← Back to branch summary

~lefteris-nikoltsios/+junk/samba-lp1016895

« back to all changes in this revision

Viewing changes to libcli/auth/ntlmssp_sign.c

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2011-12-21 13:18:04 UTC
  • mfrom: (0.39.21 sid)
  • Revision ID: package-import@ubuntu.com-20111221131804-xtlr39wx6njehxxr
Tags: 2:3.6.1-3ubuntu1
* Merge from Debian testing.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/patches/error-trans.fix-276472:
    - Add the translation of Unix Error code -ENOTSUP to NT Error Code
    - NT_STATUS_NOT_SUPPORTED to prevent the Permission denied error.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/control:
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
  + debian/samba.logrotate, debian/samba-common.dhcp, debian/samba.if-up:
    - Make them upstart compatible
  + debian/samba.postinst: 
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/patches/fix-debuglevel-name-conflict.patch: don't use 'debug_level'
    as a global variable name in an NSS module 
  + Dropped:
    - debian/patches/error-trans.fix-276472
    - debian/patches/fix-debuglevel-name-conflict.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
libcli/auth/ntlmssp_sign.c
 
1
/*
 
2
 *  Unix SMB/CIFS implementation.
 
3
 *  Version 3.0
 
4
 *  NTLMSSP Signing routines
 
5
 *  Copyright (C) Andrew Bartlett 2003-2005
 
6
 *
 
7
 *  This program is free software; you can redistribute it and/or modify
 
8
 *  it under the terms of the GNU General Public License as published by
 
9
 *  the Free Software Foundation; either version 3 of the License, or
 
10
 *  (at your option) any later version.
 
11
 *
 
12
 *  This program is distributed in the hope that it will be useful,
 
13
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 
14
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
15
 *  GNU General Public License for more details.
 
16
 *
 
17
 *  You should have received a copy of the GNU General Public License
 
18
 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
 
19
 */
 
20
 
 
21
#include "includes.h"
 
22
#include "../libcli/auth/ntlmssp.h"
 
23
#include "../libcli/auth/libcli_auth.h"
 
24
#include "../lib/crypto/md5.h"
 
25
#include "../lib/crypto/hmacmd5.h"
 
26
#include "../lib/crypto/crc32.h"
 
27
#include "../libcli/auth/ntlmssp_private.h"
 
28
 
 
29
#define CLI_SIGN "session key to client-to-server signing key magic constant"
 
30
#define CLI_SEAL "session key to client-to-server sealing key magic constant"
 
31
#define SRV_SIGN "session key to server-to-client signing key magic constant"
 
32
#define SRV_SEAL "session key to server-to-client sealing key magic constant"
 
33
 
 
34
/**
 
35
 * Some notes on the NTLM2 code:
 
36
 *
 
37
 * NTLM2 is a AEAD system.  This means that the data encrypted is not
 
38
 * all the data that is signed.  In DCE-RPC case, the headers of the
 
39
 * DCE-RPC packets are also signed.  This prevents some of the
 
40
 * fun-and-games one might have by changing them.
 
41
 *
 
42
 */
 
43
 
 
44
static void dump_arc4_state(const char *description,
 
45
                            struct arcfour_state *state)
 
46
{
 
47
        dump_data_pw(description, state->sbox, sizeof(state->sbox));
 
48
}
 
49
 
 
50
static void calc_ntlmv2_key(uint8_t subkey[16],
 
51
                            DATA_BLOB session_key,
 
52
                            const char *constant)
 
53
{
 
54
        struct MD5Context ctx3;
 
55
        MD5Init(&ctx3);
 
56
        MD5Update(&ctx3, session_key.data, session_key.length);
 
57
        MD5Update(&ctx3, (const uint8_t *)constant, strlen(constant)+1);
 
58
        MD5Final(subkey, &ctx3);
 
59
}
 
60
 
 
61
enum ntlmssp_direction {
 
62
        NTLMSSP_SEND,
 
63
        NTLMSSP_RECEIVE
 
64
};
 
65
 
 
66
static NTSTATUS ntlmssp_make_packet_signature(struct ntlmssp_state *ntlmssp_state,
 
