2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2010
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "../libcli/auth/ntlmssp.h"
26 #include "../libcli/auth/ntlmssp_private.h"
27 #include "../libcli/auth/libcli_auth.h"
28 #include "../librpc/gen_ndr/ndr_ntlmssp.h"
29 #include "../libcli/auth/ntlmssp_ndr.h"
30 #include "../lib/crypto/md5.h"
31 #include "../lib/crypto/arcfour.h"
32 #include "../lib/crypto/hmacmd5.h"
34 static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state,
35 TALLOC_CTX *out_mem_ctx, /* Unused at this time */
36 DATA_BLOB reply, DATA_BLOB *next_request);
37 static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state,
38 TALLOC_CTX *out_mem_ctx, /* Unused at this time */
39 const DATA_BLOB reply, DATA_BLOB *next_request);
41 * Callbacks for NTLMSSP - for both client and server operating modes
45 static const struct ntlmssp_callbacks {
46 enum ntlmssp_role role;
47 enum ntlmssp_message_type ntlmssp_command;
48 NTSTATUS (*fn)(struct ntlmssp_state *ntlmssp_state,
49 TALLOC_CTX *out_mem_ctx,
50 DATA_BLOB in, DATA_BLOB *out);
51 } ntlmssp_callbacks[] = {
52 {NTLMSSP_CLIENT, NTLMSSP_INITIAL, ntlmssp_client_initial},
53 {NTLMSSP_SERVER, NTLMSSP_NEGOTIATE, ntlmssp_server_negotiate},
54 {NTLMSSP_CLIENT, NTLMSSP_CHALLENGE, ntlmssp_client_challenge},
55 {NTLMSSP_SERVER, NTLMSSP_AUTH, ntlmssp_server_auth},
56 {NTLMSSP_CLIENT, NTLMSSP_UNKNOWN, NULL},
57 {NTLMSSP_SERVER, NTLMSSP_UNKNOWN, NULL}
62 * Default challenge generation code.
66 static NTSTATUS get_challenge(const struct ntlmssp_state *ntlmssp_state,
69 generate_random_buffer(chal, 8);
74 * Default 'we can set the challenge to anything we like' implementation
78 static bool may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
84 * Default 'we can set the challenge to anything we like' implementation
86 * Does not actually do anything, as the value is always in the structure anyway.
90 static NTSTATUS set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
92 SMB_ASSERT(challenge->length == 8);
97 * Set a username on an NTLMSSP context - ensures it is talloc()ed
101 NTSTATUS ntlmssp_set_username(struct ntlmssp_state *ntlmssp_state, const char *user)
103 ntlmssp_state->user = talloc_strdup(ntlmssp_state, user ? user : "" );
104 if (!ntlmssp_state->user) {
105 return NT_STATUS_NO_MEMORY;
111 * Store NT and LM hashes on an NTLMSSP context - ensures they are talloc()ed
114 NTSTATUS ntlmssp_set_hashes(struct ntlmssp_state *ntlmssp_state,
115 const uint8_t lm_hash[16],
116 const uint8_t nt_hash[16])
118 ntlmssp_state->lm_hash = (uint8_t *)
119 TALLOC_MEMDUP(ntlmssp_state, lm_hash, 16);
120 ntlmssp_state->nt_hash = (uint8_t *)
121 TALLOC_MEMDUP(ntlmssp_state, nt_hash, 16);
122 if (!ntlmssp_state->lm_hash || !ntlmssp_state->nt_hash) {
123 TALLOC_FREE(ntlmssp_state->lm_hash);
124 TALLOC_FREE(ntlmssp_state->nt_hash);
125 return NT_STATUS_NO_MEMORY;
131 * Converts a password to the hashes on an NTLMSSP context.
