2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003
8 Copyright (C) Andrew Bartlett 2005 (Updated from gensec).
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_ntlmssp.h"
28 #include "../libcli/auth/ntlmssp_ndr.h"
30 static NTSTATUS
ntlmssp_client_initial(struct ntlmssp_state
*ntlmssp_state
,
31 DATA_BLOB reply
, DATA_BLOB
*next_request
);
32 static NTSTATUS
ntlmssp_server_negotiate(struct ntlmssp_state
*ntlmssp_state
,
33 const DATA_BLOB in
, DATA_BLOB
*out
);
34 static NTSTATUS
ntlmssp_client_challenge(struct ntlmssp_state
*ntlmssp_state
,
35 const DATA_BLOB reply
, DATA_BLOB
*next_request
);
36 static NTSTATUS
ntlmssp_server_auth(struct ntlmssp_state
*ntlmssp_state
,
37 const DATA_BLOB request
, DATA_BLOB
*reply
);
40 * Callbacks for NTLMSSP - for both client and server operating modes
44 static const struct ntlmssp_callbacks
{
45 enum ntlmssp_role role
;
46 enum ntlmssp_message_type ntlmssp_command
;
47 NTSTATUS (*fn
)(struct ntlmssp_state
*ntlmssp_state
,
48 DATA_BLOB in
, DATA_BLOB
*out
);
49 } ntlmssp_callbacks
[] = {
50 {NTLMSSP_CLIENT
, NTLMSSP_INITIAL
, ntlmssp_client_initial
},
51 {NTLMSSP_SERVER
, NTLMSSP_NEGOTIATE
, ntlmssp_server_negotiate
},
52 {NTLMSSP_CLIENT
, NTLMSSP_CHALLENGE
, ntlmssp_client_challenge
},
53 {NTLMSSP_SERVER
, NTLMSSP_AUTH
, ntlmssp_server_auth
},
54 {NTLMSSP_CLIENT
, NTLMSSP_UNKNOWN
, NULL
},
55 {NTLMSSP_SERVER
, NTLMSSP_UNKNOWN
, NULL
}
60 * Print out the NTLMSSP flags for debugging
61 * @param neg_flags The flags from the packet
64 void debug_ntlmssp_flags(uint32 neg_flags
)
66 DEBUG(3,("Got NTLMSSP neg_flags=0x%08x\n", neg_flags
));
68 if (neg_flags
& NTLMSSP_NEGOTIATE_UNICODE
)
69 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_UNICODE\n"));
70 if (neg_flags
& NTLMSSP_NEGOTIATE_OEM
)
71 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM\n"));
72 if (neg_flags
& NTLMSSP_REQUEST_TARGET
)
73 DEBUGADD(4, (" NTLMSSP_REQUEST_TARGET\n"));
74 if (neg_flags
& NTLMSSP_NEGOTIATE_SIGN
)
75 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_SIGN\n"));
76 if (neg_flags
& NTLMSSP_NEGOTIATE_SEAL
)
77 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_SEAL\n"));
78 if (neg_flags
& NTLMSSP_NEGOTIATE_DATAGRAM
)
79 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_DATAGRAM\n"));
80 if (neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
)
81 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_LM_KEY\n"));
82 if (neg_flags
& NTLMSSP_NEGOTIATE_NETWARE
)
83 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NETWARE\n"));
84 if (neg_flags
& NTLMSSP_NEGOTIATE_NTLM
)
85 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NTLM\n"));
86 if (neg_flags
& NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
)
87 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED\n"));
88 if (neg_flags
& NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED
)
89 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED\n"));
90 if (neg_flags
& NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL
)
91 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL\n"));
92 if (neg_flags
& NTLMSSP_NEGOTIATE_ALWAYS_SIGN
)
93 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_ALWAYS_SIGN\n"));
94 if (neg_flags
& NTLMSSP_REQUEST_NON_NT_SESSION_KEY
)
95 DEBUGADD(4, (" NTLMSSP_REQUEST_NON_NT_SESSION_KEY\n"));
96 if (neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
)
97 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NTLM2\n"));
98 if (neg_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
)
99 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_TARGET_INFO\n"));
100 if (neg_flags
& NTLMSSP_NEGOTIATE_VERSION
)
101 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_VERSION\n"));
102 if (neg_flags
& NTLMSSP_NEGOTIATE_128
)
103 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_128\n"));
104 if (neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
)
105 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_KEY_EXCH\n"));
106 if (neg_flags
& NTLMSSP_NEGOTIATE_56
)
107 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_56\n"));
111 * Default challenge generation code.
115 static NTSTATUS
get_challenge(const struct ntlmssp_state
*ntlmssp_state
,
118 generate_random_buffer(chal
, 8);
123 * Default 'we can set the challenge to anything we like' implementation
127 static bool may_set_challenge(const struct ntlmssp_state
*ntlmssp_state
)
133 * Default 'we can set the challenge to anything we like' implementation
135 * Does not actually do anything, as the value is always in the structure anyway.
139 static NTSTATUS
set_challenge(struct ntlmssp_state
*ntlmssp_state
, DATA_BLOB
*challenge
)
141 SMB_ASSERT(challenge
->length
== 8);
146 * Set a username on an NTLMSSP context - ensures it is talloc()ed
150 NTSTATUS
ntlmssp_set_username(struct ntlmssp_state
*ntlmssp_state
, const char *user
)
152 ntlmssp_state
->user
= talloc_strdup(ntlmssp_state
, user
? user
: "" );
153 if (!ntlmssp_state
->user
) {
154 return NT_STATUS_NO_MEMORY
;
160 * Store NT and LM hashes on an NTLMSSP context - ensures they are talloc()ed
163 NTSTATUS
ntlmssp_set_hashes(struct ntlmssp_state
*ntlmssp_state
,
164 const unsigned char lm_hash
[16],
165 const unsigned char nt_hash
[16])
167 ntlmssp_state
->lm_hash
= (unsigned char *)
168 TALLOC_MEMDUP(ntlmssp_state
, lm_hash
, 16);
169 ntlmssp_state
->nt_hash
= (unsigned char *)
170 TALLOC_MEMDUP(ntlmssp_state
, nt_hash
, 16);
171 if (!ntlmssp_state
->lm_hash
|| !ntlmssp_state
->nt_hash
) {
172 TALLOC_FREE(ntlmssp_state
->lm_hash
);
173 TALLOC_FREE(ntlmssp_state
->nt_hash
);
174 return NT_STATUS_NO_MEMORY
;
180 * Converts a password to the hashes on an NTLMSSP context.
