auth/ntlmssp/ntlmssp_server.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle NTLMSSP, server side
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett 2001-2010
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include <tevent.h>
  25 #include "lib/util/tevent_ntstatus.h"
  26 #include "lib/util/time_basic.h"
  27 #include "auth/ntlmssp/ntlmssp.h"
  28 #include "auth/ntlmssp/ntlmssp_private.h"
  29 #include "../librpc/gen_ndr/ndr_ntlmssp.h"
  30 #include "auth/ntlmssp/ntlmssp_ndr.h"
  31 #include "../libcli/auth/libcli_auth.h"
  32 #include "../lib/crypto/crypto.h"
  33 #include "auth/gensec/gensec.h"
  34 #include "auth/gensec/gensec_internal.h"
  35 #include "auth/common_auth.h"
  36 #include "param/param.h"
  37 #include "param/loadparm.h"
  38 #include "libcli/security/session.h"
  39
  40 /**
  41  * Determine correct target name flags for reply, given server role
  42  * and negotiated flags
  43  *
  44  * @param ntlmssp_state NTLMSSP State
  45  * @param neg_flags The flags from the packet
  46  * @param chal_flags The flags to be set in the reply packet
  47  * @return The 'target name' string.
  48  */
  49
  50 const char *ntlmssp_target_name(struct ntlmssp_state *ntlmssp_state,
  51                                 uint32_t neg_flags, uint32_t *chal_flags)
  52 {
  53         if (neg_flags & NTLMSSP_REQUEST_TARGET) {
  54                 *chal_flags |= NTLMSSP_NEGOTIATE_TARGET_INFO;
  55                 *chal_flags |= NTLMSSP_REQUEST_TARGET;
  56                 if (ntlmssp_state->server.is_standalone) {
  57                         *chal_flags |= NTLMSSP_TARGET_TYPE_SERVER;
  58                         return ntlmssp_state->server.netbios_name;
  59                 } else {
  60                         *chal_flags |= NTLMSSP_TARGET_TYPE_DOMAIN;
  61                         return ntlmssp_state->server.netbios_domain;
  62                 };
  63         } else {
  64                 return "";
  65         }
  66 }
  67
  68 /**
  69  * Next state function for the NTLMSSP Negotiate packet
  70  *
  71  * @param gensec_security GENSEC state
  72  * @param out_mem_ctx Memory context for *out
  73  * @param in The request, as a DATA_BLOB.  reply.data must be NULL
  74  * @param out The reply, as an allocated DATA_BLOB, caller to free.
  75  * @return Errors or MORE_PROCESSING_REQUIRED if (normal) a reply is required.
  76  */
  77
  78 NTSTATUS gensec_ntlmssp_server_negotiate(struct gensec_security *gensec_security,
  79                                          TALLOC_CTX *out_mem_ctx,
  80                                          const DATA_BLOB request, DATA_BLOB *reply)
  81 {
  82         struct gensec_ntlmssp_context *gensec_ntlmssp =
  83                 talloc_get_type_abort(gensec_security->private_data,
  84                                       struct gensec_ntlmssp_context);
  85         struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
  86         struct auth4_context *auth_context = gensec_security->auth_context;
  87         DATA_BLOB struct_blob;
  88         uint32_t neg_flags = 0;
  89         uint32_t ntlmssp_command, chal_flags;
  90         uint8_t cryptkey[8];
  91         const char *target_name;
  92         NTSTATUS status;
  93         struct timeval tv_now = timeval_current();
  94         /*
  95          * See [MS-NLMP]
  96          *
  97          * Windows NT 4.0, windows_2000: use 30 minutes,
  98          * Windows XP, Windows Server 2003, Windows Vista,
  99          * Windows Server 2008, Windows 7, and Windows Server 2008 R2
 100          * use 36 hours.
 101          *
 102          * Newer systems doesn't check this, likely because the
 103          * connectionless NTLMSSP is no longer supported.
 104          *
 105          * As we expect the AUTHENTICATION_MESSAGE to arrive
 106          * directly after the NEGOTIATE_MESSAGE (typically less than
 107          * as 1 second later). We use a hard timeout of 30 Minutes.
 108          *
 109          * We don't look at AUTHENTICATE_MESSAGE.NtChallengeResponse.TimeStamp
 110          * instead we just remember our own time.
