source3/utils/ntlm_auth_diagnostics.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind status program.
   5
   6    Copyright (C) Tim Potter      2000-2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
   8    Copyright (C) Francesco Chemolli <kinkie@kame.usr.dsi.unimi.it> 2000
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "utils/ntlm_auth.h"
  26 #include "../libcli/auth/libcli_auth.h"
  27 #include "nsswitch/winbind_client.h"
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_WINBIND
  31
  32 enum ntlm_break {
  33         BREAK_NONE,
  34         BREAK_LM,
  35         BREAK_NT,
  36         NO_LM,
  37         NO_NT
  38 };
  39
  40 /*
  41    Authenticate a user with a challenge/response, checking session key
  42    and valid authentication types
  43 */
  44
  45 /*
  46  * Test the normal 'LM and NTLM' combination
  47  */
  48
  49 static bool test_lm_ntlm_broken(enum ntlm_break break_which)
  50 {
  51         bool pass = True;
  52         NTSTATUS nt_status;
  53         uint32 flags = 0;
  54         DATA_BLOB lm_response = data_blob(NULL, 24);
  55         DATA_BLOB nt_response = data_blob(NULL, 24);
  56         DATA_BLOB session_key = data_blob(NULL, 16);
  57
  58         uchar lm_key[8];
  59         uchar user_session_key[16];
  60         uchar lm_hash[16];
  61         uchar nt_hash[16];
  62         DATA_BLOB chall = get_challenge();
  63         char *error_string;
  64
  65         ZERO_STRUCT(lm_key);
  66         ZERO_STRUCT(user_session_key);
  67
  68         flags |= WBFLAG_PAM_LMKEY;
  69         flags |= WBFLAG_PAM_USER_SESSION_KEY;
  70
  71         SMBencrypt(opt_password,chall.data,lm_response.data);
  72         E_deshash(opt_password, lm_hash);
  73
  74         SMBNTencrypt(opt_password,chall.data,nt_response.data);
  75
  76         E_md4hash(opt_password, nt_hash);
  77         SMBsesskeygen_ntv1(nt_hash, session_key.data);
  78
  79         switch (break_which) {
  80         case BREAK_NONE:
  81                 break;
  82         case BREAK_LM:
  83                 lm_response.data[0]++;
  84                 break;
  85         case BREAK_NT:
  86                 nt_response.data[0]++;
  87                 break;
  88         case NO_LM:
  89                 data_blob_free(&lm_response);
  90                 break;
  91         case NO_NT:
  92                 data_blob_free(&nt_response);
  93                 break;
  94         }
  95
  96         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
  97                                               opt_workstation,
  98                                               &chall,
  99                                               &lm_response,
 100                                               &nt_response,
 101                                               flags, 0,
 102                                               lm_key,
 103                                               user_session_key,
 104                                               &error_string, NULL);
 105
 106         data_blob_free(&lm_response);
 107
 108         if (!NT_STATUS_IS_OK(nt_status)) {
 109                 d_printf("%s (0x%x)\n",
 110                          error_string,
 111                          NT_STATUS_V(nt_status));
 112                 SAFE_FREE(error_string);
 113                 return break_which == BREAK_NT;
 114         }
 115
 116         if (memcmp(lm_hash, lm_key,
 117                    sizeof(lm_key)) != 0) {
 118                 DEBUG(1, ("LM Key does not match expectations!\n"));
 119                 DEBUG(1, ("lm_key:\n"));
 120                 dump_data(1, lm_key, 8);
 121                 DEBUG(1, ("expected:\n"));
 122                 dump_data(1, lm_hash, 8);
 123                 pass = False;
 124         }
 125
 126         if (break_which == NO_NT) {
 127                 if (memcmp(lm_hash, user_session_key,
 128                            8) != 0) {
 129                         DEBUG(1, ("NT Session Key does not match expectations (should be LM hash)!\n"));
 130                         DEBUG(1, ("user_session_key:\n"));
 131                         dump_data(1, user_session_key, sizeof(user_session_key));
 132                         DEBUG(1, ("expected:\n"));
 133                         dump_data(1, lm_hash, sizeof(lm_hash));
 134                         pass = False;
 135                 }
 136         } else {
 137                 if (memcmp(session_key.data, user_session_key,
 138                            sizeof(user_session_key)) != 0) {
 139                         DEBUG(1, ("NT Session Key does not match expectations!\n"));
 140                         DEBUG(1, ("user_session_key:\n"));
 141                         dump_data(1, user_session_key, 16);
 142                         DEBUG(1, ("expected:\n"));
 143                         dump_data(1, session_key.data, session_key.length);
 144                         pass = False;
 145                 }
 146         }
 147         return pass;
 148 }
 149
 150 /*
 151  * Test LM authentication, no NT response supplied
 152  */
 153
 154 static bool test_lm(void)
 155 {
 156
 157         return test_lm_ntlm_broken(NO_NT);
 158 }
 159
 160 /*
 161  * Test the NTLM response only, no LM.
