2 Unix SMB/CIFS implementation.
4 dcerpc authentication operations
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "auth/auth.h"
28 struct gensec_ntlmssp_state {
29 struct auth_context *auth_context;
30 struct auth_serversupplied_info *server_info;
31 struct ntlmssp_state *ntlmssp_state;
37 * Return the challenge as determined by the authentication subsystem
38 * @return an 8 byte random challenge
41 static const uint8_t *auth_ntlmssp_get_challenge(const struct ntlmssp_state *ntlmssp_state)
43 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
47 status = auth_get_challenge(gensec_ntlmssp_state->auth_context, &chal);
48 if (!NT_STATUS_IS_OK(status)) {
56 * Some authentication methods 'fix' the challenge, so we may not be able to set it
58 * @return If the effective challenge used by the auth subsystem may be modified
60 static BOOL auth_ntlmssp_may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
62 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
64 return auth_challenge_may_be_modified(gensec_ntlmssp_state->auth_context);
68 * NTLM2 authentication modifies the effective challenge,
69 * @param challenge The new challenge value
71 static NTSTATUS auth_ntlmssp_set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
74 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
75 struct auth_context *auth_context = gensec_ntlmssp_state->auth_context;
78 if (challenge->length != 8) {
79 return NT_STATUS_INVALID_PARAMETER;
82 chal = challenge->data;
84 nt_status = auth_context_set_challenge(auth_context, chal, "NTLMSSP callback (NTLM2)");
90 * Check the password on an NTLMSSP login.
92 * Return the session keys used on the connection.
95 static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
97 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ntlmssp_state->auth_context;
98 struct auth_usersupplied_info *user_info = NULL;
101 nt_status = make_user_info_map(ntlmssp_state,
102 gensec_ntlmssp_state->ntlmssp_state->user,
103 gensec_ntlmssp_state->ntlmssp_state->domain,
104 gensec_ntlmssp_state->ntlmssp_state->workstation,
105 gensec_ntlmssp_state->ntlmssp_state->lm_resp.data ? &gensec_ntlmssp_state->ntlmssp_state->lm_resp : NULL,
106 gensec_ntlmssp_state->ntlmssp_state->nt_resp.data ? &gensec_ntlmssp_state->ntlmssp_state->nt_resp : NULL,
107 NULL, NULL, NULL, True,
109 NT_STATUS_NOT_OK_RETURN(nt_status);
111 nt_status = auth_check_password(gensec_ntlmssp_state->auth_context, gensec_ntlmssp_state,
112 user_info, &gensec_ntlmssp_state->server_info);
113 talloc_free(user_info);
114 NT_STATUS_NOT_OK_RETURN(nt_status);
116 if (gensec_ntlmssp_state->server_info->user_session_key.length) {
117 DEBUG(10, ("Got NT session key of length %u\n", gensec_ntlmssp_state->server_info->user_session_key.length));
118 *user_session_key = data_blob_talloc(ntlmssp_state,
119 gensec_ntlmssp_state->server_info->user_session_key.data,
120 gensec_ntlmssp_state->server_info->user_session_key.length);
122 if (gensec_ntlmssp_state->server_info->lm_session_key.length) {
123 DEBUG(10, ("Got LM session key of length %u\n", gensec_ntlmssp_state->server_info->lm_session_key.length));
124 *lm_session_key = data_blob_talloc(ntlmssp_state,
125 gensec_ntlmssp_state->server_info->lm_session_key.data,
126 gensec_ntlmssp_state->server_info->lm_session_key.length);
131 static int gensec_ntlmssp_destroy(void *ptr)
133 struct gensec_ntlmssp_state *gensec_ntlmssp_state = ptr;
135 if (gensec_ntlmssp_state->ntlmssp_state) {
136 ntlmssp_end(&gensec_ntlmssp_state->ntlmssp_state);
142 static NTSTATUS gensec_ntlmssp_start(struct gensec_security *gensec_security)
144 struct gensec_ntlmssp_state *gensec_ntlmssp_state;
146 gensec_ntlmssp_state = talloc_p(gensec_security, struct gensec_ntlmssp_state);
147 if (!gensec_ntlmssp_state) {
148 return NT_STATUS_NO_MEMORY;
151 gensec_ntlmssp_state->ntlmssp_state = NULL;
152 gensec_ntlmssp_state->auth_context = NULL;
153 gensec_ntlmssp_state->server_info = NULL;
154 gensec_ntlmssp_state->have_features = 0;
156 talloc_set_destructor(gensec_ntlmssp_state, gensec_ntlmssp_destroy);
158 gensec_security->private_data = gensec_ntlmssp_state;
162 static NTSTATUS gensec_ntlmssp_server_start(struct gensec_security *gensec_security)
165 struct ntlmssp_state *ntlmssp_state;
166 struct gensec_ntlmssp_state *gensec_ntlmssp_state;
168 nt_status = gensec_ntlmssp_start(gensec_security);
169 NT_STATUS_NOT_OK_RETURN(nt_status);
171 gensec_ntlmssp_state = gensec_security->private_data;
173 nt_status = ntlmssp_server_start(gensec_ntlmssp_state, &gensec_ntlmssp_state->ntlmssp_state);
174 NT_STATUS_NOT_OK_RETURN(nt_status);
176 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
177 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
179 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
