dcef5035cbbeccf938347c1dc17d105385370195
[jelmer/samba4-debian.git] / source / auth / ntlmssp / ntlmssp_server.c
1 /* 
2    Unix SMB/Netbios implementation.
3    Version 3.0
4    handle NLTMSSP, client server side parsing
5
6    Copyright (C) Andrew Tridgell      2001
7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2005
8    Copyright (C) Stefan Metzmacher 2005
9
10    This program is free software; you can redistribute it and/or modify
11    it under the terms of the GNU General Public License as published by
12    the Free Software Foundation; either version 3 of the License, or
13    (at your option) any later version.
14    
15    This program is distributed in the hope that it will be useful,
16    but WITHOUT ANY WARRANTY; without even the implied warranty of
17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18    GNU General Public License for more details.
19    
20    You should have received a copy of the GNU General Public License
21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "auth/ntlmssp/ntlmssp.h"
26 #include "auth/ntlmssp/msrpc_parse.h"
27 #include "lib/crypto/crypto.h"
28 #include "system/filesys.h"
29 #include "libcli/auth/libcli_auth.h"
30 #include "auth/credentials/credentials.h"
31 #include "auth/gensec/gensec.h"
32 #include "auth/auth.h"
33 #include "param/param.h"
34
35 /** 
36  * Set a username on an NTLMSSP context - ensures it is talloc()ed 
37  *
38  */
39
40 static NTSTATUS ntlmssp_set_username(struct gensec_ntlmssp_state *gensec_ntlmssp_state, const char *user) 
41 {
42         if (!user) {
43                 /* it should be at least "" */
44                 DEBUG(1, ("NTLMSSP failed to set username - cannot accept NULL username\n"));
45                 return NT_STATUS_INVALID_PARAMETER;
46         }
47         gensec_ntlmssp_state->user = talloc_strdup(gensec_ntlmssp_state, user);
48         if (!gensec_ntlmssp_state->user) {
49                 return NT_STATUS_NO_MEMORY;
50         }
51         return NT_STATUS_OK;
52 }
53
54 /** 
55  * Set a domain on an NTLMSSP context - ensures it is talloc()ed 
56  *
57  */
58 static NTSTATUS ntlmssp_set_domain(struct gensec_ntlmssp_state *gensec_ntlmssp_state, const char *domain) 
59 {
60         gensec_ntlmssp_state->domain = talloc_strdup(gensec_ntlmssp_state, domain);
61         if (!gensec_ntlmssp_state->domain) {
62                 return NT_STATUS_NO_MEMORY;
63         }
64         return NT_STATUS_OK;
65 }
66
67 /** 
68  * Set a workstation on an NTLMSSP context - ensures it is talloc()ed 
69  *
70  */
71 static NTSTATUS ntlmssp_set_workstation(struct gensec_ntlmssp_state *gensec_ntlmssp_state, const char *workstation) 
72 {
73         gensec_ntlmssp_state->workstation = talloc_strdup(gensec_ntlmssp_state, workstation);
74         if (!gensec_ntlmssp_state->workstation) {
75                 return NT_STATUS_NO_MEMORY;
76         }
77         return NT_STATUS_OK;
78 }
79
80 /**
81  * Determine correct target name flags for reply, given server role 
82  * and negotiated flags
83  * 
84  * @param gensec_ntlmssp_state NTLMSSP State
85  * @param neg_flags The flags from the packet
86  * @param chal_flags The flags to be set in the reply packet
87  * @return The 'target name' string.
88  */
89
90 static const char *ntlmssp_target_name(struct gensec_ntlmssp_state *gensec_ntlmssp_state,
91                                        uint32_t neg_flags, uint32_t *chal_flags) 
92 {
93         if (neg_flags & NTLMSSP_REQUEST_TARGET) {
94                 *chal_flags |= NTLMSSP_CHAL_TARGET_INFO;
95                 *chal_flags |= NTLMSSP_REQUEST_TARGET;
96                 if (gensec_ntlmssp_state->server_role == ROLE_STANDALONE) {
97                         *chal_flags |= NTLMSSP_TARGET_TYPE_SERVER;
98                         return gensec_ntlmssp_state->server_name;
99                 } else {
100                         *chal_flags |= NTLMSSP_TARGET_TYPE_DOMAIN;
101                         return gensec_ntlmssp_state->domain;
102                 };
103         } else {
104                 return "";
105         }
106 }
107
108
109
110 /**
111  * Next state function for the Negotiate packet
112  * 
113  * @param gensec_security GENSEC state
114  * @param out_mem_ctx Memory context for *out
115  * @param in The request, as a DATA_BLOB.  reply.data must be NULL
116  * @param out The reply, as an allocated DATA_BLOB, caller to free.
