2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003
8 Copyright (C) Andrew Bartlett 2005 (Updated from gensec).
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "../auth/ntlmssp/ntlmssp.h"
26 #include "../auth/ntlmssp/ntlmssp_private.h"
28 static void debug_ntlmssp_flags_raw(int level
, uint32_t flags
)
30 #define _PRINT_FLAG_LINE(v) do { \
32 DEBUGADD(level, (" " #v "\n")); \
35 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_UNICODE
);
36 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_OEM
);
37 _PRINT_FLAG_LINE(NTLMSSP_REQUEST_TARGET
);
38 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_SIGN
);
39 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_SEAL
);
40 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_DATAGRAM
);
41 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_LM_KEY
);
42 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_NETWARE
);
43 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_NTLM
);
44 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_NT_ONLY
);
45 _PRINT_FLAG_LINE(NTLMSSP_ANONYMOUS
);
46 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
);
47 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED
);
48 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL
);
49 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_ALWAYS_SIGN
);
50 _PRINT_FLAG_LINE(NTLMSSP_TARGET_TYPE_DOMAIN
);
51 _PRINT_FLAG_LINE(NTLMSSP_TARGET_TYPE_SERVER
);
52 _PRINT_FLAG_LINE(NTLMSSP_TARGET_TYPE_SHARE
);
53 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
);
54 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_IDENTIFY
);
55 _PRINT_FLAG_LINE(NTLMSSP_REQUEST_NON_NT_SESSION_KEY
);
56 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_TARGET_INFO
);
57 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_VERSION
);
58 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_128
);
59 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_KEY_EXCH
);
60 _PRINT_FLAG_LINE(NTLMSSP_NEGOTIATE_56
);
64 * Print out the NTLMSSP flags for debugging
65 * @param neg_flags The flags from the packet
67 void debug_ntlmssp_flags(uint32_t neg_flags
)
69 DEBUG(3,("Got NTLMSSP neg_flags=0x%08x\n", neg_flags
));
70 debug_ntlmssp_flags_raw(4, neg_flags
);
73 NTSTATUS
ntlmssp_handle_neg_flags(struct ntlmssp_state
*ntlmssp_state
,
74 uint32_t flags
, const char *name
)
76 uint32_t missing_flags
= ntlmssp_state
->required_flags
;
78 if (flags
& NTLMSSP_NEGOTIATE_UNICODE
) {
79 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_UNICODE
;
80 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_OEM
;
81 ntlmssp_state
->unicode
= true;
83 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_UNICODE
;
84 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_OEM
;
85 ntlmssp_state
->unicode
= false;
89 * NTLMSSP_NEGOTIATE_NTLM2 (NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY)
90 * has priority over NTLMSSP_NEGOTIATE_LM_KEY
92 if (!(flags
& NTLMSSP_NEGOTIATE_NTLM2
)) {
93 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
96 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
) {
97 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_LM_KEY
;
100 if (!(flags
& NTLMSSP_NEGOTIATE_LM_KEY
)) {
101 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_LM_KEY
;
104 if (!(flags
& NTLMSSP_NEGOTIATE_ALWAYS_SIGN
)) {
105 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_ALWAYS_SIGN
;
108 if (!(flags
& NTLMSSP_NEGOTIATE_128
)) {
109 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_128
;
112 if (!(flags
& NTLMSSP_NEGOTIATE_56
)) {
113 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_56
;
116 if (!(flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
)) {
117 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_KEY_EXCH
;
120 if (!(flags
& NTLMSSP_NEGOTIATE_SIGN
)) {
121 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_SIGN
;
124 if (!(flags
& NTLMSSP_NEGOTIATE_SEAL
)) {
125 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_SEAL
;
128 if ((flags
& NTLMSSP_REQUEST_TARGET
)) {
129 ntlmssp_state
->neg_flags
|= NTLMSSP_REQUEST_TARGET
;
132 missing_flags
&= ~ntlmssp_state
->neg_flags
;
133 if (missing_flags
!= 0) {
134 HRESULT hres
= HRES_SEC_E_UNSUPPORTED_FUNCTION
;
135 NTSTATUS status
= NT_STATUS(HRES_ERROR_V(hres
));
136 DEBUG(1, ("%s: Got %s flags[0x%08x] "
137 "- possible downgrade detected! "
138 "missing_flags[0x%08x] - %s\n",
141 (unsigned)missing_flags
,
143 debug_ntlmssp_flags_raw(1, missing_flags
);
144 DEBUGADD(4, ("neg_flags[0x%08x]\n",
145 (unsigned)ntlmssp_state
->neg_flags
));
146 debug_ntlmssp_flags_raw(4, ntlmssp_state
->neg_flags
);
153 /* Does this blob looks like it could be NTLMSSP? */
154 bool ntlmssp_blob_matches_magic(const DATA_BLOB
*blob
)
156 if (blob
->length
> 8 && memcmp("NTLMSSP\0", blob
->data
, 8) == 0) {
163 const DATA_BLOB
ntlmssp_version_blob(void)
166 * This is a simplified version of
168 * enum ndr_err_code err;
169 * struct ntlmssp_VERSION vers;
172 * vers.ProductMajorVersion = NTLMSSP_WINDOWS_MAJOR_VERSION_6;
173 * vers.ProductMinorVersion = NTLMSSP_WINDOWS_MINOR_VERSION_1;
174 * vers.ProductBuild = 0;
175 * vers.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
177 * err = ndr_push_struct_blob(&version_blob,
180 * (ndr_push_flags_fn_t)ndr_push_ntlmssp_VERSION);
182 * if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
183 * data_blob_free(&struct_blob);
184 * return NT_STATUS_NO_MEMORY;
187 static const uint8_t version_buffer
[8] = {
188 NTLMSSP_WINDOWS_MAJOR_VERSION_6
,
189 NTLMSSP_WINDOWS_MINOR_VERSION_1
,
190 0x00, 0x00, /* product build */
191 0x00, 0x00, 0x00, /* reserved */
192 NTLMSSP_REVISION_W2K3
195 return data_blob_const(version_buffer
, ARRAY_SIZE(version_buffer
));