180 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
183 nt_status = auth_context_create(gensec_ntlmssp_state, lp_auth_methods(), &gensec_ntlmssp_state->auth_context);
184 NT_STATUS_NOT_OK_RETURN(nt_status);
186 ntlmssp_state = gensec_ntlmssp_state->ntlmssp_state;
187 ntlmssp_state->auth_context = gensec_ntlmssp_state;
188 ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
189 ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
190 ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
191 ntlmssp_state->check_password = auth_ntlmssp_check_password;
192 ntlmssp_state->server_role = lp_server_role();
197 static NTSTATUS gensec_ntlmssp_client_start(struct gensec_security *gensec_security)
199 struct gensec_ntlmssp_state *gensec_ntlmssp_state;
200 char *password = NULL;
203 nt_status = gensec_ntlmssp_start(gensec_security);
204 NT_STATUS_NOT_OK_RETURN(nt_status);
206 gensec_ntlmssp_state = gensec_security->private_data;
207 nt_status = ntlmssp_client_start(gensec_ntlmssp_state,
208 &gensec_ntlmssp_state->ntlmssp_state);
209 NT_STATUS_NOT_OK_RETURN(nt_status);
211 if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
213 * We need to set this to allow a later SetPassword
214 * via the SAMR pipe to succeed. Strange.... We could
215 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
217 * Without this, Windows will not create the master key
218 * that it thinks is only used for NTLMSSP signing and
219 * sealing. (It is actually pulled out and used directly)
221 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
223 if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
224 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
226 if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
227 gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
230 nt_status = ntlmssp_set_domain(gensec_ntlmssp_state->ntlmssp_state,
231 gensec_security->user.domain);
232 NT_STATUS_NOT_OK_RETURN(nt_status);
234 nt_status = ntlmssp_set_username(gensec_ntlmssp_state->ntlmssp_state,
235 gensec_security->user.name);
236 NT_STATUS_NOT_OK_RETURN(nt_status);
238 if (gensec_security->user.name) {
239 nt_status = gensec_get_password(gensec_security, gensec_ntlmssp_state, &password);
240 NT_STATUS_NOT_OK_RETURN(nt_status);
244 nt_status = ntlmssp_set_password(gensec_ntlmssp_state->ntlmssp_state, password);
245 NT_STATUS_NOT_OK_RETURN(nt_status);
248 gensec_security->private_data = gensec_ntlmssp_state;
254 wrappers for the ntlmssp_*() functions
256 static NTSTATUS gensec_ntlmssp_unseal_packet(struct gensec_security *gensec_security,
258 uint8_t *data, size_t length,
259 const uint8_t *whole_pdu, size_t pdu_length,
262 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
264 return ntlmssp_unseal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
267 static NTSTATUS gensec_ntlmssp_check_packet(struct gensec_security *gensec_security,
269 const uint8_t *data, size_t length,
270 const uint8_t *whole_pdu, size_t pdu_length,
271 const DATA_BLOB *sig)
273 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
275 return ntlmssp_check_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
278 static NTSTATUS gensec_ntlmssp_seal_packet(struct gensec_security *gensec_security,
280 uint8_t *data, size_t length,
281 const uint8_t *whole_pdu, size_t pdu_length,
284 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
286 return ntlmssp_seal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
289 static NTSTATUS gensec_ntlmssp_sign_packet(struct gensec_security *gensec_security,
291 const uint8_t *data, size_t length,
292 const uint8_t *whole_pdu, size_t pdu_length,
295 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
297 return ntlmssp_sign_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx, data, length, whole_pdu, pdu_length, sig);
300 static size_t gensec_ntlmssp_sig_size(struct gensec_security *gensec_security)
302 return NTLMSSP_SIG_SIZE;
305 static NTSTATUS gensec_ntlmssp_wrap(struct gensec_security *gensec_security,
310 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
314 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
316 *out = data_blob_talloc(mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
317 memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
319 nt_status = ntlmssp_seal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
320 out->data + NTLMSSP_SIG_SIZE,
321 out->length - NTLMSSP_SIG_SIZE,
322 out->data + NTLMSSP_SIG_SIZE,
323 out->length - NTLMSSP_SIG_SIZE,
326 if (NT_STATUS_IS_OK(nt_status)) {
327 memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
331 } else if ((gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)
332 || (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