183 NTSTATUS
ntlmssp_set_password(struct ntlmssp_state
*ntlmssp_state
, const char *password
)
186 ntlmssp_state
->lm_hash
= NULL
;
187 ntlmssp_state
->nt_hash
= NULL
;
189 unsigned char lm_hash
[16];
190 unsigned char nt_hash
[16];
192 E_deshash(password
, lm_hash
);
193 E_md4hash(password
, nt_hash
);
194 return ntlmssp_set_hashes(ntlmssp_state
, lm_hash
, nt_hash
);
200 * Set a domain on an NTLMSSP context - ensures it is talloc()ed
203 NTSTATUS
ntlmssp_set_domain(struct ntlmssp_state
*ntlmssp_state
, const char *domain
)
205 ntlmssp_state
->domain
= talloc_strdup(ntlmssp_state
,
206 domain
? domain
: "" );
207 if (!ntlmssp_state
->domain
) {
208 return NT_STATUS_NO_MEMORY
;
214 * Set a workstation on an NTLMSSP context - ensures it is talloc()ed
217 NTSTATUS
ntlmssp_set_workstation(struct ntlmssp_state
*ntlmssp_state
, const char *workstation
)
219 ntlmssp_state
->workstation
= talloc_strdup(ntlmssp_state
, workstation
);
220 if (!ntlmssp_state
->workstation
) {
221 return NT_STATUS_NO_MEMORY
;
227 * Request features for the NTLMSSP negotiation
229 * @param ntlmssp_state NTLMSSP state
230 * @param feature_list List of space seperated features requested from NTLMSSP.
232 void ntlmssp_want_feature_list(struct ntlmssp_state
*ntlmssp_state
, char *feature_list
)
235 * We need to set this to allow a later SetPassword
236 * via the SAMR pipe to succeed. Strange.... We could
237 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
239 if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list
, True
)) {
240 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
242 if (in_list("NTLMSSP_FEATURE_SIGN", feature_list
, True
)) {
243 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
245 if(in_list("NTLMSSP_FEATURE_SEAL", feature_list
, True
)) {
246 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
248 if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list
, true)) {
249 ntlmssp_state
->use_ccache
= true;
254 * Request a feature for the NTLMSSP negotiation
256 * @param ntlmssp_state NTLMSSP state
257 * @param feature Bit flag specifying the requested feature
259 void ntlmssp_want_feature(struct ntlmssp_state
*ntlmssp_state
, uint32 feature
)
261 /* As per JRA's comment above */
262 if (feature
& NTLMSSP_FEATURE_SESSION_KEY
) {
263 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
265 if (feature
& NTLMSSP_FEATURE_SIGN
) {
266 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
268 if (feature
& NTLMSSP_FEATURE_SEAL
) {
269 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
271 if (feature
& NTLMSSP_FEATURE_CCACHE
) {
272 ntlmssp_state
->use_ccache
= true;
277 * Next state function for the NTLMSSP state machine
279 * @param ntlmssp_state NTLMSSP State
280 * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB
281 * @param out The reply, as an allocated DATA_BLOB, caller to free.
282 * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK.
285 NTSTATUS
ntlmssp_update(struct ntlmssp_state
*ntlmssp_state
,
286 const DATA_BLOB input
, DATA_BLOB
*out
)
288 uint32 ntlmssp_command
;
291 if (ntlmssp_state
->expected_state
== NTLMSSP_DONE
) {
292 /* Called update after negotiations finished. */
293 DEBUG(1, ("Called NTLMSSP after state machine was 'done'\n"));
294 return NT_STATUS_INVALID_PARAMETER
;
297 *out
= data_blob_null
;
300 switch (ntlmssp_state
->role
) {
302 ntlmssp_command
= NTLMSSP_INITIAL
;
305 /* 'datagram' mode - no neg packet */
306 ntlmssp_command
= NTLMSSP_NEGOTIATE
;
310 if (!msrpc_parse(ntlmssp_state
, &input
, "Cd",
313 DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
314 dump_data(2, input
.data
, input
.length
);
315 return NT_STATUS_INVALID_PARAMETER
;
319 if (ntlmssp_command
!= ntlmssp_state
->expected_state
) {
320 DEBUG(1, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command
, ntlmssp_state
->expected_state
));
321 return NT_STATUS_INVALID_PARAMETER
;
324 for (i
=0; ntlmssp_callbacks
[i
].fn
; i
++) {
325 if (ntlmssp_callbacks
[i
].role
== ntlmssp_state
->role
326 && ntlmssp_callbacks
[i
].ntlmssp_command
== ntlmssp_command
) {
327 return ntlmssp_callbacks
[i
].fn(ntlmssp_state
, input
, out
);
331 DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
332 ntlmssp_state
->role
, ntlmssp_command
));
334 return NT_STATUS_INVALID_PARAMETER
;
338 * End an NTLMSSP state machine
340 * @param ntlmssp_state NTLMSSP State, free()ed by this function
343 void ntlmssp_end(struct ntlmssp_state
**ntlmssp_state
)
345 data_blob_free(&(*ntlmssp_state
)->chal
);
346 data_blob_free(&(*ntlmssp_state
)->lm_resp
);
347 data_blob_free(&(*ntlmssp_state
)->nt_resp
);
348 TALLOC_FREE(*ntlmssp_state
);
350 *ntlmssp_state
= NULL
;
355 * Determine correct target name flags for reply, given server role
356 * and negotiated flags
358 * @param ntlmssp_state NTLMSSP State
359 * @param neg_flags The flags from the packet
360 * @param chal_flags The flags to be set in the reply packet
361 * @return The 'target name' string.
