2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003
8 Copyright (C) Andrew Bartlett 2005 (Updated from gensec).
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_ntlmssp.h"
28 #include "../libcli/auth/ntlmssp_ndr.h"
29 #include "../lib/crypto/md5.h"
30 #include "../lib/crypto/arcfour.h"
31 #include "../lib/crypto/hmacmd5.h"
33 static NTSTATUS
ntlmssp_client_initial(struct ntlmssp_state
*ntlmssp_state
,
34 DATA_BLOB reply
, DATA_BLOB
*next_request
);
35 static NTSTATUS
ntlmssp_server_negotiate(struct ntlmssp_state
*ntlmssp_state
,
36 const DATA_BLOB in
, DATA_BLOB
*out
);
37 static NTSTATUS
ntlmssp_client_challenge(struct ntlmssp_state
*ntlmssp_state
,
38 const DATA_BLOB reply
, DATA_BLOB
*next_request
);
39 static NTSTATUS
ntlmssp_server_auth(struct ntlmssp_state
*ntlmssp_state
,
40 const DATA_BLOB request
, DATA_BLOB
*reply
);
43 * Callbacks for NTLMSSP - for both client and server operating modes
47 static const struct ntlmssp_callbacks
{
48 enum ntlmssp_role role
;
49 enum ntlmssp_message_type ntlmssp_command
;
50 NTSTATUS (*fn
)(struct ntlmssp_state
*ntlmssp_state
,
51 DATA_BLOB in
, DATA_BLOB
*out
);
52 } ntlmssp_callbacks
[] = {
53 {NTLMSSP_CLIENT
, NTLMSSP_INITIAL
, ntlmssp_client_initial
},
54 {NTLMSSP_SERVER
, NTLMSSP_NEGOTIATE
, ntlmssp_server_negotiate
},
55 {NTLMSSP_CLIENT
, NTLMSSP_CHALLENGE
, ntlmssp_client_challenge
},
56 {NTLMSSP_SERVER
, NTLMSSP_AUTH
, ntlmssp_server_auth
},
57 {NTLMSSP_CLIENT
, NTLMSSP_UNKNOWN
, NULL
},
58 {NTLMSSP_SERVER
, NTLMSSP_UNKNOWN
, NULL
}
63 * Print out the NTLMSSP flags for debugging
64 * @param neg_flags The flags from the packet
67 void debug_ntlmssp_flags(uint32_t neg_flags
)
69 DEBUG(3,("Got NTLMSSP neg_flags=0x%08x\n", neg_flags
));
71 if (neg_flags
& NTLMSSP_NEGOTIATE_UNICODE
)
72 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_UNICODE\n"));
73 if (neg_flags
& NTLMSSP_NEGOTIATE_OEM
)
74 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM\n"));
75 if (neg_flags
& NTLMSSP_REQUEST_TARGET
)
76 DEBUGADD(4, (" NTLMSSP_REQUEST_TARGET\n"));
77 if (neg_flags
& NTLMSSP_NEGOTIATE_SIGN
)
78 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_SIGN\n"));
79 if (neg_flags
& NTLMSSP_NEGOTIATE_SEAL
)
80 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_SEAL\n"));
81 if (neg_flags
& NTLMSSP_NEGOTIATE_DATAGRAM
)
82 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_DATAGRAM\n"));
83 if (neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
)
84 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_LM_KEY\n"));
85 if (neg_flags
& NTLMSSP_NEGOTIATE_NETWARE
)
86 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NETWARE\n"));
87 if (neg_flags
& NTLMSSP_NEGOTIATE_NTLM
)
88 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NTLM\n"));
89 if (neg_flags
& NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
)
90 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED\n"));
91 if (neg_flags
& NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED
)
92 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED\n"));
93 if (neg_flags
& NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL
)
94 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL\n"));
95 if (neg_flags
& NTLMSSP_NEGOTIATE_ALWAYS_SIGN
)
96 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_ALWAYS_SIGN\n"));
97 if (neg_flags
& NTLMSSP_REQUEST_NON_NT_SESSION_KEY
)
98 DEBUGADD(4, (" NTLMSSP_REQUEST_NON_NT_SESSION_KEY\n"));
99 if (neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
)
100 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NTLM2\n"));
101 if (neg_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
)
102 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_TARGET_INFO\n"));
103 if (neg_flags
& NTLMSSP_NEGOTIATE_VERSION
)
104 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_VERSION\n"));
105 if (neg_flags
& NTLMSSP_NEGOTIATE_128
)
106 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_128\n"));
107 if (neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
)
108 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_KEY_EXCH\n"));
109 if (neg_flags
& NTLMSSP_NEGOTIATE_56
)
110 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_56\n"));
114 * Default challenge generation code.
118 static NTSTATUS
get_challenge(const struct ntlmssp_state
*ntlmssp_state
,
121 generate_random_buffer(chal
, 8);
126 * Default 'we can set the challenge to anything we like' implementation
130 static bool may_set_challenge(const struct ntlmssp_state
*ntlmssp_state
)
136 * Default 'we can set the challenge to anything we like' implementation
138 * Does not actually do anything, as the value is always in the structure anyway.
142 static NTSTATUS
set_challenge(struct ntlmssp_state
*ntlmssp_state
, DATA_BLOB
*challenge
)
144 SMB_ASSERT(challenge
->length
== 8);
149 * Set a username on an NTLMSSP context - ensures it is talloc()ed
153 NTSTATUS
ntlmssp_set_username(struct ntlmssp_state
*ntlmssp_state
, const char *user
)
155 ntlmssp_state
->user
= talloc_strdup(ntlmssp_state
, user
? user
: "" );
156 if (!ntlmssp_state
->user
) {
157 return NT_STATUS_NO_MEMORY
;
163 * Store NT and LM hashes on an NTLMSSP context - ensures they are talloc()ed
166 NTSTATUS
ntlmssp_set_hashes(struct ntlmssp_state
*ntlmssp_state
,
167 const uint8_t lm_hash
[16],
168 const uint8_t nt_hash
[16])
170 ntlmssp_state
->lm_hash
= (uint8_t *)
171 TALLOC_MEMDUP(ntlmssp_state
, lm_hash
, 16);
172 ntlmssp_state
->nt_hash
= (uint8_t *)
173 TALLOC_MEMDUP(ntlmssp_state
, nt_hash
, 16);
174 if (!ntlmssp_state
->lm_hash
|| !ntlmssp_state
->nt_hash
) {
175 TALLOC_FREE(ntlmssp_state
->lm_hash
);
176 TALLOC_FREE(ntlmssp_state
->nt_hash
);
177 return NT_STATUS_NO_MEMORY
;
183 * Converts a password to the hashes on an NTLMSSP context.
