(*auth_ntlmssp_state)->ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
(*auth_ntlmssp_state)->ntlmssp_state->check_password = auth_ntlmssp_check_password;
(*auth_ntlmssp_state)->ntlmssp_state->server_role = lp_server_role();
-
+
return NT_STATUS_OK;
}
*auth_ntlmssp_state = NULL;
}
+
+/**
+ * Next state function for the wrapped NTLMSSP state machine
+ *
+ * @param auth_ntlmssp_state NTLMSSP State
+ * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
+ * @param in The request, as a DATA_BLOB
+ * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
+ * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
+ * or NT_STATUS_OK if the user is authenticated.
+ */
+
NTSTATUS auth_ntlmssp_update(AUTH_NTLMSSP_STATE *auth_ntlmssp_state,
- const DATA_BLOB request, DATA_BLOB *reply)
+ TALLOC_CTX *out_mem_ctx,
+ const DATA_BLOB in, DATA_BLOB *out)
{
- return ntlmssp_update(auth_ntlmssp_state->ntlmssp_state, request, reply);
+ return ntlmssp_update(auth_ntlmssp_state->ntlmssp_state,
+ out_mem_ctx,
+ in, out);
}
key_len = 64;
}
- /* start out by storing key in pads */
- ZERO_STRUCT(ctx->k_ipad);
- ZERO_STRUCT(ctx->k_opad);
- memcpy( ctx->k_ipad, key, key_len);
- memcpy( ctx->k_opad, key, key_len);
-
- /* XOR key with ipad and opad values */
- for (i=0; i<64; i++) {
- ctx->k_ipad[i] ^= 0x36;
- ctx->k_opad[i] ^= 0x5c;
- }
-
- MD5Init(&ctx->ctx);
- MD5Update(&ctx->ctx, ctx->k_ipad, 64);
+ hmac_md5_init_rfc2104(key, key_len, ctx);
}
/***********************************************************************
SAFE_FREE(ipstr_list);
}
+/**
+ Routine to get hex characters and turn them into a 16 byte array.
+ the array can be variable length, and any non-hex-numeric
+ characters are skipped. "0xnn" or "0Xnn" is specially catered
+ for.
+
+ valid examples: "0A5D15"; "0x15, 0x49, 0xa2"; "59\ta9\te3\n"
+
+**/
+
+size_t strhex_to_str(char *p, size_t len, const char *strhex)
+{
+ size_t i;
+ size_t num_chars = 0;
+ unsigned char lonybble, hinybble;
+ const char *hexchars = "0123456789ABCDEF";
+ char *p1 = NULL, *p2 = NULL;
+
+ for (i = 0; i < len && strhex[i] != 0; i++) {
+ if (strnequal(hexchars, "0x", 2)) {
+ i++; /* skip two chars */
+ continue;
+ }
+
+ if (!(p1 = strchr_m(hexchars, toupper(strhex[i]))))
+ break;
+
+ i++; /* next hex digit */
+
+ if (!(p2 = strchr_m(hexchars, toupper(strhex[i]))))
+ break;
+
+ /* get the two nybbles */
+ hinybble = PTR_DIFF(p1, hexchars);
+ lonybble = PTR_DIFF(p2, hexchars);
+
+ p[num_chars] = (hinybble << 4) | lonybble;
+ num_chars++;
+
+ p1 = NULL;
+ p2 = NULL;
+ }
+ return num_chars;
+}
+
+DATA_BLOB strhex_to_data_blob(const char *strhex)
+{
+ DATA_BLOB ret_blob = data_blob(NULL, strlen(strhex)/2+1);
+
+ ret_blob.length = strhex_to_str(ret_blob.data,
+ strlen(strhex),
+ strhex);
+
+ return ret_blob;
+}
+
/**
Unescape a URL encoded string, in place.
#include "includes.h"
static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state,
- DATA_BLOB reply, DATA_BLOB *next_request);
+ TALLOC_CTX *out_mem_ctx,
+ DATA_BLOB in, DATA_BLOB *out);
static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state,
+ TALLOC_CTX *out_mem_ctx,
const DATA_BLOB in, DATA_BLOB *out);
static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state,
- const DATA_BLOB reply, DATA_BLOB *next_request);
+ TALLOC_CTX *out_mem_ctx,
+ const DATA_BLOB in, DATA_BLOB *out);
static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state,
- const DATA_BLOB request, DATA_BLOB *reply);
+ TALLOC_CTX *out_mem_ctx,
+ const DATA_BLOB in, DATA_BLOB *out);
/**
* Callbacks for NTLMSSP - for both client and server operating modes
enum NTLMSSP_ROLE role;
enum NTLM_MESSAGE_TYPE ntlmssp_command;
NTSTATUS (*fn)(struct ntlmssp_state *ntlmssp_state,
+ TALLOC_CTX *out_mem_ctx,
DATA_BLOB in, DATA_BLOB *out);
} ntlmssp_callbacks[] = {
{NTLMSSP_CLIENT, NTLMSSP_INITIAL, ntlmssp_client_initial},
* Next state function for the NTLMSSP state machine
*
* @param ntlmssp_state NTLMSSP State
- * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB
- * @param out The reply, as an allocated DATA_BLOB, caller to free.
- * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK.
+ * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
+ * @param in The request, as a DATA_BLOB
+ * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
+ * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
+ * or NT_STATUS_OK if the user is authenticated.
*/
NTSTATUS ntlmssp_update(NTLMSSP_STATE *ntlmssp_state,
+ TALLOC_CTX *out_mem_ctx,
const DATA_BLOB in, DATA_BLOB *out)
{
DATA_BLOB input;
*out = data_blob(NULL, 0);
+ if (ntlmssp_state->expected_state == NTLMSSP_DONE) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (!out_mem_ctx) {
+ /* if the caller doesn't want to manage/own the memory,
+ we can put it on our context */
+ out_mem_ctx = ntlmssp_state->mem_ctx;
+ }
+
if (!in.length && ntlmssp_state->stored_response.length) {
input = ntlmssp_state->stored_response;
break;
}
} else {
- if (!msrpc_parse(&input, "Cd",
+ if (!msrpc_parse(ntlmssp_state->mem_ctx,
+ &input, "Cd",
"NTLMSSP",
&ntlmssp_command)) {
DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
for (i=0; ntlmssp_callbacks[i].fn; i++) {
if (ntlmssp_callbacks[i].role == ntlmssp_state->role
- && ntlmssp_callbacks[i].ntlmssp_command == ntlmssp_command) {
- return ntlmssp_callbacks[i].fn(ntlmssp_state, input, out);
+ && ntlmssp_callbacks[i].ntlmssp_command == ntlmssp_command
+ && ntlmssp_callbacks[i].fn) {
+ return ntlmssp_callbacks[i].fn(ntlmssp_state, out_mem_ctx, input, out);
}
}
(*ntlmssp_state)->ref_count--;
if ((*ntlmssp_state)->ref_count == 0) {
- data_blob_free(&(*ntlmssp_state)->chal);
- data_blob_free(&(*ntlmssp_state)->lm_resp);
- data_blob_free(&(*ntlmssp_state)->nt_resp);
- data_blob_free(&(*ntlmssp_state)->encrypted_session_key);
talloc_destroy(mem_ctx);
}
ntlmssp_state->session_key.data[6] = 0x38;
ntlmssp_state->session_key.data[7] = 0xb0;
}
+ ntlmssp_state->session_key.length = 8;
}
}
* Next state function for the Negotiate packet
*
* @param ntlmssp_state NTLMSSP State
- * @param request The request, as a DATA_BLOB
- * @param request The reply, as an allocated DATA_BLOB, caller to free.
+ * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
+ * @param in The request, as a DATA_BLOB
+ * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
* @return Errors or MORE_PROCESSING_REQUIRED if a reply is sent.
*/
static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state,
- const DATA_BLOB request, DATA_BLOB *reply)
+ TALLOC_CTX *out_mem_ctx,
+ const DATA_BLOB in, DATA_BLOB *out)
{
DATA_BLOB struct_blob;
fstring dnsname, dnsdomname;
file_save("ntlmssp_negotiate.dat", request.data, request.length);
#endif
- if (request.length) {
- if (!msrpc_parse(&request, "CddAA",
+ if (in.length) {
+ if (!msrpc_parse(ntlmssp_state->mem_ctx,
+ &in, "CddAA",
"NTLMSSP",
&ntlmssp_command,
&neg_flags,
&cliname,
&domname)) {
DEBUG(1, ("ntlmssp_server_negotiate: failed to parse NTLMSSP:\n"));
- dump_data(2, (const char *)request.data, request.length);
+ dump_data(2, (const char *)in.data, in.length);
return NT_STATUS_INVALID_PARAMETER;
}
- SAFE_FREE(cliname);
- SAFE_FREE(domname);
-
debug_ntlmssp_flags(neg_flags);
}
target_name_dns = dnsname;
}
- msrpc_gen(&struct_blob, "aaaaa",
+ msrpc_gen(out_mem_ctx,
+ &struct_blob, "aaaaa",
NTLMSSP_NAME_TYPE_DOMAIN, target_name,
NTLMSSP_NAME_TYPE_SERVER, ntlmssp_state->get_global_myname(),
NTLMSSP_NAME_TYPE_DOMAIN_DNS, dnsdomname,
gen_string = "CdAdbddB";
}
- msrpc_gen(reply, gen_string,
+ msrpc_gen(out_mem_ctx,
+ out, gen_string,
"NTLMSSP",
NTLMSSP_CHALLENGE,
target_name,
struct_blob.data, struct_blob.length);
}
- data_blob_free(&struct_blob);
-
ntlmssp_state->expected_state = NTLMSSP_AUTH;
return NT_STATUS_MORE_PROCESSING_REQUIRED;
*
* @param ntlmssp_state NTLMSSP State
* @param request The request, as a DATA_BLOB
- * @param request The reply, as an allocated DATA_BLOB, caller to free.
* @return Errors or NT_STATUS_OK.
*/
parse_string = "CdBBAAABd";
}
+ /* zero these out */
data_blob_free(&ntlmssp_state->lm_resp);
data_blob_free(&ntlmssp_state->nt_resp);
ntlmssp_state->workstation = NULL;
/* now the NTLMSSP encoded auth hashes */
- if (!msrpc_parse(&request, parse_string,
+ if (!msrpc_parse(ntlmssp_state->mem_ctx,
+ &request, parse_string,
"NTLMSSP",
&ntlmssp_command,
&ntlmssp_state->lm_resp,
&auth_flags)) {
DEBUG(10, ("ntlmssp_server_auth: failed to parse NTLMSSP (nonfatal):\n"));
dump_data(10, (const char *)request.data, request.length);
- SAFE_FREE(domain);
- SAFE_FREE(user);
- SAFE_FREE(workstation);
+
+ /* zero this out */
data_blob_free(&ntlmssp_state->encrypted_session_key);
auth_flags = 0;
}
/* now the NTLMSSP encoded auth hashes */
- if (!msrpc_parse(&request, parse_string,
+ if (!msrpc_parse(ntlmssp_state->mem_ctx,
+ &request, parse_string,
"NTLMSSP",
&ntlmssp_command,
&ntlmssp_state->lm_resp,
&workstation)) {
DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP:\n"));
dump_data(2, (const char *)request.data, request.length);
- SAFE_FREE(domain);
- SAFE_FREE(user);
- SAFE_FREE(workstation);
return NT_STATUS_INVALID_PARAMETER;
}
ntlmssp_handle_neg_flags(ntlmssp_state, auth_flags, ntlmssp_state->allow_lm_key);
if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) {
- SAFE_FREE(domain);
- SAFE_FREE(user);
- SAFE_FREE(workstation);
+ /* zero this out */
data_blob_free(&ntlmssp_state->encrypted_session_key);
return nt_status;
}
if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) {
- SAFE_FREE(domain);
- SAFE_FREE(user);
- SAFE_FREE(workstation);
+ /* zero this out */
data_blob_free(&ntlmssp_state->encrypted_session_key);
return nt_status;
}
if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_workstation(ntlmssp_state, workstation))) {
- SAFE_FREE(domain);
- SAFE_FREE(user);
- SAFE_FREE(workstation);
+ /* zero this out */
data_blob_free(&ntlmssp_state->encrypted_session_key);
return nt_status;
}
- SAFE_FREE(domain);
- SAFE_FREE(user);
- SAFE_FREE(workstation);
-
DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
ntlmssp_state->user, ntlmssp_state->domain, ntlmssp_state->workstation, (unsigned long)ntlmssp_state->lm_resp.length, (unsigned long)ntlmssp_state->nt_resp.length));
if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
if (ntlmssp_state->nt_resp.length == 24 && ntlmssp_state->lm_resp.length == 24) {
struct MD5Context md5_session_nonce_ctx;
- SMB_ASSERT(ntlmssp_state->internal_chal.data && ntlmssp_state->internal_chal.length == 8);
+ SMB_ASSERT(ntlmssp_state->internal_chal.data
+ && ntlmssp_state->internal_chal.length == 8);
ntlmssp_state->doing_ntlm2 = True;
MD5Update(&md5_session_nonce_ctx, ntlmssp_state->session_nonce, 16);
MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
- ntlmssp_state->chal = data_blob_talloc(ntlmssp_state->mem_ctx, session_nonce_hash, 8);
+ ntlmssp_state->chal = data_blob_talloc(ntlmssp_state->mem_ctx,
+ session_nonce_hash, 8);
- /* LM response is no longer useful */
+ /* LM response is no longer useful, zero it out */
data_blob_free(&ntlmssp_state->lm_resp);
/* We changed the effective challenge - set it */
- if (!NT_STATUS_IS_OK(nt_status = ntlmssp_state->set_challenge(ntlmssp_state, &ntlmssp_state->chal))) {
+ if (!NT_STATUS_IS_OK(nt_status =
+ ntlmssp_state->set_challenge(ntlmssp_state,
+ &ntlmssp_state->chal))) {
+ /* zero this out */
data_blob_free(&ntlmssp_state->encrypted_session_key);
return nt_status;
}
}
/**
- * Next state function for the Authenticate packet
+ * Next state function for the Authenticate packet
+ * (after authentication - figures out the session keys etc)
*
* @param ntlmssp_state NTLMSSP State
- * @param request The request, as a DATA_BLOB
- * @param reply The reply, as an allocated DATA_BLOB, caller to free.
* @return Errors or NT_STATUS_OK.