67
                                              TALLOC_CTX *sig_mem_ctx,
 
68
                                              const uint8_t *data, size_t length,
 
69
                                              const uint8_t *whole_pdu, size_t pdu_length,
 
70
                                              enum ntlmssp_direction direction,
 
71
                                              DATA_BLOB *sig, bool encrypt_sig)
 
72
{
 
73
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 
74
                HMACMD5Context ctx;
 
75
                uint8_t digest[16];
 
76
                uint8_t seq_num[4];
 
77
 
 
78
                *sig = data_blob_talloc(sig_mem_ctx, NULL, NTLMSSP_SIG_SIZE);
 
79
                if (!sig->data) {
 
80
                        return NT_STATUS_NO_MEMORY;
 
81
                }
 
82
 
 
83
                switch (direction) {
 
84
                case NTLMSSP_SEND:
 
85
                        DEBUG(100,("ntlmssp_make_packet_signature: SEND seq = %u, len = %u, pdu_len = %u\n",
 
86
                                ntlmssp_state->crypt->ntlm2.sending.seq_num,
 
87
                                (unsigned int)length,
 
88
                                (unsigned int)pdu_length));
 
89
 
 
90
                        SIVAL(seq_num, 0, ntlmssp_state->crypt->ntlm2.sending.seq_num);
 
91
                        ntlmssp_state->crypt->ntlm2.sending.seq_num++;
 
92
                        hmac_md5_init_limK_to_64(ntlmssp_state->crypt->ntlm2.sending.sign_key, 16, &ctx);
 
93
                        break;
 
94
                case NTLMSSP_RECEIVE:
 
95
 
 
96
                        DEBUG(100,("ntlmssp_make_packet_signature: RECV seq = %u, len = %u, pdu_len = %u\n",
 
97
                                ntlmssp_state->crypt->ntlm2.receiving.seq_num,
 
98
                                (unsigned int)length,
 
99
                                (unsigned int)pdu_length));
 
100
 
 
101
                        SIVAL(seq_num, 0, ntlmssp_state->crypt->ntlm2.receiving.seq_num);
 
102
                        ntlmssp_state->crypt->ntlm2.receiving.seq_num++;
 
103
                        hmac_md5_init_limK_to_64(ntlmssp_state->crypt->ntlm2.receiving.sign_key, 16, &ctx);
 
104
                        break;
 
105
                }
 
106
 
 
107
                dump_data_pw("pdu data ", whole_pdu, pdu_length);
 
108
 
 
109
                hmac_md5_update(seq_num, sizeof(seq_num), &ctx);
 
110
                hmac_md5_update(whole_pdu, pdu_length, &ctx);
 
111
                hmac_md5_final(digest, &ctx);
 
112
 
 
113
                if (encrypt_sig && (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
 
114
                        switch (direction) {
 
115
                        case NTLMSSP_SEND:
 
116
                                arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
 
117
                                                   digest, 8);
 
118
                                break;
 
119
                        case NTLMSSP_RECEIVE:
 
120
                                arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.receiving.seal_state,
 
121
                                                   digest, 8);
 
122
                                break;
 
123
                        }
 
124
                }
 
125
 
 
126
                SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION);
 
127
                memcpy(sig->data + 4, digest, 8);
 
128
                memcpy(sig->data + 12, seq_num, 4);
 
129
 
 
130
                dump_data_pw("ntlmssp v2 sig ", sig->data, sig->length);
 
131
 
 
132
        } else {
 
133
                NTSTATUS status;
 
134
                uint32_t crc;
 
135
 
 
136
                crc = crc32_calc_buffer(data, length);
 
137
 
 
138
                status = msrpc_gen(sig_mem_ctx,
 
139
                               sig, "dddd",
 
140
                               NTLMSSP_SIGN_VERSION, 0, crc,
 
141
                               ntlmssp_state->crypt->ntlm.seq_num);
 
142
                if (!NT_STATUS_IS_OK(status)) {
 
143
                        return status;
 
144
                }
 
145
 
 
146
                ntlmssp_state->crypt->ntlm.seq_num++;
 
