source3/utils/ntlm_auth_diagnostics.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind status program.
   5
   6    Copyright (C) Tim Potter      2000-2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
   8    Copyright (C) Francesco Chemolli <kinkie@kame.usr.dsi.unimi.it> 2000
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "utils/ntlm_auth.h"
  26 #include "../libcli/auth/libcli_auth.h"
  27 #include "nsswitch/winbind_client.h"
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_WINBIND
  31
  32 enum ntlm_break {
  33         BREAK_NONE,
  34         BREAK_LM,
  35         BREAK_NT,
  36         NO_LM,
  37         NO_NT
  38 };
  39
  40 /*
  41    Authenticate a user with a challenge/response, checking session key
  42    and valid authentication types
  43 */
  44
  45 /*
  46  * Test the normal 'LM and NTLM' combination
  47  */
  48
  49 static bool test_lm_ntlm_broken(enum ntlm_break break_which)
  50 {
  51         bool pass = True;
  52         NTSTATUS nt_status;
  53         uint32_t flags = 0;
  54         DATA_BLOB lm_response = data_blob(NULL, 24);
  55         DATA_BLOB nt_response = data_blob(NULL, 24);
  56         DATA_BLOB session_key = data_blob(NULL, 16);
  57         uint8_t authoritative = 0;
  58         uchar lm_key[8];
  59         uchar user_session_key[16];
  60         uchar lm_hash[16];
  61         uchar nt_hash[16];
  62         DATA_BLOB chall = get_challenge();
  63         char *error_string;
  64
  65         ZERO_STRUCT(lm_key);
  66         ZERO_STRUCT(user_session_key);
  67
  68         flags |= WBFLAG_PAM_LMKEY;
  69         flags |= WBFLAG_PAM_USER_SESSION_KEY;
  70
  71         SMBencrypt(opt_password,chall.data,lm_response.data);
  72         E_deshash(opt_password, lm_hash);
  73
  74         SMBNTencrypt(opt_password,chall.data,nt_response.data);
  75
  76         E_md4hash(opt_password, nt_hash);
  77         SMBsesskeygen_ntv1(nt_hash, session_key.data);
  78
  79         switch (break_which) {
  80         case BREAK_NONE:
  81                 break;
  82         case BREAK_LM:
  83                 lm_response.data[0]++;
  84                 break;
  85         case BREAK_NT:
  86                 nt_response.data[0]++;
  87                 break;
  88         case NO_LM:
  89                 data_blob_free(&lm_response);
  90                 break;
  91         case NO_NT:
  92                 data_blob_free(&nt_response);
  93                 break;
  94         }
  95
  96         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
  97                                               opt_workstation,
  98                                               &chall,
  99                                               &lm_response,
 100                                               &nt_response,
 101                                               flags, 0,
 102                                               lm_key,
 103                                               user_session_key,
 104                                               &authoritative,
 105                                               &error_string, NULL);
 106
 107         data_blob_free(&lm_response);
 108
 109         if (!NT_STATUS_IS_OK(nt_status)) {
 110                 d_printf("%s (0x%x)\n",
 111                          error_string,
 112                          NT_STATUS_V(nt_status));
 113                 SAFE_FREE(error_string);
 114                 return break_which == BREAK_NT;
 115         }
 116
 117         if (memcmp(lm_hash, lm_key,
 118                    sizeof(lm_key)) != 0) {
 119                 DEBUG(1, ("LM Key does not match expectations!\n"));
 120                 DEBUG(1, ("lm_key:\n"));
 121                 dump_data(1, lm_key, 8);
 122                 DEBUG(1, ("expected:\n"));
 123                 dump_data(1, lm_hash, 8);
 124                 pass = False;
 125         }
 126
 127         if (break_which == NO_NT) {
 128                 if (memcmp(lm_hash, user_session_key,
 129                            8) != 0) {
 130                         DEBUG(1, ("NT Session Key does not match expectations (should be LM hash)!\n"));
 131                         DEBUG(1, ("user_session_key:\n"));
 132                         dump_data(1, user_session_key, sizeof(user_session_key));
 133                         DEBUG(1, ("expected:\n"));
 134                         dump_data(1, lm_hash, sizeof(lm_hash));
 135                         pass = False;
 136                 }
 137         } else {
 138                 if (memcmp(session_key.data, user_session_key,
 139                            sizeof(user_session_key)) != 0) {
 140                         DEBUG(1, ("NT Session Key does not match expectations!\n"));
 141                         DEBUG(1, ("user_session_key:\n"));
 142                         dump_data(1, user_session_key, 16);
 143                         DEBUG(1, ("expected:\n"));
 144                         dump_data(1, session_key.data, session_key.length);
 145                         pass = False;
 146                 }
 147         }
 148         return pass;
 149 }
 150
 151 /*
 152  * Test LM authentication, no NT response supplied
 153  */
 154
 155 static bool test_lm(void)
 156 {
 157
 158         return test_lm_ntlm_broken(NO_NT);
 159 }
 160
 161 /*
 162  * Test the NTLM response only, no LM.
