2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003
8 Copyright (C) Andrew Bartlett 2005 (Updated from gensec).
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_ntlmssp.h"
28 #include "../libcli/auth/ntlmssp_ndr.h"
29 #include "../lib/crypto/md5.h"
30 #include "../lib/crypto/arcfour.h"
31 #include "../lib/crypto/hmacmd5.h"
33 static NTSTATUS
ntlmssp_client_initial(struct ntlmssp_state
*ntlmssp_state
,
34 DATA_BLOB reply
, DATA_BLOB
*next_request
);
35 static NTSTATUS
ntlmssp_server_negotiate(struct ntlmssp_state
*ntlmssp_state
,
36 const DATA_BLOB in
, DATA_BLOB
*out
);
37 static NTSTATUS
ntlmssp_client_challenge(struct ntlmssp_state
*ntlmssp_state
,
38 const DATA_BLOB reply
, DATA_BLOB
*next_request
);
39 static NTSTATUS
ntlmssp_server_auth(struct ntlmssp_state
*ntlmssp_state
,
40 const DATA_BLOB request
, DATA_BLOB
*reply
);
43 * Callbacks for NTLMSSP - for both client and server operating modes
47 static const struct ntlmssp_callbacks
{
48 enum ntlmssp_role role
;
49 enum ntlmssp_message_type ntlmssp_command
;
50 NTSTATUS (*fn
)(struct ntlmssp_state
*ntlmssp_state
,
51 DATA_BLOB in
, DATA_BLOB
*out
);
52 } ntlmssp_callbacks
[] = {
53 {NTLMSSP_CLIENT
, NTLMSSP_INITIAL
, ntlmssp_client_initial
},
54 {NTLMSSP_SERVER
, NTLMSSP_NEGOTIATE
, ntlmssp_server_negotiate
},
55 {NTLMSSP_CLIENT
, NTLMSSP_CHALLENGE
, ntlmssp_client_challenge
},
56 {NTLMSSP_SERVER
, NTLMSSP_AUTH
, ntlmssp_server_auth
},
57 {NTLMSSP_CLIENT
, NTLMSSP_UNKNOWN
, NULL
},
58 {NTLMSSP_SERVER
, NTLMSSP_UNKNOWN
, NULL
}
63 * Print out the NTLMSSP flags for debugging
64 * @param neg_flags The flags from the packet
67 void debug_ntlmssp_flags(uint32_t neg_flags
)
69 DEBUG(3,("Got NTLMSSP neg_flags=0x%08x\n", neg_flags
));
71 if (neg_flags
& NTLMSSP_NEGOTIATE_UNICODE
)
72 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_UNICODE\n"));
73 if (neg_flags
& NTLMSSP_NEGOTIATE_OEM
)
74 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM\n"));
75 if (neg_flags
& NTLMSSP_REQUEST_TARGET
)
76 DEBUGADD(4, (" NTLMSSP_REQUEST_TARGET\n"));
77 if (neg_flags
& NTLMSSP_NEGOTIATE_SIGN
)
78 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_SIGN\n"));
79 if (neg_flags
& NTLMSSP_NEGOTIATE_SEAL
)
80 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_SEAL\n"));
81 if (neg_flags
& NTLMSSP_NEGOTIATE_DATAGRAM
)
82 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_DATAGRAM\n"));
83 if (neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
)
84 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_LM_KEY\n"));
85 if (neg_flags
& NTLMSSP_NEGOTIATE_NETWARE
)
86 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NETWARE\n"));
87 if (neg_flags
& NTLMSSP_NEGOTIATE_NTLM
)
88 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NTLM\n"));
89 if (neg_flags
& NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
)
90 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED\n"));
91 if (neg_flags
& NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED
)
92 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED\n"));
93 if (neg_flags
& NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL
)
94 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL\n"));
95 if (neg_flags
& NTLMSSP_NEGOTIATE_ALWAYS_SIGN
)
96 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_ALWAYS_SIGN\n"));
97 if (neg_flags
& NTLMSSP_REQUEST_NON_NT_SESSION_KEY
)
98 DEBUGADD(4, (" NTLMSSP_REQUEST_NON_NT_SESSION_KEY\n"));
99 if (neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
)
100 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NTLM2\n"));
101 if (neg_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
)
102 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_TARGET_INFO\n"));
103 if (neg_flags
& NTLMSSP_NEGOTIATE_VERSION
)
104 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_VERSION\n"));
105 if (neg_flags
& NTLMSSP_NEGOTIATE_128
)
106 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_128\n"));
107 if (neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
)
108 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_KEY_EXCH\n"));
109 if (neg_flags
& NTLMSSP_NEGOTIATE_56
)
110 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_56\n"));
114 * Default challenge generation code.
118 static NTSTATUS
get_challenge(const struct ntlmssp_state
*ntlmssp_state
,
121 generate_random_buffer(chal
, 8);
126 * Default 'we can set the challenge to anything we like' implementation
130 static bool may_set_challenge(const struct ntlmssp_state
*ntlmssp_state
)
136 * Default 'we can set the challenge to anything we like' implementation
138 * Does not actually do anything, as the value is always in the structure anyway.
