2 Unix SMB/CIFS implementation.
4 dcerpc authentication operations
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "auth/auth.h"
28 struct gensec_ntlmssp_state {
29 struct auth_context *auth_context;
30 struct auth_serversupplied_info *server_info;
31 struct ntlmssp_state *ntlmssp_state;
32 uint32_t have_features;
37 * Return the challenge as determined by the authentication subsystem
38 * @return an 8 byte random challenge
41 static const uint8_t *auth_ntlmssp_get_challenge(const struct ntlmssp_state *ntlmssp_state)
43 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
47 status = auth_get_challenge(gensec_ntlmssp_state->auth_context, &chal);
48 if (!NT_STATUS_IS_OK(status)) {
56 * Some authentication methods 'fix' the challenge, so we may not be able to set it
58 * @return If the effective challenge used by the auth subsystem may be modified
60 static BOOL auth_ntlmssp_may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
62 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
64 return auth_challenge_may_be_modified(gensec_ntlmssp_state->auth_context);
68 * NTLM2 authentication modifies the effective challenge,
69 * @param challenge The new challenge value
71 static NTSTATUS auth_ntlmssp_set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
74 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
75 struct auth_context *auth_context = gensec_ntlmssp_state->auth_context;
78 if (challenge->length != 8) {
79 return NT_STATUS_INVALID_PARAMETER;
82 chal = challenge->data;
84 nt_status = auth_context_set_challenge(auth_context, chal, "NTLMSSP callback (NTLM2)");
90 * Check the password on an NTLMSSP login.
92 * Return the session keys used on the connection.
95 static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
97 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
98 struct auth_usersupplied_info *user_info = NULL;
101 nt_status = make_user_info_map(ntlmssp_state,
102 gensec_ntlmssp_state->ntlmssp_state->user,
103 gensec_ntlmssp_state->ntlmssp_state->domain,
104 gensec_ntlmssp_state->ntlmssp_state->workstation,
105 gensec_ntlmssp_state->ntlmssp_state->lm_resp.data ? &gensec_ntlmssp_state->ntlmssp_state->lm_resp : NULL,
106 gensec_ntlmssp_state->ntlmssp_state->nt_resp.data ? &gensec_ntlmssp_state->ntlmssp_state->nt_resp : NULL,
107 NULL, NULL, NULL, True,
109 NT_STATUS_NOT_OK_RETURN(nt_status);
111 nt_status = auth_check_password(gensec_ntlmssp_state->auth_context, gensec_ntlmssp_state,
112 user_info, &gensec_ntlmssp_state->server_info);
113 talloc_free(user_info);
114 NT_STATUS_NOT_OK_RETURN(nt_status);
116 if (gensec_ntlmssp_state->server_info->user_session_key.length) {
117 DEBUG(10, ("Got NT session key of length %u\n", gensec_ntlmssp_state->server_info->user_session_key.length));
118 *user_session_key = data_blob_talloc(ntlmssp_state,
119 gensec_ntlmssp_state->server_info->user_session_key.data,
120 gensec_ntlmssp_state->server_info->user_session_key.length);
122 if (gensec_ntlmssp_state->server_info->lm_session_key.length) {
123 DEBUG(10, ("Got LM session key of length %u\n", gensec_ntlmssp_state->server_info->lm_session_key.length));
124 *lm_session_key = data_blob_talloc(ntlmssp_state,
125 gensec_ntlmssp_state->server_info->lm_session_key.data,
126 gensec_ntlmssp_state->server_info->lm_session_key.length);
131 static int gensec_ntlmssp_destroy(void *ptr)
133 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ptr;
135 if (gensec_ntlmssp_state->ntlmssp_state) {
136 ntlmssp_end(&gensec_ntlmssp_state->ntlmssp_state);
142 static NTSTATUS gensec_ntlmssp_start(struct gensec_security *gensec_security)
144 struct gensec_ntlmssp_state *gensec_ntlmssp_state;
146 gensec_ntlmssp_state = talloc(gensec_security, struct gensec_ntlmssp_state);
147 if (!gensec_ntlmssp_state) {
148 return NT_STATUS_NO_MEMORY;
151 gensec_ntlmssp_state->ntlmssp_state = NULL;
152 gensec_ntlmssp_state->auth_context = NULL;
153 gensec_ntlmssp_state->server_info = NULL;
154 gensec_ntlmssp_state->have_features = 0;
156 talloc_set_destructor(gensec_ntlmssp_state, gensec_ntlmssp_destroy);
158 gensec_security->private_data = gensec_ntlmssp_state;
162 static NTSTATUS gensec_ntlmssp_server_start(struct gensec_security *gensec_security)
165 struct ntlmssp_state *ntlmssp_state;
166 struct gensec_ntlmssp_state *gensec_ntlmssp_state;
168 nt_status = gensec_ntlmssp_start(gensec_security);
169 NT_STATUS_NOT_OK_RETURN(nt_status);
171 gensec_ntlmssp_state = gensec_security->private_data;
173 nt_status = ntlmssp_server_start(gensec_ntlmssp_state, &gensec_ntlmssp_state->ntlmssp_state);
174 NT_STATUS_NOT_OK_RETURN(nt_status);
176 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
177 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
179 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