*/
static NTSTATUS ntlmssp_server_postauth(struct ntlmssp_state *ntlmssp_state,
DATA_BLOB *user_session_key,
- DATA_BLOB *lm_session_key,
- DATA_BLOB *reply)
+ DATA_BLOB *lm_session_key)
{
NTSTATUS nt_status;
DATA_BLOB session_key = data_blob(NULL, 0);
- /* parse the NTLMSSP packet */
- *reply = data_blob(NULL, 0);
-
if (user_session_key)
dump_data_pw("USER session key:\n", user_session_key->data, user_session_key->length);
data_blob_free(&ntlmssp_state->encrypted_session_key);
- /* allow arbitarily many authentications */
- ntlmssp_state->expected_state = NTLMSSP_AUTH;
+ /* allow arbitarily many authentications, but watch that this will cause a
+ memory leak, until the ntlmssp_state is shutdown
+ */
+
+ if (ntlmssp_state->server_multiple_authentications) {
+ ntlmssp_state->expected_state = NTLMSSP_AUTH;
+ } else {
+ ntlmssp_state->expected_state = NTLMSSP_DONE;
+ }
return nt_status;
}
* Next state function for the Authenticate packet
*
* @param ntlmssp_state NTLMSSP State
- * @param request The request, as a DATA_BLOB
- * @param reply The reply, as an allocated DATA_BLOB, caller to free.
- * @return Errors or NT_STATUS_OK.
+ * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB
+ * @param out The reply, as an allocated DATA_BLOB, caller to free.
+ * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK.
*/
static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state,
- const DATA_BLOB request, DATA_BLOB *reply)
+ TALLOC_CTX *out_mem_ctx,
+ const DATA_BLOB in, DATA_BLOB *out)
{
DATA_BLOB user_session_key = data_blob(NULL, 0);
DATA_BLOB lm_session_key = data_blob(NULL, 0);
NTSTATUS nt_status;
- /* parse the NTLMSSP packet */
- *reply = data_blob(NULL, 0);
+ /* zero the outbound NTLMSSP packet */
+ *out = data_blob_talloc(out_mem_ctx, NULL, 0);
- if (!NT_STATUS_IS_OK(nt_status = ntlmssp_server_preauth(ntlmssp_state, request))) {
+ if (!NT_STATUS_IS_OK(nt_status = ntlmssp_server_preauth(ntlmssp_state, in))) {
return nt_status;
}
return nt_status;
}
- return ntlmssp_server_postauth(ntlmssp_state, &user_session_key, &lm_session_key, reply);
+ if (ntlmssp_state->server_use_session_keys) {
+ return ntlmssp_server_postauth(ntlmssp_state, &user_session_key, &lm_session_key);
+ } else {
+ ntlmssp_state->session_key = data_blob(NULL, 0);
+ return NT_STATUS_OK;
+ }
}
/**
(*ntlmssp_state)->allow_lm_key = (lp_lanman_auth()
&& lp_parm_bool(-1, "ntlmssp_server", "allow_lm_key", False));
+ (*ntlmssp_state)->server_use_session_keys = True;
+ (*ntlmssp_state)->server_multiple_authentications = False;
+
(*ntlmssp_state)->ref_count = 1;
(*ntlmssp_state)->neg_flags =
* Next state function for the Initial packet
*
* @param ntlmssp_state NTLMSSP State
- * @param request The request, as a DATA_BLOB. reply.data must be NULL
- * @param request The reply, as an allocated DATA_BLOB, caller to free.
+ * @param out_mem_ctx The DATA_BLOB *out will be allocated on this context
+ * @param in The request, as a DATA_BLOB. reply.data must be NULL
+ * @param out The reply, as an talloc()ed DATA_BLOB, on out_mem_ctx
* @return Errors or NT_STATUS_OK.
*/
static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state,
- DATA_BLOB reply, DATA_BLOB *next_request)
+ TALLOC_CTX *out_mem_ctx,
+ DATA_BLOB in, DATA_BLOB *out)
{
if (ntlmssp_state->unicode) {
ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
}
/* generate the ntlmssp negotiate packet */
- msrpc_gen(next_request, "CddAA",
+ msrpc_gen(out_mem_ctx,
+ out, "CddAA",
"NTLMSSP",
NTLMSSP_NEGOTIATE,
ntlmssp_state->neg_flags,
*/
static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state,
- const DATA_BLOB reply, DATA_BLOB *next_request)
+ TALLOC_CTX *out_mem_ctx,
+ const DATA_BLOB in, DATA_BLOB *out)
{
uint32 chal_flags, ntlmssp_command, unkn1, unkn2;
DATA_BLOB server_domain_blob;
DATA_BLOB encrypted_session_key = data_blob(NULL, 0);
NTSTATUS nt_status;
- if (!msrpc_parse(&reply, "CdBd",
+ if (!msrpc_parse(ntlmssp_state->mem_ctx,
+ &in, "CdBd",
"NTLMSSP",
&ntlmssp_command,
&server_domain_blob,
&chal_flags)) {
DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
- dump_data(2, (const char *)reply.data, reply.length);
+ dump_data(2, (const char *)in.data, in.length);
return NT_STATUS_INVALID_PARAMETER;
}
DEBUG(3, ("NTLMSSP: Set final flags:\n"));
debug_ntlmssp_flags(ntlmssp_state->neg_flags);
- if (!msrpc_parse(&reply, chal_parse_string,
+ if (!msrpc_parse(ntlmssp_state->mem_ctx,
+ &in, chal_parse_string,
"NTLMSSP",
&ntlmssp_command,
&server_domain,
&unkn1, &unkn2,
&struct_blob)) {
DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
- dump_data(2, (const char *)reply.data, reply.length);
+ dump_data(2, (const char *)in.data, in.length);
return NT_STATUS_INVALID_PARAMETER;
}
- ntlmssp_state->server_domain = talloc_strdup(ntlmssp_state->mem_ctx,
- server_domain);
+ ntlmssp_state->server_domain = server_domain;
- SAFE_FREE(server_domain);
if (challenge_blob.length != 8) {
- data_blob_free(&struct_blob);
return NT_STATUS_INVALID_PARAMETER;
}
/* LM Key is incompatible... */
ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
}
-
}
if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
dump_data_pw("LM session key\n", session_key.data, session_key.length);
}
- data_blob_free(&struct_blob);
-
/* Key exchange encryptes a new client-generated session key with
the password-derived key */
generate_random_buffer(client_session_key, sizeof(client_session_key), False);
/* Encrypt the new session key with the old one */
- encrypted_session_key = data_blob(client_session_key, sizeof(client_session_key));
+ encrypted_session_key = data_blob_talloc(ntlmssp_state->mem_ctx,
+ client_session_key, sizeof(client_session_key));
dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length);
SamOEMhash(encrypted_session_key.data, session_key.data, encrypted_session_key.length);
dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
/* Mark the new session key as the 'real' session key */
- data_blob_free(&session_key);
session_key = data_blob_talloc(ntlmssp_state->mem_ctx, client_session_key, sizeof(client_session_key));
}
/* this generates the actual auth packet */
- if (!msrpc_gen(next_request, auth_gen_string,
+ if (!msrpc_gen(out_mem_ctx,
+ out, auth_gen_string,
"NTLMSSP",
NTLMSSP_AUTH,
lm_response.data, lm_response.length,
return NT_STATUS_NO_MEMORY;
}
- data_blob_free(&encrypted_session_key);
-
- data_blob_free(&ntlmssp_state->chal);
-
ntlmssp_state->session_key = session_key;
/* The client might be using 56 or 40 bit weakened keys */
ntlmssp_state->lm_resp = lm_response;
ntlmssp_state->nt_resp = nt_response;
- ntlmssp_state->expected_state = NTLMSSP_UNKNOWN;
+ ntlmssp_state->expected_state = NTLMSSP_DONE;
if (!NT_STATUS_IS_OK(nt_status = ntlmssp_sign_init(ntlmssp_state))) {
- DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status)));
+ DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n",
+ nt_errstr(nt_status)));
return nt_status;
}
NTLMSSP_NEGOTIATE = 1,
NTLMSSP_CHALLENGE = 2,
NTLMSSP_AUTH = 3,
- NTLMSSP_UNKNOWN = 4
+ NTLMSSP_UNKNOWN = 4,
+ NTLMSSP_DONE = 5 /* samba final state */
};
/* NTLMSSP negotiation flags */
BOOL unicode;
BOOL use_ntlmv2;
- BOOL use_nt_response; /* Set to 'NO' to debug what happens when the NT response is omited */
+ BOOL use_nt_response; /* Set to 'False' to debug what happens when the NT response is omited */
BOOL allow_lm_key; /* The LM_KEY code is not functional at this point, and it's not
very secure anyway */
+
+ BOOL server_use_session_keys; /* Set to 'False' for authentication only,
+ that will never return a session key */
+ BOOL server_multiple_authentications; /* Set to 'True' to allow squid 2.5
+ style 'challenge caching' */
+
char *user;
char *domain;
char *workstation;
uint32 ntlmssp_seq_num;
/* ntlmv2 */
- char send_sign_const[16];
- char send_seal_const[16];
- char recv_sign_const[16];
- char recv_seal_const[16];
+ char send_sign_key[16];
+ char send_seal_key[16];
+ char recv_sign_key[16];
+ char recv_seal_key[16];
unsigned char send_sign_hash[258];
unsigned char send_seal_hash[258];
d = word (4 bytes)
C = constant ascii string
*/
-BOOL msrpc_gen(DATA_BLOB *blob,
+BOOL msrpc_gen(TALLOC_CTX *mem_ctx, DATA_BLOB *blob,
const char *format, ...)
{
int i, n;
va_end(ap);
/* allocate the space, then scan the format again to fill in the values */
- *blob = data_blob(NULL, head_size + data_size);
+ *blob = data_blob_talloc(mem_ctx, NULL, head_size + data_size);
head_ofs = 0;
data_ofs = head_size;
C = constant ascii string
*/
-BOOL msrpc_parse(const DATA_BLOB *blob,
+BOOL msrpc_parse(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob,
const char *format, ...)
{
int i;
va_list ap;
- char **ps, *s;
+ const char **ps, *s;
DATA_BLOB *b;
size_t head_ofs = 0;
uint16 len1, len2;
ps = va_arg(ap, char **);
if (len1 == 0 && len2 == 0) {
- *ps = smb_xstrdup("");
+ *ps = "";
} else {
/* make sure its in the right format - be strict */
if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
pull_string(NULL, p, blob->data + ptr, sizeof(p),
len1,
STR_UNICODE|STR_NOALIGN);
- (*ps) = smb_xstrdup(p);
+ (*ps) = talloc_strdup(mem_ctx, p);
+ if (!(*ps)) {
+ return False;
+ }
} else {
- (*ps) = smb_xstrdup("");
+ (*ps) = "";
}
}
break;
ps = va_arg(ap, char **);
/* make sure its in the right format - be strict */
if (len1 == 0 && len2 == 0) {
- *ps = smb_xstrdup("");
+ *ps = "";
} else {
if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
return False;
pull_string(NULL, p, blob->data + ptr, sizeof(p),
len1,
STR_ASCII|STR_NOALIGN);
- (*ps) = smb_xstrdup(p);
+ (*ps) = talloc_strdup(mem_ctx, p);
+ if (!(*ps)) {
+ return False;
+ }
} else {
- (*ps) = smb_xstrdup("");
+ (*ps) = "";
}
}
break;
b = (DATA_BLOB *)va_arg(ap, void *);
if (len1 == 0 && len2 == 0) {
- *b = data_blob(NULL, 0);
+ *b = data_blob_talloc(mem_ctx, NULL, 0);
} else {
/* make sure its in the right format - be strict */
if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
if (blob->data + ptr < (uint8 *)ptr || blob->data + ptr < blob->data)
return False;
- *b = data_blob(blob->data + ptr, len1);
+ *b = data_blob_talloc(mem_ctx, blob->data + ptr, len1);
}
break;
case 'b':
if (blob->data + head_ofs < (uint8 *)head_ofs || blob->data + head_ofs < blob->data)
return False;
- *b = data_blob(blob->data + head_ofs, len1);
+ *b = data_blob_talloc(mem_ctx, blob->data + head_ofs, len1);
head_ofs += len1;
break;
case 'd':
hash[257] = index_j;
}
-static void calc_hash(unsigned char hash[258], const char *k2, int k2l)
+static void calc_hash(unsigned char hash[258], const char *key, size_t key_len)
{
unsigned char j = 0;
int ind;
{
unsigned char tc;
- j += (hash[ind] + k2[ind%k2l]);
+ j += (hash[ind] + key[ind%key_len]);
tc = hash[ind];
hash[ind] = hash[j];
hash[257] = 0;
}
-static void calc_ntlmv2_hash(unsigned char hash[258], unsigned char digest[16],
+/**
+ * Some notes on then NTLM2 code:
+ *
+ * This code works correctly for the sealing part of the problem. If
+ * we disable the check for valid client signatures, then we see that
+ * the output of a rpcecho 'sinkdata' at smbd is correct. We get the
+ * valid data, and it is validly decrypted.
+ *
+ * This means that the quantity of data passing though the RC4 sealing
+ * pad is correct.
+ *
+ * This code also correctly matches test values that I have obtained,
+ * claiming to be the correct output of NTLM2 signature generation.