364 static const char *ntlmssp_target_name(struct ntlmssp_state
*ntlmssp_state
,
365 uint32 neg_flags
, uint32
*chal_flags
)
367 if (neg_flags
& NTLMSSP_REQUEST_TARGET
) {
368 *chal_flags
|= NTLMSSP_NEGOTIATE_TARGET_INFO
;
369 *chal_flags
|= NTLMSSP_REQUEST_TARGET
;
370 if (ntlmssp_state
->server
.is_standalone
) {
371 *chal_flags
|= NTLMSSP_TARGET_TYPE_SERVER
;
372 return ntlmssp_state
->server
.netbios_name
;
374 *chal_flags
|= NTLMSSP_TARGET_TYPE_DOMAIN
;
375 return ntlmssp_state
->server
.netbios_domain
;
382 static void ntlmssp_handle_neg_flags(struct ntlmssp_state
*ntlmssp_state
,
383 uint32 neg_flags
, bool allow_lm
) {
384 if (neg_flags
& NTLMSSP_NEGOTIATE_UNICODE
) {
385 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_UNICODE
;
386 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_OEM
;
387 ntlmssp_state
->unicode
= True
;
389 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_UNICODE
;
390 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_OEM
;
391 ntlmssp_state
->unicode
= False
;
394 if ((neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
) && allow_lm
) {
395 /* other end forcing us to use LM */
396 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_LM_KEY
;
397 ntlmssp_state
->use_ntlmv2
= False
;
399 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_LM_KEY
;
402 if (!(neg_flags
& NTLMSSP_NEGOTIATE_ALWAYS_SIGN
)) {
403 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_ALWAYS_SIGN
;
406 if (!(neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
)) {
407 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
410 if (!(neg_flags
& NTLMSSP_NEGOTIATE_128
)) {
411 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_128
;
414 if (!(neg_flags
& NTLMSSP_NEGOTIATE_56
)) {
415 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_56
;
418 if (!(neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
)) {
419 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_KEY_EXCH
;
422 if (!(neg_flags
& NTLMSSP_NEGOTIATE_SIGN
)) {
423 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_SIGN
;
426 if (!(neg_flags
& NTLMSSP_NEGOTIATE_SEAL
)) {
427 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_SEAL
;
430 /* Woop Woop - unknown flag for Windows compatibility...
431 What does this really do ? JRA. */
432 if (!(neg_flags
& NTLMSSP_NEGOTIATE_VERSION
)) {
433 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_VERSION
;
436 if ((neg_flags
& NTLMSSP_REQUEST_TARGET
)) {
437 ntlmssp_state
->neg_flags
|= NTLMSSP_REQUEST_TARGET
;
442 Weaken NTLMSSP keys to cope with down-level clients and servers.
444 We probably should have some parameters to control this, but as
445 it only occours for LM_KEY connections, and this is controlled
446 by the client lanman auth/lanman auth parameters, it isn't too bad.
449 DATA_BLOB
ntlmssp_weaken_keys(struct ntlmssp_state
*ntlmssp_state
, TALLOC_CTX
*mem_ctx
)
451 DATA_BLOB weakened_key
= data_blob_talloc(mem_ctx
,
452 ntlmssp_state
->session_key
.data
,
453 ntlmssp_state
->session_key
.length
);
455 /* Nothing to weaken. We certainly don't want to 'extend' the length... */
456 if (weakened_key
.length
< 16) {
457 /* perhaps there was no key? */
461 /* Key weakening not performed on the master key for NTLM2
462 and does not occour for NTLM1. Therefore we only need
463 to do this for the LM_KEY.
466 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
) {
467 /* LM key doesn't support 128 bit crypto, so this is
468 * the best we can do. If you negotiate 128 bit, but
469 * not 56, you end up with 40 bit... */
470 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_56
) {
471 weakened_key
.data
[7] = 0xa0;
472 } else { /* forty bits */
473 weakened_key
.data
[5] = 0xe5;
474 weakened_key
.data
[6] = 0x38;
475 weakened_key
.data
[7] = 0xb0;
477 weakened_key
.length
= 8;
483 * Next state function for the Negotiate packet
485 * @param ntlmssp_state NTLMSSP State
486 * @param request The request, as a DATA_BLOB
487 * @param request The reply, as an allocated DATA_BLOB, caller to free.
488 * @return Errors or MORE_PROCESSING_REQUIRED if a reply is sent.
