← Back to branch summary

~ubuntu-branches/ubuntu/vivid/samba/vivid

« back to all changes in this revision

Viewing changes to source3/libsmb/ntlmssp_sign.c

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2011-12-21 13:18:04 UTC
  • mfrom: (0.39.21 sid)
  • Revision ID: package-import@ubuntu.com-20111221131804-xtlr39wx6njehxxr
Tags: 2:3.6.1-3ubuntu1
* Merge from Debian testing.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/patches/error-trans.fix-276472:
    - Add the translation of Unix Error code -ENOTSUP to NT Error Code
    - NT_STATUS_NOT_SUPPORTED to prevent the Permission denied error.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/control:
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
  + debian/samba.logrotate, debian/samba-common.dhcp, debian/samba.if-up:
    - Make them upstart compatible
  + debian/samba.postinst: 
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/patches/fix-debuglevel-name-conflict.patch: don't use 'debug_level'
    as a global variable name in an NSS module 
  + Dropped:
    - debian/patches/error-trans.fix-276472
    - debian/patches/fix-debuglevel-name-conflict.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/libsmb/ntlmssp_sign.c
1
 
/*
2
 
 *  Unix SMB/CIFS implementation.
3
 
 *  Version 3.0
4
 
 *  NTLMSSP Signing routines
5
 
 *  Copyright (C) Andrew Bartlett 2003-2005
6
 
 *
7
 
 *  This program is free software; you can redistribute it and/or modify
8
 
 *  it under the terms of the GNU General Public License as published by
9
 
 *  the Free Software Foundation; either version 3 of the License, or
10
 
 *  (at your option) any later version.
11
 
 *
12
 
 *  This program is distributed in the hope that it will be useful,
13
 
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15
 
 *  GNU General Public License for more details.
16
 
 *
17
 
 *  You should have received a copy of the GNU General Public License
18
 
 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
19
 
 */
20
 
 
21
 
#include "includes.h"
22
 
#include "../libcli/auth/libcli_auth.h"
23
 
 
24
 
#define CLI_SIGN "session key to client-to-server signing key magic constant"
25
 
#define CLI_SEAL "session key to client-to-server sealing key magic constant"
26
 
#define SRV_SIGN "session key to server-to-client signing key magic constant"
27
 
#define SRV_SEAL "session key to server-to-client sealing key magic constant"
28
 
 
29
 
/**
30
 
 * Some notes on then NTLM2 code:
31
 
 *
32
 
 * NTLM2 is a AEAD system.  This means that the data encrypted is not
33
 
 * all the data that is signed.  In DCE-RPC case, the headers of the
34
 
 * DCE-RPC packets are also signed.  This prevents some of the
35
 
 * fun-and-games one might have by changing them.
36
 
 *
37
 
 */
38
 
 
39
 
static void dump_arc4_state(const char *description,
40
 
                            struct arcfour_state *state)
41
 
{
42
 
        dump_data_pw(description, state->sbox, sizeof(state->sbox));
43
 
}
44
 
 
45
 
static void calc_ntlmv2_key(unsigned char subkey[16],
46
 
                                DATA_BLOB session_key,
47
 
                                const char *constant)
48
 
{
49
 
        struct MD5Context ctx3;
50
 
        MD5Init(&ctx3);
51
 
        MD5Update(&ctx3, session_key.data, session_key.length);
52
 
        MD5Update(&ctx3, (const unsigned char *)constant, strlen(constant)+1);
53
 
        MD5Final(subkey, &ctx3);
54
 
}
55
 
 
56
 
enum ntlmssp_direction {
57
 
        NTLMSSP_SEND,
58
 
        NTLMSSP_RECEIVE
59
 
};
60
 
 
61
 
static NTSTATUS ntlmssp_make_packet_signature(NTLMSSP_STATE *ntlmssp_state,
62
 
                                                const uchar *data, size_t length,
63
 
                                                const uchar *whole_pdu, size_t pdu_length,
64
 