+ *
+ */
+
+
+
+
+static void calc_ntlmv2_hash(unsigned char hash[258], unsigned char subkey[16],
DATA_BLOB session_key,
const char *constant)
{
struct MD5Context ctx3;
- /* NOTE: This code is currently complate fantasy - it's
- got more in common with reality than the previous code
- (the LM session key is not the right thing to use) but
- it still needs work */
-
MD5Init(&ctx3);
MD5Update(&ctx3, session_key.data, session_key.length);
- MD5Update(&ctx3, (const unsigned char *)constant, strlen(constant)+1);
- MD5Final(digest, &ctx3);
+ MD5Update(&ctx3, constant, strlen(constant)+1);
+ MD5Final(subkey, &ctx3);
- calc_hash(hash, digest, 16);
+ calc_hash(hash, subkey, 16);
}
enum ntlmssp_direction {
};
static NTSTATUS ntlmssp_make_packet_signature(NTLMSSP_STATE *ntlmssp_state,
+ TALLOC_CTX *sig_mem_ctx,
const uchar *data, size_t length,
enum ntlmssp_direction direction,
DATA_BLOB *sig)
{
if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+
HMACMD5Context ctx;
uchar seq_num[4];
uchar digest[16];
SIVAL(seq_num, 0, ntlmssp_state->ntlmssp_seq_num);
- hmac_md5_init_limK_to_64((const unsigned char *)(ntlmssp_state->send_sign_const), 16, &ctx);
+ switch (direction) {
+ case NTLMSSP_SEND:
+ hmac_md5_init_limK_to_64(ntlmssp_state->send_sign_key,
+ sizeof(ntlmssp_state->send_sign_key), &ctx);
+ break;
+ case NTLMSSP_RECEIVE:
+ hmac_md5_init_limK_to_64(ntlmssp_state->recv_sign_key,
+ sizeof(ntlmssp_state->recv_sign_key), &ctx);
+ break;
+ }
hmac_md5_update(seq_num, 4, &ctx);
hmac_md5_update(data, length, &ctx);
hmac_md5_final(digest, &ctx);
- if (!msrpc_gen(sig, "dBd", NTLMSSP_SIGN_VERSION, digest, 8 /* only copy first 8 bytes */
- , ntlmssp_state->ntlmssp_seq_num)) {
- return NT_STATUS_NO_MEMORY;
- }
-
if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
switch (direction) {
case NTLMSSP_SEND:
- NTLMSSPcalc_ap(ntlmssp_state->send_sign_hash, sig->data+4, sig->length-4);
+ NTLMSSPcalc_ap(ntlmssp_state->send_seal_hash, digest, 8);
break;
case NTLMSSP_RECEIVE:
- NTLMSSPcalc_ap(ntlmssp_state->recv_sign_hash, sig->data+4, sig->length-4);
+ NTLMSSPcalc_ap(ntlmssp_state->recv_seal_hash, digest, 8);
break;
}
}
+ *sig = data_blob_talloc(sig_mem_ctx, NULL, 16);
+ SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION);
+ memcpy(sig->data + 4, digest, 8);
+ memcpy(sig->data + 12, seq_num, 4);
+
} else {
uint32 crc;
crc = crc32_calc_buffer((const char *)data, length);
- if (!msrpc_gen(sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) {
+ if (!msrpc_gen(sig_mem_ctx, sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) {
return NT_STATUS_NO_MEMORY;
}
}
NTSTATUS ntlmssp_sign_packet(NTLMSSP_STATE *ntlmssp_state,
- const uchar *data, size_t length,
- DATA_BLOB *sig)
+ TALLOC_CTX *sig_mem_ctx,
+ const uchar *data, size_t length,
+ DATA_BLOB *sig)
{
NTSTATUS nt_status;
+
if (!ntlmssp_state->session_key.length) {
DEBUG(3, ("NO session key, cannot check sign packet\n"));
return NT_STATUS_NO_USER_SESSION_KEY;
}
- nt_status = ntlmssp_make_packet_signature(ntlmssp_state, data, length, NTLMSSP_SEND, sig);
+ nt_status = ntlmssp_make_packet_signature(ntlmssp_state, sig_mem_ctx,
+ data, length, NTLMSSP_SEND, sig);
/* increment counter on send */
ntlmssp_state->ntlmssp_seq_num++;
/**
* Check the signature of an incoming packet
- * @note caller *must* check that the signature is the size it expects
*
*/
NTSTATUS ntlmssp_check_packet(NTLMSSP_STATE *ntlmssp_state,
+ TALLOC_CTX *sig_mem_ctx,
const uchar *data, size_t length,
const DATA_BLOB *sig)
{
(unsigned long)sig->length));
}
- nt_status = ntlmssp_make_packet_signature(ntlmssp_state, data,
+ nt_status = ntlmssp_make_packet_signature(ntlmssp_state, sig_mem_ctx, data,
length, NTLMSSP_RECEIVE, &local_sig);
if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
}
- if (local_sig.length != sig->length ||
- memcmp(local_sig.data + local_sig.length - 8,
- sig->data + sig->length - 8, 8) != 0) {
- DEBUG(5, ("BAD SIG: wanted signature of\n"));
- dump_data(5, (const char *)local_sig.data, local_sig.length);
-
- DEBUG(5, ("BAD SIG: got signature of\n"));
- dump_data(5, (const char *)(sig->data), sig->length);
+ /* increment counter on recv */
+ ntlmssp_state->ntlmssp_seq_num++;
- DEBUG(0, ("NTLMSSP packet check failed due to invalid signature!\n"));
- return NT_STATUS_ACCESS_DENIED;
+ if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+ if (local_sig.length != sig->length ||
+ memcmp(local_sig.data,
+ sig->data, sig->length) != 0) {
+ DEBUG(5, ("BAD SIG NTLM2: wanted signature of\n"));
+ dump_data(5, local_sig.data, local_sig.length);
+
+ DEBUG(5, ("BAD SIG: got signature of\n"));
+ dump_data(5, sig->data, sig->length);
+
+ DEBUG(0, ("NTLMSSP NTLM2 packet check failed due to invalid signature!\n"));
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ } else {
+ if (local_sig.length != sig->length ||
+ memcmp(local_sig.data + 8,
+ sig->data + 8, sig->length - 8) != 0) {
+ DEBUG(5, ("BAD SIG NTLM1: wanted signature of\n"));
+ dump_data(5, (const char *)local_sig.data, local_sig.length);
+
+ DEBUG(5, ("BAD SIG: got signature of\n"));
+ dump_data(5, (const char *)(sig->data), sig->length);
+
+ DEBUG(0, ("NTLMSSP NTLM1 packet check failed due to invalid signature!\n"));
+ return NT_STATUS_ACCESS_DENIED;
+ }
}
- /* increment counter on recieive */
- ntlmssp_state->ntlmssp_seq_num++;
-
return NT_STATUS_OK;
}
*/
NTSTATUS ntlmssp_seal_packet(NTLMSSP_STATE *ntlmssp_state,
+ TALLOC_CTX *sig_mem_ctx,
uchar *data, size_t length,
DATA_BLOB *sig)
{
dump_data_pw("ntlmssp clear data\n", data, length);
if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
HMACMD5Context ctx;
- char seq_num[4];
+ uchar seq_num[4];
uchar digest[16];
SIVAL(seq_num, 0, ntlmssp_state->ntlmssp_seq_num);
- hmac_md5_init_limK_to_64((const unsigned char *)(ntlmssp_state->send_sign_const), 16, &ctx);
- hmac_md5_update((const unsigned char *)seq_num, 4, &ctx);
+ hmac_md5_init_limK_to_64(ntlmssp_state->send_sign_key,