491 static NTSTATUS
ntlmssp_server_negotiate(struct ntlmssp_state
*ntlmssp_state
,
492 const DATA_BLOB request
, DATA_BLOB
*reply
)
494 DATA_BLOB struct_blob
;
495 uint32 neg_flags
= 0;
496 uint32 ntlmssp_command
, chal_flags
;
498 const char *target_name
;
499 struct NEGOTIATE_MESSAGE negotiate
;
500 struct CHALLENGE_MESSAGE challenge
;
503 /* parse the NTLMSSP packet */
505 file_save("ntlmssp_negotiate.dat", request
.data
, request
.length
);
508 if (request
.length
) {
509 if ((request
.length
< 16) || !msrpc_parse(ntlmssp_state
, &request
, "Cdd",
513 DEBUG(1, ("ntlmssp_server_negotiate: failed to parse NTLMSSP Negotiate of length %u\n",
514 (unsigned int)request
.length
));
515 dump_data(2, request
.data
, request
.length
);
516 return NT_STATUS_INVALID_PARAMETER
;
518 debug_ntlmssp_flags(neg_flags
);
520 if (DEBUGLEVEL
>= 10) {
521 if (NT_STATUS_IS_OK(ntlmssp_pull_NEGOTIATE_MESSAGE(&request
,
526 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE
, &negotiate
);
531 ntlmssp_handle_neg_flags(ntlmssp_state
, neg_flags
, lp_lanman_auth());
533 /* Ask our caller what challenge they would like in the packet */
534 status
= ntlmssp_state
->get_challenge(ntlmssp_state
, cryptkey
);
535 if (!NT_STATUS_IS_OK(status
)) {
539 /* Check if we may set the challenge */
540 if (!ntlmssp_state
->may_set_challenge(ntlmssp_state
)) {
541 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
544 /* The flags we send back are not just the negotiated flags,
545 * they are also 'what is in this packet'. Therfore, we
546 * operate on 'chal_flags' from here on
549 chal_flags
= ntlmssp_state
->neg_flags
;
551 /* get the right name to fill in as 'target' */
552 target_name
= ntlmssp_target_name(ntlmssp_state
,
553 neg_flags
, &chal_flags
);
554 if (target_name
== NULL
)
555 return NT_STATUS_INVALID_PARAMETER
;
557 ntlmssp_state
->chal
= data_blob_talloc(ntlmssp_state
, cryptkey
, 8);
558 ntlmssp_state
->internal_chal
= data_blob_talloc(ntlmssp_state
,
561 /* This creates the 'blob' of names that appears at the end of the packet */
562 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
)
564 msrpc_gen(ntlmssp_state
, &struct_blob
, "aaaaa",
565 MsvAvNbDomainName
, target_name
,
566 MsvAvNbComputerName
, ntlmssp_state
->server
.netbios_name
,
567 MsvAvDnsDomainName
, ntlmssp_state
->server
.dns_domain
,
568 MsvAvDnsComputerName
, ntlmssp_state
->server
.dns_name
,
571 struct_blob
= data_blob_null
;
575 /* Marshel the packet in the right format, be it unicode or ASCII */
576 const char *gen_string
;
577 if (ntlmssp_state
->unicode
) {
578 gen_string
= "CdUdbddB";
580 gen_string
= "CdAdbddB";
583 msrpc_gen(ntlmssp_state
, reply
, gen_string
,
590 struct_blob
.data
, struct_blob
.length
);
592 if (DEBUGLEVEL
>= 10) {
593 if (NT_STATUS_IS_OK(ntlmssp_pull_CHALLENGE_MESSAGE(reply
,
598 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE
, &challenge
);
603 data_blob_free(&struct_blob
);
605 ntlmssp_state
->expected_state
= NTLMSSP_AUTH
;
607 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
611 * Next state function for the Authenticate packet
613 * @param ntlmssp_state NTLMSSP State
614 * @param request The request, as a DATA_BLOB
615 * @param request The reply, as an allocated DATA_BLOB, caller to free.
616 * @return Errors or NT_STATUS_OK.
619 static NTSTATUS
ntlmssp_server_auth(struct ntlmssp_state
*ntlmssp_state
,
620 const DATA_BLOB request
, DATA_BLOB
*reply
)
622 DATA_BLOB encrypted_session_key
= data_blob_null
;
623 DATA_BLOB user_session_key
= data_blob_null
;
624 DATA_BLOB lm_session_key
= data_blob_null
;
625 DATA_BLOB session_key
= data_blob_null
;
626 uint32 ntlmssp_command
, auth_flags
;
627 NTSTATUS nt_status
= NT_STATUS_OK
;
628 struct AUTHENTICATE_MESSAGE authenticate
;
631 bool doing_ntlm2
= False
;
633 uchar session_nonce
[16];
634 uchar session_nonce_hash
[16];
636 const char *parse_string
;
638 /* parse the NTLMSSP packet */
639 *reply
= data_blob_null
;
642 file_save("ntlmssp_auth.dat", request
.data
, request
.length
);
645 if (ntlmssp_state
->unicode
) {
646 parse_string
= "CdBBUUUBd";
648 parse_string
= "CdBBAAABd";
651 data_blob_free(&ntlmssp_state
->lm_resp
);
652 data_blob_free(&ntlmssp_state
->nt_resp
);
654 ntlmssp_state
->user
= NULL
;
655 ntlmssp_state
->domain
= NULL
;
656 ntlmssp_state
->workstation
= NULL
;
658 /* now the NTLMSSP encoded auth hashes */
659 if (!msrpc_parse(ntlmssp_state
, &request
, parse_string
,
662 &ntlmssp_state
->lm_resp
,
663 &ntlmssp_state
->nt_resp
,
664 &ntlmssp_state
->domain
,
665 &ntlmssp_state
->user
,
666 &ntlmssp_state
->workstation
,
667 &encrypted_session_key
,
671 /* Try again with a shorter string (Win9X truncates this packet) */
672 if (ntlmssp_state
->unicode
) {
673 parse_string
= "CdBBUUU";
675 parse_string
= "CdBBAAA";
678 /* now the NTLMSSP encoded auth hashes */
679 if (!msrpc_parse(ntlmssp_state
, &request
, parse_string
,
682 &ntlmssp_state
->lm_resp
,
683 &ntlmssp_state
->nt_resp
,
684 &ntlmssp_state
->domain
,
685 &ntlmssp_state
->user
,
686 &ntlmssp_state
->workstation
)) {
687 DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP (tried both formats):\n"));
688 dump_data(2, request
.data
, request
.length
);
690 return NT_STATUS_INVALID_PARAMETER
;
695 ntlmssp_handle_neg_flags(ntlmssp_state
, auth_flags
, lp_lanman_auth());
697 if (DEBUGLEVEL
>= 10) {
698 if (NT_STATUS_IS_OK(ntlmssp_pull_AUTHENTICATE_MESSAGE(&request
,
703 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE
, &authenticate
);
707 DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
708 ntlmssp_state
->user
, ntlmssp_state
->domain
, ntlmssp_state
->workstation
, (unsigned long)ntlmssp_state
->lm_resp
.length
, (unsigned long)ntlmssp_state
->nt_resp
.length
));
711 file_save("nthash1.dat", &ntlmssp_state
->nt_resp
.data
, &ntlmssp_state
->nt_resp
.length
);
712 file_save("lmhash1.dat", &ntlmssp_state
->lm_resp
.data
, &ntlmssp_state
->lm_resp
.length
);
715 /* NTLM2 uses a 'challenge' that is made of up both the server challenge, and a
