source/auth/gensec/ntlmssp_sign.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Version 3.0
   4  *  NTLMSSP Signing routines
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-2001
   6  *  Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software Foundation,
  20  *  Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  21  */
  22
  23 #include "includes.h"
  24 #include "auth/auth.h"
  25 #include "lib/crypto/crypto.h"
  26
  27 #define CLI_SIGN "session key to client-to-server signing key magic constant"
  28 #define CLI_SEAL "session key to client-to-server sealing key magic constant"
  29 #define SRV_SIGN "session key to server-to-client signing key magic constant"
  30 #define SRV_SEAL "session key to server-to-client sealing key magic constant"
  31
  32 /**
  33  * Some notes on then NTLM2 code:
  34  *
  35  * This code works correctly for the sealing part of the problem.  If
  36  * we disable the check for valid client signatures, then we see that
  37  * the output of a rpcecho 'sinkdata' at smbd is correct.  We get the
  38  * valid data, and it is validly decrypted.
  39  *
  40  * This means that the quantity of data passing though the RC4 sealing
  41  * pad is correct.
  42  *
  43  * This code also correctly matches test values that I have obtained,
  44  * claiming to be the correct output of NTLM2 signature generation.
  45  *
  46  */
  47
  48 static void calc_ntlmv2_key(TALLOC_CTX *mem_ctx,
  49                             DATA_BLOB *subkey,
  50                             DATA_BLOB session_key,
  51                             const char *constant)
  52 {
  53         struct MD5Context ctx3;
  54         *subkey = data_blob_talloc(mem_ctx, NULL, 16);
  55         MD5Init(&ctx3);
  56         MD5Update(&ctx3, session_key.data, session_key.length);
  57         MD5Update(&ctx3, constant, strlen(constant)+1);
  58         MD5Final(subkey->data, &ctx3);
  59 }
  60
  61 enum ntlmssp_direction {
  62         NTLMSSP_SEND,
  63         NTLMSSP_RECEIVE
  64 };
  65
  66 static NTSTATUS ntlmssp_make_packet_signature(struct ntlmssp_state *ntlmssp_state,
  67                                               TALLOC_CTX *sig_mem_ctx,
  68                                               const uint8_t *data, size_t length,
  69                                               const uint8_t *whole_pdu, size_t pdu_length,
  70                                               enum ntlmssp_direction direction,
  71                                               DATA_BLOB *sig, BOOL encrypt_sig)
  72 {
  73         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
  74
  75                 HMACMD5Context ctx;
  76                 uint8_t digest[16];
  77                 uint8_t seq_num[4];
  78
  79                 *sig = data_blob_talloc(sig_mem_ctx, NULL, NTLMSSP_SIG_SIZE);
  80                 if (!sig->data) {
  81                         return NT_STATUS_NO_MEMORY;
  82                 }
  83
  84                 switch (direction) {
  85                 case NTLMSSP_SEND:
  86                         SIVAL(seq_num, 0, ntlmssp_state->ntlm2_send_seq_num);
  87                         ntlmssp_state->ntlm2_send_seq_num++;
  88                         hmac_md5_init_limK_to_64(ntlmssp_state->send_sign_key.data,
  89                                                  ntlmssp_state->send_sign_key.length, &ctx);
  90                         break;
  91                 case NTLMSSP_RECEIVE:
  92                         SIVAL(seq_num, 0, ntlmssp_state->ntlm2_recv_seq_num);
  93                         ntlmssp_state->ntlm2_recv_seq_num++;
  94                         hmac_md5_init_limK_to_64(ntlmssp_state->recv_sign_key.data,
  95                                                  ntlmssp_state->recv_sign_key.length, &ctx);
  96                         break;
  97                 }
  98                 hmac_md5_update(seq_num, sizeof(seq_num), &ctx);
  99                 hmac_md5_update(whole_pdu, pdu_length, &ctx);
 100                 hmac_md5_final(digest, &ctx);
 101
 102                 if (encrypt_sig && ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
 103                         switch (direction) {
 104                         case NTLMSSP_SEND:
