source4/libcli/auth/schannel.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    schannel library code
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "lib/crypto/crypto.h"
  25
  26 struct schannel_state {
  27         uint8_t session_key[16];
  28         uint32_t seq_num;
  29         BOOL initiator;
  30 };
  31
  32 #define NETSEC_SIGN_SIGNATURE { 0x77, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00 }
  33 #define NETSEC_SEAL_SIGNATURE { 0x77, 0x00, 0x7a, 0x00, 0xff, 0xff, 0x00, 0x00 }
  34
  35 /*******************************************************************
  36  Encode or Decode the sequence number (which is symmetric)
  37  ********************************************************************/
  38 static void netsec_deal_with_seq_num(struct schannel_state *state,
  39                                      const uint8_t packet_digest[8],
  40                                      uint8_t seq_num[8])
  41 {
  42         static const uint8_t zeros[4];
  43         uint8_t sequence_key[16];
  44         uint8_t digest1[16];
  45
  46         hmac_md5(state->session_key, zeros, sizeof(zeros), digest1);
  47         hmac_md5(digest1, packet_digest, 8, sequence_key);
  48         arcfour_crypt(seq_num, sequence_key, 8);
  49
  50         state->seq_num++;
  51 }
  52
  53
  54 /*******************************************************************
  55  Calculate the key with which to encode the data payload
  56  ********************************************************************/
  57 static void netsec_get_sealing_key(const uint8_t session_key[16],
  58                                    const uint8_t seq_num[8],
  59                                    uint8_t sealing_key[16])
  60 {
  61         static const uint8_t zeros[4];
  62         uint8_t digest2[16];
  63         uint8_t sess_kf0[16];
  64         int i;
  65
  66         for (i = 0; i < 16; i++) {
  67                 sess_kf0[i] = session_key[i] ^ 0xf0;
  68         }
  69
  70         hmac_md5(sess_kf0, zeros, 4, digest2);
  71         hmac_md5(digest2, seq_num, 8, sealing_key);
  72 }
  73
  74
  75 /*******************************************************************
  76  Create a digest over the entire packet (including the data), and
  77  MD5 it with the session key.
  78  ********************************************************************/
  79 static void schannel_digest(const uint8_t sess_key[16],
  80                             const uint8_t netsec_sig[8],
  81                             const uint8_t *confounder,
  82                             const uint8_t *data, size_t data_len,
  83                             uint8_t digest_final[16])
  84 {
  85         uint8_t packet_digest[16];
  86         static const uint8_t zeros[4];
  87         struct MD5Context ctx;
  88
  89         MD5Init(&ctx);
  90         MD5Update(&ctx, zeros, 4);
  91         MD5Update(&ctx, netsec_sig, 8);
  92         if (confounder) {
  93                 MD5Update(&ctx, confounder, 8);
  94         }
  95         MD5Update(&ctx, data, data_len);
  96         MD5Final(packet_digest, &ctx);
  97
  98         hmac_md5(sess_key, packet_digest, sizeof(packet_digest), digest_final);
  99 }
 100
 101
 102 /*
 103   unseal a packet
 104 */
 105 NTSTATUS schannel_unseal_packet(struct schannel_state *state,
 106                                 TALLOC_CTX *mem_ctx,
 107                                 uint8_t *data, size_t length,
 108                                 DATA_BLOB *sig)
 109 {
 110         uint8_t digest_final[16];
 111         uint8_t confounder[8];
 112         uint8_t seq_num[8];
 113         uint8_t sealing_key[16];
 114         static const uint8_t netsec_sig[8] = NETSEC_SEAL_SIGNATURE;
 115
 116         if (sig->length != 32) {
 117                 return NT_STATUS_ACCESS_DENIED;
 118         }
 119
 120         memcpy(confounder, sig->data+24, 8);
 121
 122         RSIVAL(seq_num, 0, state->seq_num);
 123         SIVAL(seq_num, 4, state->initiator?0:0x80);
 124
 125         netsec_get_sealing_key(state->session_key, seq_num, sealing_key);
 126         arcfour_crypt(confounder, sealing_key, 8);
 127         arcfour_crypt(data, sealing_key, length);
 128
 129         schannel_digest(state->session_key,
 130                         netsec_sig, confounder,
 131                         data, length, digest_final);
 132
 133         if (memcmp(digest_final, sig->data+16, 8) != 0) {
 134                 dump_data_pw("calc digest:", digest_final, 8);
 135                 dump_data_pw("wire digest:", sig->data+16, 8);
 136                 return NT_STATUS_ACCESS_DENIED;
 137         }
 138
 139         netsec_deal_with_seq_num(state, digest_final, seq_num);
 140
 141         if (memcmp(seq_num, sig->data+8, 8) != 0) {
 142                 dump_data_pw("calc seq num:", seq_num, 8);
 143                 dump_data_pw("wire seq num:", sig->data+8, 8);
 144                 return NT_STATUS_ACCESS_DENIED;
 145         }
 146
 147         return NT_STATUS_OK;
 148 }
 149
 150 /*
 151   check the signature on a packet
 152 */
 153 NTSTATUS schannel_check_packet(struct schannel_state *state,
