source4/auth/ntlmssp/ntlmssp_client.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle NLTMSSP, client server side parsing
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2005
   8    Copyright (C) Stefan Metzmacher 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 struct auth_session_info;
  25
  26 #include "includes.h"
  27 #include "auth/ntlmssp/ntlmssp.h"
  28 #include "source4/auth/ntlmssp/proto.h"
  29 #include "../lib/crypto/crypto.h"
  30 #include "../libcli/auth/libcli_auth.h"
  31 #include "auth/credentials/credentials.h"
  32 #include "auth/gensec/gensec.h"
  33 #include "param/param.h"
  34 #include "auth/ntlmssp/ntlmssp_private.h"
  35
  36 /*********************************************************************
  37  Client side NTLMSSP
  38 *********************************************************************/
  39
  40 /**
  41  * Next state function for the Initial packet
  42  *
  43  * @param ntlmssp_state NTLMSSP State
  44  * @param out_mem_ctx The DATA_BLOB *out will be allocated on this context
  45  * @param in A NULL data blob (input ignored)
  46  * @param out The initial negotiate request to the server, as an talloc()ed DATA_BLOB, on out_mem_ctx
  47  * @return Errors or NT_STATUS_OK.
  48  */
  49
  50 NTSTATUS ntlmssp_client_initial(struct gensec_security *gensec_security,
  51                                 TALLOC_CTX *out_mem_ctx,
  52                                 DATA_BLOB in, DATA_BLOB *out)
  53 {
  54         struct gensec_ntlmssp_context *gensec_ntlmssp =
  55                 talloc_get_type_abort(gensec_security->private_data,
  56                                       struct gensec_ntlmssp_context);
  57         struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
  58         const char *domain = ntlmssp_state->domain;
  59         const char *workstation = cli_credentials_get_workstation(gensec_security->credentials);
  60         NTSTATUS status;
  61
  62         /* These don't really matter in the initial packet, so don't panic if they are not set */
  63         if (!domain) {
  64                 domain = "";
  65         }
  66
  67         if (!workstation) {
  68                 workstation = "";
  69         }
  70
  71         if (ntlmssp_state->unicode) {
  72                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
  73         } else {
  74                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
  75         }
  76
  77         if (ntlmssp_state->use_ntlmv2) {
  78                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
  79         }
  80
  81         /* generate the ntlmssp negotiate packet */
  82         status = msrpc_gen(out_mem_ctx,
  83                   out, "CddAA",
  84                   "NTLMSSP",
  85                   NTLMSSP_NEGOTIATE,
  86                   ntlmssp_state->neg_flags,
  87                   domain,
  88                   workstation);
  89
  90         if (!NT_STATUS_IS_OK(status)) {
  91                 return status;
  92         }
  93
  94         ntlmssp_state->expected_state = NTLMSSP_CHALLENGE;
  95
  96         return NT_STATUS_MORE_PROCESSING_REQUIRED;
  97 }
  98
  99 /**
 100  * Next state function for the Challenge Packet.  Generate an auth packet.
 101  *
 102  * @param gensec_security GENSEC state
 103  * @param out_mem_ctx Memory context for *out
 104  * @param in The server challnege, as a DATA_BLOB.  reply.data must be NULL
 105  * @param out The next request (auth packet) to the server, as an allocated DATA_BLOB, on the out_mem_ctx context
 106  * @return Errors or NT_STATUS_OK.
