2 Unix SMB/CIFS implementation.
4 dcerpc authentication operations
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "auth/auth.h"
28 struct gensec_ntlmssp_state {
29 struct auth_context *auth_context;
30 struct auth_serversupplied_info *server_info;
31 struct ntlmssp_state *ntlmssp_state;
32 uint32_t have_features;
37 * Return the challenge as determined by the authentication subsystem
38 * @return an 8 byte random challenge
41 static const uint8_t *auth_ntlmssp_get_challenge(const struct ntlmssp_state *ntlmssp_state)
43 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
47 status = auth_get_challenge(gensec_ntlmssp_state->auth_context, &chal);
48 if (!NT_STATUS_IS_OK(status)) {
56 * Some authentication methods 'fix' the challenge, so we may not be able to set it
58 * @return If the effective challenge used by the auth subsystem may be modified
60 static BOOL auth_ntlmssp_may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
62 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
64 return auth_challenge_may_be_modified(gensec_ntlmssp_state->auth_context);
68 * NTLM2 authentication modifies the effective challenge,
69 * @param challenge The new challenge value
71 static NTSTATUS auth_ntlmssp_set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
74 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
75 struct auth_context *auth_context = gensec_ntlmssp_state->auth_context;
78 if (challenge->length != 8) {
79 return NT_STATUS_INVALID_PARAMETER;
82 chal = challenge->data;
84 nt_status = auth_context_set_challenge(auth_context, chal, "NTLMSSP callback (NTLM2)");
90 * Check the password on an NTLMSSP login.
92 * Return the session keys used on the connection.
95 static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
97 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
98 struct auth_usersupplied_info *user_info = NULL;
101 nt_status = make_user_info_map(ntlmssp_state,
102 gensec_ntlmssp_state->ntlmssp_state->user,
103 gensec_ntlmssp_state->ntlmssp_state->domain,
104 gensec_ntlmssp_state->ntlmssp_state->workstation,
105 gensec_ntlmssp_state->ntlmssp_state->lm_resp.data ? &gensec_ntlmssp_state->ntlmssp_state->lm_resp : NULL,
106 gensec_ntlmssp_state->ntlmssp_state->nt_resp.data ? &gensec_ntlmssp_state->ntlmssp_state->nt_resp : NULL,
107 NULL, NULL, NULL, True,
109 NT_STATUS_NOT_OK_RETURN(nt_status);
111 nt_status = auth_check_password(gensec_ntlmssp_state->auth_context, gensec_ntlmssp_state,
112 user_info, &gensec_ntlmssp_state->server_info);
113 talloc_free(user_info);
114 NT_STATUS_NOT_OK_RETURN(nt_status);
116 if (gensec_ntlmssp_state->server_info->user_session_key.length) {
117 DEBUG(10, ("Got NT session key of length %u\n", gensec_ntlmssp_state->server_info->user_session_key.length));
118 *user_session_key = data_blob_talloc(ntlmssp_state,
119 gensec_ntlmssp_state->server_info->user_session_key.data,
120 gensec_ntlmssp_state->server_info->user_session_key.length);
122 if (gensec_ntlmssp_state->server_info->lm_session_key.length) {
123 DEBUG(10, ("Got LM session key of length %u\n", gensec_ntlmssp_state->server_info->lm_session_key.length));
124 *lm_session_key = data_blob_talloc(ntlmssp_state,
125 gensec_ntlmssp_state->server_info->lm_session_key.data,
126 gensec_ntlmssp_state->server_info->lm_session_key.length);
131 static int gensec_ntlmssp_destroy(void *ptr)
133 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ptr;
135 if (gensec_ntlmssp_state->ntlmssp_state) {
136 ntlmssp_end(&gensec_ntlmssp_state->ntlmssp_state);
142 static NTSTATUS gensec_ntlmssp_start(struct gensec_security *gensec_security)
144 struct gensec_ntlmssp_state *gensec_ntlmssp_state;
146 gensec_ntlmssp_state = talloc(gensec_security, struct gensec_ntlmssp_state);
147 if (!gensec_ntlmssp_state) {
148 return NT_STATUS_NO_MEMORY;
151 gensec_ntlmssp_state->ntlmssp_state = NULL;
152 gensec_ntlmssp_state->auth_context = NULL;
153 gensec_ntlmssp_state->server_info = NULL;
154 gensec_ntlmssp_state->have_features = 0;
156 talloc_set_destructor(gensec_ntlmssp_state, gensec_ntlmssp_destroy);
158 gensec_security->private_data = gensec_ntlmssp_state;
162 static NTSTATUS gensec_ntlmssp_server_start(struct gensec_security *gensec_security)
165 struct ntlmssp_state *ntlmssp_state;
166 struct gensec_ntlmssp_state *gensec_ntlmssp_state;
168 nt_status = gensec_ntlmssp_start(gensec_security);
169 NT_STATUS_NOT_OK_RETURN(nt_status);
171 gensec_ntlmssp_state = gensec_security->private_data;
173 nt_status = ntlmssp_server_start(gensec_ntlmssp_state, &gensec_ntlmssp_state->ntlmssp_state);
174 NT_STATUS_NOT_OK_RETURN(nt_status);
176 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
177 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
179 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