+ sizeof(ntlmssp_state->send_sign_key), &ctx);
+ hmac_md5_update(seq_num, 4, &ctx);
hmac_md5_update(data, length, &ctx);
hmac_md5_final(digest, &ctx);
- if (!msrpc_gen(sig, "dBd", NTLMSSP_SIGN_VERSION, digest, 8 /* only copy first 8 bytes */
- , ntlmssp_state->ntlmssp_seq_num)) {
- return NT_STATUS_NO_MEMORY;
+ /* The order of these two operations matters - we must first seal the packet,
+ then seal the sequence number - this is becouse the send_seal_hash is not
+ constant, but is is rather updated with each iteration */
+
+ NTLMSSPcalc_ap(ntlmssp_state->send_seal_hash, data, length);
+
+ if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
+ NTLMSSPcalc_ap(ntlmssp_state->send_seal_hash, digest, 8);
}
- dump_data_pw("ntlmssp client sealing hash:\n",
- ntlmssp_state->send_seal_hash,
- sizeof(ntlmssp_state->send_seal_hash));
- NTLMSSPcalc_ap(ntlmssp_state->send_seal_hash, data, length);
- dump_data_pw("ntlmssp client signing hash:\n",
- ntlmssp_state->send_sign_hash,
- sizeof(ntlmssp_state->send_sign_hash));
- NTLMSSPcalc_ap(ntlmssp_state->send_sign_hash, sig->data+4, sig->length-4);
+ *sig = data_blob_talloc(sig_mem_ctx, NULL, 16);
+ SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION);
+ memcpy(sig->data + 4, digest, 8);
+ memcpy(sig->data + 12, seq_num, 4);
} else {
uint32 crc;
crc = crc32_calc_buffer((const char *)data, length);
- if (!msrpc_gen(sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) {
+ if (!msrpc_gen(sig_mem_ctx, sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) {
return NT_STATUS_NO_MEMORY;
}
*/
NTSTATUS ntlmssp_unseal_packet(NTLMSSP_STATE *ntlmssp_state,
- uchar *data, size_t length,
- DATA_BLOB *sig)
+ TALLOC_CTX *sig_mem_ctx,
+ uchar *data, size_t length,
+ DATA_BLOB *sig)
{
if (!ntlmssp_state->session_key.length) {
DEBUG(3, ("NO session key, cannot unseal packet\n"));
}
dump_data_pw("ntlmssp clear data\n", data, length);
- return ntlmssp_check_packet(ntlmssp_state, data, length, sig);
+ return ntlmssp_check_packet(ntlmssp_state, sig_mem_ctx, data, length, sig);
+
+ /* increment counter on recv */
+ ntlmssp_state->ntlmssp_seq_num++;
}
/**
break;
}
+ /* SEND */
calc_ntlmv2_hash(ntlmssp_state->send_sign_hash,
- ntlmssp_state->send_sign_const,
+ ntlmssp_state->send_sign_key,
ntlmssp_state->session_key, send_sign_const);
+ dump_data_pw("NTLMSSP send sign key:\n",
+ ntlmssp_state->send_sign_key,
+ sizeof(ntlmssp_state->send_sign_key));
+
dump_data_pw("NTLMSSP send sign hash:\n",
ntlmssp_state->send_sign_hash,
sizeof(ntlmssp_state->send_sign_hash));
calc_ntlmv2_hash(ntlmssp_state->send_seal_hash,
- ntlmssp_state->send_seal_const,
+ ntlmssp_state->send_seal_key,
ntlmssp_state->session_key, send_seal_const);
+ dump_data_pw("NTLMSSP send seal key:\n",
+ ntlmssp_state->send_seal_key,
+ sizeof(ntlmssp_state->send_seal_key));
+
dump_data_pw("NTLMSSP send sesl hash:\n",
ntlmssp_state->send_seal_hash,
sizeof(ntlmssp_state->send_seal_hash));
+ /* RECV */
calc_ntlmv2_hash(ntlmssp_state->recv_sign_hash,
- ntlmssp_state->recv_sign_const,
+ ntlmssp_state->recv_sign_key,
ntlmssp_state->session_key, recv_sign_const);
+ dump_data_pw("NTLMSSP recv sign key:\n",
+ ntlmssp_state->recv_sign_key,
+ sizeof(ntlmssp_state->recv_sign_key));
dump_data_pw("NTLMSSP receive sign hash:\n",
ntlmssp_state->recv_sign_hash,
sizeof(ntlmssp_state->recv_sign_hash));
calc_ntlmv2_hash(ntlmssp_state->recv_seal_hash,
- ntlmssp_state->recv_seal_const,
+ ntlmssp_state->recv_seal_key,
ntlmssp_state->session_key, recv_seal_const);
+ dump_data_pw("NTLMSSP recv seal key:\n",
+ ntlmssp_state->recv_sign_key,
+ sizeof(ntlmssp_state->recv_seal_key));
dump_data_pw("NTLMSSP receive seal hash:\n",
ntlmssp_state->recv_sign_hash,
sizeof(ntlmssp_state->recv_sign_hash));
- }
- else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
- if (!ntlmssp_state->session_key.data || ntlmssp_state->session_key.length < 8) {
- /* can't sign or check signatures yet */
- DEBUG(5, ("NTLMSSP Sign/Seal - cannot use LM KEY yet\n"));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- DEBUG(5, ("NTLMSSP Sign/Seal - using LM KEY\n"));
-
- calc_hash(ntlmssp_state->ntlmssp_hash, (const char *)(ntlmssp_state->session_key.data), 8);
- dump_data_pw("NTLMSSP hash:\n", ntlmssp_state->ntlmssp_hash,
- sizeof(ntlmssp_state->ntlmssp_hash));
} else {
- if (!ntlmssp_state->session_key.data || ntlmssp_state->session_key.length < 16) {
+ if (!ntlmssp_state->session_key.data) {
/* can't sign or check signatures yet */
- DEBUG(5, ("NTLMSSP Sign/Seal - cannot use NT KEY yet\n"));
+ DEBUG(5, ("NTLMSSP Sign/Seal - cannot use NT KEY\n"));
return NT_STATUS_UNSUCCESSFUL;
}
DEBUG(5, ("NTLMSSP Sign/Seal - using NT KEY\n"));
- calc_hash(ntlmssp_state->ntlmssp_hash, (const char *)(ntlmssp_state->session_key.data), 16);
+ calc_hash(ntlmssp_state->ntlmssp_hash, (const char *)(ntlmssp_state->session_key.data), ntlmssp_state->session_key.length);
dump_data_pw("NTLMSSP hash:\n", ntlmssp_state->ntlmssp_hash,
sizeof(ntlmssp_state->ntlmssp_hash));
}
unseal a packet
*/
NTSTATUS schannel_unseal_packet(struct schannel_state *state,
+ TALLOC_CTX *mem_ctx,
uchar *data, size_t length,
DATA_BLOB *sig)
{
seal a packet
*/
NTSTATUS schannel_seal_packet(struct schannel_state *state,
+ TALLOC_CTX *mem_ctx,
uchar *data, size_t length,
DATA_BLOB *sig)
{
netsec_deal_with_seq_num(state, digest_final, seq_num);
if (!state->signature.data) {
- state->signature = data_blob_talloc(state->mem_ctx, NULL, 32);
+ state->signature = data_blob_talloc(mem_ctx, NULL, 32);
if (!state->signature.data) {
return NT_STATUS_NO_MEMORY;
}
sign a packet
*/
NTSTATUS schannel_sign_packet(struct schannel_state *state,
+ TALLOC_CTX *mem_ctx,
const uchar *data, size_t length,
DATA_BLOB *sig)
{
netsec_deal_with_seq_num(state, digest_final, seq_num);
if (!state->signature.data) {
- state->signature = data_blob_talloc(state->mem_ctx, NULL, 32);
