source3/auth/auth_compat.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Password and authentication handling
   4    Copyright (C) Andrew Bartlett         2001-2002
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "auth.h"
  22
  23 extern struct auth_context *negprot_global_auth_context;
  24 extern bool global_encrypted_passwords_negotiated;
  25
  26 #undef DBGC_CLASS
  27 #define DBGC_CLASS DBGC_AUTH
  28
  29 /****************************************************************************
  30  COMPATIBILITY INTERFACES:
  31  ***************************************************************************/
  32
  33 /****************************************************************************
  34 check if a username/password is OK assuming the password is in plaintext
  35 return True if the password is correct, False otherwise
  36 ****************************************************************************/
  37
  38 NTSTATUS check_plaintext_password(const char *smb_name,
  39                                   DATA_BLOB plaintext_blob,
  40                                   struct auth_serversupplied_info **server_info)
  41 {
  42         struct auth_context *plaintext_auth_context = NULL;
  43         struct auth_usersupplied_info *user_info = NULL;
  44         uint8_t chal[8];
  45         NTSTATUS nt_status;
  46
  47         nt_status = make_auth_context_subsystem(talloc_tos(),
  48                                                 &plaintext_auth_context);
  49         if (!NT_STATUS_IS_OK(nt_status)) {
  50                 return nt_status;
  51         }
  52
  53         plaintext_auth_context->get_ntlm_challenge(plaintext_auth_context,
  54                                                    chal);
  55
  56         if (!make_user_info_for_reply(&user_info,
  57                                       smb_name, lp_workgroup(), chal,
  58                                       plaintext_blob)) {
  59                 return NT_STATUS_NO_MEMORY;
  60         }
  61
  62         nt_status = plaintext_auth_context->check_ntlm_password(plaintext_auth_context,
  63                                                                 user_info, server_info);
  64
  65         TALLOC_FREE(plaintext_auth_context);
  66         free_user_info(&user_info);
  67         return nt_status;
  68 }
  69
  70 static NTSTATUS pass_check_smb(struct auth_context *actx,
  71                                const char *smb_name,
  72                                const char *domain,
  73                                DATA_BLOB lm_pwd,
  74                                DATA_BLOB nt_pwd)
  75
  76 {
  77         NTSTATUS nt_status;
  78         struct auth_serversupplied_info *server_info = NULL;
  79         struct auth_usersupplied_info *user_info = NULL;
  80         if (actx == NULL) {
  81                 return NT_STATUS_INTERNAL_ERROR;
  82         }
  83         make_user_info_for_reply_enc(&user_info, smb_name,
  84                                      domain,
  85                                      lm_pwd,
  86                                      nt_pwd);
  87         nt_status = actx->check_ntlm_password(actx, user_info, &server_info);
  88         free_user_info(&user_info);
  89         TALLOC_FREE(server_info);
  90         return nt_status;
  91 }
  92
  93 /****************************************************************************
  94 check if a username/password pair is ok via the auth subsystem.
  95 return True if the password is correct, False otherwise
  96 ****************************************************************************/
  97
  98 bool password_ok(struct auth_context *actx, bool global_encrypted,
  99                  const char *session_workgroup,
 100                  const char *smb_name, DATA_BLOB password_blob)
 101 {
 102
 103         DATA_BLOB null_password = data_blob_null;
 104         bool encrypted = (global_encrypted && (password_blob.length == 24 || password_blob.length > 46));
 105
 106         if (encrypted) {
 107                 /*
 108                  * The password could be either NTLM or plain LM.  Try NTLM first,
 109                  * but fall-through as required.
 110                  * Vista sends NTLMv2 here - we need to try the client given workgroup.
 111                  */
 112                 if (session_workgroup) {
 113                         if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, session_workgroup, null_password, password_blob))) {
 114                                 return True;
 115                         }
 116                         if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, session_workgroup, password_blob, null_password))) {
 117                                 return True;
 118                         }
 119                 }
 120
 121                 if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, lp_workgroup(), null_password, password_blob))) {
 122                         return True;
 123                 }
 124
 125                 if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, lp_workgroup(), password_blob, null_password))) {
 126                         return True;
 127                 }
 128         } else {
 129                 struct auth_serversupplied_info *server_info = NULL;
 130                 NTSTATUS nt_status = check_plaintext_password(smb_name, password_blob, &server_info);
 131                 TALLOC_FREE(server_info);
 132                 if (NT_STATUS_IS_OK(nt_status)) {
 133                         return True;
 134                 }
 135         }
 136
 137         return False;
 138 }