2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003
8 Copyright (C) Andrew Bartlett 2005 (Updated from gensec).
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "../libcli/auth/ntlmssp.h"
26 #include "../libcli/auth/ntlmssp_private.h"
27 #include "../libcli/auth/libcli_auth.h"
28 #include "../librpc/gen_ndr/ndr_ntlmssp.h"
29 #include "../libcli/auth/ntlmssp_ndr.h"
30 #include "../lib/crypto/md5.h"
31 #include "../lib/crypto/arcfour.h"
32 #include "../lib/crypto/hmacmd5.h"
34 static NTSTATUS
ntlmssp_client_initial(struct ntlmssp_state
*ntlmssp_state
,
35 DATA_BLOB reply
, DATA_BLOB
*next_request
);
36 static NTSTATUS
ntlmssp_server_negotiate(struct ntlmssp_state
*ntlmssp_state
,
37 const DATA_BLOB in
, DATA_BLOB
*out
);
38 static NTSTATUS
ntlmssp_client_challenge(struct ntlmssp_state
*ntlmssp_state
,
39 const DATA_BLOB reply
, DATA_BLOB
*next_request
);
40 static NTSTATUS
ntlmssp_server_auth(struct ntlmssp_state
*ntlmssp_state
,
41 const DATA_BLOB request
, DATA_BLOB
*reply
);
44 * Callbacks for NTLMSSP - for both client and server operating modes
48 static const struct ntlmssp_callbacks
{
49 enum ntlmssp_role role
;
50 enum ntlmssp_message_type ntlmssp_command
;
51 NTSTATUS (*fn
)(struct ntlmssp_state
*ntlmssp_state
,
52 DATA_BLOB in
, DATA_BLOB
*out
);
53 } ntlmssp_callbacks
[] = {
54 {NTLMSSP_CLIENT
, NTLMSSP_INITIAL
, ntlmssp_client_initial
},
55 {NTLMSSP_SERVER
, NTLMSSP_NEGOTIATE
, ntlmssp_server_negotiate
},
56 {NTLMSSP_CLIENT
, NTLMSSP_CHALLENGE
, ntlmssp_client_challenge
},
57 {NTLMSSP_SERVER
, NTLMSSP_AUTH
, ntlmssp_server_auth
},
58 {NTLMSSP_CLIENT
, NTLMSSP_UNKNOWN
, NULL
},
59 {NTLMSSP_SERVER
, NTLMSSP_UNKNOWN
, NULL
}
64 * Default challenge generation code.
68 static NTSTATUS
get_challenge(const struct ntlmssp_state
*ntlmssp_state
,
71 generate_random_buffer(chal
, 8);
76 * Default 'we can set the challenge to anything we like' implementation
80 static bool may_set_challenge(const struct ntlmssp_state
*ntlmssp_state
)
86 * Default 'we can set the challenge to anything we like' implementation
88 * Does not actually do anything, as the value is always in the structure anyway.
92 static NTSTATUS
set_challenge(struct ntlmssp_state
*ntlmssp_state
, DATA_BLOB
*challenge
)
94 SMB_ASSERT(challenge
->length
== 8);
99 * Set a username on an NTLMSSP context - ensures it is talloc()ed
103 NTSTATUS
ntlmssp_set_username(struct ntlmssp_state
*ntlmssp_state
, const char *user
)
105 ntlmssp_state
->user
= talloc_strdup(ntlmssp_state
, user
? user
: "" );
106 if (!ntlmssp_state
->user
) {
107 return NT_STATUS_NO_MEMORY
;
113 * Store NT and LM hashes on an NTLMSSP context - ensures they are talloc()ed
116 NTSTATUS
ntlmssp_set_hashes(struct ntlmssp_state
*ntlmssp_state
,
117 const uint8_t lm_hash
[16],
118 const uint8_t nt_hash
[16])
120 ntlmssp_state
->lm_hash
= (uint8_t *)
121 TALLOC_MEMDUP(ntlmssp_state
, lm_hash
, 16);
122 ntlmssp_state
->nt_hash
= (uint8_t *)
123 TALLOC_MEMDUP(ntlmssp_state
, nt_hash
, 16);
124 if (!ntlmssp_state
->lm_hash
|| !ntlmssp_state
->nt_hash
) {
125 TALLOC_FREE(ntlmssp_state
->lm_hash
);
126 TALLOC_FREE(ntlmssp_state
->nt_hash
);
127 return NT_STATUS_NO_MEMORY
;
133 * Converts a password to the hashes on an NTLMSSP context.
136 NTSTATUS
ntlmssp_set_password(struct ntlmssp_state
*ntlmssp_state
, const char *password
)
139 ntlmssp_state
->lm_hash
= NULL
;
140 ntlmssp_state
->nt_hash
= NULL
;
145 E_deshash(password
, lm_hash
);
146 E_md4hash(password
, nt_hash
);
147 return ntlmssp_set_hashes(ntlmssp_state
, lm_hash
, nt_hash
);
153 * Set a domain on an NTLMSSP context - ensures it is talloc()ed
156 NTSTATUS
ntlmssp_set_domain(struct ntlmssp_state
*ntlmssp_state
, const char *domain
)
158 ntlmssp_state
->domain
= talloc_strdup(ntlmssp_state
,
159 domain
? domain
: "" );
160 if (!ntlmssp_state
->domain
) {
161 return NT_STATUS_NO_MEMORY
;
167 * Request features for the NTLMSSP negotiation
169 * @param ntlmssp_state NTLMSSP state
170 * @param feature_list List of space seperated features requested from NTLMSSP.
