#endif
if (lm_interactive_pwd)
- SamOEMhash((uint8_t *)lm_pwd, key, sizeof(lm_pwd));
+ arcfour_crypt((uint8_t *)lm_pwd, key, sizeof(lm_pwd));
if (nt_interactive_pwd)
- SamOEMhash((uint8_t *)nt_pwd, key, sizeof(nt_pwd));
+ arcfour_crypt((uint8_t *)nt_pwd, key, sizeof(nt_pwd));
#ifdef DEBUG_PASSWORD
DEBUG(100,("decrypt of lm owf password:"));
/***********************************************************************
the rfc 2104 version of hmac_md5 initialisation.
***********************************************************************/
-void hmac_md5_init_rfc2104(uint8_t *key, int key_len, HMACMD5Context *ctx)
+void hmac_md5_init_rfc2104(const uint8_t *key, int key_len, HMACMD5Context *ctx)
{
int i;
#include "includes.h"
/*
- initialise the credentials state
+ initialise the credentials state for old-style 64 bit session keys
this call is made after the netr_ServerReqChallenge call
*/
-static void creds_init(struct creds_CredentialState *creds,
- const struct netr_Credential *client_challenge,
- const struct netr_Credential *server_challenge,
- const uint8_t machine_password[16])
+static void creds_init_64bit(struct creds_CredentialState *creds,
+ const struct netr_Credential *client_challenge,
+ const struct netr_Credential *server_challenge,
+ const uint8_t machine_password[16])
{
- struct netr_Credential time_cred;
uint32_t sum[2];
uint8_t sum2[8];
- dump_data_pw("Client chall", client_challenge->data, sizeof(client_challenge->data));
- dump_data_pw("Server chall", server_challenge->data, sizeof(server_challenge->data));
- dump_data_pw("Machine Pass", machine_password, 16);
-
sum[0] = IVAL(client_challenge->data, 0) + IVAL(server_challenge->data, 0);
sum[1] = IVAL(client_challenge->data, 4) + IVAL(server_challenge->data, 4);
SIVAL(sum2,0,sum[0]);
SIVAL(sum2,4,sum[1]);
- cred_hash1(creds->session_key, sum2, machine_password);
+ ZERO_STRUCT(creds->session_key);
- SIVAL(time_cred.data, 0, IVAL(client_challenge->data, 0));
- SIVAL(time_cred.data, 4, IVAL(client_challenge->data, 4));
- cred_hash2(creds->client.data, time_cred.data, creds->session_key, 1);
+ des_crypt128(creds->session_key, sum2, machine_password);
- SIVAL(time_cred.data, 0, IVAL(server_challenge->data, 0));
- SIVAL(time_cred.data, 4, IVAL(server_challenge->data, 4));
- cred_hash2(creds->server.data, time_cred.data, creds->session_key, 1);
+ des_crypt112(creds->client.data, client_challenge->data, creds->session_key, 1);
+ des_crypt112(creds->server.data, server_challenge->data, creds->session_key, 1);
+
+ creds->seed = creds->client;
+}
+
+/*
+ initialise the credentials state for ADS-style 128 bit session keys
+
+ this call is made after the netr_ServerReqChallenge call
+*/
+static void creds_init_128bit(struct creds_CredentialState *creds,
+ const struct netr_Credential *client_challenge,
+ const struct netr_Credential *server_challenge,
+ const uint8_t machine_password[16])
+{
+ unsigned char zero[4], tmp[16];
+ HMACMD5Context ctx;
+ struct MD5Context md5;
+
+ ZERO_STRUCT(creds->session_key);
+
+ memset(zero, 0, sizeof(zero));
+
+ hmac_md5_init_rfc2104(machine_password, 16, &ctx);
+ MD5Init(&md5);
+ MD5Update(&md5, zero, sizeof(zero));
+ MD5Update(&md5, client_challenge->data, 8);
+ MD5Update(&md5, server_challenge->data, 8);
+ MD5Final(tmp, &md5);
+ hmac_md5_update(tmp, 16, &ctx);
+ hmac_md5_final(creds->session_key, &ctx);
+
+ creds->client = *client_challenge;
+ creds->server = *server_challenge;
+
