auth/ntlmssp/gensec_ntlmssp.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Version 3.0
   4  *  NTLMSSP Signing routines
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-2001
   6  *  Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2005
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23 #include "auth/ntlmssp/ntlmssp.h"
  24 #include "auth/gensec/gensec.h"
  25 #include "auth/gensec/gensec_internal.h"
  26 #include "auth/ntlmssp/ntlmssp_private.h"
  27
  28 NTSTATUS gensec_ntlmssp_magic(struct gensec_security *gensec_security,
  29                               const DATA_BLOB *first_packet)
  30 {
  31         if (ntlmssp_blob_matches_magic(first_packet)) {
  32                 return NT_STATUS_OK;
  33         } else {
  34                 return NT_STATUS_INVALID_PARAMETER;
  35         }
  36 }
  37
  38 /**
  39  * Return the NTLMSSP master session key
  40  *
  41  * @param ntlmssp_state NTLMSSP State
  42  */
  43
  44 NTSTATUS gensec_ntlmssp_session_key(struct gensec_security *gensec_security,
  45                                     TALLOC_CTX *mem_ctx,
  46                                     DATA_BLOB *session_key)
  47 {
  48         struct gensec_ntlmssp_context *gensec_ntlmssp =
  49                 talloc_get_type_abort(gensec_security->private_data,
  50                                       struct gensec_ntlmssp_context);
  51         struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
  52
  53         if (ntlmssp_state->expected_state != NTLMSSP_DONE) {
  54                 return NT_STATUS_NO_USER_SESSION_KEY;
  55         }
  56
  57         if (!ntlmssp_state->session_key.data) {
  58                 return NT_STATUS_NO_USER_SESSION_KEY;
  59         }
  60         *session_key = data_blob_talloc(mem_ctx, ntlmssp_state->session_key.data, ntlmssp_state->session_key.length);
  61         if (!session_key->data) {
  62                 return NT_STATUS_NO_MEMORY;
  63         }
  64
  65         return NT_STATUS_OK;
  66 }
  67
  68 bool gensec_ntlmssp_have_feature(struct gensec_security *gensec_security,
  69                                  uint32_t feature)
  70 {
  71         struct gensec_ntlmssp_context *gensec_ntlmssp =
  72                 talloc_get_type_abort(gensec_security->private_data,
  73                                       struct gensec_ntlmssp_context);
  74         struct ntlmssp_state *ntlmssp_state = gensec_ntlmssp->ntlmssp_state;
  75
  76         if (feature & GENSEC_FEATURE_SIGN) {
  77                 if (!ntlmssp_state->session_key.length) {
  78                         return false;
  79                 }
  80                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
  81                         return true;
  82                 }
  83         }
  84         if (feature & GENSEC_FEATURE_SEAL) {
  85                 if (!ntlmssp_state->session_key.length) {
  86                         return false;
  87                 }
  88                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
  89                         return true;
  90                 }
  91         }
  92         if (feature & GENSEC_FEATURE_SESSION_KEY) {
  93                 if (ntlmssp_state->session_key.length) {
  94                         return true;
  95                 }
  96         }
  97         if (feature & GENSEC_FEATURE_DCE_STYLE) {
  98                 return true;
  99         }
 100         if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
 101                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 102                         return true;
 103                 }
 104         }
 105         if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
 106                 return true;
 107         }
 108
 109         return false;
 110 }
 111
 112 NTSTATUS gensec_ntlmssp_start(struct gensec_security *gensec_security)
 113 {
 114         struct gensec_ntlmssp_context *gensec_ntlmssp;
 115
 116         gensec_ntlmssp = talloc_zero(gensec_security,
 117                                      struct gensec_ntlmssp_context);
 118         if (!gensec_ntlmssp) {
 119                 return NT_STATUS_NO_MEMORY;
 120         }
 121
 122         gensec_security->private_data = gensec_ntlmssp;
 123         return NT_STATUS_OK;
 124 }
 125
 126 NTSTATUS gensec_ntlmssp_sign_packet(struct gensec_security *gensec_security,
 127                                     TALLOC_CTX *sig_mem_ctx,
 128                                     const uint8_t *data, size_t length,
 129                                     const uint8_t *whole_pdu, size_t pdu_length,
 130                                     DATA_BLOB *sig)
 131 {
 132         struct gensec_ntlmssp_context *gensec_ntlmssp =