117  * @return Errors or MORE_PROCESSING_REQUIRED if (normal) a reply is required. 
118  */
119
120 NTSTATUS ntlmssp_server_negotiate(struct gensec_security *gensec_security, 
121                                   TALLOC_CTX *out_mem_ctx, 
122                                   const DATA_BLOB in, DATA_BLOB *out) 
123 {
124         struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
125         DATA_BLOB struct_blob;
126         char dnsname[MAXHOSTNAMELEN], dnsdomname[MAXHOSTNAMELEN];
127         const char *p;
128         uint32_t neg_flags = 0;
129         uint32_t ntlmssp_command, chal_flags;
130         const uint8_t *cryptkey;
131         const char *target_name;
132
133         /* parse the NTLMSSP packet */
134 #if 0
135         file_save("ntlmssp_negotiate.dat", request.data, request.length);
136 #endif
137
138         if (in.length) {
139                 if ((in.length < 16) || !msrpc_parse(out_mem_ctx, &in, "Cdd",
140                                                          "NTLMSSP",
141                                                          &ntlmssp_command,
142                                                          &neg_flags)) {
143                         DEBUG(1, ("ntlmssp_server_negotiate: failed to parse "
144                                 "NTLMSSP Negotiate of length %u:\n",
145                                 (unsigned int)in.length ));
146                         dump_data(2, in.data, in.length);
147                         return NT_STATUS_INVALID_PARAMETER;
148                 }
149                 debug_ntlmssp_flags(neg_flags);
150         }
151         
152         ntlmssp_handle_neg_flags(gensec_ntlmssp_state, neg_flags, gensec_ntlmssp_state->allow_lm_key);
153
154         /* Ask our caller what challenge they would like in the packet */
155         cryptkey = gensec_ntlmssp_state->get_challenge(gensec_ntlmssp_state);
156
157         /* Check if we may set the challenge */
158         if (!gensec_ntlmssp_state->may_set_challenge(gensec_ntlmssp_state)) {
159                 gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
160         }
161
162         /* The flags we send back are not just the negotiated flags,
163          * they are also 'what is in this packet'.  Therfore, we
164          * operate on 'chal_flags' from here on 
165          */
166
167         chal_flags = gensec_ntlmssp_state->neg_flags;
168
169         /* get the right name to fill in as 'target' */
170         target_name = ntlmssp_target_name(gensec_ntlmssp_state, 
171                                           neg_flags, &chal_flags); 
172         if (target_name == NULL) 
173                 return NT_STATUS_INVALID_PARAMETER;
174
175         gensec_ntlmssp_state->chal = data_blob_talloc(gensec_ntlmssp_state, cryptkey, 8);
176         gensec_ntlmssp_state->internal_chal = data_blob_talloc(gensec_ntlmssp_state, cryptkey, 8);
177
178         dnsname[0] = '\0';
179         if (gethostname(dnsname, sizeof(dnsname)) == -1) {
180                 DEBUG(0,("gethostname failed\n"));
181                 return NT_STATUS_UNSUCCESSFUL;
182         }
183
184         /* This should be a 'netbios domain -> DNS domain' mapping */
185         p = strchr(dnsname, '.');
186         if (p != NULL) {
187                 safe_strcpy(dnsdomname, p+1, sizeof(dnsdomname));
188                 strlower_m(dnsdomname);
189         } else {
190                 dnsdomname[0] = '\0';
191         }
192         
193         /* This creates the 'blob' of names that appears at the end of the packet */
194         if (chal_flags & NTLMSSP_CHAL_TARGET_INFO) 
195         {
196                 const char *target_name_dns = "";
197                 if (chal_flags |= NTLMSSP_TARGET_TYPE_DOMAIN) {
198                         target_name_dns = dnsdomname;
199                 } else if (chal_flags |= NTLMSSP_TARGET_TYPE_SERVER) {
200                         target_name_dns = dnsname;
201                 }
202
203                 msrpc_gen(out_mem_ctx, 
204                           &struct_blob, "aaaaa",
205                           NTLMSSP_NAME_TYPE_DOMAIN, target_name,
206                           NTLMSSP_NAME_TYPE_SERVER, gensec_ntlmssp_state->server_name,
207                           NTLMSSP_NAME_TYPE_DOMAIN_DNS, dnsdomname,
208                           NTLMSSP_NAME_TYPE_SERVER_DNS, dnsname,
209                           0, "");