142 static NTSTATUS
set_challenge(struct ntlmssp_state
*ntlmssp_state
, DATA_BLOB
*challenge
)
144 SMB_ASSERT(challenge
->length
== 8);
149 * Set a username on an NTLMSSP context - ensures it is talloc()ed
153 NTSTATUS
ntlmssp_set_username(struct ntlmssp_state
*ntlmssp_state
, const char *user
)
155 ntlmssp_state
->user
= talloc_strdup(ntlmssp_state
, user
? user
: "" );
156 if (!ntlmssp_state
->user
) {
157 return NT_STATUS_NO_MEMORY
;
163 * Store NT and LM hashes on an NTLMSSP context - ensures they are talloc()ed
166 NTSTATUS
ntlmssp_set_hashes(struct ntlmssp_state
*ntlmssp_state
,
167 const uint8_t lm_hash
[16],
168 const uint8_t nt_hash
[16])
170 ntlmssp_state
->lm_hash
= (uint8_t *)
171 TALLOC_MEMDUP(ntlmssp_state
, lm_hash
, 16);
172 ntlmssp_state
->nt_hash
= (uint8_t *)
173 TALLOC_MEMDUP(ntlmssp_state
, nt_hash
, 16);
174 if (!ntlmssp_state
->lm_hash
|| !ntlmssp_state
->nt_hash
) {
175 TALLOC_FREE(ntlmssp_state
->lm_hash
);
176 TALLOC_FREE(ntlmssp_state
->nt_hash
);
177 return NT_STATUS_NO_MEMORY
;
183 * Converts a password to the hashes on an NTLMSSP context.
186 NTSTATUS
ntlmssp_set_password(struct ntlmssp_state
*ntlmssp_state
, const char *password
)
189 ntlmssp_state
->lm_hash
= NULL
;
190 ntlmssp_state
->nt_hash
= NULL
;
195 E_deshash(password
, lm_hash
);
196 E_md4hash(password
, nt_hash
);
197 return ntlmssp_set_hashes(ntlmssp_state
, lm_hash
, nt_hash
);
203 * Set a domain on an NTLMSSP context - ensures it is talloc()ed
206 NTSTATUS
ntlmssp_set_domain(struct ntlmssp_state
*ntlmssp_state
, const char *domain
)
208 ntlmssp_state
->domain
= talloc_strdup(ntlmssp_state
,
209 domain
? domain
: "" );
210 if (!ntlmssp_state
->domain
) {
211 return NT_STATUS_NO_MEMORY
;
217 * Request features for the NTLMSSP negotiation
219 * @param ntlmssp_state NTLMSSP state
220 * @param feature_list List of space seperated features requested from NTLMSSP.
222 void ntlmssp_want_feature_list(struct ntlmssp_state
*ntlmssp_state
, char *feature_list
)
225 * We need to set this to allow a later SetPassword
226 * via the SAMR pipe to succeed. Strange.... We could
227 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
229 if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list
, True
)) {
230 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
232 if (in_list("NTLMSSP_FEATURE_SIGN", feature_list
, True
)) {
233 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
235 if(in_list("NTLMSSP_FEATURE_SEAL", feature_list
, True
)) {
236 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
238 if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list
, true)) {
239 ntlmssp_state
->use_ccache
= true;
244 * Request a feature for the NTLMSSP negotiation
246 * @param ntlmssp_state NTLMSSP state
247 * @param feature Bit flag specifying the requested feature
249 void ntlmssp_want_feature(struct ntlmssp_state
*ntlmssp_state
, uint32_t feature
)
251 /* As per JRA's comment above */
252 if (feature
& NTLMSSP_FEATURE_SESSION_KEY
) {
253 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
255 if (feature
& NTLMSSP_FEATURE_SIGN
) {
256 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
258 if (feature
& NTLMSSP_FEATURE_SEAL
) {
259 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
261 if (feature
& NTLMSSP_FEATURE_CCACHE
) {
262 ntlmssp_state
->use_ccache
= true;
267 * Next state function for the NTLMSSP state machine
269 * @param ntlmssp_state NTLMSSP State
270 * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB
271 * @param out The reply, as an allocated DATA_BLOB, caller to free.
272 * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK.
275 NTSTATUS
ntlmssp_update(struct ntlmssp_state
*ntlmssp_state
,
276 const DATA_BLOB input
, DATA_BLOB
*out
)
278 uint32_t ntlmssp_command
;
281 if (ntlmssp_state
->expected_state
== NTLMSSP_DONE
) {
282 /* Called update after negotiations finished. */
283 DEBUG(1, ("Called NTLMSSP after state machine was 'done'\n"));
284 return NT_STATUS_INVALID_PARAMETER
;
287 *out
= data_blob_null
;
290 switch (ntlmssp_state
->role
) {
292 ntlmssp_command
= NTLMSSP_INITIAL
;
295 /* 'datagram' mode - no neg packet */
296 ntlmssp_command
= NTLMSSP_NEGOTIATE
;
300 if (!msrpc_parse(ntlmssp_state
, &input
, "Cd",
303 DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
304 dump_data(2, input
.data
, input
.length
);
305 return NT_STATUS_INVALID_PARAMETER
;
309 if (ntlmssp_command
!= ntlmssp_state
->expected_state
) {
310 DEBUG(1, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command
, ntlmssp_state
->expected_state
));
311 return NT_STATUS_INVALID_PARAMETER
;
314 for (i
=0; ntlmssp_callbacks
[i
].fn
; i
++) {
315 if (ntlmssp_callbacks
[i
].role
== ntlmssp_state
->role
316 && ntlmssp_callbacks
[i
].ntlmssp_command
== ntlmssp_command
) {
317 return ntlmssp_callbacks
[i
].fn(ntlmssp_state
, input
, out
);
321 DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
322 ntlmssp_state
->role
, ntlmssp_command
));
324 return NT_STATUS_INVALID_PARAMETER
;
328 * End an NTLMSSP state machine
330 * @param ntlmssp_state NTLMSSP State, free()ed by this function
333 void ntlmssp_end(struct ntlmssp_state
**ntlmssp_state
)
335 data_blob_free(&(*ntlmssp_state
)->chal
);
336 data_blob_free(&(*ntlmssp_state
)->lm_resp
);
337 data_blob_free(&(*ntlmssp_state
)->nt_resp
);
338 TALLOC_FREE(*ntlmssp_state
);
340 *ntlmssp_state
= NULL
;
345 * Determine correct target name flags for reply, given server role
346 * and negotiated flags
348 * @param ntlmssp_state NTLMSSP State
349 * @param neg_flags The flags from the packet
350 * @param chal_flags The flags to be set in the reply packet
351 * @return The 'target name' string.
