2 Unix SMB/Netbios implementation.
4 SMB parameters and setup
5 Copyright (C) Andrew Tridgell 1992-1998
6 Modified by Jeremy Allison 1995.
7 Copyright (C) Jeremy Allison 1995-2000.
8 Copyright (C) Luke Kennethc Casson Leighton 1996-2000.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 extern int DEBUGLEVEL;
29 #include "byteorder.h"
32 This implements the X/Open SMB password encryption
33 It takes a password, a 8 byte "crypt key" and puts 24 bytes of
34 encrypted password into p24 */
35 void SMBencrypt(uchar *passwd, uchar *c8, uchar *p24)
37 uchar p14[15], p21[21];
41 StrnCpy((char *)p14,(char *)passwd,14);
43 strupper((char *)p14);
46 SMBOWFencrypt(p21, c8, p24);
49 DEBUG(100,("SMBencrypt: lm#, challenge, response\n"));
50 dump_data(100, (char *)p21, 16);
51 dump_data(100, (char *)c8, 8);
52 dump_data(100, (char *)p24, 24);
57 * Creates the MD4 Hash of the users password in NT UNICODE.
60 void E_md4hash(uchar *passwd, uchar *p16)
65 /* Password cannot be longer than 128 characters */
66 len = strlen((char *)passwd);
69 /* Password must be converted to NT unicode - null terminated. */
70 push_ucs2(NULL, wpwd, (const char *)passwd, 256, STR_UNICODE|STR_NOALIGN|STR_TERMINATE);
71 /* Calculate length in bytes */
72 len = strlen_w(wpwd) * sizeof(int16);
74 mdfour(p16, (unsigned char *)wpwd, len);
77 /* Does both the NT and LM owfs of a user's password */
78 void nt_lm_owf_gen(char *pwd, uchar nt_p16[16], uchar p16[16])
82 memset(passwd,'\0',514);
83 safe_strcpy( passwd, pwd, sizeof(passwd)-1);
85 /* Calculate the MD4 hash (NT compatible) of the password */
86 memset(nt_p16, '\0', 16);
87 E_md4hash((uchar *)passwd, nt_p16);
90 DEBUG(100,("nt_lm_owf_gen: pwd, nt#\n"));
91 dump_data(120, passwd, strlen(passwd));
92 dump_data(100, (char *)nt_p16, 16);
95 /* Mangle the passwords into Lanman format */
99 /* Calculate the SMB (lanman) hash functions of the password */
101 memset(p16, '\0', 16);
102 E_P16((uchar *) passwd, (uchar *)p16);
104 #ifdef DEBUG_PASSWORD
105 DEBUG(100,("nt_lm_owf_gen: pwd, lm#\n"));
106 dump_data(120, passwd, strlen(passwd));
107 dump_data(100, (char *)p16, 16);
109 /* clear out local copy of user's password (just being paranoid). */
110 memset(passwd, '\0', sizeof(passwd));
113 /* Does both the NTLMv2 owfs of a user's password */
114 void ntv2_owf_gen(const uchar owf[16],
115 const char *user_n, const char *domain_n, uchar kr_buf[16])
121 int user_l = strlen(user_n);
122 int domain_l = strlen(domain_n);
124 push_ucs2(NULL, user_u, user_n, (user_l+1)*2, STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER);
125 push_ucs2(NULL, dom_u, domain_n, (domain_l+1)*2, STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER);
127 hmac_md5_init_limK_to_64(owf, 16, &ctx);
128 hmac_md5_update((const unsigned char *)user_u, user_l * 2, &ctx);
129 hmac_md5_update((const unsigned char *)dom_u, domain_l * 2, &ctx);
130 hmac_md5_final(kr_buf, &ctx);
132 #ifdef DEBUG_PASSWORD
133 DEBUG(100, ("ntv2_owf_gen: user, domain, owfkey, kr\n"));
134 dump_data(100, user_u, user_l * 2);
135 dump_data(100, dom_u, domain_l * 2);
136 dump_data(100, owf, 16);
137 dump_data(100, kr_buf, 16);
141 /* Does the des encryption from the NT or LM MD4 hash. */
142 void SMBOWFencrypt(const uchar passwd[16], const uchar *c8, uchar p24[24])
148 memcpy(p21, passwd, 16);
152 /* Does the des encryption from the FIRST 8 BYTES of the NT or LM MD4 hash. */
153 void NTLMSSPOWFencrypt(uchar passwd[8], uchar *ntlmchalresp, uchar p24[24])
158 memcpy(p21, passwd, 8);
159 memset(p21 + 8, 0xbd, 8);
161 E_P24(p21, ntlmchalresp, p24);
162 #ifdef DEBUG_PASSWORD
163 DEBUG(100,("NTLMSSPOWFencrypt: p21, c8, p24\n"));
164 dump_data(100, (char *)p21, 21);
165 dump_data(100, (char *)ntlmchalresp, 8);
166 dump_data(100, (char *)p24, 24);
171 /* Does the NT MD4 hash then des encryption. */
173 void SMBNTencrypt(uchar *passwd, uchar *c8, uchar *p24)
179 E_md4hash(passwd, p21);
180 SMBOWFencrypt(p21, c8, p24);
182 #ifdef DEBUG_PASSWORD
183 DEBUG(100,("SMBNTencrypt: nt#, challenge, response\n"));
184 dump_data(100, (char *)p21, 16);
185 dump_data(100, (char *)c8, 8);
186 dump_data(100, (char *)p24, 24);
190 BOOL make_oem_passwd_hash(char data[516], const char *passwd, uchar old_pw_hash[16], BOOL unicode)
192 int new_pw_len = strlen(passwd) * (unicode ? 2 : 1);
194 if (new_pw_len > 512)
196 DEBUG(0,("make_oem_passwd_hash: new password is too long.\n"));
201 * Now setup the data area.