180 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
183 nt_status = auth_context_create(gensec_ntlmssp_state, lp_auth_methods(), &gensec_ntlmssp_state->auth_context);
184 NT_STATUS_NOT_OK_RETURN(nt_status);
186 ntlmssp_state = gensec_ntlmssp_state->ntlmssp_state;
187 ntlmssp_state->auth_context = gensec_ntlmssp_state;
188 ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
189 ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
190 ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
191 ntlmssp_state->check_password = auth_ntlmssp_check_password;
192 ntlmssp_state->server_role = lp_server_role();
197 static NTSTATUS gensec_ntlmssp_client_start(struct gensec_security *gensec_security)
199 struct gensec_ntlmssp_state *gensec_ntlmssp_state;
200 const char *password = NULL;
203 nt_status = gensec_ntlmssp_start(gensec_security);
204 NT_STATUS_NOT_OK_RETURN(nt_status);
206 gensec_ntlmssp_state = gensec_security->private_data;
207 nt_status = ntlmssp_client_start(gensec_ntlmssp_state,
208 &gensec_ntlmssp_state->ntlmssp_state);
209 NT_STATUS_NOT_OK_RETURN(nt_status);
211 if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
213 * We need to set this to allow a later SetPassword
214 * via the SAMR pipe to succeed. Strange.... We could
215 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
217 * Without this, Windows will not create the master key
218 * that it thinks is only used for NTLMSSP signing and
219 * sealing. (It is actually pulled out and used directly)
221 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
223 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
224 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
226 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
227 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
230 nt_status = ntlmssp_set_domain(gensec_ntlmssp_state->ntlmssp_state,
231 cli_credentials_get_domain(gensec_security->credentials));
232 NT_STATUS_NOT_OK_RETURN(nt_status);
234 nt_status = ntlmssp_set_username(gensec_ntlmssp_state->ntlmssp_state,
235 cli_credentials_get_username(gensec_security->credentials));
236 NT_STATUS_NOT_OK_RETURN(nt_status);
238 password = cli_credentials_get_password(gensec_security->credentials);
240 nt_status = ntlmssp_set_password(gensec_ntlmssp_state->ntlmssp_state, password);
241 NT_STATUS_NOT_OK_RETURN(nt_status);
243 nt_status = ntlmssp_set_workstation(gensec_ntlmssp_state->ntlmssp_state,
244 cli_credentials_get_workstation(gensec_security->credentials));
246 gensec_security->private_data = gensec_ntlmssp_state;
252 wrappers for the ntlmssp_*() functions
254 static NTSTATUS gensec_ntlmssp_unseal_packet(struct gensec_security *gensec_security,
256 uint8_t *data, size_t length,
257 const uint8_t *whole_pdu, size_t pdu_length,
260 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
262 return ntlmssp_unseal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
265 static NTSTATUS gensec_ntlmssp_check_packet(struct gensec_security *gensec_security,
267 const uint8_t *data, size_t length,
268 const uint8_t *whole_pdu, size_t pdu_length,
269 const DATA_BLOB *sig)
271 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
273 return ntlmssp_check_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
276 static NTSTATUS gensec_ntlmssp_seal_packet(struct gensec_security *gensec_security,
278 uint8_t *data, size_t length,
279 const uint8_t *whole_pdu, size_t pdu_length,
282 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
284 return ntlmssp_seal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
287 static NTSTATUS gensec_ntlmssp_sign_packet(struct gensec_security *gensec_security,
289 const uint8_t *data, size_t length,
290 const uint8_t *whole_pdu, size_t pdu_length,
293 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
295 return ntlmssp_sign_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
298 static size_t gensec_ntlmssp_sig_size(struct gensec_security *gensec_security)
300 return NTLMSSP_SIG_SIZE;
303 static NTSTATUS gensec_ntlmssp_wrap(struct gensec_security *gensec_security,
308 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
312 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
314 *out = data_blob_talloc(mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
315 memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
317 nt_status = ntlmssp_seal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
318 out->data + NTLMSSP_SIG_SIZE,
319 out->length - NTLMSSP_SIG_SIZE,
320 out->data + NTLMSSP_SIG_SIZE,
321 out->length - NTLMSSP_SIG_SIZE,
324 if (NT_STATUS_IS_OK(nt_status)) {
325 memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
329 } else if ((gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)
330 || (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
