2 Unix SMB/CIFS implementation.
4 Winbind status program.
6 Copyright (C) Tim Potter 2000-2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
8 Copyright (C) Francesco Chemolli <kinkie@kame.usr.dsi.unimi.it> 2000
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "utils/ntlm_auth.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "nsswitch/winbind_client.h"
30 #define DBGC_CLASS DBGC_WINBIND
41 Authenticate a user with a challenge/response, checking session key
42 and valid authentication types
46 * Test the normal 'LM and NTLM' combination
49 static bool test_lm_ntlm_broken(enum ntlm_break break_which
,
50 bool lanman_support_expected
)
55 DATA_BLOB lm_response
= data_blob(NULL
, 24);
56 DATA_BLOB nt_response
= data_blob(NULL
, 24);
57 DATA_BLOB session_key
= data_blob(NULL
, 16);
58 uint8_t authoritative
= 1;
60 uchar user_session_key
[16];
63 DATA_BLOB chall
= get_challenge();
67 ZERO_STRUCT(user_session_key
);
69 flags
|= WBFLAG_PAM_LMKEY
;
70 flags
|= WBFLAG_PAM_USER_SESSION_KEY
;
72 SMBencrypt(opt_password
,chall
.data
,lm_response
.data
);
73 E_deshash(opt_password
, lm_hash
);
75 SMBNTencrypt(opt_password
,chall
.data
,nt_response
.data
);
77 E_md4hash(opt_password
, nt_hash
);
78 SMBsesskeygen_ntv1(nt_hash
, session_key
.data
);
80 switch (break_which
) {
84 lm_response
.data
[0]++;
87 nt_response
.data
[0]++;
90 data_blob_free(&lm_response
);
93 data_blob_free(&nt_response
);
97 nt_status
= contact_winbind_auth_crap(opt_username
, opt_domain
,
106 &error_string
, NULL
);
108 data_blob_free(&lm_response
);
110 if (!NT_STATUS_IS_OK(nt_status
)) {
111 d_printf("%s (0x%x)\n",
113 NT_STATUS_V(nt_status
));
114 SAFE_FREE(error_string
);
115 return break_which
== BREAK_NT
;
118 /* If we are told the DC is Samba4, expect an LM key of zeros */
119 if (!lanman_support_expected
) {
120 if (!all_zero(lm_key
,
122 DEBUG(1, ("LM Key does not match expectations!\n"));
123 DEBUG(1, ("lm_key:\n"));
124 dump_data(1, lm_key
, 8);
125 DEBUG(1, ("expected: all zeros\n"));
129 if (memcmp(lm_hash
, lm_key
,
130 sizeof(lm_key
)) != 0) {
131 DEBUG(1, ("LM Key does not match expectations!\n"));
132 DEBUG(1, ("lm_key:\n"));
133 dump_data(1, lm_key
, 8);
134 DEBUG(1, ("expected:\n"));
135 dump_data(1, lm_hash
, 8);
140 if (break_which
== NO_NT
) {
141 if (memcmp(lm_hash
, user_session_key
,
143 DEBUG(1, ("NT Session Key does not match expectations (should be LM hash)!\n"));
144 DEBUG(1, ("user_session_key:\n"));
145 dump_data(1, user_session_key
, sizeof(user_session_key
));
146 DEBUG(1, ("expected:\n"));
147 dump_data(1, lm_hash
, sizeof(lm_hash
));
151 if (memcmp(session_key
.data
, user_session_key
,
152 sizeof(user_session_key
)) != 0) {
153 DEBUG(1, ("NT Session Key does not match expectations!\n"));
154 DEBUG(1, ("user_session_key:\n"));
155 dump_data(1, user_session_key
, 16);
156 DEBUG(1, ("expected:\n"));
157 dump_data(1, session_key
.data
, session_key
.length
);
165 * Test LM authentication, no NT response supplied
168 static bool test_lm(bool lanman_support_expected
)
171 return test_lm_ntlm_broken(NO_NT
, lanman_support_expected
);
175 * Test the NTLM response only, no LM.
178 static bool test_ntlm(bool lanman_support_expected
)
180 return test_lm_ntlm_broken(NO_LM
, lanman_support_expected
);
184 * Test the NTLM response only, but in the LM field.
