2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, client server side parsing
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2005
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 struct auth_session_info
;
27 #include "auth/ntlmssp/ntlmssp.h"
28 #include "auth/ntlmssp/ntlmssp_private.h"
29 #include "../libcli/auth/libcli_auth.h"
30 #include "librpc/gen_ndr/ndr_dcerpc.h"
31 #include "auth/gensec/gensec.h"
32 #include "auth/gensec/gensec_internal.h"
35 * Callbacks for NTLMSSP - for both client and server operating modes
39 static const struct ntlmssp_callbacks
{
40 enum ntlmssp_role role
;
41 enum ntlmssp_message_type command
;
42 NTSTATUS (*sync_fn
)(struct gensec_security
*gensec_security
,
43 TALLOC_CTX
*out_mem_ctx
,
44 DATA_BLOB in
, DATA_BLOB
*out
);
45 } ntlmssp_callbacks
[] = {
47 .role
= NTLMSSP_CLIENT
,
48 .command
= NTLMSSP_INITIAL
,
49 .sync_fn
= ntlmssp_client_initial
,
51 .role
= NTLMSSP_CLIENT
,
52 .command
= NTLMSSP_NEGOTIATE
,
53 .sync_fn
= gensec_ntlmssp_resume_ccache
,
55 .role
= NTLMSSP_SERVER
,
56 .command
= NTLMSSP_NEGOTIATE
,
57 .sync_fn
= gensec_ntlmssp_server_negotiate
,
59 .role
= NTLMSSP_CLIENT
,
60 .command
= NTLMSSP_CHALLENGE
,
61 .sync_fn
= ntlmssp_client_challenge
,
63 .role
= NTLMSSP_SERVER
,
64 .command
= NTLMSSP_AUTH
,
65 .sync_fn
= gensec_ntlmssp_server_auth
,
70 static NTSTATUS
gensec_ntlmssp_update_find(struct gensec_security
*gensec_security
,
71 struct gensec_ntlmssp_context
*gensec_ntlmssp
,
72 const DATA_BLOB input
, uint32_t *idx
)
74 uint32_t ntlmssp_command
;
77 if (gensec_ntlmssp
->ntlmssp_state
->expected_state
== NTLMSSP_DONE
) {
78 /* We are strict here because other modules, which we
79 * don't fully control (such as GSSAPI) are also
80 * strict, but are tested less often */
82 DEBUG(1, ("Called NTLMSSP after state machine was 'done'\n"));
83 return NT_STATUS_INVALID_PARAMETER
;
87 switch (gensec_ntlmssp
->ntlmssp_state
->role
) {
89 if (gensec_ntlmssp
->ntlmssp_state
->resume_ccache
) {
91 * make sure gensec_ntlmssp_resume_ccache()
94 ntlmssp_command
= NTLMSSP_NEGOTIATE
;
98 ntlmssp_command
= NTLMSSP_INITIAL
;
101 if (gensec_security
->want_features
& GENSEC_FEATURE_DATAGRAM_MODE
) {
102 /* 'datagram' mode - no neg packet */
103 ntlmssp_command
= NTLMSSP_NEGOTIATE
;
105 /* This is normal in SPNEGO mech negotiation fallback */
106 DEBUG(2, ("Failed to parse NTLMSSP packet: zero length\n"));
107 return NT_STATUS_INVALID_PARAMETER
;
112 if (!msrpc_parse(gensec_ntlmssp
->ntlmssp_state
,
116 DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
117 dump_data(2, input
.data
, input
.length
);
118 return NT_STATUS_INVALID_PARAMETER
;
122 if (ntlmssp_command
!= gensec_ntlmssp
->ntlmssp_state
->expected_state
) {
123 DEBUG(2, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command
,
124 gensec_ntlmssp
->ntlmssp_state
->expected_state
));
125 return NT_STATUS_INVALID_PARAMETER
;
128 for (i
=0; i
< ARRAY_SIZE(ntlmssp_callbacks
); i
++) {
129 if (ntlmssp_callbacks
[i
].role
== gensec_ntlmssp
->ntlmssp_state
->role
&&
130 ntlmssp_callbacks
[i
].command
== ntlmssp_command
) {
136 DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
137 gensec_ntlmssp
->ntlmssp_state
->role
, ntlmssp_command
));
139 return NT_STATUS_INVALID_PARAMETER
;
143 * Next state function for the wrapped NTLMSSP state machine
145 * @param gensec_security GENSEC state, initialised to NTLMSSP
146 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
147 * @param in The request, as a DATA_BLOB
148 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
149 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
150 * or NT_STATUS_OK if the user is authenticated.