147
 
 
148
                dump_arc4_state("ntlmssp hash: \n",
 
149
                                &ntlmssp_state->crypt->ntlm.seal_state);
 
150
                arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
 
151
                                   sig->data+4, sig->length-4);
 
152
        }
 
153
        return NT_STATUS_OK;
 
154
}
 
155
 
 
156
NTSTATUS ntlmssp_sign_packet(struct ntlmssp_state *ntlmssp_state,
 
157
                             TALLOC_CTX *sig_mem_ctx,
 
158
                             const uint8_t *data, size_t length,
 
159
                             const uint8_t *whole_pdu, size_t pdu_length,
 
160
                             DATA_BLOB *sig)
 
161
{
 
162
        NTSTATUS nt_status;
 
163
 
 
164
        if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 
165
                DEBUG(3, ("NTLMSSP Signing not negotiated - cannot sign packet!\n"));
 
166
                return NT_STATUS_INVALID_PARAMETER;
 
167
        }
 
168
 
 
169
        if (!ntlmssp_state->session_key.length) {
 
170
                DEBUG(3, ("NO session key, cannot check sign packet\n"));
 
171
                return NT_STATUS_NO_USER_SESSION_KEY;
 
172
        }
 
173
 
 
174
        nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 
175
                                                  sig_mem_ctx,
 
176
                                                  data, length,
 
177
                                                  whole_pdu, pdu_length,
 
178
                                                  NTLMSSP_SEND, sig, true);
 
179
 
 
180
        return nt_status;
 
181
}
 
182
 
 
183
/**
 
184
 * Check the signature of an incoming packet
 
185
 * @note caller *must* check that the signature is the size it expects
 
186
 *
 
187
 */
 
188
 
 
189
NTSTATUS ntlmssp_check_packet(struct ntlmssp_state *ntlmssp_state,
 
190
                              const uint8_t *data, size_t length,
 
191
                              const uint8_t *whole_pdu, size_t pdu_length,
 
192
                              const DATA_BLOB *sig)
 
193
{
 
194
        DATA_BLOB local_sig;
 
195
        NTSTATUS nt_status;
 
196
        TALLOC_CTX *tmp_ctx;
 
197
 
 
198
        if (!ntlmssp_state->session_key.length) {
 
199
                DEBUG(3, ("NO session key, cannot check packet signature\n"));
 
200
                return NT_STATUS_NO_USER_SESSION_KEY;
 
201
        }
 
202
 
 
203
        if (sig->length < 8) {
 
204
                DEBUG(0, ("NTLMSSP packet check failed due to short signature (%lu bytes)!\n",
 
205
                          (unsigned long)sig->length));
 
206
        }
 
207
 
 
208
        tmp_ctx = talloc_new(ntlmssp_state);
 
209
        if (!tmp_ctx) {
 
210
                return NT_STATUS_NO_MEMORY;
 
211
        }
 
212
 
 
213
        nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 
214
                                                  tmp_ctx,
 
215
                                                  data, length,
 
216
                                                  whole_pdu, pdu_length,
 
217
                                                  NTLMSSP_RECEIVE,
 
218
                                                  &local_sig, true);
 
219
 
 
220
        if (!NT_STATUS_IS_OK(nt_status)) {
 
221
                DEBUG(0,("NTLMSSP packet sig creation failed with %s\n",
 
222
                         nt_errstr(nt_status)));
 
223
                talloc_free(tmp_ctx);
 
224
                return nt_status;
 
225
        }
 
226
 
 
227
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 
228
                if (local_sig.length != sig->length ||
 
229
                    memcmp(local_sig.data, sig->data, sig->length) != 0) {
 
230
                        DEBUG(5, ("BAD SIG NTLM2: wanted signature of\n"));
 
231
                        dump_data(5, local_sig.data, local_sig.length);
 
232
 
 
233
                        DEBUG(5, ("BAD SIG: got signature of\n"));
 
234
                        dump_data(5, sig->data, sig->length);
 
235
 
 
236
                        DEBUG(0, ("NTLMSSP NTLM2 packet check failed due to invalid signature!\n"));
 
237
                        talloc_free(tmp_ctx);
 