180 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
183 nt_status = auth_context_create(gensec_ntlmssp_state, lp_auth_methods(), &gensec_ntlmssp_state->auth_context);
184 NT_STATUS_NOT_OK_RETURN(nt_status);
186 ntlmssp_state = gensec_ntlmssp_state->ntlmssp_state;
187 ntlmssp_state->auth_context = gensec_ntlmssp_state;
188 ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
189 ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
190 ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
191 ntlmssp_state->check_password = auth_ntlmssp_check_password;
192 ntlmssp_state->server_role = lp_server_role();
197 static NTSTATUS gensec_ntlmssp_client_start(struct gensec_security *gensec_security)
199 struct gensec_ntlmssp_state *gensec_ntlmssp_state;
200 char *password = NULL;
203 nt_status = gensec_ntlmssp_start(gensec_security);
204 NT_STATUS_NOT_OK_RETURN(nt_status);
206 gensec_ntlmssp_state = gensec_security->private_data;
207 nt_status = ntlmssp_client_start(gensec_ntlmssp_state,
208 &gensec_ntlmssp_state->ntlmssp_state);
209 NT_STATUS_NOT_OK_RETURN(nt_status);
211 if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
213 * We need to set this to allow a later SetPassword
214 * via the SAMR pipe to succeed. Strange.... We could
215 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
217 * Without this, Windows will not create the master key
218 * that it thinks is only used for NTLMSSP signing and
219 * sealing. (It is actually pulled out and used directly)
221 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
223 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
224 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
226 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
227 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
230 nt_status = ntlmssp_set_domain(gensec_ntlmssp_state->ntlmssp_state,
231 gensec_security->user.domain);
232 NT_STATUS_NOT_OK_RETURN(nt_status);
234 nt_status = ntlmssp_set_username(gensec_ntlmssp_state->ntlmssp_state,
235 gensec_security->user.name);
236 NT_STATUS_NOT_OK_RETURN(nt_status);
238 if (gensec_security->user.name) {
239 nt_status = gensec_get_password(gensec_security, gensec_ntlmssp_state, &password);
240 NT_STATUS_NOT_OK_RETURN(nt_status);
244 nt_status = ntlmssp_set_password(gensec_ntlmssp_state->ntlmssp_state, password);
245 NT_STATUS_NOT_OK_RETURN(nt_status);
248 nt_status = ntlmssp_set_workstation(gensec_ntlmssp_state->ntlmssp_state,
249 gensec_get_workstation(gensec_security));
251 gensec_security->private_data = gensec_ntlmssp_state;
257 wrappers for the ntlmssp_*() functions
259 static NTSTATUS gensec_ntlmssp_unseal_packet(struct gensec_security *gensec_security,
261 uint8_t *data, size_t length,
262 const uint8_t *whole_pdu, size_t pdu_length,
265 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
267 return ntlmssp_unseal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
270 static NTSTATUS gensec_ntlmssp_check_packet(struct gensec_security *gensec_security,
272 const uint8_t *data, size_t length,
273 const uint8_t *whole_pdu, size_t pdu_length,
274 const DATA_BLOB *sig)
276 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
278 return ntlmssp_check_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
281 static NTSTATUS gensec_ntlmssp_seal_packet(struct gensec_security *gensec_security,
283 uint8_t *data, size_t length,
284 const uint8_t *whole_pdu, size_t pdu_length,
287 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
289 return ntlmssp_seal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
292 static NTSTATUS gensec_ntlmssp_sign_packet(struct gensec_security *gensec_security,
294 const uint8_t *data, size_t length,
295 const uint8_t *whole_pdu, size_t pdu_length,
298 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
300 return ntlmssp_sign_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
303 static size_t gensec_ntlmssp_sig_size(struct gensec_security *gensec_security)
305 return NTLMSSP_SIG_SIZE;
308 static NTSTATUS gensec_ntlmssp_wrap(struct gensec_security *gensec_security,
313 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
317 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
319 *out = data_blob_talloc(mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
320 memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
322 nt_status = ntlmssp_seal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
323 out->data + NTLMSSP_SIG_SIZE,
324 out->length - NTLMSSP_SIG_SIZE,
325 out->data + NTLMSSP_SIG_SIZE,
326 out->length - NTLMSSP_SIG_SIZE,
329 if (NT_STATUS_IS_OK(nt_status)) {
330 memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
334 } else if ((gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)
335 || (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