210         } else {
211                 struct_blob = data_blob(NULL, 0);
212         }
213
214         {
215                 /* Marshel the packet in the right format, be it unicode or ASCII */
216                 const char *gen_string;
217                 if (gensec_ntlmssp_state->unicode) {
218                         gen_string = "CdUdbddB";
219                 } else {
220                         gen_string = "CdAdbddB";
221                 }
222                 
223                 msrpc_gen(out_mem_ctx, 
224                           out, gen_string,
225                           "NTLMSSP", 
226                           NTLMSSP_CHALLENGE,
227                           target_name,
228                           chal_flags,
229                           cryptkey, 8,
230                           0, 0,
231                           struct_blob.data, struct_blob.length);
232         }
233                 
234         gensec_ntlmssp_state->expected_state = NTLMSSP_AUTH;
235
236         return NT_STATUS_MORE_PROCESSING_REQUIRED;
237 }
238
239 /**
240  * Next state function for the Authenticate packet
241  * 
242  * @param gensec_ntlmssp_state NTLMSSP State
243  * @param request The request, as a DATA_BLOB
244  * @return Errors or NT_STATUS_OK. 
245  */
246
247 static NTSTATUS ntlmssp_server_preauth(struct gensec_ntlmssp_state *gensec_ntlmssp_state,
248                                        const DATA_BLOB request) 
249 {
250         uint32_t ntlmssp_command, auth_flags;
251         NTSTATUS nt_status;
252
253         uint8_t session_nonce_hash[16];
254
255         const char *parse_string;
256         char *domain = NULL;
257         char *user = NULL;
258         char *workstation = NULL;
259
260 #if 0
261         file_save("ntlmssp_auth.dat", request.data, request.length);
262 #endif
263
264         if (gensec_ntlmssp_state->unicode) {
265                 parse_string = "CdBBUUUBd";
266         } else {
267                 parse_string = "CdBBAAABd";
268         }
269
270         /* zero these out */
271         data_blob_free(&gensec_ntlmssp_state->lm_resp);
272         data_blob_free(&gensec_ntlmssp_state->nt_resp);
273         data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
274
275         gensec_ntlmssp_state->user = NULL;
276         gensec_ntlmssp_state->domain = NULL;
277         gensec_ntlmssp_state->workstation = NULL;
278
279         /* now the NTLMSSP encoded auth hashes */
280         if (!msrpc_parse(gensec_ntlmssp_state, 
281                          &request, parse_string,
282                          "NTLMSSP", 
283                          &ntlmssp_command, 
284                          &gensec_ntlmssp_state->lm_resp,
285                          &gensec_ntlmssp_state->nt_resp,
286                          &domain, 
287                          &user, 
288                          &workstation,
289                          &gensec_ntlmssp_state->encrypted_session_key,
290                          &auth_flags)) {
291                 DEBUG(10, ("ntlmssp_server_auth: failed to parse NTLMSSP (nonfatal):\n"));
292                 dump_data(10, request.data, request.length);
293
294                 /* zero this out */
295                 data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
296                 auth_flags = 0;
297                 
298                 /* Try again with a shorter string (Win9X truncates this packet) */
299                 if (gensec_ntlmssp_state->unicode) {
300                         parse_string = "CdBBUUU";
301                 } else {
302                         parse_string = "CdBBAAA";
303                 }
304
305                 /* now the NTLMSSP encoded auth hashes */
306                 if (!msrpc_parse(gensec_ntlmssp_state, 
307                                  &request, parse_string,
308                                  "NTLMSSP", 
309                                  &ntlmssp_command, 
310                                  &gensec_ntlmssp_state->lm_resp,
311                                  &gensec_ntlmssp_state->nt_resp,
312                                  &domain, 
313                                  &user, 
314                                  &workstation)) {
315                         DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP:\n"));
316                         dump_data(2, request.data, request.length);
317