                                                enum ntlmssp_direction direction,
65
 
                                                DATA_BLOB *sig,
66
 
                                                bool encrypt_sig)
67
 
{
68
 
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
69
 
                HMACMD5Context ctx;
70
 
                uchar seq_num[4];
71
 
                uchar digest[16];
72
 
 
73
 
                *sig = data_blob(NULL, NTLMSSP_SIG_SIZE);
74
 
                if (!sig->data) {
75
 
                        return NT_STATUS_NO_MEMORY;
76
 
                }
77
 
 
78
 
                switch (direction) {
79
 
                        case NTLMSSP_SEND:
80
 
                                DEBUG(100,("ntlmssp_make_packet_signature: SEND seq = %u, len = %u, pdu_len = %u\n",
81
 
                                        ntlmssp_state->ntlm2_send_seq_num,
82
 
                                        (unsigned int)length,
83
 
                                        (unsigned int)pdu_length));
84
 
 
85
 
                                SIVAL(seq_num, 0, ntlmssp_state->ntlm2_send_seq_num);
86
 
                                ntlmssp_state->ntlm2_send_seq_num++;
87
 
                                hmac_md5_init_limK_to_64(ntlmssp_state->send_sign_key, 16, &ctx);
88
 
                                break;
89
 
                        case NTLMSSP_RECEIVE:
90
 
 
91
 
                                DEBUG(100,("ntlmssp_make_packet_signature: RECV seq = %u, len = %u, pdu_len = %u\n",
92
 
                                        ntlmssp_state->ntlm2_recv_seq_num,
93
 
                                        (unsigned int)length,
94
 
                                        (unsigned int)pdu_length));
95
 
 
96
 
                                SIVAL(seq_num, 0, ntlmssp_state->ntlm2_recv_seq_num);
97
 
                                ntlmssp_state->ntlm2_recv_seq_num++;
98
 
                                hmac_md5_init_limK_to_64(ntlmssp_state->recv_sign_key, 16, &ctx);
99
 
                                break;
100
 
                }
101
 
 
102
 
                dump_data_pw("pdu data ", whole_pdu, pdu_length);
103
 
 
104
 
                hmac_md5_update(seq_num, 4, &ctx);
105
 
                hmac_md5_update(whole_pdu, pdu_length, &ctx);
106
 
                hmac_md5_final(digest, &ctx);
107
 
 
108
 
                if (encrypt_sig && (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
109
 
                        switch (direction) {
110
 
                        case NTLMSSP_SEND:
111
 
                                arcfour_crypt_sbox(&ntlmssp_state->send_seal_arc4_state, digest, 8);
112
 
                                break;
113
 
                        case NTLMSSP_RECEIVE:
114
 
                                arcfour_crypt_sbox(&ntlmssp_state->recv_seal_arc4_state, digest, 8);
115
 
                                break;
116
 
                        }
117
 
                }
118
 
 
119
 
                SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION);
120
 
                memcpy(sig->data + 4, digest, 8);
121
 
                memcpy(sig->data + 12, seq_num, 4);
122
 
 
123
 
                dump_data_pw("ntlmssp v2 sig ", sig->data, sig->length);
124
 
 
125
 
        } else {
126
 
                uint32 crc;
127
 
                crc = crc32_calc_buffer(data, length);
128
 
                if (!msrpc_gen(ntlmssp_state, sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmv1_seq_num)) {
129
 
                        return NT_STATUS_NO_MEMORY;
130
 
                }
131
 
 
132
 
                ntlmssp_state->ntlmv1_seq_num++;
133
 
 
134
 
                dump_arc4_state("ntlmssp hash: \n", &ntlmssp_state->ntlmv1_arc4_state);
135
 
                arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state, sig->data+4, sig->length-4);
136
 
