source3/libsmb/ntlmssp_sign.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Version 3.0
   4  *  NTLMSSP Signing routines
   5  *  Copyright (C) Andrew Bartlett 2003-2005
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 3 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "../libcli/auth/libcli_auth.h"
  23
  24 #define CLI_SIGN "session key to client-to-server signing key magic constant"
  25 #define CLI_SEAL "session key to client-to-server sealing key magic constant"
  26 #define SRV_SIGN "session key to server-to-client signing key magic constant"
  27 #define SRV_SEAL "session key to server-to-client sealing key magic constant"
  28
  29 /**
  30  * Some notes on then NTLM2 code:
  31  *
  32  * NTLM2 is a AEAD system.  This means that the data encrypted is not
  33  * all the data that is signed.  In DCE-RPC case, the headers of the
  34  * DCE-RPC packets are also signed.  This prevents some of the
  35  * fun-and-games one might have by changing them.
  36  *
  37  */
  38
  39 static void dump_arc4_state(const char *description,
  40                             struct arcfour_state *state)
  41 {
  42         dump_data_pw(description, state->sbox, sizeof(state->sbox));
  43 }
  44
  45 static void calc_ntlmv2_key(unsigned char subkey[16],
  46                                 DATA_BLOB session_key,
  47                                 const char *constant)
  48 {
  49         struct MD5Context ctx3;
  50         MD5Init(&ctx3);
  51         MD5Update(&ctx3, session_key.data, session_key.length);
  52         MD5Update(&ctx3, (const unsigned char *)constant, strlen(constant)+1);
  53         MD5Final(subkey, &ctx3);
  54 }
  55
  56 enum ntlmssp_direction {
  57         NTLMSSP_SEND,
  58         NTLMSSP_RECEIVE
  59 };
  60
  61 static NTSTATUS ntlmssp_make_packet_signature(NTLMSSP_STATE *ntlmssp_state,
  62                                                 const uchar *data, size_t length,
  63                                                 const uchar *whole_pdu, size_t pdu_length,
  64                                                 enum ntlmssp_direction direction,
  65                                                 DATA_BLOB *sig,
  66                                                 bool encrypt_sig)
  67 {
  68         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
  69                 HMACMD5Context ctx;
  70                 uchar seq_num[4];
  71                 uchar digest[16];
  72
  73                 *sig = data_blob(NULL, NTLMSSP_SIG_SIZE);
  74                 if (!sig->data) {
  75                         return NT_STATUS_NO_MEMORY;
  76                 }
  77
  78                 switch (direction) {
  79                         case NTLMSSP_SEND:
  80                                 DEBUG(100,("ntlmssp_make_packet_signature: SEND seq = %u, len = %u, pdu_len = %u\n",
  81                                         ntlmssp_state->ntlm2_send_seq_num,
  82                                         (unsigned int)length,
  83                                         (unsigned int)pdu_length));
  84
  85                                 SIVAL(seq_num, 0, ntlmssp_state->ntlm2_send_seq_num);
  86                                 ntlmssp_state->ntlm2_send_seq_num++;
  87                                 hmac_md5_init_limK_to_64(ntlmssp_state->send_sign_key, 16, &ctx);
  88                                 break;
  89                         case NTLMSSP_RECEIVE:
  90
  91                                 DEBUG(100,("ntlmssp_make_packet_signature: RECV seq = %u, len = %u, pdu_len = %u\n",
  92                                         ntlmssp_state->ntlm2_recv_seq_num,
  93                                         (unsigned int)length,
  94                                         (unsigned int)pdu_length));
  95
  96                                 SIVAL(seq_num, 0, ntlmssp_state->ntlm2_recv_seq_num);
  97                                 ntlmssp_state->ntlm2_recv_seq_num++;
  98                                 hmac_md5_init_limK_to_64(ntlmssp_state->recv_sign_key, 16, &ctx);
  99                                 break;
 100                 }
 101
 102                 dump_data_pw("pdu data ", whole_pdu, pdu_length);
 103
 104                 hmac_md5_update(seq_num, 4, &ctx);