134 NTSTATUS ntlmssp_set_password(struct ntlmssp_state *ntlmssp_state, const char *password)
137 ntlmssp_state->lm_hash = NULL;
138 ntlmssp_state->nt_hash = NULL;
143 E_deshash(password, lm_hash);
144 E_md4hash(password, nt_hash);
145 return ntlmssp_set_hashes(ntlmssp_state, lm_hash, nt_hash);
151 * Set a domain on an NTLMSSP context - ensures it is talloc()ed
154 NTSTATUS ntlmssp_set_domain(struct ntlmssp_state *ntlmssp_state, const char *domain)
156 ntlmssp_state->domain = talloc_strdup(ntlmssp_state,
157 domain ? domain : "" );
158 if (!ntlmssp_state->domain) {
159 return NT_STATUS_NO_MEMORY;
165 * Request features for the NTLMSSP negotiation
167 * @param ntlmssp_state NTLMSSP state
168 * @param feature_list List of space seperated features requested from NTLMSSP.
170 void ntlmssp_want_feature_list(struct ntlmssp_state *ntlmssp_state, char *feature_list)
173 * We need to set this to allow a later SetPassword
174 * via the SAMR pipe to succeed. Strange.... We could
175 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
177 if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list, True)) {
178 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
180 if (in_list("NTLMSSP_FEATURE_SIGN", feature_list, True)) {
181 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
183 if(in_list("NTLMSSP_FEATURE_SEAL", feature_list, True)) {
184 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
186 if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list, true)) {
187 ntlmssp_state->use_ccache = true;
192 * Request a feature for the NTLMSSP negotiation
194 * @param ntlmssp_state NTLMSSP state
195 * @param feature Bit flag specifying the requested feature
197 void ntlmssp_want_feature(struct ntlmssp_state *ntlmssp_state, uint32_t feature)
199 /* As per JRA's comment above */
200 if (feature & NTLMSSP_FEATURE_SESSION_KEY) {
201 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
203 if (feature & NTLMSSP_FEATURE_SIGN) {
204 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
206 if (feature & NTLMSSP_FEATURE_SEAL) {
207 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
209 if (feature & NTLMSSP_FEATURE_CCACHE) {
210 ntlmssp_state->use_ccache = true;
215 * Next state function for the NTLMSSP state machine
217 * @param ntlmssp_state NTLMSSP State
218 * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB
219 * @param out The reply, as an allocated DATA_BLOB, caller to free.
220 * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK.
223 NTSTATUS ntlmssp_update(struct ntlmssp_state *ntlmssp_state,
224 const DATA_BLOB input, DATA_BLOB *out)
226 uint32_t ntlmssp_command;
229 if (ntlmssp_state->expected_state == NTLMSSP_DONE) {
230 /* Called update after negotiations finished. */
231 DEBUG(1, ("Called NTLMSSP after state machine was 'done'\n"));
232 return NT_STATUS_INVALID_PARAMETER;
235 *out = data_blob_null;
238 switch (ntlmssp_state->role) {
240 ntlmssp_command = NTLMSSP_INITIAL;
243 /* 'datagram' mode - no neg packet */
244 ntlmssp_command = NTLMSSP_NEGOTIATE;
247 DEBUG(1, ("Invalid role: %d\n", ntlmssp_state->role));
248 return NT_STATUS_INVALID_PARAMETER;
251 if (!msrpc_parse(ntlmssp_state, &input, "Cd",
254 DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
255 dump_data(2, input.data, input.length);
256 return NT_STATUS_INVALID_PARAMETER;
260 if (ntlmssp_command != ntlmssp_state->expected_state) {
261 DEBUG(1, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command, ntlmssp_state->expected_state));
262 return NT_STATUS_INVALID_PARAMETER;
265 for (i=0; ntlmssp_callbacks[i].fn; i++) {
266 if (ntlmssp_callbacks[i].role == ntlmssp_state->role
267 && ntlmssp_callbacks[i].ntlmssp_command == ntlmssp_command) {
268 return ntlmssp_callbacks[i].fn(ntlmssp_state, ntlmssp_state, input, out);
272 DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
