2 Unix SMB/CIFS implementation.
4 Winbind status program.
6 Copyright (C) Tim Potter 2000-2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
8 Copyright (C) Francesco Chemolli <kinkie@kame.usr.dsi.unimi.it> 2000
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "utils/ntlm_auth.h"
29 #define DBGC_CLASS DBGC_WINBIND
40 Authenticate a user with a challenge/response, checking session key
41 and valid authentication types
45 * Test the normal 'LM and NTLM' combination
48 static BOOL test_lm_ntlm_broken(enum ntlm_break break_which)
53 DATA_BLOB lm_response = data_blob(NULL, 24);
54 DATA_BLOB nt_response = data_blob(NULL, 24);
55 DATA_BLOB session_key = data_blob(NULL, 16);
58 uchar user_session_key[16];
61 DATA_BLOB chall = get_challenge();
65 ZERO_STRUCT(user_session_key);
67 flags |= WBFLAG_PAM_LMKEY;
68 flags |= WBFLAG_PAM_USER_SESSION_KEY;
70 SMBencrypt(opt_password,chall.data,lm_response.data);
71 E_deshash(opt_password, lm_hash);
73 SMBNTencrypt(opt_password,chall.data,nt_response.data);
75 E_md4hash(opt_password, nt_hash);
76 SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data);
78 switch (break_which) {
82 lm_response.data[0]++;
85 nt_response.data[0]++;
88 data_blob_free(&lm_response);
91 data_blob_free(&nt_response);
95 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
103 &error_string, NULL);
105 data_blob_free(&lm_response);
107 if (!NT_STATUS_IS_OK(nt_status)) {
108 d_printf("%s (0x%x)\n",
110 NT_STATUS_V(nt_status));
111 SAFE_FREE(error_string);
112 return break_which == BREAK_NT;
115 if (memcmp(lm_hash, lm_key,
116 sizeof(lm_key)) != 0) {
117 DEBUG(1, ("LM Key does not match expectations!\n"));
118 DEBUG(1, ("lm_key:\n"));
119 dump_data(1, lm_key, 8);
120 DEBUG(1, ("expected:\n"));
121 dump_data(1, lm_hash, 8);
125 if (break_which == NO_NT) {
126 if (memcmp(lm_hash, user_session_key,
128 DEBUG(1, ("NT Session Key does not match expectations (should be LM hash)!\n"));
129 DEBUG(1, ("user_session_key:\n"));
130 dump_data(1, user_session_key, sizeof(user_session_key));
131 DEBUG(1, ("expected:\n"));
132 dump_data(1, lm_hash, sizeof(lm_hash));
136 if (memcmp(session_key.data, user_session_key,
137 sizeof(user_session_key)) != 0) {
138 DEBUG(1, ("NT Session Key does not match expectations!\n"));
139 DEBUG(1, ("user_session_key:\n"));
140 dump_data(1, user_session_key, 16);
141 DEBUG(1, ("expected:\n"));
142 dump_data(1, session_key.data, session_key.length);
150 * Test LM authentication, no NT response supplied
153 static BOOL test_lm(void)
156 return test_lm_ntlm_broken(NO_NT);
160 * Test the NTLM response only, no LM.
163 static BOOL test_ntlm(void)
165 return test_lm_ntlm_broken(NO_LM);
169 * Test the NTLM response only, but in the LM field.
172 static BOOL test_ntlm_in_lm(void)
177 DATA_BLOB nt_response = data_blob(NULL, 24);
181 uchar user_session_key[16];
182 DATA_BLOB chall = get_challenge();
185 ZERO_STRUCT(user_session_key);
187 flags |= WBFLAG_PAM_LMKEY;
188 flags |= WBFLAG_PAM_USER_SESSION_KEY;
190 SMBNTencrypt(opt_password,chall.data,nt_response.data);
192 E_deshash(opt_password, lm_hash);
194 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
202 &error_string, NULL);
204 data_blob_free(&nt_response);
206 if (!NT_STATUS_IS_OK(nt_status)) {
207 d_printf("%s (0x%x)\n",
209 NT_STATUS_V(nt_status));
210 SAFE_FREE(error_string);
214 if (memcmp(lm_hash, lm_key,
215 sizeof(lm_key)) != 0) {
216 DEBUG(1, ("LM Key does not match expectations!\n"));
217 DEBUG(1, ("lm_key:\n"));
218 dump_data(1, lm_key, 8);
219 DEBUG(1, ("expected:\n"));
220 dump_data(1, lm_hash, 8);
223 if (memcmp(lm_hash, user_session_key, 8) != 0) {
224 DEBUG(1, ("Session Key (first 8 lm hash) does not match expectations!\n"));
225 DEBUG(1, ("user_session_key:\n"));
226 dump_data(1, user_session_key, 16);
227 DEBUG(1, ("expected:\n"));
228 dump_data(1, lm_hash, 8);
235 * Test the NTLM response only, but in the both the NT and LM fields.
