auth/ntlmssp/ntlmssp_sign.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Version 3.0
   4  *  NTLMSSP Signing routines
   5  *  Copyright (C) Andrew Bartlett 2003-2005
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 3 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "../auth/ntlmssp/ntlmssp.h"
  23 #include "../libcli/auth/libcli_auth.h"
  24 #include "../lib/crypto/md5.h"
  25 #include "../lib/crypto/hmacmd5.h"
  26 #include "zlib.h"
  27 #include "../auth/ntlmssp/ntlmssp_private.h"
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_AUTH
  31
  32 #define CLI_SIGN "session key to client-to-server signing key magic constant"
  33 #define CLI_SEAL "session key to client-to-server sealing key magic constant"
  34 #define SRV_SIGN "session key to server-to-client signing key magic constant"
  35 #define SRV_SEAL "session key to server-to-client sealing key magic constant"
  36
  37 /**
  38  * Some notes on the NTLM2 code:
  39  *
  40  * NTLM2 is a AEAD system.  This means that the data encrypted is not
  41  * all the data that is signed.  In DCE-RPC case, the headers of the
  42  * DCE-RPC packets are also signed.  This prevents some of the
  43  * fun-and-games one might have by changing them.
  44  *
  45  */
  46
  47 static void dump_arc4_state(const char *description,
  48                             struct arcfour_state *state)
  49 {
  50         dump_data_pw(description, state->sbox, sizeof(state->sbox));
  51 }
  52
  53 static void calc_ntlmv2_key(uint8_t subkey[16],
  54                             DATA_BLOB session_key,
  55                             const char *constant)
  56 {
  57         MD5_CTX ctx3;
  58         MD5Init(&ctx3);
  59         MD5Update(&ctx3, session_key.data, session_key.length);
  60         MD5Update(&ctx3, (const uint8_t *)constant, strlen(constant)+1);
  61         MD5Final(subkey, &ctx3);
  62 }
  63
  64 enum ntlmssp_direction {
  65         NTLMSSP_SEND,
  66         NTLMSSP_RECEIVE
  67 };
  68
  69 static NTSTATUS ntlmssp_make_packet_signature(struct ntlmssp_state *ntlmssp_state,
  70                                               TALLOC_CTX *sig_mem_ctx,
  71                                               const uint8_t *data, size_t length,
  72                                               const uint8_t *whole_pdu, size_t pdu_length,
  73                                               enum ntlmssp_direction direction,
  74                                               DATA_BLOB *sig, bool encrypt_sig)
  75 {
  76         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
  77                 HMACMD5Context ctx;
  78                 uint8_t digest[16];
  79                 uint8_t seq_num[4];
  80
  81                 *sig = data_blob_talloc(sig_mem_ctx, NULL, NTLMSSP_SIG_SIZE);
  82                 if (!sig->data) {
  83                         return NT_STATUS_NO_MEMORY;
  84                 }
  85
  86                 switch (direction) {
  87                 case NTLMSSP_SEND:
  88                         DEBUG(100,("ntlmssp_make_packet_signature: SEND seq = %u, len = %u, pdu_len = %u\n",
  89                                 ntlmssp_state->crypt->ntlm2.sending.seq_num,
  90                                 (unsigned int)length,
  91                                 (unsigned int)pdu_length));
  92
  93                         SIVAL(seq_num, 0, ntlmssp_state->crypt->ntlm2.sending.seq_num);
  94                         ntlmssp_state->crypt->ntlm2.sending.seq_num++;
  95                         hmac_md5_init_limK_to_64(ntlmssp_state->crypt->ntlm2.sending.sign_key, 16, &ctx);
  96                         break;
  97                 case NTLMSSP_RECEIVE:
  98
  99                         DEBUG(100,("ntlmssp_make_packet_signature: RECV seq = %u, len = %u, pdu_len = %u\n",
 100                                 ntlmssp_state->crypt->ntlm2.receiving.seq_num,
 101                                 (unsigned int)length,
 102                                 (unsigned int)pdu_length));
 103
 104                         SIVAL(seq_num, 0, ntlmssp_state->crypt->ntlm2.receiving.seq_num);
 105                         ntlmssp_state->crypt->ntlm2.receiving.seq_num++;
 106                         hmac_md5_init_limK_to_64(ntlmssp_state->crypt->ntlm2.receiving.sign_key, 16, &ctx);
 107                         break;
 108                 }
 109
 110                 dump_data_pw("pdu data ", whole_pdu, pdu_length);
 111
 112                 hmac_md5_update(seq_num, sizeof(seq_num), &ctx);
 113                 hmac_md5_update(whole_pdu, pdu_length, &ctx);
