2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2005,2011
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 NTSTATUS
auth3_generate_session_info(struct auth4_context
*auth_context
,
29 void *server_returned_info
,
30 const char *original_user_name
,
31 uint32_t session_info_flags
,
32 struct auth_session_info
**session_info
)
34 struct auth_serversupplied_info
*server_info
= talloc_get_type_abort(server_returned_info
,
35 struct auth_serversupplied_info
);
38 nt_status
= create_local_token(mem_ctx
,
43 if (!NT_STATUS_IS_OK(nt_status
)) {
44 DEBUG(10, ("create_local_token failed: %s\n",
45 nt_errstr(nt_status
)));
53 * Return the challenge as determined by the authentication subsystem
54 * @return an 8 byte random challenge
57 NTSTATUS
auth3_get_challenge(struct auth4_context
*auth4_context
,
60 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
62 auth_get_ntlm_challenge(auth_context
, chal
);
67 * Some authentication methods 'fix' the challenge, so we may not be able to set it
69 * @return If the effective challenge used by the auth subsystem may be modified
71 bool auth3_may_set_challenge(struct auth4_context
*auth4_context
)
73 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
75 return auth_context
->challenge_may_be_modified
;
79 * NTLM2 authentication modifies the effective challenge,
80 * @param challenge The new challenge value
82 NTSTATUS
auth3_set_challenge(struct auth4_context
*auth4_context
, const uint8_t *chal
,
83 const char *challenge_set_by
)
85 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
88 auth_context
->challenge
= data_blob_talloc(auth_context
,
90 NT_STATUS_HAVE_NO_MEMORY(auth_context
->challenge
.data
);
92 auth_context
->challenge_set_by
= talloc_strdup(auth_context
, challenge_set_by
);
93 NT_STATUS_HAVE_NO_MEMORY(auth_context
->challenge_set_by
);
95 DEBUG(5, ("auth_context challenge set by %s\n", auth_context
->challenge_set_by
));
96 DEBUG(5, ("challenge is: \n"));
97 dump_data(5, auth_context
->challenge
.data
, auth_context
->challenge
.length
);
102 * Check the password on an NTLMSSP login.
104 * Return the session keys used on the connection.
107 NTSTATUS
auth3_check_password(struct auth4_context
*auth4_context
,
109 const struct auth_usersupplied_info
*user_info
,
110 void **server_returned_info
,
111 DATA_BLOB
*session_key
, DATA_BLOB
*lm_session_key
)
113 struct auth_context
*auth_context
= talloc_get_type_abort(auth4_context
->private_data
,
114 struct auth_context
);
115 struct auth_usersupplied_info
*mapped_user_info
= NULL
;
116 struct auth_serversupplied_info
*server_info
;
118 bool username_was_mapped
;
120 /* The client has given us its machine name (which we only get over NBT transport).
121 We need to possibly reload smb.conf if smb.conf includes depend on the machine name. */
123 set_remote_machine_name(user_info
->workstation_name
, True
);
125 /* setup the string used by %U */
126 /* sub_set_smb_name checks for weird internally */
127 sub_set_smb_name(user_info
->client
.account_name
);
129 lp_load(get_dyn_CONFIGFILE(), false, false, true, true);
131 nt_status
= make_user_info_map(&mapped_user_info
,
132 user_info
->client
.account_name
,
133 user_info
->client
.domain_name
,
134 user_info
->workstation_name
,
135 user_info
->remote_host
,
136 user_info
->password
.response
.lanman
.data
? &user_info
->password
.response
.lanman
: NULL
,
137 user_info
->password
.response
.nt
.data
? &user_info
->password
.response
.nt
: NULL
,
139 AUTH_PASSWORD_RESPONSE
);
141 if (!NT_STATUS_IS_OK(nt_status
)) {
145 mapped_user_info
->logon_parameters
= user_info
->logon_parameters
;
147 mapped_user_info
->flags
= user_info
->flags
;
149 nt_status
= auth_check_ntlm_password(auth_context
,
150 mapped_user_info
, &server_info
);
152 if (!NT_STATUS_IS_OK(nt_status
)) {
153 DEBUG(5,("Checking NTLMSSP password for %s\\%s failed: %s\n",
154 user_info
->client
.domain_name
,
155 user_info
->client
.account_name
,
156 nt_errstr(nt_status
)));
159 username_was_mapped
= mapped_user_info
->was_mapped
;
161 free_user_info(&mapped_user_info
);
163 if (!NT_STATUS_IS_OK(nt_status
)) {
164 nt_status
= do_map_to_guest_server_info(nt_status
,
166 user_info
->client
.account_name
,
167 user_info
->client
.domain_name
);
168 *server_returned_info
= talloc_steal(mem_ctx
, server_info
);
172 server_info
->nss_token
|= username_was_mapped
;
174 /* Clear out the session keys, and pass them to the caller.
175 * They will not be used in this form again - instead the
176 * NTLMSSP code will decide on the final correct session key,
177 * and supply it to create_local_token() */
179 DEBUG(10, ("Got NT session key of length %u\n",
180 (unsigned int)server_info
->session_key
.length
));
181 *session_key
= server_info
->session_key
;
182 talloc_steal(mem_ctx
, server_info
->session_key
.data
);
183 server_info
->session_key
= data_blob_null
;
185 if (lm_session_key
) {
186 DEBUG(10, ("Got LM session key of length %u\n",
187 (unsigned int)server_info
->lm_session_key
.length
));
188 *lm_session_key
= server_info
->lm_session_key
;
189 talloc_steal(mem_ctx
, server_info
->lm_session_key
.data
);
190 server_info
->lm_session_key
= data_blob_null
;
193 *server_returned_info
= talloc_steal(mem_ctx
, server_info
);