 111          */
 112         uint32_t max_lifetime = 30 * 60;
 113         struct timeval tv_end = timeval_add(&tv_now, max_lifetime, 0);
 114
 115         /* parse the NTLMSSP packet */
 116 #if 0
 117         file_save("ntlmssp_negotiate.dat", request.data, request.length);
 118 #endif
 119
 120         if (request.length) {
 121                 if (request.length > UINT16_MAX) {
 122                         DEBUG(1, ("ntlmssp_server_negotiate: reject large request of length %u\n",
 123                                 (unsigned int)request.length));
 124                         return NT_STATUS_INVALID_PARAMETER;
 125                 }
 126
 127                 if ((request.length < 16) || !msrpc_parse(ntlmssp_state, &request, "Cdd",
 128                                                           "NTLMSSP",
 129                                                           &ntlmssp_command,
 130                                                           &neg_flags)) {
 131                         DEBUG(1, ("ntlmssp_server_negotiate: failed to parse NTLMSSP Negotiate of length %u\n",
 132                                 (unsigned int)request.length));
 133                         dump_data(2, request.data, request.length);
 134                         return NT_STATUS_INVALID_PARAMETER;
 135                 }
 136                 debug_ntlmssp_flags(neg_flags);
 137
 138                 if (DEBUGLEVEL >= 10) {
 139                         struct NEGOTIATE_MESSAGE *negotiate = talloc(
 140                                 ntlmssp_state, struct NEGOTIATE_MESSAGE);
 141                         if (negotiate != NULL) {
 142                                 status = ntlmssp_pull_NEGOTIATE_MESSAGE(
 143                                         &request, negotiate, negotiate);
 144                                 if (NT_STATUS_IS_OK(status)) {
 145                                         NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE,
 146                                                         negotiate);
 147                                 }
 148                                 TALLOC_FREE(negotiate);
 149                         }
 150                 }
 151         }
 152
 153         status = ntlmssp_handle_neg_flags(ntlmssp_state, neg_flags, "negotiate");
 154         if (!NT_STATUS_IS_OK(status)){
 155                 return status;
 156         }
 157
 158         /* Ask our caller what challenge they would like in the packet */
 159         if (auth_context->get_ntlm_challenge) {
 160                 status = auth_context->get_ntlm_challenge(auth_context, cryptkey);
 161                 if (!NT_STATUS_IS_OK(status)) {
 162                         DEBUG(1, ("gensec_ntlmssp_server_negotiate: failed to get challenge: %s\n",
 163                                   nt_errstr(status)));
 164                         return status;
 165                 }
 166         } else {
 167                 DEBUG(1, ("gensec_ntlmssp_server_negotiate: backend doesn't give a challenge\n"));
 168                 return NT_STATUS_NOT_IMPLEMENTED;
 169         }
 170
 171         /* The flags we send back are not just the negotiated flags,
 172          * they are also 'what is in this packet'.  Therfore, we
 173          * operate on 'chal_flags' from here on
 174          */
 175
 176         chal_flags = ntlmssp_state->neg_flags;
 177         ntlmssp_state->server.challenge_endtime = timeval_to_nttime(&tv_end);
 178
 179         /* get the right name to fill in as 'target' */
 180         target_name = ntlmssp_target_name(ntlmssp_state,
 181                                           neg_flags, &chal_flags);
 182         if (target_name == NULL)
 183                 return NT_STATUS_INVALID_PARAMETER;
 184
 185         ntlmssp_state->chal = data_blob_talloc(ntlmssp_state, cryptkey, 8);
 186         ntlmssp_state->internal_chal = data_blob_talloc(ntlmssp_state,
 187                                                         cryptkey, 8);
 188
 189         /* This creates the 'blob' of names that appears at the end of the packet */
 190         if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
 191                 enum ndr_err_code err;
 192                 struct AV_PAIR *pairs = NULL;
 193                 uint32_t count = 5;
 194
 195                 pairs = talloc_zero_array(ntlmssp_state, struct AV_PAIR, count + 1);
 196                 if (pairs == NULL) {
 197                         return NT_STATUS_NO_MEMORY;
 198                 }
 199
 200                 pairs[0].AvId                   = MsvAvNbDomainName;
 201                 pairs[0].Value.AvNbDomainName   = target_name;
 202
 203                 pairs[1].AvId                   = MsvAvNbComputerName;
 204                 pairs[1].Value.AvNbComputerName = ntlmssp_state->server.netbios_name;
 205
 206                 pairs[2].AvId                   = MsvAvDnsDomainName;
 207                 pairs[2].Value.AvDnsDomainName  = ntlmssp_state->server.dns_domain;
 208
 209                 pairs[3].AvId                   = MsvAvDnsComputerName;
 210                 pairs[3].Value.AvDnsComputerName= ntlmssp_state->server.dns_name;
 211
 212                 if (!ntlmssp_state->force_old_spnego) {
 213                         pairs[4].AvId                   = MsvAvTimestamp;
 214                         pairs[4].Value.AvTimestamp      =
 215                                                 timeval_to_nttime(&tv_now);
 216                         count += 1;
 217
 218                         pairs[5].AvId                   = MsvAvEOL;
 219                 } else {
 220                         pairs[4].AvId                   = MsvAvEOL;
 221                 }
 222
 223                 ntlmssp_state->server.av_pair_list.count = count;
 224                 ntlmssp_state->server.av_pair_list.pair = pairs;
 225
 226                 err = ndr_push_struct_blob(&struct_blob,
 227                                         ntlmssp_state,
 228                                         &ntlmssp_state->server.av_pair_list,
 229                                         (ndr_push_flags_fn_t)ndr_push_AV_PAIR_LIST);
 230                 if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
 231                         return NT_STATUS_NO_MEMORY;
 232                 }
 233         } else {
 234                 struct_blob = data_blob_null;
 235         }
 236
 237         {
 238                 /* Marshal the packet in the right format, be it unicode or ASCII */
 239                 const char *gen_string;
 240                 const DATA_BLOB version_blob = ntlmssp_version_blob();
 241
 242                 if (ntlmssp_state->unicode) {
 243                         gen_string = "CdUdbddBb";
 244                 } else {
 245                         gen_string = "CdAdbddBb";
 246                 }
 247
 248                 status = msrpc_gen(out_mem_ctx, reply, gen_string,
 249                         "NTLMSSP",
 250                         NTLMSSP_CHALLENGE,
 251                         target_name,
 252                         chal_flags,
 253                         cryptkey, 8,
 254                         0, 0,
 255                         struct_blob.data, struct_blob.length,
 256                         version_blob.data, version_blob.length);
 257
 258                 if (!NT_STATUS_IS_OK(status)) {
 259                         data_blob_free(&struct_blob);
 260                         return status;
 261                 }
 262
 263                 if (DEBUGLEVEL >= 10) {
 264                         struct CHALLENGE_MESSAGE *challenge = talloc(
