source3/libsmb/ntlmssp_sign.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Version 3.0
   4  *  NTLMSSP Signing routines
   5  *  Copyright (C) Andrew Bartlett 2003-2005
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 3 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "ntlmssp.h"
  23 #include "../libcli/auth/libcli_auth.h"
  24
  25 #define CLI_SIGN "session key to client-to-server signing key magic constant"
  26 #define CLI_SEAL "session key to client-to-server sealing key magic constant"
  27 #define SRV_SIGN "session key to server-to-client signing key magic constant"
  28 #define SRV_SEAL "session key to server-to-client sealing key magic constant"
  29
  30 /**
  31  * Some notes on the NTLM2 code:
  32  *
  33  * NTLM2 is a AEAD system.  This means that the data encrypted is not
  34  * all the data that is signed.  In DCE-RPC case, the headers of the
  35  * DCE-RPC packets are also signed.  This prevents some of the
  36  * fun-and-games one might have by changing them.
  37  *
  38  */
  39
  40 static void dump_arc4_state(const char *description,
  41                             struct arcfour_state *state)
  42 {
  43         dump_data_pw(description, state->sbox, sizeof(state->sbox));
  44 }
  45
  46 static void calc_ntlmv2_key(uint8_t subkey[16],
  47                             DATA_BLOB session_key,
  48                             const char *constant)
  49 {
  50         struct MD5Context ctx3;
  51         MD5Init(&ctx3);
  52         MD5Update(&ctx3, session_key.data, session_key.length);
  53         MD5Update(&ctx3, (const uint8_t *)constant, strlen(constant)+1);
  54         MD5Final(subkey, &ctx3);
  55 }
  56
  57 enum ntlmssp_direction {
  58         NTLMSSP_SEND,
  59         NTLMSSP_RECEIVE
  60 };
  61
  62 static NTSTATUS ntlmssp_make_packet_signature(struct ntlmssp_state *ntlmssp_state,
  63                                               const uint8_t *data, size_t length,
  64                                               const uint8_t *whole_pdu, size_t pdu_length,
  65                                               enum ntlmssp_direction direction,
  66                                               DATA_BLOB *sig, bool encrypt_sig)
  67 {
  68         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
  69                 HMACMD5Context ctx;
  70                 uint8_t digest[16];
  71                 uint8_t seq_num[4];
  72
  73                 *sig = data_blob(NULL, NTLMSSP_SIG_SIZE);
  74                 if (!sig->data) {
  75                         return NT_STATUS_NO_MEMORY;
  76                 }
  77
  78                 switch (direction) {
  79                 case NTLMSSP_SEND:
  80                         DEBUG(100,("ntlmssp_make_packet_signature: SEND seq = %u, len = %u, pdu_len = %u\n",
  81                                 ntlmssp_state->ntlm2_send_seq_num,
  82                                 (unsigned int)length,
  83                                 (unsigned int)pdu_length));
  84
  85                         SIVAL(seq_num, 0, ntlmssp_state->ntlm2_send_seq_num);
  86                         ntlmssp_state->ntlm2_send_seq_num++;
  87                         hmac_md5_init_limK_to_64(ntlmssp_state->send_sign_key, 16, &ctx);
  88                         break;
  89                 case NTLMSSP_RECEIVE:
  90
  91                         DEBUG(100,("ntlmssp_make_packet_signature: RECV seq = %u, len = %u, pdu_len = %u\n",
  92                                 ntlmssp_state->ntlm2_recv_seq_num,
  93                                 (unsigned int)length,
  94                                 (unsigned int)pdu_length));
  95
  96                         SIVAL(seq_num, 0, ntlmssp_state->ntlm2_recv_seq_num);
  97                         ntlmssp_state->ntlm2_recv_seq_num++;
  98                         hmac_md5_init_limK_to_64(ntlmssp_state->recv_sign_key, 16, &ctx);
  99                         break;
 100                 }
 101
 102                 dump_data_pw("pdu data ", whole_pdu, pdu_length);
 103
 104                 hmac_md5_update(seq_num, sizeof(seq_num), &ctx);
 105                 hmac_md5_update(whole_pdu, pdu_length, &ctx);
 106                 hmac_md5_final(digest, &ctx);
 107
 108                 if (encrypt_sig && (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
 109                         switch (direction) {
 110                         case NTLMSSP_SEND:
 111                                 arcfour_crypt_sbox(&ntlmssp_state->send_seal_arc4_state,
 112                                                    digest, 8);
 113                                 break;