153 NTSTATUS
gensec_ntlmssp_update(struct gensec_security
*gensec_security
,
154 TALLOC_CTX
*out_mem_ctx
,
155 struct tevent_context
*ev
,
156 const DATA_BLOB input
, DATA_BLOB
*out
)
158 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
159 talloc_get_type_abort(gensec_security
->private_data
,
160 struct gensec_ntlmssp_context
);
161 struct ntlmssp_state
*ntlmssp_state
= gensec_ntlmssp
->ntlmssp_state
;
165 *out
= data_blob(NULL
, 0);
168 /* if the caller doesn't want to manage/own the memory,
169 we can put it on our context */
170 out_mem_ctx
= ntlmssp_state
;
173 status
= gensec_ntlmssp_update_find(gensec_security
, gensec_ntlmssp
, input
, &i
);
174 NT_STATUS_NOT_OK_RETURN(status
);
176 status
= ntlmssp_callbacks
[i
].sync_fn(gensec_security
, out_mem_ctx
, input
, out
);
177 NT_STATUS_NOT_OK_RETURN(status
);
182 static NTSTATUS
gensec_ntlmssp_may_reset_crypto(struct gensec_security
*gensec_security
,
185 struct gensec_ntlmssp_context
*gensec_ntlmssp
=
186 talloc_get_type_abort(gensec_security
->private_data
,
187 struct gensec_ntlmssp_context
);
188 struct ntlmssp_state
*ntlmssp_state
= gensec_ntlmssp
->ntlmssp_state
;
190 bool reset_seqnums
= full_reset
;
192 if (!gensec_ntlmssp_have_feature(gensec_security
, GENSEC_FEATURE_SIGN
)) {
196 status
= ntlmssp_sign_reset(ntlmssp_state
, reset_seqnums
);
197 if (!NT_STATUS_IS_OK(status
)) {
198 DEBUG(1, ("Could not reset NTLMSSP signing/sealing system (error was: %s)\n",
206 static const char *gensec_ntlmssp_oids
[] = {
211 static const struct gensec_security_ops gensec_ntlmssp_security_ops
= {
213 .sasl_name
= GENSEC_SASL_NAME_NTLMSSP
, /* "NTLM" */
214 .auth_type
= DCERPC_AUTH_TYPE_NTLMSSP
,
215 .oid
= gensec_ntlmssp_oids
,
216 .client_start
= gensec_ntlmssp_client_start
,
217 .server_start
= gensec_ntlmssp_server_start
,
218 .magic
= gensec_ntlmssp_magic
,
219 .update
= gensec_ntlmssp_update
,
220 .may_reset_crypto
= gensec_ntlmssp_may_reset_crypto
,
221 .sig_size
= gensec_ntlmssp_sig_size
,
222 .sign_packet
= gensec_ntlmssp_sign_packet
,
223 .check_packet
= gensec_ntlmssp_check_packet
,
224 .seal_packet
= gensec_ntlmssp_seal_packet
,
225 .unseal_packet
= gensec_ntlmssp_unseal_packet
,
226 .wrap
= gensec_ntlmssp_wrap
,
227 .unwrap
= gensec_ntlmssp_unwrap
,
228 .session_key
= gensec_ntlmssp_session_key
,
229 .session_info
= gensec_ntlmssp_session_info
,
230 .have_feature
= gensec_ntlmssp_have_feature
,
232 .priority
= GENSEC_NTLMSSP
235 static const struct gensec_security_ops gensec_ntlmssp_resume_ccache_ops
= {
236 .name
= "ntlmssp_resume_ccache",
237 .client_start
= gensec_ntlmssp_resume_ccache_start
,
238 .update
= gensec_ntlmssp_update
,
239 .session_key
= gensec_ntlmssp_session_key
,
240 .have_feature
= gensec_ntlmssp_have_feature
,
242 .priority
= GENSEC_NTLMSSP
245 _PUBLIC_ NTSTATUS
gensec_ntlmssp_init(void)
249 ret
= gensec_register(&gensec_ntlmssp_security_ops
);
250 if (!NT_STATUS_IS_OK(ret
)) {
251 DEBUG(0,("Failed to register '%s' gensec backend!\n",
252 gensec_ntlmssp_security_ops
.name
));
256 ret
= gensec_register(&gensec_ntlmssp_resume_ccache_ops
);
257 if (!NT_STATUS_IS_OK(ret
)) {
258 DEBUG(0,("Failed to register '%s' gensec backend!\n",
259 gensec_ntlmssp_resume_ccache_ops
.name
));
266 static struct gensec_security
*gensec_find_child_by_ops(struct gensec_security
*gensec_security
,
267 const struct gensec_security_ops
*ops
)
269 struct gensec_security
*current
= gensec_security
;
271 while (current
!= NULL
) {
272 if (current
->ops
== ops
) {
276 current
= current
->child_security
;
282 uint32_t gensec_ntlmssp_neg_flags(struct gensec_security
*gensec_security
)
284 struct gensec_ntlmssp_context
*gensec_ntlmssp
;
286 gensec_security
= gensec_find_child_by_ops(gensec_security
,
287 &gensec_ntlmssp_security_ops
);
288 if (gensec_security
== NULL
) {
292 gensec_ntlmssp
= talloc_get_type_abort(gensec_security
->private_data
,
293 struct gensec_ntlmssp_context
);
294 return gensec_ntlmssp
->ntlmssp_state
->neg_flags
;
297 const char *gensec_ntlmssp_server_domain(struct gensec_security
*gensec_security
)
299 struct gensec_ntlmssp_context
*gensec_ntlmssp
;
301 gensec_security
= gensec_find_child_by_ops(gensec_security
,
302 &gensec_ntlmssp_security_ops
);
303 if (gensec_security
== NULL
) {
307 gensec_ntlmssp
= talloc_get_type_abort(gensec_security
->private_data
,
308 struct gensec_ntlmssp_context
);
309 return gensec_ntlmssp
->ntlmssp_state
->server
.netbios_domain
;