 265                                 ntlmssp_state, struct CHALLENGE_MESSAGE);
 266                         if (challenge != NULL) {
 267                                 challenge->NegotiateFlags = chal_flags;
 268                                 status = ntlmssp_pull_CHALLENGE_MESSAGE(
 269                                         reply, challenge, challenge);
 270                                 if (NT_STATUS_IS_OK(status)) {
 271                                         NDR_PRINT_DEBUG(CHALLENGE_MESSAGE,
 272                                                         challenge);
 273                                 }
 274                                 TALLOC_FREE(challenge);
 275                         }
 276                 }
 277         }
 278
 279         data_blob_free(&struct_blob);
 280
 281         ntlmssp_state->negotiate_blob = data_blob_dup_talloc(ntlmssp_state,
 282                                                              request);
 283         if (ntlmssp_state->negotiate_blob.length != request.length) {
 284                 return NT_STATUS_NO_MEMORY;
 285         }
 286
 287         ntlmssp_state->challenge_blob = data_blob_dup_talloc(ntlmssp_state,
 288                                                              *reply);
 289         if (ntlmssp_state->challenge_blob.length != reply->length) {
 290                 return NT_STATUS_NO_MEMORY;
 291         }
 292
 293         ntlmssp_state->expected_state = NTLMSSP_AUTH;
 294
 295         return NT_STATUS_MORE_PROCESSING_REQUIRED;
 296 }
 297
 298 struct ntlmssp_server_auth_state {
 299         struct auth_usersupplied_info *user_info;
 300         DATA_BLOB user_session_key;
 301         DATA_BLOB lm_session_key;
 302         /* internal variables used by KEY_EXCH (client-supplied user session key */
 303         DATA_BLOB encrypted_session_key;
 304         bool doing_ntlm2;
 305         /* internal variables used by NTLM2 */
 306         uint8_t session_nonce[16];
 307 };
 308
 309 static NTSTATUS ntlmssp_server_preauth(struct gensec_security *gensec_security,
 310                                        struct gensec_ntlmssp_context *gensec_ntlmssp,
 311                                        struct ntlmssp_server_auth_state *state,
 312                                        const DATA_BLOB request);
 313 static NTSTATUS ntlmssp_server_check_password(struct gensec_security *gensec_security,
 314                                               struct gensec_ntlmssp_context *gensec_ntlmssp,
 315                                               const struct auth_usersupplied_info *user_info,
 316                                               TALLOC_CTX *mem_ctx,
 317                                               DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key);
 318 static NTSTATUS ntlmssp_server_postauth(struct gensec_security *gensec_security,
 319                                         struct gensec_ntlmssp_context *gensec_ntlmssp,
 320                                         struct ntlmssp_server_auth_state *state,
 321                                         DATA_BLOB request);
 322
 323 struct tevent_req *ntlmssp_server_auth_send(TALLOC_CTX *mem_ctx,
 324                                             struct tevent_context *ev,
 325                                             struct gensec_security *gensec_security,
 326                                             const DATA_BLOB in)
 327 {
 328         struct gensec_ntlmssp_context *gensec_ntlmssp =
 329                 talloc_get_type_abort(gensec_security->private_data,
 330                                       struct gensec_ntlmssp_context);
 331         struct tevent_req *req = NULL;
 332         struct ntlmssp_server_auth_state *state = NULL;
 333         NTSTATUS status;
 334
 335         req = tevent_req_create(mem_ctx, &state,
 336                                 struct ntlmssp_server_auth_state);
 337         if (req == NULL) {
 338                 return NULL;
 339         }
 340
 341         status = ntlmssp_server_preauth(gensec_security,
 342                                         gensec_ntlmssp,
 343                                         state, in);
 344         if (tevent_req_nterror(req, status)) {
 345                 return tevent_req_post(req, ev);
 346         }
 347
 348         status = ntlmssp_server_check_password(gensec_security,
 349                                                gensec_ntlmssp,
 350                                                state->user_info,
 351                                                state,
 352                                                &state->user_session_key,
 353                                                &state->lm_session_key);
 354         if (tevent_req_nterror(req, status)) {
 355                 return tevent_req_post(req, ev);
 356         }
 357
 358         status = ntlmssp_server_postauth(gensec_security,
 359                                          gensec_ntlmssp,
 360                                          state, in);
 361         if (tevent_req_nterror(req, status)) {
 362                 return tevent_req_post(req, ev);
 363         }
 364
 365         tevent_req_done(req);
 366         return tevent_req_post(req, ev);
 367 }
 368
 369 /**
 370  * Next state function for the Authenticate packet
 371  *
 372  * @param ntlmssp_state NTLMSSP State
 373  * @param request The request, as a DATA_BLOB
 374  * @return Errors or NT_STATUS_OK.
 375  */
 376
 377 static NTSTATUS ntlmssp_server_preauth(struct gensec_security *gensec_security,
 378                                        struct gensec_ntlmssp_context *gensec_ntlmssp,
 379                                        struct ntlmssp_server_auth_state *state,
 380                                        const DATA_BLOB request)
 381 {
 382         struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
 383         struct auth4_context *auth_context = gensec_security->auth_context;
 384         struct auth_usersupplied_info *user_info = NULL;
 385         uint32_t ntlmssp_command, auth_flags;
 386         NTSTATUS nt_status;
 387         const unsigned int version_len = 8;
 388         DATA_BLOB version_blob = data_blob_null;
 389         const unsigned int mic_len = NTLMSSP_MIC_SIZE;
 390         DATA_BLOB mic_blob = data_blob_null;
 391         uint8_t session_nonce_hash[16];
 392         const char *parse_string;
 393         bool ok;
 394         struct timeval endtime;
 395         bool expired = false;
 396
 397 #if 0
 398         file_save("ntlmssp_auth.dat", request.data, request.length);
 399 #endif
 400
 401         if (ntlmssp_state->unicode) {
 402                 parse_string = "CdBBUUUBdbb";
 403         } else {
 404                 parse_string = "CdBBAAABdbb";
 405         }
 406
 407         /* zero these out */
 408         data_blob_free(&ntlmssp_state->session_key);
 409         data_blob_free(&ntlmssp_state->lm_resp);
 410         data_blob_free(&ntlmssp_state->nt_resp);
 411
 412         ntlmssp_state->user = NULL;
 413         ntlmssp_state->domain = NULL;
 414         ntlmssp_state->client.netbios_name = NULL;
 415
 416         /* now the NTLMSSP encoded auth hashes */
 417         ok = msrpc_parse(ntlmssp_state, &request, parse_string,
 418                          "NTLMSSP",
 419                          &ntlmssp_command,
 420                          &ntlmssp_state->lm_resp,
 421                          &ntlmssp_state->nt_resp,
 422                          &ntlmssp_state->domain,
 423                          &ntlmssp_state->user,
 424                          &ntlmssp_state->client.netbios_name,