186 NTSTATUS
ntlmssp_set_password(struct ntlmssp_state
*ntlmssp_state
, const char *password
)
189 ntlmssp_state
->lm_hash
= NULL
;
190 ntlmssp_state
->nt_hash
= NULL
;
195 E_deshash(password
, lm_hash
);
196 E_md4hash(password
, nt_hash
);
197 return ntlmssp_set_hashes(ntlmssp_state
, lm_hash
, nt_hash
);
203 * Set a domain on an NTLMSSP context - ensures it is talloc()ed
206 NTSTATUS
ntlmssp_set_domain(struct ntlmssp_state
*ntlmssp_state
, const char *domain
)
208 ntlmssp_state
->domain
= talloc_strdup(ntlmssp_state
,
209 domain
? domain
: "" );
210 if (!ntlmssp_state
->domain
) {
211 return NT_STATUS_NO_MEMORY
;
217 * Request features for the NTLMSSP negotiation
219 * @param ntlmssp_state NTLMSSP state
220 * @param feature_list List of space seperated features requested from NTLMSSP.
222 void ntlmssp_want_feature_list(struct ntlmssp_state
*ntlmssp_state
, char *feature_list
)
225 * We need to set this to allow a later SetPassword
226 * via the SAMR pipe to succeed. Strange.... We could
227 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
229 if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list
, True
)) {
230 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
232 if (in_list("NTLMSSP_FEATURE_SIGN", feature_list
, True
)) {
233 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
235 if(in_list("NTLMSSP_FEATURE_SEAL", feature_list
, True
)) {
236 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
238 if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list
, true)) {
239 ntlmssp_state
->use_ccache
= true;
244 * Request a feature for the NTLMSSP negotiation
246 * @param ntlmssp_state NTLMSSP state
247 * @param feature Bit flag specifying the requested feature
249 void ntlmssp_want_feature(struct ntlmssp_state
*ntlmssp_state
, uint32_t feature
)
251 /* As per JRA's comment above */
252 if (feature
& NTLMSSP_FEATURE_SESSION_KEY
) {
253 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
255 if (feature
& NTLMSSP_FEATURE_SIGN
) {
256 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SIGN
;
258 if (feature
& NTLMSSP_FEATURE_SEAL
) {
259 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_SEAL
;
261 if (feature
& NTLMSSP_FEATURE_CCACHE
) {
262 ntlmssp_state
->use_ccache
= true;
267 * Next state function for the NTLMSSP state machine
269 * @param ntlmssp_state NTLMSSP State
270 * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB
271 * @param out The reply, as an allocated DATA_BLOB, caller to free.
272 * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK.
275 NTSTATUS
ntlmssp_update(struct ntlmssp_state
*ntlmssp_state
,
276 const DATA_BLOB input
, DATA_BLOB
*out
)
278 uint32_t ntlmssp_command
;
281 if (ntlmssp_state
->expected_state
== NTLMSSP_DONE
) {
282 /* Called update after negotiations finished. */
283 DEBUG(1, ("Called NTLMSSP after state machine was 'done'\n"));
284 return NT_STATUS_INVALID_PARAMETER
;
287 *out
= data_blob_null
;
290 switch (ntlmssp_state
->role
) {
292 ntlmssp_command
= NTLMSSP_INITIAL
;
295 /* 'datagram' mode - no neg packet */
296 ntlmssp_command
= NTLMSSP_NEGOTIATE
;
300 if (!msrpc_parse(ntlmssp_state
, &input
, "Cd",
303 DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
304 dump_data(2, input
.data
, input
.length
);
305 return NT_STATUS_INVALID_PARAMETER
;
309 if (ntlmssp_command
!= ntlmssp_state
->expected_state
) {
310 DEBUG(1, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command
, ntlmssp_state
->expected_state
));
311 return NT_STATUS_INVALID_PARAMETER
;
314 for (i
=0; ntlmssp_callbacks
[i
].fn
; i
++) {
315 if (ntlmssp_callbacks
[i
].role
== ntlmssp_state
->role
316 && ntlmssp_callbacks
[i
].ntlmssp_command
== ntlmssp_command
) {
317 return ntlmssp_callbacks
[i
].fn(ntlmssp_state
, input
, out
);
321 DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
322 ntlmssp_state
->role
, ntlmssp_command
));
324 return NT_STATUS_INVALID_PARAMETER
;
328 * End an NTLMSSP state machine
330 * @param ntlmssp_state NTLMSSP State, free()ed by this function
333 void ntlmssp_end(struct ntlmssp_state
**ntlmssp_state
)
335 data_blob_free(&(*ntlmssp_state
)->chal
);
336 data_blob_free(&(*ntlmssp_state
)->lm_resp
);
337 data_blob_free(&(*ntlmssp_state
)->nt_resp
);
338 TALLOC_FREE(*ntlmssp_state
);
340 *ntlmssp_state
= NULL
;
345 * Determine correct target name flags for reply, given server role
346 * and negotiated flags
348 * @param ntlmssp_state NTLMSSP State
349 * @param neg_flags The flags from the packet
350 * @param chal_flags The flags to be set in the reply packet
351 * @return The 'target name' string.
