2 Unix SMB/Netbios implementation.
4 code to manipulate domain credentials
5 Copyright (C) Andrew Tridgell 1997-1998
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 /****************************************************************************
25 represent a credential as a string
26 ****************************************************************************/
27 char *credstr(uchar *cred)
30 slprintf(buf, sizeof(buf) - 1, "%02X%02X%02X%02X%02X%02X%02X%02X",
31 cred[0], cred[1], cred[2], cred[3],
32 cred[4], cred[5], cred[6], cred[7]);
37 /****************************************************************************
38 setup the session key.
39 Input: 8 byte challenge block
40 8 byte server challenge block
41 16 byte md4 encrypted password
44 ****************************************************************************/
45 void cred_session_key(DOM_CHAL *clnt_chal, DOM_CHAL *srv_chal, char *pass,
49 unsigned char sum2[8];
51 sum[0] = IVAL(clnt_chal->data, 0) + IVAL(srv_chal->data, 0);
52 sum[1] = IVAL(clnt_chal->data, 4) + IVAL(srv_chal->data, 4);
57 cred_hash1(session_key, sum2,(unsigned char *)pass);
60 DEBUG(4,("cred_session_key\n"));
62 DEBUG(5,(" clnt_chal: %s\n", credstr(clnt_chal->data)));
63 DEBUG(5,(" srv_chal : %s\n", credstr(srv_chal->data)));
64 DEBUG(5,(" clnt+srv : %s\n", credstr(sum2)));
65 DEBUG(5,(" sess_key : %s\n", credstr(session_key)));
69 /****************************************************************************
74 8 byte stored credential
79 ****************************************************************************/
80 void cred_create(uchar session_key[8], DOM_CHAL *stor_cred, UTIME timestamp,
85 SIVAL(time_cred.data, 0, IVAL(stor_cred->data, 0) + timestamp.time);
86 SIVAL(time_cred.data, 4, IVAL(stor_cred->data, 4));
88 cred_hash2(cred->data, time_cred.data, session_key);
91 DEBUG(4,("cred_create\n"));
93 DEBUG(5,(" sess_key : %s\n", credstr(session_key)));
94 DEBUG(5,(" stor_cred: %s\n", credstr(stor_cred->data)));
95 DEBUG(5,(" timestamp: %x\n" , timestamp.time));
96 DEBUG(5,(" timecred : %s\n", credstr(time_cred.data)));
97 DEBUG(5,(" calc_cred: %s\n", credstr(cred->data)));
101 /****************************************************************************
102 check a supplied credential
105 8 byte received credential
107 8 byte stored credential
111 returns 1 if computed credential matches received credential
113 ****************************************************************************/
114 int cred_assert(DOM_CHAL *cred, uchar session_key[8], DOM_CHAL *stored_cred,
119 cred_create(session_key, stored_cred, timestamp, &cred2);
122 DEBUG(4,("cred_assert\n"));
124 DEBUG(5,(" challenge : %s\n", credstr(cred->data)));
125 DEBUG(5,(" calculated: %s\n", credstr(cred2.data)));
127 if (memcmp(cred->data, cred2.data, 8) == 0)
129 DEBUG(5, ("credentials check ok\n"));
134 DEBUG(5, ("credentials check wrong\n"));
140 /****************************************************************************
141 checks credentials; generates next step in the credential chain
142 ****************************************************************************/
143 BOOL clnt_deal_with_creds(uchar sess_key[8],
144 DOM_CRED *sto_clnt_cred, DOM_CRED *rcv_srv_cred)
149 DEBUG(5,("clnt_deal_with_creds: %d\n", __LINE__));
151 /* increment client time by one second */
152 new_clnt_time.time = sto_clnt_cred->timestamp.time + 1;
154 /* check that the received server credentials are valid */
155 if (!cred_assert(&rcv_srv_cred->challenge, sess_key,
156 &sto_clnt_cred->challenge, new_clnt_time))
161 /* first 4 bytes of the new seed is old client 4 bytes + clnt time + 1 */
162 new_cred = IVAL(sto_clnt_cred->challenge.data, 0);
163 new_cred += new_clnt_time.time;
165 /* store new seed in client credentials */
166 SIVAL(sto_clnt_cred->challenge.data, 0, new_cred);
168 DEBUG(5,(" new clnt cred: %s\n", credstr(sto_clnt_cred->challenge.data)));
173 /****************************************************************************
174 checks credentials; generates next step in the credential chain
175 ****************************************************************************/
176 BOOL deal_with_creds(uchar sess_key[8],
177 DOM_CRED *sto_clnt_cred,
178 DOM_CRED *rcv_clnt_cred, DOM_CRED *rtn_srv_cred)
183 DEBUG(5,("deal_with_creds: %d\n", __LINE__));
185 /* check that the received client credentials are valid */
186 if (!cred_assert(&rcv_clnt_cred->challenge, sess_key,
187 &sto_clnt_cred->challenge, rcv_clnt_cred->timestamp))
192 /* increment client time by one second */
193 new_clnt_time.time = rcv_clnt_cred->timestamp.time + 1;
195 /* first 4 bytes of the new seed is old client 4 bytes + clnt time + 1 */
196 new_cred = IVAL(sto_clnt_cred->challenge.data, 0);
197 new_cred += new_clnt_time.time;
199 DEBUG(5,("deal_with_creds: new_cred[0]=%x\n", new_cred));
201 /* doesn't matter that server time is 0 */
202 rtn_srv_cred->timestamp.time = 0;
204 DEBUG(5,("deal_with_creds: new_clnt_time=%x\n", new_clnt_time.time));
206 /* create return credentials for inclusion in the reply */
207 cred_create(sess_key, &sto_clnt_cred->challenge, new_clnt_time,
208 &rtn_srv_cred->challenge);
210 DEBUG(5,("deal_with_creds: clnt_cred=%s\n", credstr(sto_clnt_cred->challenge.data)));
212 /* store new seed in client credentials */
213 SIVAL(sto_clnt_cred->challenge.data, 0, new_cred);