 163  */
 164
 165 static bool test_ntlm(void)
 166 {
 167         return test_lm_ntlm_broken(NO_LM);
 168 }
 169
 170 /*
 171  * Test the NTLM response only, but in the LM field.
 172  */
 173
 174 static bool test_ntlm_in_lm(void)
 175 {
 176         bool pass = True;
 177         NTSTATUS nt_status;
 178         uint32_t flags = 0;
 179         DATA_BLOB nt_response = data_blob(NULL, 24);
 180         uint8_t authoritative = 0;
 181         uchar lm_key[8];
 182         uchar lm_hash[16];
 183         uchar user_session_key[16];
 184         DATA_BLOB chall = get_challenge();
 185         char *error_string;
 186
 187         ZERO_STRUCT(user_session_key);
 188
 189         flags |= WBFLAG_PAM_LMKEY;
 190         flags |= WBFLAG_PAM_USER_SESSION_KEY;
 191
 192         SMBNTencrypt(opt_password,chall.data,nt_response.data);
 193
 194         E_deshash(opt_password, lm_hash);
 195
 196         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
 197                                               opt_workstation,
 198                                               &chall,
 199                                               &nt_response,
 200                                               NULL,
 201                                               flags, 0,
 202                                               lm_key,
 203                                               user_session_key,
 204                                               &authoritative,
 205                                               &error_string, NULL);
 206
 207         data_blob_free(&nt_response);
 208
 209         if (!NT_STATUS_IS_OK(nt_status)) {
 210                 d_printf("%s (0x%x)\n",
 211                          error_string,
 212                          NT_STATUS_V(nt_status));
 213                 SAFE_FREE(error_string);
 214                 return False;
 215         }
 216
 217         if (memcmp(lm_hash, lm_key,
 218                    sizeof(lm_key)) != 0) {
 219                 DEBUG(1, ("LM Key does not match expectations!\n"));
 220                 DEBUG(1, ("lm_key:\n"));
 221                 dump_data(1, lm_key, 8);
 222                 DEBUG(1, ("expected:\n"));
 223                 dump_data(1, lm_hash, 8);
 224                 pass = False;
 225         }
 226         if (memcmp(lm_hash, user_session_key, 8) != 0) {
 227                 DEBUG(1, ("Session Key (first 8 lm hash) does not match expectations!\n"));
 228                 DEBUG(1, ("user_session_key:\n"));
 229                 dump_data(1, user_session_key, 16);
 230                 DEBUG(1, ("expected:\n"));
 231                 dump_data(1, lm_hash, 8);
 232                 pass = False;
 233         }
 234         return pass;
 235 }
 236
 237 /*
 238  * Test the NTLM response only, but in the both the NT and LM fields.