354 static const char *ntlmssp_target_name(struct ntlmssp_state
*ntlmssp_state
,
355 uint32_t neg_flags
, uint32_t *chal_flags
)
357 if (neg_flags
& NTLMSSP_REQUEST_TARGET
) {
358 *chal_flags
|= NTLMSSP_NEGOTIATE_TARGET_INFO
;
359 *chal_flags
|= NTLMSSP_REQUEST_TARGET
;
360 if (ntlmssp_state
->server
.is_standalone
) {
361 *chal_flags
|= NTLMSSP_TARGET_TYPE_SERVER
;
362 return ntlmssp_state
->server
.netbios_name
;
364 *chal_flags
|= NTLMSSP_TARGET_TYPE_DOMAIN
;
365 return ntlmssp_state
->server
.netbios_domain
;
372 static void ntlmssp_handle_neg_flags(struct ntlmssp_state
*ntlmssp_state
,
373 uint32_t neg_flags
, bool allow_lm
) {
374 if (neg_flags
& NTLMSSP_NEGOTIATE_UNICODE
) {
375 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_UNICODE
;
376 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_OEM
;
377 ntlmssp_state
->unicode
= True
;
379 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_UNICODE
;
380 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_OEM
;
381 ntlmssp_state
->unicode
= False
;
384 if ((neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
) && allow_lm
) {
385 /* other end forcing us to use LM */
386 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_LM_KEY
;
387 ntlmssp_state
->use_ntlmv2
= False
;
389 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_LM_KEY
;
392 if (!(neg_flags
& NTLMSSP_NEGOTIATE_ALWAYS_SIGN
)) {
393 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_ALWAYS_SIGN
;
396 if (!(neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
)) {
397 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
400 if (!(neg_flags
& NTLMSSP_NEGOTIATE_128
)) {
401 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_128
;
404 if (!(neg_flags
& NTLMSSP_NEGOTIATE_56
)) {
405 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_56
;
408 if (!(neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
)) {
409 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_KEY_EXCH
;
412 if (!(neg_flags
& NTLMSSP_NEGOTIATE_SIGN
)) {
413 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_SIGN
;
416 if (!(neg_flags
& NTLMSSP_NEGOTIATE_SEAL
)) {
417 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_SEAL
;
420 /* Woop Woop - unknown flag for Windows compatibility...
421 What does this really do ? JRA. */
422 if (!(neg_flags
& NTLMSSP_NEGOTIATE_VERSION
)) {
423 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_VERSION
;
426 if ((neg_flags
& NTLMSSP_REQUEST_TARGET
)) {
427 ntlmssp_state
->neg_flags
|= NTLMSSP_REQUEST_TARGET
;
432 * Next state function for the Negotiate packet
434 * @param ntlmssp_state NTLMSSP State
435 * @param request The request, as a DATA_BLOB
436 * @param request The reply, as an allocated DATA_BLOB, caller to free.
437 * @return Errors or MORE_PROCESSING_REQUIRED if a reply is sent.
440 static NTSTATUS
ntlmssp_server_negotiate(struct ntlmssp_state
*ntlmssp_state
,
441 const DATA_BLOB request
, DATA_BLOB
*reply
)
443 DATA_BLOB struct_blob
;
444 uint32_t neg_flags
= 0;
445 uint32_t ntlmssp_command
, chal_flags
;
447 const char *target_name
;
448 struct NEGOTIATE_MESSAGE negotiate
;
449 struct CHALLENGE_MESSAGE challenge
;
452 /* parse the NTLMSSP packet */
454 file_save("ntlmssp_negotiate.dat", request
.data
, request
.length
);
457 if (request
.length
) {
458 if ((request
.length
< 16) || !msrpc_parse(ntlmssp_state
, &request
, "Cdd",
462 DEBUG(1, ("ntlmssp_server_negotiate: failed to parse NTLMSSP Negotiate of length %u\n",
463 (unsigned int)request
.length
));
464 dump_data(2, request
.data
, request
.length
);
465 return NT_STATUS_INVALID_PARAMETER
;
467 debug_ntlmssp_flags(neg_flags
);
469 if (DEBUGLEVEL
>= 10) {
470 if (NT_STATUS_IS_OK(ntlmssp_pull_NEGOTIATE_MESSAGE(&request
,
474 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE
, &negotiate
);
479 ntlmssp_handle_neg_flags(ntlmssp_state
, neg_flags
, lp_lanman_auth());
481 /* Ask our caller what challenge they would like in the packet */
482 status
= ntlmssp_state
->get_challenge(ntlmssp_state
, cryptkey
);
483 if (!NT_STATUS_IS_OK(status
)) {
487 /* Check if we may set the challenge */
488 if (!ntlmssp_state
->may_set_challenge(ntlmssp_state
)) {
489 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
492 /* The flags we send back are not just the negotiated flags,
493 * they are also 'what is in this packet'. Therfore, we
494 * operate on 'chal_flags' from here on
497 chal_flags
= ntlmssp_state
->neg_flags
;
499 /* get the right name to fill in as 'target' */
500 target_name
= ntlmssp_target_name(ntlmssp_state
,
501 neg_flags
, &chal_flags
);
502 if (target_name
== NULL
)
503 return NT_STATUS_INVALID_PARAMETER
;
505 ntlmssp_state
->chal
= data_blob_talloc(ntlmssp_state
, cryptkey
, 8);
506 ntlmssp_state