238
                        return NT_STATUS_ACCESS_DENIED;
 
239
                }
 
240
        } else {
 
241
                if (local_sig.length != sig->length ||
 
242
                    memcmp(local_sig.data + 8, sig->data + 8, sig->length - 8) != 0) {
 
243
                        DEBUG(5, ("BAD SIG NTLM1: wanted signature of\n"));
 
244
                        dump_data(5, local_sig.data, local_sig.length);
 
245
 
 
246
                        DEBUG(5, ("BAD SIG: got signature of\n"));
 
247
                        dump_data(5, sig->data, sig->length);
 
248
 
 
249
                        DEBUG(0, ("NTLMSSP NTLM1 packet check failed due to invalid signature!\n"));
 
250
                        talloc_free(tmp_ctx);
 
251
                        return NT_STATUS_ACCESS_DENIED;
 
252
                }
 
253
        }
 
254
        dump_data_pw("checked ntlmssp signature\n", sig->data, sig->length);
 
255
        DEBUG(10,("ntlmssp_check_packet: NTLMSSP signature OK !\n"));
 
256
 
 
257
        talloc_free(tmp_ctx);
 
258
        return NT_STATUS_OK;
 
259
}
 
260
 
 
261
/**
 
262
 * Seal data with the NTLMSSP algorithm
 
263
 *
 
264
 */
 
265
 
 
266
NTSTATUS ntlmssp_seal_packet(struct ntlmssp_state *ntlmssp_state,
 
267
                             TALLOC_CTX *sig_mem_ctx,
 
268
                             uint8_t *data, size_t length,
 
269
                             const uint8_t *whole_pdu, size_t pdu_length,
 
270
                             DATA_BLOB *sig)
 
271
{
 
272
        if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 
273
                DEBUG(3, ("NTLMSSP Sealing not negotiated - cannot seal packet!\n"));
 
274
                return NT_STATUS_INVALID_PARAMETER;
 
275
        }
 
276
 
 
277
        if (!ntlmssp_state->session_key.length) {
 
278
                DEBUG(3, ("NO session key, cannot seal packet\n"));
 
279
                return NT_STATUS_NO_USER_SESSION_KEY;
 
280
        }
 
281
 
 
282
        DEBUG(10,("ntlmssp_seal_data: seal\n"));
 
283
        dump_data_pw("ntlmssp clear data\n", data, length);
 
284
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 
285
                NTSTATUS nt_status;
 
286
                /*
 
287
                 * The order of these two operations matters - we
 
288
                 * must first seal the packet, then seal the
 
289
                 * sequence number - this is because the
 
290
                 * send_seal_hash is not constant, but is is rather
 
291
                 * updated with each iteration
 
292
                 */
 
293
                nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
 
294
                                                          sig_mem_ctx,
 
295
                                                          data, length,
 
296
                                                          whole_pdu, pdu_length,
 
297
                                                          NTLMSSP_SEND,
 
298
                                                          sig, false);
 
299
                if (!NT_STATUS_IS_OK(nt_status)) {
 
300
                        return nt_status;
 
301
                }
 
302
 
 
303
                arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
 
304
                                   data, length);
 
305
                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
 
306
                        arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
 
307
                                           sig->data+4, 8);
 
308
                }
 
309
        } else {
 
310
                NTSTATUS status;
 
311
                uint32_t crc;
 
312
 
 
313
                crc = crc32_calc_buffer(data, length);
 
314
 
 
315
                status = msrpc_gen(sig_mem_ctx,
 
316
                               sig, "dddd",
 
317
                               NTLMSSP_SIGN_VERSION, 0, crc,
 
318
                               ntlmssp_state->crypt->ntlm.seq_num);
 
319
                if (!NT_STATUS_IS_OK(status)) {
 
320
                        return status;
 
321
                }
 
322
 
 
323
                /*
 
324
                 * The order of these two operations matters - we
 
325
                 * must first seal the packet, then seal the
 
326
                 * sequence number - this is because the ntlmv1_arc4_state
 
327
                 * is not constant, but is is rather updated with
 
328
                 * each iteration
 
329
                 */
 
330
 
 
331
                dump_arc4_state("ntlmv1 arc4 state:\n",
 
332
                                &ntlmssp_state->crypt->ntlm.seal_state);
 