 425                          &state->encrypted_session_key,
 426                          &auth_flags,
 427                          &version_blob, version_len,
 428                          &mic_blob, mic_len);
 429         if (!ok) {
 430                 DEBUG(10, ("ntlmssp_server_auth: failed to parse NTLMSSP (nonfatal):\n"));
 431                 dump_data(10, request.data, request.length);
 432
 433                 data_blob_free(&version_blob);
 434                 data_blob_free(&mic_blob);
 435
 436                 if (ntlmssp_state->unicode) {
 437                         parse_string = "CdBBUUUBd";
 438                 } else {
 439                         parse_string = "CdBBAAABd";
 440                 }
 441
 442                 ok = msrpc_parse(ntlmssp_state, &request, parse_string,
 443                                  "NTLMSSP",
 444                                  &ntlmssp_command,
 445                                  &ntlmssp_state->lm_resp,
 446                                  &ntlmssp_state->nt_resp,
 447                                  &ntlmssp_state->domain,
 448                                  &ntlmssp_state->user,
 449                                  &ntlmssp_state->client.netbios_name,
 450                                  &state->encrypted_session_key,
 451                                  &auth_flags);
 452         }
 453
 454         if (!ok) {
 455                 DEBUG(10, ("ntlmssp_server_auth: failed to parse NTLMSSP (nonfatal):\n"));
 456                 dump_data(10, request.data, request.length);
 457
 458                 /* zero this out */
 459                 data_blob_free(&state->encrypted_session_key);
 460                 auth_flags = 0;
 461
 462                 /* Try again with a shorter string (Win9X truncates this packet) */
 463                 if (ntlmssp_state->unicode) {
 464                         parse_string = "CdBBUUU";
 465                 } else {
 466                         parse_string = "CdBBAAA";
 467                 }
 468
 469                 /* now the NTLMSSP encoded auth hashes */
 470                 if (!msrpc_parse(ntlmssp_state, &request, parse_string,
 471                                  "NTLMSSP",
 472                                  &ntlmssp_command,
 473                                  &ntlmssp_state->lm_resp,
 474                                  &ntlmssp_state->nt_resp,
 475                                  &ntlmssp_state->domain,
 476                                  &ntlmssp_state->user,
 477                                  &ntlmssp_state->client.netbios_name)) {
 478                         DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP (tried both formats):\n"));
 479                         dump_data(2, request.data, request.length);
 480
 481                         return NT_STATUS_INVALID_PARAMETER;
 482                 }
 483         }
 484
 485         talloc_steal(state, state->encrypted_session_key.data);
 486
 487         if (auth_flags != 0) {
 488                 nt_status = ntlmssp_handle_neg_flags(ntlmssp_state,
 489                                                      auth_flags,
 490                                                      "authenticate");
 491                 if (!NT_STATUS_IS_OK(nt_status)){
 492                         return nt_status;
 493                 }
 494         }
 495
 496         if (DEBUGLEVEL >= 10) {
 497                 struct AUTHENTICATE_MESSAGE *authenticate = talloc(
 498                         ntlmssp_state, struct AUTHENTICATE_MESSAGE);
 499                 if (authenticate != NULL) {
 500                         NTSTATUS status;
 501                         authenticate->NegotiateFlags = auth_flags;
 502                         status = ntlmssp_pull_AUTHENTICATE_MESSAGE(
 503                                 &request, authenticate, authenticate);
 504                         if (NT_STATUS_IS_OK(status)) {
 505                                 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE,
 506                                                 authenticate);
 507                         }
 508                         TALLOC_FREE(authenticate);
 509                 }
 510         }
 511
 512         DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
 513                  ntlmssp_state->user, ntlmssp_state->domain,
 514                  ntlmssp_state->client.netbios_name,
 515                  (unsigned long)ntlmssp_state->lm_resp.length,
 516                  (unsigned long)ntlmssp_state->nt_resp.length));
 517
 518 #if 0
 519         file_save("nthash1.dat",  &ntlmssp_state->nt_resp.data,  &ntlmssp_state->nt_resp.length);
 520         file_save("lmhash1.dat",  &ntlmssp_state->lm_resp.data,  &ntlmssp_state->lm_resp.length);
 521 #endif
 522
 523         if (ntlmssp_state->nt_resp.length > 24) {
 524                 struct NTLMv2_RESPONSE v2_resp;
 525                 enum ndr_err_code err;
 526                 uint32_t i = 0;
 527                 uint32_t count = 0;
 528                 const struct AV_PAIR *flags = NULL;
 529                 const struct AV_PAIR *eol = NULL;
 530                 uint32_t av_flags = 0;
 531
 532                 err = ndr_pull_struct_blob(&ntlmssp_state->nt_resp,
 533                                         ntlmssp_state,
 534                                         &v2_resp,
 535                                         (ndr_pull_flags_fn_t)ndr_pull_NTLMv2_RESPONSE);
 536                 if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
 537                         nt_status = ndr_map_error2ntstatus(err);
 538                         DEBUG(1,("%s: failed to parse NTLMv2_RESPONSE of length %zu for "
 539                                  "user=[%s] domain=[%s] workstation=[%s] - %s %s\n",
 540                                  __func__, ntlmssp_state->nt_resp.length,
 541                                  ntlmssp_state->user, ntlmssp_state->domain,
 542                                  ntlmssp_state->client.netbios_name,
 543                                  ndr_errstr(err), nt_errstr(nt_status)));
 544                         return nt_status;
 545                 }
 546
 547                 if (DEBUGLVL(10)) {
 548                         NDR_PRINT_DEBUG(NTLMv2_RESPONSE, &v2_resp);
 549                 }
 550
 551                 eol = ndr_ntlmssp_find_av(&v2_resp.Challenge.AvPairs,
 552                                           MsvAvEOL);
 553                 if (eol == NULL) {
 554                         DEBUG(1,("%s: missing MsvAvEOL for "
 555                                  "user=[%s] domain=[%s] workstation=[%s]\n",
 556                                  __func__, ntlmssp_state->user, ntlmssp_state->domain,
 557                                  ntlmssp_state->client.netbios_name));
 558                         return NT_STATUS_INVALID_PARAMETER;
 559                 }
 560
 561                 flags = ndr_ntlmssp_find_av(&v2_resp.Challenge.AvPairs,
 562                                             MsvAvFlags);
 563                 if (flags != NULL) {
 564                         av_flags = flags->Value.AvFlags;
 565                 }
 566
 567                 if (av_flags & NTLMSSP_AVFLAG_MIC_IN_AUTHENTICATE_MESSAGE) {
 568                         if (mic_blob.length != NTLMSSP_MIC_SIZE) {
 569                                 DEBUG(1,("%s: mic_blob.length[%u] for "
 570                                          "user=[%s] domain=[%s] workstation=[%s]\n",
 571                                          __func__,
 572                                          (unsigned)mic_blob.length,