337 *out = data_blob_talloc(mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
338 memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
340 nt_status = ntlmssp_sign_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
341 out->data + NTLMSSP_SIG_SIZE,
342 out->length - NTLMSSP_SIG_SIZE,
343 out->data + NTLMSSP_SIG_SIZE,
344 out->length - NTLMSSP_SIG_SIZE,
347 if (NT_STATUS_IS_OK(nt_status)) {
348 memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
359 static NTSTATUS gensec_ntlmssp_unwrap(struct gensec_security *gensec_security,
364 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
367 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
368 if (in->length < NTLMSSP_SIG_SIZE) {
369 return NT_STATUS_INVALID_PARAMETER;
372 sig.length = NTLMSSP_SIG_SIZE;
374 *out = data_blob_talloc(mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
376 return ntlmssp_unseal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
377 out->data, out->length,
378 out->data, out->length,
381 } else if ((gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)
382 || (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
383 if (in->length < NTLMSSP_SIG_SIZE) {
384 return NT_STATUS_INVALID_PARAMETER;
387 sig.length = NTLMSSP_SIG_SIZE;
389 *out = data_blob_talloc(mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
391 return ntlmssp_check_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
392 out->data, out->length,
393 out->data, out->length,
401 static NTSTATUS gensec_ntlmssp_session_key(struct gensec_security *gensec_security,
402 DATA_BLOB *session_key)
404 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
406 return ntlmssp_session_key(gensec_ntlmssp_state->ntlmssp_state, session_key);
410 * Next state function for the wrapped NTLMSSP state machine
412 * @param gensec_security GENSEC state, initialised to NTLMSSP
413 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
414 * @param in The request, as a DATA_BLOB
415 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
416 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
417 * or NT_STATUS_OK if the user is authenticated.
420 static NTSTATUS gensec_ntlmssp_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
421 const DATA_BLOB in, DATA_BLOB *out)
423 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
426 status = ntlmssp_update(gensec_ntlmssp_state->ntlmssp_state, out_mem_ctx, in, out);
428 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
432 gensec_ntlmssp_state->have_features = 0;
434 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
435 gensec_ntlmssp_state->have_features |= GENSEC_FEATURE_SIGN;
438 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
439 gensec_ntlmssp_state->have_features |= GENSEC_FEATURE_SEAL;
442 if (gensec_ntlmssp_state->ntlmssp_state->session_key.data) {
443 gensec_ntlmssp_state->have_features |= GENSEC_FEATURE_SESSION_KEY;
450 * Return the credentials of a logged on user, including session keys
453 * Only valid after a successful authentication
455 * May only be called once per authentication.
459 static NTSTATUS gensec_ntlmssp_session_info(struct gensec_security *gensec_security,
460 struct auth_session_info **session_info)
463 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
465 nt_status = auth_generate_session_info(gensec_ntlmssp_state, gensec_ntlmssp_state->server_info, session_info);
466 NT_STATUS_NOT_OK_RETURN(nt_status);
468 (*session_info)->session_key = data_blob_talloc(*session_info,
469 gensec_ntlmssp_state->ntlmssp_state->session_key.data,
470 gensec_ntlmssp_state->ntlmssp_state->session_key.length);
475 static BOOL gensec_ntlmssp_have_feature(struct gensec_security *gensec_security,
478 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
479 if (gensec_ntlmssp_state->have_features & feature) {
486 static const struct gensec_security_ops gensec_ntlmssp_security_ops = {
489 .auth_type = DCERPC_AUTH_TYPE_NTLMSSP,
490 .oid = GENSEC_OID_NTLMSSP,
491 .client_start = gensec_ntlmssp_client_start,
492 .server_start = gensec_ntlmssp_server_start,
493 .update = gensec_ntlmssp_update,
494 .sig_size = gensec_ntlmssp_sig_size,
495 .sign_packet = gensec_ntlmssp_sign_packet,
496 .check_packet = gensec_ntlmssp_check_packet,
497 .seal_packet = gensec_ntlmssp_seal_packet,
498 .unseal_packet = gensec_ntlmssp_unseal_packet,
499 .wrap = gensec_ntlmssp_wrap,
500 .unwrap = gensec_ntlmssp_unwrap,
501 .session_key = gensec_ntlmssp_session_key,
502 .session_info = gensec_ntlmssp_session_info,
503 .have_feature = gensec_ntlmssp_have_feature,
508 NTSTATUS gensec_ntlmssp_init(void)
511 ret = gensec_register(&gensec_ntlmssp_security_ops);
512 if (!NT_STATUS_IS_OK(ret)) {
513 DEBUG(0,("Failed to register '%s' gensec backend!\n",
514 gensec_ntlmssp_security_ops.name));