r995: - renamed many of our crypto routines to use the industry standard

  names rather than our crazy naming scheme. So DES is now called
  des_crypt() rather than smbhash()

- added the code from the solution of the ADS crypto challenge that
  allows Samba to correctly handle a 128 bit session key in all of the
  netr_ServerAuthenticateX() varients. A huge thanks to Luke Howard
  from PADL for solving this one!

- restructured the server side rpc authentication to allow for other
  than NTLMSSP sign and seal. This commit just adds the structure, the
  next commit will add schannel server side support.

- added 128 bit session key support to our client side code, and
  testing against w2k3 with smbtorture. Works well.
(This used to be commit 729b2f41c924a0b435d44a14209e6dacc2304cee)

8 files changed, 173 insertions, 70 deletions

diff --git a/source4/rpc_server/config.mk b/source4/rpc_server/config.mk
index da6adaa220..4f8b4796fd 100644
--- a/source4/rpc_server/config.mk
+++ b/source4/rpc_server/config.mk
@@ -122,6 +122,7 @@ INIT_OBJ_FILES = \
 ADD_OBJ_FILES = \
 		rpc_server/dcerpc_tcp.o \
 		rpc_server/dcesrv_auth.o \
+		rpc_server/dcesrv_crypto.o \
 		rpc_server/handles.o
 #
 # End SUBSYSTEM DCERPC
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index 683be7225b..fd806c5289 100644
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -268,7 +268,7 @@ NTSTATUS dcesrv_endpoint_connect(struct dcesrv_context *dce_ctx,
 	(*p)->cli_max_recv_frag = 0;
 	(*p)->handles = NULL;
 	(*p)->partial_input = data_blob(NULL, 0);
-	(*p)->auth_state.ntlmssp_state = NULL;
+	(*p)->auth_state.crypto_state = NULL;
 	(*p)->auth_state.auth_info = NULL;
 	(*p)->session_key = data_blob(NULL, 0);
 
diff --git a/source4/rpc_server/dcerpc_server.h b/source4/rpc_server/dcerpc_server.h
index 2d833ebd58..bdda8f252f 100644
--- a/source4/rpc_server/dcerpc_server.h
+++ b/source4/rpc_server/dcerpc_server.h
@@ -95,7 +95,7 @@ struct dcesrv_handle {
 
 /* hold the authentication state information */
 struct dcesrv_auth {
-	struct auth_ntlmssp_state *ntlmssp_state;
+	void *crypto_state;
 	struct dcerpc_auth *auth_info;
 };
 
diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index 48792180c6..7aa296c245 100644
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -22,7 +22,6 @@
 
 #include "includes.h"
 
-
 /*
   parse any auth information from a dcerpc bind request
   return False if we can't handle the auth request for some 
@@ -52,24 +51,11 @@ BOOL dcesrv_auth_bind(struct dcesrv_call_state *call)
 		return False;
 	}
 
-	if (dce_conn->auth_state.auth_info->auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
-		/* only do NTLMSSP for now */
-		DEBUG(2,("auth_type %d not supported\n", dce_conn->auth_state.auth_info->auth_type));
-		return False;
-	}
-
-	if (dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_INTEGRITY &&
-	    dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
-		DEBUG(2,("auth_level %d not supported\n", dce_conn->auth_state.auth_info->auth_level));
-		return False;
-	}
-
-	status = auth_ntlmssp_start(&dce_conn->auth_state.ntlmssp_state);
+	status = dcesrv_crypto_startup(dce_conn, &dce_conn->auth_state);
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(2, ("Failed to start NTLMSSP subsystem!\n"));
 		return False;
 	}
-
+	
 	return True;
 }
 
@@ -81,17 +67,17 @@ BOOL dcesrv_auth_bind_ack(struct dcesrv_call_state *call, struct dcerpc_packet *
 	struct dcesrv_connection *dce_conn = call->conn;
 	NTSTATUS status;
 
-	if (!call->conn->auth_state.ntlmssp_state) {
+	if (!call->conn->auth_state.crypto_state) {
 		return True;
 	}
 
-	status = auth_ntlmssp_update(dce_conn->auth_state.ntlmssp_state,
-				     call->mem_ctx,
-				     dce_conn->auth_state.auth_info->credentials, 
-				     &dce_conn->auth_state.auth_info->credentials);
+	status = dcesrv_crypto_update(&dce_conn->auth_state,
+				      call->mem_ctx,
+				      dce_conn->auth_state.auth_info->credentials, 
+				      &dce_conn->auth_state.auth_info->credentials);
 	if (!NT_STATUS_IS_OK(status) && 
 	    !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-		DEBUG(2, ("Failed to start NTLMSSP process NTLMSSP negotiate: %s\n", nt_errstr(status)));
+		DEBUG(2, ("Failed to start dcesrv auth negotiate: %s\n", nt_errstr(status)));
 		return False;
 	}
 
@@ -103,7 +89,7 @@ BOOL dcesrv_auth_bind_ack(struct dcesrv_call_state *call, struct dcerpc_packet *
 