 573                                          ntlmssp_state->user,
 574                                          ntlmssp_state->domain,
 575                                          ntlmssp_state->client.netbios_name));
 576                                 return NT_STATUS_INVALID_PARAMETER;
 577                         }
 578
 579                         if (request.length <
 580                             (NTLMSSP_MIC_OFFSET + NTLMSSP_MIC_SIZE))
 581                         {
 582                                 DEBUG(1,("%s: missing MIC "
 583                                          "request.length[%u] for "
 584                                          "user=[%s] domain=[%s] workstation=[%s]\n",
 585                                          __func__,
 586                                          (unsigned)request.length,
 587                                          ntlmssp_state->user,
 588                                          ntlmssp_state->domain,
 589                                          ntlmssp_state->client.netbios_name));
 590                                 return NT_STATUS_INVALID_PARAMETER;
 591                         }
 592
 593                         ntlmssp_state->new_spnego = true;
 594                 }
 595
 596                 count = ntlmssp_state->server.av_pair_list.count;
 597                 if (v2_resp.Challenge.AvPairs.count < count) {
 598                         return NT_STATUS_INVALID_PARAMETER;
 599                 }
 600
 601                 for (i = 0; i < count; i++) {
 602                         const struct AV_PAIR *sp =
 603                                 &ntlmssp_state->server.av_pair_list.pair[i];
 604                         const struct AV_PAIR *cp = NULL;
 605
 606                         if (sp->AvId == MsvAvEOL) {
 607                                 continue;
 608                         }
 609
 610                         cp = ndr_ntlmssp_find_av(&v2_resp.Challenge.AvPairs,
 611                                                  sp->AvId);
 612                         if (cp == NULL) {
 613                                 DEBUG(1,("%s: AvId 0x%x missing for"
 614                                          "user=[%s] domain=[%s] "
 615                                          "workstation=[%s]\n",
 616                                          __func__,
 617                                          (unsigned)sp->AvId,
 618                                          ntlmssp_state->user,
 619                                          ntlmssp_state->domain,
 620                                          ntlmssp_state->client.netbios_name));
 621                                 return NT_STATUS_INVALID_PARAMETER;
 622                         }
 623
 624                         switch (cp->AvId) {
 625 #define CASE_STRING(v) case Msv ## v: do { \
 626         int cmp; \
 627         if (sp->Value.v == NULL) { \
 628                 return NT_STATUS_INTERNAL_ERROR; \
 629         } \
 630         if (cp->Value.v == NULL) { \
 631                 DEBUG(1,("%s: invalid %s " \
 632                          "got[%s] expect[%s] for " \
 633                          "user=[%s] domain=[%s] workstation=[%s]\n", \
 634                          __func__, #v, \
 635                          cp->Value.v, \
 636                          sp->Value.v, \
 637                          ntlmssp_state->user, \
 638                          ntlmssp_state->domain, \
 639                          ntlmssp_state->client.netbios_name)); \
 640                 return NT_STATUS_INVALID_PARAMETER; \
 641         } \
 642         cmp = strcmp(cp->Value.v, sp->Value.v); \
 643         if (cmp != 0) { \
 644                 DEBUG(1,("%s: invalid %s " \
 645                          "got[%s] expect[%s] for " \
 646                          "user=[%s] domain=[%s] workstation=[%s]\n", \
 647                          __func__, #v, \
 648                          cp->Value.v, \
 649                          sp->Value.v, \
 650                          ntlmssp_state->user, \
 651                          ntlmssp_state->domain, \
 652                          ntlmssp_state->client.netbios_name)); \
 653                 return NT_STATUS_INVALID_PARAMETER; \
 654         } \
 655 } while(0); break
 656                         CASE_STRING(AvNbComputerName);
 657                         CASE_STRING(AvNbDomainName);
 658                         CASE_STRING(AvDnsComputerName);
 659                         CASE_STRING(AvDnsDomainName);
 660                         CASE_STRING(AvDnsTreeName);
 661                         case MsvAvTimestamp:
 662                                 if (cp->Value.AvTimestamp != sp->Value.AvTimestamp) {
 663                                         struct timeval ct;
 664                                         struct timeval st;
 665                                         struct timeval_buf tmp1;
 666                                         struct timeval_buf tmp2;
 667
 668                                         nttime_to_timeval(&ct,
 669                                                           cp->Value.AvTimestamp);
 670                                         nttime_to_timeval(&st,
 671                                                           sp->Value.AvTimestamp);
 672
 673                                         DEBUG(1,("%s: invalid AvTimestamp "
 674                                                  "got[%s] expect[%s] for "
 675                                                  "user=[%s] domain=[%s] "
 676                                                  "workstation=[%s]\n",
 677                                                  __func__,
 678                                                  timeval_str_buf(&ct, false,
 679                                                                  true, &tmp1),
 680                                                  timeval_str_buf(&st, false,
 681                                                                  true, &tmp2),
 682                                                  ntlmssp_state->user,
 683                                                  ntlmssp_state->domain,
 684                                                  ntlmssp_state->client.netbios_name));
 685                                         return NT_STATUS_INVALID_PARAMETER;
 686                                 }
 687                                 break;
 688                         default:
 689                                 /*
 690                                  * This can't happen as we control
 691                                  * ntlmssp_state->server.av_pair_list
 692                                  */
 693                                 return NT_STATUS_INTERNAL_ERROR;
 694                         }
 695                 }
 696         }
 697
 698         nttime_to_timeval(&endtime, ntlmssp_state->server.challenge_endtime);
 699         expired = timeval_expired(&endtime);
 700         if (expired) {
 701                 struct timeval_buf tmp;
 702                 DEBUG(1,("%s: challenge invalid (expired %s) for "
 703                          "user=[%s] domain=[%s] workstation=[%s]\n",
 704                          __func__,
 705                          timeval_str_buf(&endtime, false, true, &tmp),
 706                          ntlmssp_state->user, ntlmssp_state->domain,
 707                          ntlmssp_state->client.netbios_name));
 708                 return NT_STATUS_INVALID_PARAMETER;
 709         }
 710
 711         /* NTLM2 uses a 'challenge' that is made of up both the server challenge, and a
