2 Unix SMB/CIFS implementation.
4 Winbind status program.
6 Copyright (C) Tim Potter 2000-2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
8 Copyright (C) Francesco Chemolli <kinkie@kame.usr.dsi.unimi.it> 2000
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "utils/ntlm_auth.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "nsswitch/winbind_client.h"
30 #define DBGC_CLASS DBGC_WINBIND
41 Authenticate a user with a challenge/response, checking session key
42 and valid authentication types
46 * Test the normal 'LM and NTLM' combination
49 static bool test_lm_ntlm_broken(enum ntlm_break break_which)
54 DATA_BLOB lm_response = data_blob(NULL, 24);
55 DATA_BLOB nt_response = data_blob(NULL, 24);
56 DATA_BLOB session_key = data_blob(NULL, 16);
57 uint8_t authoritative = 0;
59 uchar user_session_key[16];
62 DATA_BLOB chall = get_challenge();
66 ZERO_STRUCT(user_session_key);
68 flags |= WBFLAG_PAM_LMKEY;
69 flags |= WBFLAG_PAM_USER_SESSION_KEY;
71 SMBencrypt(opt_password,chall.data,lm_response.data);
72 E_deshash(opt_password, lm_hash);
74 SMBNTencrypt(opt_password,chall.data,nt_response.data);
76 E_md4hash(opt_password, nt_hash);
77 SMBsesskeygen_ntv1(nt_hash, session_key.data);
79 switch (break_which) {
83 lm_response.data[0]++;
86 nt_response.data[0]++;
89 data_blob_free(&lm_response);
92 data_blob_free(&nt_response);
96 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
105 &error_string, NULL);
107 data_blob_free(&lm_response);
109 if (!NT_STATUS_IS_OK(nt_status)) {
110 d_printf("%s (0x%x)\n",
112 NT_STATUS_V(nt_status));
113 SAFE_FREE(error_string);
114 return break_which == BREAK_NT;
117 if (memcmp(lm_hash, lm_key,
118 sizeof(lm_key)) != 0) {
119 DEBUG(1, ("LM Key does not match expectations!\n"));
120 DEBUG(1, ("lm_key:\n"));
121 dump_data(1, lm_key, 8);
122 DEBUG(1, ("expected:\n"));
123 dump_data(1, lm_hash, 8);
127 if (break_which == NO_NT) {
128 if (memcmp(lm_hash, user_session_key,
130 DEBUG(1, ("NT Session Key does not match expectations (should be LM hash)!\n"));
131 DEBUG(1, ("user_session_key:\n"));
132 dump_data(1, user_session_key, sizeof(user_session_key));
133 DEBUG(1, ("expected:\n"));
134 dump_data(1, lm_hash, sizeof(lm_hash));
138 if (memcmp(session_key.data, user_session_key,
139 sizeof(user_session_key)) != 0) {
140 DEBUG(1, ("NT Session Key does not match expectations!\n"));
141 DEBUG(1, ("user_session_key:\n"));
142 dump_data(1, user_session_key, 16);
143 DEBUG(1, ("expected:\n"));
144 dump_data(1, session_key.data, session_key.length);
152 * Test LM authentication, no NT response supplied
155 static bool test_lm(void)
158 return test_lm_ntlm_broken(NO_NT);
162 * Test the NTLM response only, no LM.
165 static bool test_ntlm(void)
167 return test_lm_ntlm_broken(NO_LM);
171 * Test the NTLM response only, but in the LM field.
174 static bool test_ntlm_in_lm(void)
179 DATA_BLOB nt_response = data_blob(NULL, 24);
180 uint8_t authoritative = 0;
183 uchar user_session_key[16];
184 DATA_BLOB chall = get_challenge();
187 ZERO_STRUCT(user_session_key);
189 flags |= WBFLAG_PAM_LMKEY;
190 flags |= WBFLAG_PAM_USER_SESSION_KEY;
192 SMBNTencrypt(opt_password,chall.data,nt_response.data);
194 E_deshash(opt_password, lm_hash);
196 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
205 &error_string, NULL);
207 data_blob_free(&nt_response);
209 if (!NT_STATUS_IS_OK(nt_status)) {
210 d_printf("%s (0x%x)\n",
212 NT_STATUS_V(nt_status));
213 SAFE_FREE(error_string);
217 if (memcmp(lm_hash, lm_key,
218 sizeof(lm_key)) != 0) {
219 DEBUG(1, ("LM Key does not match expectations!\n"));
220 DEBUG(1, ("lm_key:\n"));
221 dump_data(1, lm_key, 8);
222 DEBUG(1, ("expected:\n"));
223 dump_data(1, lm_hash, 8);
226 if (memcmp(lm_hash, user_session_key, 8) != 0) {
227 DEBUG(1, ("Session Key (first 8 lm hash) does not match expectations!\n"));
228 DEBUG(1, ("user_session_key:\n"));
229 dump_data(1, user_session_key, 16);
230 DEBUG(1, ("expected:\n"));
231 dump_data(1, lm_hash, 8);
238 * Test the NTLM response only, but in the both the NT and LM fields.