+ des_crypt112(creds->client.data, client_challenge->data, creds->session_key, 1);
+ des_crypt112(creds->server.data, server_challenge->data, creds->session_key, 1);
creds->seed = creds->client;
}
DEBUG(5,("\tseed+time %08x:%08x\n", IVAL(time_cred.data, 0), IVAL(time_cred.data, 4)));
- cred_hash2(creds->client.data, time_cred.data, creds->session_key, 1);
+ des_crypt112(creds->client.data, time_cred.data, creds->session_key, 1);
DEBUG(5,("\tCLIENT %08x:%08x\n",
IVAL(creds->client.data, 0), IVAL(creds->client.data, 4)));
DEBUG(5,("\tseed+time+1 %08x:%08x\n",
IVAL(time_cred.data, 0), IVAL(time_cred.data, 4)));
- cred_hash2(creds->server.data, time_cred.data, creds->session_key, 1);
+ des_crypt112(creds->server.data, time_cred.data, creds->session_key, 1);
DEBUG(5,("\tSERVER %08x:%08x\n",
IVAL(creds->server.data, 0), IVAL(creds->server.data, 4)));
void creds_des_encrypt(struct creds_CredentialState *creds, struct netr_Password *pass)
{
struct netr_Password tmp;
- cred_hash3(tmp.data, pass->data, creds->session_key, 1);
+ des_crypt112_16(tmp.data, pass->data, creds->session_key, 1);
*pass = tmp;
}
void creds_des_decrypt(struct creds_CredentialState *creds, struct netr_Password *pass)
{
struct netr_Password tmp;
- cred_hash3(tmp.data, pass->data, creds->session_key, 0);
+ des_crypt112_16(tmp.data, pass->data, creds->session_key, 0);
*pass = tmp;
}
*/
void creds_arcfour_crypt(struct creds_CredentialState *creds, char *data, size_t len)
{
- DATA_BLOB session_key = data_blob(NULL, 16);
-
- memcpy(&session_key.data[0], creds->session_key, 8);
- memset(&session_key.data[8], '\0', 8);
+ DATA_BLOB session_key = data_blob(creds->session_key, 16);
- SamOEMhashBlob(data, len, &session_key);
+ arcfour_crypt_blob(data, len, &session_key);
data_blob_free(&session_key);
}
const struct netr_Credential *client_challenge,
const struct netr_Credential *server_challenge,
const uint8_t machine_password[16],
- struct netr_Credential *initial_credential)
+ struct netr_Credential *initial_credential,
+ uint32_t negotiate_flags)
{
creds->sequence = time(NULL);
- creds_init(creds, client_challenge, server_challenge, machine_password);
+ creds->negotiate_flags = negotiate_flags;
+
+ dump_data_pw("Client chall", client_challenge->data, sizeof(client_challenge->data));
+ dump_data_pw("Server chall", server_challenge->data, sizeof(server_challenge->data));
+ dump_data_pw("Machine Pass", machine_password, 16);
+
+ if (negotiate_flags & NETLOGON_NEG_128BIT) {
+ creds_init_128bit(creds, client_challenge, server_challenge, machine_password);
+ } else {
+ creds_init_64bit(creds, client_challenge, server_challenge, machine_password);
+ }
+
+ dump_data_pw("Session key", creds->session_key, 16);
+ dump_data_pw("Credential ", creds->client.data, 8);
*initial_credential = creds->client;
}
const struct netr_Credential *client_challenge,
const struct netr_Credential *server_challenge,
const uint8_t machine_password[16],
- struct netr_Credential *initial_credential)
+ struct netr_Credential *initial_credential,
+ uint32_t negotiate_flags)
{
- creds_init(creds, client_challenge, server_challenge, machine_password);
+ if (negotiate_flags & NETLOGON_NEG_128BIT) {
+ creds_init_128bit(creds, client_challenge, server_challenge,
+ machine_password);
+ } else {
+ creds_init_64bit(creds, client_challenge, server_challenge,
+ machine_password);
+ }
*initial_credential = creds->server;
}
*/
struct creds_CredentialState {
- uint8_t session_key[8];
+ uint32_t negotiate_flags;