        }
137
 
        return NT_STATUS_OK;
138
 
}
139
 
 
140
 
NTSTATUS ntlmssp_sign_packet(NTLMSSP_STATE *ntlmssp_state,
141
 
                                    const uchar *data, size_t length,
142
 
                                    const uchar *whole_pdu, size_t pdu_length,
143
 
                                    DATA_BLOB *sig)
144
 
{
145
 
        NTSTATUS nt_status;
146
 
 
147
 
        if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
148
 
                DEBUG(3, ("NTLMSSP Signing not negotiated - cannot sign packet!\n"));
149
 
                return NT_STATUS_INVALID_PARAMETER;
150
 
        }
151
 
 
152
 
        if (!ntlmssp_state->session_key.length) {
153
 
                DEBUG(3, ("NO session key, cannot check sign packet\n"));
154
 
                return NT_STATUS_NO_USER_SESSION_KEY;
155
 
        }
156
 
 
157
 
        nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
158
 
                                                data, length,
159
 
                                                whole_pdu, pdu_length,
160
 
                                                NTLMSSP_SEND, sig, True);
161
 
 
162
 
        return nt_status;
163
 
}
164
 
 
165
 
/**
166
 
 * Check the signature of an incoming packet
167
 
 * @note caller *must* check that the signature is the size it expects
168
 
 *
169
 
 */
170
 
 
171
 
NTSTATUS ntlmssp_check_packet(NTLMSSP_STATE *ntlmssp_state,
172
 
                                const uchar *data, size_t length,
173
 
                                const uchar *whole_pdu, size_t pdu_length,
174
 
                                const DATA_BLOB *sig)
175
 
{
176
 
        DATA_BLOB local_sig;
177
 
        NTSTATUS nt_status;
178
 
 
179
 
        if (!ntlmssp_state->session_key.length) {
180
 
                DEBUG(3, ("NO session key, cannot check packet signature\n"));
181
 
                return NT_STATUS_NO_USER_SESSION_KEY;
182
 
        }
183
 
 
184
 
        if (sig->length < 8) {
185
 
                DEBUG(0, ("NTLMSSP packet check failed due to short signature (%lu bytes)!\n",
186
 