318                         return NT_STATUS_INVALID_PARAMETER;
319                 }
320         }
321
322         if (auth_flags)
323                 ntlmssp_handle_neg_flags(gensec_ntlmssp_state, auth_flags, gensec_ntlmssp_state->allow_lm_key);
324
325         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(gensec_ntlmssp_state, domain))) {
326                 /* zero this out */
327                 data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
328                 return nt_status;
329         }
330
331         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(gensec_ntlmssp_state, user))) {
332                 /* zero this out */
333                 data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
334                 return nt_status;
335         }
336
337         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_workstation(gensec_ntlmssp_state, workstation))) {
338                 /* zero this out */
339                 data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
340                 return nt_status;
341         }
342
343         DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
344                  gensec_ntlmssp_state->user, gensec_ntlmssp_state->domain, gensec_ntlmssp_state->workstation, (unsigned long)gensec_ntlmssp_state->lm_resp.length, (unsigned long)gensec_ntlmssp_state->nt_resp.length));
345
346 #if 0
347         file_save("nthash1.dat",  &gensec_ntlmssp_state->nt_resp.data,  &gensec_ntlmssp_state->nt_resp.length);
348         file_save("lmhash1.dat",  &gensec_ntlmssp_state->lm_resp.data,  &gensec_ntlmssp_state->lm_resp.length);
349 #endif
350
351         /* NTLM2 uses a 'challenge' that is made of up both the server challenge, and a 
352            client challenge 
353         
354            However, the NTLM2 flag may still be set for the real NTLMv2 logins, be careful.
355         */
356         if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
357                 if (gensec_ntlmssp_state->nt_resp.length == 24 && gensec_ntlmssp_state->lm_resp.length == 24) {
358                         struct MD5Context md5_session_nonce_ctx;
359                         SMB_ASSERT(gensec_ntlmssp_state->internal_chal.data 
360                                    && gensec_ntlmssp_state->internal_chal.length == 8);
361                         
362                         gensec_ntlmssp_state->doing_ntlm2 = True;
363
364                         memcpy(gensec_ntlmssp_state->crypt.ntlm2.session_nonce, gensec_ntlmssp_state->internal_chal.data, 8);
365                         memcpy(&gensec_ntlmssp_state->crypt.ntlm2.session_nonce[8], gensec_ntlmssp_state->lm_resp.data, 8);
366                         
367                         MD5Init(&md5_session_nonce_ctx);
368                         MD5Update(&md5_session_nonce_ctx, gensec_ntlmssp_state->crypt.ntlm2.session_nonce, 16);
369                         MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
370                         
371                         gensec_ntlmssp_state->chal = data_blob_talloc(gensec_ntlmssp_state, 
372                                                                session_nonce_hash, 8);
373
374                         /* LM response is no longer useful, zero it out */
375                         data_blob_free(&gensec_ntlmssp_state->lm_resp);
376
377                         /* We changed the effective challenge - set it */
378                         if (!NT_STATUS_IS_OK(nt_status = 
379                                              gensec_ntlmssp_state->set_challenge(gensec_ntlmssp_state, 
380                                                                                  &gensec_ntlmssp_state->chal))) {
381                                 /* zero this out */
382                                 data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
383                                 return nt_status;
384                         }
385
386                         /* LM Key is incompatible... */
387                         gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
388                 }
389         }
390         return NT_STATUS_OK;
391 }
392
393 /**
394  * Next state function for the Authenticate packet 
395  * (after authentication - figures out the session keys etc)
396  * 
397  * @param gensec_ntlmssp_state NTLMSSP State
398  * @return Errors or NT_STATUS_OK. 