+ uint8_t session_key[16];
uint32_t sequence;
struct netr_Credential seed;
struct netr_Credential client;
};
+#define NETLOGON_NEG_128BIT 0x4000
+
+
/* for the timebeing, use the same neg flags as Samba3. */
/* The 7 here seems to be required to get Win2k not to downgrade us
to NT4. Actually, anything other than 1ff would seem to do... */
dump_data_pw("KEY_EXCH session key (enc):\n",
ntlmssp_state->encrypted_session_key.data,
ntlmssp_state->encrypted_session_key.length);
- SamOEMhash(ntlmssp_state->encrypted_session_key.data,
- session_key.data,
- ntlmssp_state->encrypted_session_key.length);
+ arcfour_crypt(ntlmssp_state->encrypted_session_key.data,
+ session_key.data,
+ ntlmssp_state->encrypted_session_key.length);
ntlmssp_state->session_key = data_blob_talloc(ntlmssp_state->mem_ctx,
ntlmssp_state->encrypted_session_key.data,
ntlmssp_state->encrypted_session_key.length);
encrypted_session_key = data_blob_talloc(ntlmssp_state->mem_ctx,
client_session_key, sizeof(client_session_key));
dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length);
- SamOEMhash(encrypted_session_key.data, session_key.data, encrypted_session_key.length);
+ arcfour_crypt(encrypted_session_key.data, session_key.data, encrypted_session_key.length);
dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
/* Mark the new session key as the 'real' session key */
hmac_md5(state->session_key, zeros, sizeof(zeros), digest1);
hmac_md5(digest1, packet_digest, 8, sequence_key);
- SamOEMhash(seq_num, sequence_key, 8);
+ arcfour_crypt(seq_num, sequence_key, 8);
state->seq_num++;
}
SIVAL(seq_num, 4, state->initiator?0:0x80);
netsec_get_sealing_key(state->session_key, seq_num, sealing_key);
- SamOEMhash(confounder, sealing_key, 8);
- SamOEMhash(data, sealing_key, length);
+ arcfour_crypt(confounder, sealing_key, 8);
+ arcfour_crypt(data, sealing_key, length);
schannel_digest(state->session_key,
netsec_sig, confounder,
data, length, digest_final);
netsec_get_sealing_key(state->session_key, seq_num, sealing_key);
- SamOEMhash(confounder, sealing_key, 8);
- SamOEMhash(data, sealing_key, length);
+ arcfour_crypt(confounder, sealing_key, 8);
+ arcfour_crypt(data, sealing_key, length);
netsec_deal_with_seq_num(state, digest_final, seq_num);
}
memcpy(key, &session_key->data[k], 7);
- smbhash(bout, bin, key, forward?1:0);
+ des_crypt56(bout, bin, key, forward?1:0);
memcpy(&out->data[i], bout, MIN(8, in->length-i));
}
}
}
-
-void smbhash(uint8_t *out, const uint8_t *in, const uint8_t *key, int forw)
+/*
+ basic des crypt using a 56 bit (7 byte) key
+*/
+void des_crypt56(uint8_t out[8], const uint8_t in[8], const uint8_t key[7], int forw)
{
int i;
char outb[64];
void E_P16(const uint8_t *p14,uint8_t *p16)
{
const uint8_t sp8[8] = {0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25};
- smbhash(p16, sp8, p14, 1);
- smbhash(p16+8, sp8, p14+7, 1);
+ des_crypt56(p16, sp8, p14, 1);
+ des_crypt56(p16+8, sp8, p14+7, 1);
}
void E_P24(const uint8_t *p21, const uint8_t *c8, uint8_t *p24)
{
- smbhash(p24, c8, p21, 1);
- smbhash(p24+8, c8, p21+7, 1);
- smbhash(p24+16, c8, p21+14, 1);
+ des_crypt56(p24, c8, p21, 1);
+ des_crypt56(p24+8, c8, p21+7, 1);
+ des_crypt56(p24+16, c8, p21+14, 1);
}
void D_P16(const uint8_t *p14, const uint8_t *in, uint8_t *out)
{
- smbhash(out, in, p14, 0);
- smbhash(out+8, in+8, p14+7, 0);
+ des_crypt56(out, in, p14, 0);
+ des_crypt56(out+8, in+8, p14+7, 0);
}
void E_old_pw_hash( uint8_t *p14, const uint8_t *in, uint8_t *out)
{