->internal_chal
= data_blob_talloc(ntlmssp_state
,
509 /* This creates the 'blob' of names that appears at the end of the packet */
510 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
)
512 msrpc_gen(ntlmssp_state
, &struct_blob
, "aaaaa",
513 MsvAvNbDomainName
, target_name
,
514 MsvAvNbComputerName
, ntlmssp_state
->server
.netbios_name
,
515 MsvAvDnsDomainName
, ntlmssp_state
->server
.dns_domain
,
516 MsvAvDnsComputerName
, ntlmssp_state
->server
.dns_name
,
519 struct_blob
= data_blob_null
;
523 /* Marshal the packet in the right format, be it unicode or ASCII */
524 const char *gen_string
;
525 DATA_BLOB version_blob
= data_blob_null
;
527 if (chal_flags
& NTLMSSP_NEGOTIATE_VERSION
) {
528 enum ndr_err_code err
;
531 /* "What Windows returns" as a version number. */
533 vers
.ProductMajorVersion
= NTLMSSP_WINDOWS_MAJOR_VERSION_6
;
534 vers
.ProductMinorVersion
= NTLMSSP_WINDOWS_MINOR_VERSION_1
;
535 vers
.ProductBuild
= 0;
536 vers
.NTLMRevisionCurrent
= NTLMSSP_REVISION_W2K3
;
538 err
= ndr_push_struct_blob(&version_blob
,
541 (ndr_push_flags_fn_t
)ndr_push_VERSION
);
543 if (!NDR_ERR_CODE_IS_SUCCESS(err
)) {
544 return NT_STATUS_NO_MEMORY
;
548 if (ntlmssp_state
->unicode
) {
549 gen_string
= "CdUdbddBb";
551 gen_string
= "CdAdbddBb";
554 msrpc_gen(ntlmssp_state
, reply
, gen_string
,
561 struct_blob
.data
, struct_blob
.length
,
562 version_blob
.data
, version_blob
.length
);
564 data_blob_free(&version_blob
);
566 if (DEBUGLEVEL
>= 10) {
567 if (NT_STATUS_IS_OK(ntlmssp_pull_CHALLENGE_MESSAGE(reply
,
571 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE
, &challenge
);
576 data_blob_free(&struct_blob
);
578 ntlmssp_state
->expected_state
= NTLMSSP_AUTH
;
580 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
584 * Next state function for the Authenticate packet
586 * @param ntlmssp_state NTLMSSP State
587 * @param request The request, as a DATA_BLOB
588 * @param request The reply, as an allocated DATA_BLOB, caller to free.
589 * @return Errors or NT_STATUS_OK.
592 static NTSTATUS
ntlmssp_server_auth(struct ntlmssp_state
*ntlmssp_state
,
593 const DATA_BLOB request
, DATA_BLOB
*reply
)
595 DATA_BLOB encrypted_session_key
= data_blob_null
;
596 DATA_BLOB user_session_key
= data_blob_null
;
597 DATA_BLOB lm_session_key
= data_blob_null
;
598 DATA_BLOB session_key
= data_blob_null
;
599 uint32_t ntlmssp_command
, auth_flags
;
600 NTSTATUS nt_status
= NT_STATUS_OK
;
601 struct AUTHENTICATE_MESSAGE authenticate
;
604 bool doing_ntlm2
= False
;
606 uint8_t session_nonce
[16];
607 uint8_t session_nonce_hash
[16];
609 const char *parse_string
;
611 /* parse the NTLMSSP packet */
612 *reply
= data_blob_null
;
615 file_save("ntlmssp_auth.dat", request
.data
, request
.length
);
618 if (ntlmssp_state
->unicode
) {
619 parse_string
= "CdBBUUUBd";
621 parse_string
= "CdBBAAABd";
624 data_blob_free(&ntlmssp_state
->lm_resp
);
625 data_blob_free(&ntlmssp_state
->nt_resp
);
627 ntlmssp_state
->user
= NULL
;
628 ntlmssp_state
->domain
= NULL
;
630 /* now the NTLMSSP encoded auth hashes */
631 if (!msrpc_parse(ntlmssp_state
, &request
, parse_string
,
634 &ntlmssp_state
->lm_resp
,
635 &ntlmssp_state
->nt_resp
,
636 &ntlmssp_state
->domain
,
637 &ntlmssp_state
->user
,
638 &ntlmssp_state
->client
.netbios_name
,
639 &encrypted_session_key
,
643 /* Try again with a shorter string (Win9X truncates this packet) */
644 if (ntlmssp_state
->unicode
) {
645 parse_string
= "CdBBUUU";
647 parse_string
= "CdBBAAA";
650 /* now the NTLMSSP encoded auth hashes */
651 if (!msrpc_parse(ntlmssp_state
, &request
, parse_string
,
654 &ntlmssp_state
->lm_resp
,
655 &ntlmssp_state
->nt_resp
,
656 &ntlmssp_state
->domain
,
657 &ntlmssp_state
->user
,
658 &ntlmssp_state
->client
.netbios_name
)) {
659 DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP (tried both formats):\n"));
660 dump_data(2, request
.data
, request
.length
);
662 return NT_STATUS_INVALID_PARAMETER
;
667 ntlmssp_handle_neg_flags(ntlmssp_state
, auth_flags
, lp_lanman_auth());
669 if (DEBUGLEVEL
>= 10) {
670 if (NT_STATUS_IS_OK(ntlmssp_pull_AUTHENTICATE_MESSAGE(&request
,
674 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE
, &authenticate
);
678 DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
679 ntlmssp_state
->user
, ntlmssp_state
->domain
,
680 ntlmssp_state
->client
.netbios_name
,
681 (unsigned long)ntlmssp_state
->lm_resp
.length
,
682 (unsigned long)ntlmssp_state
->nt_resp
.length
));
685 file_save("nthash1.dat", &ntlmssp_state
->nt_resp
.data
, &ntlmssp_state
->nt_resp
.length
);
686 file_save("lmhash1.dat", &ntlmssp_state
->lm_resp
.data
, &ntlmssp_state
->lm_resp
.length
);
689 /* NTLM2 uses a 'challenge' that is made of up both the server challenge, and a