241 static bool test_ntlm_in_both(void)
246 DATA_BLOB nt_response = data_blob(NULL, 24);
247 DATA_BLOB session_key = data_blob(NULL, 16);
248 uint8_t authoritative = 0;
251 uint8_t user_session_key[16];
253 DATA_BLOB chall = get_challenge();
257 ZERO_STRUCT(user_session_key);
259 flags |= WBFLAG_PAM_LMKEY;
260 flags |= WBFLAG_PAM_USER_SESSION_KEY;
262 SMBNTencrypt(opt_password,chall.data,nt_response.data);
263 E_md4hash(opt_password, nt_hash);
264 SMBsesskeygen_ntv1(nt_hash, session_key.data);
266 E_deshash(opt_password, lm_hash);
268 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
277 &error_string, NULL);
279 data_blob_free(&nt_response);
281 if (!NT_STATUS_IS_OK(nt_status)) {
282 d_printf("%s (0x%x)\n",
284 NT_STATUS_V(nt_status));
285 SAFE_FREE(error_string);
289 if (memcmp(lm_hash, lm_key,
290 sizeof(lm_key)) != 0) {
291 DEBUG(1, ("LM Key does not match expectations!\n"));
292 DEBUG(1, ("lm_key:\n"));
293 dump_data(1, lm_key, 8);
294 DEBUG(1, ("expected:\n"));
295 dump_data(1, lm_hash, 8);
298 if (memcmp(session_key.data, user_session_key,
299 sizeof(user_session_key)) != 0) {
300 DEBUG(1, ("NT Session Key does not match expectations!\n"));
301 DEBUG(1, ("user_session_key:\n"));
302 dump_data(1, user_session_key, 16);
303 DEBUG(1, ("expected:\n"));
304 dump_data(1, session_key.data, session_key.length);
313 * Test the NTLMv2 and LMv2 responses
316 static bool test_lmv2_ntlmv2_broken(enum ntlm_break break_which)
321 DATA_BLOB ntlmv2_response = data_blob_null;
322 DATA_BLOB lmv2_response = data_blob_null;
323 DATA_BLOB ntlmv2_session_key = data_blob_null;
324 DATA_BLOB names_blob = NTLMv2_generate_names_blob(NULL, get_winbind_netbios_name(), get_winbind_domain());
325 uint8_t authoritative = 0;
326 uchar user_session_key[16];
327 DATA_BLOB chall = get_challenge();
330 ZERO_STRUCT(user_session_key);
332 flags |= WBFLAG_PAM_USER_SESSION_KEY;
334 if (!SMBNTLMv2encrypt(NULL, opt_username, opt_domain, opt_password, &chall,
336 &lmv2_response, &ntlmv2_response, NULL,
337 &ntlmv2_session_key)) {
338 data_blob_free(&names_blob);
341 data_blob_free(&names_blob);
343 switch (break_which) {
347 lmv2_response.data[0]++;
350 ntlmv2_response.data[0]++;
353 data_blob_free(&lmv2_response);
356 data_blob_free(&ntlmv2_response);
360 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
369 &error_string, NULL);
371 data_blob_free(&lmv2_response);
372 data_blob_free(&ntlmv2_response);
374 if (!NT_STATUS_IS_OK(nt_status)) {
375 d_printf("%s (0x%x)\n",
377 NT_STATUS_V(nt_status));
378 SAFE_FREE(error_string);
379 return break_which == BREAK_NT;
382 if (break_which != NO_NT && break_which != BREAK_NT && memcmp(ntlmv2_session_key.data, user_session_key,
383 sizeof(user_session_key)) != 0) {
384 DEBUG(1, ("USER (NTLMv2) Session Key does not match expectations!\n"));
385 DEBUG(1, ("user_session_key:\n"));
386 dump_data(1, user_session_key, 16);
387 DEBUG(1, ("expected:\n"));
388 dump_data(1, ntlmv2_session_key.data, ntlmv2_session_key.length);
395 * Test the NTLMv2 and LMv2 responses
398 static bool test_lmv2_ntlmv2(void)
400 return test_lmv2_ntlmv2_broken(BREAK_NONE);
404 * Test the LMv2 response only
407 static bool test_lmv2(void)
409 return test_lmv2_ntlmv2_broken(NO_NT);
413 * Test the NTLMv2 response only
416 static bool test_ntlmv2(void)
418 return test_lmv2_ntlmv2_broken(NO_LM);
421 static bool test_lm_ntlm(void)
423 return test_lm_ntlm_broken(BREAK_NONE);
426 static bool test_ntlm_lm_broken(void)
