source4/auth/ntlmssp/ntlmssp_client.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle NLTMSSP, client server side parsing
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2005
   8    Copyright (C) Stefan Metzmacher 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 struct auth_session_info;
  25
  26 #include "includes.h"
  27 #include "auth/ntlmssp/ntlmssp.h"
  28 #include "source4/auth/ntlmssp/proto.h"
  29 #include "../lib/crypto/crypto.h"
  30 #include "../libcli/auth/libcli_auth.h"
  31 #include "auth/credentials/credentials.h"
  32 #include "auth/gensec/gensec.h"
  33 #include "param/param.h"
  34 #include "auth/ntlmssp/ntlmssp_private.h"
  35
  36 /*********************************************************************
  37  Client side NTLMSSP
  38 *********************************************************************/
  39
  40 /**
  41  * Next state function for the Initial packet
  42  *
  43  * @param ntlmssp_state NTLMSSP State
  44  * @param out_mem_ctx The DATA_BLOB *out will be allocated on this context
  45  * @param in A NULL data blob (input ignored)
  46  * @param out The initial negotiate request to the server, as an talloc()ed DATA_BLOB, on out_mem_ctx
  47  * @return Errors or NT_STATUS_OK.
  48  */
  49
  50 NTSTATUS ntlmssp_client_initial(struct gensec_security *gensec_security,
  51                                 TALLOC_CTX *out_mem_ctx,
  52                                 DATA_BLOB in, DATA_BLOB *out)
  53 {
  54         struct gensec_ntlmssp_context *gensec_ntlmssp =
  55                 talloc_get_type_abort(gensec_security->private_data,
  56                                       struct gensec_ntlmssp_context);
  57         struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
  58         const char *domain = ntlmssp_state->domain;
  59         const char *workstation = cli_credentials_get_workstation(gensec_security->credentials);
  60         NTSTATUS status;
  61
  62         /* These don't really matter in the initial packet, so don't panic if they are not set */
  63         if (!domain) {
  64                 domain = "";
  65         }
  66
  67         if (!workstation) {
  68                 workstation = "";
  69         }
  70
  71         if (ntlmssp_state->unicode) {
  72                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
  73         } else {
  74                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
  75         }
  76
  77         if (ntlmssp_state->use_ntlmv2) {
  78                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
  79         }
  80
  81         /* generate the ntlmssp negotiate packet */
  82         status = msrpc_gen(out_mem_ctx,
  83                   out, "CddAA",
  84                   "NTLMSSP",
  85                   NTLMSSP_NEGOTIATE,
  86                   ntlmssp_state->neg_flags,
  87                   domain,
  88                   workstation);
  89
  90         if (!NT_STATUS_IS_OK(status)) {
  91                 return status;
  92         }
  93
  94         ntlmssp_state->expected_state = NTLMSSP_CHALLENGE;
  95
  96         return NT_STATUS_MORE_PROCESSING_REQUIRED;
  97 }
  98
  99 /**
 100  * Next state function for the Challenge Packet.  Generate an auth packet.
 101  *
 102  * @param gensec_security GENSEC state
 103  * @param out_mem_ctx Memory context for *out
 104  * @param in The server challnege, as a DATA_BLOB.  reply.data must be NULL
 105  * @param out The next request (auth packet) to the server, as an allocated DATA_BLOB, on the out_mem_ctx context
 106  * @return Errors or NT_STATUS_OK.