 114                 hmac_md5_final(digest, &ctx);
 115
 116                 if (encrypt_sig && (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
 117                         switch (direction) {
 118                         case NTLMSSP_SEND:
 119                                 arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
 120                                                    digest, 8);
 121                                 break;
 122                         case NTLMSSP_RECEIVE:
 123                                 arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.receiving.seal_state,
 124                                                    digest, 8);
 125                                 break;
 126                         }
 127                 }
 128
 129                 SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION);
 130                 memcpy(sig->data + 4, digest, 8);
 131                 memcpy(sig->data + 12, seq_num, 4);
 132
 133                 dump_data_pw("ntlmssp v2 sig ", sig->data, sig->length);
 134
 135         } else {
 136                 NTSTATUS status;
 137                 uint32_t crc;
 138
 139                 crc = crc32(0, Z_NULL, 0);
 140                 crc = crc32(crc, data, length);
 141
 142                 status = msrpc_gen(sig_mem_ctx,
 143                                sig, "dddd",
 144                                NTLMSSP_SIGN_VERSION, 0, crc,
 145                                ntlmssp_state->crypt->ntlm.seq_num);
 146                 if (!NT_STATUS_IS_OK(status)) {
 147                         return status;
 148                 }
 149
 150                 ntlmssp_state->crypt->ntlm.seq_num++;
 151
 152                 dump_arc4_state("ntlmssp hash: \n",
 153                                 &ntlmssp_state->crypt->ntlm.seal_state);
 154                 arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
 155                                    sig->data+4, sig->length-4);
 156         }
 157         return NT_STATUS_OK;
 158 }
 159
 160 NTSTATUS ntlmssp_sign_packet(struct ntlmssp_state *ntlmssp_state,
 161                              TALLOC_CTX *sig_mem_ctx,
 162                              const uint8_t *data, size_t length,
 163                              const uint8_t *whole_pdu, size_t pdu_length,
 164                              DATA_BLOB *sig)
 165 {
 166         NTSTATUS nt_status;
 167
 168         if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 169                 DEBUG(3, ("NTLMSSP Signing not negotiated - cannot sign packet!\n"));
 170                 return NT_STATUS_INVALID_PARAMETER;
 171         }
 172
 173         if (!ntlmssp_state->session_key.length) {
 174                 DEBUG(3, ("NO session key, cannot check sign packet\n"));
 175                 return NT_STATUS_NO_USER_SESSION_KEY;
 176         }
 177
 178         nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 179                                                   sig_mem_ctx,
 180                                                   data, length,
 181                                                   whole_pdu, pdu_length,
 182                                                   NTLMSSP_SEND, sig, true);
 183
 184         return nt_status;
 185 }
 186
 187 /**
 188  * Check the signature of an incoming packet
 189  * @note caller *must* check that the signature is the size it expects
 190  *
 191  */
 192
 193 NTSTATUS ntlmssp_check_packet(struct ntlmssp_state *ntlmssp_state,
 194                               const uint8_t *data, size_t length,
 195                               const uint8_t *whole_pdu, size_t pdu_length,
 196                               const DATA_BLOB *sig)
 197 {
 198         DATA_BLOB local_sig;
 199         NTSTATUS nt_status;
 200         TALLOC_CTX *tmp_ctx;
 201
 202         if (!ntlmssp_state->session_key.length) {
 203                 DEBUG(3, ("NO session key, cannot check packet signature\n"));
 204                 return NT_STATUS_NO_USER_SESSION_KEY;
 205         }
 206
 207         if (sig->length < 8) {
 208                 DEBUG(0, ("NTLMSSP packet check failed due to short signature (%lu bytes)!\n",
 209                           (unsigned long)sig->length));
 210         }
 211
 212         tmp_ctx = talloc_new(ntlmssp_state);
 213         if (!tmp_ctx) {
 214                 return NT_STATUS_NO_MEMORY;
 215         }
 216
 217         nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 218                                                   tmp_ctx,