- smbhash(out, in, p14, 1);
- smbhash(out+8, in+8, p14+7, 1);
+ des_crypt56(out, in, p14, 1);
+ des_crypt56(out+8, in+8, p14+7, 1);
}
-void cred_hash1(uint8_t *out, const uint8_t *in, const uint8_t *key)
+/* des encryption with a 128 bit key */
+void des_crypt128(uint8_t out[8], const uint8_t in[8], const uint8_t key[16])
{
uint8_t buf[8];
-
- smbhash(buf, in, key, 1);
- smbhash(out, buf, key+9, 1);
+ des_crypt56(buf, in, key, 1);
+ des_crypt56(out, buf, key+9, 1);
}
-void cred_hash2(uint8_t *out, const uint8_t *in, const uint8_t *key, int forw)
+/* des encryption with a 64 bit key */
+void des_crypt64(uint8_t out[8], const uint8_t in[8], const uint8_t key[8], int forw)
{
uint8_t buf[8];
uint8_t key2[8];
ZERO_STRUCT(key2);
- smbhash(buf, in, key, forw);
+ des_crypt56(buf, in, key, forw);
key2[0] = key[7];
- smbhash(out, buf, key2, forw);
+ des_crypt56(out, buf, key2, forw);
}
-void cred_hash3(uint8_t *out, uint8_t *in, const uint8_t *key, int forw)
+/* des encryption with a 112 bit (14 byte) key */
+void des_crypt112(uint8_t out[8], const uint8_t in[8], const uint8_t key[14], int forw)
{
- uint8_t key2[8];
- ZERO_STRUCT(key2);
- smbhash(out, in, key, forw);
- key2[0] = key[7];
- smbhash(out + 8, in + 8, key2, forw);
+ uint8_t buf[8];
+ des_crypt56(buf, in, key, forw);
+ des_crypt56(out, buf, key+7, forw);
}
+/* des encryption of a 16 byte lump of data with a 112 bit key */
+void des_crypt112_16(uint8_t out[16], uint8_t in[16], const uint8_t key[14], int forw)
+{
+ des_crypt56(out, in, key, forw);
+ des_crypt56(out + 8, in + 8, key+7, forw);
+}
-void SamOEMhashBlob(uint8_t *data, int len, const DATA_BLOB *key)
+/*
+ arcfour encryption with a blob key
+*/
+void arcfour_crypt_blob(uint8_t *data, int len, const DATA_BLOB *key)
{
uint8_t s_box[256];
uint8_t index_i = 0;
a varient that assumes a 16 byte key. This should be removed
when the last user is gone
*/
-void SamOEMhash(uint8_t *data, const uint8_t keystr[16], int len)
+void arcfour_crypt(uint8_t *data, const uint8_t keystr[16], int len)
{
DATA_BLOB key = data_blob(keystr, 16);
- SamOEMhashBlob(data, len, &key);
+ arcfour_crypt_blob(data, len, &key);
data_blob_free(&key);
}
s[2] = s[6] = s[10] = (uint8_t)((rid >> 16) & 0xFF);
s[3] = s[7] = s[11] = (uint8_t)((rid >> 24) & 0xFF);
- smbhash(out, in, s, forw);
- smbhash(out+8, in+8, s+7, forw);
+ des_crypt56(out, in, s, forw);
+ des_crypt56(out+8, in+8, s+7, forw);
}
step 3 - authenticate on the netlogon pipe
*/
E_md4hash(password, mach_pwd);
- creds_client_init(&creds, &credentials1, &credentials2, mach_pwd, &credentials3);
+ creds_client_init(&creds, &credentials1, &credentials2, mach_pwd, &credentials3,
+ negotiate_flags);
a.in.server_name = r.in.server_name;
a.in.username = talloc_asprintf(p->mem_ctx, "%s$", workstation);
ADD_OBJ_FILES = \
rpc_server/dcerpc_tcp.o \
rpc_server/dcesrv_auth.o \
+ rpc_server/dcesrv_crypto.o \
rpc_server/handles.o
#
# End SUBSYSTEM DCERPC
(*p)->cli_max_recv_frag = 0;
(*p)->handles = NULL;
(*p)->partial_input = data_blob(NULL, 0);
- (*p)->auth_state.ntlmssp_state = NULL;
+ (*p)->auth_state.crypto_state = NULL;
(*p)->auth_state.auth_info = NULL;
(*p)->session_key = data_blob(NULL, 0);
/* hold the authentication state information */
struct dcesrv_auth {
- struct auth_ntlmssp_state *ntlmssp_state;
+ void *crypto_state;
struct dcerpc_auth *auth_info;
};
#include "includes.h"
-
/*
parse any auth information from a dcerpc bind request
return False if we can't handle the auth request for some