                          (unsigned long)sig->length));
187
 
        }
188
 
 
189
 
        nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
190
 
                                                data, length,
191
 
                                                whole_pdu, pdu_length,
192
 
                                                NTLMSSP_RECEIVE, &local_sig, True);
193
 
 
194
 
        if (!NT_STATUS_IS_OK(nt_status)) {
195
 
                DEBUG(0, ("NTLMSSP packet check failed with %s\n", nt_errstr(nt_status)));
196
 
                data_blob_free(&local_sig);
197
 
                return nt_status;
198
 
        }
199
 
 
200
 
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
201
 
                if (local_sig.length != sig->length ||
202
 
                                memcmp(local_sig.data, sig->data, sig->length) != 0) {
203
 
                        DEBUG(5, ("BAD SIG NTLM2: wanted signature of\n"));
204
 
                        dump_data(5, local_sig.data, local_sig.length);
205
 
 
206
 
                        DEBUG(5, ("BAD SIG: got signature of\n"));
207
 
                        dump_data(5, sig->data, sig->length);
208
 
 
209
 
                        DEBUG(0, ("NTLMSSP NTLM2 packet check failed due to invalid signature!\n"));
210
 
                        data_blob_free(&local_sig);
211
 
                        return NT_STATUS_ACCESS_DENIED;
212
 
                }
213
 
        } else {
214
 
                if (local_sig.length != sig->length ||
215
 
                                memcmp(local_sig.data + 8, sig->data + 8, sig->length - 8) != 0) {
216
 
                        DEBUG(5, ("BAD SIG NTLM1: wanted signature of\n"));
217
 
                        dump_data(5, local_sig.data, local_sig.length);
218
 
 
219
 
                        DEBUG(5, ("BAD SIG: got signature of\n"));
220
 
                        dump_data(5, sig->data, sig->length);
221
 
 
222
 
                        DEBUG(0, ("NTLMSSP NTLM1 packet check failed due to invalid signature!\n"));
223
 
                        data_blob_free(&local_sig);
224
 
                        return NT_STATUS_ACCESS_DENIED;
225
 
                }
226
 
        }
227
 
        dump_data_pw("checked ntlmssp signature\n", sig->data, sig->length);
228
 
        DEBUG(10,("ntlmssp_check_packet: NTLMSSP signature OK !\n"));
229
 
 
230
 
        data_blob_free(&local_sig);
231
 
        return NT_STATUS_OK;
232
 
}
233
 
 
234
 
/**
235
 
 * Seal data with the NTLMSSP algorithm
236
 
 *
237
 
 */
238
 
 
239
 
NTSTATUS ntlmssp_seal_packet(NTLMSSP_STATE *ntlmssp_state,
240
 
                             uchar *data, size_t length,
241
 
                             uchar *whole_pdu, size_t pdu_length,
242
 
                             DATA_BLOB *sig)
243
 
{
244
 
        if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
245
 
                DEBUG(3, ("NTLMSSP Sealing not negotiated - cannot seal packet!\n"));
246
 
                return NT_STATUS_INVALID_PARAMETER;
247
 
        }
248
 
 
249
 
        if (!ntlmssp_state->session_key.length) {
250
 
                DEBUG(3, ("NO session key, cannot seal packet\n"));
251
 
                return NT_STATUS_NO_USER_SESSION_KEY;
252
 
        }
253
 
 
254
 
        DEBUG(10,("ntlmssp_seal_data: seal\n"));
255
 
        dump_data_pw("ntlmssp clear data\n", data, length);
256
 
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
257
 
                /* The order of these two operations matters - we must first seal the packet,
258
 
                   then seal the sequence number - this is becouse the send_seal_hash is not
259
 
                   constant, but is is rather updated with each iteration */
260
 
                NTSTATUS nt_status = ntlmssp_make_packet_signature(ntlmssp_state,
261
 
                                                        data, length,
262
 
                                                        whole_pdu, pdu_length,
263
 
                                                        NTLMSSP_SEND, sig, False);
264
 
                if (!NT_STATUS_IS_OK(nt_status)) {
265
 
                        return nt_status;
266
 
                }
267
 
 
268
 
                arcfour_crypt_sbox(&ntlmssp_state->send_seal_arc4_state, data, length);
269
 
                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
270
 
                        arcfour_crypt_sbox(&ntlmssp_state->send_seal_arc4_state, sig->data+4, 8);
271
 
                }
272
 
        } else {
273
 
                uint32 crc;
274
 
                crc = crc32_calc_buffer(data, length);
275
 
                if (!msrpc_gen(ntlmssp_state, sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmv1_seq_num)) {
276
 
                        return NT_STATUS_NO_MEMORY;
277
 
                }
278
 
 
279
 
                /* The order of these two operations matters - we must first seal the packet,
280
 
                   then seal the sequence number - this is becouse the ntlmv1_arc4_state is not
281
 
                   constant, but is is rather updated with each iteration */
282
 
 
283
 
                dump_arc4_state("ntlmv1 arc4 state:\n",
284
 
                                                &ntlmssp_state->ntlmv1_arc4_state);
285
 
                arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state, data, length);
286
 
 
287
 
                dump_arc4_state("ntlmv1 arc4 state:\n",
288
 
                                                &ntlmssp_state->ntlmv1_arc4_state);
289
 
 
290
 
                arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state, sig->data+4, sig->length-4);
291
 
