?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix for CVE-2009-2906.
[Samba.git] / source3 / libsmb / ntlm_check.c
blob9380a83ea0bd0ac076faeda3920648d79b0aa8b9
1 /*
2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Tridgell 1992-2000
5 Copyright (C) Luke Kenneth Casson Leighton 1996-2000
6 Copyright (C) Andrew Bartlett 2001-2003
7 Copyright (C) Gerald Carter 2003
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24
25 #undef DBGC_CLASS
26 #define DBGC_CLASS DBGC_AUTH
27
28 /****************************************************************************
29 Core of smb password checking routine.
30 ****************************************************************************/
31
32 static bool smb_pwd_check_ntlmv1(const DATA_BLOB *nt_response,
33 const uchar *part_passwd,
34 const DATA_BLOB *sec_blob,
35 DATA_BLOB *user_sess_key)
36 {
37 /* Finish the encryption of part_passwd. */
38 uchar p24[24];
39
40 if (part_passwd == NULL) {
41 DEBUG(10,("No password set - DISALLOWING access\n"));
42 /* No password set - always false ! */
43 return false;
44 }
45
46 if (sec_blob->length != 8) {
47 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%lu)\n",
48 (unsigned long)sec_blob->length));
49 return false;
50 }
51
52 if (nt_response->length != 24) {
53 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%lu)\n",
54 (unsigned long)nt_response->length));
55 return false;
56 }
57
58 SMBOWFencrypt(part_passwd, sec_blob->data, p24);
59 if (user_sess_key != NULL) {
60 *user_sess_key = data_blob(NULL, 16);
61 SMBsesskeygen_ntv1(part_passwd, NULL, user_sess_key->data);
62 }
63
64
65 #if DEBUG_PASSWORD
66 DEBUG(100,("Part password (P16) was |\n"));
67 dump_data(100, part_passwd, 16);
68 DEBUGADD(100,("Password from client was |\n"));
69 dump_data(100, nt_response->data, nt_response->length);
70 DEBUGADD(100,("Given challenge was |\n"));
71 dump_data(100, sec_blob->data, sec_blob->length);
72 DEBUGADD(100,("Value from encryption was |\n"));
73 dump_data(100, p24, 24);
74 #endif
75 return (memcmp(p24, nt_response->data, 24) == 0);
76 }
77
78 /****************************************************************************
79 Core of smb password checking routine. (NTLMv2, LMv2)
80 Note: The same code works with both NTLMv2 and LMv2.
81 ****************************************************************************/
82
83 static bool smb_pwd_check_ntlmv2(TALLOC_CTX *mem_ctx,
84 const DATA_BLOB *ntv2_response,
85 const uint8_t *part_passwd,
86 const DATA_BLOB *sec_blob,
87 const char *user, const char *domain,
88 bool upper_case_domain, /* should the domain be transformed into upper case? */
89 DATA_BLOB *user_sess_key)
90 {
91 /* Finish the encryption of part_passwd. */
92 uint8_t kr[16];
93 uint8_t value_from_encryption[16];
94 uint8_t client_response[16];
95 DATA_BLOB client_key_data;
96 bool res;
97
98 if (part_passwd == NULL) {
99 DEBUG(10,("No password set - DISALLOWING access\n"));
100 /* No password set - always false */
101 return false;
102 }
103
104 if (sec_blob->length != 8) {
105 DEBUG(0, ("smb_pwd_check_ntlmv2: incorrect challenge size (%lu)\n",
106 (unsigned long)sec_blob->length));
107 return false;
108 }
109
110 if (ntv2_response->length < 24) {
111 /* We MUST have more than 16 bytes, or the stuff below will go
112 crazy. No known implementation sends less than the 24 bytes
113 for LMv2, let alone NTLMv2. */
114 DEBUG(0, ("smb_pwd_check_ntlmv2: incorrect password length (%lu)\n",
115 (unsigned long)ntv2_response->length));
116 return false;
117 }
118
119 client_key_data = data_blob_talloc(mem_ctx, ntv2_response->data+16, ntv2_response->length-16);
120 /*
121 todo: should we be checking this for anything? We can't for LMv2,
122 but for NTLMv2 it is meant to contain the current time etc.