187 static bool test_ntlm_in_lm(bool lanman_support_expected
)
192 DATA_BLOB nt_response
= data_blob(NULL
, 24);
193 uint8_t authoritative
= 1;
196 uchar user_session_key
[16];
197 DATA_BLOB chall
= get_challenge();
200 ZERO_STRUCT(user_session_key
);
202 flags
|= WBFLAG_PAM_LMKEY
;
203 flags
|= WBFLAG_PAM_USER_SESSION_KEY
;
205 SMBNTencrypt(opt_password
,chall
.data
,nt_response
.data
);
207 E_deshash(opt_password
, lm_hash
);
209 nt_status
= contact_winbind_auth_crap(opt_username
, opt_domain
,
218 &error_string
, NULL
);
220 data_blob_free(&nt_response
);
222 if (!NT_STATUS_IS_OK(nt_status
)) {
223 d_printf("%s (0x%x)\n",
225 NT_STATUS_V(nt_status
));
226 SAFE_FREE(error_string
);
230 /* If we are told the DC is Samba4, expect an LM key of zeros */
231 if (!lanman_support_expected
) {
232 if (!all_zero(lm_key
,
234 DEBUG(1, ("LM Key does not match expectations!\n"));
235 DEBUG(1, ("lm_key:\n"));
236 dump_data(1, lm_key
, 8);
237 DEBUG(1, ("expected: all zeros\n"));
240 if (!all_zero(user_session_key
,
241 sizeof(user_session_key
))) {
242 DEBUG(1, ("Session Key (normally first 8 lm hash) does not match expectations!\n"));
243 DEBUG(1, ("user_session_key:\n"));
244 dump_data(1, user_session_key
, 16);
245 DEBUG(1, ("expected all zeros:\n"));
249 if (memcmp(lm_hash
, lm_key
,
250 sizeof(lm_key
)) != 0) {
251 DEBUG(1, ("LM Key does not match expectations!\n"));
252 DEBUG(1, ("lm_key:\n"));
253 dump_data(1, lm_key
, 8);
254 DEBUG(1, ("expected:\n"));
255 dump_data(1, lm_hash
, 8);
258 if (memcmp(lm_hash
, user_session_key
, 8) != 0) {
259 DEBUG(1, ("Session Key (first 8 lm hash) does not match expectations!\n"));
260 DEBUG(1, ("user_session_key:\n"));
261 dump_data(1, user_session_key
, 16);
262 DEBUG(1, ("expected:\n"));
263 dump_data(1, lm_hash
, 8);
271 * Test the NTLM response only, but in the both the NT and LM fields.
274 static bool test_ntlm_in_both(bool lanman_support_expected
)
279 DATA_BLOB nt_response
= data_blob(NULL
, 24);
280 DATA_BLOB session_key
= data_blob(NULL
, 16);
281 uint8_t authoritative
= 1;
284 uint8_t user_session_key
[16];
286 DATA_BLOB chall
= get_challenge();
290 ZERO_STRUCT(user_session_key
);
292 flags
|= WBFLAG_PAM_LMKEY
;
293 flags
|= WBFLAG_PAM_USER_SESSION_KEY
;
295 SMBNTencrypt(opt_password
,chall
.data
,nt_response
.data
);
296 E_md4hash(opt_password
, nt_hash
);
297 SMBsesskeygen_ntv1(nt_hash
, session_key
.data
);
299 E_deshash(opt_password
, lm_hash
);
301 nt_status
= contact_winbind_auth_crap(opt_username
, opt_domain
,
310 &error_string
, NULL
);
312 data_blob_free(&nt_response
);
314 if (!NT_STATUS_IS_OK(nt_status
)) {
315 d_printf("%s (0x%x)\n",
317 NT_STATUS_V(nt_status
));
318 SAFE_FREE(error_string
);
322 /* If we are told the DC is Samba4, expect an LM key of zeros */
323 if (!lanman_support_expected
) {
324 if (!all_zero(lm_key
,
326 DEBUG(1, ("LM Key does not match expectations!\n"));
327 DEBUG(1, ("lm_key:\n"));
328 dump_data(1, lm_key
, 8);
329 DEBUG(1, ("expected: all zeros\n"));
333 if (memcmp(lm_hash
, lm_key
,
334 sizeof(lm_key
)) != 0) {
335 DEBUG(1, ("LM Key does not match expectations!\n"));
336 DEBUG(1, ("lm_key:\n"));
337 dump_data(1, lm_key
, 8);
338 DEBUG(1, ("expected:\n"));
339 dump_data(1, lm_hash
, 8);
343 if (memcmp(session_key
.data
, user_session_key
,
344 sizeof(user_session_key
)) != 0) {
