
263 &gensec_ntlmssp
->ntlmssp_state
);
264 if (!NT_STATUS_IS_OK(nt_status
)) {
268 gensec_ntlmssp
->ntlmssp_state
->callback_private
= gensec_ntlmssp
;
270 gensec_ntlmssp
->ntlmssp_state
->get_challenge
= auth_ntlmssp_get_challenge
;
271 gensec_ntlmssp
->ntlmssp_state
->may_set_challenge
= auth_ntlmssp_may_set_challenge
;
272 gensec_ntlmssp
->ntlmssp_state
->set_challenge
= auth_ntlmssp_set_challenge
;
273 gensec_ntlmssp
->ntlmssp_state
->check_password
= auth_ntlmssp_check_password
;
275 if (gensec_ntlmssp
->gensec_security
->want_features
& GENSEC_FEATURE_SESSION_KEY
) {
276 gensec_ntlmssp
->ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
278 if (gensec_ntlmssp
->gensec_security
->want_features
& GENSEC_FEATURE_SIGN
) {
279 gensec_ntlmssp
->ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
281 if (gensec_ntlmssp
->gensec_security
->want_features
& GENSEC_FEATURE_SEAL
) {
282 gensec_ntlmssp
->ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
283 gensec_ntlmssp
->ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
289 static const char *gensec_ntlmssp3_server_oids
[] = {
294 const struct gensec_security_ops gensec_ntlmssp3_server_ops
= {
295 .name
= "ntlmssp3_server",
296 .sasl_name
= GENSEC_SASL_NAME_NTLMSSP
, /* "NTLM" */
297 .auth_type
= DCERPC_AUTH_TYPE_NTLMSSP
,
298 .oid
= gensec_ntlmssp3_server_oids
,
299 .server_start
= gensec_ntlmssp3_server_start
,
300 .magic
= gensec_ntlmssp_magic
,
301 .update
= gensec_ntlmssp3_server_update
,
302 .sig_size
= gensec_ntlmssp_sig_size
,
303 .sign_packet
= gensec_ntlmssp_sign_packet
,
304 .check_packet
= gensec_ntlmssp_check_packet
,
305 .seal_packet
= gensec_ntlmssp_seal_packet
,
306 .unseal_packet
= gensec_ntlmssp_unseal_packet
,
307 .wrap
= gensec_ntlmssp_wrap
,
308 .unwrap
= gensec_ntlmssp_unwrap
,
309 .session_key
= gensec_ntlmssp_session_key
,
310 .session_info
= gensec_ntlmssp_session_info
,
311 .have_feature
= gensec_ntlmssp_have_feature
,
313 .priority
= GENSEC_NTLMSSP