 154                                const uint8_t *data, size_t length,
 155                                const DATA_BLOB *sig)
 156 {
 157         uint8_t digest_final[16];
 158         uint8_t seq_num[8];
 159         static const uint8_t netsec_sig[8] = NETSEC_SIGN_SIGNATURE;
 160
 161         /* w2k sends just 24 bytes and skip the confounder */
 162         if (sig->length != 32 && sig->length != 24) {
 163                 return NT_STATUS_ACCESS_DENIED;
 164         }
 165
 166         RSIVAL(seq_num, 0, state->seq_num);
 167         SIVAL(seq_num, 4, state->initiator?0:0x80);
 168
 169         dump_data_pw("seq_num:\n", seq_num, 8);
 170         dump_data_pw("sess_key:\n", state->session_key, 16);
 171
 172         schannel_digest(state->session_key,
 173                         netsec_sig, NULL,
 174                         data, length, digest_final);
 175
 176         netsec_deal_with_seq_num(state, digest_final, seq_num);
 177
 178         if (memcmp(seq_num, sig->data+8, 8) != 0) {
 179                 dump_data_pw("calc seq num:", seq_num, 8);
 180                 dump_data_pw("wire seq num:", sig->data+8, 8);
 181                 return NT_STATUS_ACCESS_DENIED;
 182         }
 183
 184         if (memcmp(digest_final, sig->data+16, 8) != 0) {
 185                 dump_data_pw("calc digest:", digest_final, 8);
 186                 dump_data_pw("wire digest:", sig->data+16, 8);
 187                 return NT_STATUS_ACCESS_DENIED;
 188         }
 189
 190         return NT_STATUS_OK;
 191 }
 192
 193
 194 /*
 195   seal a packet
 196 */
 197 NTSTATUS schannel_seal_packet(struct schannel_state *state,
 198                               TALLOC_CTX *mem_ctx,
 199                               uint8_t *data, size_t length,
 200                               DATA_BLOB *sig)
 201 {
 202         uint8_t digest_final[16];
 203         uint8_t confounder[8];
 204         uint8_t seq_num[8];
 205         uint8_t sealing_key[16];
 206         static const uint8_t netsec_sig[8] = NETSEC_SEAL_SIGNATURE;
 207
 208         generate_random_buffer(confounder, 8);
 209
 210         RSIVAL(seq_num, 0, state->seq_num);
 211         SIVAL(seq_num, 4, state->initiator?0x80:0);
 212
 213         schannel_digest(state->session_key,
 214                         netsec_sig, confounder,
 215                         data, length, digest_final);
 216
 217         netsec_get_sealing_key(state->session_key, seq_num, sealing_key);
 218         arcfour_crypt(confounder, sealing_key, 8);
 219         arcfour_crypt(data, sealing_key, length);
 220
 221         netsec_deal_with_seq_num(state, digest_final, seq_num);
 222
 223         (*sig) = data_blob_talloc(mem_ctx, NULL, 32);
 224
 225         memcpy(sig->data, netsec_sig, 8);
 226         memcpy(sig->data+8, seq_num, 8);
 227         memcpy(sig->data+16, digest_final, 8);
 228         memcpy(sig->data+24, confounder, 8);
 229
 230         dump_data_pw("signature:", sig->data+ 0, 8);
 231         dump_data_pw("seq_num  :", sig->data+ 8, 8);
 232         dump_data_pw("digest   :", sig->data+16, 8);
 233         dump_data_pw("confound :", sig->data+24, 8);
 234
 235         return NT_STATUS_OK;
 236 }
 237
 238
 239 /*
 240   sign a packet
 241 */
 242 NTSTATUS schannel_sign_packet(struct schannel_state *state,
 243                               TALLOC_CTX *mem_ctx,
 244                               const uint8_t *data, size_t length,
 245                               DATA_BLOB *sig)
 246 {
 247         uint8_t digest_final[16];
 248         uint8_t seq_num[8];
 249         static const uint8_t netsec_sig[8] = NETSEC_SIGN_SIGNATURE;
 250
 251         RSIVAL(seq_num, 0, state->seq_num);
 252         SIVAL(seq_num, 4, state->initiator?0x80:0);
 253
 254         schannel_digest(state->session_key,
 255                         netsec_sig, NULL,
 256                         data, length, digest_final);
 257
 258         netsec_deal_with_seq_num(state, digest_final, seq_num);
 259
 260         (*sig) = data_blob_talloc(mem_ctx, NULL, 32);
 261
 262         memcpy(sig->data, netsec_sig, 8);
 263         memcpy(sig->data+8, seq_num, 8);
 264         memcpy(sig->data+16, digest_final, 8);
 265         memset(sig->data+24, 0, 8);
 266
 267         dump_data_pw("signature:", sig->data+ 0, 8);
 268         dump_data_pw("seq_num  :", sig->data+ 8, 8);
 269         dump_data_pw("digest   :", sig->data+16, 8);
 270         dump_data_pw("confound :", sig->data+24, 8);
 271
 272         return NT_STATUS_OK;
 273 }
 274
 275 /*
 276   create an schannel context state
 277 */
 278 NTSTATUS schannel_start(TALLOC_CTX *mem_ctx,
 279                         struct schannel_state **state,
 280                         const uint8_t session_key[16],
 281                         BOOL initiator)
 282 {
 283         (*state) = talloc(mem_ctx, struct schannel_state);
 284         if (!(*state)) {
 285                 return NT_STATUS_NO_MEMORY;
 286         }
 287
 288         memcpy((*state)->session_key, session_key, 16);
 289         (*state)->initiator = initiator;
 290         (*state)->seq_num = 0;
 291
 292         return NT_STATUS_OK;
 293 }