123 */
124
125 memcpy(client_response, ntv2_response->data, sizeof(client_response));
126
127 if (!ntv2_owf_gen(part_passwd, user, domain, upper_case_domain, kr)) {
128 return false;
129 }
130
131 SMBOWFencrypt_ntv2(kr, sec_blob, &client_key_data, value_from_encryption);
132 if (user_sess_key != NULL) {
133 *user_sess_key = data_blob(NULL, 16);
134 SMBsesskeygen_ntv2(kr, value_from_encryption, user_sess_key->data);
135 }
136
137 #if DEBUG_PASSWORD
138 DEBUG(100,("Part password (P16) was |\n"));
139 dump_data(100, part_passwd, 16);
140 DEBUGADD(100,("Password from client was |\n"));
141 dump_data(100, ntv2_response->data, ntv2_response->length);
142 DEBUGADD(100,("Variable data from client was |\n"));
143 dump_data(100, client_key_data.data, client_key_data.length);
144 DEBUGADD(100,("Given challenge was |\n"));
145 dump_data(100, sec_blob->data, sec_blob->length);
146 DEBUGADD(100,("Value from encryption was |\n"));
147 dump_data(100, value_from_encryption, 16);
148 #endif
149 data_blob_clear_free(&client_key_data);
150 res = (memcmp(value_from_encryption, client_response, 16) == 0);
151 if ((!res) && (user_sess_key != NULL))
152 data_blob_clear_free(user_sess_key);
153 return res;
154 }
155
156 /**
157 * Check a challenge-response password against the value of the NT or
158 * LM password hash.
159 *
160 * @param mem_ctx talloc context
161 * @param challenge 8-byte challenge. If all zero, forces plaintext comparison
162 * @param nt_response 'unicode' NT response to the challenge, or unicode password
163 * @param lm_response ASCII or LANMAN response to the challenge, or password in DOS code page
164 * @param username internal Samba username, for log messages
165 * @param client_username username the client used
166 * @param client_domain domain name the client used (may be mapped)
167 * @param nt_pw MD4 unicode password from our passdb or similar
168 * @param lm_pw LANMAN ASCII password from our passdb or similar
169 * @param user_sess_key User session key
170 * @param lm_sess_key LM session key (first 8 bytes of the LM hash)
171 */
172
173 NTSTATUS ntlm_password_check(TALLOC_CTX *mem_ctx,
174 const DATA_BLOB *challenge,
175 const DATA_BLOB *lm_response,
176 const DATA_BLOB *nt_response,
177 const DATA_BLOB *lm_interactive_pwd,
178 const DATA_BLOB *nt_interactive_pwd,
179 const char *username,
180 const char *client_username,
181 const char *client_domain,
182 const uint8_t *lm_pw, const uint8_t *nt_pw,
183 DATA_BLOB *user_sess_key,
184 DATA_BLOB *lm_sess_key)
185 {
186 unsigned char zeros[8];
187
188 ZERO_STRUCT(zeros);
189
190 if (nt_pw == NULL) {
191 DEBUG(3,("ntlm_password_check: NO NT password stored for user %s.\n",
192 username));
193 }
194
195 if (nt_interactive_pwd && nt_interactive_pwd->length && nt_pw) {
196 if (nt_interactive_pwd->length != 16) {
197 DEBUG(3,("ntlm_password_check: Interactive logon: Invalid NT password length (%d) supplied for user %s\n", (int)nt_interactive_pwd->length,
198 username));
199 return NT_STATUS_WRONG_PASSWORD;
200 }
201
202 if (memcmp(nt_interactive_pwd->data, nt_pw, 16) == 0) {
203 if (user_sess_key) {
204 *user_sess_key = data_blob(NULL, 16);
205 SMBsesskeygen_ntv1(nt_pw, NULL, user_sess_key->data);
206 }
207 return NT_STATUS_OK;
208 } else {
209 DEBUG(3,("ntlm_password_check: Interactive logon: NT password check failed for user %s\n",
210 username));
211 return NT_STATUS_WRONG_PASSWORD;
212 }
213
214 } else if (lm_interactive_pwd && lm_interactive_pwd->length && lm_pw) {
215 if (lm_interactive_pwd->length != 16) {
216 DEBUG(3,("ntlm_password_check: Interactive logon: Invalid LANMAN password length (%d) supplied for user %s\n", (int)lm_interactive_pwd->length,
217 username));