172 void ntlmssp_want_feature_list(struct ntlmssp_state
*ntlmssp_state
, char *feature_list
)
175 * We need to set this to allow a later SetPassword
176 * via the SAMR pipe to succeed. Strange.... We could
177 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
179 if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list
, True
)) {
180 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
182 if (in_list("NTLMSSP_FEATURE_SIGN", feature_list
, True
)) {
183 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
185 if(in_list("NTLMSSP_FEATURE_SEAL", feature_list
, True
)) {
186 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
188 if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list
, true)) {
189 ntlmssp_state
->use_ccache
= true;
194 * Request a feature for the NTLMSSP negotiation
196 * @param ntlmssp_state NTLMSSP state
197 * @param feature Bit flag specifying the requested feature
199 void ntlmssp_want_feature(struct ntlmssp_state
*ntlmssp_state
, uint32_t feature
)
201 /* As per JRA's comment above */
202 if (feature
& NTLMSSP_FEATURE_SESSION_KEY
) {
203 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
205 if (feature
& NTLMSSP_FEATURE_SIGN
) {
206 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
208 if (feature
& NTLMSSP_FEATURE_SEAL
) {
209 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
211 if (feature
& NTLMSSP_FEATURE_CCACHE
) {
212 ntlmssp_state
->use_ccache
= true;
217 * Next state function for the NTLMSSP state machine
219 * @param ntlmssp_state NTLMSSP State
220 * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB
221 * @param out The reply, as an allocated DATA_BLOB, caller to free.
222 * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK.
225 NTSTATUS
ntlmssp_update(struct ntlmssp_state
*ntlmssp_state
,
226 const DATA_BLOB input
, DATA_BLOB
*out
)
228 uint32_t ntlmssp_command
;
231 if (ntlmssp_state
->expected_state
== NTLMSSP_DONE
) {
232 /* Called update after negotiations finished. */
233 DEBUG(1, ("Called NTLMSSP after state machine was 'done'\n"));
234 return NT_STATUS_INVALID_PARAMETER
;
237 *out
= data_blob_null
;
240 switch (ntlmssp_state
->role
) {
242 ntlmssp_command
= NTLMSSP_INITIAL
;
245 /* 'datagram' mode - no neg packet */
246 ntlmssp_command
= NTLMSSP_NEGOTIATE
;
250 if (!msrpc_parse(ntlmssp_state
, &input
, "Cd",
253 DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
254 dump_data(2, input
.data
, input
.length
);
255 return NT_STATUS_INVALID_PARAMETER
;
259 if (ntlmssp_command
!= ntlmssp_state
->expected_state
) {
260 DEBUG(1, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command
, ntlmssp_state
->expected_state
));
261 return NT_STATUS_INVALID_PARAMETER
;
264 for (i
=0; ntlmssp_callbacks
[i
].fn
; i
++) {
265 if (ntlmssp_callbacks
[i
].role
== ntlmssp_state
->role
266 && ntlmssp_callbacks
[i
].ntlmssp_command
== ntlmssp_command
) {
267 return ntlmssp_callbacks
[i
].fn(ntlmssp_state
, input
, out
);
271 DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
272 ntlmssp_state
->role
, ntlmssp_command
));
274 return NT_STATUS_INVALID_PARAMETER
;
278 * Determine correct target name flags for reply, given server role
279 * and negotiated flags
281 * @param ntlmssp_state NTLMSSP State
282 * @param neg_flags The flags from the packet
283 * @param chal_flags The flags to be set in the reply packet
284 * @return The 'target name' string.
287 static const char *ntlmssp_target_name(struct ntlmssp_state
*ntlmssp_state
,
288 uint32_t neg_flags
, uint32_t *chal_flags
)
290 if (neg_flags
& NTLMSSP_REQUEST_TARGET
) {
291 *chal_flags
|= NTLMSSP_NEGOTIATE_TARGET_INFO
;
292 *chal_flags
|= NTLMSSP_REQUEST_TARGET
;
293 if (ntlmssp_state
->server
.is_standalone
) {
294 *chal_flags
|= NTLMSSP_TARGET_TYPE_SERVER
;
295 return ntlmssp_state
->server
.netbios_name
;
297 *chal_flags
|= NTLMSSP_TARGET_TYPE_DOMAIN
;
298 return ntlmssp_state
->server
.netbios_domain
;
305 static void ntlmssp_handle_neg_flags(struct ntlmssp_state
*ntlmssp_state
,
306 uint32_t neg_flags
, bool allow_lm
) {
307 if (neg_flags
& NTLMSSP_NEGOTIATE_UNICODE
) {
308 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_UNICODE
;
309 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_OEM
;
310 ntlmssp_state
->unicode
= True
;
312 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_UNICODE
;
313 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_OEM
;
314 ntlmssp_state
->unicode
= False
;
317 if ((neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
) && allow_lm
) {
318 /* other end forcing us to use LM */
319 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_LM_KEY
;
320 ntlmssp_state
->use_ntlmv2
= False
;
322 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_LM_KEY
;
325 if (!(neg_flags
& NTLMSSP_NEGOTIATE_ALWAYS_SIGN
)) {
326 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_ALWAYS_SIGN
;
329 if (!(neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
)) {
330 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
333 if (!(neg_flags
& NTLMSSP_NEGOTIATE_128
)) {
334 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_128
;
337 if (!(neg_flags
& NTLMSSP_NEGOTIATE_56
)) {
338 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_56
;
341 if (!(neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
)) {
342 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_KEY_EXCH
;
345 if (!(neg_flags
& NTLMSSP_NEGOTIATE_SIGN
)) {
346 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_SIGN
;
349 if (!(neg_flags
& NTLMSSP_NEGOTIATE_SEAL
)) {
350 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_SEAL
;
353 /* Woop Woop - unknown flag for Windows compatibility...