354 static const char *ntlmssp_target_name(struct ntlmssp_state
*ntlmssp_state
,
355 uint32_t neg_flags
, uint32_t *chal_flags
)
357 if (neg_flags
& NTLMSSP_REQUEST_TARGET
) {
358 *chal_flags
|= NTLMSSP_NEGOTIATE_TARGET_INFO
;
359 *chal_flags
|= NTLMSSP_REQUEST_TARGET
;
360 if (ntlmssp_state
->server
.is_standalone
) {
361 *chal_flags
|= NTLMSSP_TARGET_TYPE_SERVER
;
362 return ntlmssp_state
->server
.netbios_name
;
364 *chal_flags
|= NTLMSSP_TARGET_TYPE_DOMAIN
;
365 return ntlmssp_state
->server
.netbios_domain
;
372 static void ntlmssp_handle_neg_flags(struct ntlmssp_state
*ntlmssp_state
,
373 uint32_t neg_flags
, bool allow_lm
) {
374 if (neg_flags
& NTLMSSP_NEGOTIATE_UNICODE
) {
375 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_UNICODE
;
376 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_OEM
;
377 ntlmssp_state
->unicode
= True
;
379 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_UNICODE
;
380 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_OEM
;
381 ntlmssp_state
->unicode
= False
;
384 if ((neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
) && allow_lm
) {
385 /* other end forcing us to use LM */
386 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_LM_KEY
;
387 ntlmssp_state
->use_ntlmv2
= False
;
389 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_LM_KEY
;
392 if (!(neg_flags
& NTLMSSP_NEGOTIATE_ALWAYS_SIGN
)) {
393 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_ALWAYS_SIGN
;
396 if (!(neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
)) {
397 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
400 if (!(neg_flags
& NTLMSSP_NEGOTIATE_128
)) {
401 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_128
;
404 if (!(neg_flags
& NTLMSSP_NEGOTIATE_56
)) {
405 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_56
;
408 if (!(neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
)) {
409 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_KEY_EXCH
;
412 if (!(neg_flags
& NTLMSSP_NEGOTIATE_SIGN
)) {
413 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_SIGN
;
416 if (!(neg_flags
& NTLMSSP_NEGOTIATE_SEAL
)) {
417 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_SEAL
;
420 /* Woop Woop - unknown flag for Windows compatibility...
421 What does this really do ? JRA. */
422 if (!(neg_flags
& NTLMSSP_NEGOTIATE_VERSION
)) {
423 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_VERSION
;
426 if ((neg_flags
& NTLMSSP_REQUEST_TARGET
)) {
427 ntlmssp_state
->neg_flags
|= NTLMSSP_REQUEST_TARGET
;
432 * Next state function for the Negotiate packet
434 * @param ntlmssp_state NTLMSSP State
435 * @param request The request, as a DATA_BLOB
436 * @param request The reply, as an allocated DATA_BLOB, caller to free.
437 * @return Errors or MORE_PROCESSING_REQUIRED if a reply is sent.
440 static NTSTATUS
ntlmssp_server_negotiate(struct ntlmssp_state
*ntlmssp_state
,
441 const DATA_BLOB request
, DATA_BLOB
*reply
)
443 DATA_BLOB struct_blob
;
444 uint32_t neg_flags
= 0;
445 uint32_t ntlmssp_command
, chal_flags
;
447 const char *target_name
;
448 struct NEGOTIATE_MESSAGE negotiate
;
449 struct CHALLENGE_MESSAGE challenge
;
452 /* parse the NTLMSSP packet */
454 file_save("ntlmssp_negotiate.dat", request
.data
, request
.length
);
457 if (request
.length
) {
458 if ((request
.length
< 16) || !msrpc_parse(ntlmssp_state
, &request
, "Cdd",
462 DEBUG(1, ("ntlmssp_server_negotiate: failed to parse NTLMSSP Negotiate of length %u\n",
463 (unsigned int)request
.length
));
464 dump_data(2, request
.data
, request
.length
);
465 return NT_STATUS_INVALID_PARAMETER
;
467 debug_ntlmssp_flags(neg_flags
);
469 if (DEBUGLEVEL
>= 10) {
470 if (NT_STATUS_IS_OK(ntlmssp_pull_NEGOTIATE_MESSAGE(&request
,
474 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE
, &negotiate
);
479 ntlmssp_handle_neg_flags(ntlmssp_state
, neg_flags
, lp_lanman_auth());
481 /* Ask our caller what challenge they would like in the packet */
482 status
= ntlmssp_state
->get_challenge(ntlmssp_state
, cryptkey
);
483 if (!NT_STATUS_IS_OK(status
)) {
487 /* Check if we may set the challenge */
488 if (!ntlmssp_state
->may_set_challenge(ntlmssp_state
)) {
489 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
492 /* The flags we send back are not just the negotiated flags,
493 * they are also 'what is in this packet'. Therfore, we
494 * operate on 'chal_flags' from here on
497 chal_flags
= ntlmssp_state
->neg_flags
;
499 /* get the right name to fill in as 'target' */
500 target_name
= ntlmssp_target_name(ntlmssp_state
,
501 neg_flags
, &chal_flags
);
502 if (target_name
== NULL
)
503 return NT_STATUS_INVALID_PARAMETER
;
505 ntlmssp_state
->chal
= data_blob_talloc(ntlmssp_state
, cryptkey
, 8);
506 ntlmssp_state
->internal_chal
= data_blob_talloc(ntlmssp_state
,
509 /* This creates the 'blob' of names that appears at the end of the packet */
510 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
)
512 msrpc_gen(ntlmssp_state
, &struct_blob
, "aaaaa",
513 MsvAvNbDomainName
, target_name
,
514 MsvAvNbComputerName
, ntlmssp_state
->server
.netbios_name
,
515 MsvAvDnsDomainName
, ntlmssp_state
->server
.dns_domain
,
516 MsvAvDnsComputerName
, ntlmssp_state
->server
.dns_name
,
519 struct_blob
= data_blob_null
;
523 /* Marshel the packet in the right format, be it unicode or ASCII */
524 const char *gen_string
;
525 if (ntlmssp_state
->unicode
) {
526 gen_string
= "CdUdbddB";
528 gen_string
= "CdAdbddB";
531 msrpc_gen(ntlmssp_state
, reply
, gen_string
,
538 struct_blob
.data
, struct_blob
.length
);
540 if (DEBUGLEVEL
>= 10) {
541 if (NT_STATUS_IS_OK(ntlmssp_pull_CHALLENGE_MESSAGE(reply
,
545 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE
, &challenge
);
550 data_blob_free(&struct_blob
);
552 ntlmssp_state
->expected_state
= NTLMSSP_AUTH
;
554 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
558 * Next state function for the Authenticate packet
560 * @param ntlmssp_state NTLMSSP State
561 * @param request The request, as a DATA_BLOB
562 * @param request The reply, as an allocated DATA_BLOB, caller to free.