218 return NT_STATUS_WRONG_PASSWORD;
219 }
220
221 if (!lp_lanman_auth()) {
222 DEBUG(3,("ntlm_password_check: Interactive logon: only LANMAN password supplied for user %s, and LM passwords are disabled!\n",
223 username));
224 return NT_STATUS_WRONG_PASSWORD;
225 }
226
227 if (memcmp(lm_interactive_pwd->data, lm_pw, 16) == 0) {
228 return NT_STATUS_OK;
229 } else {
230 DEBUG(3,("ntlm_password_check: Interactive logon: LANMAN password check failed for user %s\n",
231 username));
232 return NT_STATUS_WRONG_PASSWORD;
233 }
234 }
235
236 /* Check for cleartext netlogon. Used by Exchange 5.5. */
237 if (challenge->length == sizeof(zeros) &&
238 (memcmp(challenge->data, zeros, challenge->length) == 0 )) {
239
240 DEBUG(4,("ntlm_password_check: checking plaintext passwords for user %s\n",
241 username));
242 if (nt_pw && nt_response->length) {
243 unsigned char pwhash[16];
244 mdfour(pwhash, nt_response->data, nt_response->length);
245 if (memcmp(pwhash, nt_pw, sizeof(pwhash)) == 0) {
246 return NT_STATUS_OK;
247 } else {
248 DEBUG(3,("ntlm_password_check: NT (Unicode) plaintext password check failed for user %s\n",
249 username));
250 return NT_STATUS_WRONG_PASSWORD;
251 }
252
253 } else if (!lp_lanman_auth()) {
254 DEBUG(3,("ntlm_password_check: (plaintext password check) LANMAN passwords NOT PERMITTED for user %s\n",
255 username));
256
257 } else if (lm_pw && lm_response->length) {
258 uchar dospwd[14];
259 uchar p16[16];
260 ZERO_STRUCT(dospwd);
261
262 memcpy(dospwd, lm_response->data, MIN(lm_response->length, sizeof(dospwd)));
263 /* Only the fisrt 14 chars are considered, password need not be null terminated. */
264
265 /* we *might* need to upper-case the string here */
266 E_P16((const unsigned char *)dospwd, p16);
267
268 if (memcmp(p16, lm_pw, sizeof(p16)) == 0) {
269 return NT_STATUS_OK;
270 } else {
271 DEBUG(3,("ntlm_password_check: LANMAN (ASCII) plaintext password check failed for user %s\n",
272 username));
273 return NT_STATUS_WRONG_PASSWORD;
274 }
275 } else {
276 DEBUG(3, ("Plaintext authentication for user %s attempted, but neither NT nor LM passwords available\n", username));
277 return NT_STATUS_WRONG_PASSWORD;
278 }
279 }
280
281 if (nt_response->length != 0 && nt_response->length < 24) {
282 DEBUG(2,("ntlm_password_check: invalid NT password length (%lu) for user %s\n",
283 (unsigned long)nt_response->length, username));
284 }
285
286 if (nt_response->length >= 24 && nt_pw) {
287 if (nt_response->length > 24) {
288 /* We have the NT MD4 hash challenge available - see if we can
289 use it
290 */
291 DEBUG(4,("ntlm_password_check: Checking NTLMv2 password with domain [%s]\n", client_domain));
292 if (smb_pwd_check_ntlmv2(mem_ctx,
293 nt_response,
294 nt_pw, challenge,
295 client_username,
296 client_domain,
297 False,
298 user_sess_key)) {
299 return NT_STATUS_OK;
300 }
301
302 DEBUG(4,("ntlm_password_check: Checking NTLMv2 password with uppercased version of domain [%s]\n", client_domain));
303 if (smb_pwd_check_ntlmv2(mem_ctx,
304 nt_response,
305 nt_pw, challenge,
306 client_username,
307 client_domain,
308 true,
309 user_sess_key)) {
310 return NT_STATUS_OK;
311 }
312
313 DEBUG(4,("ntlm_password_check: Checking NTLMv2 password without a domain\n"));
314 if (smb_pwd_check_ntlmv2(mem_ctx,
315 nt_response,
316 nt_pw, challenge,
317 client_username,
318 "",
319 False,
320 user_sess_key)) {
321 return NT_STATUS_OK;
322 } else {
323 DEBUG(3,("ntlm_password_check: NTLMv2 password check failed\n"));
324 return NT_STATUS_WRONG_PASSWORD;
325 }
326 }
327
328 if (lp_ntlm_auth()) {
329 /* We have the NT MD4 hash challenge available - see if we can
330 use it (ie. does it exist in the smbpasswd file).