 162  */
 163
 164 static bool test_ntlm(void)
 165 {
 166         return test_lm_ntlm_broken(NO_LM);
 167 }
 168
 169 /*
 170  * Test the NTLM response only, but in the LM field.
 171  */
 172
 173 static bool test_ntlm_in_lm(void)
 174 {
 175         bool pass = True;
 176         NTSTATUS nt_status;
 177         uint32 flags = 0;
 178         DATA_BLOB nt_response = data_blob(NULL, 24);
 179
 180         uchar lm_key[8];
 181         uchar lm_hash[16];
 182         uchar user_session_key[16];
 183         DATA_BLOB chall = get_challenge();
 184         char *error_string;
 185
 186         ZERO_STRUCT(user_session_key);
 187
 188         flags |= WBFLAG_PAM_LMKEY;
 189         flags |= WBFLAG_PAM_USER_SESSION_KEY;
 190
 191         SMBNTencrypt(opt_password,chall.data,nt_response.data);
 192
 193         E_deshash(opt_password, lm_hash);
 194
 195         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
 196                                               opt_workstation,
 197                                               &chall,
 198                                               &nt_response,
 199                                               NULL,
 200                                               flags, 0,
 201                                               lm_key,
 202                                               user_session_key,
 203                                               &error_string, NULL);
 204
 205         data_blob_free(&nt_response);
 206
 207         if (!NT_STATUS_IS_OK(nt_status)) {
 208                 d_printf("%s (0x%x)\n",
 209                          error_string,
 210                          NT_STATUS_V(nt_status));
 211                 SAFE_FREE(error_string);
 212                 return False;
 213         }
 214
 215         if (memcmp(lm_hash, lm_key,
 216                    sizeof(lm_key)) != 0) {
 217                 DEBUG(1, ("LM Key does not match expectations!\n"));
 218                 DEBUG(1, ("lm_key:\n"));
 219                 dump_data(1, lm_key, 8);
 220                 DEBUG(1, ("expected:\n"));
 221                 dump_data(1, lm_hash, 8);
 222                 pass = False;
 223         }
 224         if (memcmp(lm_hash, user_session_key, 8) != 0) {
 225                 DEBUG(1, ("Session Key (first 8 lm hash) does not match expectations!\n"));
 226                 DEBUG(1, ("user_session_key:\n"));
 227                 dump_data(1, user_session_key, 16);
 228                 DEBUG(1, ("expected:\n"));
 229                 dump_data(1, lm_hash, 8);
 230                 pass = False;
 231         }
 232         return pass;
 233 }
 234
 235 /*
 236  * Test the NTLM response only, but in the both the NT and LM fields.