563 * @return Errors or NT_STATUS_OK.
566 static NTSTATUS
ntlmssp_server_auth(struct ntlmssp_state
*ntlmssp_state
,
567 const DATA_BLOB request
, DATA_BLOB
*reply
)
569 DATA_BLOB encrypted_session_key
= data_blob_null
;
570 DATA_BLOB user_session_key
= data_blob_null
;
571 DATA_BLOB lm_session_key
= data_blob_null
;
572 DATA_BLOB session_key
= data_blob_null
;
573 uint32_t ntlmssp_command
, auth_flags
;
574 NTSTATUS nt_status
= NT_STATUS_OK
;
575 struct AUTHENTICATE_MESSAGE authenticate
;
578 bool doing_ntlm2
= False
;
580 uint8_t session_nonce
[16];
581 uint8_t session_nonce_hash
[16];
583 const char *parse_string
;
585 /* parse the NTLMSSP packet */
586 *reply
= data_blob_null
;
589 file_save("ntlmssp_auth.dat", request
.data
, request
.length
);
592 if (ntlmssp_state
->unicode
) {
593 parse_string
= "CdBBUUUBd";
595 parse_string
= "CdBBAAABd";
598 data_blob_free(&ntlmssp_state
->lm_resp
);
599 data_blob_free(&ntlmssp_state
->nt_resp
);
601 ntlmssp_state
->user
= NULL
;
602 ntlmssp_state
->domain
= NULL
;
604 /* now the NTLMSSP encoded auth hashes */
605 if (!msrpc_parse(ntlmssp_state
, &request
, parse_string
,
608 &ntlmssp_state
->lm_resp
,
609 &ntlmssp_state
->nt_resp
,
610 &ntlmssp_state
->domain
,
611 &ntlmssp_state
->user
,
612 &ntlmssp_state
->client
.netbios_name
,
613 &encrypted_session_key
,
617 /* Try again with a shorter string (Win9X truncates this packet) */
618 if (ntlmssp_state
->unicode
) {
619 parse_string
= "CdBBUUU";
621 parse_string
= "CdBBAAA";
624 /* now the NTLMSSP encoded auth hashes */
625 if (!msrpc_parse(ntlmssp_state
, &request
, parse_string
,
628 &ntlmssp_state
->lm_resp
,
629 &ntlmssp_state
->nt_resp
,
630 &ntlmssp_state
->domain
,
631 &ntlmssp_state
->user
,
632 &ntlmssp_state
->client
.netbios_name
)) {
633 DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP (tried both formats):\n"));
634 dump_data(2, request
.data
, request
.length
);
636 return NT_STATUS_INVALID_PARAMETER
;
641 ntlmssp_handle_neg_flags(ntlmssp_state
, auth_flags
, lp_lanman_auth());
643 if (DEBUGLEVEL
>= 10) {
644 if (NT_STATUS_IS_OK(ntlmssp_pull_AUTHENTICATE_MESSAGE(&request
,
648 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE
, &authenticate
);
652 DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
653 ntlmssp_state
->user
, ntlmssp_state
->domain
,
654 ntlmssp_state
->client
.netbios_name
,
655 (unsigned long)ntlmssp_state
->lm_resp
.length
,
656 (unsigned long)ntlmssp_state
->nt_resp
.length
));
659 file_save("nthash1.dat", &ntlmssp_state
->nt_resp
.data
, &ntlmssp_state
->nt_resp
.length
);
660 file_save("lmhash1.dat", &ntlmssp_state
->lm_resp
.data
, &ntlmssp_state
->lm_resp
.length
);
663 /* NTLM2 uses a 'challenge' that is made of up both the server challenge, and a