 105                 hmac_md5_update(whole_pdu, pdu_length, &ctx);
 106                 hmac_md5_final(digest, &ctx);
 107
 108                 if (encrypt_sig && (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
 109                         switch (direction) {
 110                         case NTLMSSP_SEND:
 111                                 arcfour_crypt_sbox(&ntlmssp_state->send_seal_arc4_state, digest, 8);
 112                                 break;
 113                         case NTLMSSP_RECEIVE:
 114                                 arcfour_crypt_sbox(&ntlmssp_state->recv_seal_arc4_state, digest, 8);
 115                                 break;
 116                         }
 117                 }
 118
 119                 SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION);
 120                 memcpy(sig->data + 4, digest, 8);
 121                 memcpy(sig->data + 12, seq_num, 4);
 122
 123                 dump_data_pw("ntlmssp v2 sig ", sig->data, sig->length);
 124
 125         } else {
 126                 uint32 crc;
 127                 crc = crc32_calc_buffer(data, length);
 128                 if (!msrpc_gen(ntlmssp_state, sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmv1_seq_num)) {
 129                         return NT_STATUS_NO_MEMORY;
 130                 }
 131
 132                 ntlmssp_state->ntlmv1_seq_num++;
 133
 134                 dump_arc4_state("ntlmssp hash: \n", &ntlmssp_state->ntlmv1_arc4_state);
 135                 arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state, sig->data+4, sig->length-4);
 136         }
 137         return NT_STATUS_OK;
 138 }
 139
 140 NTSTATUS ntlmssp_sign_packet(NTLMSSP_STATE *ntlmssp_state,
 141                                     const uchar *data, size_t length,
 142                                     const uchar *whole_pdu, size_t pdu_length,
 143                                     DATA_BLOB *sig)
 144 {
 145         NTSTATUS nt_status;
 146
 147         if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 148                 DEBUG(3, ("NTLMSSP Signing not negotiated - cannot sign packet!\n"));
 149                 return NT_STATUS_INVALID_PARAMETER;
 150         }
 151
 152         if (!ntlmssp_state->session_key.length) {
 153                 DEBUG(3, ("NO session key, cannot check sign packet\n"));
 154                 return NT_STATUS_NO_USER_SESSION_KEY;
 155         }
 156
 157         nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 158                                                 data, length,
 159                                                 whole_pdu, pdu_length,
 160                                                 NTLMSSP_SEND, sig, True);
 161
 162         return nt_status;
 163 }
 164
 165 /**
 166  * Check the signature of an incoming packet
 167  * @note caller *must* check that the signature is the size it expects
 168  *
 169  */
 170
 171 NTSTATUS ntlmssp_check_packet(NTLMSSP_STATE *ntlmssp_state,
 172                                 const uchar *data, size_t length,
 173                                 const uchar *whole_pdu, size_t pdu_length,
 174                                 const DATA_BLOB *sig)
 175 {
 176         DATA_BLOB local_sig;
 177         NTSTATUS nt_status;
 178
 179         if (!ntlmssp_state->session_key.length) {
 180                 DEBUG(3, ("NO session key, cannot check packet signature\n"));
 181                 return NT_STATUS_NO_USER_SESSION_KEY;
 182         }
 183
 184         if (sig->length < 8) {
 185                 DEBUG(0, ("NTLMSSP packet check failed due to short signature (%lu bytes)!\n",
 186                           (unsigned long)sig->length));
 187         }
 188
 189         nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 190                                                 data, length,
 191                                                 whole_pdu, pdu_length,
 192                                                 NTLMSSP_RECEIVE, &local_sig, True);
 193
 194         if (!NT_STATUS_IS_OK(nt_status)) {
 195                 DEBUG(0, ("NTLMSSP packet check failed with %s\n", nt_errstr(nt_status)));
 196                 data_blob_free(&local_sig);