 237  */
 238
 239 static bool test_ntlm_in_both(void)
 240 {
 241         bool pass = True;
 242         NTSTATUS nt_status;
 243         uint32 flags = 0;
 244         DATA_BLOB nt_response = data_blob(NULL, 24);
 245         DATA_BLOB session_key = data_blob(NULL, 16);
 246
 247         uint8 lm_key[8];
 248         uint8 lm_hash[16];
 249         uint8 user_session_key[16];
 250         uint8 nt_hash[16];
 251         DATA_BLOB chall = get_challenge();
 252         char *error_string;
 253
 254         ZERO_STRUCT(lm_key);
 255         ZERO_STRUCT(user_session_key);
 256
 257         flags |= WBFLAG_PAM_LMKEY;
 258         flags |= WBFLAG_PAM_USER_SESSION_KEY;
 259
 260         SMBNTencrypt(opt_password,chall.data,nt_response.data);
 261         E_md4hash(opt_password, nt_hash);
 262         SMBsesskeygen_ntv1(nt_hash, session_key.data);
 263
 264         E_deshash(opt_password, lm_hash);
 265
 266         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
 267                                               opt_workstation,
 268                                               &chall,
 269                                               &nt_response,
 270                                               &nt_response,
 271                                               flags, 0,
 272                                               lm_key,
 273                                               user_session_key,
 274                                               &error_string, NULL);
 275
 276         data_blob_free(&nt_response);
 277
 278         if (!NT_STATUS_IS_OK(nt_status)) {
 279                 d_printf("%s (0x%x)\n",
 280                          error_string,
 281                          NT_STATUS_V(nt_status));
 282                 SAFE_FREE(error_string);
 283                 return False;
 284         }
 285
 286         if (memcmp(lm_hash, lm_key,
 287                    sizeof(lm_key)) != 0) {
 288                 DEBUG(1, ("LM Key does not match expectations!\n"));
 289                 DEBUG(1, ("lm_key:\n"));
 290                 dump_data(1, lm_key, 8);
 291                 DEBUG(1, ("expected:\n"));
 292                 dump_data(1, lm_hash, 8);
 293                 pass = False;
 294         }
 295         if (memcmp(session_key.data, user_session_key,
 296                    sizeof(user_session_key)) != 0) {
 297                 DEBUG(1, ("NT Session Key does not match expectations!\n"));
 298                 DEBUG(1, ("user_session_key:\n"));
 299                 dump_data(1, user_session_key, 16);
 300                 DEBUG(1, ("expected:\n"));
 301                 dump_data(1, session_key.data, session_key.length);
 302                 pass = False;
 303         }
 304
 305
 306         return pass;
 307 }
 308
 309 /*
 310  * Test the NTLMv2 and LMv2 responses
 311  */
 312
 313 static bool test_lmv2_ntlmv2_broken(enum ntlm_break break_which)
 314 {
 315         bool pass = True;
 316         NTSTATUS nt_status;
 317         uint32 flags = 0;
 318         DATA_BLOB ntlmv2_response = data_blob_null;
 319         DATA_BLOB lmv2_response = data_blob_null;
 320         DATA_BLOB ntlmv2_session_key = data_blob_null;
 321         DATA_BLOB names_blob = NTLMv2_generate_names_blob(NULL, get_winbind_netbios_name(), get_winbind_domain());
 322
 323         uchar user_session_key[16];
 324         DATA_BLOB chall = get_challenge();
 325         char *error_string;
 326
 327         ZERO_STRUCT(user_session_key);
 328
 329         flags |= WBFLAG_PAM_USER_SESSION_KEY;
 330
 331         if (!SMBNTLMv2encrypt(NULL, opt_username, opt_domain, opt_password, &chall,
 332                               &names_blob,
 333                               &lmv2_response, &ntlmv2_response, NULL,
 334                               &ntlmv2_session_key)) {
 335                 data_blob_free(&names_blob);
 336                 return False;
 337         }
 338         data_blob_free(&names_blob);
 339
 340         switch (break_which) {
 341         case BREAK_NONE:
 342                 break;
 343         case BREAK_LM:
 344                 lmv2_response.data[0]++;
 345                 break;
 346         case BREAK_NT:
 347                 ntlmv2_response.data[0]++;
 348                 break;
 349         case NO_LM:
 350                 data_blob_free(&lmv2_response);
 351                 break;
