source3/auth/auth_ntlmssp.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle NLTMSSP, server side
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett 2001-2003
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "../libcli/auth/ntlmssp.h"
  25
  26 struct auth_ntlmssp_state {
  27         TALLOC_CTX *mem_ctx;
  28         struct auth_context *auth_context;
  29         struct auth_serversupplied_info *server_info;
  30         struct ntlmssp_state *ntlmssp_state;
  31 };
  32
  33 NTSTATUS auth_ntlmssp_sign_packet(struct auth_ntlmssp_state *auth_ntlmssp_state,
  34                                   TALLOC_CTX *sig_mem_ctx,
  35                                   const uint8_t *data, size_t length,
  36                                   const uint8_t *whole_pdu, size_t pdu_length,
  37                                   DATA_BLOB *sig)
  38 {
  39         return ntlmssp_sign_packet(auth_ntlmssp_state->ntlmssp_state, sig_mem_ctx, data, length, whole_pdu, pdu_length, sig);
  40 }
  41
  42 NTSTATUS auth_ntlmssp_check_packet(struct auth_ntlmssp_state *auth_ntlmssp_state,
  43                                    const uint8_t *data, size_t length,
  44                                    const uint8_t *whole_pdu, size_t pdu_length,
  45                                    const DATA_BLOB *sig)
  46 {
  47         return ntlmssp_check_packet(auth_ntlmssp_state->ntlmssp_state, data, length, whole_pdu, pdu_length, sig);
  48 }
  49
  50 NTSTATUS auth_ntlmssp_seal_packet(struct auth_ntlmssp_state *auth_ntlmssp_state,
  51                                   TALLOC_CTX *sig_mem_ctx,
  52                                   uint8_t *data, size_t length,
  53                                   const uint8_t *whole_pdu, size_t pdu_length,
  54                                   DATA_BLOB *sig)
  55 {
  56         return ntlmssp_seal_packet(auth_ntlmssp_state->ntlmssp_state, sig_mem_ctx, data, length, whole_pdu, pdu_length, sig);
  57 }
  58
  59 NTSTATUS auth_ntlmssp_unseal_packet(struct auth_ntlmssp_state *auth_ntlmssp_state,
  60                                     uint8_t *data, size_t length,
  61                                     const uint8_t *whole_pdu, size_t pdu_length,
  62                                     const DATA_BLOB *sig)
  63 {
  64         return ntlmssp_unseal_packet(auth_ntlmssp_state->ntlmssp_state, data, length, whole_pdu, pdu_length, sig);
  65 }
  66
  67 bool auth_ntlmssp_negotiated_sign(struct auth_ntlmssp_state *auth_ntlmssp_state)
  68 {
  69         return auth_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN;
  70 }
  71
  72 bool auth_ntlmssp_negotiated_seal(struct auth_ntlmssp_state *auth_ntlmssp_state)
  73 {
  74         return auth_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL;
  75 }
  76
  77 struct auth_serversupplied_info *auth_ntlmssp_server_info(TALLOC_CTX *mem_ctx,
  78                                                           struct auth_ntlmssp_state *auth_ntlmssp_state)
  79 {
  80         struct auth_serversupplied_info *server_info = auth_ntlmssp_state->server_info;
  81         data_blob_free(&server_info->user_session_key);
  82         server_info->user_session_key =
  83                 data_blob_talloc(
  84                         server_info,
  85                         auth_ntlmssp_state->ntlmssp_state->session_key.data,
  86                         auth_ntlmssp_state->ntlmssp_state->session_key.length);
  87         if (auth_ntlmssp_state->ntlmssp_state->session_key.length && !server_info->user_session_key.data) {
  88                 return NULL;
  89         }
  90         auth_ntlmssp_state->server_info = NULL;
  91         return talloc_steal(mem_ctx, server_info);
  92 }
  93
  94 struct ntlmssp_state *auth_ntlmssp_get_ntlmssp_state(struct auth_ntlmssp_state *auth_ntlmssp_state)
  95 {
  96         return auth_ntlmssp_state->ntlmssp_state;
  97 }
  98
  99 /* Needed for 'map to guest' and 'smb username' processing */
 100 const char *auth_ntlmssp_get_username(struct auth_ntlmssp_state *auth_ntlmssp_state)
 101 {
 102         return auth_ntlmssp_state->ntlmssp_state->user;
 103 }
 104
 105 const char *auth_ntlmssp_get_domain(struct auth_ntlmssp_state *auth_ntlmssp_state)
 106 {
 107         return auth_ntlmssp_state->ntlmssp_state->domain;
 108 }
 109
 110 const char *auth_ntlmssp_get_client(struct auth_ntlmssp_state *auth_ntlmssp_state)
 111 {
 112         return auth_ntlmssp_state->ntlmssp_state->client.netbios_name;
 113 }
 114
 115 /**
 116  * Return the challenge as determined by the authentication subsystem
 117  * @return an 8 byte random challenge
 118  */
 119
 120 static NTSTATUS auth_ntlmssp_get_challenge(const struct ntlmssp_state *ntlmssp_state,
 121                                            uint8_t chal[8])
 122 {
 123         struct auth_ntlmssp_state *auth_ntlmssp_state =