692 However, the NTLM2 flag may still be set for the real NTLMv2 logins, be careful.
694 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
) {
695 if (ntlmssp_state
->nt_resp
.length
== 24 && ntlmssp_state
->lm_resp
.length
== 24) {
696 struct MD5Context md5_session_nonce_ctx
;
697 SMB_ASSERT(ntlmssp_state
->internal_chal
.data
&& ntlmssp_state
->internal_chal
.length
== 8);
701 memcpy(session_nonce
, ntlmssp_state
->internal_chal
.data
, 8);
702 memcpy(&session_nonce
[8], ntlmssp_state
->lm_resp
.data
, 8);
704 MD5Init(&md5_session_nonce_ctx
);
705 MD5Update(&md5_session_nonce_ctx
, session_nonce
, 16);
706 MD5Final(session_nonce_hash
, &md5_session_nonce_ctx
);
708 ntlmssp_state
->chal
= data_blob_talloc(
709 ntlmssp_state
, session_nonce_hash
, 8);
711 /* LM response is no longer useful */
712 data_blob_free(&ntlmssp_state
->lm_resp
);
714 /* We changed the effective challenge - set it */
715 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_state
->set_challenge(ntlmssp_state
, &ntlmssp_state
->chal
))) {
716 data_blob_free(&encrypted_session_key
);
720 /* LM Key is incompatible. */
721 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_LM_KEY
;
726 * Note we don't check here for NTLMv2 auth settings. If NTLMv2 auth
727 * is required (by "ntlm auth = no" and "lm auth = no" being set in the
728 * smb.conf file) and no NTLMv2 response was sent then the password check
729 * will fail here. JRA.
732 /* Finally, actually ask if the password is OK */
734 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_state
->check_password(ntlmssp_state
,
735 &user_session_key
, &lm_session_key
))) {
736 data_blob_free(&encrypted_session_key
);
740 dump_data_pw("NT session key:\n", user_session_key
.data
, user_session_key
.length
);
741 dump_data_pw("LM first-8:\n", lm_session_key
.data
, lm_session_key
.length
);
743 /* Handle the different session key derivation for NTLM2 */
745 if (user_session_key
.data
&& user_session_key
.length
== 16) {
746 session_key
= data_blob_talloc(ntlmssp_state
,
748 hmac_md5(user_session_key
.data
, session_nonce
,
749 sizeof(session_nonce
), session_key
.data
);
750 DEBUG(10,("ntlmssp_server_auth: Created NTLM2 session key.\n"));
751 dump_data_pw("NTLM2 session key:\n", session_key
.data
, session_key
.length
);
754 DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM2 session key.\n"));
755 session_key
= data_blob_null
;
757 } else if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
) {
758 if (lm_session_key
.data
&& lm_session_key
.length
>= 8) {
759 if (ntlmssp_state
->lm_resp
.data
&& ntlmssp_state
->lm_resp
.length
== 24) {
760 session_key
= data_blob_talloc(ntlmssp_state
,
762 if (session_key
.data
== NULL
) {
763 return NT_STATUS_NO_MEMORY
;
765 SMBsesskeygen_lm_sess_key(lm_session_key
.data
, ntlmssp_state
->lm_resp
.data
,
767 DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
769 static const uint8_t zeros
[24] = {0, };
770 session_key
= data_blob_talloc(
771 ntlmssp_state
, NULL
, 16);
772 if (session_key
.data
== NULL
) {
773 return NT_STATUS_NO_MEMORY
;
775 SMBsesskeygen_lm_sess_key(
776 lm_session_key
.data
, zeros
,
779 dump_data_pw("LM session key:\n", session_key
.data
,
782 DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM session key.\n"));
783 session_key
= data_blob_null
;
785 } else if (user_session_key
.data
) {
786 session_key
= user_session_key
;
787 DEBUG(10,("ntlmssp_server_auth: Using unmodified nt session key.\n"));
788 dump_data_pw("unmodified session key:\n", session_key
.data
, session_key
.length
);
789 } else if (lm_session_key
.data
) {
790 session_key
= lm_session_key
;
791 DEBUG(10,("ntlmssp_server_auth: Using unmodified lm session key.\n"));
792 dump_data_pw("unmodified session key:\n", session_key
.data
, session_key
.length
);
794 DEBUG(10,("ntlmssp_server_auth: Failed to create unmodified session key.\n"));
795 session_key
= data_blob_null
;
798 /* With KEY_EXCH, the client supplies the proposed session key,
799 but encrypts it with the long-term key */
800 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
) {
801 if (!encrypted_session_key
.data
|| encrypted_session_key
.length
!= 16) {
802 data_blob_free(&encrypted_session_key
);
803 DEBUG(1, ("Client-supplied KEY_EXCH session key was of invalid length (%u)!\n",
804 (unsigned int)encrypted_session_key
.length
));
805 return NT_STATUS_INVALID_PARAMETER
;
806 } else if (!session_key
.data
|| session_key
.length
!= 16) {
807 DEBUG(5, ("server session key is invalid (len == %u), cannot do KEY_EXCH!\n",
808 (unsigned int)session_key
.length
));
809 ntlmssp_state
->session_key
= session_key
;
811 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
812 arcfour_crypt_blob(encrypted_session_key
.data
,
813 encrypted_session_key
.length
,
815 ntlmssp_state
->session_key
= data_blob_talloc(
816 ntlmssp_state
, encrypted_session_key
.data
,
817 encrypted_session_key