 352         case NO_NT:
 353                 data_blob_free(&ntlmv2_response);
 354                 break;
 355         }
 356
 357         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
 358                                               opt_workstation,
 359                                               &chall,
 360                                               &lmv2_response,
 361                                               &ntlmv2_response,
 362                                               flags, 0,
 363                                               NULL,
 364                                               user_session_key,
 365                                               &error_string, NULL);
 366
 367         data_blob_free(&lmv2_response);
 368         data_blob_free(&ntlmv2_response);
 369
 370         if (!NT_STATUS_IS_OK(nt_status)) {
 371                 d_printf("%s (0x%x)\n",
 372                          error_string,
 373                          NT_STATUS_V(nt_status));
 374                 SAFE_FREE(error_string);
 375                 return break_which == BREAK_NT;
 376         }
 377
 378         if (break_which != NO_NT && break_which != BREAK_NT && memcmp(ntlmv2_session_key.data, user_session_key,
 379                    sizeof(user_session_key)) != 0) {
 380                 DEBUG(1, ("USER (NTLMv2) Session Key does not match expectations!\n"));
 381                 DEBUG(1, ("user_session_key:\n"));
 382                 dump_data(1, user_session_key, 16);
 383                 DEBUG(1, ("expected:\n"));
 384                 dump_data(1, ntlmv2_session_key.data, ntlmv2_session_key.length);
 385                 pass = False;
 386         }
 387         return pass;
 388 }
 389
 390 /*
 391  * Test the NTLMv2 and LMv2 responses
 392  */
 393
 394 static bool test_lmv2_ntlmv2(void)
 395 {
 396         return test_lmv2_ntlmv2_broken(BREAK_NONE);
 397 }
 398
 399 /*
 400  * Test the LMv2 response only
 401  */
 402
 403 static bool test_lmv2(void)
 404 {
 405         return test_lmv2_ntlmv2_broken(NO_NT);
 406 }
 407
 408 /*
 409  * Test the NTLMv2 response only
 410  */
 411
 412 static bool test_ntlmv2(void)
 413 {
 414         return test_lmv2_ntlmv2_broken(NO_LM);
 415 }
 416
 417 static bool test_lm_ntlm(void)
 418 {
 419         return test_lm_ntlm_broken(BREAK_NONE);
 420 }
 421
 422 static bool test_ntlm_lm_broken(void)
 423 {
 424         return test_lm_ntlm_broken(BREAK_LM);
 425 }
 426
 427 static bool test_ntlm_ntlm_broken(void)
 428 {
 429         return test_lm_ntlm_broken(BREAK_NT);
 430 }
 431
 432 static bool test_ntlmv2_lmv2_broken(void)
 433 {
 434         return test_lmv2_ntlmv2_broken(BREAK_LM);
 435 }
 436
 437 static bool test_ntlmv2_ntlmv2_broken(void)
 438 {
 439         return test_lmv2_ntlmv2_broken(BREAK_NT);
 440 }
 441
 442 static bool test_plaintext(enum ntlm_break break_which)
 443 {
 444         NTSTATUS nt_status;
 445         uint32 flags = 0;
 446         DATA_BLOB nt_response = data_blob_null;
 447         DATA_BLOB lm_response = data_blob_null;
 448         char *password;
 449         smb_ucs2_t *nt_response_ucs2;
 450         size_t converted_size;
 451
 452         uchar user_session_key[16];
 453         uchar lm_key[16];
 454         static const uchar zeros[8] = { 0, };
 455         DATA_BLOB chall = data_blob(zeros, sizeof(zeros));
 456         char *error_string;
 457
 458         ZERO_STRUCT(user_session_key);
 459
 460         flags |= WBFLAG_PAM_LMKEY;
 461         flags |= WBFLAG_PAM_USER_SESSION_KEY;
 462
 463         if (!push_ucs2_talloc(talloc_tos(), &nt_response_ucs2, opt_password,
 464                                 &converted_size))
 465         {
 466                 DEBUG(0, ("push_ucs2_talloc failed!\n"));
 467                 exit(1);
 468         }
 469
 470         nt_response.data = (unsigned char *)nt_response_ucs2;
 471         nt_response.length = strlen_w(nt_response_ucs2)*sizeof(smb_ucs2_t);
 472
 473         if ((password = strupper_talloc(talloc_tos(), opt_password)) == NULL) {
 474                 DEBUG(0, ("strupper_talloc() failed!\n"));
 475                 exit(1);
 476         }
 477
 478         if (!convert_string_talloc(talloc_tos(), CH_UNIX,
 479                                    CH_DOS, password,
 480                                    strlen(password)+1,
 481                                    &lm_response.data,