238 static BOOL test_ntlm_in_both(void)
243 DATA_BLOB nt_response = data_blob(NULL, 24);
244 DATA_BLOB session_key = data_blob(NULL, 16);
248 uint8 user_session_key[16];
250 DATA_BLOB chall = get_challenge();
254 ZERO_STRUCT(user_session_key);
256 flags |= WBFLAG_PAM_LMKEY;
257 flags |= WBFLAG_PAM_USER_SESSION_KEY;
259 SMBNTencrypt(opt_password,chall.data,nt_response.data);
260 E_md4hash(opt_password, nt_hash);
261 SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data);
263 E_deshash(opt_password, lm_hash);
265 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
273 &error_string, NULL);
275 data_blob_free(&nt_response);
277 if (!NT_STATUS_IS_OK(nt_status)) {
278 d_printf("%s (0x%x)\n",
280 NT_STATUS_V(nt_status));
281 SAFE_FREE(error_string);
285 if (memcmp(lm_hash, lm_key,
286 sizeof(lm_key)) != 0) {
287 DEBUG(1, ("LM Key does not match expectations!\n"));
288 DEBUG(1, ("lm_key:\n"));
289 dump_data(1, lm_key, 8);
290 DEBUG(1, ("expected:\n"));
291 dump_data(1, lm_hash, 8);
294 if (memcmp(session_key.data, user_session_key,
295 sizeof(user_session_key)) != 0) {
296 DEBUG(1, ("NT Session Key does not match expectations!\n"));
297 DEBUG(1, ("user_session_key:\n"));
298 dump_data(1, user_session_key, 16);
299 DEBUG(1, ("expected:\n"));
300 dump_data(1, session_key.data, session_key.length);
309 * Test the NTLMv2 and LMv2 responses
312 static BOOL test_lmv2_ntlmv2_broken(enum ntlm_break break_which)
317 DATA_BLOB ntlmv2_response = data_blob(NULL, 0);
318 DATA_BLOB lmv2_response = data_blob(NULL, 0);
319 DATA_BLOB ntlmv2_session_key = data_blob(NULL, 0);
320 DATA_BLOB names_blob = NTLMv2_generate_names_blob(get_winbind_netbios_name(), get_winbind_domain());
322 uchar user_session_key[16];
323 DATA_BLOB chall = get_challenge();
326 ZERO_STRUCT(user_session_key);
328 flags |= WBFLAG_PAM_USER_SESSION_KEY;
330 if (!SMBNTLMv2encrypt(opt_username, opt_domain, opt_password, &chall,
332 &lmv2_response, &ntlmv2_response,
333 &ntlmv2_session_key)) {
334 data_blob_free(&names_blob);
337 data_blob_free(&names_blob);
339 switch (break_which) {
343 lmv2_response.data[0]++;
346 ntlmv2_response.data[0]++;
349 data_blob_free(&lmv2_response);
352 data_blob_free(&ntlmv2_response);
356 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
364 &error_string, NULL);
366 data_blob_free(&lmv2_response);
367 data_blob_free(&ntlmv2_response);
369 if (!NT_STATUS_IS_OK(nt_status)) {
370 d_printf("%s (0x%x)\n",
372 NT_STATUS_V(nt_status));
373 SAFE_FREE(error_string);
374 return break_which == BREAK_NT;
377 if (break_which != NO_NT && break_which != BREAK_NT && memcmp(ntlmv2_session_key.data, user_session_key,
378 sizeof(user_session_key)) != 0) {
379 DEBUG(1, ("USER (NTLMv2) Session Key does not match expectations!\n"));
380 DEBUG(1, ("user_session_key:\n"));
381 dump_data(1, user_session_key, 16);
382 DEBUG(1, ("expected:\n"));
383 dump_data(1, ntlmv2_session_key.data, ntlmv2_session_key.length);
390 * Test the NTLMv2 and LMv2 responses
393 static BOOL test_lmv2_ntlmv2(void)
395 return test_lmv2_ntlmv2_broken(BREAK_NONE);
399 * Test the LMv2 response only
402 static BOOL test_lmv2(void)
404 return test_lmv2_ntlmv2_broken(NO_NT);
408 * Test the NTLMv2 response only
411 static BOOL test_ntlmv2(void)
413 return test_lmv2_ntlmv2_broken(NO_LM);
416 static BOOL test_lm_ntlm(void)
418 return test_lm_ntlm_broken(BREAK_NONE);