 107  */
 108
 109 NTSTATUS ntlmssp_client_challenge(struct gensec_security *gensec_security,
 110                                   TALLOC_CTX *out_mem_ctx,
 111                                   const DATA_BLOB in, DATA_BLOB *out)
 112 {
 113         struct gensec_ntlmssp_context *gensec_ntlmssp =
 114                 talloc_get_type_abort(gensec_security->private_data,
 115                                       struct gensec_ntlmssp_context);
 116         struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
 117         uint32_t chal_flags, ntlmssp_command, unkn1, unkn2;
 118         DATA_BLOB server_domain_blob;
 119         DATA_BLOB challenge_blob;
 120         DATA_BLOB target_info = data_blob(NULL, 0);
 121         char *server_domain;
 122         const char *chal_parse_string;
 123         const char *auth_gen_string;
 124         DATA_BLOB lm_response = data_blob(NULL, 0);
 125         DATA_BLOB nt_response = data_blob(NULL, 0);
 126         DATA_BLOB session_key = data_blob(NULL, 0);
 127         DATA_BLOB lm_session_key = data_blob(NULL, 0);
 128         DATA_BLOB encrypted_session_key = data_blob(NULL, 0);
 129         NTSTATUS nt_status;
 130         int flags = 0;
 131         const char *user, *domain;
 132
 133         TALLOC_CTX *mem_ctx = talloc_new(out_mem_ctx);
 134         if (!mem_ctx) {
 135                 return NT_STATUS_NO_MEMORY;
 136         }
 137
 138         if (!msrpc_parse(mem_ctx,
 139                          &in, "CdBd",
 140                          "NTLMSSP",
 141                          &ntlmssp_command,
 142                          &server_domain_blob,
 143                          &chal_flags)) {
 144                 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
 145                 dump_data(2, in.data, in.length);
 146                 talloc_free(mem_ctx);
 147
 148                 return NT_STATUS_INVALID_PARAMETER;
 149         }
 150
 151         data_blob_free(&server_domain_blob);
 152
 153         DEBUG(3, ("Got challenge flags:\n"));
 154         debug_ntlmssp_flags(chal_flags);
 155
 156         ntlmssp_handle_neg_flags(ntlmssp_state, chal_flags, ntlmssp_state->allow_lm_key);
 157
 158         if (ntlmssp_state->unicode) {
 159                 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
 160                         chal_parse_string = "CdUdbddB";
 161                 } else {
 162                         chal_parse_string = "CdUdbdd";
 163                 }
 164                 auth_gen_string = "CdBBUUUBd";
 165         } else {
 166                 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
 167                         chal_parse_string = "CdAdbddB";
 168                 } else {
 169                         chal_parse_string = "CdAdbdd";
 170                 }
 171
 172                 auth_gen_string = "CdBBAAABd";
 173         }
 174
 175         if (!msrpc_parse(mem_ctx,
 176                          &in, chal_parse_string,
 177                          "NTLMSSP",
 178                          &ntlmssp_command,
 179                          &server_domain,
 180                          &chal_flags,
 181                          &challenge_blob, 8,
 182                          &unkn1, &unkn2,
 183                          &target_info)) {
 184                 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
 185                 dump_data(2, in.data, in.length);
 186                 talloc_free(mem_ctx);
 187                 return NT_STATUS_INVALID_PARAMETER;
 188         }
 189
 190         if (chal_flags & NTLMSSP_TARGET_TYPE_SERVER) {
 191                 ntlmssp_state->server.is_standalone = true;
 192         } else {
 193                 ntlmssp_state->server.is_standalone = false;
 194         }
 195         /* TODO: parse struct_blob and fill in the rest */
 196         ntlmssp_state->server.netbios_name = "";
 197         ntlmssp_state->server.netbios_domain = server_domain;
 198         ntlmssp_state->server.dns_name = "";
 199         ntlmssp_state->server.dns_domain = "";
 200
 201         if (challenge_blob.length != 8) {
 202                 talloc_free(mem_ctx);
 203                 return NT_STATUS_INVALID_PARAMETER;
 204         }
 205
 206         cli_credentials_get_ntlm_username_domain(gensec_security->credentials, mem_ctx,
 207                                                  &user, &domain);
 208
 209         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 210                 flags |= CLI_CRED_NTLM2;
 211         }
 212         if (ntlmssp_state->use_ntlmv2) {
 213                 flags |= CLI_CRED_NTLMv2_AUTH;
 214         }
 215         if (ntlmssp_state->use_nt_response) {
 216                 flags |= CLI_CRED_NTLM_AUTH;
 217         }
 218         if (lpcfg_client_lanman_auth(gensec_security->settings->lp_ctx)) {