 105                                 arcfour_crypt_sbox(ntlmssp_state->send_seal_hash, digest, 8);
 106                                 break;
 107                         case NTLMSSP_RECEIVE:
 108                                 arcfour_crypt_sbox(ntlmssp_state->recv_seal_hash, digest, 8);
 109                                 break;
 110                         }
 111                 }
 112
 113                 SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION);
 114                 memcpy(sig->data + 4, digest, 8);
 115                 memcpy(sig->data + 12, seq_num, 4);
 116
 117         } else {
 118                 uint32_t crc;
 119                 crc = crc32_calc_buffer(data, length);
 120                 if (!msrpc_gen(sig_mem_ctx, sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlm_seq_num)) {
 121                         return NT_STATUS_NO_MEMORY;
 122                 }
 123                 ntlmssp_state->ntlm_seq_num++;
 124
 125                 arcfour_crypt_sbox(ntlmssp_state->ntlmssp_hash, sig->data+4, sig->length-4);
 126         }
 127         dump_data_pw("calculated ntlmssp signature\n", sig->data, sig->length);
 128         return NT_STATUS_OK;
 129 }
 130
 131 NTSTATUS ntlmssp_sign_packet(struct ntlmssp_state *ntlmssp_state,
 132                              TALLOC_CTX *sig_mem_ctx,
 133                              const uint8_t *data, size_t length,
 134                              const uint8_t *whole_pdu, size_t pdu_length,
 135                              DATA_BLOB *sig)
 136 {
 137         if (!ntlmssp_state->session_key.length) {
 138                 DEBUG(3, ("NO session key, cannot check sign packet\n"));
 139                 return NT_STATUS_NO_USER_SESSION_KEY;
 140         }
 141
 142         if (!ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
 143                 DEBUG(3, ("NTLMSSP Signing not negotiated - cannot sign packet!\n"));
 144                 return NT_STATUS_INVALID_PARAMETER;
 145         }
 146
 147         return ntlmssp_make_packet_signature(ntlmssp_state, sig_mem_ctx,
 148                                              data, length,
 149                                              whole_pdu, pdu_length,
 150                                              NTLMSSP_SEND, sig, True);
 151 }
 152
 153 /**
 154  * Check the signature of an incoming packet
 155  *
 156  */
 157
 158 NTSTATUS ntlmssp_check_packet(struct ntlmssp_state *ntlmssp_state,
 159                               TALLOC_CTX *sig_mem_ctx,
 160                               const uint8_t *data, size_t length,
 161                               const uint8_t *whole_pdu, size_t pdu_length,
 162                               const DATA_BLOB *sig)
 163 {
 164         DATA_BLOB local_sig;
 165         NTSTATUS nt_status;
 166
 167         if (!ntlmssp_state->session_key.length) {
 168                 DEBUG(3, ("NO session key, cannot check packet signature\n"));
 169                 return NT_STATUS_NO_USER_SESSION_KEY;
 170         }
 171
 172         if (sig->length < 8) {
 173                 DEBUG(0, ("NTLMSSP packet check failed due to short signature (%lu bytes)!\n",
 174                           (unsigned long)sig->length));
 175         }
 176
 177         nt_status = ntlmssp_make_packet_signature(ntlmssp_state, sig_mem_ctx,
 178                                                   data, length,
 179                                                   whole_pdu, pdu_length,
 180                                                   NTLMSSP_RECEIVE, &local_sig, True);
 181
 182         if (!NT_STATUS_IS_OK(nt_status)) {
 183                 DEBUG(0, ("NTLMSSP packet check failed with %s\n", nt_errstr(nt_status)));
 184                 return nt_status;
 185         }
 186
 187         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 188                 if (local_sig.length != sig->length ||
 189                     memcmp(local_sig.data,
 190                            sig->data, sig->length) != 0) {
 191                         DEBUG(5, ("BAD SIG NTLM2: wanted signature of\n"));
 192                         dump_data(5, local_sig.data, local_sig.length);
 193
 194                         DEBUG(5, ("BAD SIG: got signature of\n"));