 712            client challenge
 713
 714            However, the NTLM2 flag may still be set for the real NTLMv2 logins, be careful.
 715         */
 716         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 717                 if (ntlmssp_state->nt_resp.length == 24 && ntlmssp_state->lm_resp.length == 24) {
 718                         MD5_CTX md5_session_nonce_ctx;
 719                         state->doing_ntlm2 = true;
 720
 721                         memcpy(state->session_nonce, ntlmssp_state->internal_chal.data, 8);
 722                         memcpy(&state->session_nonce[8], ntlmssp_state->lm_resp.data, 8);
 723
 724                         SMB_ASSERT(ntlmssp_state->internal_chal.data && ntlmssp_state->internal_chal.length == 8);
 725
 726                         MD5Init(&md5_session_nonce_ctx);
 727                         MD5Update(&md5_session_nonce_ctx, state->session_nonce, 16);
 728                         MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
 729
 730                         /* LM response is no longer useful */
 731                         data_blob_free(&ntlmssp_state->lm_resp);
 732
 733                         /* We changed the effective challenge - set it */
 734                         if (auth_context->set_ntlm_challenge) {
 735                                 nt_status = auth_context->set_ntlm_challenge(auth_context,
 736                                                                              session_nonce_hash,
 737                                                                              "NTLMSSP callback (NTLM2)");
 738                                 if (!NT_STATUS_IS_OK(nt_status)) {
 739                                         DEBUG(1, ("gensec_ntlmssp_server_negotiate: failed to get challenge: %s\n",
 740                                                   nt_errstr(nt_status)));
 741                                         return nt_status;
 742                                 }
 743                         } else {
 744                                 DEBUG(1, ("gensec_ntlmssp_server_negotiate: backend doesn't have facility for challenge to be set\n"));
 745
 746                                 return NT_STATUS_NOT_IMPLEMENTED;
 747                         }
 748
 749                         /* LM Key is incompatible. */
 750                         ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
 751                 }
 752         }
 753
 754         user_info = talloc_zero(state, struct auth_usersupplied_info);
 755         if (!user_info) {
 756                 return NT_STATUS_NO_MEMORY;
 757         }
 758
 759         user_info->logon_parameters = MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
 760         user_info->flags = 0;
 761         user_info->mapped_state = false;
 762         user_info->client.account_name = ntlmssp_state->user;
 763         user_info->client.domain_name = ntlmssp_state->domain;
 764         user_info->workstation_name = ntlmssp_state->client.netbios_name;
 765         user_info->remote_host = gensec_get_remote_address(gensec_security);
 766         user_info->local_host = gensec_get_local_address(gensec_security);
 767         user_info->service_description
 768                 = gensec_get_target_service_description(gensec_security);
 769
 770         /*
 771          * This will just be the string "NTLMSSP" from
 772          * gensec_ntlmssp_final_auth_type, but ensures it stays in sync
 773          * with the same use in the authorization logging triggered by
 774          * gensec_session_info() later
 775          */
 776         user_info->auth_description = gensec_final_auth_type(gensec_security);
 777
 778         user_info->password_state = AUTH_PASSWORD_RESPONSE;
 779         user_info->password.response.lanman = ntlmssp_state->lm_resp;
 780         user_info->password.response.nt = ntlmssp_state->nt_resp;
 781
 782         state->user_info = user_info;
 783         return NT_STATUS_OK;
 784 }
 785
 786 /**
 787  * Check the password on an NTLMSSP login.
 788  *
 789  * Return the session keys used on the connection.