 219                                                   data, length,
 220                                                   whole_pdu, pdu_length,
 221                                                   NTLMSSP_RECEIVE,
 222                                                   &local_sig, true);
 223
 224         if (!NT_STATUS_IS_OK(nt_status)) {
 225                 DEBUG(0,("NTLMSSP packet sig creation failed with %s\n",
 226                          nt_errstr(nt_status)));
 227                 talloc_free(tmp_ctx);
 228                 return nt_status;
 229         }
 230
 231         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 232                 if (local_sig.length != sig->length ||
 233                     memcmp(local_sig.data, sig->data, sig->length) != 0) {
 234                         DEBUG(5, ("BAD SIG NTLM2: wanted signature of\n"));
 235                         dump_data(5, local_sig.data, local_sig.length);
 236
 237                         DEBUG(5, ("BAD SIG: got signature of\n"));
 238                         dump_data(5, sig->data, sig->length);
 239
 240                         DEBUG(0, ("NTLMSSP NTLM2 packet check failed due to invalid signature!\n"));
 241                         talloc_free(tmp_ctx);
 242                         return NT_STATUS_ACCESS_DENIED;
 243                 }
 244         } else {
 245                 if (local_sig.length != sig->length ||
 246                     memcmp(local_sig.data + 8, sig->data + 8, sig->length - 8) != 0) {
 247                         DEBUG(5, ("BAD SIG NTLM1: wanted signature of\n"));
 248                         dump_data(5, local_sig.data, local_sig.length);
 249
 250                         DEBUG(5, ("BAD SIG: got signature of\n"));
 251                         dump_data(5, sig->data, sig->length);
 252
 253                         DEBUG(0, ("NTLMSSP NTLM1 packet check failed due to invalid signature!\n"));
 254                         talloc_free(tmp_ctx);
 255                         return NT_STATUS_ACCESS_DENIED;
 256                 }
 257         }
 258         dump_data_pw("checked ntlmssp signature\n", sig->data, sig->length);
 259         DEBUG(10,("ntlmssp_check_packet: NTLMSSP signature OK !\n"));
 260
 261         talloc_free(tmp_ctx);
 262         return NT_STATUS_OK;
 263 }
 264
 265 /**
 266  * Seal data with the NTLMSSP algorithm
 267  *
 268  */
 269
 270 NTSTATUS ntlmssp_seal_packet(struct ntlmssp_state *ntlmssp_state,
 271                              TALLOC_CTX *sig_mem_ctx,
 272                              uint8_t *data, size_t length,
 273                              const uint8_t *whole_pdu, size_t pdu_length,
 274                              DATA_BLOB *sig)
 275 {
 276         if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 277                 DEBUG(3, ("NTLMSSP Sealing not negotiated - cannot seal packet!\n"));
 278                 return NT_STATUS_INVALID_PARAMETER;
 279         }
 280
 281         if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 282                 DEBUG(3, ("NTLMSSP Sealing not negotiated - cannot seal packet!\n"));
 283                 return NT_STATUS_INVALID_PARAMETER;
 284         }
 285
 286         if (!ntlmssp_state->session_key.length) {
 287                 DEBUG(3, ("NO session key, cannot seal packet\n"));
 288                 return NT_STATUS_NO_USER_SESSION_KEY;
 289         }
 290
 291         DEBUG(10,("ntlmssp_seal_data: seal\n"));
 292         dump_data_pw("ntlmssp clear data\n", data, length);
 293         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 294                 NTSTATUS nt_status;
 295                 /*
 296                  * The order of these two operations matters - we
 297                  * must first seal the packet, then seal the
 298                  * sequence number - this is because the
 299                  * send_seal_hash is not constant, but is is rather
 300                  * updated with each iteration
 301                  */
 302                 nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 303                                                           sig_mem_ctx,
 304                                                           data, length,
 305                                                           whole_pdu, pdu_length,
 306                                                           NTLMSSP_SEND,
 307                                                           sig, false);
 308                 if (!NT_STATUS_IS_OK(nt_status)) {