332 *out = data_blob_talloc(mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
333 memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
335 nt_status = ntlmssp_sign_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
336 out->data + NTLMSSP_SIG_SIZE,
337 out->length - NTLMSSP_SIG_SIZE,
338 out->data + NTLMSSP_SIG_SIZE,
339 out->length - NTLMSSP_SIG_SIZE,
342 if (NT_STATUS_IS_OK(nt_status)) {
343 memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
354 static NTSTATUS gensec_ntlmssp_unwrap(struct gensec_security *gensec_security,
359 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
362 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
363 if (in->length < NTLMSSP_SIG_SIZE) {
364 return NT_STATUS_INVALID_PARAMETER;
367 sig.length = NTLMSSP_SIG_SIZE;
369 *out = data_blob_talloc(mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
371 return ntlmssp_unseal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
372 out->data, out->length,
373 out->data, out->length,
376 } else if ((gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)
377 || (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
378 if (in->length < NTLMSSP_SIG_SIZE) {
379 return NT_STATUS_INVALID_PARAMETER;
382 sig.length = NTLMSSP_SIG_SIZE;
384 *out = data_blob_talloc(mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
386 return ntlmssp_check_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
387 out->data, out->length,
388 out->data, out->length,
396 static NTSTATUS gensec_ntlmssp_session_key(struct gensec_security *gensec_security,
397 DATA_BLOB *session_key)
399 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
401 return ntlmssp_session_key(gensec_ntlmssp_state->ntlmssp_state, session_key);
405 * Next state function for the wrapped NTLMSSP state machine
407 * @param gensec_security GENSEC state, initialised to NTLMSSP
408 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
409 * @param in The request, as a DATA_BLOB
410 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
411 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
412 * or NT_STATUS_OK if the user is authenticated.
415 static NTSTATUS gensec_ntlmssp_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
416 const DATA_BLOB in, DATA_BLOB *out)
418 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
421 status = ntlmssp_update(gensec_ntlmssp_state->ntlmssp_state, out_mem_ctx, in, out);
423 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
427 gensec_ntlmssp_state->have_features = 0;
429 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
430 gensec_ntlmssp_state->have_features |= GENSEC_FEATURE_SIGN;
433 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
434 gensec_ntlmssp_state->have_features |= GENSEC_FEATURE_SEAL;
437 if (gensec_ntlmssp_state->ntlmssp_state->session_key.data) {
438 gensec_ntlmssp_state->have_features |= GENSEC_FEATURE_SESSION_KEY;
445 * Return the credentials of a logged on user, including session keys
448 * Only valid after a successful authentication
450 * May only be called once per authentication.
454 static NTSTATUS gensec_ntlmssp_session_info(struct gensec_security *gensec_security,
455 struct auth_session_info **session_info)
458 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
460 nt_status = auth_generate_session_info(gensec_ntlmssp_state, gensec_ntlmssp_state->server_info, session_info);
461 NT_STATUS_NOT_OK_RETURN(nt_status);
463 (*session_info)->session_key = data_blob_talloc(*session_info,
464 gensec_ntlmssp_state->ntlmssp_state->session_key.data,
465 gensec_ntlmssp_state->ntlmssp_state->session_key.length);
470 static BOOL gensec_ntlmssp_have_feature(struct gensec_security *gensec_security,
473 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
474 if (gensec_ntlmssp_state->have_features & feature) {
481 static const struct gensec_security_ops gensec_ntlmssp_security_ops = {
484 .auth_type = DCERPC_AUTH_TYPE_NTLMSSP,
485 .oid = GENSEC_OID_NTLMSSP,
486 .client_start = gensec_ntlmssp_client_start,
487 .server_start = gensec_ntlmssp_server_start,
488 .update = gensec_ntlmssp_update,
489 .sig_size = gensec_ntlmssp_sig_size,
490 .sign_packet = gensec_ntlmssp_sign_packet,
491 .check_packet = gensec_ntlmssp_check_packet,
492 .seal_packet = gensec_ntlmssp_seal_packet,
493 .unseal_packet = gensec_ntlmssp_unseal_packet,
494 .wrap = gensec_ntlmssp_wrap,
495 .unwrap = gensec_ntlmssp_unwrap,
496 .session_key = gensec_ntlmssp_session_key,
497 .session_info = gensec_ntlmssp_session_info,
498 .have_feature = gensec_ntlmssp_have_feature,
503 NTSTATUS gensec_ntlmssp_init(void)
506 ret = gensec_register(&gensec_ntlmssp_security_ops);
507 if (!NT_STATUS_IS_OK(ret)) {
508 DEBUG(0,("Failed to register '%s' gensec backend!\n",
509 gensec_ntlmssp_security_ops.name));