273 ntlmssp_state->role, ntlmssp_command));
275 return NT_STATUS_INVALID_PARAMETER;
279 * Create an NTLMSSP state machine
281 * @param ntlmssp_state NTLMSSP State, allocated by this function
284 NTSTATUS ntlmssp_server_start(TALLOC_CTX *mem_ctx,
286 const char *netbios_name,
287 const char *netbios_domain,
288 const char *dns_name,
289 const char *dns_domain,
290 struct ntlmssp_state **_ntlmssp_state)
292 struct ntlmssp_state *ntlmssp_state;
298 if (!netbios_domain) {
310 ntlmssp_state = talloc_zero(mem_ctx, struct ntlmssp_state);
311 if (!ntlmssp_state) {
312 return NT_STATUS_NO_MEMORY;
315 ntlmssp_state->role = NTLMSSP_SERVER;
317 ntlmssp_state->get_challenge = get_challenge;
318 ntlmssp_state->set_challenge = set_challenge;
319 ntlmssp_state->may_set_challenge = may_set_challenge;
321 ntlmssp_state->server.is_standalone = is_standalone;
323 ntlmssp_state->expected_state = NTLMSSP_NEGOTIATE;
325 ntlmssp_state->allow_lm_key = lp_lanman_auth();
327 ntlmssp_state->neg_flags =
328 NTLMSSP_NEGOTIATE_128 |
329 NTLMSSP_NEGOTIATE_56 |
330 NTLMSSP_NEGOTIATE_VERSION |
331 NTLMSSP_NEGOTIATE_ALWAYS_SIGN |
332 NTLMSSP_NEGOTIATE_NTLM |
333 NTLMSSP_NEGOTIATE_NTLM2 |
334 NTLMSSP_NEGOTIATE_KEY_EXCH |
335 NTLMSSP_NEGOTIATE_SIGN |
336 NTLMSSP_NEGOTIATE_SEAL;
338 ntlmssp_state->server.netbios_name = talloc_strdup(ntlmssp_state, netbios_name);
339 if (!ntlmssp_state->server.netbios_name) {
340 talloc_free(ntlmssp_state);
341 return NT_STATUS_NO_MEMORY;
343 ntlmssp_state->server.netbios_domain = talloc_strdup(ntlmssp_state, netbios_domain);
344 if (!ntlmssp_state->server.netbios_domain) {
345 talloc_free(ntlmssp_state);
346 return NT_STATUS_NO_MEMORY;
348 ntlmssp_state->server.dns_name = talloc_strdup(ntlmssp_state, dns_name);
349 if (!ntlmssp_state->server.dns_name) {
350 talloc_free(ntlmssp_state);
351 return NT_STATUS_NO_MEMORY;
353 ntlmssp_state->server.dns_domain = talloc_strdup(ntlmssp_state, dns_domain);
354 if (!ntlmssp_state->server.dns_domain) {
355 talloc_free(ntlmssp_state);
356 return NT_STATUS_NO_MEMORY;
359 *_ntlmssp_state = ntlmssp_state;
363 /*********************************************************************
365 *********************************************************************/
368 * Next state function for the Initial packet
370 * @param ntlmssp_state NTLMSSP State
371 * @param request The request, as a DATA_BLOB. reply.data must be NULL
372 * @param request The reply, as an allocated DATA_BLOB, caller to free.
373 * @return Errors or NT_STATUS_OK.
376 static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state,
377 TALLOC_CTX *out_mem_ctx, /* Unused at this time */
378 DATA_BLOB reply, DATA_BLOB *next_request)
382 if (ntlmssp_state->unicode) {
383 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
385 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
388 if (ntlmssp_state->use_ntlmv2) {
389 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
392 /* generate the ntlmssp negotiate packet */
393 status = msrpc_gen(ntlmssp_state, next_request, "CddAA",
396 ntlmssp_state->neg_flags,
397 ntlmssp_state->client.netbios_domain,
398 ntlmssp_state->client.netbios_name);
399 if (!NT_STATUS_IS_OK(status)) {
400 DEBUG(0, ("ntlmssp_client_initial: failed to generate "
401 "ntlmssp negotiate packet\n"));
405 if (DEBUGLEVEL >= 10) {
406 struct NEGOTIATE_MESSAGE *negotiate = talloc(
407 talloc_tos(), struct NEGOTIATE_MESSAGE);
408 if (negotiate != NULL) {
409 status = ntlmssp_pull_NEGOTIATE_MESSAGE(
410 next_request, negotiate, negotiate);
411 if (NT_STATUS_IS_OK(status)) {
412 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE,
415 TALLOC_FREE(negotiate);
419 ntlmssp_state->expected_state = NTLMSSP_CHALLENGE;
421 return NT_STATUS_MORE_PROCESSING_REQUIRED;
425 * Next state function for the Challenge Packet. Generate an auth packet.