 309                         return nt_status;
 310                 }
 311
 312                 arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
 313                                    data, length);
 314                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
 315                         arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
 316                                            sig->data+4, 8);
 317                 }
 318         } else {
 319                 NTSTATUS status;
 320                 uint32_t crc;
 321
 322                 crc = crc32(0, Z_NULL, 0);
 323                 crc = crc32(crc, data, length);
 324
 325                 status = msrpc_gen(sig_mem_ctx,
 326                                sig, "dddd",
 327                                NTLMSSP_SIGN_VERSION, 0, crc,
 328                                ntlmssp_state->crypt->ntlm.seq_num);
 329                 if (!NT_STATUS_IS_OK(status)) {
 330                         return status;
 331                 }
 332
 333                 /*
 334                  * The order of these two operations matters - we
 335                  * must first seal the packet, then seal the
 336                  * sequence number - this is because the ntlmv1_arc4_state
 337                  * is not constant, but is is rather updated with
 338                  * each iteration
 339                  */
 340
 341                 dump_arc4_state("ntlmv1 arc4 state:\n",
 342                                 &ntlmssp_state->crypt->ntlm.seal_state);
 343                 arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
 344                                    data, length);
 345
 346                 dump_arc4_state("ntlmv1 arc4 state:\n",
 347                                 &ntlmssp_state->crypt->ntlm.seal_state);
 348
 349                 arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
 350                                    sig->data+4, sig->length-4);
 351
 352                 ntlmssp_state->crypt->ntlm.seq_num++;
 353         }
 354         dump_data_pw("ntlmssp signature\n", sig->data, sig->length);
 355         dump_data_pw("ntlmssp sealed data\n", data, length);
 356
 357         return NT_STATUS_OK;
 358 }
 359
 360 /**
 361  * Unseal data with the NTLMSSP algorithm
 362  *
 363  */
 364
 365 NTSTATUS ntlmssp_unseal_packet(struct ntlmssp_state *ntlmssp_state,
 366                                uint8_t *data, size_t length,
 367                                const uint8_t *whole_pdu, size_t pdu_length,
 368                                const DATA_BLOB *sig)
 369 {
 370         NTSTATUS status;
 371         if (!ntlmssp_state->session_key.length) {
 372                 DEBUG(3, ("NO session key, cannot unseal packet\n"));
 373                 return NT_STATUS_NO_USER_SESSION_KEY;
 374         }
 375
 376         DEBUG(10,("ntlmssp_unseal_packet: seal\n"));
 377         dump_data_pw("ntlmssp sealed data\n", data, length);
 378
 379         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 380                 /* First unseal the data. */
 381                 arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.receiving.seal_state,
 382                                    data, length);
 383                 dump_data_pw("ntlmv2 clear data\n", data, length);
 384         } else {
 385                 arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
 386                                    data, length);
 387                 dump_data_pw("ntlmv1 clear data\n", data, length);
 388         }
 389         status = ntlmssp_check_packet(ntlmssp_state,
 390                                       data, length,
 391                                       whole_pdu, pdu_length,
 392                                       sig);
 393
 394         if (!NT_STATUS_IS_OK(status)) {
 395                 DEBUG(1,("NTLMSSP packet check for unseal failed due to invalid signature on %llu bytes of input:\n",
 396                          (unsigned long long)length));
 397         }
 398         return status;
 399 }
 400
 401 NTSTATUS ntlmssp_wrap(struct ntlmssp_state *ntlmssp_state,
 402                       TALLOC_CTX *out_mem_ctx,
 403                       const DATA_BLOB *in,
 404                       DATA_BLOB *out)
 405 {
 406         NTSTATUS nt_status;
 407         DATA_BLOB sig;
 408
 409         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
 410                 if (in->length + NTLMSSP_SIG_SIZE < in->length) {
 411                         return NT_STATUS_INVALID_PARAMETER;
