2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2010
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "../auth/ntlmssp/ntlmssp.h"
26 #include "../auth/ntlmssp/ntlmssp_private.h"
27 #include "../libcli/auth/libcli_auth.h"
28 #include "../librpc/gen_ndr/ndr_ntlmssp.h"
29 #include "../auth/ntlmssp/ntlmssp_ndr.h"
30 #include "../lib/crypto/md5.h"
31 #include "../lib/crypto/arcfour.h"
32 #include "../lib/crypto/hmacmd5.h"
33 #include "../nsswitch/libwbclient/wbclient.h"
35 static NTSTATUS
ntlmssp_client_initial(struct ntlmssp_state
*ntlmssp_state
,
36 TALLOC_CTX
*out_mem_ctx
,
37 DATA_BLOB reply
, DATA_BLOB
*next_request
);
38 static NTSTATUS
ntlmssp_client_challenge(struct ntlmssp_state
*ntlmssp_state
,
39 TALLOC_CTX
*out_mem_ctx
, /* Unused at this time */
40 const DATA_BLOB reply
, DATA_BLOB
*next_request
);
42 * Callbacks for NTLMSSP - for both client and server operating modes
46 static const struct ntlmssp_callbacks
{
47 enum ntlmssp_role role
;
48 enum ntlmssp_message_type ntlmssp_command
;
49 NTSTATUS (*fn
)(struct ntlmssp_state
*ntlmssp_state
,
50 TALLOC_CTX
*out_mem_ctx
,
51 DATA_BLOB in
, DATA_BLOB
*out
);
52 } ntlmssp_callbacks
[] = {
53 {NTLMSSP_CLIENT
, NTLMSSP_INITIAL
, ntlmssp_client_initial
},
54 {NTLMSSP_SERVER
, NTLMSSP_NEGOTIATE
, ntlmssp_server_negotiate
},
55 {NTLMSSP_CLIENT
, NTLMSSP_CHALLENGE
, ntlmssp_client_challenge
},
56 {NTLMSSP_SERVER
, NTLMSSP_AUTH
, ntlmssp_server_auth
},
57 {NTLMSSP_CLIENT
, NTLMSSP_UNKNOWN
, NULL
},
58 {NTLMSSP_SERVER
, NTLMSSP_UNKNOWN
, NULL
}
63 * Default challenge generation code.
67 static NTSTATUS
get_challenge(const struct ntlmssp_state
*ntlmssp_state
,
70 generate_random_buffer(chal
, 8);
75 * Default 'we can set the challenge to anything we like' implementation
79 static bool may_set_challenge(const struct ntlmssp_state
*ntlmssp_state
)
85 * Default 'we can set the challenge to anything we like' implementation
87 * Does not actually do anything, as the value is always in the structure anyway.
91 static NTSTATUS
set_challenge(struct ntlmssp_state
*ntlmssp_state
, DATA_BLOB
*challenge
)
93 SMB_ASSERT(challenge
->length
== 8);
98 * Set a username on an NTLMSSP context - ensures it is talloc()ed
102 NTSTATUS
ntlmssp_set_username(struct ntlmssp_state
*ntlmssp_state
, const char *user
)
104 ntlmssp_state
->user
= talloc_strdup(ntlmssp_state
, user
? user
: "" );
105 if (!ntlmssp_state
->user
) {
106 return NT_STATUS_NO_MEMORY
;
112 * Store NT and LM hashes on an NTLMSSP context - ensures they are talloc()ed
115 NTSTATUS
ntlmssp_set_hashes(struct ntlmssp_state
*ntlmssp_state
,
116 const uint8_t lm_hash
[16],
117 const uint8_t nt_hash
[16])
119 ntlmssp_state
->lm_hash
= (uint8_t *)
120 talloc_memdup(ntlmssp_state
, lm_hash
, 16);
121 ntlmssp_state
->nt_hash
= (uint8_t *)
122 talloc_memdup(ntlmssp_state
, nt_hash
, 16);
123 if (!ntlmssp_state
->lm_hash
|| !ntlmssp_state
->nt_hash
) {
124 TALLOC_FREE(ntlmssp_state
->lm_hash
);
125 TALLOC_FREE(ntlmssp_state
->nt_hash
);
126 return NT_STATUS_NO_MEMORY
;
132 * Converts a password to the hashes on an NTLMSSP context.