 114                         case NTLMSSP_RECEIVE:
 115                                 arcfour_crypt_sbox(&ntlmssp_state->recv_seal_arc4_state,
 116                                                    digest, 8);
 117                                 break;
 118                         }
 119                 }
 120
 121                 SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION);
 122                 memcpy(sig->data + 4, digest, 8);
 123                 memcpy(sig->data + 12, seq_num, 4);
 124
 125                 dump_data_pw("ntlmssp v2 sig ", sig->data, sig->length);
 126
 127         } else {
 128                 bool ok;
 129                 uint32_t crc;
 130
 131                 crc = crc32_calc_buffer(data, length);
 132
 133                 ok = msrpc_gen(ntlmssp_state,
 134                                sig, "dddd",
 135                                NTLMSSP_SIGN_VERSION, 0, crc,
 136                                ntlmssp_state->ntlmv1_seq_num);
 137                 if (!ok) {
 138                         return NT_STATUS_NO_MEMORY;
 139                 }
 140
 141                 ntlmssp_state->ntlmv1_seq_num++;
 142
 143                 dump_arc4_state("ntlmssp hash: \n",
 144                                 &ntlmssp_state->ntlmv1_arc4_state);
 145                 arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state,
 146                                    sig->data+4, sig->length-4);
 147         }
 148         return NT_STATUS_OK;
 149 }
 150
 151 NTSTATUS ntlmssp_sign_packet(struct ntlmssp_state *ntlmssp_state,
 152                              const uint8_t *data, size_t length,
 153                              const uint8_t *whole_pdu, size_t pdu_length,
 154                              DATA_BLOB *sig)
 155 {
 156         NTSTATUS nt_status;
 157
 158         if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 159                 DEBUG(3, ("NTLMSSP Signing not negotiated - cannot sign packet!\n"));
 160                 return NT_STATUS_INVALID_PARAMETER;
 161         }
 162
 163         if (!ntlmssp_state->session_key.length) {
 164                 DEBUG(3, ("NO session key, cannot check sign packet\n"));
 165                 return NT_STATUS_NO_USER_SESSION_KEY;
 166         }
 167
 168         nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 169                                                   data, length,
 170                                                   whole_pdu, pdu_length,
 171                                                   NTLMSSP_SEND, sig, true);
 172
 173         return nt_status;
 174 }
 175
 176 /**
 177  * Check the signature of an incoming packet
 178  * @note caller *must* check that the signature is the size it expects
 179  *
 180  */
 181
 182 NTSTATUS ntlmssp_check_packet(struct ntlmssp_state *ntlmssp_state,
 183                               const uint8_t *data, size_t length,
 184                               const uint8_t *whole_pdu, size_t pdu_length,
 185                               const DATA_BLOB *sig)
 186 {
 187         DATA_BLOB local_sig;
 188         NTSTATUS nt_status;
 189
 190         if (!ntlmssp_state->session_key.length) {
 191                 DEBUG(3, ("NO session key, cannot check packet signature\n"));
 192                 return NT_STATUS_NO_USER_SESSION_KEY;
 193         }
 194
 195         if (sig->length < 8) {
 196                 DEBUG(0, ("NTLMSSP packet check failed due to short signature (%lu bytes)!\n",
 197                           (unsigned long)sig->length));
 198         }
 199
 200         nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 201                                                   data, length,
 202                                                   whole_pdu, pdu_length,
 203                                                   NTLMSSP_RECEIVE,
 204                                                   &local_sig, true);
 205
 206         if (!NT_STATUS_IS_OK(nt_status)) {
 207                 DEBUG(0,("NTLMSSP packet sig creation failed with %s\n",
 208                          nt_errstr(nt_status)));
 209                 data_blob_free(&local_sig);
 210                 return nt_status;
 211         }
 212
 213         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 214                 if (local_sig.length != sig->length ||
 215                     memcmp(local_sig.data, sig->data, sig->length) != 0) {
 216                         DEBUG(5, ("BAD SIG NTLM2: wanted signature of\n"));
 217                         dump_data(5, local_sig.data, local_sig.length);
 218
 219                         DEBUG(5, ("BAD SIG: got signature of\n"));