 
292
 
                ntlmssp_state->ntlmv1_seq_num++;
293
 
        }
294
 
        dump_data_pw("ntlmssp signature\n", sig->data, sig->length);
295
 
        dump_data_pw("ntlmssp sealed data\n", data, length);
296
 
 
297
 
        return NT_STATUS_OK;
298
 
}
299
 
 
300
 
/**
301
 
 * Unseal data with the NTLMSSP algorithm
302
 
 *
303
 
 */
304
 
 
305
 
NTSTATUS ntlmssp_unseal_packet(NTLMSSP_STATE *ntlmssp_state,
306
 
                                uchar *data, size_t length,
307
 
                                uchar *whole_pdu, size_t pdu_length,
308
 
                                DATA_BLOB *sig)
309
 
{
310
 
        if (!ntlmssp_state->session_key.length) {
311
 
                DEBUG(3, ("NO session key, cannot unseal packet\n"));
312
 
                return NT_STATUS_NO_USER_SESSION_KEY;
313
 
        }
314
 
 
315
 
        DEBUG(10,("ntlmssp_unseal_packet: seal\n"));
316
 
        dump_data_pw("ntlmssp sealed data\n", data, length);
317
 
 
318
 
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
319
 
                /* First unseal the data. */
320
 
                arcfour_crypt_sbox(&ntlmssp_state->recv_seal_arc4_state, data, length);
321
 
                dump_data_pw("ntlmv2 clear data\n", data, length);
322
 
        } else {
323
 
                arcfour_crypt_sbox(&ntlmssp_state->ntlmv1_arc4_state, data, length);
324
 
                dump_data_pw("ntlmv1 clear data\n", data, length);
325
 
        }
326
 
        return ntlmssp_check_packet(ntlmssp_state, data, length, whole_pdu, pdu_length, sig);
327
 
}
328
 
 
329
 
/**
330
 
   Initialise the state for NTLMSSP signing.
331
 
*/
332
 
NTSTATUS ntlmssp_sign_init(NTLMSSP_STATE *ntlmssp_state)
333
 
{
334
 
        unsigned char p24[24];
335
 
        TALLOC_CTX *mem_ctx;
336
 
        ZERO_STRUCT(p24);
337
 
 
338
 
        mem_ctx = talloc_init("weak_keys");
339
 
        if (!mem_ctx) {
340
 
                return NT_STATUS_NO_MEMORY;
341
 
        }
342
 
 
343
 
        DEBUG(3, ("NTLMSSP Sign/Seal - Initialising with flags:\n"));
344
 
        debug_ntlmssp_flags(ntlmssp_state->neg_flags);
345
 
 
346
 
        if (ntlmssp_state->session_key.length < 8) {
347
 
                TALLOC_FREE(mem_ctx);
348
 
                DEBUG(3, ("NO session key, cannot intialise signing\n"));
349
 
                return NT_STATUS_NO_USER_SESSION_KEY;
350
 
        }
351
 
 
352
 
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
353
 
                DATA_BLOB weak_session_key = ntlmssp_state->session_key;
354
 
                const char *send_sign_const;
355
 
                const char *send_seal_const;
356
 
                const char *recv_sign_const;
357
 
                const char *recv_seal_const;
358
 
                DATA_BLOB send_seal_key_blob, recv_seal_blob;
359
 
 
360
 
                switch (ntlmssp_state->role) {
361
 
                case NTLMSSP_CLIENT:
362
 
                        send_sign_const = CLI_SIGN;
363
 
                        send_seal_const = CLI_SEAL;
364
 
                        recv_sign_const = SRV_SIGN;
365
 
                        recv_seal_const = SRV_SEAL;
366
 
                        break;
367
 
                case NTLMSSP_SERVER:
368
 
                        send_sign_const = SRV_SIGN;
369
 
                        send_seal_const = SRV_SEAL;
370
 
                        recv_sign_const = CLI_SIGN;
371
 
                        recv_seal_const = CLI_SEAL;
372
 
                        break;
373
 
                default:
374
 
                        TALLOC_FREE(mem_ctx);
375
 
                        return NT_STATUS_INTERNAL_ERROR;
376
 
                }
377
 
 
378
 
                /**
379
 
                  Weaken NTLMSSP keys to cope with down-level clients, servers and export restrictions.
380
 
                  We probably should have some parameters to control this, once we get NTLM2 working.
381
 