 124                 (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
 125         auth_ntlmssp_state->auth_context->get_ntlm_challenge(
 126                 auth_ntlmssp_state->auth_context, chal);
 127         return NT_STATUS_OK;
 128 }
 129
 130 /**
 131  * Some authentication methods 'fix' the challenge, so we may not be able to set it
 132  *
 133  * @return If the effective challenge used by the auth subsystem may be modified
 134  */
 135 static bool auth_ntlmssp_may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
 136 {
 137         struct auth_ntlmssp_state *auth_ntlmssp_state =
 138                 (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
 139         struct auth_context *auth_context = auth_ntlmssp_state->auth_context;
 140
 141         return auth_context->challenge_may_be_modified;
 142 }
 143
 144 /**
 145  * NTLM2 authentication modifies the effective challenge,
 146  * @param challenge The new challenge value
 147  */
 148 static NTSTATUS auth_ntlmssp_set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
 149 {
 150         struct auth_ntlmssp_state *auth_ntlmssp_state =
 151                 (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
 152         struct auth_context *auth_context = auth_ntlmssp_state->auth_context;
 153
 154         SMB_ASSERT(challenge->length == 8);
 155
 156         auth_context->challenge = data_blob_talloc(auth_context,
 157                                                    challenge->data, challenge->length);
 158
 159         auth_context->challenge_set_by = "NTLMSSP callback (NTLM2)";
 160
 161         DEBUG(5, ("auth_context challenge set by %s\n", auth_context->challenge_set_by));
 162         DEBUG(5, ("challenge is: \n"));
 163         dump_data(5, auth_context->challenge.data, auth_context->challenge.length);
 164         return NT_STATUS_OK;
 165 }
 166
 167 /**
 168  * Check the password on an NTLMSSP login.
 169  *
 170  * Return the session keys used on the connection.
 171  */
 172
 173 static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
 174 {
 175         struct auth_ntlmssp_state *auth_ntlmssp_state =
 176                 (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
 177         struct auth_usersupplied_info *user_info = NULL;
 178         NTSTATUS nt_status;
 179         bool username_was_mapped;
 180
 181         /* the client has given us its machine name (which we otherwise would not get on port 445).
 182            we need to possibly reload smb.conf if smb.conf includes depend on the machine name */
 183
 184         set_remote_machine_name(auth_ntlmssp_state->ntlmssp_state->client.netbios_name, True);
 185
 186         /* setup the string used by %U */
 187         /* sub_set_smb_name checks for weird internally */
 188         sub_set_smb_name(auth_ntlmssp_state->ntlmssp_state->user);
 189
 190         reload_services(True);
 191
 192         nt_status = make_user_info_map(&user_info,
 193                                        auth_ntlmssp_state->ntlmssp_state->user,
 194                                        auth_ntlmssp_state->ntlmssp_state->domain,
 195                                        auth_ntlmssp_state->ntlmssp_state->client.netbios_name,
 196                                        auth_ntlmssp_state->ntlmssp_state->lm_resp.data ? &auth_ntlmssp_state->ntlmssp_state->lm_resp : NULL,
 197                                        auth_ntlmssp_state->ntlmssp_state->nt_resp.data ? &auth_ntlmssp_state->ntlmssp_state->nt_resp : NULL,
 198                                        NULL, NULL, NULL,
 199                                        True);
 200
 201         user_info->logon_parameters = MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
 202
 203         if (!NT_STATUS_IS_OK(nt_status)) {
 204                 return nt_status;
 205         }
 206
 207         nt_status = auth_ntlmssp_state->auth_context->check_ntlm_password(auth_ntlmssp_state->auth_context,
 208                                                                           user_info, &auth_ntlmssp_state->server_info);
 209
 210         username_was_mapped = user_info->was_mapped;
 211
 212         free_user_info(&user_info);
 213
 214         if (!NT_STATUS_IS_OK(nt_status)) {
 215                 return nt_status;
 216         }
 217
 218         auth_ntlmssp_state->server_info->nss_token |= username_was_mapped;
 219
 220         nt_status = create_local_token(auth_ntlmssp_state->server_info);
 221
 222         if (!NT_STATUS_IS_OK(nt_status)) {
 223                 DEBUG(10, ("create_local_token failed: %s\n",
 224                         nt_errstr(nt_status)));
 225                 return nt_status;
 226         }
 227
 228         if (auth_ntlmssp_state->server_info->user_session_key.length) {