334 *out = data_blob_talloc(mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
335 memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
337 nt_status = ntlmssp_sign_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
338 out->data + NTLMSSP_SIG_SIZE,
339 out->length - NTLMSSP_SIG_SIZE,
340 out->data + NTLMSSP_SIG_SIZE,
341 out->length - NTLMSSP_SIG_SIZE,
344 if (NT_STATUS_IS_OK(nt_status)) {
345 memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
356 static NTSTATUS gensec_ntlmssp_unwrap(struct gensec_security *gensec_security,
361 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
364 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
365 if (in->length < NTLMSSP_SIG_SIZE) {
366 return NT_STATUS_INVALID_PARAMETER;
369 sig.length = NTLMSSP_SIG_SIZE;
371 *out = data_blob_talloc(mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
373 return ntlmssp_unseal_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
374 out->data, out->length,
375 out->data, out->length,
378 } else if ((gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)
379 || (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
380 if (in->length < NTLMSSP_SIG_SIZE) {
381 return NT_STATUS_INVALID_PARAMETER;
384 sig.length = NTLMSSP_SIG_SIZE;
386 *out = data_blob_talloc(mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
388 return ntlmssp_check_packet(gensec_ntlmssp_state->ntlmssp_state, mem_ctx,
389 out->data, out->length,
390 out->data, out->length,
398 static NTSTATUS gensec_ntlmssp_session_key(struct gensec_security *gensec_security,
399 DATA_BLOB *session_key)
401 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
403 return ntlmssp_session_key(gensec_ntlmssp_state->ntlmssp_state, session_key);
407 * Next state function for the wrapped NTLMSSP state machine
409 * @param gensec_security GENSEC state, initialised to NTLMSSP
410 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
411 * @param in The request, as a DATA_BLOB
412 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
413 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
414 * or NT_STATUS_OK if the user is authenticated.
417 static NTSTATUS gensec_ntlmssp_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
418 const DATA_BLOB in, DATA_BLOB *out)
420 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
423 status = ntlmssp_update(gensec_ntlmssp_state->ntlmssp_state, out_mem_ctx, in, out);
425 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
429 gensec_ntlmssp_state->have_features = 0;
431 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
432 gensec_ntlmssp_state->have_features |= GENSEC_FEATURE_SIGN;
435 if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
436 gensec_ntlmssp_state->have_features |= GENSEC_FEATURE_SEAL;
439 if (gensec_ntlmssp_state->ntlmssp_state->session_key.data) {
440 gensec_ntlmssp_state->have_features |= GENSEC_FEATURE_SESSION_KEY;
447 * Return the credentials of a logged on user, including session keys
450 * Only valid after a successful authentication
452 * May only be called once per authentication.
456 static NTSTATUS gensec_ntlmssp_session_info(struct gensec_security *gensec_security,
457 struct auth_session_info **session_info)
460 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
462 nt_status = auth_generate_session_info(gensec_ntlmssp_state, gensec_ntlmssp_state->server_info, session_info);
463 NT_STATUS_NOT_OK_RETURN(nt_status);
465 (*session_info)->session_key = data_blob_talloc(*session_info,
466 gensec_ntlmssp_state->ntlmssp_state->session_key.data,
467 gensec_ntlmssp_state->ntlmssp_state->session_key.length);
472 static BOOL gensec_ntlmssp_have_feature(struct gensec_security *gensec_security,
475 struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
476 if (gensec_ntlmssp_state->have_features & feature) {
483 static const struct gensec_security_ops gensec_ntlmssp_security_ops = {
486 .auth_type = DCERPC_AUTH_TYPE_NTLMSSP,
487 .oid = GENSEC_OID_NTLMSSP,
488 .client_start = gensec_ntlmssp_client_start,
489 .server_start = gensec_ntlmssp_server_start,
490 .update = gensec_ntlmssp_update,
491 .sig_size = gensec_ntlmssp_sig_size,
492 .sign_packet = gensec_ntlmssp_sign_packet,
493 .check_packet = gensec_ntlmssp_check_packet,
494 .seal_packet = gensec_ntlmssp_seal_packet,
495 .unseal_packet = gensec_ntlmssp_unseal_packet,
496 .wrap = gensec_ntlmssp_wrap,
497 .unwrap = gensec_ntlmssp_unwrap,
498 .session_key = gensec_ntlmssp_session_key,
499 .session_info = gensec_ntlmssp_session_info,
500 .have_feature = gensec_ntlmssp_have_feature,
505 NTSTATUS gensec_ntlmssp_init(void)
508 ret = gensec_register(&gensec_ntlmssp_security_ops);
509 if (!NT_STATUS_IS_OK(ret)) {
510 DEBUG(0,("Failed to register '%s' gensec backend!\n",
511 gensec_ntlmssp_security_ops.name));