 790  */
 791
 792 static NTSTATUS ntlmssp_server_check_password(struct gensec_security *gensec_security,
 793                                               struct gensec_ntlmssp_context *gensec_ntlmssp,
 794                                               const struct auth_usersupplied_info *user_info,
 795                                               TALLOC_CTX *mem_ctx,
 796                                               DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
 797 {
 798         struct auth4_context *auth_context = gensec_security->auth_context;
 799         NTSTATUS nt_status = NT_STATUS_NOT_IMPLEMENTED;
 800
 801         if (auth_context->check_ntlm_password) {
 802                 uint8_t authoritative = 0;
 803
 804                 nt_status = auth_context->check_ntlm_password(auth_context,
 805                                                               gensec_ntlmssp,
 806                                                               user_info,
 807                                                               &authoritative,
 808                                                               &gensec_ntlmssp->server_returned_info,
 809                                                               user_session_key, lm_session_key);
 810         }
 811
 812         if (!NT_STATUS_IS_OK(nt_status)) {
 813                 DEBUG(5, (__location__ ": Checking NTLMSSP password for %s\\%s failed: %s\n", user_info->client.domain_name, user_info->client.account_name, nt_errstr(nt_status)));
 814         }
 815         NT_STATUS_NOT_OK_RETURN(nt_status);
 816
 817         talloc_steal(mem_ctx, user_session_key->data);
 818         talloc_steal(mem_ctx, lm_session_key->data);
 819
 820         return nt_status;
 821 }
 822
 823 /**
 824  * Next state function for the Authenticate packet
 825  * (after authentication - figures out the session keys etc)
 826  *
 827  * @param ntlmssp_state NTLMSSP State
 828  * @return Errors or NT_STATUS_OK.
 829  */
 830
 831 static NTSTATUS ntlmssp_server_postauth(struct gensec_security *gensec_security,
 832                                         struct gensec_ntlmssp_context *gensec_ntlmssp,
 833                                         struct ntlmssp_server_auth_state *state,
 834                                         DATA_BLOB request)
 835 {
 836         struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
 837         struct auth4_context *auth_context = gensec_security->auth_context;
 838         DATA_BLOB user_session_key = state->user_session_key;
 839         DATA_BLOB lm_session_key = state->lm_session_key;
 840         NTSTATUS nt_status = NT_STATUS_OK;
 841         DATA_BLOB session_key = data_blob(NULL, 0);
 842         struct auth_session_info *session_info = NULL;
 843
 844         TALLOC_FREE(state->user_info);
 845
 846         if (lpcfg_map_to_guest(gensec_security->settings->lp_ctx) != NEVER_MAP_TO_GUEST
 847             && auth_context->generate_session_info != NULL)
 848         {
 849                 NTSTATUS tmp_status;
 850
 851                 /*
 852                  * We need to check if the auth is anonymous or mapped to guest
 853                  */
 854                 tmp_status = auth_context->generate_session_info(auth_context, state,
 855                                                                  gensec_ntlmssp->server_returned_info,
 856                                                                  gensec_ntlmssp->ntlmssp_state->user,
 857                                                                  AUTH_SESSION_INFO_SIMPLE_PRIVILEGES,
 858                                                                  &session_info);
 859                 if (!NT_STATUS_IS_OK(tmp_status)) {
 860                         /*
 861                          * We don't care about failures,
 862                          * the worst result is that we try MIC checking
 863                          * for a map to guest authentication.
 864                          */
 865                         TALLOC_FREE(session_info);
 866                 }
 867         }
 868
 869         if (session_info != NULL) {
 870                 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
 871                         /*
 872                          * Anonymous and GUEST are not secure anyway.
 873                          * avoid new_spnego and MIC checking.
 874                          */
 875                         ntlmssp_state->new_spnego = false;
 876                         ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SIGN;
 877                         ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SEAL;
 878                 }
 879                 TALLOC_FREE(session_info);
 880         }
 881
 882         dump_data_pw("NT session key:\n", user_session_key.data, user_session_key.length);
 883         dump_data_pw("LM first-8:\n", lm_session_key.data, lm_session_key.length);
 884
 885         /* Handle the different session key derivation for NTLM2 */
 886         if (state->doing_ntlm2) {
 887                 if (user_session_key.data && user_session_key.length == 16) {
 888                         session_key = data_blob_talloc(ntlmssp_state,
 889                                                        NULL, 16);
 890                         hmac_md5(user_session_key.data, state->session_nonce,
 891                                  sizeof(state->session_nonce), session_key.data);
 892                         DEBUG(10,("ntlmssp_server_auth: Created NTLM2 session key.\n"));
 893                         dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
 894
 895                 } else {
 896                         DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM2 session key.\n"));
 897                         session_key = data_blob_null;
 898                 }
 899         } else if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
 900                 /* Ensure we can never get here on NTLMv2 */
 901                 && (ntlmssp_state->nt_resp.length == 0 || ntlmssp_state->nt_resp.length == 24)) {
 902
 903                 if (lm_session_key.data && lm_session_key.length >= 8) {
 904                         if (ntlmssp_state->lm_resp.data && ntlmssp_state->lm_resp.length == 24) {
 905                                 session_key = data_blob_talloc(ntlmssp_state,
 906                                                                NULL, 16);
 907                                 if (session_key.data == NULL) {
 908                                         return NT_STATUS_NO_MEMORY;
 909                                 }
 910                                 SMBsesskeygen_lm_sess_key(lm_session_key.data, ntlmssp_state->lm_resp.data,
 911                                                           session_key.data);
 912                                 DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
 913                         } else {
 914                                 static const uint8_t zeros[24] = {0, };
 915                                 session_key = data_blob_talloc(
 916                                         ntlmssp_state, NULL, 16);
 917                                 if (session_key.data == NULL) {
 918                                         return NT_STATUS_NO_MEMORY;
 919                                 }
 920                                 SMBsesskeygen_lm_sess_key(zeros, zeros,
 921                                                           session_key.data);
 922                                 DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