427 * @param ntlmssp_state NTLMSSP State
428 * @param request The request, as a DATA_BLOB. reply.data must be NULL
429 * @param request The reply, as an allocated DATA_BLOB, caller to free.
430 * @return Errors or NT_STATUS_OK.
433 static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state,
434 TALLOC_CTX *out_mem_ctx, /* Unused at this time */
435 const DATA_BLOB reply, DATA_BLOB *next_request)
437 uint32_t chal_flags, ntlmssp_command, unkn1, unkn2;
438 DATA_BLOB server_domain_blob;
439 DATA_BLOB challenge_blob;
440 DATA_BLOB struct_blob = data_blob_null;
442 const char *chal_parse_string;
443 const char *auth_gen_string;
444 DATA_BLOB lm_response = data_blob_null;
445 DATA_BLOB nt_response = data_blob_null;
446 DATA_BLOB session_key = data_blob_null;
447 DATA_BLOB encrypted_session_key = data_blob_null;
448 NTSTATUS nt_status = NT_STATUS_OK;
450 if (ntlmssp_state->use_ccache) {
451 struct wbcCredentialCacheParams params;
452 struct wbcCredentialCacheInfo *info = NULL;
453 struct wbcAuthErrorInfo *error = NULL;
454 struct wbcNamedBlob auth_blob;
455 struct wbcBlob *wbc_next = NULL;
456 struct wbcBlob *wbc_session_key = NULL;
460 params.account_name = ntlmssp_state->user;
461 params.domain_name = ntlmssp_state->domain;
462 params.level = WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP;
464 auth_blob.name = "challenge_blob";
466 auth_blob.blob.data = reply.data;
467 auth_blob.blob.length = reply.length;
468 params.num_blobs = 1;
469 params.blobs = &auth_blob;
471 wbc_status = wbcCredentialCache(¶ms, &info, &error);
472 wbcFreeMemory(error);
473 if (!WBC_ERROR_IS_OK(wbc_status)) {
477 for (i=0; i<info->num_blobs; i++) {
478 if (strequal(info->blobs[i].name, "auth_blob")) {
479 wbc_next = &info->blobs[i].blob;
481 if (strequal(info->blobs[i].name, "session_key")) {
482 wbc_session_key = &info->blobs[i].blob;
485 if ((wbc_next == NULL) || (wbc_session_key == NULL)) {
490 *next_request = data_blob(wbc_next->data, wbc_next->length);
491 ntlmssp_state->session_key = data_blob(
492 wbc_session_key->data, wbc_session_key->length);
500 if (!msrpc_parse(ntlmssp_state, &reply, "CdBd",
505 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
506 dump_data(2, reply.data, reply.length);
508 return NT_STATUS_INVALID_PARAMETER;
511 if (DEBUGLEVEL >= 10) {
512 struct CHALLENGE_MESSAGE *challenge = talloc(
513 talloc_tos(), struct CHALLENGE_MESSAGE);
514 if (challenge != NULL) {
516 challenge->NegotiateFlags = chal_flags;
517 status = ntlmssp_pull_CHALLENGE_MESSAGE(
518 &reply, challenge, challenge);
519 if (NT_STATUS_IS_OK(status)) {
520 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE,
523 TALLOC_FREE(challenge);
527 data_blob_free(&server_domain_blob);
529 DEBUG(3, ("Got challenge flags:\n"));
530 debug_ntlmssp_flags(chal_flags);
532 ntlmssp_handle_neg_flags(ntlmssp_state, chal_flags, lp_client_lanman_auth());
534 if (ntlmssp_state->unicode) {
535 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
536 chal_parse_string = "CdUdbddB";
538 chal_parse_string = "CdUdbdd";
540 auth_gen_string = "CdBBUUUBd";
542 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
543 chal_parse_string = "CdAdbddB";
545 chal_parse_string = "CdAdbdd";
548 auth_gen_string = "CdBBAAABd";
551 DEBUG(3, ("NTLMSSP: Set final flags:\n"));
552 debug_ntlmssp_flags(ntlmssp_state->neg_flags);
554 if (!msrpc_parse(ntlmssp_state, &reply, chal_parse_string,
562 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