399  */
400
401 static NTSTATUS ntlmssp_server_postauth(struct gensec_security *gensec_security, 
402                                         DATA_BLOB *user_session_key, 
403                                         DATA_BLOB *lm_session_key) 
404 {
405         struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
406         NTSTATUS nt_status;
407         DATA_BLOB session_key = data_blob(NULL, 0);
408
409         if (user_session_key)
410                 dump_data_pw("USER session key:\n", user_session_key->data, user_session_key->length);
411
412         if (lm_session_key) 
413                 dump_data_pw("LM first-8:\n", lm_session_key->data, lm_session_key->length);
414
415         /* Handle the different session key derivation for NTLM2 */
416         if (gensec_ntlmssp_state->doing_ntlm2) {
417                 if (user_session_key && user_session_key->data && user_session_key->length == 16) {
418                         session_key = data_blob_talloc(gensec_ntlmssp_state, NULL, 16);
419                         hmac_md5(user_session_key->data, gensec_ntlmssp_state->crypt.ntlm2.session_nonce, 
420                                  sizeof(gensec_ntlmssp_state->crypt.ntlm2.session_nonce), session_key.data);
421                         DEBUG(10,("ntlmssp_server_auth: Created NTLM2 session key.\n"));
422                         dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
423                         
424                 } else {
425                         DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM2 session key.\n"));
426                         session_key = data_blob(NULL, 0);
427                 }
428         } else if ((gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) 
429                 /* Ensure we can never get here on NTLMv2 */
430                 && (gensec_ntlmssp_state->nt_resp.length == 0 || gensec_ntlmssp_state->nt_resp.length == 24)) {
431
432                 if (lm_session_key && lm_session_key->data && lm_session_key->length >= 8) {
433                         if (gensec_ntlmssp_state->lm_resp.data && gensec_ntlmssp_state->lm_resp.length == 24) {
434                                 session_key = data_blob_talloc(gensec_ntlmssp_state, NULL, 16);
435                                 SMBsesskeygen_lm_sess_key(lm_session_key->data, gensec_ntlmssp_state->lm_resp.data, 
436                                                           session_key.data);
437                                 DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
438                                 dump_data_pw("LM session key:\n", session_key.data, session_key.length);
439                         } else {
440                                 
441                                 /* When there is no LM response, just use zeros */
442                                 static const uint8_t zeros[24];
443                                 session_key = data_blob_talloc(gensec_ntlmssp_state, NULL, 16);
444                                 SMBsesskeygen_lm_sess_key(zeros, zeros, 
445                                                           session_key.data);
446                                 DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
447                                 dump_data_pw("LM session key:\n", session_key.data, session_key.length);
448                         }
449                 } else {
450                         /* LM Key not selected */
451                         gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
452
453                         DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM session key.\n"));
454                         session_key = data_blob(NULL, 0);
455                 }
456
457         } else if (user_session_key && user_session_key->data) {
458                 session_key = *user_session_key;
459                 DEBUG(10,("ntlmssp_server_auth: Using unmodified nt session key.\n"));
460                 dump_data_pw("unmodified session key:\n", session_key.data, session_key.length);
461
462                 /* LM Key not selected */
463                 gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
464
465         } else if (lm_session_key && lm_session_key->data) {
466                 /* Very weird to have LM key, but no user session key, but anyway.. */
467                 session_key = *lm_session_key;
468                 DEBUG(10,("ntlmssp_server_auth: Using unmodified lm session key.\n"));
469                 dump_data_pw("unmodified session key:\n", session_key.data, session_key.length);
470
471                 /* LM Key not selected */
472                 gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
473
474         } else {
475                 DEBUG(10,("ntlmssp_server_auth: Failed to create unmodified session key.\n"));
476                 session_key = data_blob(NULL, 0);
477
478                 /* LM Key not selected */
479                 gensec_ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