 923                         }
 924                         dump_data_pw("LM session key:\n", session_key.data,
 925                                      session_key.length);
 926                 } else {
 927                         /* LM Key not selected */
 928                         ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
 929
 930                         DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM session key.\n"));
 931                         session_key = data_blob_null;
 932                 }
 933
 934         } else if (user_session_key.data) {
 935                 session_key = user_session_key;
 936                 DEBUG(10,("ntlmssp_server_auth: Using unmodified nt session key.\n"));
 937                 dump_data_pw("unmodified session key:\n", session_key.data, session_key.length);
 938
 939                 /* LM Key not selected */
 940                 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
 941
 942         } else if (lm_session_key.data) {
 943                 /* Very weird to have LM key, but no user session key, but anyway.. */
 944                 session_key = lm_session_key;
 945                 DEBUG(10,("ntlmssp_server_auth: Using unmodified lm session key.\n"));
 946                 dump_data_pw("unmodified session key:\n", session_key.data, session_key.length);
 947
 948                 /* LM Key not selected */
 949                 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
 950
 951         } else {
 952                 DEBUG(10,("ntlmssp_server_auth: Failed to create unmodified session key.\n"));
 953                 session_key = data_blob_null;
 954
 955                 /* LM Key not selected */
 956                 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
 957         }
 958
 959         /* With KEY_EXCH, the client supplies the proposed session key,
 960            but encrypts it with the long-term key */
 961         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
 962                 if (!state->encrypted_session_key.data
 963                     || state->encrypted_session_key.length != 16) {
 964                         DEBUG(1, ("Client-supplied KEY_EXCH session key was of invalid length (%u)!\n",
 965                                   (unsigned)state->encrypted_session_key.length));
 966                         return NT_STATUS_INVALID_PARAMETER;
 967                 } else if (!session_key.data || session_key.length != 16) {
 968                         DEBUG(5, ("server session key is invalid (len == %u), cannot do KEY_EXCH!\n",
 969                                   (unsigned int)session_key.length));
 970                         ntlmssp_state->session_key = session_key;
 971                         talloc_steal(ntlmssp_state, session_key.data);
 972                 } else {
 973                         dump_data_pw("KEY_EXCH session key (enc):\n",
 974                                      state->encrypted_session_key.data,
 975                                      state->encrypted_session_key.length);
 976                         arcfour_crypt(state->encrypted_session_key.data,
 977                                       session_key.data,
 978                                       state->encrypted_session_key.length);
 979                         ntlmssp_state->session_key = data_blob_talloc(ntlmssp_state,
 980                                                                       state->encrypted_session_key.data,
 981                                                                       state->encrypted_session_key.length);
 982                         dump_data_pw("KEY_EXCH session key:\n",
 983                                      state->encrypted_session_key.data,
 984                                      state->encrypted_session_key.length);
 985                 }
 986         } else {
 987                 ntlmssp_state->session_key = session_key;
 988                 talloc_steal(ntlmssp_state, session_key.data);
 989         }
 990
 991         if (ntlmssp_state->new_spnego) {
 992                 HMACMD5Context ctx;
 993                 uint8_t mic_buffer[NTLMSSP_MIC_SIZE] = { 0, };
 994                 int cmp;
 995
 996                 hmac_md5_init_limK_to_64(ntlmssp_state->session_key.data,
 997                                          ntlmssp_state->session_key.length,
 998                                          &ctx);
 999
1000                 hmac_md5_update(ntlmssp_state->negotiate_blob.data,
1001                                 ntlmssp_state->negotiate_blob.length,
1002                                 &ctx);
1003                 hmac_md5_update(ntlmssp_state->challenge_blob.data,
1004                                 ntlmssp_state->challenge_blob.length,
1005                                 &ctx);
1006
1007                 /* checked were we set ntlmssp_state->new_spnego */
1008                 SMB_ASSERT(request.length >
1009                            (NTLMSSP_MIC_OFFSET + NTLMSSP_MIC_SIZE));
1010
1011                 hmac_md5_update(request.data, NTLMSSP_MIC_OFFSET, &ctx);
1012                 hmac_md5_update(mic_buffer, NTLMSSP_MIC_SIZE, &ctx);
1013                 hmac_md5_update(request.data +
1014                                 (NTLMSSP_MIC_OFFSET + NTLMSSP_MIC_SIZE),
1015                                 request.length -
1016                                 (NTLMSSP_MIC_OFFSET + NTLMSSP_MIC_SIZE),
1017                                 &ctx);
1018                 hmac_md5_final(mic_buffer, &ctx);
1019
1020                 cmp = memcmp(request.data + NTLMSSP_MIC_OFFSET,
1021                              mic_buffer, NTLMSSP_MIC_SIZE);
1022                 if (cmp != 0) {
1023                         DEBUG(1,("%s: invalid NTLMSSP_MIC for "
1024                                  "user=[%s] domain=[%s] workstation=[%s]\n",
1025                                  __func__,
1026                                  ntlmssp_state->user,
1027                                  ntlmssp_state->domain,
1028                                  ntlmssp_state->client.netbios_name));
1029                         dump_data(1, request.data + NTLMSSP_MIC_OFFSET,
1030                                   NTLMSSP_MIC_SIZE);
1031                         dump_data(1, mic_buffer,
1032                                   NTLMSSP_MIC_SIZE);
1033                         return NT_STATUS_INVALID_PARAMETER;
1034                 }
1035         }
1036
1037         data_blob_free(&ntlmssp_state->negotiate_blob);
1038         data_blob_free(&ntlmssp_state->challenge_blob);
1039
1040         if (gensec_ntlmssp_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
1041                 nt_status = ntlmssp_sign_init(ntlmssp_state);
1042         }
1043
1044         data_blob_clear_free(&ntlmssp_state->internal_chal);
1045         data_blob_clear_free(&ntlmssp_state->chal);
1046         data_blob_clear_free(&ntlmssp_state->lm_resp);
1047         data_blob_clear_free(&ntlmssp_state->nt_resp);
1048
1049         ntlmssp_state->expected_state = NTLMSSP_DONE;
1050
1051         return nt_status;
1052 }
1053
1054 NTSTATUS ntlmssp_server_auth_recv(struct tevent_req *req,
1055                                   TALLOC_CTX *out_mem_ctx,
1056                                   DATA_BLOB *out)
1057 {
1058         NTSTATUS status;
1059
1060         *out = data_blob_null;
1061
1062         if (tevent_req_is_nterror(req, &status)) {
1063                 tevent_req_received(req);
1064                 return status;
1065         }
1066
1067         tevent_req_received(req);
1068         return NT_STATUS_OK;
1069 }