331 */
332 DEBUG(4,("ntlm_password_check: Checking NT MD4 password\n"));
333 if (smb_pwd_check_ntlmv1(nt_response,
334 nt_pw, challenge,
335 user_sess_key)) {
336 /* The LM session key for this response is not very secure,
337 so use it only if we otherwise allow LM authentication */
338
339 if (lp_lanman_auth() && lm_pw) {
340 uint8_t first_8_lm_hash[16];
341 memcpy(first_8_lm_hash, lm_pw, 8);
342 memset(first_8_lm_hash + 8, '\0', 8);
343 if (lm_sess_key) {
344 *lm_sess_key = data_blob(first_8_lm_hash, 16);
345 }
346 }
347 return NT_STATUS_OK;
348 } else {
349 DEBUG(3,("ntlm_password_check: NT MD4 password check failed for user %s\n",
350 username));
351 return NT_STATUS_WRONG_PASSWORD;
352 }
353 } else {
354 DEBUG(2,("ntlm_password_check: NTLMv1 passwords NOT PERMITTED for user %s\n",
355 username));
356 /* no return, becouse we might pick up LMv2 in the LM field */
357 }
358 }
359
360 if (lm_response->length == 0) {
361 DEBUG(3,("ntlm_password_check: NEITHER LanMan nor NT password supplied for user %s\n",
362 username));
363 return NT_STATUS_WRONG_PASSWORD;
364 }
365
366 if (lm_response->length < 24) {
367 DEBUG(2,("ntlm_password_check: invalid LanMan password length (%lu) for user %s\n",
368 (unsigned long)nt_response->length, username));
369 return NT_STATUS_WRONG_PASSWORD;
370 }
371
372 if (!lp_lanman_auth()) {
373 DEBUG(3,("ntlm_password_check: Lanman passwords NOT PERMITTED for user %s\n",
374 username));
375 } else if (!lm_pw) {
376 DEBUG(3,("ntlm_password_check: NO LanMan password set for user %s (and no NT password supplied)\n",
377 username));
378 } else {
379 DEBUG(4,("ntlm_password_check: Checking LM password\n"));
380 if (smb_pwd_check_ntlmv1(lm_response,
381 lm_pw, challenge,
382 NULL)) {
383 uint8_t first_8_lm_hash[16];
384 memcpy(first_8_lm_hash, lm_pw, 8);
385 memset(first_8_lm_hash + 8, '\0', 8);
386 if (user_sess_key) {
387 *user_sess_key = data_blob(first_8_lm_hash, 16);
388 }
389
390 if (lm_sess_key) {
391 *lm_sess_key = data_blob(first_8_lm_hash, 16);
392 }
393 return NT_STATUS_OK;
394 }
395 }
396
397 if (!nt_pw) {
398 DEBUG(4,("ntlm_password_check: LM password check failed for user, no NT password %s\n",username));
399 return NT_STATUS_WRONG_PASSWORD;
400 }
401
402 /* This is for 'LMv2' authentication. almost NTLMv2 but limited to 24 bytes.
403 - related to Win9X, legacy NAS pass-though authentication
404 */
405 DEBUG(4,("ntlm_password_check: Checking LMv2 password with domain %s\n", client_domain));
406 if (smb_pwd_check_ntlmv2(mem_ctx,
407 lm_response,
408 nt_pw, challenge,
409 client_username,
410 client_domain,
411 false,
412 NULL)) {
413 return NT_STATUS_OK;
414 }
415
416 DEBUG(4,("ntlm_password_check: Checking LMv2 password with upper-cased version of domain %s\n", client_domain));
417 if (smb_pwd_check_ntlmv2(mem_ctx,
418 lm_response,
419 nt_pw, challenge,
420 client_username,
421 client_domain,
422 true,
423 NULL)) {
424 return NT_STATUS_OK;
425 }
426
427 DEBUG(4,("ntlm_password_check: Checking LMv2 password without a domain\n"));
428 if (smb_pwd_check_ntlmv2(mem_ctx,
429 lm_response,
430 nt_pw, challenge,
431 client_username,
432 "",
433 false,
434 NULL)) {
435 return NT_STATUS_OK;
436 }
437
438 /* Apparently NT accepts NT responses in the LM field
439 - I think this is related to Win9X pass-though authentication
440 */
441 DEBUG(4,("ntlm_password_check: Checking NT MD4 password in LM field\n"));
442 if (lp_ntlm_auth()) {
443 if (smb_pwd_check_ntlmv1(lm_response,
444 nt_pw, challenge,
445 NULL)) {
446 /* The session key for this response is still very odd.
447 It not very secure, so use it only if we otherwise
448 allow LM authentication */
449
450 if (lp_lanman_auth() && lm_pw) {
451 uint8_t first_8_lm_hash[16];
452 memcpy(first_8_lm_hash, lm_pw, 8);
453 memset(first_8_lm_hash + 8, '\0', 8);
454 if (user_sess_key) {
455 *user_sess_key = data_blob(first_8_lm_hash, 16);
456 }
457
458 if (lm_sess_key) {
459 *lm_sess_key = data_blob(first_8_lm_hash, 16);
460 }
461 }
462 return NT_STATUS_OK;
463 }
464 DEBUG(3,("ntlm_password_check: LM password, NT MD4 password in LM field and LMv2 failed for user %s\n",username));
465 } else {
466 DEBUG(3,("ntlm_password_check: LM password and LMv2 failed for user %s, and NT MD4 password in LM field not permitted\n",username));
467 }
468 return NT_STATUS_WRONG_PASSWORD;
469 }
470
Samba GIT mirror