135 NTSTATUS
ntlmssp_set_password(struct ntlmssp_state
*ntlmssp_state
, const char *password
)
138 ntlmssp_state
->lm_hash
= NULL
;
139 ntlmssp_state
->nt_hash
= NULL
;
144 E_deshash(password
, lm_hash
);
145 E_md4hash(password
, nt_hash
);
146 return ntlmssp_set_hashes(ntlmssp_state
, lm_hash
, nt_hash
);
152 * Set a domain on an NTLMSSP context - ensures it is talloc()ed
155 NTSTATUS
ntlmssp_set_domain(struct ntlmssp_state
*ntlmssp_state
, const char *domain
)
157 ntlmssp_state
->domain
= talloc_strdup(ntlmssp_state
,
158 domain
? domain
: "" );
159 if (!ntlmssp_state
->domain
) {
160 return NT_STATUS_NO_MEMORY
;
166 * Request features for the NTLMSSP negotiation
168 * @param ntlmssp_state NTLMSSP state
169 * @param feature_list List of space seperated features requested from NTLMSSP.
171 void ntlmssp_want_feature_list(struct ntlmssp_state
*ntlmssp_state
, char *feature_list
)
174 * We need to set this to allow a later SetPassword
175 * via the SAMR pipe to succeed. Strange.... We could
176 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
178 if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list
, True
)) {
179 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
181 if (in_list("NTLMSSP_FEATURE_SIGN", feature_list
, True
)) {
182 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
184 if(in_list("NTLMSSP_FEATURE_SEAL", feature_list
, True
)) {
185 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
187 if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list
, true)) {
188 ntlmssp_state
->use_ccache
= true;
193 * Request a feature for the NTLMSSP negotiation
195 * @param ntlmssp_state NTLMSSP state
196 * @param feature Bit flag specifying the requested feature
198 void ntlmssp_want_feature(struct ntlmssp_state
*ntlmssp_state
, uint32_t feature
)
200 /* As per JRA's comment above */
201 if (feature
& NTLMSSP_FEATURE_SESSION_KEY
) {
202 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
204 if (feature
& NTLMSSP_FEATURE_SIGN
) {
205 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
207 if (feature
& NTLMSSP_FEATURE_SEAL
) {
208 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
209 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
211 if (feature
& NTLMSSP_FEATURE_CCACHE
) {
212 ntlmssp_state
->use_ccache
= true;
217 * Next state function for the NTLMSSP state machine
219 * @param ntlmssp_state NTLMSSP State
220 * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB
221 * @param out The reply, as an allocated DATA_BLOB, caller to free.
222 * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK.