 197                 return nt_status;
 198         }
 199
 200         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 201                 if (local_sig.length != sig->length ||
 202                                 memcmp(local_sig.data, sig->data, sig->length) != 0) {
 203                         DEBUG(5, ("BAD SIG NTLM2: wanted signature of\n"));
 204                         dump_data(5, local_sig.data, local_sig.length);
 205
 206                         DEBUG(5, ("BAD SIG: got signature of\n"));
 207                         dump_data(5, sig->data, sig->length);
 208
 209                         DEBUG(0, ("NTLMSSP NTLM2 packet check failed due to invalid signature!\n"));
 210                         data_blob_free(&local_sig);
 211                         return NT_STATUS_ACCESS_DENIED;
 212                 }
 213         } else {
 214                 if (local_sig.length != sig->length ||
 215                                 memcmp(local_sig.data + 8, sig->data + 8, sig->length - 8) != 0) {
 216                         DEBUG(5, ("BAD SIG NTLM1: wanted signature of\n"));
 217                         dump_data(5, local_sig.data, local_sig.length);
 218
 219                         DEBUG(5, ("BAD SIG: got signature of\n"));
 220                         dump_data(5, sig->data, sig->length);
 221
 222                         DEBUG(0, ("NTLMSSP NTLM1 packet check failed due to invalid signature!\n"));
 223                         data_blob_free(&local_sig);
 224                         return NT_STATUS_ACCESS_DENIED;
 225                 }
 226         }
 227         dump_data_pw("checked ntlmssp signature\n", sig->data, sig->length);
 228         DEBUG(10,("ntlmssp_check_packet: NTLMSSP signature OK !\n"));
 229
 230         data_blob_free(&local_sig);
 231         return NT_STATUS_OK;
 232 }
 233
 234 /**
 235  * Seal data with the NTLMSSP algorithm
 236  *
 237  */
 238
 239 NTSTATUS ntlmssp_seal_packet(NTLMSSP_STATE *ntlmssp_state,
 240                              uchar *data, size_t length,
 241                              uchar *whole_pdu, size_t pdu_length,
 242                              DATA_BLOB *sig)
 243 {
 244         if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 245                 DEBUG(3, ("NTLMSSP Sealing not negotiated - cannot seal packet!\n"));
 246                 return NT_STATUS_INVALID_PARAMETER;
 247         }
 248
 249         if (!ntlmssp_state->session_key.length) {
 250                 DEBUG(3, ("NO session key, cannot seal packet\n"));
 251                 return NT_STATUS_NO_USER_SESSION_KEY;
 252         }
 253
 254         DEBUG(10,("ntlmssp_seal_data: seal\n"));
 255         dump_data_pw("ntlmssp clear data\n", data, length);
 256         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 257                 /* The order of these two operations matters - we must first seal the packet,
 258                    then seal the sequence number - this is becouse the send_seal_hash is not
 259                    constant, but is is rather updated with each iteration */
 260                 NTSTATUS nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 261                                                         data, length,
 262                                                         whole_pdu, pdu_length,
 263                                                         NTLMSSP_SEND, sig, False);
 264                 if (!NT_STATUS_IS_OK(nt_status)) {
 265                         return nt_status;
 266                 }
 267
 268                 arcfour_crypt_sbox(&ntlmssp_state->send_seal_arc4_state, data, length);
 269                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
 270                         arcfour_crypt_sbox(&ntlmssp_state->send_seal_arc4_state, sig->data+4, 8);
 271                 }
 272         } else {
 273                 uint32 crc;
 274                 crc = crc32_calc_buffer(data, length);
 275                 if (!msrpc_gen(ntlmssp_state, sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmv1_seq_num)) {
 276                         return NT_STATUS_NO_MEMORY;
 277                 }
 278
 279                 /* The order of these two operations matters - we must first seal the packet,