 219                 flags |= CLI_CRED_LANMAN_AUTH;
 220         }
 221
 222         nt_status = cli_credentials_get_ntlm_response(gensec_security->credentials, mem_ctx,
 223                                                       &flags, challenge_blob, target_info,
 224                                                       &lm_response, &nt_response,
 225                                                       &lm_session_key, &session_key);
 226
 227         if (!NT_STATUS_IS_OK(nt_status)) {
 228                 return nt_status;
 229         }
 230
 231         if (!(flags & CLI_CRED_LANMAN_AUTH)) {
 232                 /* LM Key is still possible, just silly.  Fortunetly
 233                  * we require command line options to end up here */
 234                 /* ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY; */
 235         }
 236
 237         if (!(flags & CLI_CRED_NTLM2)) {
 238                 /* NTLM2 is incompatible... */
 239                 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
 240         }
 241
 242         if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
 243             && lpcfg_client_lanman_auth(gensec_security->settings->lp_ctx) && lm_session_key.length == 16) {
 244                 DATA_BLOB new_session_key = data_blob_talloc(mem_ctx, NULL, 16);
 245                 if (lm_response.length == 24) {
 246                         SMBsesskeygen_lm_sess_key(lm_session_key.data, lm_response.data,
 247                                                   new_session_key.data);
 248                 } else {
 249                         static const uint8_t zeros[24];
 250                         SMBsesskeygen_lm_sess_key(lm_session_key.data, zeros,
 251                                                   new_session_key.data);
 252                 }
 253                 session_key = new_session_key;
 254                 dump_data_pw("LM session key\n", session_key.data, session_key.length);
 255         }
 256
 257
 258         /* Key exchange encryptes a new client-generated session key with
 259            the password-derived key */
 260         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
 261                 /* Make up a new session key */
 262                 uint8_t client_session_key[16];
 263                 generate_secret_buffer(client_session_key, sizeof(client_session_key));
 264
 265                 /* Encrypt the new session key with the old one */
 266                 encrypted_session_key = data_blob_talloc(ntlmssp_state,
 267                                                          client_session_key, sizeof(client_session_key));
 268                 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length);
 269                 arcfour_crypt(encrypted_session_key.data, session_key.data, encrypted_session_key.length);
 270                 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
 271
 272                 /* Mark the new session key as the 'real' session key */
 273                 session_key = data_blob_talloc(mem_ctx, client_session_key, sizeof(client_session_key));
 274         }
 275
 276         DEBUG(3, ("NTLMSSP: Set final flags:\n"));
 277         debug_ntlmssp_flags(ntlmssp_state->neg_flags);
 278
 279         /* this generates the actual auth packet */
 280         nt_status = msrpc_gen(mem_ctx,
 281                        out, auth_gen_string,
 282                        "NTLMSSP",
 283                        NTLMSSP_AUTH,
 284                        lm_response.data, lm_response.length,
 285                        nt_response.data, nt_response.length,
 286                        domain,
 287                        user,
 288                        cli_credentials_get_workstation(gensec_security->credentials),
 289                        encrypted_session_key.data, encrypted_session_key.length,
 290                        ntlmssp_state->neg_flags);
 291         if (!NT_STATUS_IS_OK(nt_status)) {
 292                 talloc_free(mem_ctx);
 293                 return nt_status;
 294         }
 295
 296         ntlmssp_state->session_key = session_key;
 297         talloc_steal(ntlmssp_state, session_key.data);
 298
 299         talloc_steal(out_mem_ctx, out->data);
 300
 301         ntlmssp_state->chal = challenge_blob;
 302         ntlmssp_state->lm_resp = lm_response;
 303         talloc_steal(ntlmssp_state->lm_resp.data, lm_response.data);
 304         ntlmssp_state->nt_resp = nt_response;
 305         talloc_steal(ntlmssp_state->nt_resp.data, nt_response.data);
 306
 307         ntlmssp_state->expected_state = NTLMSSP_DONE;
 308
 309         if (gensec_security->want_features & (GENSEC_FEATURE_SIGN|GENSEC_FEATURE_SEAL)) {
 310                 nt_status = ntlmssp_sign_init(ntlmssp_state);
 311                 if (!NT_STATUS_IS_OK(nt_status)) {