718 However, the NTLM2 flag may still be set for the real NTLMv2 logins, be careful.
720 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
) {
721 if (ntlmssp_state
->nt_resp
.length
== 24 && ntlmssp_state
->lm_resp
.length
== 24) {
722 struct MD5Context md5_session_nonce_ctx
;
723 SMB_ASSERT(ntlmssp_state
->internal_chal
.data
&& ntlmssp_state
->internal_chal
.length
== 8);
727 memcpy(session_nonce
, ntlmssp_state
->internal_chal
.data
, 8);
728 memcpy(&session_nonce
[8], ntlmssp_state
->lm_resp
.data
, 8);
730 MD5Init(&md5_session_nonce_ctx
);
731 MD5Update(&md5_session_nonce_ctx
, session_nonce
, 16);
732 MD5Final(session_nonce_hash
, &md5_session_nonce_ctx
);
734 ntlmssp_state
->chal
= data_blob_talloc(
735 ntlmssp_state
, session_nonce_hash
, 8);
737 /* LM response is no longer useful */
738 data_blob_free(&ntlmssp_state
->lm_resp
);
740 /* We changed the effective challenge - set it */
741 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_state
->set_challenge(ntlmssp_state
, &ntlmssp_state
->chal
))) {
742 data_blob_free(&encrypted_session_key
);
746 /* LM Key is incompatible. */
747 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_LM_KEY
;
752 * Note we don't check here for NTLMv2 auth settings. If NTLMv2 auth
753 * is required (by "ntlm auth = no" and "lm auth = no" being set in the
754 * smb.conf file) and no NTLMv2 response was sent then the password check
755 * will fail here. JRA.
758 /* Finally, actually ask if the password is OK */
760 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_state
->check_password(ntlmssp_state
,
761 &user_session_key
, &lm_session_key
))) {
762 data_blob_free(&encrypted_session_key
);
766 dump_data_pw("NT session key:\n", user_session_key
.data
, user_session_key
.length
);
767 dump_data_pw("LM first-8:\n", lm_session_key
.data
, lm_session_key
.length
);
769 /* Handle the different session key derivation for NTLM2 */
771 if (user_session_key
.data
&& user_session_key
.length
== 16) {
772 session_key
= data_blob_talloc(ntlmssp_state
,
774 hmac_md5(user_session_key
.data
, session_nonce
,
775 sizeof(session_nonce
), session_key
.data
);
776 DEBUG(10,("ntlmssp_server_auth: Created NTLM2 session key.\n"));
777 dump_data_pw("NTLM2 session key:\n", session_key
.data
, session_key
.length
);
780 DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM2 session key.\n"));
781 session_key
= data_blob_null
;
783 } else if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
) {
784 if (lm_session_key
.data
&& lm_session_key
.length
>= 8) {
785 if (ntlmssp_state
->lm_resp
.data
&& ntlmssp_state
->lm_resp
.length
== 24) {
786 session_key
= data_blob_talloc(ntlmssp_state
,
788 if (session_key
.data
== NULL
) {
789 return NT_STATUS_NO_MEMORY
;
791 SMBsesskeygen_lm_sess_key(lm_session_key
.data
, ntlmssp_state
->lm_resp
.data
,
793 DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
795 static const uint8 zeros
[24] = {0, };
796 session_key
= data_blob_talloc(
797 ntlmssp_state
, NULL
, 16);
798 if (session_key
.data
== NULL
) {
799 return NT_STATUS_NO_MEMORY
;
801 SMBsesskeygen_lm_sess_key(
802 lm_session_key
.data
, zeros
,
805 dump_data_pw("LM session key:\n", session_key
.data
,
808 DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM session key.\n"));
809 session_key
= data_blob_null
;
811 } else if (user_session_key
.data
) {
812 session_key
= user_session_key
;
813 DEBUG(10,("ntlmssp_server_auth: Using unmodified nt session key.\n"));
814 dump_data_pw("unmodified session key:\n", session_key
.data
, session_key
.length
);
815 } else if (lm_session_key
.data
) {
816 session_key
= lm_session_key
;
817 DEBUG(10,("ntlmssp_server_auth: Using unmodified lm session key.\n"));
818 dump_data_pw("unmodified session key:\n", session_key
.data
, session_key
.length
);
820 DEBUG(10,("ntlmssp_server_auth: Failed to create unmodified session key.\n"));
821 session_key
= data_blob_null
;
824 /* With KEY_EXCH, the client supplies the proposed session key,
825 but encrypts it with the long-term key */
826 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
) {
827 if (!encrypted_session_key
.data
|| encrypted_session_key
.length
!= 16) {
828 data_blob_free(&encrypted_session_key
);
829 DEBUG(1, ("Client-supplied KEY_EXCH session key was of invalid length (%u)!\n",
830 (unsigned int)encrypted_session_key
.length
));
831 return NT_STATUS_INVALID_PARAMETER
;
832 } else if (!session_key
.data
|| session_key
.length
!= 16) {
833 DEBUG(5, ("server session key is invalid (len == %u), cannot do KEY_EXCH!\n",