 107  */
 108
 109 NTSTATUS ntlmssp_client_challenge(struct gensec_security *gensec_security,
 110                                   TALLOC_CTX *out_mem_ctx,
 111                                   const DATA_BLOB in, DATA_BLOB *out)
 112 {
 113         struct gensec_ntlmssp_context *gensec_ntlmssp =
 114                 talloc_get_type_abort(gensec_security->private_data,
 115                                       struct gensec_ntlmssp_context);
 116         struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
 117         uint32_t chal_flags, ntlmssp_command, unkn1, unkn2;
 118         DATA_BLOB server_domain_blob;
 119         DATA_BLOB challenge_blob;
 120         DATA_BLOB target_info = data_blob(NULL, 0);
 121         char *server_domain;
 122         const char *chal_parse_string;
 123         const char *auth_gen_string;
 124         DATA_BLOB lm_response = data_blob(NULL, 0);
 125         DATA_BLOB nt_response = data_blob(NULL, 0);
 126         DATA_BLOB session_key = data_blob(NULL, 0);
 127         DATA_BLOB lm_session_key = data_blob(NULL, 0);
 128         DATA_BLOB encrypted_session_key = data_blob(NULL, 0);
 129         NTSTATUS nt_status;
 130         int flags = 0;
 131         const char *user, *domain;
 132
 133         TALLOC_CTX *mem_ctx = talloc_new(out_mem_ctx);
 134         if (!mem_ctx) {
 135                 return NT_STATUS_NO_MEMORY;
 136         }
 137
 138         if (!msrpc_parse(mem_ctx,
 139                          &in, "CdBd",
 140                          "NTLMSSP",
 141                          &ntlmssp_command,
 142                          &server_domain_blob,
 143                          &chal_flags)) {
 144                 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
 145                 dump_data(2, in.data, in.length);
 146                 talloc_free(mem_ctx);
 147
 148                 return NT_STATUS_INVALID_PARAMETER;
 149         }
 150
 151         data_blob_free(&server_domain_blob);
 152
 153         DEBUG(3, ("Got challenge flags:\n"));
 154         debug_ntlmssp_flags(chal_flags);
 155
 156         ntlmssp_handle_neg_flags(ntlmssp_state, chal_flags, ntlmssp_state->allow_lm_key);
 157
 158         if (ntlmssp_state->unicode) {
 159                 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
 160                         chal_parse_string = "CdUdbddB";
 161                 } else {
 162                         chal_parse_string = "CdUdbdd";
 163                 }
 164                 auth_gen_string = "CdBBUUUBd";
 165         } else {
 166                 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
 167                         chal_parse_string = "CdAdbddB";
 168                 } else {
 169                         chal_parse_string = "CdAdbdd";
 170                 }
 171
 172                 auth_gen_string = "CdBBAAABd";
 173         }
 174
 175         if (!msrpc_parse(mem_ctx,
 176                          &in, chal_parse_string,
 177                          "NTLMSSP",
 178                          &ntlmssp_command,
 179                          &server_domain,
 180                          &chal_flags,
 181                          &challenge_blob, 8,
 182                          &unkn1, &unkn2,
 183                          &target_info)) {
 184                 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
 185                 dump_data(2, in.data, in.length);
 186                 talloc_free(mem_ctx);
 187                 return NT_STATUS_INVALID_PARAMETER;
 188         }
 189
 190         if (chal_flags & NTLMSSP_TARGET_TYPE_SERVER) {
 191                 ntlmssp_state->server.is_standalone = true;
 192         } else {
 193                 ntlmssp_state->server.is_standalone = false;
 194         }
 195         /* TODO: parse struct_blob and fill in the rest */
 196         ntlmssp_state->server.netbios_name = "";
 197         ntlmssp_state->server.netbios_domain = server_domain;
 198         ntlmssp_state->server.dns_name = "";
 199         ntlmssp_state->server.dns_domain = "";
 200
 201         if (challenge_blob.length != 8) {
 202                 talloc_free(mem_ctx);
 203                 return NT_STATUS_INVALID_PARAMETER;
 204         }
 205
 206         cli_credentials_get_ntlm_username_domain(gensec_security->credentials, mem_ctx,
 207                                                  &user, &domain);
 208
 209         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 210                 flags |= CLI_CRED_NTLM2;
 211         }
 212         if (ntlmssp_state->use_ntlmv2) {
 213                 flags |= CLI_CRED_NTLMv2_AUTH;
 214         }
 215         if (ntlmssp_state->use_nt_response) {
 216                 flags |= CLI_CRED_NTLM_AUTH;
 217         }
 218         if (lpcfg_client_lanman_auth(gensec_security->settings->lp_ctx)) {