202 * We need to generate a random fill
203 * for this area to make it harder to
206 generate_random_buffer((unsigned char *)data, 516, False);
207 push_string(NULL, &data[512 - new_pw_len], passwd, new_pw_len,
208 STR_NOALIGN | (unicode?STR_UNICODE:STR_ASCII));
209 SIVAL(data, 512, new_pw_len);
211 #ifdef DEBUG_PASSWORD
212 DEBUG(100,("make_oem_passwd_hash\n"));
213 dump_data(100, data, 516);
215 SamOEMhash( (unsigned char *)data, (unsigned char *)old_pw_hash, 516);
220 /* Does the md5 encryption from the NT hash for NTLMv2. */
221 void SMBOWFencrypt_ntv2(const uchar kr[16],
222 const uchar * srv_chal, int srv_chal_len,
223 const uchar * cli_chal, int cli_chal_len,
228 hmac_md5_init_limK_to_64(kr, 16, &ctx);
229 hmac_md5_update(srv_chal, srv_chal_len, &ctx);
230 hmac_md5_update(cli_chal, cli_chal_len, &ctx);
231 hmac_md5_final((unsigned char *)resp_buf, &ctx);
233 #ifdef DEBUG_PASSWORD
234 DEBUG(100, ("SMBOWFencrypt_ntv2: srv_chal, cli_chal, resp_buf\n"));
235 dump_data(100, srv_chal, srv_chal_len);
236 dump_data(100, cli_chal, cli_chal_len);
237 dump_data(100, resp_buf, 16);
241 void SMBsesskeygen_ntv2(const uchar kr[16],
242 const uchar * nt_resp, char sess_key[16])
246 hmac_md5_init_limK_to_64(kr, 16, &ctx);
247 hmac_md5_update(nt_resp, 16, &ctx);
248 hmac_md5_final((unsigned char *)sess_key, &ctx);
250 #ifdef DEBUG_PASSWORD
251 DEBUG(100, ("SMBsesskeygen_ntv2:\n"));
252 dump_data(100, sess_key, 16);
256 void SMBsesskeygen_ntv1(const uchar kr[16],
257 const uchar * nt_resp, char sess_key[16])
259 mdfour((unsigned char *)sess_key, kr, 16);
261 #ifdef DEBUG_PASSWORD
262 DEBUG(100, ("SMBsesskeygen_ntv1:\n"));
263 dump_data(100, sess_key, 16);
267 /***********************************************************
268 encode a password buffer
269 ************************************************************/
270 BOOL encode_pw_buffer(char buffer[516], const char *new_pass,
271 int new_pw_len, BOOL nt_pass_set)
273 generate_random_buffer((unsigned char *)buffer, 516, True);
277 push_ucs2(NULL, &buffer[512 - new_pw_len], new_pass,
280 push_ascii(&buffer[512 - new_pw_len], new_pass,
285 * The length of the new password is in the last 4 bytes of
288 SIVAL(buffer, 512, new_pw_len);
293 /***********************************************************
294 decode a password buffer
295 *new_pw_len is the length in bytes of the possibly mulitbyte
296 returned password including termination.
297 ************************************************************/
298 BOOL decode_pw_buffer(char in_buffer[516], char *new_pwrd,
299 int new_pwrd_size, uint32 *new_pw_len)
304 Warning !!! : This function is called from some rpc call.
305 The password IN the buffer is a UNICODE string.
306 The password IN new_pwrd is an ASCII string
307 If you reuse that code somewhere else check first.
310 /* The length of the new password is in the last 4 bytes of the data buffer. */
312 byte_len = IVAL(in_buffer, 512);
314 #ifdef DEBUG_PASSWORD
315 dump_data(100, in_buffer, 516);
318 /* Password cannot be longer than 128 characters */
319 if ( (byte_len < 0) || (byte_len > new_pwrd_size - 1)) {
320 DEBUG(0, ("decode_pw_buffer: incorrect password length (%d).\n", byte_len));
321 DEBUG(0, ("decode_pw_buffer: check that 'encrypt passwords = yes'\n"));
325 /* decode into the return buffer. Buffer must be a pstring */
326 *new_pw_len = pull_string(NULL, new_pwrd, &in_buffer[512 - byte_len], new_pwrd_size, byte_len, STR_UNICODE);
328 #ifdef DEBUG_PASSWORD
329 DEBUG(100,("decode_pw_buffer: new_pwrd: "));
330 dump_data(100, (char *)new_pwrd, *new_pw_len);
331 DEBUG(100,("multibyte len:%d\n", *new_pw_len));
332 DEBUG(100,("original char len:%d\n", byte_len/2));
339 /* Calculate the NT owfs of a user's password */
340 void nt_owf_genW(const UNISTR2 *pwd, uchar nt_p16[16])
345 for (i = 0; i < MIN(pwd->uni_str_len, sizeof(buf) / 2); i++)
347 SIVAL(buf, i * 2, pwd->buffer[i]);
349 /* Calculate the MD4 hash (NT compatible) of the password */
350 mdfour(nt_p16, (const unsigned char *)buf, pwd->uni_str_len * 2);
352 /* clear out local copy of user's password (just being paranoid). */