return False;
}
- if (dce_conn->auth_state.auth_info->auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
- /* only do NTLMSSP for now */
- DEBUG(2,("auth_type %d not supported\n", dce_conn->auth_state.auth_info->auth_type));
- return False;
- }
-
- if (dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_INTEGRITY &&
- dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
- DEBUG(2,("auth_level %d not supported\n", dce_conn->auth_state.auth_info->auth_level));
- return False;
- }
-
- status = auth_ntlmssp_start(&dce_conn->auth_state.ntlmssp_state);
+ status = dcesrv_crypto_startup(dce_conn, &dce_conn->auth_state);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(2, ("Failed to start NTLMSSP subsystem!\n"));
return False;
}
-
+
return True;
}
struct dcesrv_connection *dce_conn = call->conn;
NTSTATUS status;
- if (!call->conn->auth_state.ntlmssp_state) {
+ if (!call->conn->auth_state.crypto_state) {
return True;
}
- status = auth_ntlmssp_update(dce_conn->auth_state.ntlmssp_state,
- call->mem_ctx,
- dce_conn->auth_state.auth_info->credentials,
- &dce_conn->auth_state.auth_info->credentials);
+ status = dcesrv_crypto_update(&dce_conn->auth_state,
+ call->mem_ctx,
+ dce_conn->auth_state.auth_info->credentials,
+ &dce_conn->auth_state.auth_info->credentials);
if (!NT_STATUS_IS_OK(status) &&
!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
- DEBUG(2, ("Failed to start NTLMSSP process NTLMSSP negotiate: %s\n", nt_errstr(status)));
+ DEBUG(2, ("Failed to start dcesrv auth negotiate: %s\n", nt_errstr(status)));
return False;
}
/*
- process the final stage of a NTLMSSP auth request
+ process the final stage of a auth request
*/
BOOL dcesrv_auth_auth3(struct dcesrv_call_state *call)
{
NTSTATUS status;
if (!dce_conn->auth_state.auth_info ||
- !dce_conn->auth_state.ntlmssp_state ||
+ !dce_conn->auth_state.crypto_state ||
pkt->u.auth.auth_info.length == 0) {
return False;
}
return False;
}
- if (dce_conn->auth_state.auth_info->auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
- return False;
- }
- if (dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_INTEGRITY &&
- dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
- return False;
- }
-
- status = auth_ntlmssp_update(dce_conn->auth_state.ntlmssp_state,
- call->mem_ctx,
- dce_conn->auth_state.auth_info->credentials,
- &dce_conn->auth_state.auth_info->credentials);
+ status = dcesrv_crypto_update(&dce_conn->auth_state,
+ call->mem_ctx,
+ dce_conn->auth_state.auth_info->credentials,
+ &dce_conn->auth_state.auth_info->credentials);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(4, ("User failed to authenticated with NTLMSSP: %s\n", nt_errstr(status)));
+ DEBUG(4, ("dcesrv_auth_auth3: failed to authenticate: %s\n",
+ nt_errstr(status)));
return False;
}
NTSTATUS status;
if (!dce_conn->auth_state.auth_info ||
- !dce_conn->auth_state.ntlmssp_state) {
+ !dce_conn->auth_state.crypto_state) {
return True;
}
/* check signature or unseal the packet */
switch (dce_conn->auth_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
- status = ntlmssp_unseal_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
- call->mem_ctx,
- pkt->u.request.stub_and_verifier.data,
- pkt->u.request.stub_and_verifier.length,
- &auth.credentials);
- break;
-
- case DCERPC_AUTH_LEVEL_INTEGRITY:
- status = ntlmssp_check_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
+ status = dcesrv_crypto_unseal(&dce_conn->auth_state,
call->mem_ctx,