 219                 flags |= CLI_CRED_LANMAN_AUTH;
 220         }
 221
 222         nt_status = cli_credentials_get_ntlm_response(gensec_security->credentials, mem_ctx,
 223                                                       &flags, challenge_blob, target_info,
 224                                                       &lm_response, &nt_response,
 225                                                       &lm_session_key, &session_key);
 226
 227         if (!NT_STATUS_IS_OK(nt_status)) {
 228                 return nt_status;
 229         }
 230
 231         if (!(flags & CLI_CRED_LANMAN_AUTH)) {
 232                 /* LM Key is still possible, just silly, so we do not
 233                  * allow it. Fortunetly all LM crypto is off by
 234                  * default and we require command line options to end
 235                  * up here */
 236                 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
 237         }
 238
 239         if (!(flags & CLI_CRED_NTLM2)) {
 240                 /* NTLM2 is incompatible... */
 241                 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
 242         }
 243
 244         if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
 245             && lpcfg_client_lanman_auth(gensec_security->settings->lp_ctx) && lm_session_key.length == 16) {
 246                 DATA_BLOB new_session_key = data_blob_talloc(mem_ctx, NULL, 16);
 247                 if (lm_response.length == 24) {
 248                         SMBsesskeygen_lm_sess_key(lm_session_key.data, lm_response.data,
 249                                                   new_session_key.data);
 250                 } else {
 251                         static const uint8_t zeros[24];
 252                         SMBsesskeygen_lm_sess_key(lm_session_key.data, zeros,
 253                                                   new_session_key.data);
 254                 }
 255                 session_key = new_session_key;
 256                 dump_data_pw("LM session key\n", session_key.data, session_key.length);
 257         }
 258
 259
 260         /* Key exchange encryptes a new client-generated session key with
 261            the password-derived key */
 262         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
 263                 /* Make up a new session key */
 264                 uint8_t client_session_key[16];
 265                 generate_secret_buffer(client_session_key, sizeof(client_session_key));
 266
 267                 /* Encrypt the new session key with the old one */
 268                 encrypted_session_key = data_blob_talloc(ntlmssp_state,
 269                                                          client_session_key, sizeof(client_session_key));
 270                 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length);
 271                 arcfour_crypt(encrypted_session_key.data, session_key.data, encrypted_session_key.length);
 272                 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
 273
 274                 /* Mark the new session key as the 'real' session key */
 275                 session_key = data_blob_talloc(mem_ctx, client_session_key, sizeof(client_session_key));
 276         }
 277
 278         DEBUG(3, ("NTLMSSP: Set final flags:\n"));
 279         debug_ntlmssp_flags(ntlmssp_state->neg_flags);
 280
 281         /* this generates the actual auth packet */
 282         nt_status = msrpc_gen(mem_ctx,
 283                        out, auth_gen_string,
 284                        "NTLMSSP",
 285                        NTLMSSP_AUTH,
 286                        lm_response.data, lm_response.length,
 287                        nt_response.data, nt_response.length,
 288                        domain,
 289                        user,
 290                        cli_credentials_get_workstation(gensec_security->credentials),
 291                        encrypted_session_key.data, encrypted_session_key.length,
 292                        ntlmssp_state->neg_flags);
 293         if (!NT_STATUS_IS_OK(nt_status)) {
 294                 talloc_free(mem_ctx);
 295                 return nt_status;
 296         }
 297
 298         ntlmssp_state->session_key = session_key;
 299         talloc_steal(ntlmssp_state, session_key.data);
 300
 301         talloc_steal(out_mem_ctx, out->data);
 302
 303         ntlmssp_state->chal = challenge_blob;
 304         ntlmssp_state->lm_resp = lm_response;
 305         talloc_steal(ntlmssp_state->lm_resp.data, lm_response.data);
 306         ntlmssp_state->nt_resp = nt_response;
 307         talloc_steal(ntlmssp_state->nt_resp.data, nt_response.data);
 308
 309         ntlmssp_state->expected_state = NTLMSSP_DONE;
 310
 311         if (gensec_security->want_features & (GENSEC_FEATURE_SIGN|GENSEC_FEATURE_SEAL)) {
 312                 nt_status = ntlmssp_sign_init(ntlmssp_state);
