2 Unix SMB/Netbios implementation.
4 SMB parameters and setup
5 Copyright (C) Andrew Tridgell 1992-1998
6 Modified by Jeremy Allison 1995.
7 Copyright (C) Jeremy Allison 1995-2000.
8 Copyright (C) Luke Kennethc Casson Leighton 1996-2000.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "byteorder.h"
29 This implements the X/Open SMB password encryption
30 It takes a password, a 8 byte "crypt key" and puts 24 bytes of
31 encrypted password into p24 */
32 void SMBencrypt(const uchar
*passwd
, const uchar
*c8
, uchar
*p24
)
34 uchar p14
[15], p21
[21];
38 StrnCpy((char *)p14
,(const char *)passwd
,14);
40 strupper((char *)p14
);
43 SMBOWFencrypt(p21
, c8
, p24
);
46 DEBUG(100,("SMBencrypt: lm#, challenge, response\n"));
47 dump_data(100, (char *)p21
, 16);
48 dump_data(100, (const char *)c8
, 8);
49 dump_data(100, (char *)p24
, 24);
54 * Creates the MD4 Hash of the users password in NT UNICODE.
57 void E_md4hash(const uchar
*passwd
, uchar
*p16
)
62 /* Password cannot be longer than 128 characters */
63 len
= strlen((const char *)passwd
);
66 /* Password must be converted to NT unicode - null terminated. */
67 push_ucs2(NULL
, wpwd
, (const char *)passwd
, 256, STR_UNICODE
|STR_NOALIGN
|STR_TERMINATE
);
68 /* Calculate length in bytes */
69 len
= strlen_w(wpwd
) * sizeof(int16
);
71 mdfour(p16
, (unsigned char *)wpwd
, len
);
74 /* Does both the NT and LM owfs of a user's password */
75 void nt_lm_owf_gen(const char *pwd
, uchar nt_p16
[16], uchar p16
[16])
79 memset(passwd
,'\0',514);
80 safe_strcpy( passwd
, pwd
, sizeof(passwd
)-1);
82 /* Calculate the MD4 hash (NT compatible) of the password */
83 memset(nt_p16
, '\0', 16);
84 E_md4hash((uchar
*)passwd
, nt_p16
);
87 DEBUG(100,("nt_lm_owf_gen: pwd, nt#\n"));
88 dump_data(120, passwd
, strlen(passwd
));
89 dump_data(100, (char *)nt_p16
, 16);
92 /* Mangle the passwords into Lanman format */
96 /* Calculate the SMB (lanman) hash functions of the password */
98 memset(p16
, '\0', 16);
99 E_P16((uchar
*) passwd
, (uchar
*)p16
);
101 #ifdef DEBUG_PASSWORD
102 DEBUG(100,("nt_lm_owf_gen: pwd, lm#\n"));
103 dump_data(120, passwd
, strlen(passwd
));
104 dump_data(100, (char *)p16
, 16);
106 /* clear out local copy of user's password (just being paranoid). */
107 memset(passwd
, '\0', sizeof(passwd
));
110 /* Does both the NTLMv2 owfs of a user's password */
111 void ntv2_owf_gen(const uchar owf
[16],
112 const char *user_n
, const char *domain_n
, uchar kr_buf
[16])
118 int user_l
= strlen(user_n
);
119 int domain_l
= strlen(domain_n
);
121 push_ucs2(NULL
, user_u
, user_n
, (user_l
+1)*2, STR_UNICODE
|STR_NOALIGN
|STR_TERMINATE
|STR_UPPER
);
122 push_ucs2(NULL
, dom_u
, domain_n
, (domain_l
+1)*2, STR_UNICODE
|STR_NOALIGN
|STR_TERMINATE
|STR_UPPER
);
124 hmac_md5_init_limK_to_64(owf
, 16, &ctx
);
125 hmac_md5_update((const unsigned char *)user_u
, user_l
* 2, &ctx
);
126 hmac_md5_update((const unsigned char *)dom_u