 239  */
 240
 241 static bool test_ntlm_in_both(void)
 242 {
 243         bool pass = True;
 244         NTSTATUS nt_status;
 245         uint32_t flags = 0;
 246         DATA_BLOB nt_response = data_blob(NULL, 24);
 247         DATA_BLOB session_key = data_blob(NULL, 16);
 248         uint8_t authoritative = 0;
 249         uint8_t lm_key[8];
 250         uint8_t lm_hash[16];
 251         uint8_t user_session_key[16];
 252         uint8_t nt_hash[16];
 253         DATA_BLOB chall = get_challenge();
 254         char *error_string;
 255
 256         ZERO_STRUCT(lm_key);
 257         ZERO_STRUCT(user_session_key);
 258
 259         flags |= WBFLAG_PAM_LMKEY;
 260         flags |= WBFLAG_PAM_USER_SESSION_KEY;
 261
 262         SMBNTencrypt(opt_password,chall.data,nt_response.data);
 263         E_md4hash(opt_password, nt_hash);
 264         SMBsesskeygen_ntv1(nt_hash, session_key.data);
 265
 266         E_deshash(opt_password, lm_hash);
 267
 268         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
 269                                               opt_workstation,
 270                                               &chall,
 271                                               &nt_response,
 272                                               &nt_response,
 273                                               flags, 0,
 274                                               lm_key,
 275                                               user_session_key,
 276                                               &authoritative,
 277                                               &error_string, NULL);
 278
 279         data_blob_free(&nt_response);
 280
 281         if (!NT_STATUS_IS_OK(nt_status)) {
 282                 d_printf("%s (0x%x)\n",
 283                          error_string,
 284                          NT_STATUS_V(nt_status));
 285                 SAFE_FREE(error_string);
 286                 return False;
 287         }
 288
 289         if (memcmp(lm_hash, lm_key,
 290                    sizeof(lm_key)) != 0) {
 291                 DEBUG(1, ("LM Key does not match expectations!\n"));
 292                 DEBUG(1, ("lm_key:\n"));
 293                 dump_data(1, lm_key, 8);
 294                 DEBUG(1, ("expected:\n"));
 295                 dump_data(1, lm_hash, 8);
 296                 pass = False;
 297         }
 298         if (memcmp(session_key.data, user_session_key,
 299                    sizeof(user_session_key)) != 0) {
 300                 DEBUG(1, ("NT Session Key does not match expectations!\n"));
 301                 DEBUG(1, ("user_session_key:\n"));
 302                 dump_data(1, user_session_key, 16);
 303                 DEBUG(1, ("expected:\n"));
 304                 dump_data(1, session_key.data, session_key.length);
 305                 pass = False;
 306         }
 307
 308
 309         return pass;
 310 }
 311
 312 /*
 313  * Test the NTLMv2 and LMv2 responses
 314  */
 315
 316 static bool test_lmv2_ntlmv2_broken(enum ntlm_break break_which)
 317 {
 318         bool pass = True;
 319         NTSTATUS nt_status;
 320         uint32_t flags = 0;
 321         DATA_BLOB ntlmv2_response = data_blob_null;
 322         DATA_BLOB lmv2_response = data_blob_null;
 323         DATA_BLOB ntlmv2_session_key = data_blob_null;
 324         DATA_BLOB names_blob = NTLMv2_generate_names_blob(NULL, get_winbind_netbios_name(), get_winbind_domain());
 325         uint8_t authoritative = 0;
 326         uchar user_session_key[16];
 327         DATA_BLOB chall = get_challenge();
 328         char *error_string;
 329
 330         ZERO_STRUCT(user_session_key);
 331
 332         flags |= WBFLAG_PAM_USER_SESSION_KEY;
 333
 334         if (!SMBNTLMv2encrypt(NULL, opt_username, opt_domain, opt_password, &chall,
 335                               &names_blob,
 336                               &lmv2_response, &ntlmv2_response, NULL,
 337                               &ntlmv2_session_key)) {
 338                 data_blob_free(&names_blob);
 339                 return False;
 340         }
 341         data_blob_free(&names_blob);
 342
 343         switch (break_which) {
 344         case BREAK_NONE:
 345                 break;
 346         case BREAK_LM:
 347                 lmv2_response.data[0]++;
 348                 break;
 349         case BREAK_NT:
 350                 ntlmv2_response.data[0]++;
 351                 break;
 352         case NO_LM:
 353                 data_blob_free(&lmv2_response);