 195                         dump_data(5, sig->data, sig->length);
 196
 197                         DEBUG(0, ("NTLMSSP NTLM2 packet check failed due to invalid signature!\n"));
 198                         return NT_STATUS_ACCESS_DENIED;
 199                 }
 200         } else {
 201                 if (local_sig.length != sig->length ||
 202                     memcmp(local_sig.data + 8,
 203                            sig->data + 8, sig->length - 8) != 0) {
 204                         DEBUG(5, ("BAD SIG NTLM1: wanted signature of\n"));
 205                         dump_data(5, local_sig.data, local_sig.length);
 206
 207                         DEBUG(5, ("BAD SIG: got signature of\n"));
 208                         dump_data(5, sig->data, sig->length);
 209
 210                         DEBUG(0, ("NTLMSSP NTLM1 packet check failed due to invalid signature!\n"));
 211                         return NT_STATUS_ACCESS_DENIED;
 212                 }
 213         }
 214         dump_data_pw("checked ntlmssp signature\n", sig->data, sig->length);
 215
 216         return NT_STATUS_OK;
 217 }
 218
 219
 220 /**
 221  * Seal data with the NTLMSSP algorithm
 222  *
 223  */
 224
 225 NTSTATUS ntlmssp_seal_packet(struct ntlmssp_state *ntlmssp_state,
 226                              TALLOC_CTX *sig_mem_ctx,
 227                              uint8_t *data, size_t length,
 228                              const uint8_t *whole_pdu, size_t pdu_length,
 229                              DATA_BLOB *sig)
 230 {
 231         NTSTATUS nt_status;
 232         if (!ntlmssp_state->session_key.length) {
 233                 DEBUG(3, ("NO session key, cannot seal packet\n"));
 234                 return NT_STATUS_NO_USER_SESSION_KEY;
 235         }
 236
 237         if (!ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
 238                 DEBUG(3, ("NTLMSSP Sealing not negotiated - cannot seal packet!\n"));
 239                 return NT_STATUS_INVALID_PARAMETER;
 240         }
 241
 242         DEBUG(10,("ntlmssp_seal_data: seal\n"));
 243         dump_data_pw("ntlmssp clear data\n", data, length);
 244         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 245                 /* The order of these two operations matters - we must first seal the packet,
 246                    then seal the sequence number - this is becouse the send_seal_hash is not
 247                    constant, but is is rather updated with each iteration */
 248                 nt_status = ntlmssp_make_packet_signature(ntlmssp_state, sig_mem_ctx,
 249                                                           data, length,
 250                                                           whole_pdu, pdu_length,
 251                                                           NTLMSSP_SEND, sig, False);
 252                 arcfour_crypt_sbox(ntlmssp_state->send_seal_hash, data, length);
 253                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
 254                         arcfour_crypt_sbox(ntlmssp_state->send_seal_hash, sig->data+4, 8);
 255                 }
 256         } else {
 257                 uint32_t crc;
 258                 crc = crc32_calc_buffer(data, length);
 259                 if (!msrpc_gen(sig_mem_ctx, sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlm_seq_num)) {
 260                         return NT_STATUS_NO_MEMORY;
 261                 }
 262
 263                 /* The order of these two operations matters - we must
 264                    first seal the packet, then seal the sequence
 265                    number - this is becouse the ntlmssp_hash is not
 266                    constant, but is is rather updated with each
 267                    iteration */
 268
 269                 arcfour_crypt_sbox(ntlmssp_state->ntlmssp_hash, data, length);
 270                 arcfour_crypt_sbox(ntlmssp_state->ntlmssp_hash, sig->data+4, sig->length-4);
 271                 /* increment counter on send */
 272                 ntlmssp_state->ntlm_seq_num++;
 273                 nt_status = NT_STATUS_OK;
 274         }
 275         dump_data_pw("ntlmssp signature\n", sig->data, sig->length);
 276         dump_data_pw("ntlmssp sealed data\n", data, length);
 277
 278
