2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, client server side parsing
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2005
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "system/network.h"
26 #include "lib/tsocket/tsocket.h"
27 #include "auth/ntlmssp/ntlmssp.h"
28 #include "../librpc/gen_ndr/ndr_ntlmssp.h"
29 #include "auth/ntlmssp/ntlmssp_ndr.h"
30 #include "auth/ntlmssp/ntlmssp_private.h"
31 #include "../libcli/auth/libcli_auth.h"
32 #include "../lib/crypto/crypto.h"
33 #include "auth/gensec/gensec.h"
34 #include "auth/gensec/gensec_internal.h"
35 #include "auth/common_auth.h"
36 #include "param/param.h"
37 #include "param/loadparm.h"
38 #include "libds/common/roles.h"
41 * Return the credentials of a logged on user, including session keys
44 * Only valid after a successful authentication
46 * May only be called once per authentication.
50 NTSTATUS
gensec_ntlmssp_session_info(struct gensec_security
*gensec_security
,
52 struct auth_session_info
**session_info
)
55 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
56 talloc_get_type_abort(gensec_security
->private_data
,
57 struct gensec_ntlmssp_context
);
58 uint32_t session_info_flags
= 0;
60 if (gensec_security
->want_features
& GENSEC_FEATURE_UNIX_TOKEN
) {
61 session_info_flags
|= AUTH_SESSION_INFO_UNIX_TOKEN
;
64 session_info_flags
|= AUTH_SESSION_INFO_DEFAULT_GROUPS
;
66 if (gensec_security
->auth_context
&& gensec_security
->auth_context
->generate_session_info
) {
67 nt_status
= gensec_security
->auth_context
->generate_session_info(gensec_security
->auth_context
, mem_ctx
,
68 gensec_ntlmssp
->server_returned_info
,
69 gensec_ntlmssp
->ntlmssp_state
->user
,
73 DEBUG(0, ("Cannot generate a session_info without the auth_context\n"));
74 return NT_STATUS_INTERNAL_ERROR
;
77 NT_STATUS_NOT_OK_RETURN(nt_status
);
79 nt_status
= gensec_ntlmssp_session_key(gensec_security
, *session_info
,
80 &(*session_info
)->session_key
);
81 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_USER_SESSION_KEY
)) {
82 (*session_info
)->session_key
= data_blob_null
;
83 nt_status
= NT_STATUS_OK
;
90 * Start NTLMSSP on the server side
93 NTSTATUS
gensec_ntlmssp_server_start(struct gensec_security
*gensec_security
)
96 struct ntlmssp_state
*ntlmssp_state
;
97 struct gensec_ntlmssp_context
*gensec_ntlmssp
;
98 const char *netbios_name
;
99 const char *netbios_domain
;
100 const char *dns_name
;
101 const char *dns_domain
;
102 enum server_role role
;
104 role
= lpcfg_server_role(gensec_security
->settings
->lp_ctx
);
106 nt_status
= gensec_ntlmssp_start(gensec_security
);
107 NT_STATUS_NOT_OK_RETURN(nt_status
);
110 talloc_get_type_abort(gensec_security
->private_data
,
111 struct gensec_ntlmssp_context
);
113 ntlmssp_state
= talloc_zero(gensec_ntlmssp
,
114 struct ntlmssp_state
);
115 if (!ntlmssp_state
) {
116 return NT_STATUS_NO_MEMORY
;
118 gensec_ntlmssp
->ntlmssp_state
= ntlmssp_state
;
120 ntlmssp_state
->role
= NTLMSSP_SERVER
;
122 ntlmssp_state
->expected_state
= NTLMSSP_NEGOTIATE
;
124 ntlmssp_state
->allow_lm_response
=
125 lpcfg_lanman_auth(gensec_security
->settings
->lp_ctx
);
127 if (ntlmssp_state
->allow_lm_response
&&
128 gensec_setting_bool(gensec_security
->settings
,
129 "ntlmssp_server", "allow_lm_key", false))
131 ntlmssp_state
->allow_lm_key
= true;
134 ntlmssp_state
->force_old_spnego
= false;
136 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "force_old_spnego", false)) {
138 * For testing Windows 2000 mode
140 ntlmssp_state
->force_old_spnego
= true;
143 ntlmssp_state
->neg_flags
=
144 NTLMSSP_NEGOTIATE_NTLM
| NTLMSSP_NEGOTIATE_VERSION