 280                    then seal the sequence number - this is becouse the ntlmv1_arc4_state is not
 281                    constant, but is is rather updated with each iteration */
 282
 283                 dump_arc4_state("ntlmv1 arc4 state:\n",
 284                                                 &ntlmssp_state->ntlmv1_arc4_state);
 285                 arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state, data, length);
 286
 287                 dump_arc4_state("ntlmv1 arc4 state:\n",
 288                                                 &ntlmssp_state->ntlmv1_arc4_state);
 289
 290                 arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state, sig->data+4, sig->length-4);
 291
 292                 ntlmssp_state->ntlmv1_seq_num++;
 293         }
 294         dump_data_pw("ntlmssp signature\n", sig->data, sig->length);
 295         dump_data_pw("ntlmssp sealed data\n", data, length);
 296
 297         return NT_STATUS_OK;
 298 }
 299
 300 /**
 301  * Unseal data with the NTLMSSP algorithm
 302  *
 303  */
 304
 305 NTSTATUS ntlmssp_unseal_packet(NTLMSSP_STATE *ntlmssp_state,
 306                                 uchar *data, size_t length,
 307                                 uchar *whole_pdu, size_t pdu_length,
 308                                 DATA_BLOB *sig)
 309 {
 310         if (!ntlmssp_state->session_key.length) {
 311                 DEBUG(3, ("NO session key, cannot unseal packet\n"));
 312                 return NT_STATUS_NO_USER_SESSION_KEY;
 313         }
 314
 315         DEBUG(10,("ntlmssp_unseal_packet: seal\n"));
 316         dump_data_pw("ntlmssp sealed data\n", data, length);
 317
 318         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 319                 /* First unseal the data. */
 320                 arcfour_crypt_sbox(&ntlmssp_state->recv_seal_arc4_state, data, length);
 321                 dump_data_pw("ntlmv2 clear data\n", data, length);
 322         } else {
 323                 arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state, data, length);
 324                 dump_data_pw("ntlmv1 clear data\n", data, length);
 325         }
 326         return ntlmssp_check_packet(ntlmssp_state, data, length, whole_pdu, pdu_length, sig);
 327 }
 328
 329 /**
 330    Initialise the state for NTLMSSP signing.
 331 */
 332 NTSTATUS ntlmssp_sign_init(NTLMSSP_STATE *ntlmssp_state)
 333 {
 334         unsigned char p24[24];
 335         TALLOC_CTX *mem_ctx;
 336         ZERO_STRUCT(p24);
 337
 338         mem_ctx = talloc_init("weak_keys");
 339         if (!mem_ctx) {
 340                 return NT_STATUS_NO_MEMORY;
 341         }
 342
 343         DEBUG(3, ("NTLMSSP Sign/Seal - Initialising with flags:\n"));
 344         debug_ntlmssp_flags(ntlmssp_state->neg_flags);
 345
 346         if (ntlmssp_state->session_key.length < 8) {
 347                 TALLOC_FREE(mem_ctx);
 348                 DEBUG(3, ("NO session key, cannot intialise signing\n"));
 349                 return NT_STATUS_NO_USER_SESSION_KEY;
 350         }
 351
 352         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 353                 DATA_BLOB weak_session_key = ntlmssp_state->session_key;
 354                 const char *send_sign_const;
 355                 const char *send_seal_const;
 356                 const char *recv_sign_const;
 357                 const char *recv_seal_const;
 358                 DATA_BLOB send_seal_key_blob, recv_seal_blob;
 359
 360                 switch (ntlmssp_state->role) {
 361                 case NTLMSSP_CLIENT:
 362                         send_sign_const = CLI_SIGN;
 363                         send_seal_const = CLI_SEAL;
 364                         recv_sign_const = SRV_SIGN;
 365                         recv_seal_const = SRV_SEAL;
 366                         break;
 367                 case NTLMSSP_SERVER:
 368                         send_sign_const = SRV_SIGN;
 369                         send_seal_const = SRV_SEAL;
 370                         recv_sign_const = CLI_SIGN;
 371                         recv_seal_const = CLI_SEAL;
 372                         break;
 373                 default:
 374                         TALLOC_FREE(mem_ctx);
 375                         return NT_STATUS_INTERNAL_ERROR;