 279         return nt_status;
 280 }
 281
 282 /**
 283  * Unseal data with the NTLMSSP algorithm
 284  *
 285  */
 286
 287 NTSTATUS ntlmssp_unseal_packet(struct ntlmssp_state *ntlmssp_state,
 288                                TALLOC_CTX *sig_mem_ctx,
 289                                uint8_t *data, size_t length,
 290                                const uint8_t *whole_pdu, size_t pdu_length,
 291                                DATA_BLOB *sig)
 292 {
 293         DATA_BLOB local_sig;
 294         NTSTATUS nt_status;
 295         if (!ntlmssp_state->session_key.length) {
 296                 DEBUG(3, ("NO session key, cannot unseal packet\n"));
 297                 return NT_STATUS_NO_USER_SESSION_KEY;
 298         }
 299
 300         dump_data_pw("ntlmssp sealed data\n", data, length);
 301         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 302                 arcfour_crypt_sbox(ntlmssp_state->recv_seal_hash, data, length);
 303
 304                 nt_status = ntlmssp_make_packet_signature(ntlmssp_state, sig_mem_ctx,
 305                                                           data, length,
 306                                                           whole_pdu, pdu_length,
 307                                                           NTLMSSP_RECEIVE, &local_sig, True);
 308                 if (!NT_STATUS_IS_OK(nt_status)) {
 309                         return nt_status;
 310                 }
 311
 312                 if (local_sig.length != sig->length ||
 313                     memcmp(local_sig.data,
 314                            sig->data, sig->length) != 0) {
 315                         DEBUG(5, ("BAD SIG NTLM2: wanted signature of\n"));
 316                         dump_data(5, local_sig.data, local_sig.length);
 317
 318                         DEBUG(5, ("BAD SIG: got signature of\n"));
 319                         dump_data(5, sig->data, sig->length);
 320
 321                         DEBUG(0, ("NTLMSSP NTLM2 packet check failed due to invalid signature!\n"));
 322                         return NT_STATUS_ACCESS_DENIED;
 323                 }
 324
 325                 dump_data_pw("ntlmssp clear data\n", data, length);
 326                 return NT_STATUS_OK;
 327         } else {
 328                 arcfour_crypt_sbox(ntlmssp_state->ntlmssp_hash, data, length);
 329                 dump_data_pw("ntlmssp clear data\n", data, length);
 330                 return ntlmssp_check_packet(ntlmssp_state, sig_mem_ctx, data, length, whole_pdu, pdu_length, sig);
 331         }
 332 }
 333
 334 /**
 335    Initialise the state for NTLMSSP signing.
 336 */
 337 NTSTATUS ntlmssp_sign_init(struct ntlmssp_state *ntlmssp_state)
 338 {
 339         uint8_t p24[24];
 340         ZERO_STRUCT(p24);
 341
 342         DEBUG(3, ("NTLMSSP Sign/Seal - Initialising with flags:\n"));
 343         debug_ntlmssp_flags(ntlmssp_state->neg_flags);
 344
 345         if (!ntlmssp_state->session_key.length) {
 346                 DEBUG(3, ("NO session key, cannot intialise signing\n"));
 347                 return NT_STATUS_NO_USER_SESSION_KEY;
 348         }
 349
 350         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2)
 351         {
 352                 DATA_BLOB weak_session_key = ntlmssp_state->session_key;
 353                 const char *send_sign_const;
 354                 const char *send_seal_const;
 355                 const char *recv_sign_const;
 356                 const char *recv_seal_const;
 357
 358                 switch (ntlmssp_state->role) {
 359                 case NTLMSSP_CLIENT:
 360                         send_sign_const = CLI_SIGN;
 361                         send_seal_const = CLI_SEAL;
 362                         recv_sign_const = SRV_SIGN;
 363                         recv_seal_const = SRV_SEAL;
 364                         break;
 365                 case NTLMSSP_SERVER:
 366                         send_sign_const = SRV_SIGN;
 367                         send_seal_const = SRV_SEAL;
 368                         recv_sign_const = CLI_SIGN;
 369                         recv_seal_const = CLI_SEAL;
 370                         break;
 371                 default:
 372                         return NT_STATUS_INTERNAL_ERROR;