;
146 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "128bit", true)) {
147 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_128
;
150 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "56bit", true)) {
151 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_56
;
154 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "keyexchange", true)) {
155 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_KEY_EXCH
;
158 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "alwayssign", true)) {
159 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_ALWAYS_SIGN
;
162 if (gensec_setting_bool(gensec_security
->settings
, "ntlmssp_server", "ntlm2", true)) {
163 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_NTLM2
;
166 if (ntlmssp_state
->allow_lm_key
) {
167 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_LM_KEY
;
170 if (gensec_security
->want_features
& GENSEC_FEATURE_SESSION_KEY
) {
171 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
173 if (gensec_security
->want_features
& GENSEC_FEATURE_SIGN
) {
174 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
176 if (gensec_security
->want_features
& GENSEC_FEATURE_LDAP_STYLE
) {
178 * We need to handle NTLMSSP_NEGOTIATE_SIGN as
179 * NTLMSSP_NEGOTIATE_SEAL if GENSEC_FEATURE_LDAP_STYLE
182 ntlmssp_state
->force_wrap_seal
= true;
185 if (gensec_security
->want_features
& GENSEC_FEATURE_SEAL
) {
186 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
187 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
190 if (role
== ROLE_STANDALONE
) {
191 ntlmssp_state
->server
.is_standalone
= true;
193 ntlmssp_state
->server
.is_standalone
= false;
196 if (gensec_security
->settings
->server_netbios_name
) {
197 netbios_name
= gensec_security
->settings
->server_netbios_name
;
199 netbios_name
= lpcfg_netbios_name(gensec_security
->settings
->lp_ctx
);
202 if (gensec_security
->settings
->server_netbios_domain
) {
203 netbios_domain
= gensec_security
->settings
->server_netbios_domain
;
205 netbios_domain
= lpcfg_workgroup(gensec_security
->settings
->lp_ctx
);
208 if (gensec_security
->settings
->server_dns_name
) {
209 dns_name
= gensec_security
->settings
->server_dns_name
;
211 const char *dnsdomain
= lpcfg_dnsdomain(gensec_security
->settings
->lp_ctx
);
212 char *lower_netbiosname
;
214 lower_netbiosname
= strlower_talloc(ntlmssp_state
, netbios_name
);
215 NT_STATUS_HAVE_NO_MEMORY(lower_netbiosname
);
217 /* Find out the DNS host name */
218 if (dnsdomain
&& dnsdomain
[0] != '\0') {
219 dns_name
= talloc_asprintf(ntlmssp_state
, "%s.%s",
222 talloc_free(lower_netbiosname
);
223 NT_STATUS_HAVE_NO_MEMORY(dns_name
);
225 dns_name
= lower_netbiosname
;
229 if (gensec_security
->settings
->server_dns_domain
) {
230 dns_domain
= gensec_security
->settings
->server_dns_domain
;
232 dns_domain
= lpcfg_dnsdomain(gensec_security
->settings
->lp_ctx
);
235 ntlmssp_state
->server
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
236 NT_STATUS_HAVE_NO_MEMORY(ntlmssp_state
->server
.netbios_name
);
238 ntlmssp_state
->server
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
239 NT_STATUS_HAVE_NO_MEMORY(ntlmssp_state
->server
.netbios_domain
);
241 ntlmssp_state
->server
.dns_name
= talloc_strdup(ntlmssp_state
, dns_name
);
242 NT_STATUS_HAVE_NO_MEMORY(ntlmssp_state
->server
.dns_name
);
244 ntlmssp_state
->server
.dns_domain
= talloc_strdup(ntlmssp_state
, dns_domain
);
245 NT_STATUS_HAVE_NO_MEMORY(ntlmssp_state
->server
.dns_domain
);
247 ntlmssp_state
->neg_flags
|= ntlmssp_state
->required_flags
;
248 ntlmssp_state
->conf_flags
= ntlmssp_state
->neg_flags
;