.length
);
818 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key
.data
,
819 encrypted_session_key
.length
);
822 ntlmssp_state
->session_key
= session_key
;
825 if (!NT_STATUS_IS_OK(nt_status
)) {
826 ntlmssp_state
->session_key
= data_blob_null
;
827 } else if (ntlmssp_state
->session_key
.length
) {
828 nt_status
= ntlmssp_sign_init(ntlmssp_state
);
831 data_blob_free(&encrypted_session_key
);
833 /* Only one authentication allowed per server state. */
834 ntlmssp_state
->expected_state
= NTLMSSP_DONE
;
840 * Create an NTLMSSP state machine
842 * @param ntlmssp_state NTLMSSP State, allocated by this function
845 NTSTATUS
ntlmssp_server_start(TALLOC_CTX
*mem_ctx
,
847 const char *netbios_name
,
848 const char *netbios_domain
,
849 const char *dns_name
,
850 const char *dns_domain
,
851 struct ntlmssp_state
**_ntlmssp_state
)
853 struct ntlmssp_state
*ntlmssp_state
;
859 if (!netbios_domain
) {
871 ntlmssp_state
= talloc_zero(mem_ctx
, struct ntlmssp_state
);
872 if (!ntlmssp_state
) {
873 return NT_STATUS_NO_MEMORY
;
876 ntlmssp_state
->role
= NTLMSSP_SERVER
;
878 ntlmssp_state
->get_challenge
= get_challenge
;
879 ntlmssp_state
->set_challenge
= set_challenge
;
880 ntlmssp_state
->may_set_challenge
= may_set_challenge
;
882 ntlmssp_state
->server
.is_standalone
= is_standalone
;
884 ntlmssp_state
->expected_state
= NTLMSSP_NEGOTIATE
;
886 ntlmssp_state
->neg_flags
=
887 NTLMSSP_NEGOTIATE_128
|
888 NTLMSSP_NEGOTIATE_56
|
889 NTLMSSP_NEGOTIATE_VERSION
|
890 NTLMSSP_NEGOTIATE_ALWAYS_SIGN
|
891 NTLMSSP_NEGOTIATE_NTLM
|
892 NTLMSSP_NEGOTIATE_NTLM2
|
893 NTLMSSP_NEGOTIATE_KEY_EXCH
|
894 NTLMSSP_NEGOTIATE_SIGN
|
895 NTLMSSP_NEGOTIATE_SEAL
;
897 ntlmssp_state
->server
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
898 if (!ntlmssp_state
->server
.netbios_name
) {
899 talloc_free(ntlmssp_state
);
900 return NT_STATUS_NO_MEMORY
;
902 ntlmssp_state
->server
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
903 if (!ntlmssp_state
->server
.netbios_domain
) {
904 talloc_free(ntlmssp_state
);
905 return NT_STATUS_NO_MEMORY
;
907 ntlmssp_state
->server
.dns_name
= talloc_strdup(ntlmssp_state
, dns_name
);
908 if (!ntlmssp_state
->server
.dns_name
) {
909 talloc_free(ntlmssp_state
);
910 return NT_STATUS_NO_MEMORY
;
912 ntlmssp_state
->server
.dns_domain
= talloc_strdup(ntlmssp_state
, dns_domain
);
913 if (!ntlmssp_state
->server
.dns_domain
) {
914 talloc_free(ntlmssp_state
);
915 return NT_STATUS_NO_MEMORY
;
918 *_ntlmssp_state
= ntlmssp_state
;
922 /*********************************************************************
924 *********************************************************************/
927 * Next state function for the Initial packet
929 * @param ntlmssp_state NTLMSSP State
930 * @param request The request, as a DATA_BLOB. reply.data must be NULL
931 * @param request The reply, as an allocated DATA_BLOB, caller to free.
932 * @return Errors or NT_STATUS_OK.
935 static NTSTATUS
ntlmssp_client_initial(struct ntlmssp_state
*ntlmssp_state
,
936 DATA_BLOB reply
, DATA_BLOB
*next_request
)
938 struct NEGOTIATE_MESSAGE negotiate
;
940 if (ntlmssp_state
->unicode
) {
941 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_UNICODE
;
943 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_OEM
;
946 if (ntlmssp_state
->use_ntlmv2
) {
947 ntlmssp_state
->neg_flags
|= NTLMSSP_NEGOTIATE_NTLM2
;
950 /* generate the ntlmssp negotiate packet */
951 msrpc_gen(ntlmssp_state
, next_request
, "CddAA",
954 ntlmssp_state
->neg_flags
,
955 ntlmssp_state
->client
.netbios_domain
,
956 ntlmssp_state
->client
.netbios_name
);
958 if (DEBUGLEVEL
>= 10) {
959 if (NT_STATUS_IS_OK(ntlmssp_pull_NEGOTIATE_MESSAGE(next_request
,
963 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE
, &negotiate
);
967 ntlmssp_state
->expected_state
= NTLMSSP_CHALLENGE
;
969 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
973 * Next state function for the Challenge Packet. Generate an auth packet.
975 * @param ntlmssp_state NTLMSSP State
976 * @param request The request, as a DATA_BLOB. reply.data must be NULL
977 * @param request The reply, as an allocated DATA_BLOB, caller to free.
978 * @return Errors or NT_STATUS_OK.
981 static NTSTATUS
ntlmssp_client_challenge(struct ntlmssp_state
*ntlmssp_state
,
982 const DATA_BLOB reply
, DATA_BLOB
*next_request
)
984 uint32_t chal_flags
, ntlmssp_command
, unkn1
, unkn2
;
985 DATA_BLOB server_domain_blob
;
986 DATA_BLOB challenge_blob
;
987 DATA_BLOB struct_blob
= data_blob_null
;
989 const char *chal_parse_string
;
990 const char *auth_gen_string
;
991 DATA_BLOB lm_response
= data_blob_null
;
992 DATA_BLOB nt_response
= data_blob_null
;
993 DATA_BLOB session_key
= data_blob_null
;
994 DATA_BLOB encrypted_session_key
= data_blob_null
;
995 NTSTATUS nt_status
= NT_STATUS_OK
;
996 struct CHALLENGE_MESSAGE challenge
;
997 struct AUTHENTICATE_MESSAGE authenticate
;
999 if (ntlmssp_state