354 What does this really do ? JRA. */
355 if (!(neg_flags
& NTLMSSP_NEGOTIATE_VERSION
)) {
356 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_VERSION
;
359 if ((neg_flags
& NTLMSSP_REQUEST_TARGET
)) {
360 ntlmssp_state
->neg_flags
|= NTLMSSP_REQUEST_TARGET
;
365 * Next state function for the Negotiate packet
367 * @param ntlmssp_state NTLMSSP State
368 * @param request The request, as a DATA_BLOB
369 * @param request The reply, as an allocated DATA_BLOB, caller to free.
370 * @return Errors or MORE_PROCESSING_REQUIRED if a reply is sent.
373 static NTSTATUS
ntlmssp_server_negotiate(struct ntlmssp_state
*ntlmssp_state
,
374 const DATA_BLOB request
, DATA_BLOB
*reply
)
376 DATA_BLOB struct_blob
;
377 uint32_t neg_flags
= 0;
378 uint32_t ntlmssp_command
, chal_flags
;
380 const char *target_name
;
383 /* parse the NTLMSSP packet */
385 file_save("ntlmssp_negotiate.dat", request
.data
, request
.length
);
388 if (request
.length
) {
389 if ((request
.length
< 16) || !msrpc_parse(ntlmssp_state
, &request
, "Cdd",
393 DEBUG(1, ("ntlmssp_server_negotiate: failed to parse NTLMSSP Negotiate of length %u\n",
394 (unsigned int)request
.length
));
395 dump_data(2, request
.data
, request
.length
);
396 return NT_STATUS_INVALID_PARAMETER
;
398 debug_ntlmssp_flags(neg_flags
);
400 if (DEBUGLEVEL
>= 10) {
401 struct NEGOTIATE_MESSAGE
*negotiate
= talloc(
402 talloc_tos(), struct NEGOTIATE_MESSAGE
);
403 if (negotiate
!= NULL
) {
404 status
= ntlmssp_pull_NEGOTIATE_MESSAGE(
405 &request
, negotiate
, negotiate
);
406 if (NT_STATUS_IS_OK(status
)) {
407 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE
,
410 TALLOC_FREE(negotiate
);
415 ntlmssp_handle_neg_flags(ntlmssp_state
, neg_flags
, lp_lanman_auth());
417 /* Ask our caller what challenge they would like in the packet */
418 status
= ntlmssp_state
->get_challenge(ntlmssp_state
, cryptkey
);
419 if (!NT_STATUS_IS_OK(status
)) {
423 /* Check if we may set the challenge */
424 if (!ntlmssp_state
->may_set_challenge(ntlmssp_state
)) {
425 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
428 /* The flags we send back are not just the negotiated flags,
429 * they are also 'what is in this packet'. Therfore, we
430 * operate on 'chal_flags' from here on
433 chal_flags
= ntlmssp_state
->neg_flags
;
435 /* get the right name to fill in as 'target' */
436 target_name
= ntlmssp_target_name(ntlmssp_state
,
437 neg_flags
, &chal_flags
);
438 if (target_name
== NULL
)
439 return NT_STATUS_INVALID_PARAMETER
;
441 ntlmssp_state
->chal
= data_blob_talloc(ntlmssp_state
, cryptkey
, 8);
442 ntlmssp_state
->internal_chal
= data_blob_talloc(ntlmssp_state
,
445 /* This creates the 'blob' of names that appears at the end of the packet */
446 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
)
448 msrpc_gen(ntlmssp_state
, &struct_blob
, "aaaaa",
449 MsvAvNbDomainName
, target_name
,
450 MsvAvNbComputerName
, ntlmssp_state
->server
.netbios_name
,
451 MsvAvDnsDomainName
, ntlmssp_state
->server
.dns_domain
,
452 MsvAvDnsComputerName
, ntlmssp_state
->server
.dns_name
,
455 struct_blob
= data_blob_null
;
459 /* Marshal the packet in the right format, be it unicode or ASCII */
460 const char *gen_string
;
461 DATA_BLOB version_blob
= data_blob_null
;
463 if (chal_flags
& NTLMSSP_NEGOTIATE_VERSION
) {
464 enum ndr_err_code err
;
467 /* "What Windows returns" as a version number. */
469 vers
.ProductMajorVersion
= NTLMSSP_WINDOWS_MAJOR_VERSION_6
;
470 vers
.ProductMinorVersion
= NTLMSSP_WINDOWS_MINOR_VERSION_1
;
471 vers
.ProductBuild
= 0;
472 vers
.NTLMRevisionCurrent
= NTLMSSP_REVISION_W2K3
;
474 err
= ndr_push_struct_blob(&version_blob
,
477 (ndr_push_flags_fn_t
)ndr_push_VERSION
);
479 if (!NDR_ERR_CODE_IS_SUCCESS(err
)) {
480 return NT_STATUS_NO_MEMORY
;
484 if (ntlmssp_state
->unicode
) {
485 gen_string
= "CdUdbddBb";
487 gen_string
= "CdAdbddBb";
490 msrpc_gen(ntlmssp_state
, reply
, gen_string
,
497 struct_blob
.data
, struct_blob
.length
,
498 version_blob
.data
, version_blob
.length
);
500 data_blob_free(&version_blob
);
502 if (DEBUGLEVEL
>= 10) {
503 struct CHALLENGE_MESSAGE
*challenge
= talloc(
504 talloc_tos(), struct CHALLENGE_MESSAGE
);
505 if (challenge
!= NULL
) {
506 challenge
->NegotiateFlags
= chal_flags
;
507 status
= ntlmssp_pull_CHALLENGE_MESSAGE(
508 reply
, challenge
, challenge
);
509 if (NT_STATUS_IS_OK(status
)) {
510 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE
,
513 TALLOC_FREE(challenge
);
518 data_blob_free(&struct_blob
);
520 ntlmssp_state
->expected_state
= NTLMSSP_AUTH
;
522 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
526 * Next state function for the Authenticate packet
528 * @param ntlmssp_state NTLMSSP State
529 * @param request The request, as a DATA_BLOB
530 * @param request The reply, as an allocated DATA_BLOB, caller to free.