pkt->u.request.stub_and_verifier.data,
pkt->u.request.stub_and_verifier.length,
&auth.credentials);
break;
+ case DCERPC_AUTH_LEVEL_INTEGRITY:
+ status = dcesrv_crypto_check_sig(&dce_conn->auth_state,
+ call->mem_ctx,
+ pkt->u.request.stub_and_verifier.data,
+ pkt->u.request.stub_and_verifier.length,
+ &auth.credentials);
+ break;
+
default:
status = NT_STATUS_INVALID_LEVEL;
break;
struct ndr_push *ndr;
/* non-signed packets are simple */
- if (!dce_conn->auth_state.auth_info || !dce_conn->auth_state.ntlmssp_state) {
+ if (!dce_conn->auth_state.auth_info || !dce_conn->auth_state.crypto_state) {
status = dcerpc_push_auth(blob, call->mem_ctx, pkt, NULL);
return NT_STATUS_IS_OK(status);
}
/* sign or seal the packet */
switch (dce_conn->auth_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
- status = ntlmssp_seal_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
- call->mem_ctx,
- ndr->data + DCERPC_REQUEST_LENGTH,
- ndr->offset - DCERPC_REQUEST_LENGTH,
- &dce_conn->auth_state.auth_info->credentials);
+ status = dcesrv_crypto_seal(&dce_conn->auth_state,
+ call->mem_ctx,
+ ndr->data + DCERPC_REQUEST_LENGTH,
+ ndr->offset - DCERPC_REQUEST_LENGTH,
+ &dce_conn->auth_state.auth_info->credentials);
break;
case DCERPC_AUTH_LEVEL_INTEGRITY:
- status = ntlmssp_sign_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
- call->mem_ctx,
- ndr->data + DCERPC_REQUEST_LENGTH,
- ndr->offset - DCERPC_REQUEST_LENGTH,
- &dce_conn->auth_state.auth_info->credentials);
+ status = dcesrv_crypto_sign(&dce_conn->auth_state,
+ call->mem_ctx,
+ ndr->data + DCERPC_REQUEST_LENGTH,
+ ndr->offset - DCERPC_REQUEST_LENGTH,
+ &dce_conn->auth_state.auth_info->credentials);
break;
default:
status = NT_STATUS_INVALID_LEVEL;
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+
+ server side dcerpc authentication code - crypto support
+
+ Copyright (C) Andrew Tridgell 2004
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+/*
+ this provides a crypto interface to the various backends (such as
+ NTLMSSP and SCHANNEL) for the rpc server code
+*/
+
+#include "includes.h"
+
+/*
+ startup the cryptographic side of an authenticated dcerpc server
+*/
+NTSTATUS dcesrv_crypto_startup(struct dcesrv_connection *dce_conn,
+ struct dcesrv_auth *auth)
+{
+ struct auth_ntlmssp_state *ntlmssp = NULL;
+ NTSTATUS status;
+
+ if (auth->auth_info->auth_level != DCERPC_AUTH_LEVEL_INTEGRITY &&
+ auth->auth_info->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
+ DEBUG(2,("auth_level %d not supported in dcesrv auth\n",
+ auth->auth_info->auth_level));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ switch (auth->auth_info->auth_type) {
+/*
+ case DCERPC_AUTH_TYPE_SCHANNEL:
+ return auth_schannel_start();
+*/
+
+ case DCERPC_AUTH_TYPE_NTLMSSP:
+ status = auth_ntlmssp_start(&ntlmssp);
+ auth->crypto_state = ntlmssp;
+ break;
+
+ default:
+ DEBUG(2,("dcesrv auth_type %d not supported\n", auth->auth_info->auth_type));
+ status = NT_STATUS_INVALID_PARAMETER;
+ }
+
+ DEBUG(4,("dcesrv_crypto_startup: %s\n", nt_errstr(status)));
+
+ return status;
+}
+
+/*
+ update crypto state
+*/
+NTSTATUS dcesrv_crypto_update(struct dcesrv_auth *auth,
+ TALLOC_CTX *out_mem_ctx,
+ const DATA_BLOB in, DATA_BLOB *out)
+{
+ AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+ return ntlmssp_update(ntlmssp->ntlmssp_state, out_mem_ctx, in, out);
+}
+
+
+/*
+ seal a packet
+*/
+NTSTATUS dcesrv_crypto_seal(struct dcesrv_auth *auth,