 220                         dump_data(5, sig->data, sig->length);
 221
 222                         DEBUG(0, ("NTLMSSP NTLM2 packet check failed due to invalid signature!\n"));
 223                         data_blob_free(&local_sig);
 224                         return NT_STATUS_ACCESS_DENIED;
 225                 }
 226         } else {
 227                 if (local_sig.length != sig->length ||
 228                     memcmp(local_sig.data + 8, sig->data + 8, sig->length - 8) != 0) {
 229                         DEBUG(5, ("BAD SIG NTLM1: wanted signature of\n"));
 230                         dump_data(5, local_sig.data, local_sig.length);
 231
 232                         DEBUG(5, ("BAD SIG: got signature of\n"));
 233                         dump_data(5, sig->data, sig->length);
 234
 235                         DEBUG(0, ("NTLMSSP NTLM1 packet check failed due to invalid signature!\n"));
 236                         data_blob_free(&local_sig);
 237                         return NT_STATUS_ACCESS_DENIED;
 238                 }
 239         }
 240         dump_data_pw("checked ntlmssp signature\n", sig->data, sig->length);
 241         DEBUG(10,("ntlmssp_check_packet: NTLMSSP signature OK !\n"));
 242
 243         data_blob_free(&local_sig);
 244         return NT_STATUS_OK;
 245 }
 246
 247 /**
 248  * Seal data with the NTLMSSP algorithm
 249  *
 250  */
 251
 252 NTSTATUS ntlmssp_seal_packet(struct ntlmssp_state *ntlmssp_state,
 253                              uint8_t *data, size_t length,
 254                              const uint8_t *whole_pdu, size_t pdu_length,
 255                              DATA_BLOB *sig)
 256 {
 257         if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 258                 DEBUG(3, ("NTLMSSP Sealing not negotiated - cannot seal packet!\n"));
 259                 return NT_STATUS_INVALID_PARAMETER;
 260         }
 261
 262         if (!ntlmssp_state->session_key.length) {
 263                 DEBUG(3, ("NO session key, cannot seal packet\n"));
 264                 return NT_STATUS_NO_USER_SESSION_KEY;
 265         }
 266
 267         DEBUG(10,("ntlmssp_seal_data: seal\n"));
 268         dump_data_pw("ntlmssp clear data\n", data, length);
 269         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 270                 NTSTATUS nt_status;
 271                 /*
 272                  * The order of these two operations matters - we
 273                  * must first seal the packet, then seal the
 274                  * sequence number - this is because the
 275                  * send_seal_hash is not constant, but is is rather
 276                  * updated with each iteration
 277                  */
 278                 nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 279                                                           data, length,
 280                                                           whole_pdu, pdu_length,
 281                                                           NTLMSSP_SEND,
 282                                                           sig, false);
 283                 if (!NT_STATUS_IS_OK(nt_status)) {
 284                         return nt_status;
 285                 }
 286
 287                 arcfour_crypt_sbox(&ntlmssp_state->send_seal_arc4_state,
 288                                    data, length);
 289                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
 290                         arcfour_crypt_sbox(&ntlmssp_state->send_seal_arc4_state,
 291                                            sig->data+4, 8);
 292                 }
 293         } else {
 294                 bool ok;
 295                 uint32_t crc;
 296
 297                 crc = crc32_calc_buffer(data, length);
 298
 299                 ok = msrpc_gen(ntlmssp_state,
 300                                sig, "dddd",
 301                                NTLMSSP_SIGN_VERSION, 0, crc,
 302                                ntlmssp_state->ntlmv1_seq_num);
 303                 if (!ok) {
 304                         return NT_STATUS_NO_MEMORY;
 305                 }
 306
 307                 /*
 308                  * The order of these two operations matters - we
 309                  * must first seal the packet, then seal the
 310                  * sequence number - this is because the ntlmv1_arc4_state
 311                  * is not constant, but is is rather updated with
 312                  * each iteration
 313                  */
 314
 315                 dump_arc4_state("ntlmv1 arc4 state:\n",
 316                                 &ntlmssp_state->ntlmv1_arc4_state);