345 DEBUG(1, ("NT Session Key does not match expectations!\n"));
346 DEBUG(1, ("user_session_key:\n"));
347 dump_data(1, user_session_key
, 16);
348 DEBUG(1, ("expected:\n"));
349 dump_data(1, session_key
.data
, session_key
.length
);
358 * Test the NTLMv2 and LMv2 responses
361 static bool test_lmv2_ntlmv2_broken(enum ntlm_break break_which
)
366 DATA_BLOB ntlmv2_response
= data_blob_null
;
367 DATA_BLOB lmv2_response
= data_blob_null
;
368 DATA_BLOB ntlmv2_session_key
= data_blob_null
;
369 DATA_BLOB names_blob
= NTLMv2_generate_names_blob(NULL
, get_winbind_netbios_name(), get_winbind_domain());
370 uint8_t authoritative
= 1;
371 uchar user_session_key
[16];
372 DATA_BLOB chall
= get_challenge();
375 ZERO_STRUCT(user_session_key
);
377 flags
|= WBFLAG_PAM_USER_SESSION_KEY
;
379 if (!SMBNTLMv2encrypt(NULL
, opt_username
, opt_domain
, opt_password
, &chall
,
381 &lmv2_response
, &ntlmv2_response
, NULL
,
382 &ntlmv2_session_key
)) {
383 data_blob_free(&names_blob
);
386 data_blob_free(&names_blob
);
388 switch (break_which
) {
392 lmv2_response
.data
[0]++;
395 ntlmv2_response
.data
[0]++;
398 data_blob_free(&lmv2_response
);
401 data_blob_free(&ntlmv2_response
);
405 nt_status
= contact_winbind_auth_crap(opt_username
, opt_domain
,
414 &error_string
, NULL
);
416 data_blob_free(&lmv2_response
);
417 data_blob_free(&ntlmv2_response
);
419 if (!NT_STATUS_IS_OK(nt_status
)) {
420 d_printf("%s (0x%x)\n",
422 NT_STATUS_V(nt_status
));
423 SAFE_FREE(error_string
);
424 return break_which
== BREAK_NT
;
427 if (break_which
!= NO_NT
&& break_which
!= BREAK_NT
&& memcmp(ntlmv2_session_key
.data
, user_session_key
,
428 sizeof(user_session_key
)) != 0) {
429 DEBUG(1, ("USER (NTLMv2) Session Key does not match expectations!\n"));
430 DEBUG(1, ("user_session_key:\n"));
431 dump_data(1, user_session_key
, 16);
432 DEBUG(1, ("expected:\n"));
433 dump_data(1, ntlmv2_session_key
.data
, ntlmv2_session_key
.length
);
440 * Test the NTLMv2 and LMv2 responses
443 static bool test_lmv2_ntlmv2(bool lanman_support_expected
)
445 return test_lmv2_ntlmv2_broken(BREAK_NONE
);
449 * Test the LMv2 response only
452 static bool test_lmv2(bool lanman_support_expected
)
454 return test_lmv2_ntlmv2_broken(NO_NT
);
458 * Test the NTLMv2 response only
461 static bool test_ntlmv2(bool lanman_support_expected
)
463 return test_lmv2_ntlmv2_broken(NO_LM
);
466 static bool test_lm_ntlm(bool lanman_support_expected
)
468 return test_lm_ntlm_broken(BREAK_NONE
, lanman_support_expected
);
471 static bool test_ntlm_lm_broken(bool lanman_support_expected
)
473 return test_lm_ntlm_broken(BREAK_LM
, lanman_support_expected
);
476 static bool test_ntlm_ntlm_broken(bool lanman_support_expected
)
478 return test_lm_ntlm_broken(BREAK_NT
, lanman_support_expected
);
481 static bool test_ntlmv2_lmv2_broken(bool lanman_support_expected
)
483 return test_lmv2_ntlmv2_broken(BREAK_LM
);
486 static bool test_ntlmv2_ntlmv2_broken(bool lanman_support_expected
)
488 return test_lmv2_ntlmv2_broken(BREAK_NT
);
491 static bool test_plaintext(enum ntlm_break break_which
)
495 DATA_BLOB nt_response
= data_blob_null
;
496 DATA_BLOB lm_response
= data_blob_null
;
498 smb_ucs2_t
*nt_response_ucs2
;
499 size_t converted_size
;
500 uint8_t authoritative
= 1;
501 uchar user_session_key
[16];
503 static const uchar zeros
[8] = { 0, };
504 DATA_BLOB chall
= data_blob(zeros