834 (unsigned int)session_key
.length
));
835 ntlmssp_state
->session_key
= session_key
;
837 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
838 arcfour_crypt_blob(encrypted_session_key
.data
,
839 encrypted_session_key
.length
,
841 ntlmssp_state
->session_key
= data_blob_talloc(
842 ntlmssp_state
, encrypted_session_key
.data
,
843 encrypted_session_key
.length
);
844 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key
.data
,
845 encrypted_session_key
.length
);
848 ntlmssp_state
->session_key
= session_key
;
851 if (!NT_STATUS_IS_OK(nt_status
)) {
852 ntlmssp_state
->session_key
= data_blob_null
;
853 } else if (ntlmssp_state
->session_key
.length
) {
854 nt_status
= ntlmssp_sign_init(ntlmssp_state
);
857 data_blob_free(&encrypted_session_key
);
859 /* Only one authentication allowed per server state. */
860 ntlmssp_state
->expected_state
= NTLMSSP_DONE
;
866 * Create an NTLMSSP state machine
868 * @param ntlmssp_state NTLMSSP State, allocated by this function
871 NTSTATUS
ntlmssp_server_start(TALLOC_CTX
*mem_ctx
,
873 const char *netbios_name
,
874 const char *netbios_domain
,
875 const char *dns_name
,
876 const char *dns_domain
,
877 struct ntlmssp_state
**_ntlmssp_state
)
879 struct ntlmssp_state
*ntlmssp_state
;
885 if (!netbios_domain
) {
897 ntlmssp_state
= talloc_zero(mem_ctx
, struct ntlmssp_state
);
898 if (!ntlmssp_state
) {
899 return NT_STATUS_NO_MEMORY
;
902 ntlmssp_state
->role
= NTLMSSP_SERVER
;
904 ntlmssp_state
->get_challenge
= get_challenge
;
905 ntlmssp_state
->set_challenge
= set_challenge
;
906 ntlmssp_state
->may_set_challenge
= may_set_challenge
;
908 ntlmssp_state
->server
.is_standalone
= is_standalone
;
910 ntlmssp_state
->expected_state
= NTLMSSP_NEGOTIATE
;
912 ntlmssp_state
->neg_flags
=
913 NTLMSSP_NEGOTIATE_128
|
914 NTLMSSP_NEGOTIATE_56
|
915 NTLMSSP_NEGOTIATE_VERSION
|
916 NTLMSSP_NEGOTIATE_ALWAYS_SIGN
|
917 NTLMSSP_NEGOTIATE_NTLM
|
918 NTLMSSP_NEGOTIATE_NTLM2
|
919 NTLMSSP_NEGOTIATE_KEY_EXCH
|
920 NTLMSSP_NEGOTIATE_SIGN
|
921 NTLMSSP_NEGOTIATE_SEAL
;
923 ntlmssp_state
->server
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
924 if (!ntlmssp_state
->server
.netbios_name
) {
925 talloc_free(ntlmssp_state
);
926 return NT_STATUS_NO_MEMORY
;
928 ntlmssp_state
->server
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
929 if (!ntlmssp_state
->server
.netbios_domain
) {
930 talloc_free(ntlmssp_state
);
931 return NT_STATUS_NO_MEMORY
;
933 ntlmssp_state
->server
.dns_name
= talloc_strdup(ntlmssp_state
, dns_name
);
934 if (!ntlmssp_state
->server
.dns_name
) {
935 talloc_free(ntlmssp_state
);
936 return NT_STATUS_NO_MEMORY
;
938 ntlmssp_state
->server
.dns_domain
= talloc_strdup(ntlmssp_state
, dns_domain
);
939 if (!ntlmssp_state
->server
.dns_domain
) {
940 talloc_free(ntlmssp_state
);
941 return NT_STATUS_NO_MEMORY
;
944 *_ntlmssp_state
= ntlmssp_state
;
948 /*********************************************************************
950 *********************************************************************/
953 * Next state function for the Initial packet
955 * @param ntlmssp_state NTLMSSP State
956 * @param request The request, as a DATA_BLOB. reply.data must be NULL
957 * @param request The reply, as an allocated DATA_BLOB, caller to free.
958 * @return Errors or NT_STATUS_OK.
961 static NTSTATUS
ntlmssp_client_initial(struct ntlmssp_state
*ntlmssp_state
,
962 DATA_BLOB reply
, DATA_BLOB
*next_request
)
964 struct NEGOTIATE_MESSAGE negotiate
;
966 if (ntlmssp_state
->unicode
) {
967 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_UNICODE
;
969 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_OEM
;
972 if (ntlmssp_state
->use_ntlmv2
) {
973 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_NTLM2
;
976 /* generate the ntlmssp negotiate packet */
977 msrpc_gen(ntlmssp_state
, next_request
, "CddAA",
980 ntlmssp_state
->neg_flags
,
981 ntlmssp_state
->client
.netbios_domain
,
982 ntlmssp_state
->client
.netbios_name
);
984 if (DEBUGLEVEL
>= 10) {
985 if (NT_STATUS_IS_OK(ntlmssp_pull_NEGOTIATE_MESSAGE(next_request
,
990 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE
, &negotiate
);
994 ntlmssp_state
->expected_state
= NTLMSSP_CHALLENGE
;
996 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
1000 * Next state function for the Challenge Packet. Generate an auth packet.
1002 * @param ntlmssp_state NTLMSSP State
1003 * @param request The request, as a DATA_BLOB. reply.data must be NULL
1004 * @param request The reply, as an allocated DATA_BLOB, caller to free.
1005 * @return Errors or NT_STATUS_OK.