666 However, the NTLM2 flag may still be set for the real NTLMv2 logins, be careful.
668 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
) {
669 if (ntlmssp_state
->nt_resp
.length
== 24 && ntlmssp_state
->lm_resp
.length
== 24) {
670 struct MD5Context md5_session_nonce_ctx
;
671 SMB_ASSERT(ntlmssp_state
->internal_chal
.data
&& ntlmssp_state
->internal_chal
.length
== 8);
675 memcpy(session_nonce
, ntlmssp_state
->internal_chal
.data
, 8);
676 memcpy(&session_nonce
[8], ntlmssp_state
->lm_resp
.data
, 8);
678 MD5Init(&md5_session_nonce_ctx
);
679 MD5Update(&md5_session_nonce_ctx
, session_nonce
, 16);
680 MD5Final(session_nonce_hash
, &md5_session_nonce_ctx
);
682 ntlmssp_state
->chal
= data_blob_talloc(
683 ntlmssp_state
, session_nonce_hash
, 8);
685 /* LM response is no longer useful */
686 data_blob_free(&ntlmssp_state
->lm_resp
);
688 /* We changed the effective challenge - set it */
689 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_state
->set_challenge(ntlmssp_state
, &ntlmssp_state
->chal
))) {
690 data_blob_free(&encrypted_session_key
);
694 /* LM Key is incompatible. */
695 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_LM_KEY
;
700 * Note we don't check here for NTLMv2 auth settings. If NTLMv2 auth
701 * is required (by "ntlm auth = no" and "lm auth = no" being set in the
702 * smb.conf file) and no NTLMv2 response was sent then the password check
703 * will fail here. JRA.
706 /* Finally, actually ask if the password is OK */
708 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_state
->check_password(ntlmssp_state
,
709 &user_session_key
, &lm_session_key
))) {
710 data_blob_free(&encrypted_session_key
);
714 dump_data_pw("NT session key:\n", user_session_key
.data
, user_session_key
.length
);
715 dump_data_pw("LM first-8:\n", lm_session_key
.data
, lm_session_key
.length
);
717 /* Handle the different session key derivation for NTLM2 */
719 if (user_session_key
.data
&& user_session_key
.length
== 16) {
720 session_key
= data_blob_talloc(ntlmssp_state
,
722 hmac_md5(user_session_key
.data
, session_nonce
,
723 sizeof(session_nonce
), session_key
.data
);
724 DEBUG(10,("ntlmssp_server_auth: Created NTLM2 session key.\n"));
725 dump_data_pw("NTLM2 session key:\n", session_key
.data
, session_key
.length
);
728 DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM2 session key.\n"));
729 session_key
= data_blob_null
;
731 } else if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
) {
732 if (lm_session_key
.data
&& lm_session_key
.length
>= 8) {
733 if (ntlmssp_state
->lm_resp
.data
&& ntlmssp_state
->lm_resp
.length
== 24) {
734 session_key
= data_blob_talloc(ntlmssp_state
,
736 if (session_key
.data
== NULL
) {
737 return NT_STATUS_NO_MEMORY
;
739 SMBsesskeygen_lm_sess_key(lm_session_key
.data
, ntlmssp_state
->lm_resp
.data
,
741 DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
743 static const uint8_t zeros
[24] = {0, };
744 session_key
= data_blob_talloc(
745 ntlmssp_state
, NULL
, 16);
746 if (session_key
.data
== NULL
) {
747 return NT_STATUS_NO_MEMORY
;
749 SMBsesskeygen_lm_sess_key(
750 lm_session_key
.data
, zeros
,
753 dump_data_pw("LM session key:\n", session_key
.data
,
756 DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM session key.\n"));
757 session_key
= data_blob_null
;
759 } else if (user_session_key
.data
) {
760 session_key
= user_session_key
;
761 DEBUG(10,("ntlmssp_server_auth: Using unmodified nt session key.\n"));
762 dump_data_pw("unmodified session key:\n", session_key
.data
, session_key
.length
);
763 } else if (lm_session_key
.data
) {
764 session_key
= lm_session_key
;
765 DEBUG(10,("ntlmssp_server_auth: Using unmodified lm session key.\n"));
766 dump_data_pw("unmodified session key:\n", session_key
.data
, session_key
.length
);
768 DEBUG(10,("ntlmssp_server_auth: Failed to create unmodified session key.\n"));
769 session_key
= data_blob_null
;
772 /* With KEY_EXCH, the client supplies the proposed session key,
773 but encrypts it with the long-term key */
774 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
) {
775 if (!encrypted_session_key
.data
|| encrypted_session_key
.length
!= 16) {
776 data_blob_free(&encrypted_session_key
);
777 DEBUG(1, ("Client-supplied KEY_EXCH session key was of invalid length (%u)!\n",
778 (unsigned int)encrypted_session_key
.length
));
779 return NT_STATUS_INVALID_PARAMETER
;
780 } else if (!session_key
.data
|| session_key
.length
!= 16) {
781 DEBUG(5, ("server session key is invalid (len == %u), cannot do KEY_EXCH!\n",