225 NTSTATUS
ntlmssp_update(struct ntlmssp_state
*ntlmssp_state
,
226 const DATA_BLOB input
, DATA_BLOB
*out
)
228 uint32_t ntlmssp_command
;
231 if (ntlmssp_state
->expected_state
== NTLMSSP_DONE
) {
232 /* Called update after negotiations finished. */
233 DEBUG(1, ("Called NTLMSSP after state machine was 'done'\n"));
234 return NT_STATUS_INVALID_PARAMETER
;
237 *out
= data_blob_null
;
240 switch (ntlmssp_state
->role
) {
242 ntlmssp_command
= NTLMSSP_INITIAL
;
245 /* 'datagram' mode - no neg packet */
246 ntlmssp_command
= NTLMSSP_NEGOTIATE
;
249 DEBUG(1, ("Invalid role: %d\n", ntlmssp_state
->role
));
250 return NT_STATUS_INVALID_PARAMETER
;
253 if (!msrpc_parse(ntlmssp_state
, &input
, "Cd",
256 DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
257 dump_data(2, input
.data
, input
.length
);
258 return NT_STATUS_INVALID_PARAMETER
;
262 if (ntlmssp_command
!= ntlmssp_state
->expected_state
) {
263 DEBUG(1, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command
, ntlmssp_state
->expected_state
));
264 return NT_STATUS_INVALID_PARAMETER
;
267 for (i
=0; ntlmssp_callbacks
[i
].fn
; i
++) {
268 if (ntlmssp_callbacks
[i
].role
== ntlmssp_state
->role
269 && ntlmssp_callbacks
[i
].ntlmssp_command
== ntlmssp_command
) {
270 return ntlmssp_callbacks
[i
].fn(ntlmssp_state
, ntlmssp_state
, input
, out
);
274 DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
275 ntlmssp_state
->role
, ntlmssp_command
));
277 return NT_STATUS_INVALID_PARAMETER
;
281 * Create an NTLMSSP state machine
283 * @param ntlmssp_state NTLMSSP State, allocated by this function
286 NTSTATUS
ntlmssp_server_start(TALLOC_CTX
*mem_ctx
,
288 const char *netbios_name
,
289 const char *netbios_domain
,
290 const char *dns_name
,
291 const char *dns_domain
,
292 struct ntlmssp_state
**_ntlmssp_state
)
294 struct ntlmssp_state
*ntlmssp_state
;
300 if (!netbios_domain
) {
312 ntlmssp_state
= talloc_zero(mem_ctx
, struct ntlmssp_state
);
313 if (!ntlmssp_state
) {
314 return NT_STATUS_NO_MEMORY
;
317 ntlmssp_state
->role
= NTLMSSP_SERVER
;
319 ntlmssp_state
->get_challenge
= get_challenge
;
320 ntlmssp_state
->set_challenge
= set_challenge
;
321 ntlmssp_state
->may_set_challenge
= may_set_challenge
;
323 ntlmssp_state
->server
.is_standalone
= is_standalone
;
325 ntlmssp_state
->expected_state
= NTLMSSP_NEGOTIATE
;
327 ntlmssp_state
->allow_lm_key
= lp_lanman_auth();
329 ntlmssp_state
->neg_flags
=
330 NTLMSSP_NEGOTIATE_128
|
331 NTLMSSP_NEGOTIATE_56
|
332 NTLMSSP_NEGOTIATE_VERSION
|
333 NTLMSSP_NEGOTIATE_ALWAYS_SIGN
|
334 NTLMSSP_NEGOTIATE_NTLM
|
335 NTLMSSP_NEGOTIATE_NTLM2
|
336 NTLMSSP_NEGOTIATE_KEY_EXCH
;
338 ntlmssp_state
->server
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
339 if (!ntlmssp_state
->server
.netbios_name
) {
340 talloc_free(ntlmssp_state
);
341 return NT_STATUS_NO_MEMORY
;
343 ntlmssp_state
->server
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
344 if (!ntlmssp_state
->server
.netbios_domain
) {
345 talloc_free(ntlmssp_state
);
346 return NT_STATUS_NO_MEMORY
;
348 ntlmssp_state
->server
.dns_name
= talloc_strdup(ntlmssp_state
, dns_name
);
349 if (!ntlmssp_state
->server
.dns_name
) {
350 talloc_free(ntlmssp_state
);
351 return NT_STATUS_NO_MEMORY
;
353 ntlmssp_state
->server
.dns_domain
= talloc_strdup(ntlmssp_state
, dns_domain
);
354 if (!ntlmssp_state
->server
.dns_domain
) {
355 talloc_free(ntlmssp_state
);
356 return NT_STATUS_NO_MEMORY
;
359 *_ntlmssp_state
= ntlmssp_state
;
363 /*********************************************************************
365 *********************************************************************/
368 * Next state function for the Initial packet
370 * @param ntlmssp_state NTLMSSP State
371 * @param request The request, as a DATA_BLOB. reply.data must be NULL
372 * @param request The reply, as an allocated DATA_BLOB, caller to free.