+ state->signature = data_blob_talloc(mem_ctx, NULL, 32);
if (!state->signature.data) {
return NT_STATUS_NO_MEMORY;
}
#endif
}
-DATA_BLOB NTLMv2_generate_names_blob(const char *hostname,
+DATA_BLOB NTLMv2_generate_names_blob(TALLOC_CTX *mem_ctx,
+ const char *hostname,
const char *domain)
{
- DATA_BLOB names_blob = data_blob(NULL, 0);
+ DATA_BLOB names_blob = data_blob_talloc(mem_ctx, NULL, 0);
- msrpc_gen(&names_blob, "aaa",
+ msrpc_gen(mem_ctx, &names_blob, "aaa",
NTLMSSP_NAME_TYPE_DOMAIN, domain,
NTLMSSP_NAME_TYPE_SERVER, hostname,
0, "");
return names_blob;
}
-static DATA_BLOB NTLMv2_generate_client_data(const DATA_BLOB *names_blob)
+static DATA_BLOB NTLMv2_generate_client_data(TALLOC_CTX *mem_ctx, const DATA_BLOB *names_blob)
{
uchar client_chal[8];
DATA_BLOB response = data_blob(NULL, 0);
/* See http://www.ubiqx.org/cifs/SMB.html#SMB.8.5 */
- msrpc_gen(&response, "ddbbdb",
+ msrpc_gen(mem_ctx, &response, "ddbbdb",
0x00000101, /* Header */
0, /* 'Reserved' */
long_date, 8, /* Timestamp */
DATA_BLOB ntlmv2_client_data;
DATA_BLOB final_response;
+ TALLOC_CTX *mem_ctx = talloc_init("NTLMv2_generate_response internal context");
+
+ if (!mem_ctx) {
+ return data_blob(NULL, 0);
+ }
+
/* NTLMv2 */
/* generate some data to pass into the response function - including
the hostname and domain name of the server */
- ntlmv2_client_data = NTLMv2_generate_client_data(names_blob);
+ ntlmv2_client_data = NTLMv2_generate_client_data(mem_ctx, names_blob);
/* Given that data, and the challenge from the server, generate a response */
SMBOWFencrypt_ntv2(ntlm_v2_hash, server_chal, &ntlmv2_client_data, ntlmv2_response);
memcpy(final_response.data+sizeof(ntlmv2_response),
ntlmv2_client_data.data, ntlmv2_client_data.length);
- data_blob_free(&ntlmv2_client_data);
+ talloc_destroy(mem_ctx);
return final_response;
}
/* Function: 0x2d */
- NTSTATUS UNK_GET_CONNUSER ();
+ NTSTATUS UNK_GET_CONNUSER (
+ [in] unistr *system_name,
+ [in] uint32 unknown1,
+ [in] uint32 unknown2,
+ [in] uint32 unknown3,
+ [out] unistr *username,
+ [out] unistr *domain_name
+ );
+
/* Function: 0x2e */
NTSTATUS QUERYINFO2 ();
}
switch (p->auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
status = p->security_state->unseal_packet(p->security_state,
+ mem_ctx,
pkt->u.response.stub_and_verifier.data,
pkt->u.response.stub_and_verifier.length,
&auth.credentials);
case DCERPC_AUTH_LEVEL_INTEGRITY:
status = p->security_state->check_packet(p->security_state,
+ mem_ctx,
pkt->u.response.stub_and_verifier.data,
pkt->u.response.stub_and_verifier.length,
&auth.credentials);
switch (p->auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
status = p->security_state->seal_packet(p->security_state,
+ mem_ctx,
ndr->data + DCERPC_REQUEST_LENGTH,
ndr->offset - DCERPC_REQUEST_LENGTH,
&p->auth_info->credentials);
case DCERPC_AUTH_LEVEL_INTEGRITY:
status = p->security_state->sign_packet(p->security_state,
+ mem_ctx,
ndr->data + DCERPC_REQUEST_LENGTH,
ndr->offset - DCERPC_REQUEST_LENGTH,
&p->auth_info->credentials);
struct dcerpc_security {
void *private;
NTSTATUS (*unseal_packet)(struct dcerpc_security *,
+ TALLOC_CTX *mem_ctx,
uchar *data, size_t length, DATA_BLOB *sig);
NTSTATUS (*check_packet)(struct dcerpc_security *,
+ TALLOC_CTX *mem_ctx,
const uchar *data, size_t length, const DATA_BLOB *sig);
NTSTATUS (*seal_packet)(struct dcerpc_security *,
- uchar *data, size_t length, DATA_BLOB *sig);
+ TALLOC_CTX *mem_ctx,
+ uchar *data, size_t length, DATA_BLOB *sig);
NTSTATUS (*sign_packet)(struct dcerpc_security *,
+ TALLOC_CTX *mem_ctx,
const uchar *data, size_t length, DATA_BLOB *sig);
NTSTATUS (*session_key)(struct dcerpc_security *, DATA_BLOB *session_key);
void (*security_end)(struct dcerpc_security *);
wrappers for the ntlmssp_*() functions
*/
static NTSTATUS ntlm_unseal_packet(struct dcerpc_security *dcerpc_security,
- uchar *data, size_t length, DATA_BLOB *sig)
+ TALLOC_CTX *mem_ctx,
+ uchar *data, size_t length, DATA_BLOB *sig)
{
struct ntlmssp_state *ntlmssp_state = dcerpc_security->private;
- return ntlmssp_unseal_packet(ntlmssp_state, data, length, sig);
+ return ntlmssp_unseal_packet(ntlmssp_state, mem_ctx, data, length, sig);
}
static NTSTATUS ntlm_check_packet(struct dcerpc_security *dcerpc_security,
+ TALLOC_CTX *mem_ctx,
const uchar *data, size_t length,
const DATA_BLOB *sig)
{
struct ntlmssp_state *ntlmssp_state = dcerpc_security->private;
- return ntlmssp_check_packet(ntlmssp_state, data, length, sig);
+ return ntlmssp_check_packet(ntlmssp_state, mem_ctx, data, length, sig);
}
static NTSTATUS ntlm_seal_packet(struct dcerpc_security *dcerpc_security,
+ TALLOC_CTX *mem_ctx,
uchar *data, size_t length,
DATA_BLOB *sig)
{
struct ntlmssp_state *ntlmssp_state = dcerpc_security->private;
- return ntlmssp_seal_packet(ntlmssp_state, data, length, sig);
+ return ntlmssp_seal_packet(ntlmssp_state, mem_ctx, data, length, sig);
}
static NTSTATUS ntlm_sign_packet(struct dcerpc_security *dcerpc_security,
+ TALLOC_CTX *mem_ctx,
const uchar *data, size_t length,
DATA_BLOB *sig)
{
struct ntlmssp_state *ntlmssp_state = dcerpc_security->private;
- return ntlmssp_sign_packet(ntlmssp_state, data, length, sig);
+ return ntlmssp_sign_packet(ntlmssp_state, mem_ctx, data, length, sig);
}
static NTSTATUS ntlm_session_key(struct dcerpc_security *dcerpc_security,
p->auth_info->credentials = data_blob(NULL, 0);
p->security_state = NULL;
- status = ntlmssp_update(state,
+ status = ntlmssp_update(state, mem_ctx,
p->auth_info->credentials,
&credentials);
+
if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
goto done;
}
- p->auth_info->credentials = data_blob_talloc(mem_ctx,
- credentials.data,
- credentials.length);
- data_blob_free(&credentials);
+ p->auth_info->credentials = credentials;
status = dcerpc_bind_byuuid(p, mem_ctx, uuid, version);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
-
- status = ntlmssp_update(state,
+ status = ntlmssp_update(state, mem_ctx,