480         }
481
482         /* With KEY_EXCH, the client supplies the proposed session key, 
483            but encrypts it with the long-term key */
484         if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
485                 if (!gensec_ntlmssp_state->encrypted_session_key.data 
486                     || gensec_ntlmssp_state->encrypted_session_key.length != 16) {
487                         data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
488                         DEBUG(1, ("Client-supplied KEY_EXCH session key was of invalid length (%u)!\n", 
489                                   (unsigned)gensec_ntlmssp_state->encrypted_session_key.length));
490                         return NT_STATUS_INVALID_PARAMETER;
491                 } else if (!session_key.data || session_key.length != 16) {
492                         DEBUG(5, ("server session key is invalid (len == %u), cannot do KEY_EXCH!\n", 
493                                   (unsigned)session_key.length));
494                         gensec_ntlmssp_state->session_key = session_key;
495                 } else {
496                         dump_data_pw("KEY_EXCH session key (enc):\n", 
497                                      gensec_ntlmssp_state->encrypted_session_key.data, 
498                                      gensec_ntlmssp_state->encrypted_session_key.length);
499                         arcfour_crypt(gensec_ntlmssp_state->encrypted_session_key.data, 
500                                       session_key.data, 
501                                       gensec_ntlmssp_state->encrypted_session_key.length);
502                         gensec_ntlmssp_state->session_key = data_blob_talloc(gensec_ntlmssp_state, 
503                                                                       gensec_ntlmssp_state->encrypted_session_key.data, 
504                                                                       gensec_ntlmssp_state->encrypted_session_key.length);
505                         dump_data_pw("KEY_EXCH session key:\n", gensec_ntlmssp_state->encrypted_session_key.data, 
506                                      gensec_ntlmssp_state->encrypted_session_key.length);
507                 }
508         } else {
509                 gensec_ntlmssp_state->session_key = session_key;
510         }
511
512         /* keep the session key around on the new context */
513         talloc_steal(gensec_ntlmssp_state, session_key.data);
514
515         if ((gensec_security->want_features & GENSEC_FEATURE_SIGN)
516             || (gensec_security->want_features & GENSEC_FEATURE_SEAL)) {
517                 nt_status = ntlmssp_sign_init(gensec_ntlmssp_state);
518         } else {
519                 nt_status = NT_STATUS_OK;
520         }
521
522         data_blob_free(&gensec_ntlmssp_state->encrypted_session_key);
523         
524         /* allow arbitarily many authentications, but watch that this will cause a 
525            memory leak, until the gensec_ntlmssp_state is shutdown 
526         */
527
528         if (gensec_ntlmssp_state->server_multiple_authentications) {
529                 gensec_ntlmssp_state->expected_state = NTLMSSP_AUTH;
530         } else {
531                 gensec_ntlmssp_state->expected_state = NTLMSSP_DONE;
532         }
533
534         return nt_status;
535 }
536
537
538 /**
539  * Next state function for the Authenticate packet
540  * 
541  * @param gensec_security GENSEC state
542  * @param out_mem_ctx Memory context for *out
543  * @param in The request, as a DATA_BLOB.  reply.data must be NULL
544  * @param out The reply, as an allocated DATA_BLOB, caller to free.
545  * @return Errors or NT_STATUS_OK if authentication sucessful
546  */
547
548 NTSTATUS ntlmssp_server_auth(struct gensec_security *gensec_security, 
549                              TALLOC_CTX *out_mem_ctx, 
550                              const DATA_BLOB in, DATA_BLOB *out) 
551 {       
552         struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
553         DATA_BLOB user_session_key = data_blob(NULL, 0);
554         DATA_BLOB lm_session_key = data_blob(NULL, 0);
555         NTSTATUS nt_status;
556
557         TALLOC_CTX *mem_ctx = talloc_new(out_mem_ctx);
558         if (!mem_ctx) {
559                 return NT_STATUS_NO_MEMORY;
560         }
561
562         /* zero the outbound NTLMSSP packet */
563         *out = data_blob_talloc(out_mem_ctx, NULL, 0);
564
565         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_server_preauth(gensec_ntlmssp_state, in))) {
566                 talloc_free(mem_ctx);
567                 return nt_status;
568         }
569
570         /*
571          * Note we don't check here for NTLMv2 auth settings. If NTLMv2 auth
572          * is required (by "ntlm auth = no" and "lm auth = no" being set in the
573          * smb.conf file) and no NTLMv2 response was sent then the password check
574          * will fail here. JRA.