->use_ccache
) {
1000 struct wbcCredentialCacheParams params
;
1001 struct wbcCredentialCacheInfo
*info
= NULL
;
1002 struct wbcAuthErrorInfo
*error
= NULL
;
1003 struct wbcNamedBlob auth_blob
;
1004 struct wbcBlob
*wbc_next
= NULL
;
1005 struct wbcBlob
*wbc_session_key
= NULL
;
1009 params
.account_name
= ntlmssp_state
->user
;
1010 params
.domain_name
= ntlmssp_state
->domain
;
1011 params
.level
= WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP
;
1013 auth_blob
.name
= "challenge_blob";
1014 auth_blob
.flags
= 0;
1015 auth_blob
.blob
.data
= reply
.data
;
1016 auth_blob
.blob
.length
= reply
.length
;
1017 params
.num_blobs
= 1;
1018 params
.blobs
= &auth_blob
;
1020 wbc_status
= wbcCredentialCache(¶ms
, &info
, &error
);
1021 if (error
!= NULL
) {
1022 wbcFreeMemory(error
);
1024 if (!WBC_ERROR_IS_OK(wbc_status
)) {
1028 for (i
=0; i
<info
->num_blobs
; i
++) {
1029 if (strequal(info
->blobs
[i
].name
, "auth_blob")) {
1030 wbc_next
= &info
->blobs
[i
].blob
;
1032 if (strequal(info
->blobs
[i
].name
, "session_key")) {
1033 wbc_session_key
= &info
->blobs
[i
].blob
;
1036 if ((wbc_next
== NULL
) || (wbc_session_key
== NULL
)) {
1037 wbcFreeMemory(info
);
1041 *next_request
= data_blob(wbc_next
->data
, wbc_next
->length
);
1042 ntlmssp_state
->session_key
= data_blob(
1043 wbc_session_key
->data
, wbc_session_key
->length
);
1045 wbcFreeMemory(info
);
1051 if (!msrpc_parse(ntlmssp_state
, &reply
, "CdBd",
1054 &server_domain_blob
,
1056 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
1057 dump_data(2, reply
.data
, reply
.length
);
1059 return NT_STATUS_INVALID_PARAMETER
;
1062 if (DEBUGLEVEL
>= 10) {
1063 if (NT_STATUS_IS_OK(ntlmssp_pull_CHALLENGE_MESSAGE(&reply
,
1067 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE
, &challenge
);
1071 data_blob_free(&server_domain_blob
);
1073 DEBUG(3, ("Got challenge flags:\n"));
1074 debug_ntlmssp_flags(chal_flags
);
1076 ntlmssp_handle_neg_flags(ntlmssp_state
, chal_flags
, lp_client_lanman_auth());
1078 if (ntlmssp_state
->unicode
) {
1079 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
) {
1080 chal_parse_string
= "CdUdbddB";
1082 chal_parse_string
= "CdUdbdd";
1084 auth_gen_string
= "CdBBUUUBd";
1086 if (chal_flags
& NTLMSSP_NEGOTIATE_TARGET_INFO
) {
1087 chal_parse_string
= "CdAdbddB";
1089 chal_parse_string
= "CdAdbdd";
1092 auth_gen_string
= "CdBBAAABd";
1095 DEBUG(3, ("NTLMSSP: Set final flags:\n"));
1096 debug_ntlmssp_flags(ntlmssp_state
->neg_flags
);
1098 if (!msrpc_parse(ntlmssp_state
, &reply
, chal_parse_string
,
1106 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
1107 dump_data(2, reply
.data
, reply
.length
);
1108 return NT_STATUS_INVALID_PARAMETER
;
1111 if (chal_flags
& NTLMSSP_TARGET_TYPE_SERVER
) {
1112 ntlmssp_state
->server
.is_standalone
= true;
1114 ntlmssp_state
->server
.is_standalone
= false;
1116 /* TODO: parse struct_blob and fill in the rest */
1117 ntlmssp_state
->server
.netbios_name
= "";
1118 ntlmssp_state
->server
.netbios_domain
= server_domain
;
1119 ntlmssp_state
->server
.dns_name
= "";
1120 ntlmssp_state
->server
.dns_domain
= "";
1122 if (challenge_blob
.length
!= 8) {
1123 data_blob_free(&struct_blob
);
1124 return NT_STATUS_INVALID_PARAMETER
;
1127 if (!ntlmssp_state
->nt_hash
|| !ntlmssp_state
->lm_hash
) {
1128 static const uint8_t zeros
[16] = {0, };
1129 /* do nothing - blobs are zero length */
1131 /* session key is all zeros */
1132 session_key
= data_blob_talloc(ntlmssp_state
, zeros
, 16);
1134 /* not doing NLTM2 without a password */
1135 ntlmssp_state
->neg_flags
&= ~NTLMSSP_NEGOTIATE_NTLM2
;
1136 } else if (ntlmssp_state
->use_ntlmv2
) {
1137 if (!struct_blob
.length
) {
1138 /* be lazy, match win2k - we can't do NTLMv2 without it */
1139 DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
1140 return NT_STATUS_INVALID_PARAMETER
;
1143 /* TODO: if the remote server is standalone, then we should replace 'domain'
1144 with the server name as supplied above */
1146 if (!SMBNTLMv2encrypt_hash(ntlmssp_state
,
1147 ntlmssp_state
->user
,
1148 ntlmssp_state
->domain
,
1149 ntlmssp_state
->nt_hash
, &challenge_blob
,
1151 &lm_response
, &nt_response
, NULL
,
1153 data_blob_free(&challenge_blob
);
1154 data_blob_free(&struct_blob
);
1155 return NT_STATUS_NO_MEMORY
;
1157 } else if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_NTLM2
) {
1158 struct MD5Context md5_session_nonce_ctx
;
1159 uint8_t session_nonce
[16];
1160 uint8_t session_nonce_hash
[16];
1161 uint8_t user_session_key
[16];
1163 lm_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1164 generate_random_buffer(lm_response
.data
, 8);
1165 memset(lm_response
.data
+8, 0, 16);
1167 memcpy(session_nonce
, challenge_blob
.data
, 8);
1168 memcpy(&session_nonce
[8], lm_response
.data
, 8);
1170 MD5Init(&md5_session_nonce_ctx
);
1171 MD5Update(&md5_session_nonce_ctx
, challenge_blob
.data
, 8);
