Move source4/lib/crypto to lib/crypto.

[ira/wip.git] / source4 / auth / credentials / credentials_ntlm.c

diff --git a/source4/auth/credentials/credentials_ntlm.c b/source4/auth/credentials/credentials_ntlm.c
index 9fd4c0947382b63ba285f6f86bcb13228a6a6494..ef41971462b0db0d8c0162789dd01091e2b03731 100644 (file)
--- a/source4/auth/credentials/credentials_ntlm.c
+++ b/source4/auth/credentials/credentials_ntlm.c
@@ -9,7 +9,7 @@
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
@@ -18,16 +18,16 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 #include "includes.h"
-#include "lib/ldb/include/ldb.h"
-#include "librpc/gen_ndr/ndr_samr.h" /* for struct samrPassword */
-#include "lib/crypto/crypto.h"
+#include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
+#include "../lib/crypto/crypto.h"
+#include "libcli/auth/libcli_auth.h"
+#include "auth/credentials/credentials.h"
 
-void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
+_PUBLIC_ void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
                                              const char **username, 
                                              const char **domain) 
 {
@@ -40,7 +40,7 @@ void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALL
        }
 }
 
-NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
+_PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
                                           int *flags,
                                           DATA_BLOB challenge, DATA_BLOB target_info, 
                                           DATA_BLOB *_lm_response, DATA_BLOB *_nt_response, 
@@ -52,6 +52,20 @@ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_
        const struct samr_Password *nt_hash;
        lm_session_key = data_blob(NULL, 0);
 
+       /* We may already have an NTLM response we prepared earlier.
+        * This is used for NTLM pass-though authentication */
+       if (cred->nt_response.data || cred->lm_response.data) {
+               *_nt_response = cred->nt_response;
+               *_lm_response = cred->lm_response;
+
+               if (!cred->lm_response.data) {
+                       *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
+               }
+               *_lm_session_key = data_blob(NULL, 0);
+               *_session_key = data_blob(NULL, 0);
+               return NT_STATUS_OK;
+       }
+
        nt_hash = cli_credentials_get_nt_hash(cred, mem_ctx);
 
        cli_credentials_get_ntlm_username_domain(cred, mem_ctx, &user, &domain);
@@ -67,6 +81,10 @@ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_
        if (cred->machine_account) {
                *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
        }
+       
+       if (cred->use_kerberos == CRED_MUST_USE_KERBEROS) {
+               return NT_STATUS_ACCESS_DENIED;
+       }
 
        if (!nt_hash) {
                static const uint8_t zeros[16];
@@ -140,6 +158,7 @@ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_
                /* LM Key is incompatible... */
                *flags &= ~CLI_CRED_LANMAN_AUTH;
        } else {
+               uint8_t lm_hash[16];
                nt_response = data_blob_talloc(mem_ctx, NULL, 24);
                SMBOWFencrypt(nt_hash->hash, challenge.data,
                              nt_response.data);
@@ -156,7 +175,6 @@ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_
                        if (!password) {
                                lm_response = nt_response;
                        } else {
-                               uint8_t lm_hash[16];
                                lm_response = data_blob_talloc(mem_ctx, NULL, 24);
                                if (!SMBencrypt(password,challenge.data,
                                                lm_response.data)) {
@@ -181,9 +199,19 @@ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_
                                }
                        }
                } else {
+                       const char *password;
+
                        /* LM Key is incompatible... */
                        lm_response = nt_response;
                        *flags &= ~CLI_CRED_LANMAN_AUTH;
+
+                       password = cli_credentials_get_password(cred);
+                       if (password) {
+                               E_deshash(password, lm_hash);
+                               lm_session_key = data_blob_talloc(mem_ctx, NULL, 16);
+                               memcpy(lm_session_key.data, lm_hash, 8);
+                               memset(&lm_session_key.data[8], '\0', 8);
+                       }
                }
        }
        if (_lm_response) {
@@ -201,3 +229,41 @@ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_
        return NT_STATUS_OK;
 }
        
+_PUBLIC_ bool cli_credentials_set_nt_hash(struct cli_credentials *cred,
+                                const struct samr_Password *nt_hash, 
+                                enum credentials_obtained obtained)
+{
+       if (obtained >= cred->password_obtained) {
+               cli_credentials_set_password(cred, NULL, obtained);
+               if (nt_hash) {
+                       cred->nt_hash = talloc(cred, struct samr_Password);
+                       *cred->nt_hash = *nt_hash;
+               } else {
+                       cred->nt_hash = NULL;
+               }
+               return true;
+       }
+
+       return false;
+}
+
+_PUBLIC_ bool cli_credentials_set_ntlm_response(struct cli_credentials *cred,
+                                               const DATA_BLOB *lm_response, 
+                                               const DATA_BLOB *nt_response, 
+                                               enum credentials_obtained obtained)
+{
+       if (obtained >= cred->password_obtained) {
+               cli_credentials_set_password(cred, NULL, obtained);
+               if (nt_response) {
+                       cred->nt_response = data_blob_talloc(cred, nt_response->data, nt_response->length);
+                       talloc_steal(cred, cred->nt_response.data);
+               }
+               if (nt_response) {
+                       cred->lm_response = data_blob_talloc(cred, lm_response->data, lm_response->length);
+               }
+               return true;
+       }
+
+       return false;
+}
+