333
                arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
 
334
                                   data, length);
 
335
 
 
336
                dump_arc4_state("ntlmv1 arc4 state:\n",
 
337
                                &ntlmssp_state->crypt->ntlm.seal_state);
 
338
 
 
339
                arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
 
340
                                   sig->data+4, sig->length-4);
 
341
 
 
342
                ntlmssp_state->crypt->ntlm.seq_num++;
 
343
        }
 
344
        dump_data_pw("ntlmssp signature\n", sig->data, sig->length);
 
345
        dump_data_pw("ntlmssp sealed data\n", data, length);
 
346
 
 
347
        return NT_STATUS_OK;
 
348
}
 
349
 
 
350
/**
 
351
 * Unseal data with the NTLMSSP algorithm
 
352
 *
 
353
 */
 
354
 
 
355
NTSTATUS ntlmssp_unseal_packet(struct ntlmssp_state *ntlmssp_state,
 
356
                               uint8_t *data, size_t length,
 
357
                               const uint8_t *whole_pdu, size_t pdu_length,
 
358
                               const DATA_BLOB *sig)
 
359
{
 
360
        NTSTATUS status;
 
361
        if (!ntlmssp_state->session_key.length) {
 
362
                DEBUG(3, ("NO session key, cannot unseal packet\n"));
 
363
                return NT_STATUS_NO_USER_SESSION_KEY;
 
364
        }
 
365
 
 
366
        DEBUG(10,("ntlmssp_unseal_packet: seal\n"));
 
367
        dump_data_pw("ntlmssp sealed data\n", data, length);
 
368
 
 
369
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 
370
                /* First unseal the data. */
 
371
                arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.receiving.seal_state,
 
372
                                   data, length);
 
373
                dump_data_pw("ntlmv2 clear data\n", data, length);
 
374
        } else {
 
375
                arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
 
376
                                   data, length);
 
377
                dump_data_pw("ntlmv1 clear data\n", data, length);
 
378
        }
 
379
        status = ntlmssp_check_packet(ntlmssp_state,
 
380
                                      data, length,
 
381
                                      whole_pdu, pdu_length,
 
382
                                      sig);
 
383
 
 
384
        if (!NT_STATUS_IS_OK(status)) {
 
385
                DEBUG(1,("NTLMSSP packet check for unseal failed due to invalid signature on %llu bytes of input:\n",
 
386
                         (unsigned long long)length));
 
387
        }
 
388
        return status;
 
389
}
 
390
 
 
391
NTSTATUS ntlmssp_wrap(struct ntlmssp_state *ntlmssp_state,
 
392
                      TALLOC_CTX *out_mem_ctx,
 
393
                      const DATA_BLOB *in,
 
394
                      DATA_BLOB *out)
 
395
{
 
396
        NTSTATUS nt_status;
 
397
        DATA_BLOB sig;
 
398
 
 
399
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
 
400
                *out = data_blob_talloc(out_mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
 
401
                if (!out->data) {
 
402
                        return NT_STATUS_NO_MEMORY;
 
403
                }
 
404
                memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
 
405
 
 
406
                nt_status = ntlmssp_seal_packet(ntlmssp_state, out_mem_ctx,
 
407
                                                out->data + NTLMSSP_SIG_SIZE,
 
408
                                                out->length - NTLMSSP_SIG_SIZE,
 
409
                                                out->data + NTLMSSP_SIG_SIZE,
 
410
                                                out->length - NTLMSSP_SIG_SIZE,
 
411
                                                &sig);
 
412
 
 
413
                if (NT_STATUS_IS_OK(nt_status)) {
 
414
                        memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
 
415
                        talloc_free(sig.data);
 
416
                }
 
417
                return nt_status;
 
418
 
 
419
        } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
 
420
 
 
421
                *out = data_blob_talloc(out_mem_ctx, NULL, in->length + NTLMSSP_SIG_SIZE);
 
422
                if (!out->data) {
 
423
                        return NT_STATUS_NO_MEMORY;
 