, domain_l
* 2, &ctx
);
127 hmac_md5_final(kr_buf
, &ctx
);
129 #ifdef DEBUG_PASSWORD
130 DEBUG(100, ("ntv2_owf_gen: user, domain, owfkey, kr\n"));
131 dump_data(100, user_u
, user_l
* 2);
132 dump_data(100, dom_u
, domain_l
* 2);
133 dump_data(100, owf
, 16);
134 dump_data(100, kr_buf
, 16);
138 /* Does the des encryption from the NT or LM MD4 hash. */
139 void SMBOWFencrypt(const uchar passwd
[16], const uchar
*c8
, uchar p24
[24])
145 memcpy(p21
, passwd
, 16);
149 /* Does the des encryption from the FIRST 8 BYTES of the NT or LM MD4 hash. */
150 void NTLMSSPOWFencrypt(const uchar passwd
[8], const uchar
*ntlmchalresp
, uchar p24
[24])
155 memcpy(p21
, passwd
, 8);
156 memset(p21
+ 8, 0xbd, 8);
158 E_P24(p21
, ntlmchalresp
, p24
);
159 #ifdef DEBUG_PASSWORD
160 DEBUG(100,("NTLMSSPOWFencrypt: p21, c8, p24\n"));
161 dump_data(100, (char *)p21
, 21);
162 dump_data(100, (const char *)ntlmchalresp
, 8);
163 dump_data(100, (char *)p24
, 24);
168 /* Does the NT MD4 hash then des encryption. */
170 void SMBNTencrypt(const uchar
*passwd
, uchar
*c8
, uchar
*p24
)
176 E_md4hash(passwd
, p21
);
177 SMBOWFencrypt(p21
, c8
, p24
);
179 #ifdef DEBUG_PASSWORD
180 DEBUG(100,("SMBNTencrypt: nt#, challenge, response\n"));
181 dump_data(100, (char *)p21
, 16);
182 dump_data(100, (char *)c8
, 8);
183 dump_data(100, (char *)p24
, 24);
187 BOOL
make_oem_passwd_hash(char data
[516], const char *passwd
, uchar old_pw_hash
[16], BOOL unicode
)
189 int new_pw_len
= strlen(passwd
) * (unicode
? 2 : 1);
191 if (new_pw_len
> 512)
193 DEBUG(0,("make_oem_passwd_hash: new password is too long.\n"));
198 * Now setup the data area.
199 * We need to generate a random fill
200 * for this area to make it harder to
203 generate_random_buffer((unsigned char *)data
, 516, False
);
204 push_string(NULL
, &data
[512 - new_pw_len
], passwd
, new_pw_len
,
205 STR_NOALIGN
| (unicode
?STR_UNICODE
:STR_ASCII
));
206 SIVAL(data
, 512, new_pw_len
);
208 #ifdef DEBUG_PASSWORD
209 DEBUG(100,("make_oem_passwd_hash\n"));
210 dump_data(100, data
, 516);
212 SamOEMhash( (unsigned char *)data
, (unsigned char *)old_pw_hash
, 516);
217 /* Does the md5 encryption from the NT hash for NTLMv2. */
218 void SMBOWFencrypt_ntv2(const uchar kr
[16],
219 const DATA_BLOB srv_chal
,
220 const DATA_BLOB cli_chal
,
225 hmac_md5_init_limK_to_64(kr
, 16, &ctx
);
226 hmac_md5_update(srv_chal
.data
, srv_chal
.length
, &ctx
);
227 hmac_md5_update(cli_chal
.data
, cli_chal
.length
, &ctx
);
228 hmac_md5_final((unsigned char *)resp_buf
, &ctx
);
230 #ifdef DEBUG_PASSWORD
231 DEBUG(100, ("SMBOWFencrypt_ntv2: srv_chal, cli_chal, resp_buf\n"));
232 dump_data(100, srv_chal
.data
, srv_chal
.length
);
233 dump_data(100, cli_chal
.data
, cli_chal
.length
);
234 dump_data(100, resp_buf
, 16);
238 void SMBsesskeygen_ntv2(const uchar kr
[16],
239 const uchar
* nt_resp
, uint8 sess_key
[16])
243 hmac_md5_init_limK_to_64(kr