428 return test_lm_ntlm_broken(BREAK_LM);
431 static bool test_ntlm_ntlm_broken(void)
433 return test_lm_ntlm_broken(BREAK_NT);
436 static bool test_ntlmv2_lmv2_broken(void)
438 return test_lmv2_ntlmv2_broken(BREAK_LM);
441 static bool test_ntlmv2_ntlmv2_broken(void)
443 return test_lmv2_ntlmv2_broken(BREAK_NT);
446 static bool test_plaintext(enum ntlm_break break_which)
450 DATA_BLOB nt_response = data_blob_null;
451 DATA_BLOB lm_response = data_blob_null;
453 smb_ucs2_t *nt_response_ucs2;
454 size_t converted_size;
455 uint8_t authoritative = 0;
456 uchar user_session_key[16];
458 static const uchar zeros[8] = { 0, };
459 DATA_BLOB chall = data_blob(zeros, sizeof(zeros));
462 ZERO_STRUCT(user_session_key);
464 flags |= WBFLAG_PAM_LMKEY;
465 flags |= WBFLAG_PAM_USER_SESSION_KEY;
467 if (!push_ucs2_talloc(talloc_tos(), &nt_response_ucs2, opt_password,
470 DEBUG(0, ("push_ucs2_talloc failed!\n"));
474 nt_response.data = (unsigned char *)nt_response_ucs2;
475 nt_response.length = strlen_w(nt_response_ucs2)*sizeof(smb_ucs2_t);
477 if ((password = strupper_talloc(talloc_tos(), opt_password)) == NULL) {
478 DEBUG(0, ("strupper_talloc() failed!\n"));
482 if (!convert_string_talloc(talloc_tos(), CH_UNIX,
486 &lm_response.length)) {
487 DEBUG(0, ("convert_string_talloc failed!\n"));
491 TALLOC_FREE(password);
493 switch (break_which) {
497 lm_response.data[0]++;
500 nt_response.data[0]++;
503 TALLOC_FREE(lm_response.data);
504 lm_response.length = 0;
507 TALLOC_FREE(nt_response.data);
508 nt_response.length = 0;
512 nt_status = contact_winbind_auth_crap(opt_username, opt_domain,
517 flags, MSV1_0_CLEARTEXT_PASSWORD_ALLOWED,
521 &error_string, NULL);
523 TALLOC_FREE(nt_response.data);
524 TALLOC_FREE(lm_response.data);
525 data_blob_free(&chall);
527 if (!NT_STATUS_IS_OK(nt_status)) {
528 d_printf("%s (0x%x)\n",
530 NT_STATUS_V(nt_status));
531 SAFE_FREE(error_string);
532 return break_which == BREAK_NT;
535 return break_which != BREAK_NT;
538 static bool test_plaintext_none_broken(void) {
539 return test_plaintext(BREAK_NONE);
542 static bool test_plaintext_lm_broken(void) {
543 return test_plaintext(BREAK_LM);
546 static bool test_plaintext_nt_broken(void) {
547 return test_plaintext(BREAK_NT);
550 static bool test_plaintext_nt_only(void) {
551 return test_plaintext(NO_LM);
554 static bool test_plaintext_lm_only(void) {
555 return test_plaintext(NO_NT);
569 - plaintext tests (in challenge-response feilds)
571 check we get the correct session key in each case
572 check what values we get for the LM session key
576 static const struct ntlm_tests {
581 {test_lm_ntlm, "LM and NTLM"},
583 {test_ntlm_in_lm, "NTLM in LM"},
584 {test_ntlm_in_both, "NTLM in both"},
585 {test_ntlmv2, "NTLMv2"},
586 {test_lmv2_ntlmv2, "NTLMv2 and LMv2"},
588 {test_ntlmv2_lmv2_broken, "NTLMv2 and LMv2, LMv2 broken"},
589 {test_ntlmv2_ntlmv2_broken, "NTLMv2 and LMv2, NTLMv2 broken"},
590 {test_ntlm_lm_broken, "NTLM and LM, LM broken"},
591 {test_ntlm_ntlm_broken, "NTLM and LM, NTLM broken"},
592 {test_plaintext_none_broken, "Plaintext"},
593 {test_plaintext_lm_broken, "Plaintext LM broken"},
594 {test_plaintext_nt_broken, "Plaintext NT broken"},
595 {test_plaintext_nt_only, "Plaintext NT only"},
596 {test_plaintext_lm_only, "Plaintext LM only"},
600 bool diagnose_ntlm_auth(void)
605 for (i=0; test_table[i].fn; i++) {
606 if (!test_table[i].fn()) {
607 DEBUG(1, ("Test %s failed!\n", test_table[i].name));