 482                                    &lm_response.length)) {
 483                 DEBUG(0, ("convert_string_talloc failed!\n"));
 484                 exit(1);
 485         }
 486
 487         TALLOC_FREE(password);
 488
 489         switch (break_which) {
 490         case BREAK_NONE:
 491                 break;
 492         case BREAK_LM:
 493                 lm_response.data[0]++;
 494                 break;
 495         case BREAK_NT:
 496                 nt_response.data[0]++;
 497                 break;
 498         case NO_LM:
 499                 TALLOC_FREE(lm_response.data);
 500                 lm_response.length = 0;
 501                 break;
 502         case NO_NT:
 503                 TALLOC_FREE(nt_response.data);
 504                 nt_response.length = 0;
 505                 break;
 506         }
 507
 508         nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
 509                                               opt_workstation,
 510                                               &chall,
 511                                               &lm_response,
 512                                               &nt_response,
 513                                               flags, MSV1_0_CLEARTEXT_PASSWORD_ALLOWED,
 514                                               lm_key,
 515                                               user_session_key,
 516                                               &error_string, NULL);
 517
 518         TALLOC_FREE(nt_response.data);
 519         TALLOC_FREE(lm_response.data);
 520         data_blob_free(&chall);
 521
 522         if (!NT_STATUS_IS_OK(nt_status)) {
 523                 d_printf("%s (0x%x)\n",
 524                          error_string,
 525                          NT_STATUS_V(nt_status));
 526                 SAFE_FREE(error_string);
 527                 return break_which == BREAK_NT;
 528         }
 529
 530         return break_which != BREAK_NT;
 531 }
 532
 533 static bool test_plaintext_none_broken(void) {
 534         return test_plaintext(BREAK_NONE);
 535 }
 536
 537 static bool test_plaintext_lm_broken(void) {
 538         return test_plaintext(BREAK_LM);
 539 }
 540
 541 static bool test_plaintext_nt_broken(void) {
 542         return test_plaintext(BREAK_NT);
 543 }
 544
 545 static bool test_plaintext_nt_only(void) {
 546         return test_plaintext(NO_LM);
 547 }
 548
 549 static bool test_plaintext_lm_only(void) {
 550         return test_plaintext(NO_NT);
 551 }
 552
 553 /*
 554    Tests:
 555
 556    - LM only
 557    - NT and LM
 558    - NT
 559    - NT in LM field
 560    - NT in both fields
 561    - NTLMv2
 562    - NTLMv2 and LMv2
 563    - LMv2
 564    - plaintext tests (in challenge-response feilds)
 565
 566    check we get the correct session key in each case
 567    check what values we get for the LM session key
 568
 569 */
 570
 571 static const struct ntlm_tests {
 572         bool (*fn)(void);
 573         const char *name;
 574 } test_table[] = {
 575         {test_lm, "LM"},
 576         {test_lm_ntlm, "LM and NTLM"},
 577         {test_ntlm, "NTLM"},
 578         {test_ntlm_in_lm, "NTLM in LM"},
 579         {test_ntlm_in_both, "NTLM in both"},
 580         {test_ntlmv2, "NTLMv2"},
 581         {test_lmv2_ntlmv2, "NTLMv2 and LMv2"},
 582         {test_lmv2, "LMv2"},
 583         {test_ntlmv2_lmv2_broken, "NTLMv2 and LMv2, LMv2 broken"},
 584         {test_ntlmv2_ntlmv2_broken, "NTLMv2 and LMv2, NTLMv2 broken"},
 585         {test_ntlm_lm_broken, "NTLM and LM, LM broken"},
 586         {test_ntlm_ntlm_broken, "NTLM and LM, NTLM broken"},
 587         {test_plaintext_none_broken, "Plaintext"},
 588         {test_plaintext_lm_broken, "Plaintext LM broken"},
 589         {test_plaintext_nt_broken, "Plaintext NT broken"},
 590         {test_plaintext_nt_only, "Plaintext NT only"},
 591         {test_plaintext_lm_only, "Plaintext LM only"},
 592         {NULL, NULL}
 593 };
 594
 595 bool diagnose_ntlm_auth(void)
 596 {
 597         unsigned int i;
 598         bool pass = True;
 599
 600         for (i=0; test_table[i].fn; i++) {
 601                 if (!test_table[i].fn()) {
 602                         DEBUG(1, ("Test %s failed!\n", test_table[i].name));
 603                         pass = False;
 604                 }
 605         }
 606
 607         return pass;
 608 }
 609