, 16, &ctx
);
244 hmac_md5_update(nt_resp
, 16, &ctx
);
245 hmac_md5_final((unsigned char *)sess_key
, &ctx
);
247 #ifdef DEBUG_PASSWORD
248 DEBUG(100, ("SMBsesskeygen_ntv2:\n"));
249 dump_data(100, sess_key
, 16);
253 void SMBsesskeygen_ntv1(const uchar kr
[16],
254 const uchar
* nt_resp
, uint8 sess_key
[16])
256 mdfour((unsigned char *)sess_key
, kr
, 16);
258 #ifdef DEBUG_PASSWORD
259 DEBUG(100, ("SMBsesskeygen_ntv1:\n"));
260 dump_data(100, sess_key
, 16);
264 /***********************************************************
265 encode a password buffer. The caller gets to figure out
267 ************************************************************/
268 BOOL
encode_pw_buffer(char buffer
[516], char *new_pw
, int new_pw_length
)
270 generate_random_buffer((unsigned char *)buffer
, 516, True
);
272 memcpy(&buffer
[512 - new_pw_length
], new_pw
, new_pw_length
);
275 * The length of the new password is in the last 4 bytes of
278 SIVAL(buffer
, 512, new_pw_length
);
283 /***********************************************************
284 decode a password buffer
285 *new_pw_len is the length in bytes of the possibly mulitbyte
286 returned password including termination.
287 ************************************************************/
288 BOOL
decode_pw_buffer(char in_buffer
[516], char *new_pwrd
,
289 int new_pwrd_size
, uint32
*new_pw_len
)
294 Warning !!! : This function is called from some rpc call.
295 The password IN the buffer is a UNICODE string.
296 The password IN new_pwrd is an ASCII string
297 If you reuse that code somewhere else check first.
300 /* The length of the new password is in the last 4 bytes of the data buffer. */
302 byte_len
= IVAL(in_buffer
, 512);
304 #ifdef DEBUG_PASSWORD
305 dump_data(100, in_buffer
, 516);
308 /* Password cannot be longer than 128 characters */
309 if ( (byte_len
< 0) || (byte_len
> new_pwrd_size
- 1)) {
310 DEBUG(0, ("decode_pw_buffer: incorrect password length (%d).\n", byte_len
));
311 DEBUG(0, ("decode_pw_buffer: check that 'encrypt passwords = yes'\n"));
315 /* decode into the return buffer. Buffer must be a pstring */
316 *new_pw_len
= pull_string(NULL
, new_pwrd
, &in_buffer
[512 - byte_len
], new_pwrd_size
, byte_len
, STR_UNICODE
);
318 #ifdef DEBUG_PASSWORD
319 DEBUG(100,("decode_pw_buffer: new_pwrd: "));
320 dump_data(100, (char *)new_pwrd
, *new_pw_len
);
321 DEBUG(100,("multibyte len:%d\n", *new_pw_len
));
322 DEBUG(100,("original char len:%d\n", byte_len
/2));
329 /* Calculate the NT owfs of a user's password */
330 void nt_owf_genW(const UNISTR2
*pwd
, uchar nt_p16
[16])
335 for (i
= 0; i
< MIN(pwd
->uni_str_len
, sizeof(buf
) / 2); i
++)
337 SIVAL(buf
, i
* 2, pwd
->buffer
[i
]);
339 /* Calculate the MD4 hash (NT compatible) of the password */
340 mdfour(nt_p16
, (const unsigned char *)buf
, pwd
->uni_str_len
* 2);
342 /* clear out local copy of user's password (just being paranoid). */