 412                 }
 413
 414                 *out = data_blob_talloc(out_mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
 415                 if (!out->data) {
 416                         return NT_STATUS_NO_MEMORY;
 417                 }
 418                 memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
 419
 420                 nt_status = ntlmssp_seal_packet(ntlmssp_state, out_mem_ctx,
 421                                                 out->data + NTLMSSP_SIG_SIZE,
 422                                                 out->length - NTLMSSP_SIG_SIZE,
 423                                                 out->data + NTLMSSP_SIG_SIZE,
 424                                                 out->length - NTLMSSP_SIG_SIZE,
 425                                                 &sig);
 426
 427                 if (NT_STATUS_IS_OK(nt_status)) {
 428                         memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
 429                         talloc_free(sig.data);
 430                 }
 431                 return nt_status;
 432
 433         } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
 434                 if (in->length + NTLMSSP_SIG_SIZE < in->length) {
 435                         return NT_STATUS_INVALID_PARAMETER;
 436                 }
 437
 438                 *out = data_blob_talloc(out_mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
 439                 if (!out->data) {
 440                         return NT_STATUS_NO_MEMORY;
 441                 }
 442                 memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
 443
 444                 nt_status = ntlmssp_sign_packet(ntlmssp_state, out_mem_ctx,
 445                                                 out->data + NTLMSSP_SIG_SIZE,
 446                                                 out->length - NTLMSSP_SIG_SIZE,
 447                                                 out->data + NTLMSSP_SIG_SIZE,
 448                                                 out->length - NTLMSSP_SIG_SIZE,
 449                                                 &sig);
 450
 451                 if (NT_STATUS_IS_OK(nt_status)) {
 452                         memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
 453                         talloc_free(sig.data);
 454                 }
 455                 return nt_status;
 456         } else {
 457                 *out = data_blob_talloc(out_mem_ctx, in->data, in->length);
 458                 if (!out->data) {
 459                         return NT_STATUS_NO_MEMORY;
 460                 }
 461                 return NT_STATUS_OK;
 462         }
 463 }
 464
 465 NTSTATUS ntlmssp_unwrap(struct ntlmssp_state *ntlmssp_state,
 466                         TALLOC_CTX *out_mem_ctx,
 467                         const DATA_BLOB *in,
 468                         DATA_BLOB *out)
 469 {
 470         DATA_BLOB sig;
 471
 472         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
 473                 if (in->length < NTLMSSP_SIG_SIZE) {
 474                         return NT_STATUS_INVALID_PARAMETER;
 475                 }
 476                 sig.data = in->data;
 477                 sig.length = NTLMSSP_SIG_SIZE;
 478
 479                 *out = data_blob_talloc(out_mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
 480
 481                 return ntlmssp_unseal_packet(ntlmssp_state,
 482                                              out->data, out->length,
 483                                              out->data, out->length,
 484                                              &sig);
 485
 486         } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
 487                 if (in->length < NTLMSSP_SIG_SIZE) {
 488                         return NT_STATUS_INVALID_PARAMETER;
 489                 }
 490                 sig.data = in->data;
 491                 sig.length = NTLMSSP_SIG_SIZE;
 492
 493                 *out = data_blob_talloc(out_mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
 494
 495                 return ntlmssp_check_packet(ntlmssp_state,
 496                                             out->data, out->length,
 497                                             out->data, out->length,
 498                                             &sig);
 499         } else {
 500                 *out = data_blob_talloc(out_mem_ctx, in->data, in->length);
 501                 if (!out->data) {
 502                         return NT_STATUS_NO_MEMORY;
 503                 }
 504                 return NT_STATUS_OK;