p->auth_info->credentials,
&credentials);
+
if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
goto done;
}
- p->auth_info->credentials = data_blob_talloc(mem_ctx,
- credentials.data,
- credentials.length);
- data_blob_free(&credentials);
+ p->auth_info->credentials = credentials;
status = dcerpc_auth3(p, mem_ctx);
p->security_state->session_key = ntlm_session_key;
p->security_state->security_end = ntlm_security_end;
- switch (p->auth_info->auth_level) {
- case DCERPC_AUTH_LEVEL_PRIVACY:
- case DCERPC_AUTH_LEVEL_INTEGRITY:
- /* setup for signing */
- status = ntlmssp_sign_init(state);
- break;
- }
-
done:
talloc_destroy(mem_ctx);
wrappers for the schannel_*() functions
*/
static NTSTATUS schan_unseal_packet(struct dcerpc_security *dcerpc_security,
- uchar *data, size_t length, DATA_BLOB *sig)
+ TALLOC_CTX *mem_ctx,
+ uchar *data, size_t length, DATA_BLOB *sig)
{
struct schannel_state *schannel_state = dcerpc_security->private;
- return schannel_unseal_packet(schannel_state, data, length, sig);
+ return schannel_unseal_packet(schannel_state, mem_ctx, data, length, sig);
}
static NTSTATUS schan_check_packet(struct dcerpc_security *dcerpc_security,
- const uchar *data, size_t length,
- const DATA_BLOB *sig)
+ TALLOC_CTX *mem_ctx,
+ const uchar *data, size_t length,
+ const DATA_BLOB *sig)
{
struct schannel_state *schannel_state = dcerpc_security->private;
return schannel_check_packet(schannel_state, data, length, sig);
}
static NTSTATUS schan_seal_packet(struct dcerpc_security *dcerpc_security,
- uchar *data, size_t length,
- DATA_BLOB *sig)
+ TALLOC_CTX *mem_ctx,
+ uchar *data, size_t length,
+ DATA_BLOB *sig)
{
struct schannel_state *schannel_state = dcerpc_security->private;
- return schannel_seal_packet(schannel_state, data, length, sig);
+ return schannel_seal_packet(schannel_state, mem_ctx, data, length, sig);
}
static NTSTATUS schan_sign_packet(struct dcerpc_security *dcerpc_security,
+ TALLOC_CTX *mem_ctx,
const uchar *data, size_t length,
DATA_BLOB *sig)
{
struct schannel_state *schannel_state = dcerpc_security->private;
- return schannel_sign_packet(schannel_state, data, length, sig);
+ return schannel_sign_packet(schannel_state, mem_ctx, data, length, sig);
}
static NTSTATUS schan_session_key(struct dcerpc_security *dcerpc_security,
status = auth_ntlmssp_start(&dce_conn->auth_state.ntlmssp_state);
if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(2, ("Failed to start NTLMSSP subsystem!\n"));
return False;
}
}
status = auth_ntlmssp_update(dce_conn->auth_state.ntlmssp_state,
+ call->mem_ctx,
dce_conn->auth_state.auth_info->credentials,
&dce_conn->auth_state.auth_info->credentials);
if (!NT_STATUS_IS_OK(status) &&
!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ DEBUG(2, ("Failed to start NTLMSSP process NTLMSSP negotiate: %s\n", nt_errstr(status)));
return False;
}
}
status = auth_ntlmssp_update(dce_conn->auth_state.ntlmssp_state,
+ call->mem_ctx,
dce_conn->auth_state.auth_info->credentials,
&dce_conn->auth_state.auth_info->credentials);
if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(4, ("User failed to authenticated with NTLMSSP: %s\n", nt_errstr(status)));
return False;
}
- switch (dce_conn->auth_state.auth_info->auth_level) {
- case DCERPC_AUTH_LEVEL_PRIVACY:
- case DCERPC_AUTH_LEVEL_INTEGRITY:
- /* setup for signing */
- status = ntlmssp_sign_init(dce_conn->auth_state.ntlmssp_state->ntlmssp_state);
- break;
- }
-
return True;
}
switch (dce_conn->auth_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
status = ntlmssp_unseal_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
+ call->mem_ctx,
pkt->u.request.stub_and_verifier.data,
pkt->u.request.stub_and_verifier.length,
&auth.credentials);
case DCERPC_AUTH_LEVEL_INTEGRITY:
status = ntlmssp_check_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
+ call->mem_ctx,
pkt->u.request.stub_and_verifier.data,
pkt->u.request.stub_and_verifier.length,
&auth.credentials);
switch (dce_conn->auth_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
status = ntlmssp_seal_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
+ call->mem_ctx,
ndr->data + DCERPC_REQUEST_LENGTH,
ndr->offset - DCERPC_REQUEST_LENGTH,
&dce_conn->auth_state.auth_info->credentials);
case DCERPC_AUTH_LEVEL_INTEGRITY:
status = ntlmssp_sign_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state,
+ call->mem_ctx,
ndr->data + DCERPC_REQUEST_LENGTH,
ndr->offset - DCERPC_REQUEST_LENGTH,
&dce_conn->auth_state.auth_info->credentials);
torture/basic/charset.o \
torture/basic/mangle_test.o \
torture/basic/denytest.o \
- torture/basic/aliases.o
+ torture/basic/aliases.o
REQUIRED_SUBSYSTEMS = \
LIBSMB
# End SUBSYSTEM TORTURE_BASIC
[BINARY::smbtorture]
OBJ_FILES = \
torture/torture.o \
- torture/torture_util.o
+ torture/torture_util.o \
+ torture/ntlmssp.o
REQUIRED_SUBSYSTEMS = \
TORTURE_BASIC \
TORTURE_RAW \
DATA_BLOB ntlmv2_response = data_blob(NULL, 0);
DATA_BLOB lmv2_response = data_blob(NULL, 0);
DATA_BLOB ntlmv2_session_key = data_blob(NULL, 0);
- DATA_BLOB names_blob = NTLMv2_generate_names_blob(lp_netbios_name(), lp_workgroup());
+ DATA_BLOB names_blob = NTLMv2_generate_names_blob(samlogon_state->mem_ctx, lp_netbios_name(), lp_workgroup());
uchar user_session_key[16];
ZERO_STRUCT(user_session_key);
/* TODO - test with various domain cases, and without domain */
- if (!SMBNTLMv2encrypt(samlogon_state->username, lp_workgroup(), samlogon_state->password, &samlogon_state->chall,
+ if (!SMBNTLMv2encrypt(samlogon_state->username, lp_workgroup(),
+ samlogon_state->password, &samlogon_state->chall,
&names_blob,
&lmv2_response, &ntlmv2_response,
&ntlmv2_session_key)) {
{"RPC-MGMT", torture_rpc_mgmt, 0},
{"RPC-SCANNER", torture_rpc_scanner, 0},
{"RPC-AUTOIDL", torture_rpc_autoidl, 0},
+ {"NTLMSSP-SELFCHECK", torture_ntlmssp_self_check, 0},
{NULL, NULL, 0}};
git.samba.org / kai / samba-autobuild / .git / commitdiff