531 * @return Errors or NT_STATUS_OK.
534 static NTSTATUS
ntlmssp_server_auth(struct ntlmssp_state
*ntlmssp_state
,
535 const DATA_BLOB request
, DATA_BLOB
*reply
)
537 DATA_BLOB encrypted_session_key
= data_blob_null
;
538 DATA_BLOB user_session_key
= data_blob_null
;
539 DATA_BLOB lm_session_key
= data_blob_null
;
540 DATA_BLOB session_key
= data_blob_null
;
541 uint32_t ntlmssp_command
, auth_flags
;
542 NTSTATUS nt_status
= NT_STATUS_OK
;
545 bool doing_ntlm2
= False
;
547 uint8_t session_nonce
[16];
548 uint8_t session_nonce_hash
[16];
550 const char *parse_string
;
552 /* parse the NTLMSSP packet */
553 *reply
= data_blob_null
;
556 file_save("ntlmssp_auth.dat", request
.data
, request
.length
);
559 if (ntlmssp_state
->unicode
) {
560 parse_string
= "CdBBUUUBd";
562 parse_string
= "CdBBAAABd";
565 data_blob_free(&ntlmssp_state
->lm_resp
);
566 data_blob_free(&ntlmssp_state
->nt_resp
);
568 ntlmssp_state
->user
= NULL
;
569 ntlmssp_state
->domain
= NULL
;
571 /* now the NTLMSSP encoded auth hashes */
572 if (!msrpc_parse(ntlmssp_state
, &request
, parse_string
,
575 &ntlmssp_state
->lm_resp
,
576 &ntlmssp_state
->nt_resp
,
577 &ntlmssp_state
->domain
,
578 &ntlmssp_state
->user
,
579 &ntlmssp_state
->client
.netbios_name
,
580 &encrypted_session_key
,
584 /* Try again with a shorter string (Win9X truncates this packet) */
585 if (ntlmssp_state
->unicode
) {
586 parse_string
= "CdBBUUU";
588 parse_string
= "CdBBAAA";
591 /* now the NTLMSSP encoded auth hashes */
592 if (!msrpc_parse(ntlmssp_state
, &request
, parse_string
,
595 &ntlmssp_state
->lm_resp
,
596 &ntlmssp_state
->nt_resp
,
597 &ntlmssp_state
->domain
,
598 &ntlmssp_state
->user
,
599 &ntlmssp_state
->client
.netbios_name
)) {
600 DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP (tried both formats):\n"));
601 dump_data(2, request
.data
, request
.length
);
603 return NT_STATUS_INVALID_PARAMETER
;
608 ntlmssp_handle_neg_flags(ntlmssp_state
, auth_flags
, lp_lanman_auth());
610 if (DEBUGLEVEL
>= 10) {
611 struct AUTHENTICATE_MESSAGE
*authenticate
= talloc(
612 talloc_tos(), struct AUTHENTICATE_MESSAGE
);
613 if (authenticate
!= NULL
) {
615 authenticate
->NegotiateFlags
= auth_flags
;
616 status
= ntlmssp_pull_AUTHENTICATE_MESSAGE(
617 &request
, authenticate
, authenticate
);
618 if (NT_STATUS_IS_OK(status
)) {
619 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE
,
622 TALLOC_FREE(authenticate
);
626 DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
627 ntlmssp_state
->user
, ntlmssp_state
->domain
,
628 ntlmssp_state
->client
.netbios_name
,
629 (unsigned long)ntlmssp_state
->lm_resp
.length
,
630 (unsigned long)ntlmssp_state
->nt_resp
.length
));
633 file_save("nthash1.dat", &ntlmssp_state
->nt_resp
.data
, &ntlmssp_state
->nt_resp
.length
);
634 file_save("lmhash1.dat", &ntlmssp_state
->lm_resp
.data
, &ntlmssp_state
->lm_resp
.length
);
637 /* NTLM2 uses a 'challenge' that is made of up both the server challenge, and a
640 However, the NTLM2 flag may still be set for the real NTLMv2 logins, be careful.
642 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
) {
643 if (ntlmssp_state
->nt_resp
.length
== 24 && ntlmssp_state
->lm_resp
.length
== 24) {
644 struct MD5Context md5_session_nonce_ctx
;
645 SMB_ASSERT(ntlmssp_state
->internal_chal
.data
&& ntlmssp_state
->internal_chal
.length
== 8);
649 memcpy(session_nonce
, ntlmssp_state
->internal_chal
.data
, 8);
650 memcpy(&session_nonce
[8], ntlmssp_state
->lm_resp
.data
, 8);
652 MD5Init(&md5_session_nonce_ctx
);
653 MD5Update(&md5_session_nonce_ctx
, session_nonce
, 16);
654 MD5Final(session_nonce_hash
, &md5_session_nonce_ctx
);
656 ntlmssp_state
->chal
= data_blob_talloc(
657 ntlmssp_state
, session_nonce_hash
, 8);
659 /* LM response is no longer useful */
660 data_blob_free(&ntlmssp_state
->lm_resp
);
662 /* We changed the effective challenge - set it */
663 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_state
->set_challenge(ntlmssp_state
, &ntlmssp_state
->chal
))) {
664 data_blob_free(&encrypted_session_key
);
668 /* LM Key is incompatible. */
669 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_LM_KEY
;
674 * Note we don't check here for NTLMv2 auth settings. If NTLMv2 auth
675 * is required (by "ntlm auth = no" and "lm auth = no" being set in the
676 * smb.conf file) and no NTLMv2 response was sent then the password check
677 * will fail here. JRA.