782 (unsigned int)session_key
.length
));
783 ntlmssp_state
->session_key
= session_key
;
785 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
786 arcfour_crypt_blob(encrypted_session_key
.data
,
787 encrypted_session_key
.length
,
789 ntlmssp_state
->session_key
= data_blob_talloc(
790 ntlmssp_state
, encrypted_session_key
.data
,
791 encrypted_session_key
.length
);
792 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key
.data
,
793 encrypted_session_key
.length
);
796 ntlmssp_state
->session_key
= session_key
;
799 if (!NT_STATUS_IS_OK(nt_status
)) {
800 ntlmssp_state
->session_key
= data_blob_null
;
801 } else if (ntlmssp_state
->session_key
.length
) {
802 nt_status
= ntlmssp_sign_init(ntlmssp_state
);
805 data_blob_free(&encrypted_session_key
);
807 /* Only one authentication allowed per server state. */
808 ntlmssp_state
->expected_state
= NTLMSSP_DONE
;
814 * Create an NTLMSSP state machine
816 * @param ntlmssp_state NTLMSSP State, allocated by this function
819 NTSTATUS
ntlmssp_server_start(TALLOC_CTX
*mem_ctx
,
821 const char *netbios_name
,
822 const char *netbios_domain
,
823 const char *dns_name
,
824 const char *dns_domain
,
825 struct ntlmssp_state
**_ntlmssp_state
)
827 struct ntlmssp_state
*ntlmssp_state
;
833 if (!netbios_domain
) {
845 ntlmssp_state
= talloc_zero(mem_ctx
, struct ntlmssp_state
);
846 if (!ntlmssp_state
) {
847 return NT_STATUS_NO_MEMORY
;
850 ntlmssp_state
->role
= NTLMSSP_SERVER
;
852 ntlmssp_state
->get_challenge
= get_challenge
;
853 ntlmssp_state
->set_challenge
= set_challenge
;
854 ntlmssp_state
->may_set_challenge
= may_set_challenge
;
856 ntlmssp_state
->server
.is_standalone
= is_standalone
;
858 ntlmssp_state
->expected_state
= NTLMSSP_NEGOTIATE
;
860 ntlmssp_state
->neg_flags
=
861 NTLMSSP_NEGOTIATE_128
|
862 NTLMSSP_NEGOTIATE_56
|
863 NTLMSSP_NEGOTIATE_VERSION
|
864 NTLMSSP_NEGOTIATE_ALWAYS_SIGN
|
865 NTLMSSP_NEGOTIATE_NTLM
|
866 NTLMSSP_NEGOTIATE_NTLM2
|
867 NTLMSSP_NEGOTIATE_KEY_EXCH
|
868 NTLMSSP_NEGOTIATE_SIGN
|
869 NTLMSSP_NEGOTIATE_SEAL
;
871 ntlmssp_state
->server
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
872 if (!ntlmssp_state
->server
.netbios_name
) {
873 talloc_free(ntlmssp_state
);
874 return NT_STATUS_NO_MEMORY
;
876 ntlmssp_state
->server
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
877 if (!ntlmssp_state
->server
.netbios_domain
) {
878 talloc_free(ntlmssp_state
);
879 return NT_STATUS_NO_MEMORY
;
881 ntlmssp_state
->server
.dns_name
= talloc_strdup(ntlmssp_state
, dns_name
);
882 if (!ntlmssp_state
->server
.dns_name
) {
883 talloc_free(ntlmssp_state
);
884 return NT_STATUS_NO_MEMORY
;
886 ntlmssp_state
->server
.dns_domain
= talloc_strdup(ntlmssp_state
, dns_domain
);
887 if (!ntlmssp_state
->server
.dns_domain
) {
888 talloc_free(ntlmssp_state
);
889 return NT_STATUS_NO_MEMORY
;
892 *_ntlmssp_state
= ntlmssp_state
;
896 /*********************************************************************
898 *********************************************************************/
901 * Next state function for the Initial packet
903 * @param ntlmssp_state NTLMSSP State
904 * @param request The request, as a DATA_BLOB. reply.data must be NULL
905 * @param request The reply, as an allocated DATA_BLOB, caller to free.
906 * @return Errors or NT_STATUS_OK.
909 static NTSTATUS
ntlmssp_client_initial(struct ntlmssp_state
*ntlmssp_state
,
910 DATA_BLOB reply
, DATA_BLOB
*next_request
)
912 struct NEGOTIATE_MESSAGE negotiate
;
914 if (ntlmssp_state
->unicode
) {
915 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_UNICODE
;
917 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_OEM
;
920 if (ntlmssp_state
->use_ntlmv2
) {
921 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_NTLM2
;
924 /* generate the ntlmssp negotiate packet */
925 msrpc_gen(ntlmssp_state
, next_request
, "CddAA",
928 ntlmssp_state
->neg_flags
,
929 ntlmssp_state
->client
.netbios_domain
,
930 ntlmssp_state
->client
.netbios_name
);
932 if (DEBUGLEVEL
>= 10) {
933 if (NT_STATUS_IS_OK(ntlmssp_pull_NEGOTIATE_MESSAGE(next_request
,
937 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE
, &negotiate
);
941 ntlmssp_state
->expected_state
= NTLMSSP_CHALLENGE
;
943 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
947 * Next state function for the Challenge Packet. Generate an auth packet.
949 * @param ntlmssp_state NTLMSSP State
950 * @param request The request, as a DATA_BLOB. reply.data must be NULL
951 * @param request The reply, as an allocated DATA_BLOB, caller to free.
952 * @return Errors or NT_STATUS_OK.