575          */
576
577         /* Finally, actually ask if the password is OK */
578
579         if (!NT_STATUS_IS_OK(nt_status = gensec_ntlmssp_state->check_password(gensec_ntlmssp_state, mem_ctx,
580                                                                               &user_session_key, &lm_session_key))) {
581                 talloc_free(mem_ctx);
582                 return nt_status;
583         }
584         
585         if (gensec_security->want_features
586             & (GENSEC_FEATURE_SIGN|GENSEC_FEATURE_SEAL|GENSEC_FEATURE_SESSION_KEY)) {
587                 nt_status = ntlmssp_server_postauth(gensec_security, &user_session_key, &lm_session_key);
588                 talloc_free(mem_ctx);
589                 return nt_status;
590         } else {
591                 gensec_ntlmssp_state->session_key = data_blob(NULL, 0);
592                 talloc_free(mem_ctx);
593                 return NT_STATUS_OK;
594         }
595 }
596
597 /**
598  * Return the challenge as determined by the authentication subsystem 
599  * @return an 8 byte random challenge
600  */
601
602 static const uint8_t *auth_ntlmssp_get_challenge(const struct gensec_ntlmssp_state *gensec_ntlmssp_state)
603 {
604         NTSTATUS status;
605         const uint8_t *chal;
606
607         status = auth_get_challenge(gensec_ntlmssp_state->auth_context, &chal);
608         if (!NT_STATUS_IS_OK(status)) {
609                 return NULL;
610         }
611
612         return chal;
613 }
614
615 /**
616  * Some authentication methods 'fix' the challenge, so we may not be able to set it
617  *
618  * @return If the effective challenge used by the auth subsystem may be modified
619  */
620 static BOOL auth_ntlmssp_may_set_challenge(const struct gensec_ntlmssp_state *gensec_ntlmssp_state)
621 {
622         return auth_challenge_may_be_modified(gensec_ntlmssp_state->auth_context);
623 }
624
625 /**
626  * NTLM2 authentication modifies the effective challenge, 
627  * @param challenge The new challenge value
628  */
629 static NTSTATUS auth_ntlmssp_set_challenge(struct gensec_ntlmssp_state *gensec_ntlmssp_state, DATA_BLOB *challenge)
630 {
631         NTSTATUS nt_status;
632         struct auth_context *auth_context = gensec_ntlmssp_state->auth_context;
633         const uint8_t *chal;
634
635         if (challenge->length != 8) {
636                 return NT_STATUS_INVALID_PARAMETER;
637         }
638
639         chal = challenge->data;
640
641         nt_status = auth_context_set_challenge(auth_context, chal, "NTLMSSP callback (NTLM2)");
642
643         return nt_status;
644 }
645
646 /**
647  * Check the password on an NTLMSSP login.  
648  *
649  * Return the session keys used on the connection.
650  */
651
652 static NTSTATUS auth_ntlmssp_check_password(struct gensec_ntlmssp_state *gensec_ntlmssp_state, 
653                                             TALLOC_CTX *mem_ctx, 
654                                             DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key) 
655 {
656         NTSTATUS nt_status;
657         struct auth_usersupplied_info *user_info = talloc(mem_ctx, struct auth_usersupplied_info);
658         if (!user_info) {
659                 return NT_STATUS_NO_MEMORY;
660         }
661
662         user_info->logon_parameters = MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
663         user_info->flags = 0;
664         user_info->mapped_state = False;
665         user_info->client.account_name = gensec_ntlmssp_state->user;
666         user_info->client.domain_name = gensec_ntlmssp_state->domain;
667         user_info->workstation_name = gensec_ntlmssp_state->workstation;
668         user_info->remote_host = gensec_get_peer_addr(gensec_ntlmssp_state->gensec_security);
669
670         user_info->password_state = AUTH_PASSWORD_RESPONSE;
671         user_info->password.response.lanman = gensec_ntlmssp_state->lm_resp;
672         user_info->password.response.lanman.data = talloc_steal(user_info, gensec_ntlmssp_state->lm_resp.data);
673         user_info->password.response.nt = gensec_ntlmssp_state->nt_resp;
674         user_info->password.response.nt.data = talloc_steal(user_info, gensec_ntlmssp_state->nt_resp.data);
675
676         nt_status = auth_check_password(gensec_ntlmssp_state->auth_context, mem_ctx,
677                                         user_info, &gensec_ntlmssp_state->server_info);
678         talloc_free(user_info);
679         NT_STATUS_NOT_OK_RETURN(nt_status);
680
681         talloc_steal(gensec_ntlmssp_state, gensec_ntlmssp_state->server_info);
682
683         if (gensec_ntlmssp_state->server_info->user_session_key.length) {
684                 DEBUG(10, ("Got NT session key of length %u\n", 
685                            (unsigned)gensec_ntlmssp_state->server_info->user_session_key.length));
686                 if (!talloc_reference(mem_ctx, gensec_ntlmssp_state->server_info->user_session_key.data)) {
687                         return NT_STATUS_NO_MEMORY;
688                 }
689
690                 *user_session_key = gensec_ntlmssp_state->server_info->user_session_key;
691         }
692         if (gensec_ntlmssp_state->server_info->lm_session_key.length) {
693                 DEBUG(10, ("Got LM session key of length %u\n", 
694                            (unsigned)gensec_ntlmssp_state->server_info->lm_session_key.length));
695                 if (!talloc_reference(mem_ctx, gensec_ntlmssp_state->server_info->lm_session_key.data)) {
696                         return NT_STATUS_NO_MEMORY;
697                 }
698
699                 *lm_session_key = gensec_ntlmssp_state->server_info->lm_session_key;
700         }
701         return nt_status;
702 }
703
704 /** 
705  * Return the credentials of a logged on user, including session keys
706  * etc.