680 /* Finally, actually ask if the password is OK */
682 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_state
->check_password(ntlmssp_state
,
683 &user_session_key
, &lm_session_key
))) {
684 data_blob_free(&encrypted_session_key
);
688 dump_data_pw("NT session key:\n", user_session_key
.data
, user_session_key
.length
);
689 dump_data_pw("LM first-8:\n", lm_session_key
.data
, lm_session_key
.length
);
691 /* Handle the different session key derivation for NTLM2 */
693 if (user_session_key
.data
&& user_session_key
.length
== 16) {
694 session_key
= data_blob_talloc(ntlmssp_state
,
696 hmac_md5(user_session_key
.data
, session_nonce
,
697 sizeof(session_nonce
), session_key
.data
);
698 DEBUG(10,("ntlmssp_server_auth: Created NTLM2 session key.\n"));
699 dump_data_pw("NTLM2 session key:\n", session_key
.data
, session_key
.length
);
702 DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM2 session key.\n"));
703 session_key
= data_blob_null
;
705 } else if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
) {
706 if (lm_session_key
.data
&& lm_session_key
.length
>= 8) {
707 if (ntlmssp_state
->lm_resp
.data
&& ntlmssp_state
->lm_resp
.length
== 24) {
708 session_key
= data_blob_talloc(ntlmssp_state
,
710 if (session_key
.data
== NULL
) {
711 return NT_STATUS_NO_MEMORY
;
713 SMBsesskeygen_lm_sess_key(lm_session_key
.data
, ntlmssp_state
->lm_resp
.data
,
715 DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
717 static const uint8_t zeros
[24] = {0, };
718 session_key
= data_blob_talloc(
719 ntlmssp_state
, NULL
, 16);
720 if (session_key
.data
== NULL
) {
721 return NT_STATUS_NO_MEMORY
;
723 SMBsesskeygen_lm_sess_key(
724 lm_session_key
.data
, zeros
,
727 dump_data_pw("LM session key:\n", session_key
.data
,
730 DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM session key.\n"));
731 session_key
= data_blob_null
;
733 } else if (user_session_key
.data
) {
734 session_key
= user_session_key
;
735 DEBUG(10,("ntlmssp_server_auth: Using unmodified nt session key.\n"));
736 dump_data_pw("unmodified session key:\n", session_key
.data
, session_key
.length
);
737 } else if (lm_session_key
.data
) {
738 session_key
= lm_session_key
;
739 DEBUG(10,("ntlmssp_server_auth: Using unmodified lm session key.\n"));
740 dump_data_pw("unmodified session key:\n", session_key
.data
, session_key
.length
);
742 DEBUG(10,("ntlmssp_server_auth: Failed to create unmodified session key.\n"));
743 session_key
= data_blob_null
;
746 /* With KEY_EXCH, the client supplies the proposed session key,
747 but encrypts it with the long-term key */
748 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
) {
749 if (!encrypted_session_key
.data
|| encrypted_session_key
.length
!= 16) {
750 data_blob_free(&encrypted_session_key
);
751 DEBUG(1, ("Client-supplied KEY_EXCH session key was of invalid length (%u)!\n",
752 (unsigned int)encrypted_session_key
.length
));
753 return NT_STATUS_INVALID_PARAMETER
;
754 } else if (!session_key
.data
|| session_key
.length
!= 16) {
755 DEBUG(5, ("server session key is invalid (len == %u), cannot do KEY_EXCH!\n",
756 (unsigned int)session_key
.length
));
757 ntlmssp_state
->session_key
= session_key
;
759 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
760 arcfour_crypt_blob(encrypted_session_key
.data
,
761 encrypted_session_key
.length
,
763 ntlmssp_state
->session_key
= data_blob_talloc(
764 ntlmssp_state
, encrypted_session_key
.data
,
765 encrypted_session_key
.length
);
766 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key
.data
,
767 encrypted_session_key
.length
);
770 ntlmssp_state
->session_key
= session_key
;
773 if (!NT_STATUS_IS_OK(nt_status
)) {
774 ntlmssp_state
->session_key
= data_blob_null
;
775 } else if (ntlmssp_state
->session_key
.length
) {
776 nt_status
= ntlmssp_sign_init(ntlmssp_state
);
779 data_blob_free(&encrypted_session_key
);
781 /* Only one authentication allowed per server state. */
782 ntlmssp_state
->expected_state
= NTLMSSP_DONE
;
788 * Create an NTLMSSP state machine
790 * @param ntlmssp_state NTLMSSP State, allocated by this function
793 NTSTATUS
ntlmssp_server_start(TALLOC_CTX
*mem_ctx
,
795 const char *netbios_name
,
796 const char *netbios_domain
,
797 const char *dns_name
,
798 const char *dns_domain
,
799 struct ntlmssp_state
**_ntlmssp_state
)
801 struct ntlmssp_state
*ntlmssp_state
;
807 if (!netbios_domain
) {
819 ntlmssp_state
= talloc_zero(mem_ctx
, struct ntlmssp_state
);
820 if (!ntlmssp_state
) {
821 return NT_STATUS_NO_MEMORY
;
824 ntlmssp_state
->role
= NTLMSSP_SERVER
;
826 ntlmssp_state
->get_challenge
= get_challenge
;
827 ntlmssp_state
->set_challenge