 376                 }
 377
 378                 /**
 379                   Weaken NTLMSSP keys to cope with down-level clients, servers and export restrictions.
 380                   We probably should have some parameters to control this, once we get NTLM2 working.
 381                 */
 382
 383                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
 384                         ;
 385                 } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
 386                         weak_session_key.length = 7;
 387                 } else { /* forty bits */
 388                         weak_session_key.length = 5;
 389                 }
 390
 391                 dump_data_pw("NTLMSSP weakend master key:\n",
 392                                 weak_session_key.data,
 393                                 weak_session_key.length);
 394
 395                 /* SEND: sign key */
 396                 calc_ntlmv2_key(ntlmssp_state->send_sign_key,
 397                                 ntlmssp_state->session_key, send_sign_const);
 398                 dump_data_pw("NTLMSSP send sign key:\n",
 399                                 ntlmssp_state->send_sign_key, 16);
 400
 401                 /* SEND: seal ARCFOUR pad */
 402                 calc_ntlmv2_key(ntlmssp_state->send_seal_key,
 403                                 weak_session_key, send_seal_const);
 404                 dump_data_pw("NTLMSSP send seal key:\n",
 405                                 ntlmssp_state->send_seal_key, 16);
 406
 407                 send_seal_key_blob.data = ntlmssp_state->send_seal_key;
 408                 send_seal_key_blob.length = 16;
 409                 arcfour_init(&ntlmssp_state->send_seal_arc4_state,
 410                              &send_seal_key_blob);
 411
 412                 dump_arc4_state("NTLMSSP send seal arc4 state:\n",
 413                              &ntlmssp_state->send_seal_arc4_state);
 414
 415                 /* RECV: sign key */
 416                 calc_ntlmv2_key(ntlmssp_state->recv_sign_key,
 417                                 ntlmssp_state->session_key, recv_sign_const);
 418                 dump_data_pw("NTLMSSP recv send sign key:\n",
 419                                 ntlmssp_state->recv_sign_key, 16);
 420
 421                 /* RECV: seal ARCFOUR pad */
 422                 calc_ntlmv2_key(ntlmssp_state->recv_seal_key,
 423                                 weak_session_key, recv_seal_const);
 424
 425                 dump_data_pw("NTLMSSP recv seal key:\n",
 426                                 ntlmssp_state->recv_seal_key, 16);
 427
 428                 recv_seal_blob.data = ntlmssp_state->recv_seal_key;
 429                 recv_seal_blob.length = 16;
 430                 arcfour_init(&ntlmssp_state->recv_seal_arc4_state,
 431                                 &recv_seal_blob);
 432
 433                 dump_arc4_state("NTLMSSP recv seal arc4 state:\n",
 434                              &ntlmssp_state->recv_seal_arc4_state);
 435
 436                 ntlmssp_state->ntlm2_send_seq_num = 0;
 437                 ntlmssp_state->ntlm2_recv_seq_num = 0;
 438
 439
 440         } else {
 441 #if 0
 442                 /* Hmmm. Shouldn't we also weaken keys for ntlmv1 ? JRA. */
 443
 444                 DATA_BLOB weak_session_key = ntlmssp_state->session_key;
 445                 /**
 446                   Weaken NTLMSSP keys to cope with down-level clients, servers and export restrictions.
 447                   We probably should have some parameters to control this, once we get NTLM2 working.
 448                 */
 449
 450                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
 451                         ;
 452                 } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
 453                         weak_session_key.length = 6;
 454                 } else { /* forty bits */
 455                         weak_session_key.length = 5;
 456                 }
 457                 dump_data_pw("NTLMSSP weakend master key:\n",
 458                                 weak_session_key.data,
 459                                 weak_session_key.length);
 460 #endif
 461
 462                 DATA_BLOB weak_session_key = ntlmssp_weaken_keys(ntlmssp_state, mem_ctx);
 463
 464                 DEBUG(5, ("NTLMSSP Sign/Seal - using NTLM1\n"));
 465
 466                 arcfour_init(&ntlmssp_state->ntlmv1_arc4_state,
 467                              &weak_session_key);
 468
 469                 dump_arc4_state("NTLMv1 arc4 state:\n",
 470                                 &ntlmssp_state->ntlmv1_arc4_state);
 471
 472                 ntlmssp_state->ntlmv1_seq_num = 0;
 473         }
 474
 475         TALLOC_FREE(mem_ctx);
 476         return NT_STATUS_OK;
 477 }