1008 static NTSTATUS
ntlmssp_client_challenge(struct ntlmssp_state
*ntlmssp_state
,
1009 const DATA_BLOB reply
, DATA_BLOB
*next_request
)
1011 uint32 chal_flags
, ntlmssp_command
, unkn1
, unkn2
;
1012 DATA_BLOB server_domain_blob
;
1013 DATA_BLOB challenge_blob
;
1014 DATA_BLOB struct_blob
= data_blob_null
;
1015 char *server_domain
;
1016 const char *chal_parse_string
;
1017 const char *auth_gen_string
;
1018 DATA_BLOB lm_response
= data_blob_null
;
1019 DATA_BLOB nt_response
= data_blob_null
;
1020 DATA_BLOB session_key
= data_blob_null
;
1021 DATA_BLOB encrypted_session_key
= data_blob_null
;
1022 NTSTATUS nt_status
= NT_STATUS_OK
;
1023 struct CHALLENGE_MESSAGE challenge
;
1024 struct AUTHENTICATE_MESSAGE authenticate
;
1026 if (ntlmssp_state
->use_ccache
) {
1027 struct wbcCredentialCacheParams params
;
1028 struct wbcCredentialCacheInfo
*info
= NULL
;
1029 struct wbcAuthErrorInfo
*error
= NULL
;
1030 struct wbcNamedBlob auth_blob
;
1031 struct wbcBlob
*wbc_next
= NULL
;
1032 struct wbcBlob
*wbc_session_key
= NULL
;
1036 params
.account_name
= ntlmssp_state
->user
;
1037 params
.domain_name
= ntlmssp_state
->domain
;
1038 params
.level
= WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP
;
1040 auth_blob
.name
= "challenge_blob";
1041 auth_blob
.flags
= 0;
1042 auth_blob
.blob
.data
= reply
.data
;
1043 auth_blob
.blob
.length
= reply
.length
;
1044 params
.num_blobs
= 1;
1045 params
.blobs
= &auth_blob
;
1047 wbc_status
= wbcCredentialCache(¶ms
, &info
, &error
);
1048 if (error
!= NULL
) {
1049 wbcFreeMemory(error
);
1051 if (!WBC_ERROR_IS_OK(wbc_status
)) {
1055 for (i
=0; i
<info
->num_blobs
; i
++) {
1056 if (strequal(info
->blobs
[i
].name
, "auth_blob")) {
1057 wbc_next
= &info
->blobs
[i
].blob
;
1059 if (strequal(info
->blobs
[i
].name
, "session_key")) {
1060 wbc_session_key
= &info
->blobs
[i
].blob
;
1063 if ((wbc_next
== NULL
) || (wbc_session_key
== NULL
)) {
1064 wbcFreeMemory(info
);
1068 *next_request
= data_blob(wbc_next
->data
, wbc_next
->length
);
1069 ntlmssp_state
->session_key
= data_blob(
1070 wbc_session_key
->data
, wbc_session_key
->length
);
1072 wbcFreeMemory(info
);
1078 if (!msrpc_parse(ntlmssp_state
, &reply
, "CdBd",
1081 &server_domain_blob
,
1083 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
1084 dump_data(2, reply
.data
, reply
.length
);
1086 return NT_STATUS_INVALID_PARAMETER
;
1089 if (DEBUGLEVEL
>= 10) {
1090 if (NT_STATUS_IS_OK(ntlmssp_pull_CHALLENGE_MESSAGE(&reply
,
1095 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE
, &challenge
);
1099 data_blob_free(&server_domain_blob
);
1101 DEBUG(3, ("Got challenge flags:\n"));
1102 debug_ntlmssp_flags(chal_flags
);
1104 ntlmssp_handle_neg_flags(ntlmssp_state
, chal_flags
, lp_client_lanman_auth());
1106 if (ntlmssp_state
->unicode
) {
1107 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
) {
1108 chal_parse_string
= "CdUdbddB";
1110 chal_parse_string
= "CdUdbdd";
1112 auth_gen_string
= "CdBBUUUBd";
1114 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
) {
1115 chal_parse_string
= "CdAdbddB";
1117 chal_parse_string
= "CdAdbdd";
1120 auth_gen_string
= "CdBBAAABd";
1123 DEBUG(3, ("NTLMSSP: Set final flags:\n"));
1124 debug_ntlmssp_flags(ntlmssp_state
->neg_flags
);
1126 if (!msrpc_parse(ntlmssp_state
, &reply
, chal_parse_string
,
1134 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
1135 dump_data(2, reply
.data
, reply
.length
);
1136 return NT_STATUS_INVALID_PARAMETER
;
1139 if (chal_flags
& NTLMSSP_TARGET_TYPE_SERVER
) {
1140 ntlmssp_state
->server
.is_standalone
= true;
1142 ntlmssp_state
->server
.is_standalone
= false;
1144 /* TODO: parse struct_blob and fill in the rest */
1145 ntlmssp_state
->server
.netbios_name
= "";
1146 ntlmssp_state
->server
.netbios_domain
= server_domain
;
1147 ntlmssp_state
->server
.dns_name
= "";
1148 ntlmssp_state
->server
.dns_domain
= "";
1150 if (challenge_blob
.length
!= 8) {
1151 data_blob_free(&struct_blob
);
1152 return NT_STATUS_INVALID_PARAMETER
;
1155 if (!ntlmssp_state
->nt_hash
|| !ntlmssp_state
->lm_hash
) {
1156 static const uint8_t zeros
[16] = {0, };
1157 /* do nothing - blobs are zero length */
1159 /* session key is all zeros */
1160 session_key
= data_blob_talloc(ntlmssp_state
, zeros
, 16);
1162 /* not doing NLTM2 without a password */
1163 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
1164 } else if (ntlmssp_state
->use_ntlmv2
) {
1165 if (!struct_blob
.length
) {
1166 /* be lazy, match win2k - we can't do NTLMv2 without it */
1167 DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
1168 return NT_STATUS_INVALID_PARAMETER
;
1171 /* TODO: if the remote server is standalone, then we should replace 'domain'
1172 with the server name as supplied above */
1174 if (!SMBNTLMv2encrypt_hash(ntlmssp_state
,
1175 ntlmssp_state
->user
,
1176 ntlmssp_state
->domain
,
1177 ntlmssp_state
->nt_hash
, &challenge_blob
,
1179 &lm_response
, &nt_response
, NULL
,
1181 data_blob_free(&challenge_blob
);
1182 data_blob_free(&struct_blob
);
1183 return NT_STATUS_NO_MEMORY
;
1185 } else if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
) {
1186 struct MD5Context md5_session_nonce_ctx
;
1187 uchar session_nonce
[16];
1188 uchar session_nonce_hash
[16];