373 * @return Errors or NT_STATUS_OK.
376 static NTSTATUS
ntlmssp_client_initial(struct ntlmssp_state
*ntlmssp_state
,
377 TALLOC_CTX
*out_mem_ctx
,
378 DATA_BLOB in
, DATA_BLOB
*out
)
380 const char *domain
= ntlmssp_state
->client
.netbios_domain
;
381 const char *workstation
= ntlmssp_state
->client
.netbios_name
;
384 /* These don't really matter in the initial packet, so don't panic if they are not set */
393 if (ntlmssp_state
->unicode
) {
394 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_UNICODE
;
396 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_OEM
;
399 if (ntlmssp_state
->use_ntlmv2
) {
400 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_NTLM2
;
403 /* generate the ntlmssp negotiate packet */
404 status
= msrpc_gen(out_mem_ctx
,
408 ntlmssp_state
->neg_flags
,
412 if (!NT_STATUS_IS_OK(status
)) {
413 DEBUG(0, ("ntlmssp_client_initial: failed to generate "
414 "ntlmssp negotiate packet\n"));
418 if (DEBUGLEVEL
>= 10) {
419 struct NEGOTIATE_MESSAGE
*negotiate
= talloc(
420 talloc_tos(), struct NEGOTIATE_MESSAGE
);
421 if (negotiate
!= NULL
) {
422 status
= ntlmssp_pull_NEGOTIATE_MESSAGE(
423 out
, negotiate
, negotiate
);
424 if (NT_STATUS_IS_OK(status
)) {
425 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE
,
428 TALLOC_FREE(negotiate
);
432 ntlmssp_state
->expected_state
= NTLMSSP_CHALLENGE
;
434 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
438 * Next state function for the Challenge Packet. Generate an auth packet.
440 * @param ntlmssp_state NTLMSSP State
441 * @param request The request, as a DATA_BLOB. reply.data must be NULL
442 * @param request The reply, as an allocated DATA_BLOB, caller to free.
443 * @return Errors or NT_STATUS_OK.
446 static NTSTATUS
ntlmssp_client_challenge(struct ntlmssp_state
*ntlmssp_state
,
447 TALLOC_CTX
*out_mem_ctx
, /* Unused at this time */
448 const DATA_BLOB reply
, DATA_BLOB
*next_request
)
450 uint32_t chal_flags
, ntlmssp_command
, unkn1
, unkn2
;
451 DATA_BLOB server_domain_blob
;
452 DATA_BLOB challenge_blob
;
453 DATA_BLOB struct_blob
= data_blob_null
;
455 const char *chal_parse_string
;
456 const char *auth_gen_string
;
457 DATA_BLOB lm_response
= data_blob_null
;
458 DATA_BLOB nt_response
= data_blob_null
;
459 DATA_BLOB session_key
= data_blob_null
;
460 DATA_BLOB encrypted_session_key
= data_blob_null
;
461 NTSTATUS nt_status
= NT_STATUS_OK
;
463 if (ntlmssp_state
->use_ccache
) {
464 struct wbcCredentialCacheParams params
;
465 struct wbcCredentialCacheInfo
*info
= NULL
;
466 struct wbcAuthErrorInfo
*error
= NULL
;
467 struct wbcNamedBlob auth_blob
;
468 struct wbcBlob
*wbc_next
= NULL
;
469 struct wbcBlob
*wbc_session_key
= NULL
;
473 params
.account_name
= ntlmssp_state
->user
;
474 params
.domain_name
= ntlmssp_state
->domain
;
475 params
.level
= WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP
;
477 auth_blob
.name
= "challenge_blob";
479 auth_blob
.blob
.data
= reply
.data
;
480 auth_blob
.blob
.length
= reply
.length
;
481 params
.num_blobs
= 1;
482 params
.blobs
= &auth_blob
;
484 wbc_status