 505         }
 506 }
 507
 508 /**
 509    Initialise the state for NTLMSSP signing.
 510 */
 511 NTSTATUS ntlmssp_sign_reset(struct ntlmssp_state *ntlmssp_state,
 512                             bool reset_seqnums)
 513 {
 514         DEBUG(3, ("NTLMSSP Sign/Seal - Initialising with flags:\n"));
 515         debug_ntlmssp_flags(ntlmssp_state->neg_flags);
 516
 517         if (ntlmssp_state->crypt == NULL) {
 518                 return NT_STATUS_INVALID_PARAMETER_MIX;
 519         }
 520
 521         if (ntlmssp_state->force_wrap_seal &&
 522             (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN))
 523         {
 524                 /*
 525                  * We need to handle NTLMSSP_NEGOTIATE_SIGN as
 526                  * NTLMSSP_NEGOTIATE_SEAL if GENSEC_FEATURE_LDAP_STYLE
 527                  * is requested.
 528                  *
 529                  * The negotiation of flags (and authentication)
 530                  * is completed when ntlmssp_sign_init() is called
 531                  * so we can safely pretent NTLMSSP_NEGOTIATE_SEAL
 532                  * was negotiated.
 533                  */
 534                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
 535         }
 536
 537         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 538                 DATA_BLOB weak_session_key = ntlmssp_state->session_key;
 539                 const char *send_sign_const;
 540                 const char *send_seal_const;
 541                 const char *recv_sign_const;
 542                 const char *recv_seal_const;
 543                 uint8_t send_seal_key[16];
 544                 DATA_BLOB send_seal_blob = data_blob_const(send_seal_key,
 545                                            sizeof(send_seal_key));
 546                 uint8_t recv_seal_key[16];
 547                 DATA_BLOB recv_seal_blob = data_blob_const(recv_seal_key,
 548                                            sizeof(recv_seal_key));
 549
 550                 switch (ntlmssp_state->role) {
 551                 case NTLMSSP_CLIENT:
 552                         send_sign_const = CLI_SIGN;
 553                         send_seal_const = CLI_SEAL;
 554                         recv_sign_const = SRV_SIGN;
 555                         recv_seal_const = SRV_SEAL;
 556                         break;
 557                 case NTLMSSP_SERVER:
 558                         send_sign_const = SRV_SIGN;
 559                         send_seal_const = SRV_SEAL;
 560                         recv_sign_const = CLI_SIGN;
 561                         recv_seal_const = CLI_SEAL;
 562                         break;
 563                 default:
 564                         return NT_STATUS_INTERNAL_ERROR;
 565                 }
 566
 567                 /*
 568                  * Weaken NTLMSSP keys to cope with down-level
 569                  * clients, servers and export restrictions.
 570                  *
 571                  * We probably should have some parameters to
 572                  * control this, once we get NTLM2 working.
 573                  *
 574                  * Key weakening was not performed on the master key
 575                  * for NTLM2, but must be done on the encryption subkeys only.
 576                  */
 577
 578                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
 579                         /* nothing to do */
 580                 } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
 581                         weak_session_key.length = 7;
 582                 } else { /* forty bits */
 583                         weak_session_key.length = 5;
 584                 }
 585
 586                 dump_data_pw("NTLMSSP weakend master key:\n",
 587                              weak_session_key.data,
 588                              weak_session_key.length);
 589
 590                 /* SEND: sign key */
 591                 calc_ntlmv2_key(ntlmssp_state->crypt->ntlm2.sending.sign_key,
 592                                 ntlmssp_state->session_key, send_sign_const);
 593                 dump_data_pw("NTLMSSP send sign key:\n",
 594                              ntlmssp_state->crypt->ntlm2.sending.sign_key, 16);
 595
 596                 /* SEND: seal ARCFOUR pad */
 597                 calc_ntlmv2_key(send_seal_key,
 598                                 weak_session_key, send_seal_const);
 599                 dump_data_pw("NTLMSSP send seal key:\n", send_seal_key, 16);
 600
 601                 arcfour_init(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