 229                 DEBUG(10, ("Got NT session key of length %u\n",
 230                         (unsigned int)auth_ntlmssp_state->server_info->user_session_key.length));
 231                 *user_session_key = data_blob_talloc(auth_ntlmssp_state->mem_ctx,
 232                                                    auth_ntlmssp_state->server_info->user_session_key.data,
 233                                                    auth_ntlmssp_state->server_info->user_session_key.length);
 234         }
 235         if (auth_ntlmssp_state->server_info->lm_session_key.length) {
 236                 DEBUG(10, ("Got LM session key of length %u\n",
 237                         (unsigned int)auth_ntlmssp_state->server_info->lm_session_key.length));
 238                 *lm_session_key = data_blob_talloc(auth_ntlmssp_state->mem_ctx,
 239                                                    auth_ntlmssp_state->server_info->lm_session_key.data,
 240                                                    auth_ntlmssp_state->server_info->lm_session_key.length);
 241         }
 242         return nt_status;
 243 }
 244
 245 NTSTATUS auth_ntlmssp_start(struct auth_ntlmssp_state **auth_ntlmssp_state)
 246 {
 247         NTSTATUS nt_status;
 248         TALLOC_CTX *mem_ctx;
 249         bool is_standalone;
 250         const char *netbios_name;
 251         const char *netbios_domain;
 252         const char *dns_name;
 253         char *dns_domain;
 254
 255         if ((enum server_types)lp_server_role() == ROLE_STANDALONE) {
 256                 is_standalone = true;
 257         } else {
 258                 is_standalone = false;
 259         }
 260
 261         netbios_name = global_myname();
 262         netbios_domain = lp_workgroup();
 263         /* This should be a 'netbios domain -> DNS domain' mapping */
 264         dns_domain = get_mydnsdomname(talloc_tos());
 265         if (dns_domain) {
 266                 strlower_m(dns_domain);
 267         }
 268         dns_name = get_mydnsfullname();
 269
 270         mem_ctx = talloc_init("AUTH NTLMSSP context");
 271
 272         *auth_ntlmssp_state = TALLOC_ZERO_P(mem_ctx, struct auth_ntlmssp_state);
 273         if (!*auth_ntlmssp_state) {
 274                 DEBUG(0,("auth_ntlmssp_start: talloc failed!\n"));
 275                 talloc_destroy(mem_ctx);
 276                 return NT_STATUS_NO_MEMORY;
 277         }
 278
 279         ZERO_STRUCTP(*auth_ntlmssp_state);
 280
 281         (*auth_ntlmssp_state)->mem_ctx = mem_ctx;
 282
 283         nt_status = ntlmssp_server_start(NULL,
 284                                          is_standalone,
 285                                          netbios_name,
 286                                          netbios_domain,
 287                                          dns_name,
 288                                          dns_domain,
 289                                          &(*auth_ntlmssp_state)->ntlmssp_state);
 290         if (!NT_STATUS_IS_OK(nt_status)) {
 291                 return nt_status;
 292         }
 293
 294         if (!NT_STATUS_IS_OK(nt_status = make_auth_context_subsystem(&(*auth_ntlmssp_state)->auth_context))) {
 295                 return nt_status;
 296         }
 297
 298         (*auth_ntlmssp_state)->ntlmssp_state->callback_private = (*auth_ntlmssp_state);
 299         (*auth_ntlmssp_state)->ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
 300         (*auth_ntlmssp_state)->ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
 301         (*auth_ntlmssp_state)->ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
 302         (*auth_ntlmssp_state)->ntlmssp_state->check_password = auth_ntlmssp_check_password;
 303
 304         return NT_STATUS_OK;
 305 }
 306
 307 void auth_ntlmssp_end(struct auth_ntlmssp_state **auth_ntlmssp_state)
 308 {
 309         TALLOC_CTX *mem_ctx;
 310
 311         if (*auth_ntlmssp_state == NULL) {
 312                 return;
 313         }
 314
 315         mem_ctx = (*auth_ntlmssp_state)->mem_ctx;
 316         if ((*auth_ntlmssp_state)->ntlmssp_state) {
 317                 ntlmssp_end(&(*auth_ntlmssp_state)->ntlmssp_state);
 318         }
 319         if ((*auth_ntlmssp_state)->auth_context) {
 320                 ((*auth_ntlmssp_state)->auth_context->free)(&(*auth_ntlmssp_state)->auth_context);
 321         }
 322         if ((*auth_ntlmssp_state)->server_info) {
 323                 TALLOC_FREE((*auth_ntlmssp_state)->server_info);
 324         }
 325         talloc_destroy(mem_ctx);
 326         *auth_ntlmssp_state = NULL;
 327 }
 328
 329 NTSTATUS auth_ntlmssp_update(struct auth_ntlmssp_state *auth_ntlmssp_state,
 330                              const DATA_BLOB request, DATA_BLOB *reply)
 331 {
 332         return ntlmssp_update(auth_ntlmssp_state->ntlmssp_state, request, reply);
 333 }