707  *
708  * Only valid after a successful authentication
709  *
710  * May only be called once per authentication.
711  *
712  */
713
714 NTSTATUS gensec_ntlmssp_session_info(struct gensec_security *gensec_security,
715                                      struct auth_session_info **session_info) 
716 {
717         NTSTATUS nt_status;
718         struct gensec_ntlmssp_state *gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
719
720         nt_status = auth_generate_session_info(gensec_ntlmssp_state, gensec_ntlmssp_state->server_info, session_info);
721         NT_STATUS_NOT_OK_RETURN(nt_status);
722
723         (*session_info)->session_key = data_blob_talloc(*session_info, 
724                                                         gensec_ntlmssp_state->session_key.data,
725                                                         gensec_ntlmssp_state->session_key.length);
726
727         return NT_STATUS_OK;
728 }
729
730 /**
731  * Start NTLMSSP on the server side 
732  *
733  */
734 NTSTATUS gensec_ntlmssp_server_start(struct gensec_security *gensec_security)
735 {
736         NTSTATUS nt_status;
737         struct gensec_ntlmssp_state *gensec_ntlmssp_state;
738
739         nt_status = gensec_ntlmssp_start(gensec_security);
740         NT_STATUS_NOT_OK_RETURN(nt_status);
741
742         gensec_ntlmssp_state = (struct gensec_ntlmssp_state *)gensec_security->private_data;
743
744         gensec_ntlmssp_state->role = NTLMSSP_SERVER;
745
746         gensec_ntlmssp_state->workstation = NULL;
747         gensec_ntlmssp_state->server_name = lp_netbios_name(global_loadparm);
748
749         gensec_ntlmssp_state->domain = lp_workgroup(global_loadparm);
750
751         gensec_ntlmssp_state->expected_state = NTLMSSP_NEGOTIATE;
752
753         gensec_ntlmssp_state->allow_lm_key = (lp_lanman_auth(global_loadparm) 
754                                           && lp_parm_bool(NULL, "ntlmssp_server", "allow_lm_key", false));
755
756         gensec_ntlmssp_state->server_multiple_authentications = False;
757         
758         gensec_ntlmssp_state->neg_flags = 
759                 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_UNKNOWN_02000000;
760
761         gensec_ntlmssp_state->lm_resp = data_blob(NULL, 0);
762         gensec_ntlmssp_state->nt_resp = data_blob(NULL, 0);
763         gensec_ntlmssp_state->encrypted_session_key = data_blob(NULL, 0);
764
765         if (lp_parm_bool(NULL, "ntlmssp_server", "128bit", true)) {
766                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_128;               
767         }
768
769         if (lp_parm_bool(NULL, "ntlmssp_server", "56bit", true)) {
770                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_56;                
771         }
772
773         if (lp_parm_bool(NULL, "ntlmssp_server", "keyexchange", true)) {
774                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_KEY_EXCH;          
775         }
776
777         if (lp_parm_bool(NULL, "ntlmssp_server", "alwayssign", true)) {
778                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;               
779         }
780
781         if (lp_parm_bool(NULL, "ntlmssp_server", "ntlm2", true)) {
782                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;             
783         }
784
785         if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
786                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
787         }
788         if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
789                 gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
790         }
791
792         nt_status = auth_context_create(gensec_ntlmssp_state, 
793                                         gensec_security->event_ctx,
794                                         gensec_security->msg_ctx,
795                                         &gensec_ntlmssp_state->auth_context);
796         NT_STATUS_NOT_OK_RETURN(nt_status);
797
798         gensec_ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
799         gensec_ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
800         gensec_ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
801         gensec_ntlmssp_state->check_password = auth_ntlmssp_check_password;
802         gensec_ntlmssp_state->server_role = lp_server_role(global_loadparm);
803
804         return NT_STATUS_OK;
805 }
806