 602                              &send_seal_blob);
 603
 604                 dump_arc4_state("NTLMSSP send seal arc4 state:\n",
 605                                 &ntlmssp_state->crypt->ntlm2.sending.seal_state);
 606
 607                 /* SEND: seq num */
 608                 if (reset_seqnums) {
 609                         ntlmssp_state->crypt->ntlm2.sending.seq_num = 0;
 610                 }
 611
 612                 /* RECV: sign key */
 613                 calc_ntlmv2_key(ntlmssp_state->crypt->ntlm2.receiving.sign_key,
 614                                 ntlmssp_state->session_key, recv_sign_const);
 615                 dump_data_pw("NTLMSSP recv sign key:\n",
 616                              ntlmssp_state->crypt->ntlm2.receiving.sign_key, 16);
 617
 618                 /* RECV: seal ARCFOUR pad */
 619                 calc_ntlmv2_key(recv_seal_key,
 620                                 weak_session_key, recv_seal_const);
 621                 dump_data_pw("NTLMSSP recv seal key:\n", recv_seal_key, 16);
 622
 623                 arcfour_init(&ntlmssp_state->crypt->ntlm2.receiving.seal_state,
 624                              &recv_seal_blob);
 625
 626                 dump_arc4_state("NTLMSSP recv seal arc4 state:\n",
 627                                 &ntlmssp_state->crypt->ntlm2.receiving.seal_state);
 628
 629                 /* RECV: seq num */
 630                 if (reset_seqnums) {
 631                         ntlmssp_state->crypt->ntlm2.receiving.seq_num = 0;
 632                 }
 633         } else {
 634                 uint8_t weak_session_key[8];
 635                 DATA_BLOB seal_session_key = ntlmssp_state->session_key;
 636                 bool do_weak = false;
 637
 638                 DEBUG(5, ("NTLMSSP Sign/Seal - using NTLM1\n"));
 639
 640                 /*
 641                  * Key weakening not performed on the master key for NTLM2
 642                  * and does not occour for NTLM1. Therefore we only need
 643                  * to do this for the LM_KEY.
 644                  */
 645                 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
 646                         do_weak = true;
 647                 }
 648
 649                 /*
 650                  * Nothing to weaken.
 651                  * We certainly don't want to 'extend' the length...
 652                  */
 653                 if (seal_session_key.length < 16) {
 654                         /* TODO: is this really correct? */
 655                         do_weak = false;
 656                 }
 657
 658                 if (do_weak) {
 659                         memcpy(weak_session_key, seal_session_key.data, 8);
 660                         seal_session_key = data_blob_const(weak_session_key, 8);
 661
 662                         /*
 663                          * LM key doesn't support 128 bit crypto, so this is
 664                          * the best we can do. If you negotiate 128 bit, but
 665                          * not 56, you end up with 40 bit...
 666                          */
 667                         if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
 668                                 weak_session_key[7] = 0xa0;
 669                         } else { /* forty bits */
 670                                 weak_session_key[5] = 0xe5;
 671                                 weak_session_key[6] = 0x38;
 672                                 weak_session_key[7] = 0xb0;
 673                         }
 674                 }
 675
 676                 arcfour_init(&ntlmssp_state->crypt->ntlm.seal_state,
 677                              &seal_session_key);
 678
 679                 dump_arc4_state("NTLMv1 arc4 state:\n",
 680                                 &ntlmssp_state->crypt->ntlm.seal_state);
 681
 682                 if (reset_seqnums) {
 683                         ntlmssp_state->crypt->ntlm.seq_num = 0;
 684                 }
 685         }
 686
 687         return NT_STATUS_OK;
 688 }
 689
 690 NTSTATUS ntlmssp_sign_init(struct ntlmssp_state *ntlmssp_state)
 691 {
 692         if (ntlmssp_state->session_key.length < 8) {
 693                 DEBUG(3, ("NO session key, cannot initialise signing\n"));
 694                 return NT_STATUS_NO_USER_SESSION_KEY;
 695         }
 696
 697         ntlmssp_state->crypt = talloc_zero(ntlmssp_state,
 698                                            union ntlmssp_crypt_state);
 699         if (ntlmssp_state->crypt == NULL) {
 700                 return NT_STATUS_NO_MEMORY;
 701         }
 702
 703         return ntlmssp_sign_reset(ntlmssp_state, true);
 704 }