 354                 break;
 355         case NO_NT:
 356                 data_blob_free(&ntlmv2_response);
 357                 break;
 358         }
 359
 360         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
 361                                               opt_workstation,
 362                                               &chall,
 363                                               &lmv2_response,
 364                                               &ntlmv2_response,
 365                                               flags, 0,
 366                                               NULL,
 367                                               user_session_key,
 368                                               &authoritative,
 369                                               &error_string, NULL);
 370
 371         data_blob_free(&lmv2_response);
 372         data_blob_free(&ntlmv2_response);
 373
 374         if (!NT_STATUS_IS_OK(nt_status)) {
 375                 d_printf("%s (0x%x)\n",
 376                          error_string,
 377                          NT_STATUS_V(nt_status));
 378                 SAFE_FREE(error_string);
 379                 return break_which == BREAK_NT;
 380         }
 381
 382         if (break_which != NO_NT && break_which != BREAK_NT && memcmp(ntlmv2_session_key.data, user_session_key,
 383                    sizeof(user_session_key)) != 0) {
 384                 DEBUG(1, ("USER (NTLMv2) Session Key does not match expectations!\n"));
 385                 DEBUG(1, ("user_session_key:\n"));
 386                 dump_data(1, user_session_key, 16);
 387                 DEBUG(1, ("expected:\n"));
 388                 dump_data(1, ntlmv2_session_key.data, ntlmv2_session_key.length);
 389                 pass = False;
 390         }
 391         return pass;
 392 }
 393
 394 /*
 395  * Test the NTLMv2 and LMv2 responses
 396  */
 397
 398 static bool test_lmv2_ntlmv2(void)
 399 {
 400         return test_lmv2_ntlmv2_broken(BREAK_NONE);
 401 }
 402
 403 /*
 404  * Test the LMv2 response only
 405  */
 406
 407 static bool test_lmv2(void)
 408 {
 409         return test_lmv2_ntlmv2_broken(NO_NT);
 410 }
 411
 412 /*
 413  * Test the NTLMv2 response only
 414  */
 415
 416 static bool test_ntlmv2(void)
 417 {
 418         return test_lmv2_ntlmv2_broken(NO_LM);
 419 }
 420
 421 static bool test_lm_ntlm(void)
 422 {
 423         return test_lm_ntlm_broken(BREAK_NONE);
 424 }
 425
 426 static bool test_ntlm_lm_broken(void)
 427 {
 428         return test_lm_ntlm_broken(BREAK_LM);
 429 }
 430
 431 static bool test_ntlm_ntlm_broken(void)
 432 {
 433         return test_lm_ntlm_broken(BREAK_NT);
 434 }
 435
 436 static bool test_ntlmv2_lmv2_broken(void)
 437 {
 438         return test_lmv2_ntlmv2_broken(BREAK_LM);
 439 }
 440
 441 static bool test_ntlmv2_ntlmv2_broken(void)
 442 {
 443         return test_lmv2_ntlmv2_broken(BREAK_NT);
 444 }
 445
 446 static bool test_plaintext(enum ntlm_break break_which)
 447 {
 448         NTSTATUS nt_status;
 449         uint32_t flags = 0;
 450         DATA_BLOB nt_response = data_blob_null;
 451         DATA_BLOB lm_response = data_blob_null;
 452         char *password;
 453         smb_ucs2_t *nt_response_ucs2;
 454         size_t converted_size;
 455         uint8_t authoritative = 0;
 456         uchar user_session_key[16];
 457         uchar lm_key[16];
 458         static const uchar zeros[8] = { 0, };
 459         DATA_BLOB chall = data_blob(zeros, sizeof(zeros));
 460         char *error_string;
 461
 462         ZERO_STRUCT(user_session_key);
 463
 464         flags |= WBFLAG_PAM_LMKEY;
 465         flags |= WBFLAG_PAM_USER_SESSION_KEY;
 466
 467         if (!push_ucs2_talloc(talloc_tos(), &nt_response_ucs2, opt_password,
 468                                 &converted_size))
 469         {
 470                 DEBUG(0, ("push_ucs2_talloc failed!\n"));
 471                 exit(1);
 472         }
 473
 474         nt_response.data = (unsigned char *)nt_response_ucs2;
 475         nt_response.length = strlen_w(nt_response_ucs2)*sizeof(smb_ucs2_t);
 476
 477         if ((password = strupper_talloc(talloc_tos(), opt_password)) == NULL) {
 478                 DEBUG(0, ("strupper_talloc() failed!\n"));
 479                 exit(1);
 480         }
 481
 482         if (!convert_string_talloc(talloc_tos(), CH_UNIX,
 483                                    CH_DOS, password,
 484                                    strlen(password)+1,