= wbcCredentialCache(¶ms
, &info
, &error
);
485 wbcFreeMemory(error
);
486 if (!WBC_ERROR_IS_OK(wbc_status
)) {
490 for (i
=0; i
<info
->num_blobs
; i
++) {
491 if (strequal(info
->blobs
[i
].name
, "auth_blob")) {
492 wbc_next
= &info
->blobs
[i
].blob
;
494 if (strequal(info
->blobs
[i
].name
, "session_key")) {
495 wbc_session_key
= &info
->blobs
[i
].blob
;
498 if ((wbc_next
== NULL
) || (wbc_session_key
== NULL
)) {
503 *next_request
= data_blob(wbc_next
->data
, wbc_next
->length
);
504 ntlmssp_state
->session_key
= data_blob(
505 wbc_session_key
->data
, wbc_session_key
->length
);
513 if (!msrpc_parse(ntlmssp_state
, &reply
, "CdBd",
518 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
519 dump_data(2, reply
.data
, reply
.length
);
521 return NT_STATUS_INVALID_PARAMETER
;
524 if (DEBUGLEVEL
>= 10) {
525 struct CHALLENGE_MESSAGE
*challenge
= talloc(
526 talloc_tos(), struct CHALLENGE_MESSAGE
);
527 if (challenge
!= NULL
) {
529 challenge
->NegotiateFlags
= chal_flags
;
530 status
= ntlmssp_pull_CHALLENGE_MESSAGE(
531 &reply
, challenge
, challenge
);
532 if (NT_STATUS_IS_OK(status
)) {
533 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE
,
536 TALLOC_FREE(challenge
);
540 data_blob_free(&server_domain_blob
);
542 DEBUG(3, ("Got challenge flags:\n"));
543 debug_ntlmssp_flags(chal_flags
);
545 ntlmssp_handle_neg_flags(ntlmssp_state
, chal_flags
, lp_client_lanman_auth());
547 if (ntlmssp_state
->unicode
) {
548 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
) {
549 chal_parse_string
= "CdUdbddB";
551 chal_parse_string
= "CdUdbdd";
553 auth_gen_string
= "CdBBUUUBd";
555 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
) {
556 chal_parse_string
= "CdAdbddB";
558 chal_parse_string
= "CdAdbdd";
561 auth_gen_string
= "CdBBAAABd";
564 DEBUG(3, ("NTLMSSP: Set final flags:\n"));
565 debug_ntlmssp_flags(ntlmssp_state
->neg_flags
);
567 if (!msrpc_parse(ntlmssp_state
, &reply
, chal_parse_string
,
575 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
576 dump_data(2, reply
.data
, reply
.length
);
577 return NT_STATUS_INVALID_PARAMETER
;
580 if (chal_flags
& NTLMSSP_TARGET_TYPE_SERVER
) {
581 ntlmssp_state
->server
.is_standalone
= true;
583 ntlmssp_state
->server
.is_standalone
= false;
585 /* TODO: parse struct_blob and fill in the rest */
586 ntlmssp_state
->server
.netbios_name
= "";
587 ntlmssp_state
->server
.netbios_domain
= server_domain
;
588 ntlmssp_state
->server
.dns_name
= "";
589 ntlmssp_state
->server
.dns_domain
= "";
591 if (challenge_blob
.length
!= 8) {
592 data_blob_free(&struct_blob
);
593 return NT_STATUS_INVALID_PARAMETER
;
596 if (!ntlmssp_state
->nt_hash
|| !ntlmssp_state
->lm_hash
) {
597 static const uint8_t zeros
[16] = {0, };
598 /* do nothing - blobs are zero length */
600 /* session key is all zeros */
601 session_key
= data_blob_talloc(ntlmssp_state
, zeros
, 16);
603 /* not doing NLTM2 without a password */
604 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
605 } else if (ntlmssp_state
->use_ntlmv2
) {
606 if (!struct_blob
.length
) {