 317                 arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state,
 318                                    data, length);
 319
 320                 dump_arc4_state("ntlmv1 arc4 state:\n",
 321                                 &ntlmssp_state->ntlmv1_arc4_state);
 322
 323                 arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state,
 324                                    sig->data+4, sig->length-4);
 325
 326                 ntlmssp_state->ntlmv1_seq_num++;
 327         }
 328         dump_data_pw("ntlmssp signature\n", sig->data, sig->length);
 329         dump_data_pw("ntlmssp sealed data\n", data, length);
 330
 331         return NT_STATUS_OK;
 332 }
 333
 334 /**
 335  * Unseal data with the NTLMSSP algorithm
 336  *
 337  */
 338
 339 NTSTATUS ntlmssp_unseal_packet(struct ntlmssp_state *ntlmssp_state,
 340                                uint8_t *data, size_t length,
 341                                const uint8_t *whole_pdu, size_t pdu_length,
 342                                const DATA_BLOB *sig)
 343 {
 344         if (!ntlmssp_state->session_key.length) {
 345                 DEBUG(3, ("NO session key, cannot unseal packet\n"));
 346                 return NT_STATUS_NO_USER_SESSION_KEY;
 347         }
 348
 349         DEBUG(10,("ntlmssp_unseal_packet: seal\n"));
 350         dump_data_pw("ntlmssp sealed data\n", data, length);
 351
 352         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 353                 /* First unseal the data. */
 354                 arcfour_crypt_sbox(&ntlmssp_state->recv_seal_arc4_state,
 355                                    data, length);
 356                 dump_data_pw("ntlmv2 clear data\n", data, length);
 357         } else {
 358                 arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state,
 359                                    data, length);
 360                 dump_data_pw("ntlmv1 clear data\n", data, length);
 361         }
 362         return ntlmssp_check_packet(ntlmssp_state, data, length, whole_pdu, pdu_length, sig);
 363 }
 364
 365 /**
 366    Initialise the state for NTLMSSP signing.
 367 */
 368 NTSTATUS ntlmssp_sign_init(struct ntlmssp_state *ntlmssp_state)
 369 {
 370         DEBUG(3, ("NTLMSSP Sign/Seal - Initialising with flags:\n"));
 371         debug_ntlmssp_flags(ntlmssp_state->neg_flags);
 372
 373         if (ntlmssp_state->session_key.length < 8) {
 374                 DEBUG(3, ("NO session key, cannot intialise signing\n"));
 375                 return NT_STATUS_NO_USER_SESSION_KEY;
 376         }
 377
 378         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 379                 DATA_BLOB weak_session_key = ntlmssp_state->session_key;
 380                 const char *send_sign_const;
 381                 const char *send_seal_const;
 382                 const char *recv_sign_const;
 383                 const char *recv_seal_const;
 384                 uint8_t send_seal_key[16];
 385                 DATA_BLOB send_seal_blob = data_blob_const(send_seal_key,
 386                                            sizeof(send_seal_key));
 387                 uint8_t recv_seal_key[16];
 388                 DATA_BLOB recv_seal_blob = data_blob_const(recv_seal_key,
 389                                            sizeof(recv_seal_key));
 390
 391                 switch (ntlmssp_state->role) {
 392                 case NTLMSSP_CLIENT:
 393                         send_sign_const = CLI_SIGN;
 394                         send_seal_const = CLI_SEAL;
 395                         recv_sign_const = SRV_SIGN;
 396                         recv_seal_const = SRV_SEAL;
 397                         break;
 398                 case NTLMSSP_SERVER:
 399                         send_sign_const = SRV_SIGN;
 400                         send_seal_const = SRV_SEAL;
 401                         recv_sign_const = CLI_SIGN;
 402                         recv_seal_const = CLI_SEAL;
 403                         break;
 404                 default:
 405                         return NT_STATUS_INTERNAL_ERROR;
 406                 }
 407
 408                 /*
 409                  * Weaken NTLMSSP keys to cope with down-level
 410                  * clients, servers and export restrictions.
 411                  *
 412                  * We probably should have some parameters to
 413                  * control this, once we get NTLM2 working.
 414                  *
 415                  * Key weakening was not performed on the master key
 416                  * for NTLM2, but must be done on the encryption subkeys only.