421 static BOOL test_ntlm_lm_broken(void)
423 return test_lm_ntlm_broken(BREAK_LM);
426 static BOOL test_ntlm_ntlm_broken(void)
428 return test_lm_ntlm_broken(BREAK_NT);
431 static BOOL test_ntlmv2_lmv2_broken(void)
433 return test_lmv2_ntlmv2_broken(BREAK_LM);
436 static BOOL test_ntlmv2_ntlmv2_broken(void)
438 return test_lmv2_ntlmv2_broken(BREAK_NT);
441 static BOOL test_plaintext(enum ntlm_break break_which)
445 DATA_BLOB nt_response = data_blob(NULL, 0);
446 DATA_BLOB lm_response = data_blob(NULL, 0);
448 smb_ucs2_t *nt_response_ucs2;
450 uchar user_session_key[16];
452 static const uchar zeros[8] = { 0, };
453 DATA_BLOB chall = data_blob(zeros, sizeof(zeros));
456 ZERO_STRUCT(user_session_key);
458 flags |= WBFLAG_PAM_LMKEY;
459 flags |= WBFLAG_PAM_USER_SESSION_KEY;
461 if ((push_ucs2_allocate(&nt_response_ucs2, opt_password)) == -1) {
462 DEBUG(0, ("push_ucs2_allocate failed!\n"));
466 nt_response.data = (unsigned char *)nt_response_ucs2;
467 nt_response.length = strlen_w(nt_response_ucs2)*sizeof(smb_ucs2_t);
469 if ((password = strdup_upper(opt_password)) == NULL) {
470 DEBUG(0, ("strdup_upper failed!\n"));
474 if ((convert_string_allocate(NULL, CH_UNIX,
477 &lm_response.data,True)) == -1) {
478 DEBUG(0, ("convert_string_allocate failed!\n"));
484 lm_response.length = strlen((const char *)lm_response.data);
486 switch (break_which) {
490 lm_response.data[0]++;
493 nt_response.data[0]++;
496 SAFE_FREE(lm_response.data);
497 lm_response.length = 0;
500 SAFE_FREE(nt_response.data);
501 nt_response.length = 0;
505 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
513 &error_string, NULL);
515 SAFE_FREE(nt_response.data);
516 SAFE_FREE(lm_response.data);
517 data_blob_free(&chall);
519 if (!NT_STATUS_IS_OK(nt_status)) {
520 d_printf("%s (0x%x)\n",
522 NT_STATUS_V(nt_status));
523 SAFE_FREE(error_string);
524 return break_which == BREAK_NT;
527 return break_which != BREAK_NT;
530 static BOOL test_plaintext_none_broken(void) {
531 return test_plaintext(BREAK_NONE);
534 static BOOL test_plaintext_lm_broken(void) {
535 return test_plaintext(BREAK_LM);
538 static BOOL test_plaintext_nt_broken(void) {
539 return test_plaintext(BREAK_NT);
542 static BOOL test_plaintext_nt_only(void) {
543 return test_plaintext(NO_LM);
546 static BOOL test_plaintext_lm_only(void) {
547 return test_plaintext(NO_NT);
561 - plaintext tests (in challenge-response feilds)
563 check we get the correct session key in each case
564 check what values we get for the LM session key
568 static const struct ntlm_tests {
573 {test_lm_ntlm, "LM and NTLM"},
575 {test_ntlm_in_lm, "NTLM in LM"},
576 {test_ntlm_in_both, "NTLM in both"},
577 {test_ntlmv2, "NTLMv2"},
578 {test_lmv2_ntlmv2, "NTLMv2 and LMv2"},
580 {test_ntlmv2_lmv2_broken, "NTLMv2 and LMv2, LMv2 broken"},
581 {test_ntlmv2_ntlmv2_broken, "NTLMv2 and LMv2, NTLMv2 broken"},
582 {test_ntlm_lm_broken, "NTLM and LM, LM broken"},
583 {test_ntlm_ntlm_broken, "NTLM and LM, NTLM broken"},
584 {test_plaintext_none_broken, "Plaintext"},
585 {test_plaintext_lm_broken, "Plaintext LM broken"},
586 {test_plaintext_nt_broken, "Plaintext NT broken"},
587 {test_plaintext_nt_only, "Plaintext NT only"},
588 {test_plaintext_lm_only, "Plaintext LM only"},
592 BOOL diagnose_ntlm_auth(void)
597 for (i=0; test_table[i].fn; i++) {
598 if (!test_table[i].fn()) {
599 DEBUG(1, ("Test %s failed!\n", test_table[i].name));