1189 uchar user_session_key
[16];
1191 lm_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1192 generate_random_buffer(lm_response
.data
, 8);
1193 memset(lm_response
.data
+8, 0, 16);
1195 memcpy(session_nonce
, challenge_blob
.data
, 8);
1196 memcpy(&session_nonce
[8], lm_response
.data
, 8);
1198 MD5Init(&md5_session_nonce_ctx
);
1199 MD5Update(&md5_session_nonce_ctx
, challenge_blob
.data
, 8);
1200 MD5Update(&md5_session_nonce_ctx
, lm_response
.data
, 8);
1201 MD5Final(session_nonce_hash
, &md5_session_nonce_ctx
);
1203 DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
1204 DEBUG(5, ("challenge is: \n"));
1205 dump_data(5, session_nonce_hash
, 8);
1207 nt_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1208 SMBNTencrypt_hash(ntlmssp_state
->nt_hash
,
1212 session_key
= data_blob_talloc(ntlmssp_state
, NULL
, 16);
1214 SMBsesskeygen_ntv1(ntlmssp_state
->nt_hash
, user_session_key
);
1215 hmac_md5(user_session_key
, session_nonce
, sizeof(session_nonce
), session_key
.data
);
1216 dump_data_pw("NTLM2 session key:\n", session_key
.data
, session_key
.length
);
1218 /* lanman auth is insecure, it may be disabled */
1219 if (lp_client_lanman_auth()) {
1220 lm_response
= data_blob_talloc(ntlmssp_state
,
1222 SMBencrypt_hash(ntlmssp_state
->lm_hash
,challenge_blob
.data
,
1226 nt_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1227 SMBNTencrypt_hash(ntlmssp_state
->nt_hash
,challenge_blob
.data
,
1230 session_key
= data_blob_talloc(ntlmssp_state
, NULL
, 16);
1231 if ((ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
)
1232 && lp_client_lanman_auth()) {
1233 SMBsesskeygen_lm_sess_key(ntlmssp_state
->lm_hash
, lm_response
.data
,
1235 dump_data_pw("LM session key\n", session_key
.data
, session_key
.length
);
1237 SMBsesskeygen_ntv1(ntlmssp_state
->nt_hash
, session_key
.data
);
1238 dump_data_pw("NT session key:\n", session_key
.data
, session_key
.length
);
1241 data_blob_free(&struct_blob
);
1243 /* Key exchange encryptes a new client-generated session key with
1244 the password-derived key */
1245 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
) {
1246 /* Make up a new session key */
1247 uint8 client_session_key
[16];
1248 generate_random_buffer(client_session_key
, sizeof(client_session_key
));
1250 /* Encrypt the new session key with the old one */
1251 encrypted_session_key
= data_blob(client_session_key
, sizeof(client_session_key
));
1252 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
1253 arcfour_crypt_blob(encrypted_session_key
.data
, encrypted_session_key
.length
, &session_key
);
1254 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
1256 /* Mark the new session key as the 'real' session key */
1257 data_blob_free(&session_key
);
1258 session_key
= data_blob_talloc(ntlmssp_state
,
1260 sizeof(client_session_key
));
1263 /* this generates the actual auth packet */
1264 if (!msrpc_gen(ntlmssp_state
, next_request
, auth_gen_string
,
1267 lm_response
.data
, lm_response
.length
,
1268 nt_response
.data
, nt_response
.length
,
1269 ntlmssp_state
->domain
,
1270 ntlmssp_state
->user
,
1271 ntlmssp_state
->client
.netbios_name
,
1272 encrypted_session_key
.data
, encrypted_session_key
.length
,
1273 ntlmssp_state
->neg_flags
)) {
1275 return NT_STATUS_NO_MEMORY
;
1278 if (DEBUGLEVEL
>= 10) {
1279 if (NT_STATUS_IS_OK(ntlmssp_pull_AUTHENTICATE_MESSAGE(next_request
,
1284 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE
, &authenticate
);
1288 data_blob_free(&encrypted_session_key
);
1290 data_blob_free(&ntlmssp_state
->chal
);
1292 ntlmssp_state
->session_key
= session_key
;
1294 ntlmssp_state
->chal
= challenge_blob
;
1295 ntlmssp_state
->lm_resp
= lm_response
;
1296 ntlmssp_state
->nt_resp
= nt_response
;
1300 ntlmssp_state
->expected_state
= NTLMSSP_DONE
;
1302 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_sign_init(ntlmssp_state
))) {
1303 DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status
)));
1309 NTSTATUS
ntlmssp_client_start(TALLOC_CTX
*mem_ctx
,
1310 const char *netbios_name
,
1311 const char *netbios_domain
,
1313 struct ntlmssp_state
**_ntlmssp_state
)
1315 struct ntlmssp_state
*ntlmssp_state
;
1317 if (!netbios_name
) {
1321 if (!netbios_domain
) {
1322 netbios_domain
= "";
1325 ntlmssp_state
= talloc_zero(mem_ctx
, struct ntlmssp_state
);
1326 if (!ntlmssp_state
) {
1327 return NT_STATUS_NO_MEMORY
;
1330 ntlmssp_state
->role
= NTLMSSP_CLIENT
;
1332 ntlmssp_state
->unicode
= True
;
1334 ntlmssp_state
->use_ntlmv2
= use_ntlmv2
;
1336 ntlmssp_state
->expected_state
= NTLMSSP_INITIAL
;
1338 ntlmssp_state
->neg_flags
=
1339 NTLMSSP_NEGOTIATE_128
|
1340 NTLMSSP_NEGOTIATE_ALWAYS_SIGN
|
1341 NTLMSSP_NEGOTIATE_NTLM
|
1342 NTLMSSP_NEGOTIATE_NTLM2
|
1343 NTLMSSP_NEGOTIATE_KEY_EXCH
|
1344 NTLMSSP_REQUEST_TARGET
;
1346 ntlmssp_state
->client
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
1347 if (!ntlmssp_state
->client
.netbios_name
) {
1348 talloc_free(ntlmssp_state
);
1349 return NT_STATUS_NO_MEMORY
;
1351 ntlmssp_state
->client
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
1352 if (!ntlmssp_state
->client
.netbios_domain
) {
1353 talloc_free(ntlmssp_state
);
1354 return NT_STATUS_NO_MEMORY
;
1357 *_ntlmssp_state
= ntlmssp_state
;
1358 return NT_STATUS_OK
;