607 /* be lazy, match win2k - we can't do NTLMv2 without it */
608 DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
609 return NT_STATUS_INVALID_PARAMETER
;
612 /* TODO: if the remote server is standalone, then we should replace 'domain'
613 with the server name as supplied above */
615 if (!SMBNTLMv2encrypt_hash(ntlmssp_state
,
617 ntlmssp_state
->domain
,
618 ntlmssp_state
->nt_hash
, &challenge_blob
,
620 &lm_response
, &nt_response
, NULL
,
622 data_blob_free(&challenge_blob
);
623 data_blob_free(&struct_blob
);
624 return NT_STATUS_NO_MEMORY
;
626 } else if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
) {
627 struct MD5Context md5_session_nonce_ctx
;
628 uint8_t session_nonce
[16];
629 uint8_t session_nonce_hash
[16];
630 uint8_t user_session_key
[16];
632 lm_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
633 generate_random_buffer(lm_response
.data
, 8);
634 memset(lm_response
.data
+8, 0, 16);
636 memcpy(session_nonce
, challenge_blob
.data
, 8);
637 memcpy(&session_nonce
[8], lm_response
.data
, 8);
639 MD5Init(&md5_session_nonce_ctx
);
640 MD5Update(&md5_session_nonce_ctx
, challenge_blob
.data
, 8);
641 MD5Update(&md5_session_nonce_ctx
, lm_response
.data
, 8);
642 MD5Final(session_nonce_hash
, &md5_session_nonce_ctx
);
644 DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
645 DEBUG(5, ("challenge is: \n"));
646 dump_data(5, session_nonce_hash
, 8);
648 nt_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
649 SMBNTencrypt_hash(ntlmssp_state
->nt_hash
,
653 session_key
= data_blob_talloc(ntlmssp_state
, NULL
, 16);
655 SMBsesskeygen_ntv1(ntlmssp_state
->nt_hash
, user_session_key
);
656 hmac_md5(user_session_key
, session_nonce
, sizeof(session_nonce
), session_key
.data
);
657 dump_data_pw("NTLM2 session key:\n", session_key
.data
, session_key
.length
);
659 /* lanman auth is insecure, it may be disabled */
660 if (lp_client_lanman_auth()) {
661 lm_response
= data_blob_talloc(ntlmssp_state
,
663 SMBencrypt_hash(ntlmssp_state
->lm_hash
,challenge_blob
.data
,
667 nt_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
668 SMBNTencrypt_hash(ntlmssp_state
->nt_hash
,challenge_blob
.data
,
671 session_key
= data_blob_talloc(ntlmssp_state
, NULL
, 16);
672 if ((ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
)
673 && lp_client_lanman_auth()) {
674 SMBsesskeygen_lm_sess_key(ntlmssp_state
->lm_hash
, lm_response
.data
,
676 dump_data_pw("LM session key\n", session_key
.data
, session_key
.length
);
678 SMBsesskeygen_ntv1(ntlmssp_state
->nt_hash
, session_key
.data
);
679 dump_data_pw("NT session key:\n", session_key
.data
, session_key
.length
);
682 data_blob_free(&struct_blob
);
684 /* Key exchange encryptes a new client-generated session key with
685 the password-derived key */
686 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
) {
687 /* Make up a new session key */
688 uint8_t client_session_key
[16];
689 generate_random_buffer(client_session_key
, sizeof(client_session_key
));
691 /* Encrypt the new session key with the old one */
692 encrypted_session_key