424
                }
 
425
                memcpy(out->data + NTLMSSP_SIG_SIZE, in->data, in->length);
 
426
 
 
427
                nt_status = ntlmssp_sign_packet(ntlmssp_state, out_mem_ctx,
 
428
                                                out->data + NTLMSSP_SIG_SIZE,
 
429
                                                out->length - NTLMSSP_SIG_SIZE,
 
430
                                                out->data + NTLMSSP_SIG_SIZE,
 
431
                                                out->length - NTLMSSP_SIG_SIZE,
 
432
                                                &sig);
 
433
 
 
434
                if (NT_STATUS_IS_OK(nt_status)) {
 
435
                        memcpy(out->data, sig.data, NTLMSSP_SIG_SIZE);
 
436
                        talloc_free(sig.data);
 
437
                }
 
438
                return nt_status;
 
439
        } else {
 
440
                *out = data_blob_talloc(out_mem_ctx, in->data, in->length);
 
441
                if (!out->data) {
 
442
                        return NT_STATUS_NO_MEMORY;
 
443
                }
 
444
                return NT_STATUS_OK;
 
445
        }
 
446
}
 
447
 
 
448
NTSTATUS ntlmssp_unwrap(struct ntlmssp_state *ntlmssp_state,
 
449
                        TALLOC_CTX *out_mem_ctx,
 
450
                        const DATA_BLOB *in,
 
451
                        DATA_BLOB *out)
 
452
{
 
453
        DATA_BLOB sig;
 
454
 
 
455
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
 
456
                if (in->length < NTLMSSP_SIG_SIZE) {
 
457
                        return NT_STATUS_INVALID_PARAMETER;
 
458
                }
 
459
                sig.data = in->data;
 
460
                sig.length = NTLMSSP_SIG_SIZE;
 
461
 
 
462
                *out = data_blob_talloc(out_mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
 
463
 
 
464
                return ntlmssp_unseal_packet(ntlmssp_state,
 
465
                                             out->data, out->length,
 
466
                                             out->data, out->length,
 
467
                                             &sig);
 
468
 
 
469
        } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
 
470
                NTSTATUS status;
 
471
                struct ntlmssp_crypt_direction save_direction;
 
472
 
 
473
                if (in->length < NTLMSSP_SIG_SIZE) {
 
474
                        return NT_STATUS_INVALID_PARAMETER;
 
475
                }
 
476
                sig.data = in->data;
 
477
                sig.length = NTLMSSP_SIG_SIZE;
 
478
                *out = data_blob_talloc(out_mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
 
479
 
 
480
                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 
481
                        save_direction = ntlmssp_state->crypt->ntlm2.receiving;
 
482
                } else {
 
483
                        save_direction = ntlmssp_state->crypt->ntlm;
 
484
                }
 
485
 
 
486
                status = ntlmssp_check_packet(ntlmssp_state,
 
487
                                              out->data, out->length,
 
488
                                              out->data, out->length,
 
489
                                              &sig);
 
490
                if (!NT_STATUS_IS_OK(status)) {
 
491
                        NTSTATUS check_status = status;
 
492
                        /*
 
493
                         * The Windows LDAP libraries seems to have a bug
 
494
                         * and always use sealing even if only signing was
 
495
                         * negotiated. So we need to fallback.
 
496
                         */
 
497
 
 
498
                        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 
499
                                ntlmssp_state->crypt->ntlm2.receiving = save_direction;
 
500
                        } else {
 
501
                                ntlmssp_state->crypt->ntlm = save_direction;
 
502
                        }
 
503
 
 
504
                        status = ntlmssp_unseal_packet(ntlmssp_state,
 
505
                                                       out->data,
 
506
                                                       out->length,
 
507
                                                       out->data,
 
508
                                                       out->length,
 
509
                                                       &sig);
 
510
                        if (NT_STATUS_IS_OK(status)) {
 
511
                                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
 
512
                        } else {
 
513
                                status = check_status;
 
514
                        }
 
515
                }
 
516
 
 
517
                if (!NT_STATUS_IS_OK(status)) {
 
518
                        DEBUG(1, ("NTLMSSP packet check for unwrap failed due to invalid signature\n"));
 
519
                }
 
520
                return status;
 