563 dump_data(2, reply.data, reply.length);
564 return NT_STATUS_INVALID_PARAMETER;
567 if (chal_flags & NTLMSSP_TARGET_TYPE_SERVER) {
568 ntlmssp_state->server.is_standalone = true;
570 ntlmssp_state->server.is_standalone = false;
572 /* TODO: parse struct_blob and fill in the rest */
573 ntlmssp_state->server.netbios_name = "";
574 ntlmssp_state->server.netbios_domain = server_domain;
575 ntlmssp_state->server.dns_name = "";
576 ntlmssp_state->server.dns_domain = "";
578 if (challenge_blob.length != 8) {
579 data_blob_free(&struct_blob);
580 return NT_STATUS_INVALID_PARAMETER;
583 if (!ntlmssp_state->nt_hash || !ntlmssp_state->lm_hash) {
584 static const uint8_t zeros[16] = {0, };
585 /* do nothing - blobs are zero length */
587 /* session key is all zeros */
588 session_key = data_blob_talloc(ntlmssp_state, zeros, 16);
590 /* not doing NLTM2 without a password */
591 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
592 } else if (ntlmssp_state->use_ntlmv2) {
593 if (!struct_blob.length) {
594 /* be lazy, match win2k - we can't do NTLMv2 without it */
595 DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
596 return NT_STATUS_INVALID_PARAMETER;
599 /* TODO: if the remote server is standalone, then we should replace 'domain'
600 with the server name as supplied above */
602 if (!SMBNTLMv2encrypt_hash(ntlmssp_state,
604 ntlmssp_state->domain,
605 ntlmssp_state->nt_hash, &challenge_blob,
607 &lm_response, &nt_response, NULL,
609 data_blob_free(&challenge_blob);
610 data_blob_free(&struct_blob);
611 return NT_STATUS_NO_MEMORY;
613 } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
614 struct MD5Context md5_session_nonce_ctx;
615 uint8_t session_nonce[16];
616 uint8_t session_nonce_hash[16];
617 uint8_t user_session_key[16];
619 lm_response = data_blob_talloc(ntlmssp_state, NULL, 24);
620 generate_random_buffer(lm_response.data, 8);
621 memset(lm_response.data+8, 0, 16);
623 memcpy(session_nonce, challenge_blob.data, 8);
624 memcpy(&session_nonce[8], lm_response.data, 8);
626 MD5Init(&md5_session_nonce_ctx);
627 MD5Update(&md5_session_nonce_ctx, challenge_blob.data, 8);
628 MD5Update(&md5_session_nonce_ctx, lm_response.data, 8);
629 MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
631 DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
632 DEBUG(5, ("challenge is: \n"));
633 dump_data(5, session_nonce_hash, 8);
635 nt_response = data_blob_talloc(ntlmssp_state, NULL, 24);
636 SMBNTencrypt_hash(ntlmssp_state->nt_hash,
640 session_key = data_blob_talloc(ntlmssp_state, NULL, 16);
642 SMBsesskeygen_ntv1(ntlmssp_state->nt_hash, user_session_key);
643 hmac_md5(user_session_key, session_nonce, sizeof(session_nonce), session_key.data);
644 dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
646 /* lanman auth is insecure, it may be disabled */
647 if (lp_client_lanman_auth()) {
648 lm_response = data_blob_talloc(ntlmssp_state,
650 SMBencrypt_hash(ntlmssp_state->lm_hash,challenge_blob.data,
654 nt_response = data_blob_talloc(ntlmssp_state, NULL, 24);
655 SMBNTencrypt_hash(ntlmssp_state->nt_hash,challenge_blob.data,
658 session_key = data_blob_talloc(ntlmssp_state, NULL, 16);
659 if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
660 && lp_client_lanman_auth()) {
661 SMBsesskeygen_lm_sess_key(ntlmssp_state->lm_hash, lm_response.data,
663 dump_data_pw("LM session key\n", session_key.data, session_key.length);
665 SMBsesskeygen_ntv1(ntlmssp_state->nt_hash, session_key.data);