1172 MD5Update(&md5_session_nonce_ctx
, lm_response
.data
, 8);
1173 MD5Final(session_nonce_hash
, &md5_session_nonce_ctx
);
1175 DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
1176 DEBUG(5, ("challenge is: \n"));
1177 dump_data(5, session_nonce_hash
, 8);
1179 nt_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1180 SMBNTencrypt_hash(ntlmssp_state
->nt_hash
,
1184 session_key
= data_blob_talloc(ntlmssp_state
, NULL
, 16);
1186 SMBsesskeygen_ntv1(ntlmssp_state
->nt_hash
, user_session_key
);
1187 hmac_md5(user_session_key
, session_nonce
, sizeof(session_nonce
), session_key
.data
);
1188 dump_data_pw("NTLM2 session key:\n", session_key
.data
, session_key
.length
);
1190 /* lanman auth is insecure, it may be disabled */
1191 if (lp_client_lanman_auth()) {
1192 lm_response
= data_blob_talloc(ntlmssp_state
,
1194 SMBencrypt_hash(ntlmssp_state
->lm_hash
,challenge_blob
.data
,
1198 nt_response
= data_blob_talloc(ntlmssp_state
, NULL
, 24);
1199 SMBNTencrypt_hash(ntlmssp_state
->nt_hash
,challenge_blob
.data
,
1202 session_key
= data_blob_talloc(ntlmssp_state
, NULL
, 16);
1203 if ((ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_LM_KEY
)
1204 && lp_client_lanman_auth()) {
1205 SMBsesskeygen_lm_sess_key(ntlmssp_state
->lm_hash
, lm_response
.data
,
1207 dump_data_pw("LM session key\n", session_key
.data
, session_key
.length
);
1209 SMBsesskeygen_ntv1(ntlmssp_state
->nt_hash
, session_key
.data
);
1210 dump_data_pw("NT session key:\n", session_key
.data
, session_key
.length
);
1213 data_blob_free(&struct_blob
);
1215 /* Key exchange encryptes a new client-generated session key with
1216 the password-derived key */
1217 if (ntlmssp_state
->neg_flags
& NTLMSSP_NEGOTIATE_KEY_EXCH
) {
1218 /* Make up a new session key */
1219 uint8_t client_session_key
[16];
1220 generate_random_buffer(client_session_key
, sizeof(client_session_key
));
1222 /* Encrypt the new session key with the old one */
1223 encrypted_session_key
= data_blob(client_session_key
, sizeof(client_session_key
));
1224 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
1225 arcfour_crypt_blob(encrypted_session_key
.data
, encrypted_session_key
.length
, &session_key
);
1226 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key
.data
, encrypted_session_key
.length
);
1228 /* Mark the new session key as the 'real' session key */
1229 data_blob_free(&session_key
);
1230 session_key
= data_blob_talloc(ntlmssp_state
,
1232 sizeof(client_session_key
));
1235 /* this generates the actual auth packet */
1236 if (!msrpc_gen(ntlmssp_state
, next_request
, auth_gen_string
,
1239 lm_response
.data
, lm_response
.length
,
1240 nt_response
.data
, nt_response
.length
,
1241 ntlmssp_state
->domain
,
1242 ntlmssp_state
->user
,
1243 ntlmssp_state
->client
.netbios_name
,
1244 encrypted_session_key
.data
, encrypted_session_key
.length
,
1245 ntlmssp_state
->neg_flags
)) {
1247 return NT_STATUS_NO_MEMORY
;
1250 if (DEBUGLEVEL
>= 10) {
1251 if (NT_STATUS_IS_OK(ntlmssp_pull_AUTHENTICATE_MESSAGE(next_request
,
1255 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE
, &authenticate
);
1259 data_blob_free(&encrypted_session_key
);
1261 data_blob_free(&ntlmssp_state
->chal
);
1263 ntlmssp_state
->session_key
= session_key
;
1265 ntlmssp_state
->chal
= challenge_blob
;
1266 ntlmssp_state
->lm_resp
= lm_response
;
1267 ntlmssp_state
->nt_resp
= nt_response
;
1271 ntlmssp_state
->expected_state
= NTLMSSP_DONE
;
1273 if (!NT_STATUS_IS_OK(nt_status
= ntlmssp_sign_init(ntlmssp_state
))) {
1274 DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status
)));
1280 NTSTATUS
ntlmssp_client_start(TALLOC_CTX
*mem_ctx
,
1281 const char *netbios_name
,
1282 const char *netbios_domain
,
1284 struct ntlmssp_state
**_ntlmssp_state
)
1286 struct ntlmssp_state
*ntlmssp_state
;
1288 if (!netbios_name
) {
1292 if (!netbios_domain
) {
1293 netbios_domain
= "";
1296 ntlmssp_state
= talloc_zero(mem_ctx
, struct ntlmssp_state
);
1297 if (!ntlmssp_state
) {
1298 return NT_STATUS_NO_MEMORY
;
1301 ntlmssp_state
->role
= NTLMSSP_CLIENT
;
1303 ntlmssp_state
->unicode
= True
;
1305 ntlmssp_state
->use_ntlmv2
= use_ntlmv2
;
1307 ntlmssp_state
->expected_state
= NTLMSSP_INITIAL
;
1309 ntlmssp_state
->neg_flags
=
1310 NTLMSSP_NEGOTIATE_128
|
1311 NTLMSSP_NEGOTIATE_ALWAYS_SIGN
|
1312 NTLMSSP_NEGOTIATE_NTLM
|
1313 NTLMSSP_NEGOTIATE_NTLM2
|
1314 NTLMSSP_NEGOTIATE_KEY_EXCH
|
1315 NTLMSSP_REQUEST_TARGET
;
1317 ntlmssp_state
->client
.netbios_name
= talloc_strdup(ntlmssp_state
, netbios_name
);
1318 if (!ntlmssp_state
->client
.netbios_name
) {
1319 talloc_free(ntlmssp_state
);
1320 return NT_STATUS_NO_MEMORY
;
1322 ntlmssp_state
->client
.netbios_domain
= talloc_strdup(ntlmssp_state
, netbios_domain
);
1323 if (!ntlmssp_state
->client
.netbios_domain
) {
1324 talloc_free(ntlmssp_state
);
1325 return NT_STATUS_NO_MEMORY
;
1328 *_ntlmssp_state
= ntlmssp_state
;
1329 return NT_STATUS_OK
;