521
        } else {
 
522
                *out = data_blob_talloc(out_mem_ctx, in->data, in->length);
 
523
                if (!out->data) {
 
524
                        return NT_STATUS_NO_MEMORY;
 
525
                }
 
526
                return NT_STATUS_OK;
 
527
        }
 
528
}
 
529
 
 
530
/**
 
531
   Initialise the state for NTLMSSP signing.
 
532
*/
 
533
NTSTATUS ntlmssp_sign_init(struct ntlmssp_state *ntlmssp_state)
 
534
{
 
535
        DEBUG(3, ("NTLMSSP Sign/Seal - Initialising with flags:\n"));
 
536
        debug_ntlmssp_flags(ntlmssp_state->neg_flags);
 
537
 
 
538
        if (ntlmssp_state->session_key.length < 8) {
 
539
                DEBUG(3, ("NO session key, cannot intialise signing\n"));
 
540
                return NT_STATUS_NO_USER_SESSION_KEY;
 
541
        }
 
542
 
 
543
        ntlmssp_state->crypt = talloc_zero(ntlmssp_state,
 
544
                                           union ntlmssp_crypt_state);
 
545
        if (ntlmssp_state->crypt == NULL) {
 
546
                return NT_STATUS_NO_MEMORY;
 
547
        }
 
548
 
 
549
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 
550
                DATA_BLOB weak_session_key = ntlmssp_state->session_key;
 
551
                const char *send_sign_const;
 
552
                const char *send_seal_const;
 
553
                const char *recv_sign_const;
 
554
                const char *recv_seal_const;
 
555
                uint8_t send_seal_key[16];
 
556
                DATA_BLOB send_seal_blob = data_blob_const(send_seal_key,
 
557
                                           sizeof(send_seal_key));
 
558
                uint8_t recv_seal_key[16];
 
559
                DATA_BLOB recv_seal_blob = data_blob_const(recv_seal_key,
 
560
                                           sizeof(recv_seal_key));
 
561
 
 
562
                switch (ntlmssp_state->role) {
 
563
                case NTLMSSP_CLIENT:
 
564
                        send_sign_const = CLI_SIGN;
 
565
                        send_seal_const = CLI_SEAL;
 
566
                        recv_sign_const = SRV_SIGN;
 
567
                        recv_seal_const = SRV_SEAL;
 
568
                        break;
 
569
                case NTLMSSP_SERVER:
 
570
                        send_sign_const = SRV_SIGN;
 
571
                        send_seal_const = SRV_SEAL;
 
572
                        recv_sign_const = CLI_SIGN;
 
573
                        recv_seal_const = CLI_SEAL;
 
574
                        break;
 
575
                default:
 
576
                        return NT_STATUS_INTERNAL_ERROR;
 
577
                }
 
578
 
 
579
                /*
 
580
                 * Weaken NTLMSSP keys to cope with down-level
 
581
                 * clients, servers and export restrictions.
 
582
                 *
 
583
                 * We probably should have some parameters to
 
584
                 * control this, once we get NTLM2 working.
 
585
                 *
 
586
                 * Key weakening was not performed on the master key
 
587
                 * for NTLM2, but must be done on the encryption subkeys only.
 
588
                 */
 
589
 
 
590
                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
 
591
                        /* nothing to do */
 
592
                } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
 
593
                        weak_session_key.length = 7;
 
594
                } else { /* forty bits */
 
595
                        weak_session_key.length = 5;
 
596
                }
 
597
 
 
598
                dump_data_pw("NTLMSSP weakend master key:\n",
 
599
                             weak_session_key.data,
 
600
                             weak_session_key.length);
 
601
 
 
602
                /* SEND: sign key */
 
603
                calc_ntlmv2_key(ntlmssp_state->crypt->ntlm2.sending.sign_key,
 
604
                                ntlmssp_state->session_key, send_sign_const);
 
605
                dump_data_pw("NTLMSSP send sign key:\n",
 
606
                             ntlmssp_state->crypt->ntlm2.sending.sign_key, 16);
 