 485                                    &lm_response.data,
 486                                    &lm_response.length)) {
 487                 DEBUG(0, ("convert_string_talloc failed!\n"));
 488                 exit(1);
 489         }
 490
 491         TALLOC_FREE(password);
 492
 493         switch (break_which) {
 494         case BREAK_NONE:
 495                 break;
 496         case BREAK_LM:
 497                 lm_response.data[0]++;
 498                 break;
 499         case BREAK_NT:
 500                 nt_response.data[0]++;
 501                 break;
 502         case NO_LM:
 503                 TALLOC_FREE(lm_response.data);
 504                 lm_response.length = 0;
 505                 break;
 506         case NO_NT:
 507                 TALLOC_FREE(nt_response.data);
 508                 nt_response.length = 0;
 509                 break;
 510         }
 511
 512         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
 513                                               opt_workstation,
 514                                               &chall,
 515                                               &lm_response,
 516                                               &nt_response,
 517                                               flags, MSV1_0_CLEARTEXT_PASSWORD_ALLOWED,
 518                                               lm_key,
 519                                               user_session_key,
 520                                               &authoritative,
 521                                               &error_string, NULL);
 522
 523         TALLOC_FREE(nt_response.data);
 524         TALLOC_FREE(lm_response.data);
 525         data_blob_free(&chall);
 526
 527         if (!NT_STATUS_IS_OK(nt_status)) {
 528                 d_printf("%s (0x%x)\n",
 529                          error_string,
 530                          NT_STATUS_V(nt_status));
 531                 SAFE_FREE(error_string);
 532                 return break_which == BREAK_NT;
 533         }
 534
 535         return break_which != BREAK_NT;
 536 }
 537
 538 static bool test_plaintext_none_broken(void) {
 539         return test_plaintext(BREAK_NONE);
 540 }
 541
 542 static bool test_plaintext_lm_broken(void) {
 543         return test_plaintext(BREAK_LM);
 544 }
 545
 546 static bool test_plaintext_nt_broken(void) {
 547         return test_plaintext(BREAK_NT);
 548 }
 549
 550 static bool test_plaintext_nt_only(void) {
 551         return test_plaintext(NO_LM);
 552 }
 553
 554 static bool test_plaintext_lm_only(void) {
 555         return test_plaintext(NO_NT);
 556 }
 557
 558 /*
 559    Tests:
 560
 561    - LM only
 562    - NT and LM
 563    - NT
 564    - NT in LM field
 565    - NT in both fields
 566    - NTLMv2
 567    - NTLMv2 and LMv2
 568    - LMv2
 569    - plaintext tests (in challenge-response feilds)
 570
 571    check we get the correct session key in each case
 572    check what values we get for the LM session key
 573
 574 */
 575
 576 static const struct ntlm_tests {
 577         bool (*fn)(void);
 578         const char *name;
 579 } test_table[] = {
 580         {test_lm, "LM"},
 581         {test_lm_ntlm, "LM and NTLM"},
 582         {test_ntlm, "NTLM"},
 583         {test_ntlm_in_lm, "NTLM in LM"},
 584         {test_ntlm_in_both, "NTLM in both"},
 585         {test_ntlmv2, "NTLMv2"},
 586         {test_lmv2_ntlmv2, "NTLMv2 and LMv2"},
 587         {test_lmv2, "LMv2"},
 588         {test_ntlmv2_lmv2_broken, "NTLMv2 and LMv2, LMv2 broken"},
 589         {test_ntlmv2_ntlmv2_broken, "NTLMv2 and LMv2, NTLMv2 broken"},
 590         {test_ntlm_lm_broken, "NTLM and LM, LM broken"},
 591         {test_ntlm_ntlm_broken, "NTLM and LM, NTLM broken"},
 592         {test_plaintext_none_broken, "Plaintext"},
 593         {test_plaintext_lm_broken, "Plaintext LM broken"},
 594         {test_plaintext_nt_broken, "Plaintext NT broken"},
 595         {test_plaintext_nt_only, "Plaintext NT only"},
 596         {test_plaintext_lm_only, "Plaintext LM only"},
 597         {NULL, NULL}
 598 };
 599
 600 bool diagnose_ntlm_auth(void)
 601 {
 602         unsigned int i;
 603         bool pass = True;
 604
 605         for (i=0; test_table[i].fn; i++) {
 606                 if (!test_table[i].fn()) {
 607                         DEBUG(1, ("Test %s failed!\n", test_table[i].name));
 608                         pass = False;
 609                 }
 610         }
 611
 612         return pass;
 613 }
 614