= data_blob(client_session_key
, sizeof(client_session_key
));
693 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
694 arcfour_crypt_blob(encrypted_session_key
.data
, encrypted_session_key
.length
, &session_key
);
695 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
697 /* Mark the new session key as the 'real' session key */
698 data_blob_free(&session_key
);
699 session_key
= data_blob_talloc(ntlmssp_state
,
701 sizeof(client_session_key
));
704 /* this generates the actual auth packet */
705 nt_status
= msrpc_gen(ntlmssp_state
, next_request
, auth_gen_string
,
708 lm_response
.data
, lm_response
.length
,
709 nt_response
.data
, nt_response
.length
,
710 ntlmssp_state
->domain
,
712 ntlmssp_state
->client
.netbios_name
,
713 encrypted_session_key
.data
, encrypted_session_key
.length
,
714 ntlmssp_state
->neg_flags
);
716 if (!NT_STATUS_IS_OK(nt_status
)) {
717 return NT_STATUS_NO_MEMORY
;
720 if (DEBUGLEVEL
>= 10) {
721 struct AUTHENTICATE_MESSAGE
*authenticate
= talloc(
722 talloc_tos(), struct AUTHENTICATE_MESSAGE
);
723 if (authenticate
!= NULL
) {
725 authenticate
->NegotiateFlags
=
726 ntlmssp_state
->neg_flags
;
727 status
= ntlmssp_pull_AUTHENTICATE_MESSAGE(
728 next_request
, authenticate
, authenticate
);
729 if (NT_STATUS_IS_OK(status
)) {
730 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE
,
733 TALLOC_FREE(authenticate
);
737 data_blob_free(&encrypted_session_key
);
739 data_blob_free(&ntlmssp_state
->chal
);
741 ntlmssp_state
->session_key
= session_key
;
743 ntlmssp_state
->chal
= challenge_blob
;
744 ntlmssp_state
->lm_resp
= lm_response
;
745 ntlmssp_state
->nt_resp
= nt_response
;
749 ntlmssp_state
->expected_state
= NTLMSSP_DONE
;
751 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_sign_init(ntlmssp_state
))) {
752 DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status
)));
758 NTSTATUS
ntlmssp_client_start(TALLOC_CTX
*mem_ctx
,
759 const char *netbios_name
,
760 const char *netbios_domain
,
762 struct ntlmssp_state
**_ntlmssp_state
)
764 struct ntlmssp_state
*ntlmssp_state
;
770 if (!netbios_domain
) {
774 ntlmssp_state
= talloc_zero(mem_ctx
, struct ntlmssp_state
);
775 if (!ntlmssp_state
) {
776 return NT_STATUS_NO_MEMORY
;
779 ntlmssp_state
->role
= NTLMSSP_CLIENT
;
781 ntlmssp_state
->unicode
= True
;
783 ntlmssp_state
->use_ntlmv2
= use_ntlmv2
;
785 ntlmssp_state
->expected_state
= NTLMSSP_INITIAL
;
787 ntlmssp_state
->neg_flags
=
788 NTLMSSP_NEGOTIATE_128
|
789 NTLMSSP_NEGOTIATE_ALWAYS_SIGN
|
790 NTLMSSP_NEGOTIATE_NTLM
|
791 NTLMSSP_NEGOTIATE_NTLM2
|
792 NTLMSSP_NEGOTIATE_KEY_EXCH
|
793 NTLMSSP_REQUEST_TARGET
;
795 ntlmssp_state
->client
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
796 if (!ntlmssp_state
->client
.netbios_name
) {
797 talloc_free(ntlmssp_state
);
798 return NT_STATUS_NO_MEMORY
;
800 ntlmssp_state
->client
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
801 if (!ntlmssp_state
->client
.netbios_domain
) {
802 talloc_free(ntlmssp_state
);
803 return NT_STATUS_NO_MEMORY
;
806 *_ntlmssp_state
= ntlmssp_state
;