= set_challenge
;
828 ntlmssp_state
->may_set_challenge
= may_set_challenge
;
830 ntlmssp_state
->server
.is_standalone
= is_standalone
;
832 ntlmssp_state
->expected_state
= NTLMSSP_NEGOTIATE
;
834 ntlmssp_state
->neg_flags
=
835 NTLMSSP_NEGOTIATE_128
|
836 NTLMSSP_NEGOTIATE_56
|
837 NTLMSSP_NEGOTIATE_VERSION
|
838 NTLMSSP_NEGOTIATE_ALWAYS_SIGN
|
839 NTLMSSP_NEGOTIATE_NTLM
|
840 NTLMSSP_NEGOTIATE_NTLM2
|
841 NTLMSSP_NEGOTIATE_KEY_EXCH
|
842 NTLMSSP_NEGOTIATE_SIGN
|
843 NTLMSSP_NEGOTIATE_SEAL
;
845 ntlmssp_state
->server
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
846 if (!ntlmssp_state
->server
.netbios_name
) {
847 talloc_free(ntlmssp_state
);
848 return NT_STATUS_NO_MEMORY
;
850 ntlmssp_state
->server
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
851 if (!ntlmssp_state
->server
.netbios_domain
) {
852 talloc_free(ntlmssp_state
);
853 return NT_STATUS_NO_MEMORY
;
855 ntlmssp_state
->server
.dns_name
= talloc_strdup(ntlmssp_state
, dns_name
);
856 if (!ntlmssp_state
->server
.dns_name
) {
857 talloc_free(ntlmssp_state
);
858 return NT_STATUS_NO_MEMORY
;
860 ntlmssp_state
->server
.dns_domain
= talloc_strdup(ntlmssp_state
, dns_domain
);
861 if (!ntlmssp_state
->server
.dns_domain
) {
862 talloc_free(ntlmssp_state
);
863 return NT_STATUS_NO_MEMORY
;
866 *_ntlmssp_state
= ntlmssp_state
;
870 /*********************************************************************
872 *********************************************************************/
875 * Next state function for the Initial packet
877 * @param ntlmssp_state NTLMSSP State
878 * @param request The request, as a DATA_BLOB. reply.data must be NULL
879 * @param request The reply, as an allocated DATA_BLOB, caller to free.
880 * @return Errors or NT_STATUS_OK.
883 static NTSTATUS
ntlmssp_client_initial(struct ntlmssp_state
*ntlmssp_state
,
884 DATA_BLOB reply
, DATA_BLOB
*next_request
)
886 if (ntlmssp_state
->unicode
) {
887 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_UNICODE
;
889 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_OEM
;
892 if (ntlmssp_state
->use_ntlmv2
) {
893 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_NTLM2
;
896 /* generate the ntlmssp negotiate packet */
897 msrpc_gen(ntlmssp_state
, next_request
, "CddAA",
900 ntlmssp_state
->neg_flags
,
901 ntlmssp_state
->client
.netbios_domain
,
902 ntlmssp_state
->client
.netbios_name
);
904 if (DEBUGLEVEL
>= 10) {
905 struct NEGOTIATE_MESSAGE
*negotiate
= talloc(
906 talloc_tos(), struct NEGOTIATE_MESSAGE
);
907 if (negotiate
!= NULL
) {
909 status
= ntlmssp_pull_NEGOTIATE_MESSAGE(
910 next_request
, negotiate
, negotiate
);
911 if (NT_STATUS_IS_OK(status
)) {
912 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE
,
915 TALLOC_FREE(negotiate
);
919 ntlmssp_state
->expected_state
= NTLMSSP_CHALLENGE
;
921 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
925 * Next state function for the Challenge Packet. Generate an auth packet.
927 * @param ntlmssp_state NTLMSSP State
928 * @param request The request, as a DATA_BLOB. reply.data must be NULL
929 * @param request The reply, as an allocated DATA_BLOB, caller to free.
930 * @return Errors or NT_STATUS_OK.
933 static NTSTATUS
ntlmssp_client_challenge(struct ntlmssp_state
*ntlmssp_state
,
934 const DATA_BLOB reply
, DATA_BLOB
*next_request
)
936 uint32_t chal_flags
, ntlmssp_command
, unkn1
, unkn2
;
937 DATA_BLOB server_domain_blob
;
938 DATA_BLOB challenge_blob
;
939 DATA_BLOB struct_blob
= data_blob_null
;
941 const char *chal_parse_string
;
942 const char *auth_gen_string
;
943 DATA_BLOB lm_response
= data_blob_null
;
944 DATA_BLOB nt_response
= data_blob_null
;
945 DATA_BLOB session_key
= data_blob_null
;
946 DATA_BLOB encrypted_session_key
= data_blob_null
;
947 NTSTATUS nt_status
= NT_STATUS_OK
;
949 if (ntlmssp_state
->use_ccache
) {
950 struct wbcCredentialCacheParams params
;
951 struct wbcCredentialCacheInfo
*info
= NULL
;
952 struct wbcAuthErrorInfo
*error
= NULL
;
953 struct wbcNamedBlob auth_blob
;
954 struct wbcBlob
*wbc_next
= NULL
;
955 struct wbcBlob
*wbc_session_key
= NULL
;
959 params
.account_name
= ntlmssp_state
->user
;
960 params
.domain_name
= ntlmssp_state
->domain
;
961 params
.level
= WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP
;
963 auth_blob
.name
= "challenge_blob";
965 auth_blob
.blob
.data
= reply
.data
;
966 auth_blob
.blob
.length
= reply
.length
;
967 params
.num_blobs
= 1;
968 params
.blobs
= &auth_blob
;
970 wbc_status
= wbcCredentialCache(¶ms
, &info
, &error
);
972 wbcFreeMemory(error
);
974 if (!WBC_ERROR_IS_OK(wbc_status
)) {
978 for (i
=0; i
<info
->num_blobs
; i
++) {
979 if (strequal(info
->blobs