 133                 talloc_get_type_abort(gensec_security->private_data,
 134                                       struct gensec_ntlmssp_context);
 135         NTSTATUS nt_status;
 136
 137         nt_status = ntlmssp_sign_packet(gensec_ntlmssp->ntlmssp_state,
 138                                         sig_mem_ctx,
 139                                         data, length,
 140                                         whole_pdu, pdu_length,
 141                                         sig);
 142
 143         return nt_status;
 144 }
 145
 146 NTSTATUS gensec_ntlmssp_check_packet(struct gensec_security *gensec_security,
 147                                      const uint8_t *data, size_t length,
 148                                      const uint8_t *whole_pdu, size_t pdu_length,
 149                                      const DATA_BLOB *sig)
 150 {
 151         struct gensec_ntlmssp_context *gensec_ntlmssp =
 152                 talloc_get_type_abort(gensec_security->private_data,
 153                                       struct gensec_ntlmssp_context);
 154         NTSTATUS nt_status;
 155
 156         nt_status = ntlmssp_check_packet(gensec_ntlmssp->ntlmssp_state,
 157                                          data, length,
 158                                          whole_pdu, pdu_length,
 159                                          sig);
 160
 161         return nt_status;
 162 }
 163
 164 NTSTATUS gensec_ntlmssp_seal_packet(struct gensec_security *gensec_security,
 165                                     TALLOC_CTX *sig_mem_ctx,
 166                                     uint8_t *data, size_t length,
 167                                     const uint8_t *whole_pdu, size_t pdu_length,
 168                                     DATA_BLOB *sig)
 169 {
 170         struct gensec_ntlmssp_context *gensec_ntlmssp =
 171                 talloc_get_type_abort(gensec_security->private_data,
 172                                       struct gensec_ntlmssp_context);
 173         NTSTATUS nt_status;
 174
 175         nt_status = ntlmssp_seal_packet(gensec_ntlmssp->ntlmssp_state,
 176                                         sig_mem_ctx,
 177                                         data, length,
 178                                         whole_pdu, pdu_length,
 179                                         sig);
 180
 181         return nt_status;
 182 }
 183
 184 /*
 185   wrappers for the ntlmssp_*() functions
 186 */
 187 NTSTATUS gensec_ntlmssp_unseal_packet(struct gensec_security *gensec_security,
 188                                       uint8_t *data, size_t length,
 189                                       const uint8_t *whole_pdu, size_t pdu_length,
 190                                       const DATA_BLOB *sig)
 191 {
 192         struct gensec_ntlmssp_context *gensec_ntlmssp =
 193                 talloc_get_type_abort(gensec_security->private_data,
 194                                       struct gensec_ntlmssp_context);
 195         NTSTATUS nt_status;
 196
 197         nt_status = ntlmssp_unseal_packet(gensec_ntlmssp->ntlmssp_state,
 198                                           data, length,
 199                                           whole_pdu, pdu_length,
 200                                           sig);
 201
 202         return nt_status;
 203 }
 204
 205 size_t gensec_ntlmssp_sig_size(struct gensec_security *gensec_security, size_t data_size)
 206 {
 207         return NTLMSSP_SIG_SIZE;
 208 }
 209
 210 NTSTATUS gensec_ntlmssp_wrap(struct gensec_security *gensec_security,
 211                              TALLOC_CTX *out_mem_ctx,
 212                              const DATA_BLOB *in,
 213                              DATA_BLOB *out)
 214 {
 215         struct gensec_ntlmssp_context *gensec_ntlmssp =
 216                 talloc_get_type_abort(gensec_security->private_data,
 217                                       struct gensec_ntlmssp_context);
 218
 219         return ntlmssp_wrap(gensec_ntlmssp->ntlmssp_state,
 220                             out_mem_ctx,
 221                             in, out);
 222 }
 223
 224
 225 NTSTATUS gensec_ntlmssp_unwrap(struct gensec_security *gensec_security,
 226                                TALLOC_CTX *out_mem_ctx,
 227                                const DATA_BLOB *in,
 228                                DATA_BLOB *out)
 229 {
 230         struct gensec_ntlmssp_context *gensec_ntlmssp =
 231                 talloc_get_type_abort(gensec_security->private_data,
 232                                       struct gensec_ntlmssp_context);
 233
 234         return ntlmssp_unwrap(gensec_ntlmssp->ntlmssp_state,
 235                               out_mem_ctx,
 236                               in, out);
 237 }