955 static NTSTATUS
ntlmssp_client_challenge(struct ntlmssp_state
*ntlmssp_state
,
956 const DATA_BLOB reply
, DATA_BLOB
*next_request
)
958 uint32_t chal_flags
, ntlmssp_command
, unkn1
, unkn2
;
959 DATA_BLOB server_domain_blob
;
960 DATA_BLOB challenge_blob
;
961 DATA_BLOB struct_blob
= data_blob_null
;
963 const char *chal_parse_string
;
964 const char *auth_gen_string
;
965 DATA_BLOB lm_response
= data_blob_null
;
966 DATA_BLOB nt_response
= data_blob_null
;
967 DATA_BLOB session_key
= data_blob_null
;
968 DATA_BLOB encrypted_session_key
= data_blob_null
;
969 NTSTATUS nt_status
= NT_STATUS_OK
;
970 struct CHALLENGE_MESSAGE challenge
;
971 struct AUTHENTICATE_MESSAGE authenticate
;
973 if (ntlmssp_state
->use_ccache
) {
974 struct wbcCredentialCacheParams params
;
975 struct wbcCredentialCacheInfo
*info
= NULL
;
976 struct wbcAuthErrorInfo
*error
= NULL
;
977 struct wbcNamedBlob auth_blob
;
978 struct wbcBlob
*wbc_next
= NULL
;
979 struct wbcBlob
*wbc_session_key
= NULL
;
983 params
.account_name
= ntlmssp_state
->user
;
984 params
.domain_name
= ntlmssp_state
->domain
;
985 params
.level
= WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP
;
987 auth_blob
.name
= "challenge_blob";
989 auth_blob
.blob
.data
= reply
.data
;
990 auth_blob
.blob
.length
= reply
.length
;
991 params
.num_blobs
= 1;
992 params
.blobs
= &auth_blob
;
994 wbc_status
= wbcCredentialCache(¶ms
, &info
, &error
);
996 wbcFreeMemory(error
);
998 if (!WBC_ERROR_IS_OK(wbc_status
)) {
1002 for (i
=0; i
<info
->num_blobs
; i
++) {
1003 if (strequal(info
->blobs
[i
].name
, "auth_blob")) {
1004 wbc_next
= &info
->blobs
[i
].blob
;
1006 if (strequal(info
->blobs
[i
].name
, "session_key")) {
1007 wbc_session_key
= &info
->blobs
[i
].blob
;
1010 if ((wbc_next
== NULL
) || (wbc_session_key
== NULL
)) {
1011 wbcFreeMemory(info
);
1015 *next_request
= data_blob(wbc_next
->data
, wbc_next
->length
);
1016 ntlmssp_state
->session_key
= data_blob(
1017 wbc_session_key
->data
, wbc_session_key
->length
);
1019 wbcFreeMemory(info
);
1025 if (!msrpc_parse(ntlmssp_state
, &reply
, "CdBd",
1028 &server_domain_blob
,
1030 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
1031 dump_data(2, reply
.data
, reply
.length
);
1033 return NT_STATUS_INVALID_PARAMETER
;
1036 if (DEBUGLEVEL
>= 10) {
1037 if (NT_STATUS_IS_OK(ntlmssp_pull_CHALLENGE_MESSAGE(&reply
,
1041 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE
, &challenge
);
1045 data_blob_free(&server_domain_blob
);
1047 DEBUG(3, ("Got challenge flags:\n"));
1048 debug_ntlmssp_flags(chal_flags
);
1050 ntlmssp_handle_neg_flags(ntlmssp_state
, chal_flags
, lp_client_lanman_auth());
1052 if (ntlmssp_state
->unicode
) {
1053 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
) {
1054 chal_parse_string
= "CdUdbddB";
1056 chal_parse_string
= "CdUdbdd";
1058 auth_gen_string
= "CdBBUUUBd";
1060 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
) {
1061 chal_parse_string
= "CdAdbddB";
1063 chal_parse_string
= "CdAdbdd";
1066 auth_gen_string
= "CdBBAAABd";
1069 DEBUG(3, ("NTLMSSP: Set final flags:\n"));
1070 debug_ntlmssp_flags(ntlmssp_state
->neg_flags
);
1072 if (!msrpc_parse(ntlmssp_state
, &reply
, chal_parse_string
,
1080 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
1081 dump_data(2, reply
.data
, reply
.length
);
1082 return NT_STATUS_INVALID_PARAMETER
;
1085 if (chal_flags
& NTLMSSP_TARGET_TYPE_SERVER
) {
1086 ntlmssp_state
->server
.is_standalone
= true;
1088 ntlmssp_state
->server
.is_standalone
= false;
1090 /* TODO: parse struct_blob and fill in the rest */
1091 ntlmssp_state
->server
.netbios_name
= "";
1092 ntlmssp_state
->server
.netbios_domain
= server_domain
;
1093 ntlmssp_state
->server
.dns_name
= "";
1094 ntlmssp_state
->server
.dns_domain
= "";
1096 if (challenge_blob
.length
!= 8) {
1097 data_blob_free(&struct_blob
);
1098 return NT_STATUS_INVALID_PARAMETER
;
1101 if (!ntlmssp_state
->nt_hash
|| !ntlmssp_state
->lm_hash
) {
1102 static const uint8_t zeros
[16] = {0, };
1103 /* do nothing - blobs are zero length */
1105 /* session key is all zeros */
1106 session_key
= data_blob_talloc(ntlmssp_state
, zeros
, 16);
1108 /* not doing NLTM2 without a password */
1109 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
1110 } else if (ntlmssp_state
->use_ntlmv2
) {
1111 if (!struct_blob
.length
) {
1112 /* be lazy, match win2k - we can't do NTLMv2 without it */
1113 DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
1114 return NT_STATUS_INVALID_PARAMETER
;
1117 /* TODO: if the remote server is standalone, then we should replace 'domain'
1118 with the server name as supplied above */
1120 if (!SMBNTLMv2encrypt_hash(ntlmssp_state
,
1121 ntlmssp_state
->user
,
1122 ntlmssp_state
->domain
,
1123 ntlmssp_state
->nt_hash
, &challenge_blob
,
1125 &lm_response
, &nt_response
, NULL
,
1127 data_blob_free(&challenge_blob
);
1128 data_blob_free(&struct_blob
);
1129 return NT_STATUS_NO_MEMORY
;
1131 } else if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
) {
1132 struct MD5Context md5_session_nonce_ctx
;
1133 uint8_t session_nonce
[16];
1134 uint8_t session_nonce_hash
[16];
1135 uint8_t user_session_key
[16];
