2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "../libcli/auth/ntlmssp.h"
26 #include "ntlmssp_wrap.h"
27 #include "../librpc/gen_ndr/netlogon.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "auth/gensec/gensec.h"
31 NTSTATUS auth_ntlmssp_steal_session_info(TALLOC_CTX *mem_ctx,
32 struct auth_ntlmssp_state *auth_ntlmssp_state,
33 struct auth_session_info **session_info)
36 if (auth_ntlmssp_state->gensec_security) {
38 nt_status = gensec_session_info(auth_ntlmssp_state->gensec_security,
44 nt_status = create_local_token(mem_ctx,
45 auth_ntlmssp_state->server_info,
46 &auth_ntlmssp_state->ntlmssp_state->session_key,
47 auth_ntlmssp_state->ntlmssp_state->user,
50 if (!NT_STATUS_IS_OK(nt_status)) {
51 DEBUG(10, ("create_local_token failed: %s\n",
52 nt_errstr(nt_status)));
58 * Return the challenge as determined by the authentication subsystem
59 * @return an 8 byte random challenge
62 static NTSTATUS auth_ntlmssp_get_challenge(const struct ntlmssp_state *ntlmssp_state,
65 struct auth_ntlmssp_state *auth_ntlmssp_state =
66 (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
67 auth_ntlmssp_state->auth_context->get_ntlm_challenge(
68 auth_ntlmssp_state->auth_context, chal);
73 * Some authentication methods 'fix' the challenge, so we may not be able to set it
75 * @return If the effective challenge used by the auth subsystem may be modified
77 static bool auth_ntlmssp_may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
79 struct auth_ntlmssp_state *auth_ntlmssp_state =
80 (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
81 struct auth_context *auth_context = auth_ntlmssp_state->auth_context;
83 return auth_context->challenge_may_be_modified;
87 * NTLM2 authentication modifies the effective challenge,
88 * @param challenge The new challenge value
90 static NTSTATUS auth_ntlmssp_set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
92 struct auth_ntlmssp_state *auth_ntlmssp_state =
93 (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
94 struct auth_context *auth_context = auth_ntlmssp_state->auth_context;
96 SMB_ASSERT(challenge->length == 8);
98 auth_context->challenge = data_blob_talloc(auth_context,
99 challenge->data, challenge->length);
101 auth_context->challenge_set_by = "NTLMSSP callback (NTLM2)";
103 DEBUG(5, ("auth_context challenge set by %s\n", auth_context->challenge_set_by));
104 DEBUG(5, ("challenge is: \n"));
105 dump_data(5, auth_context->challenge.data, auth_context->challenge.length);
110 * Check the password on an NTLMSSP login.
112 * Return the session keys used on the connection.
115 static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state, TALLOC_CTX *mem_ctx,
116 DATA_BLOB *session_key, DATA_BLOB *lm_session_key)
118 struct auth_ntlmssp_state *auth_ntlmssp_state =
119 (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
120 struct auth_usersupplied_info *user_info = NULL;
122 bool username_was_mapped;
124 /* the client has given us its machine name (which we otherwise would not get on port 445).
125 we need to possibly reload smb.conf if smb.conf includes depend on the machine name */
127 set_remote_machine_name(auth_ntlmssp_state->ntlmssp_state->client.netbios_name, True);
129 /* setup the string used by %U */
130 /* sub_set_smb_name checks for weird internally */
131 sub_set_smb_name(auth_ntlmssp_state->ntlmssp_state->user);
133 lp_load(get_dyn_CONFIGFILE(), false, false, true, true);
135 nt_status = make_user_info_map(&user_info,
136 auth_ntlmssp_state->ntlmssp_state->user,
137 auth_ntlmssp_state->ntlmssp_state->domain,
138 auth_ntlmssp_state->ntlmssp_state->client.netbios_name,
139 auth_ntlmssp_state->remote_address,
140 auth_ntlmssp_state->ntlmssp_state->lm_resp.data ? &auth_ntlmssp_state->ntlmssp_state->lm_resp : NULL,
141 auth_ntlmssp_state->ntlmssp_state->nt_resp.data ? &auth_ntlmssp_state->ntlmssp_state->nt_resp : NULL,
143 AUTH_PASSWORD_RESPONSE);
145 if (!NT_STATUS_IS_OK(nt_status)) {
149 user_info->logon_parameters = MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
151 nt_status = auth_ntlmssp_state->auth_context->check_ntlm_password(auth_ntlmssp_state->auth_context,
152 user_info, &auth_ntlmssp_state->server_info);
154 username_was_mapped = user_info->was_mapped;
156 free_user_info(&user_info);
158 if (!NT_STATUS_IS_OK(nt_status)) {
159 nt_status = do_map_to_guest_server_info(nt_status,
160 &auth_ntlmssp_state->server_info,
161 auth_ntlmssp_state->ntlmssp_state->user,
162 auth_ntlmssp_state->ntlmssp_state->domain);
166 auth_ntlmssp_state->server_info->nss_token |= username_was_mapped;
168 /* Clear out the session keys, and pass them to the caller.