[i
].name
, "auth_blob")) {
980 wbc_next
= &info
->blobs
[i
].blob
;
982 if (strequal(info
->blobs
[i
].name
, "session_key")) {
983 wbc_session_key
= &info
->blobs
[i
].blob
;
986 if ((wbc_next
== NULL
) || (wbc_session_key
== NULL
)) {
991 *next_request
= data_blob(wbc_next
->data
, wbc_next
->length
);
992 ntlmssp_state
->session_key
= data_blob(
993 wbc_session_key
->data
, wbc_session_key
->length
);
1001 if (!msrpc_parse(ntlmssp_state
, &reply
, "CdBd",
1004 &server_domain_blob
,
1006 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
1007 dump_data(2, reply
.data
, reply
.length
);
1009 return NT_STATUS_INVALID_PARAMETER
;
1012 if (DEBUGLEVEL
>= 10) {
1013 struct CHALLENGE_MESSAGE
*challenge
= talloc(
1014 talloc_tos(), struct CHALLENGE_MESSAGE
);
1015 if (challenge
!= NULL
) {
1017 challenge
->NegotiateFlags
= chal_flags
;
1018 status
= ntlmssp_pull_CHALLENGE_MESSAGE(
1019 &reply
, challenge
, challenge
);
1020 if (NT_STATUS_IS_OK(status
)) {
1021 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE
,
1024 TALLOC_FREE(challenge
);
1028 data_blob_free(&server_domain_blob
);
1030 DEBUG(3, ("Got challenge flags:\n"));
1031 debug_ntlmssp_flags(chal_flags
);
1033 ntlmssp_handle_neg_flags(ntlmssp_state
, chal_flags
, lp_client_lanman_auth());
1035 if (ntlmssp_state
->unicode
) {
1036 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
) {
1037 chal_parse_string
= "CdUdbddB";
1039 chal_parse_string
= "CdUdbdd";
1041 auth_gen_string
= "CdBBUUUBd";
1043 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
) {
1044 chal_parse_string
= "CdAdbddB";
1046 chal_parse_string
= "CdAdbdd";
1049 auth_gen_string
= "CdBBAAABd";
1052 DEBUG(3, ("NTLMSSP: Set final flags:\n"));
1053 debug_ntlmssp_flags(ntlmssp_state
->neg_flags
);
1055 if (!msrpc_parse(ntlmssp_state
, &reply
, chal_parse_string
,
1063 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
1064 dump_data(2, reply
.data
, reply
.length
);
1065 return NT_STATUS_INVALID_PARAMETER
;
1068 if (chal_flags
& NTLMSSP_TARGET_TYPE_SERVER
) {
1069 ntlmssp_state
->server
.is_standalone
= true;
1071 ntlmssp_state
->server
.is_standalone
= false;
1073 /* TODO: parse struct_blob and fill in the rest */
1074 ntlmssp_state
->server
.netbios_name
= "";
1075 ntlmssp_state
->server
.netbios_domain
= server_domain
;
1076 ntlmssp_state
->server
.dns_name
= "";
1077 ntlmssp_state
->server
.dns_domain
= "";
1079 if (challenge_blob
.length
!= 8) {
1080 data_blob_free(&struct_blob
);
1081 return NT_STATUS_INVALID_PARAMETER
;
1084 if (!ntlmssp_state
->nt_hash
|| !ntlmssp_state
->lm_hash
) {
1085 static const uint8_t zeros
[16] = {0, };
1086 /* do nothing - blobs are zero length */
1088 /* session key is all zeros */
1089 session_key
= data_blob_talloc(ntlmssp_state
, zeros
, 16);
1091 /* not doing NLTM2 without a password */
1092 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
1093 } else if (ntlmssp_state
->use_ntlmv2
) {
1094 if (!struct_blob
.length
) {
1095 /* be lazy, match win2k - we can't do NTLMv2 without it */
1096 DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
1097 return NT_STATUS_INVALID_PARAMETER
;
1100 /* TODO: if the remote server is standalone, then we should replace 'domain'
1101 with the server name as supplied above */
1103 if (!SMBNTLMv2encrypt_hash(ntlmssp_state
,
1104 ntlmssp_state
->user
,
1105 ntlmssp_state
->domain
,
1106 ntlmssp_state
->nt_hash
, &challenge_blob
,
1108 &lm_response
, &nt_response
, NULL
,
1110 data_blob_free(&challenge_blob
);
1111 data_blob_free(&struct_blob
);
1112 return NT_STATUS_NO_MEMORY
;
1114 } else if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
) {
1115 struct MD5Context md5_session_nonce_ctx
;
1116 uint8_t session_nonce
[16];
1117 uint8_t session_nonce_hash
[16];
1118 uint8_t user_session_key
[16];
1120 lm_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1121 generate_random_buffer(lm_response
.data
, 8);
1122 memset(lm_response
.data
+8, 0, 16);
1124 memcpy(session_nonce
, challenge_blob
.data
, 8);
1125 memcpy(&session_nonce
[8], lm_response
.data
, 8);
1127 MD5Init(&md5_session_nonce_ctx
);
1128 MD5Update(&md5_session_nonce_ctx
, challenge_blob
.data
, 8);
1129 MD5Update(&md5_session_nonce_ctx
, lm_response
.data
, 8);
1130 MD5Final(session_nonce_hash
, &md5_session_nonce_ctx
);
1132 DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
1133 DEBUG(5, ("challenge is: \n"));
1134 dump_data(5, session_nonce_hash
, 8);
1136 nt_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1137 SMBNTencrypt_hash(ntlmssp_state
->nt_hash
,
1141 session_key
= data_blob_talloc(ntlmssp_state
, NULL
, 16);
1143 SMBsesskeygen_ntv1(ntlmssp_state
->nt_hash