 313                 if (!NT_STATUS_IS_OK(nt_status)) {
 314                         DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n",
 315                                   nt_errstr(nt_status)));
 316                         talloc_free(mem_ctx);
 317                         return nt_status;
 318                 }
 319         }
 320
 321         talloc_free(mem_ctx);
 322         return NT_STATUS_OK;
 323 }
 324
 325 NTSTATUS gensec_ntlmssp_client_start(struct gensec_security *gensec_security)
 326 {
 327         struct gensec_ntlmssp_context *gensec_ntlmssp;
 328         struct ntlmssp_state *ntlmssp_state;
 329         NTSTATUS nt_status;
 330
 331         nt_status = gensec_ntlmssp_start(gensec_security);
 332         NT_STATUS_NOT_OK_RETURN(nt_status);
 333
 334         gensec_ntlmssp =
 335                 talloc_get_type_abort(gensec_security->private_data,
 336                                       struct gensec_ntlmssp_context);
 337
 338         ntlmssp_state = talloc_zero(gensec_ntlmssp,
 339                                     struct ntlmssp_state);
 340         if (!ntlmssp_state) {
 341                 return NT_STATUS_NO_MEMORY;
 342         }
 343
 344         ntlmssp_state->callback_private = gensec_ntlmssp;
 345
 346         gensec_ntlmssp->ntlmssp_state = ntlmssp_state;
 347
 348         ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
 349
 350         ntlmssp_state->role = NTLMSSP_CLIENT;
 351
 352         ntlmssp_state->domain = lpcfg_workgroup(gensec_security->settings->lp_ctx);
 353
 354         ntlmssp_state->unicode = gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "unicode", true);
 355
 356         ntlmssp_state->use_nt_response = gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "send_nt_reponse", true);
 357
 358         ntlmssp_state->allow_lm_key = (lpcfg_client_lanman_auth(gensec_security->settings->lp_ctx)
 359                                               && (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "allow_lm_key", false)
 360                                                   || gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "lm_key", false)));
 361
 362         ntlmssp_state->use_ntlmv2 = lpcfg_client_ntlmv2_auth(gensec_security->settings->lp_ctx);
 363
 364         ntlmssp_state->expected_state = NTLMSSP_INITIAL;
 365
 366         ntlmssp_state->neg_flags =
 367                 NTLMSSP_NEGOTIATE_NTLM |
 368                 NTLMSSP_REQUEST_TARGET;
 369
 370         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "128bit", true)) {
 371                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_128;
 372         }
 373
 374         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "56bit", false)) {
 375                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_56;
 376         }
 377
 378         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "lm_key", false)) {
 379                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_LM_KEY;
 380         }
 381
 382         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "keyexchange", true)) {
 383                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_KEY_EXCH;
 384         }
 385
 386         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "alwayssign", true)) {
 387                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
 388         }
 389
 390         if (gensec_setting_bool(gensec_security->settings, "ntlmssp_client", "ntlm2", true)) {
 391                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
 392         } else {
 393                 /* apparently we can't do ntlmv2 if we don't do ntlm2 */
 394                 ntlmssp_state->use_ntlmv2 = false;
 395         }
 396
 397         if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
 398                 /*
 399                  * We need to set this to allow a later SetPassword
 400                  * via the SAMR pipe to succeed. Strange.... We could
 401                  * also add  NTLMSSP_NEGOTIATE_SEAL here. JRA.
 402                  *
 403                  * Without this, Windows will not create the master key
 404                  * that it thinks is only used for NTLMSSP signing and
 405                  * sealing.  (It is actually pulled out and used directly)
 406                  */
 407                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
 408         }
 409         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
 410                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
 411         }
 412         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
 413                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
 414                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
 415         }
 416
 417         return NT_STATUS_OK;
 418 }
 419