169 * They will not be used in this form again - instead the
170 * NTLMSSP code will decide on the final correct session key,
171 * and put it back here at the end of
172 * auth_ntlmssp_steal_server_info */
173 if (auth_ntlmssp_state->server_info->session_key.length) {
174 DEBUG(10, ("Got NT session key of length %u\n",
175 (unsigned int)auth_ntlmssp_state->server_info->session_key.length));
176 *session_key = auth_ntlmssp_state->server_info->session_key;
177 talloc_steal(mem_ctx, auth_ntlmssp_state->server_info->session_key.data);
178 auth_ntlmssp_state->server_info->session_key = data_blob_null;
180 if (auth_ntlmssp_state->server_info->lm_session_key.length) {
181 DEBUG(10, ("Got LM session key of length %u\n",
182 (unsigned int)auth_ntlmssp_state->server_info->lm_session_key.length));
183 *lm_session_key = auth_ntlmssp_state->server_info->lm_session_key;
184 talloc_steal(mem_ctx, auth_ntlmssp_state->server_info->lm_session_key.data);
185 auth_ntlmssp_state->server_info->lm_session_key = data_blob_null;
190 static int auth_ntlmssp_state_destructor(void *ptr);
192 NTSTATUS auth_ntlmssp_prepare(const struct tsocket_address *remote_address,
193 struct auth_ntlmssp_state **auth_ntlmssp_state)
197 const char *netbios_name;
198 const char *netbios_domain;
199 const char *dns_name;
201 struct auth_ntlmssp_state *ans;
202 struct auth_context *auth_context;
204 ans = talloc_zero(NULL, struct auth_ntlmssp_state);
206 DEBUG(0,("auth_ntlmssp_start: talloc failed!\n"));
207 return NT_STATUS_NO_MEMORY;
210 nt_status = make_auth_context_subsystem(talloc_tos(), &auth_context);
211 if (!NT_STATUS_IS_OK(nt_status)) {
216 ans->auth_context = talloc_steal(ans, auth_context);
218 if (auth_context->prepare_gensec) {
219 nt_status = auth_context->prepare_gensec(ans, &ans->gensec_security);
220 if (!NT_STATUS_IS_OK(nt_status)) {
224 *auth_ntlmssp_state = ans;
229 if ((enum server_role)lp_server_role() == ROLE_STANDALONE) {
230 is_standalone = true;
232 is_standalone = false;
235 netbios_name = lp_netbios_name();
236 netbios_domain = lp_workgroup();
237 /* This should be a 'netbios domain -> DNS domain' mapping */
238 dns_domain = get_mydnsdomname(talloc_tos());
240 strlower_m(dns_domain);
242 dns_name = get_mydnsfullname();
244 ans->remote_address = tsocket_address_copy(remote_address, ans);
245 if (ans->remote_address == NULL) {
246 DEBUG(0,("auth_ntlmssp_start: talloc failed!\n"));
247 return NT_STATUS_NO_MEMORY;
250 nt_status = ntlmssp_server_start(ans,
256 &ans->ntlmssp_state);
257 if (!NT_STATUS_IS_OK(nt_status)) {
261 ans->ntlmssp_state->callback_private = ans;
262 ans->ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
263 ans->ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
264 ans->ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
265 ans->ntlmssp_state->check_password = auth_ntlmssp_check_password;
267 talloc_set_destructor((TALLOC_CTX *)ans, auth_ntlmssp_state_destructor);
269 *auth_ntlmssp_state = ans;
273 static int auth_ntlmssp_state_destructor(void *ptr)
275 struct auth_ntlmssp_state *ans;
277 ans = talloc_get_type(ptr, struct auth_ntlmssp_state);
279 TALLOC_FREE(ans->remote_address);
280 TALLOC_FREE(ans->server_info);
281 TALLOC_FREE(ans->ntlmssp_state);
285 NTSTATUS auth_ntlmssp_start(struct auth_ntlmssp_state *auth_ntlmssp_state)
287 if (auth_ntlmssp_state->auth_context->gensec_start_mech_by_oid) {
288 return auth_ntlmssp_state->auth_context->gensec_start_mech_by_oid(auth_ntlmssp_state->gensec_security, GENSEC_OID_NTLMSSP);