, user_session_key
);
1144 hmac_md5(user_session_key
, session_nonce
, sizeof(session_nonce
), session_key
.data
);
1145 dump_data_pw("NTLM2 session key:\n", session_key
.data
, session_key
.length
);
1147 /* lanman auth is insecure, it may be disabled */
1148 if (lp_client_lanman_auth()) {
1149 lm_response
= data_blob_talloc(ntlmssp_state
,
1151 SMBencrypt_hash(ntlmssp_state
->lm_hash
,challenge_blob
.data
,
1155 nt_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1156 SMBNTencrypt_hash(ntlmssp_state
->nt_hash
,challenge_blob
.data
,
1159 session_key
= data_blob_talloc(ntlmssp_state
, NULL
, 16);
1160 if ((ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
)
1161 && lp_client_lanman_auth()) {
1162 SMBsesskeygen_lm_sess_key(ntlmssp_state
->lm_hash
, lm_response
.data
,
1164 dump_data_pw("LM session key\n", session_key
.data
, session_key
.length
);
1166 SMBsesskeygen_ntv1(ntlmssp_state
->nt_hash
, session_key
.data
);
1167 dump_data_pw("NT session key:\n", session_key
.data
, session_key
.length
);
1170 data_blob_free(&struct_blob
);
1172 /* Key exchange encryptes a new client-generated session key with
1173 the password-derived key */
1174 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
) {
1175 /* Make up a new session key */
1176 uint8_t client_session_key
[16];
1177 generate_random_buffer(client_session_key
, sizeof(client_session_key
));
1179 /* Encrypt the new session key with the old one */
1180 encrypted_session_key
= data_blob(client_session_key
, sizeof(client_session_key
));
1181 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
1182 arcfour_crypt_blob(encrypted_session_key
.data
, encrypted_session_key
.length
, &session_key
);
1183 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
1185 /* Mark the new session key as the 'real' session key */
1186 data_blob_free(&session_key
);
1187 session_key
= data_blob_talloc(ntlmssp_state
,
1189 sizeof(client_session_key
));
1192 /* this generates the actual auth packet */
1193 if (!msrpc_gen(ntlmssp_state
, next_request
, auth_gen_string
,
1196 lm_response
.data
, lm_response
.length
,
1197 nt_response
.data
, nt_response
.length
,
1198 ntlmssp_state
->domain
,
1199 ntlmssp_state
->user
,
1200 ntlmssp_state
->client
.netbios_name
,
1201 encrypted_session_key
.data
, encrypted_session_key
.length
,
1202 ntlmssp_state
->neg_flags
)) {
1204 return NT_STATUS_NO_MEMORY
;
1207 if (DEBUGLEVEL
>= 10) {
1208 struct AUTHENTICATE_MESSAGE
*authenticate
= talloc(
1209 talloc_tos(), struct AUTHENTICATE_MESSAGE
);
1210 if (authenticate
!= NULL
) {
1212 authenticate
->NegotiateFlags
=
1213 ntlmssp_state
->neg_flags
;
1214 status
= ntlmssp_pull_AUTHENTICATE_MESSAGE(
1215 next_request
, authenticate
, authenticate
);
1216 if (NT_STATUS_IS_OK(status
)) {
1217 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE
,
1220 TALLOC_FREE(authenticate
);
1224 data_blob_free(&encrypted_session_key
);
1226 data_blob_free(&ntlmssp_state
->chal
);
1228 ntlmssp_state
->session_key
= session_key
;
1230 ntlmssp_state
->chal
= challenge_blob
;
1231 ntlmssp_state
->lm_resp
= lm_response
;
1232 ntlmssp_state
->nt_resp
= nt_response
;
1236 ntlmssp_state
->expected_state
= NTLMSSP_DONE
;
1238 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_sign_init(ntlmssp_state
))) {
1239 DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status
)));
1245 NTSTATUS
ntlmssp_client_start(TALLOC_CTX
*mem_ctx
,
1246 const char *netbios_name
,
1247 const char *netbios_domain
,
1249 struct ntlmssp_state
**_ntlmssp_state
)
1251 struct ntlmssp_state
*ntlmssp_state
;
1253 if (!netbios_name
) {
1257 if (!netbios_domain
) {
1258 netbios_domain
= "";
1261 ntlmssp_state
= talloc_zero(mem_ctx
, struct ntlmssp_state
);
1262 if (!ntlmssp_state
) {
1263 return NT_STATUS_NO_MEMORY
;
1266 ntlmssp_state
->role
= NTLMSSP_CLIENT
;
1268 ntlmssp_state
->unicode
= True
;
1270 ntlmssp_state
->use_ntlmv2
= use_ntlmv2
;
1272 ntlmssp_state
->expected_state
= NTLMSSP_INITIAL
;
1274 ntlmssp_state
->neg_flags
=
1275 NTLMSSP_NEGOTIATE_128
|
1276 NTLMSSP_NEGOTIATE_ALWAYS_SIGN
|
1277 NTLMSSP_NEGOTIATE_NTLM
|
1278 NTLMSSP_NEGOTIATE_NTLM2
|
1279 NTLMSSP_NEGOTIATE_KEY_EXCH
|
1280 NTLMSSP_REQUEST_TARGET
;
1282 ntlmssp_state
->client
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
1283 if (!ntlmssp_state
->client
.netbios_name
) {
1284 talloc_free(ntlmssp_state
);
1285 return NT_STATUS_NO_MEMORY
;
1287 ntlmssp_state
->client
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
1288 if (!ntlmssp_state
->client
.netbios_domain
) {
1289 talloc_free(ntlmssp_state
);
1290 return NT_STATUS_NO_MEMORY
;
1293 *_ntlmssp_state
= ntlmssp_state
;
1294 return NT_STATUS_OK
;