 312                         DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n",
 313                                   nt_errstr(nt_status)));
 314                         talloc_free(mem_ctx);
 315                         return nt_status;
 316                 }
 317         }
 318
 319         talloc_free(mem_ctx);
 320         return NT_STATUS_OK;
 321 }
 322
 323 NTSTATUS gensec_ntlmssp_client_start(struct gensec_security *gensec_security)
 324 {
 325         struct gensec_ntlmssp_context *gensec_ntlmssp;
 326         struct ntlmssp_state *ntlmssp_state;
 327         NTSTATUS nt_status;
 328
 329         nt_status = gensec_ntlmssp_start(gensec_security);
 330         NT_STATUS_NOT_OK_RETURN(nt_status);
 331
 332         gensec_ntlmssp =
 333                 talloc_get_type_abort(gensec_security->private_data,
 334                                       struct gensec_ntlmssp_context);
 335
 336         ntlmssp_state = talloc_zero(gensec_ntlmssp,
 337                                     struct ntlmssp_state);
 338         if (!ntlmssp_state) {
 339                 return NT_STATUS_NO_MEMORY;
 340         }
 341
 342         ntlmssp_state->callback_private = gensec_ntlmssp;
 343
 344         gensec_ntlmssp->ntlmssp_state = ntlmssp_state;
 345
 346         ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
 347
 348         ntlmssp_state->role = NTLMSSP_CLIENT;
 349
 350         ntlmssp_state->domain = lpcfg_workgroup(gensec_security->settings->lp_ctx);
 351
 352         ntlmssp_state->unicode = gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "unicode", true);
 353
 354         ntlmssp_state->use_nt_response = gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "send_nt_reponse", true);
 355
 356         ntlmssp_state->allow_lm_key = (lpcfg_client_lanman_auth(gensec_security->settings->lp_ctx)
 357                                               && (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "allow_lm_key", false)
 358                                                   || gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "lm_key", false)));
 359
 360         ntlmssp_state->use_ntlmv2 = lpcfg_client_ntlmv2_auth(gensec_security->settings->lp_ctx);
 361
 362         ntlmssp_state->expected_state = NTLMSSP_INITIAL;
 363
 364         ntlmssp_state->neg_flags =
 365                 NTLMSSP_NEGOTIATE_NTLM |
 366                 NTLMSSP_REQUEST_TARGET;
 367
 368         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "128bit", true)) {
 369                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_128;
 370         }
 371
 372         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "56bit", false)) {
 373                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_56;
 374         }
 375
 376         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "lm_key", false)) {
 377                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_LM_KEY;
 378         }
 379
 380         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "keyexchange", true)) {
 381                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_KEY_EXCH;
 382         }
 383
 384         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "alwayssign", true)) {
 385                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
 386         }
 387
 388         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "ntlm2", true)) {
 389                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
 390         } else {
 391                 /* apparently we can't do ntlmv2 if we don't do ntlm2 */
 392                 ntlmssp_state->use_ntlmv2 = false;
 393         }
 394
 395         if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
 396                 /*
 397                  * We need to set this to allow a later SetPassword
 398                  * via the SAMR pipe to succeed. Strange.... We could
 399                  * also add  NTLMSSP_NEGOTIATE_SEAL here. JRA.
 400                  *
 401                  * Without this, Windows will not create the master key
 402                  * that it thinks is only used for NTLMSSP signing and
 403                  * sealing.  (It is actually pulled out and used directly)
 404                  */
 405                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
 406         }
 407         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
 408                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
 409         }
 410         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
 411                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
 412                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
 413         }
 414
 415         return NT_STATUS_OK;
 416 }
 417