666 dump_data_pw("NT session key:\n", session_key.data, session_key.length);
669 data_blob_free(&struct_blob);
671 /* Key exchange encryptes a new client-generated session key with
672 the password-derived key */
673 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
674 /* Make up a new session key */
675 uint8_t client_session_key[16];
676 generate_random_buffer(client_session_key, sizeof(client_session_key));
678 /* Encrypt the new session key with the old one */
679 encrypted_session_key = data_blob(client_session_key, sizeof(client_session_key));
680 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length);
681 arcfour_crypt_blob(encrypted_session_key.data, encrypted_session_key.length, &session_key);
682 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
684 /* Mark the new session key as the 'real' session key */
685 data_blob_free(&session_key);
686 session_key = data_blob_talloc(ntlmssp_state,
688 sizeof(client_session_key));
691 /* this generates the actual auth packet */
692 nt_status = msrpc_gen(ntlmssp_state, next_request, auth_gen_string,
695 lm_response.data, lm_response.length,
696 nt_response.data, nt_response.length,
697 ntlmssp_state->domain,
699 ntlmssp_state->client.netbios_name,
700 encrypted_session_key.data, encrypted_session_key.length,
701 ntlmssp_state->neg_flags);
703 if (!NT_STATUS_IS_OK(nt_status)) {
704 return NT_STATUS_NO_MEMORY;
707 if (DEBUGLEVEL >= 10) {
708 struct AUTHENTICATE_MESSAGE *authenticate = talloc(
709 talloc_tos(), struct AUTHENTICATE_MESSAGE);
710 if (authenticate != NULL) {
712 authenticate->NegotiateFlags =
713 ntlmssp_state->neg_flags;
714 status = ntlmssp_pull_AUTHENTICATE_MESSAGE(
715 next_request, authenticate, authenticate);
716 if (NT_STATUS_IS_OK(status)) {
717 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE,
720 TALLOC_FREE(authenticate);
724 data_blob_free(&encrypted_session_key);
726 data_blob_free(&ntlmssp_state->chal);
728 ntlmssp_state->session_key = session_key;
730 ntlmssp_state->chal = challenge_blob;
731 ntlmssp_state->lm_resp = lm_response;
732 ntlmssp_state->nt_resp = nt_response;
736 ntlmssp_state->expected_state = NTLMSSP_DONE;
738 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_sign_init(ntlmssp_state))) {
739 DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status)));
745 NTSTATUS ntlmssp_client_start(TALLOC_CTX *mem_ctx,
746 const char *netbios_name,
747 const char *netbios_domain,
749 struct ntlmssp_state **_ntlmssp_state)
751 struct ntlmssp_state *ntlmssp_state;
757 if (!netbios_domain) {
761 ntlmssp_state = talloc_zero(mem_ctx, struct ntlmssp_state);
762 if (!ntlmssp_state) {
763 return NT_STATUS_NO_MEMORY;
766 ntlmssp_state->role = NTLMSSP_CLIENT;
768 ntlmssp_state->unicode = True;
770 ntlmssp_state->use_ntlmv2 = use_ntlmv2;
772 ntlmssp_state->expected_state = NTLMSSP_INITIAL;
774 ntlmssp_state->neg_flags =
775 NTLMSSP_NEGOTIATE_128 |
776 NTLMSSP_NEGOTIATE_ALWAYS_SIGN |
777 NTLMSSP_NEGOTIATE_NTLM |
778 NTLMSSP_NEGOTIATE_NTLM2 |
779 NTLMSSP_NEGOTIATE_KEY_EXCH |
780 NTLMSSP_REQUEST_TARGET;
782 ntlmssp_state->client.netbios_name = talloc_strdup(ntlmssp_state, netbios_name);
783 if (!ntlmssp_state->client.netbios_name) {
784 talloc_free(ntlmssp_state);
785 return NT_STATUS_NO_MEMORY;
787 ntlmssp_state->client.netbios_domain = talloc_strdup(ntlmssp_state, netbios_domain);
788 if (!ntlmssp_state->client.netbios_domain) {
789 talloc_free(ntlmssp_state);
790 return NT_STATUS_NO_MEMORY;
793 *_ntlmssp_state = ntlmssp_state;