 373                 }
 374
 375                 /**
 376                    Weaken NTLMSSP keys to cope with down-level clients, servers and export restrictions.
 377
 378                    We probably should have some parameters to control this, once we get NTLM2 working.
 379                 */
 380
 381
 382                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
 383
 384                 } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
 385                         weak_session_key.length = 6;
 386                 } else { /* forty bits */
 387                         weak_session_key.length = 5;
 388                 }
 389                 dump_data_pw("NTLMSSP weakend master key:\n",
 390                              weak_session_key.data,
 391                              weak_session_key.length);
 392
 393                 /* SEND */
 394                 calc_ntlmv2_key(ntlmssp_state,
 395                                 &ntlmssp_state->send_sign_key,
 396                                 ntlmssp_state->session_key, send_sign_const);
 397                 dump_data_pw("NTLMSSP send sign key:\n",
 398                              ntlmssp_state->send_sign_key.data,
 399                              ntlmssp_state->send_sign_key.length);
 400
 401                 calc_ntlmv2_key(ntlmssp_state,
 402                                 &ntlmssp_state->send_seal_key,
 403                                 weak_session_key, send_seal_const);
 404                 dump_data_pw("NTLMSSP send seal key:\n",
 405                              ntlmssp_state->send_seal_key.data,
 406                              ntlmssp_state->send_seal_key.length);
 407
 408                 arcfour_init(ntlmssp_state->send_seal_hash,
 409                              &ntlmssp_state->send_seal_key);
 410
 411                 dump_data_pw("NTLMSSP send sesl hash:\n",
 412                              ntlmssp_state->send_seal_hash,
 413                              sizeof(ntlmssp_state->send_seal_hash));
 414
 415                 /* RECV */
 416                 calc_ntlmv2_key(ntlmssp_state,
 417                                 &ntlmssp_state->recv_sign_key,
 418                                 ntlmssp_state->session_key, recv_sign_const);
 419                 dump_data_pw("NTLMSSP recv sign key:\n",
 420                              ntlmssp_state->recv_sign_key.data,
 421                              ntlmssp_state->recv_sign_key.length);
 422
 423                 calc_ntlmv2_key(ntlmssp_state,
 424                                 &ntlmssp_state->recv_seal_key,
 425                                 weak_session_key, recv_seal_const);
 426                 dump_data_pw("NTLMSSP recv seal key:\n",
 427                              ntlmssp_state->recv_seal_key.data,
 428                              ntlmssp_state->recv_seal_key.length);
 429                 arcfour_init(ntlmssp_state->recv_seal_hash,
 430                              &ntlmssp_state->recv_seal_key);
 431
 432                 dump_data_pw("NTLMSSP receive seal hash:\n",
 433                              ntlmssp_state->recv_seal_hash,
 434                              sizeof(ntlmssp_state->recv_seal_hash));
 435         } else {
 436                 DEBUG(5, ("NTLMSSP Sign/Seal - using NTLM1\n"));
 437
 438                 arcfour_init(ntlmssp_state->ntlmssp_hash,
 439                              &ntlmssp_state->session_key);
 440                 dump_data_pw("NTLMSSP hash:\n", ntlmssp_state->ntlmssp_hash,
 441                              sizeof(ntlmssp_state->ntlmssp_hash));
 442         }
 443
 444         ntlmssp_state->ntlm_seq_num = 0;
 445         ntlmssp_state->ntlm2_send_seq_num = 0;
 446         ntlmssp_state->ntlm2_recv_seq_num = 0;
 447
 448         return NT_STATUS_OK;
 449 }