+ TALLOC_CTX *sig_mem_ctx, uint8_t *data, size_t length, DATA_BLOB *sig)
+{
+ AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+ return ntlmssp_seal_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
+
+/*
+ sign a packet
+*/
+NTSTATUS dcesrv_crypto_sign(struct dcesrv_auth *auth,
+ TALLOC_CTX *sig_mem_ctx, const uint8_t *data, size_t length, DATA_BLOB *sig)
+{
+ AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+ return ntlmssp_sign_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
+
+/*
+ check a packet signature
+*/
+NTSTATUS dcesrv_crypto_check_sig(struct dcesrv_auth *auth,
+ TALLOC_CTX *sig_mem_ctx, const uint8_t *data, size_t length, const DATA_BLOB *sig)
+{
+ AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+ return ntlmssp_check_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
+
+/*
+ unseal a packet
+*/
+NTSTATUS dcesrv_crypto_unseal(struct dcesrv_auth *auth,
+ TALLOC_CTX *sig_mem_ctx, uint8_t *data, size_t length, DATA_BLOB *sig)
+{
+ AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+ return ntlmssp_unseal_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
twr->floors[4].lhs.protocol = EPM_PROTOCOL_IP;
twr->floors[4].lhs.info.lhs_data = data_blob(NULL, 0);
twr->floors[4].rhs.rhs_data = data_blob_talloc_zero(mem_ctx, 4);
+ /* TODO: we should fill in our IP address here as a hint to the
+ client */
break;
}
count = build_ep_list(mem_ctx, dce_call->conn->dce_ctx->endpoint_list, &eps);
- ZERO_STRUCTP(r->out.entry_handle);
+ ZERO_STRUCT(*r->out.entry_handle);
r->out.num_towers = 1;
r->out.status = 0;
r->out.towers = talloc_p(mem_ctx, struct epm_twr_p_t);
ZERO_STRUCTP(r->out.credentials);
*r->out.rid = 0;
- *r->out.negotiate_flags = *r->in.negotiate_flags & NETLOGON_NEG_AUTH2_FLAGS;
+ *r->out.negotiate_flags = *r->in.negotiate_flags;
if (!pipe_state) {
DEBUG(1, ("No challange requested by client, cannot authenticate\n"));
creds_server_init(pipe_state->creds, &pipe_state->client_challenge,
&pipe_state->server_challenge, mach_pwd,
- r->out.credentials);
-
+ r->out.credentials,
+ *r->in.negotiate_flags);
+
if (!creds_server_check(pipe_state->creds, r->in.credentials)) {
return NT_STATUS_ACCESS_DENIED;
}
}
pipe_state->computer_name = talloc_strdup(pipe_state->mem_ctx, r->in.computer_name);
-
- *r->out.negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
return NT_STATUS_OK;
}
}
/* decrypt the password we have been given */
- SamOEMhash(pwbuf->data, lm_pwd, 516);
+ arcfour_crypt(pwbuf->data, lm_pwd, 516);
if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
&new_pass_len, STR_ASCII)) {
}
/* decrypt the password we have been given */
- SamOEMhash(r->in.nt_password->data, nt_pwd, 516);
+ arcfour_crypt(r->in.nt_password->data, nt_pwd, 516);
if (!decode_pw_buffer(r->in.nt_password->data, new_pass, sizeof(new_pass),
&new_pass_len, STR_UNICODE)) {
uint32_t new_pass_len;
DATA_BLOB session_key = dce_call->conn->session_key;
- SamOEMhashBlob(pwbuf->data, 516, &session_key);
+ arcfour_crypt_blob(pwbuf->data, 516, &session_key);
if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
&new_pass_len, STR_UNICODE)) {
MD5Update(&ctx, session_key.data, session_key.length);
MD5Final(co_session_key.data, &ctx);
- SamOEMhashBlob(pwbuf->data, 516, &co_session_key);
+ arcfour_crypt_blob(pwbuf->data, 516, &co_session_key);
if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
&new_pass_len, STR_UNICODE)) {
return False;
}
- SamOEMhashBlob(u.info24.password.data, 516, &session_key);
+ arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