, sizeof(zeros
));
507 ZERO_STRUCT(user_session_key
);
509 flags
|= WBFLAG_PAM_LMKEY
;
510 flags
|= WBFLAG_PAM_USER_SESSION_KEY
;
512 if (!push_ucs2_talloc(talloc_tos(), &nt_response_ucs2
, opt_password
,
515 DEBUG(0, ("push_ucs2_talloc failed!\n"));
519 nt_response
.data
= (unsigned char *)nt_response_ucs2
;
520 nt_response
.length
= strlen_w(nt_response_ucs2
)*sizeof(smb_ucs2_t
);
522 if ((password
= strupper_talloc(talloc_tos(), opt_password
)) == NULL
) {
523 DEBUG(0, ("strupper_talloc() failed!\n"));
527 if (!convert_string_talloc(talloc_tos(), CH_UNIX
,
531 &lm_response
.length
)) {
532 DEBUG(0, ("convert_string_talloc failed!\n"));
536 TALLOC_FREE(password
);
538 switch (break_which
) {
542 lm_response
.data
[0]++;
545 nt_response
.data
[0]++;
548 TALLOC_FREE(lm_response
.data
);
549 lm_response
.length
= 0;
552 TALLOC_FREE(nt_response
.data
);
553 nt_response
.length
= 0;
557 nt_status
= contact_winbind_auth_crap(opt_username
, opt_domain
,
562 flags
, MSV1_0_CLEARTEXT_PASSWORD_ALLOWED
,
566 &error_string
, NULL
);
568 TALLOC_FREE(nt_response
.data
);
569 TALLOC_FREE(lm_response
.data
);
570 data_blob_free(&chall
);
572 if (!NT_STATUS_IS_OK(nt_status
)) {
573 d_printf("%s (0x%x)\n",
575 NT_STATUS_V(nt_status
));
576 SAFE_FREE(error_string
);
577 return break_which
== BREAK_NT
;
580 return break_which
!= BREAK_NT
;
583 static bool test_plaintext_none_broken(bool lanman_support_expected
) {
584 return test_plaintext(BREAK_NONE
);
587 static bool test_plaintext_lm_broken(bool lanman_support_expected
) {
588 return test_plaintext(BREAK_LM
);
591 static bool test_plaintext_nt_broken(bool lanman_support_expected
) {
592 return test_plaintext(BREAK_NT
);
595 static bool test_plaintext_nt_only(bool lanman_support_expected
) {
596 return test_plaintext(NO_LM
);
599 static bool test_plaintext_lm_only(bool lanman_support_expected
) {
600 return test_plaintext(NO_NT
);
614 - plaintext tests (in challenge-response fields)
616 check we get the correct session key in each case
617 check what values we get for the LM session key
621 static const struct ntlm_tests
{
622 bool (*fn
)(bool lanman_support_expected
);
633 .name
= "LM and NTLM"
640 .fn
= test_ntlm_in_lm
,
644 .fn
= test_ntlm_in_both
,
645 .name
= "NTLM in both"
652 .fn
= test_lmv2_ntlmv2
,
653 .name
= "NTLMv2 and LMv2"
660 .fn
= test_ntlmv2_lmv2_broken
,
661 .name
= "NTLMv2 and LMv2, LMv2 broken"
664 .fn
= test_ntlmv2_ntlmv2_broken
,
665 .name
= "NTLMv2 and LMv2, NTLMv2 broken"
668 .fn
= test_ntlm_lm_broken
,
669 .name
= "NTLM and LM, LM broken"
672 .fn
= test_ntlm_ntlm_broken
,
673 .name
= "NTLM and LM, NTLM broken"
676 .fn
= test_plaintext_none_broken
,
680 .fn
= test_plaintext_lm_broken
,
681 .name
= "Plaintext LM broken"
684 .fn
= test_plaintext_nt_broken
,
685 .name
= "Plaintext NT broken"
688 .fn
= test_plaintext_nt_only
,
689 .name
= "Plaintext NT only"
692 .fn
= test_plaintext_lm_only
,
693 .name
= "Plaintext LM only",
701 bool diagnose_ntlm_auth(bool lanman_support_expected
)
706 for (i
=0; test_table
[i
].fn
; i
++) {
707 bool test_pass
= test_table
[i
].fn(lanman_support_expected
);
708 if (!lanman_support_expected
709 && test_table
[i
].lanman
) {
711 DBG_ERR("Test %s unexpectedly passed "
712 "(server should have rejected LM)!\n",
716 } else if (!test_pass
) {
717 DBG_ERR("Test %s failed!\n", test_table
[i
].name
);