 417                  */
 418
 419                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
 420                         /* nothing to do */
 421                 } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
 422                         weak_session_key.length = 7;
 423                 } else { /* forty bits */
 424                         weak_session_key.length = 5;
 425                 }
 426
 427                 dump_data_pw("NTLMSSP weakend master key:\n",
 428                              weak_session_key.data,
 429                              weak_session_key.length);
 430
 431                 /* SEND: sign key */
 432                 calc_ntlmv2_key(ntlmssp_state->send_sign_key,
 433                                 ntlmssp_state->session_key, send_sign_const);
 434                 dump_data_pw("NTLMSSP send sign key:\n",
 435                              ntlmssp_state->send_sign_key, 16);
 436
 437                 /* SEND: seal ARCFOUR pad */
 438                 calc_ntlmv2_key(send_seal_key,
 439                                 weak_session_key, send_seal_const);
 440                 dump_data_pw("NTLMSSP send seal key:\n", send_seal_key, 16);
 441
 442                 arcfour_init(&ntlmssp_state->send_seal_arc4_state,
 443                              &send_seal_blob);
 444
 445                 dump_arc4_state("NTLMSSP send seal arc4 state:\n",
 446                                 &ntlmssp_state->send_seal_arc4_state);
 447
 448                 /* SEND: seq num */
 449                 ntlmssp_state->ntlm2_send_seq_num = 0;
 450
 451                 /* RECV: sign key */
 452                 calc_ntlmv2_key(ntlmssp_state->recv_sign_key,
 453                                 ntlmssp_state->session_key, recv_sign_const);
 454                 dump_data_pw("NTLMSSP recv sign key:\n",
 455                              ntlmssp_state->recv_sign_key, 16);
 456
 457                 /* RECV: seal ARCFOUR pad */
 458                 calc_ntlmv2_key(recv_seal_key,
 459                                 weak_session_key, recv_seal_const);
 460                 dump_data_pw("NTLMSSP recv seal key:\n", recv_seal_key, 16);
 461
 462                 arcfour_init(&ntlmssp_state->recv_seal_arc4_state,
 463                              &recv_seal_blob);
 464
 465                 dump_arc4_state("NTLMSSP recv seal arc4 state:\n",
 466                                 &ntlmssp_state->recv_seal_arc4_state);
 467
 468                 /* RECV: seq num */
 469                 ntlmssp_state->ntlm2_recv_seq_num = 0;
 470         } else {
 471                 uint8_t weak_session_key[8];
 472                 DATA_BLOB seal_session_key = ntlmssp_state->session_key;
 473                 bool do_weak = false;
 474
 475                 DEBUG(5, ("NTLMSSP Sign/Seal - using NTLM1\n"));
 476
 477                 /*
 478                  * Key weakening not performed on the master key for NTLM2
 479                  * and does not occour for NTLM1. Therefore we only need
 480                  * to do this for the LM_KEY.
 481                  */
 482                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
 483                         do_weak = true;
 484                 }
 485
 486                 /*
 487                  * Nothing to weaken.
 488                  * We certainly don't want to 'extend' the length...
 489                  */
 490                 if (seal_session_key.length < 16) {
 491                         /* TODO: is this really correct? */
 492                         do_weak = false;
 493                 }
 494
 495                 if (do_weak) {
 496                         memcpy(weak_session_key, seal_session_key.data, 8);
 497                         seal_session_key = data_blob_const(weak_session_key, 8);
 498
 499                         /*
 500                          * LM key doesn't support 128 bit crypto, so this is
 501                          * the best we can do. If you negotiate 128 bit, but
 502                          * not 56, you end up with 40 bit...
 503                          */
 504                         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
 505                                 weak_session_key[7] = 0xa0;
 506                         } else { /* forty bits */
 507                                 weak_session_key[5] = 0xe5;
 508                                 weak_session_key[6] = 0x38;
 509                                 weak_session_key[7] = 0xb0;
 510                         }
 511                 }
 512
 513                 arcfour_init(&ntlmssp_state->ntlmv1_arc4_state,
 514                              &seal_session_key);
 515
 516                 dump_arc4_state("NTLMv1 arc4 state:\n",
 517                                 &ntlmssp_state->ntlmv1_arc4_state);
 518
 519                 ntlmssp_state->ntlmv1_seq_num = 0;
 520         }
 521
 522         return NT_STATUS_OK;
 523 }