                */
382
 
 
383
 
                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
384
 
                        ;
385
 
                } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
386
 
                        weak_session_key.length = 7;
387
 
                } else { /* forty bits */
388
 
                        weak_session_key.length = 5;
389
 
                }
390
 
 
391
 
                dump_data_pw("NTLMSSP weakend master key:\n",
392
 
                                weak_session_key.data,
393
 
                                weak_session_key.length);
394
 
 
395
 
                /* SEND: sign key */
396
 
                calc_ntlmv2_key(ntlmssp_state->send_sign_key,
397
 
                                ntlmssp_state->session_key, send_sign_const);
398
 
                dump_data_pw("NTLMSSP send sign key:\n",
399
 
                                ntlmssp_state->send_sign_key, 16);
400
 
 
401
 
                /* SEND: seal ARCFOUR pad */
402
 
                calc_ntlmv2_key(ntlmssp_state->send_seal_key,
403
 
                                weak_session_key, send_seal_const);
404
 
                dump_data_pw("NTLMSSP send seal key:\n",
405
 
                                ntlmssp_state->send_seal_key, 16);
406
 
 
407
 
                send_seal_key_blob.data = ntlmssp_state->send_seal_key;
408
 
                send_seal_key_blob.length = 16;
409
 
                arcfour_init(&ntlmssp_state->send_seal_arc4_state,
410
 
                             &send_seal_key_blob);
411
 
 
412
 
                dump_arc4_state("NTLMSSP send seal arc4 state:\n",
413
 
                             &ntlmssp_state->send_seal_arc4_state);
414
 
 
415
 
                /* RECV: sign key */
416
 
                calc_ntlmv2_key(ntlmssp_state->recv_sign_key,
417
 
                                ntlmssp_state->session_key, recv_sign_const);
418
 
                dump_data_pw("NTLMSSP recv send sign key:\n",
419
 
                                ntlmssp_state->recv_sign_key, 16);
420
 
 
421
 
                /* RECV: seal ARCFOUR pad */
422
 
                calc_ntlmv2_key(ntlmssp_state->recv_seal_key,
423
 
                                weak_session_key, recv_seal_const);
424
 
 
425
 
                dump_data_pw("NTLMSSP recv seal key:\n",
426
 
                                ntlmssp_state->recv_seal_key, 16);
427
 
 
428
 
                recv_seal_blob.data = ntlmssp_state->recv_seal_key;
429
 
                recv_seal_blob.length = 16;
430
 
                arcfour_init(&ntlmssp_state->recv_seal_arc4_state,
431
 
                                &recv_seal_blob);
432
 
 
433
 
                dump_arc4_state("NTLMSSP recv seal arc4 state:\n",
434
 
                             &ntlmssp_state->recv_seal_arc4_state);
435
 
 
436
 
                ntlmssp_state->ntlm2_send_seq_num = 0;
437
 
                ntlmssp_state->ntlm2_recv_seq_num = 0;
438
 
 
439
 
 
440
 
        } else {
441
 
#if 0
442
 
                /* Hmmm. Shouldn't we also weaken keys for ntlmv1 ? JRA. */
443
 
 
444
 
                DATA_BLOB weak_session_key = ntlmssp_state->session_key;
445
 
                /**
446
 
                  Weaken NTLMSSP keys to cope with down-level clients, servers and export restrictions.
447
 
                  We probably should have some parameters to control this, once we get NTLM2 working.
448
 
                */
449
 
 
450
 
                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
451
 
                        ;
452
 
                } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
453
 
                        weak_session_key.length = 6;
454
 
                } else { /* forty bits */
455
 
                        weak_session_key.length = 5;
456
 
                }
457
 
                dump_data_pw("NTLMSSP weakend master key:\n",
458
 
                                weak_session_key.data,
459
 
                                weak_session_key.length);
460
 
#endif
461
 
 
462
 
                DATA_BLOB weak_session_key = ntlmssp_weaken_keys(ntlmssp_state, mem_ctx);
463
 
 
464
 
                DEBUG(5, ("NTLMSSP Sign/Seal - using NTLM1\n"));
465
 
 
466
 
                arcfour_init(&ntlmssp_state->ntlmv1_arc4_state,
467
 
                             &weak_session_key);
468
 
 
469
 
                dump_arc4_state("NTLMv1 arc4 state:\n",
470
 
                                &ntlmssp_state->ntlmv1_arc4_state);
471
 
 
472
 
                ntlmssp_state->ntlmv1_seq_num = 0;
473
 
        }
474
 
 
475
 
        TALLOC_FREE(mem_ctx);
476
 
        return NT_STATUS_OK;
477
 
}