607
 
 
608
                /* SEND: seal ARCFOUR pad */
 
609
                calc_ntlmv2_key(send_seal_key,
 
610
                                weak_session_key, send_seal_const);
 
611
                dump_data_pw("NTLMSSP send seal key:\n", send_seal_key, 16);
 
612
 
 
613
                arcfour_init(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
 
614
                             &send_seal_blob);
 
615
 
 
616
                dump_arc4_state("NTLMSSP send seal arc4 state:\n",
 
617
                                &ntlmssp_state->crypt->ntlm2.sending.seal_state);
 
618
 
 
619
                /* SEND: seq num */
 
620
                ntlmssp_state->crypt->ntlm2.sending.seq_num = 0;
 
621
 
 
622
                /* RECV: sign key */
 
623
                calc_ntlmv2_key(ntlmssp_state->crypt->ntlm2.receiving.sign_key,
 
624
                                ntlmssp_state->session_key, recv_sign_const);
 
625
                dump_data_pw("NTLMSSP recv sign key:\n",
 
626
                             ntlmssp_state->crypt->ntlm2.receiving.sign_key, 16);
 
627
 
 
628
                /* RECV: seal ARCFOUR pad */
 
629
                calc_ntlmv2_key(recv_seal_key,
 
630
                                weak_session_key, recv_seal_const);
 
631
                dump_data_pw("NTLMSSP recv seal key:\n", recv_seal_key, 16);
 
632
 
 
633
                arcfour_init(&ntlmssp_state->crypt->ntlm2.receiving.seal_state,
 
634
                             &recv_seal_blob);
 
635
 
 
636
                dump_arc4_state("NTLMSSP recv seal arc4 state:\n",
 
637
                                &ntlmssp_state->crypt->ntlm2.receiving.seal_state);
 
638
 
 
639
                /* RECV: seq num */
 
640
                ntlmssp_state->crypt->ntlm2.receiving.seq_num = 0;
 
641
        } else {
 
642
                uint8_t weak_session_key[8];
 
643
                DATA_BLOB seal_session_key = ntlmssp_state->session_key;
 
644
                bool do_weak = false;
 
645
 
 
646
                DEBUG(5, ("NTLMSSP Sign/Seal - using NTLM1\n"));
 
647
 
 
648
                /*
 
649
                 * Key weakening not performed on the master key for NTLM2
 
650
                 * and does not occour for NTLM1. Therefore we only need
 
651
                 * to do this for the LM_KEY.
 
652
                 */
 
653
                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
 
654
                        do_weak = true;
 
655
                }
 
656
 
 
657
                /*
 
658
                 * Nothing to weaken.
 
659
                 * We certainly don't want to 'extend' the length...
 
660
                 */
 
661
                if (seal_session_key.length < 16) {
 
662
                        /* TODO: is this really correct? */
 
663
                        do_weak = false;
 
664
                }
 
665
 
 
666
                if (do_weak) {
 
667
                        memcpy(weak_session_key, seal_session_key.data, 8);
 
668
                        seal_session_key = data_blob_const(weak_session_key, 8);
 
669
 
 
670
                        /*
 
671
                         * LM key doesn't support 128 bit crypto, so this is
 
672
                         * the best we can do. If you negotiate 128 bit, but
 
673
                         * not 56, you end up with 40 bit...
 
674
                         */
 
675
                        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
 
676
                                weak_session_key[7] = 0xa0;
 
677
                        } else { /* forty bits */
 
678
                                weak_session_key[5] = 0xe5;
 
679
                                weak_session_key[6] = 0x38;
 
680
                                weak_session_key[7] = 0xb0;
 
681
                        }
 
682
                }
 
683
 
 
684
                arcfour_init(&ntlmssp_state->crypt->ntlm.seal_state,
 
685
                             &seal_session_key);
 
686
 
 
687
                dump_arc4_state("NTLMv1 arc4 state:\n",
 
688
                                &ntlmssp_state->crypt->ntlm.seal_state);
 
689
 
 
690
                ntlmssp_state->crypt->ntlm.seq_num = 0;
 
691
        }
 
692
 
 
693
        return NT_STATUS_OK;
 
694
}