2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett 2001-2002
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 2 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program; if not, write to the Free Software
18 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #define DBGC_CLASS DBGC_AUTH
26 /****************************************************************************
27 COMPATIBILITY INTERFACES:
28 ***************************************************************************/
30 /****************************************************************************
31 check if a username/password is OK assuming the password is a 24 byte
33 return True if the password is correct, False otherwise
34 ****************************************************************************/
36 NTSTATUS check_plaintext_password(const char *smb_name, DATA_BLOB plaintext_password, auth_serversupplied_info **server_info)
38 struct auth_context *plaintext_auth_context = NULL;
39 auth_usersupplied_info *user_info = NULL;
42 if (!NT_STATUS_IS_OK(nt_status = make_auth_context_subsystem(&plaintext_auth_context))) {
46 chal = plaintext_auth_context->get_ntlm_challenge(plaintext_auth_context);
48 if (!make_user_info_for_reply(&user_info,
49 smb_name, lp_workgroup(), chal,
50 plaintext_password)) {
51 return NT_STATUS_NO_MEMORY;
54 nt_status = plaintext_auth_context->check_ntlm_password(plaintext_auth_context,
55 user_info, server_info);
57 (plaintext_auth_context->free)(&plaintext_auth_context);
58 free_user_info(&user_info);
62 static NTSTATUS pass_check_smb(struct server_context *smb,
67 DATA_BLOB plaintext_password,
72 auth_serversupplied_info *server_info = NULL;
74 auth_usersupplied_info *user_info = NULL;
75 make_user_info_for_reply_enc(&user_info, smb_name,
79 nt_status = smb->negotiate.auth_context->check_ntlm_password(smb->negotiate.auth_context,
80 user_info, &server_info);
81 free_user_info(&user_info);
83 nt_status = check_plaintext_password(smb_name, plaintext_password, &server_info);
85 free_server_info(&server_info);
89 /****************************************************************************
90 check if a username/password pair is ok via the auth subsystem.
91 return True if the password is correct, False otherwise
92 ****************************************************************************/
93 BOOL password_ok(struct server_context *smb, const char *smb_name, DATA_BLOB password_blob)
96 DATA_BLOB null_password = data_blob(NULL, 0);
97 BOOL encrypted = (smb->negotiate.encrypted_passwords && password_blob.length == 24);
102 * The password could be either NTLM or plain LM. Try NTLM first,
103 * but fall-through as required.
104 * NTLMv2 makes no sense here.
106 status = pass_check_smb(smb, smb_name, lp_workgroup(), null_password,
107 password_blob, null_password, encrypted);
108 if (NT_STATUS_IS_OK(status)) {
112 status = pass_check_smb(smb, smb_name, lp_workgroup(), password_blob,
113 null_password, null_password, encrypted);
115 status = pass_check_smb(smb, smb_name, lp_workgroup(), null_password,
116 null_password, password_blob, encrypted);
119 return NT_STATUS_IS_OK(status);