status = dcerpc_samr_SetUserInfo(join.p, mem_ctx, &s);
if (!NT_STATUS_IS_OK(status)) {
a.in.credentials = &credentials3;
a.out.credentials = &credentials3;
- creds_client_init(creds, &credentials1, &credentials2, mach_pwd, &credentials3);
+ creds_client_init(creds, &credentials1, &credentials2, mach_pwd, &credentials3,
+ NETLOGON_NEG_AUTH2_FLAGS);
printf("Testing ServerAuthenticate\n");
a.in.credentials = &credentials3;
a.out.credentials = &credentials3;
- creds_client_init(creds, &credentials1, &credentials2, mach_pwd, &credentials3);
+ creds_client_init(creds, &credentials1, &credentials2, mach_pwd, &credentials3,
+ negotiate_flags);
printf("Testing ServerAuthenticate2\n");
r.in.computer_name = TEST_MACHINE_NAME;
r.in.credentials = &credentials1;
r.out.credentials = &credentials2;
+
generate_random_buffer(credentials1.data, sizeof(credentials1.data), False);
status = dcerpc_netr_ServerReqChallenge(p, mem_ctx, &r);
a.out.negotiate_flags = &negotiate_flags;
a.out.rid = &rid;
- creds_client_init(creds, &credentials1, &credentials2, mach_pwd, &credentials3);
+ creds_client_init(creds, &credentials1, &credentials2, mach_pwd, &credentials3,
+ negotiate_flags);
printf("Testing ServerAuthenticate3\n");
return False;
}
- SamOEMhashBlob(u.info24.password.data, 516, &session_key);
+ arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
printf("Testing SetUserInfo level 24 (set password)\n");
return False;
}
- SamOEMhashBlob(u.info23.password.data, 516, &session_key);
+ arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
printf("Testing SetUserInfo level 23 (set password)\n");
MD5Update(&ctx, session_key.data, session_key.length);
MD5Final(confounded_session_key.data, &ctx);
- SamOEMhashBlob(u.info26.password.data, 516, &confounded_session_key);
+ arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
memcpy(&u.info26.password.data[516], confounder, 16);
printf("Testing SetUserInfo level 26 (set password ex)\n");
MD5Update(&ctx, session_key.data, session_key.length);
MD5Final(confounded_session_key.data, &ctx);
- SamOEMhashBlob(u.info25.password.data, 516, &confounded_session_key);
+ arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
memcpy(&u.info25.password.data[516], confounder, 16);
printf("Testing SetUserInfo level 25 (set password ex)\n");
E_deshash(newpass, new_lm_hash);
encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
- SamOEMhash(lm_pass.data, old_lm_hash, 516);
+ arcfour_crypt(lm_pass.data, old_lm_hash, 516);
E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
r.in.server = &server;
E_deshash(newpass, new_lm_hash);
encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
- SamOEMhash(lm_pass.data, old_lm_hash, 516);
+ arcfour_crypt(lm_pass.data, old_lm_hash, 516);
E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
- SamOEMhash(nt_pass.data, old_nt_hash, 516);
+ arcfour_crypt(nt_pass.data, old_nt_hash, 516);
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
r.in.server = &server;
E_deshash(newpass, new_lm_hash);
encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
- SamOEMhash(lm_pass.data, old_nt_hash, 516);
+ arcfour_crypt(lm_pass.data, old_nt_hash, 516);
E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
- SamOEMhash(nt_pass.data, old_nt_hash, 516);
+ arcfour_crypt(nt_pass.data, old_nt_hash, 516);
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
r.in.server = &server;
git.samba.org / gd / samba-autobuild / .git / commitdiff