1137 lm_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1138 generate_random_buffer(lm_response
.data
, 8);
1139 memset(lm_response
.data
+8, 0, 16);
1141 memcpy(session_nonce
, challenge_blob
.data
, 8);
1142 memcpy(&session_nonce
[8], lm_response
.data
, 8);
1144 MD5Init(&md5_session_nonce_ctx
);
1145 MD5Update(&md5_session_nonce_ctx
, challenge_blob
.data
, 8);
1146 MD5Update(&md5_session_nonce_ctx
, lm_response
.data
, 8);
1147 MD5Final(session_nonce_hash
, &md5_session_nonce_ctx
);
1149 DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
1150 DEBUG(5, ("challenge is: \n"));
1151 dump_data(5, session_nonce_hash
, 8);
1153 nt_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1154 SMBNTencrypt_hash(ntlmssp_state
->nt_hash
,
1158 session_key
= data_blob_talloc(ntlmssp_state
, NULL
, 16);
1160 SMBsesskeygen_ntv1(ntlmssp_state
->nt_hash
, user_session_key
);
1161 hmac_md5(user_session_key
, session_nonce
, sizeof(session_nonce
), session_key
.data
);
1162 dump_data_pw("NTLM2 session key:\n", session_key
.data
, session_key
.length
);
1164 /* lanman auth is insecure, it may be disabled */
1165 if (lp_client_lanman_auth()) {
1166 lm_response
= data_blob_talloc(ntlmssp_state
,
1168 SMBencrypt_hash(ntlmssp_state
->lm_hash
,challenge_blob
.data
,
1172 nt_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1173 SMBNTencrypt_hash(ntlmssp_state
->nt_hash
,challenge_blob
.data
,
1176 session_key
= data_blob_talloc(ntlmssp_state
, NULL
, 16);
1177 if ((ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
)
1178 && lp_client_lanman_auth()) {
1179 SMBsesskeygen_lm_sess_key(ntlmssp_state
->lm_hash
, lm_response
.data
,
1181 dump_data_pw("LM session key\n", session_key
.data
, session_key
.length
);
1183 SMBsesskeygen_ntv1(ntlmssp_state
->nt_hash
, session_key
.data
);
1184 dump_data_pw("NT session key:\n", session_key
.data
, session_key
.length
);
1187 data_blob_free(&struct_blob
);
1189 /* Key exchange encryptes a new client-generated session key with
1190 the password-derived key */
1191 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
) {
1192 /* Make up a new session key */
1193 uint8_t client_session_key
[16];
1194 generate_random_buffer(client_session_key
, sizeof(client_session_key
));
1196 /* Encrypt the new session key with the old one */
1197 encrypted_session_key
= data_blob(client_session_key
, sizeof(client_session_key
));
1198 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
1199 arcfour_crypt_blob(encrypted_session_key
.data
, encrypted_session_key
.length
, &session_key
);
1200 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
1202 /* Mark the new session key as the 'real' session key */
1203 data_blob_free(&session_key
);
1204 session_key
= data_blob_talloc(ntlmssp_state
,
1206 sizeof(client_session_key
));
1209 /* this generates the actual auth packet */
1210 if (!msrpc_gen(ntlmssp_state
, next_request
, auth_gen_string
,
1213 lm_response
.data
, lm_response
.length
,
1214 nt_response
.data
, nt_response
.length
,
1215 ntlmssp_state
->domain
,
1216 ntlmssp_state
->user
,
1217 ntlmssp_state
->client
.netbios_name
,
1218 encrypted_session_key
.data
, encrypted_session_key
.length
,
1219 ntlmssp_state
->neg_flags
)) {
1221 return NT_STATUS_NO_MEMORY
;
1224 if (DEBUGLEVEL
>= 10) {
1225 if (NT_STATUS_IS_OK(ntlmssp_pull_AUTHENTICATE_MESSAGE(next_request
,
1229 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE
, &authenticate
);
1233 data_blob_free(&encrypted_session_key
);
1235 data_blob_free(&ntlmssp_state
->chal
);
1237 ntlmssp_state
->session_key
= session_key
;
1239 ntlmssp_state
->chal
= challenge_blob
;
1240 ntlmssp_state
->lm_resp
= lm_response
;
1241 ntlmssp_state
->nt_resp
= nt_response
;
1245 ntlmssp_state
->expected_state
= NTLMSSP_DONE
;
1247 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_sign_init(ntlmssp_state
))) {
1248 DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status
)));
1254 NTSTATUS
ntlmssp_client_start(TALLOC_CTX
*mem_ctx
,
1255 const char *netbios_name
,
1256 const char *netbios_domain
,
1258 struct ntlmssp_state
**_ntlmssp_state
)
1260 struct ntlmssp_state
*ntlmssp_state
;
1262 if (!netbios_name
) {
1266 if (!netbios_domain
) {
1267 netbios_domain
= "";
1270 ntlmssp_state
= talloc_zero(mem_ctx
, struct ntlmssp_state
);
1271 if (!ntlmssp_state
) {
1272 return NT_STATUS_NO_MEMORY
;
1275 ntlmssp_state
->role
= NTLMSSP_CLIENT
;
1277 ntlmssp_state
->unicode
= True
;
1279 ntlmssp_state
->use_ntlmv2
= use_ntlmv2
;
1281 ntlmssp_state
->expected_state
= NTLMSSP_INITIAL
;
1283 ntlmssp_state
->neg_flags
=
1284 NTLMSSP_NEGOTIATE_128
|
1285 NTLMSSP_NEGOTIATE_ALWAYS_SIGN
|
1286 NTLMSSP_NEGOTIATE_NTLM
|
1287 NTLMSSP_NEGOTIATE_NTLM2
|
1288 NTLMSSP_NEGOTIATE_KEY_EXCH
|
1289 NTLMSSP_REQUEST_TARGET
;
1291 ntlmssp_state
->client
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
1292 if (!ntlmssp_state
->client
.netbios_name
) {
1293 talloc_free(ntlmssp_state
);
1294 return NT_STATUS_NO_MEMORY
;
1296 ntlmssp_state
->client
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
1297 if (!ntlmssp_state
->client
.netbios_domain
) {
1298 talloc_free(ntlmssp_state
);
1299 return NT_STATUS_NO_MEMORY
;
1302 *_ntlmssp_state
= ntlmssp_state
;
1303 return NT_STATUS_OK
;