 
 /*
-  process the final stage of a NTLMSSP auth request
+  process the final stage of a auth request
 */
 BOOL dcesrv_auth_auth3(struct dcesrv_call_state *call)
 {
@@ -112,7 +98,7 @@ BOOL dcesrv_auth_auth3(struct dcesrv_call_state *call)
 	NTSTATUS status;
 
 	if (!dce_conn->auth_state.auth_info ||
-	    !dce_conn->auth_state.ntlmssp_state ||
+	    !dce_conn->auth_state.crypto_state ||
 	    pkt->u.auth.auth_info.length == 0) {
 		return False;
 	}
@@ -125,20 +111,13 @@ BOOL dcesrv_auth_auth3(struct dcesrv_call_state *call)
 		return False;
 	}
 
-	if (dce_conn->auth_state.auth_info->auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
-		return False;
-	}
-	if (dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_INTEGRITY &&
-	    dce_conn->auth_state.auth_info->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
-		return False;
-	}
-
-	status = auth_ntlmssp_update(dce_conn->auth_state.ntlmssp_state,
-				     call->mem_ctx,
-				     dce_conn->auth_state.auth_info->credentials, 
-				     &dce_conn->auth_state.auth_info->credentials);
+	status = dcesrv_crypto_update(&dce_conn->auth_state,
+				      call->mem_ctx,
+				      dce_conn->auth_state.auth_info->credentials, 
+				      &dce_conn->auth_state.auth_info->credentials);
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(4, ("User failed to authenticated with NTLMSSP: %s\n", nt_errstr(status)));
+		DEBUG(4, ("dcesrv_auth_auth3: failed to authenticate: %s\n", 
+			  nt_errstr(status)));
 		return False;
 	}
 
@@ -159,7 +138,7 @@ BOOL dcesrv_auth_request(struct dcesrv_call_state *call)
 	NTSTATUS status;
 
 	if (!dce_conn->auth_state.auth_info ||
-	    !dce_conn->auth_state.ntlmssp_state) {
+	    !dce_conn->auth_state.crypto_state) {
 		return True;
 	}
 
@@ -193,21 +172,21 @@ BOOL dcesrv_auth_request(struct dcesrv_call_state *call)
 	/* check signature or unseal the packet */
 	switch (dce_conn->auth_state.auth_info->auth_level) {
 	case DCERPC_AUTH_LEVEL_PRIVACY:
-		status = ntlmssp_unseal_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state, 
-					       call->mem_ctx,
-					       pkt->u.request.stub_and_verifier.data, 
-					       pkt->u.request.stub_and_verifier.length, 
-					       &auth.credentials);
-		break;
-
-	case DCERPC_AUTH_LEVEL_INTEGRITY:
-		status = ntlmssp_check_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state, 
+		status = dcesrv_crypto_unseal(&dce_conn->auth_state,
 					      call->mem_ctx,
 					      pkt->u.request.stub_and_verifier.data, 
 					      pkt->u.request.stub_and_verifier.length, 
 					      &auth.credentials);
 		break;
 
+	case DCERPC_AUTH_LEVEL_INTEGRITY:
+		status = dcesrv_crypto_check_sig(&dce_conn->auth_state,
+						 call->mem_ctx,
+						 pkt->u.request.stub_and_verifier.data, 
+						 pkt->u.request.stub_and_verifier.length,
+						 &auth.credentials);
+		break;
+
 	default:
 		status = NT_STATUS_INVALID_LEVEL;
 		break;
@@ -234,7 +213,7 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call,
 	struct ndr_push *ndr;
 
 	/* non-signed packets are simple */
-	if (!dce_conn->auth_state.auth_info || !dce_conn->auth_state.ntlmssp_state) {
+	if (!dce_conn->auth_state.auth_info || !dce_conn->auth_state.crypto_state) {
 		status = dcerpc_push_auth(blob, call->mem_ctx, pkt, NULL);
 		return NT_STATUS_IS_OK(status);
 	}
@@ -260,19 +239,19 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call,
 	/* sign or seal the packet */
 	switch (dce_conn->auth_state.auth_info->auth_level) {
 	case DCERPC_AUTH_LEVEL_PRIVACY:
-		status = ntlmssp_seal_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state, 
-					     call->mem_ctx,
-					     ndr->data + DCERPC_REQUEST_LENGTH, 
-					     ndr->offset - DCERPC_REQUEST_LENGTH,
-					     &dce_conn->auth_state.auth_info->credentials);
+		status = dcesrv_crypto_seal(&dce_conn->auth_state, 
+					    call->mem_ctx,
+					    ndr->data + DCERPC_REQUEST_LENGTH, 
+					    ndr->offset - DCERPC_REQUEST_LENGTH,
+					    &dce_conn->auth_state.auth_info->credentials);
 		break;
 
 	case DCERPC_AUTH_LEVEL_INTEGRITY:
-		status = ntlmssp_sign_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state, 
-					     call->mem_ctx,
-					     ndr->data + DCERPC_REQUEST_LENGTH, 
-					     ndr->offset - DCERPC_REQUEST_LENGTH,
-					     &dce_conn->auth_state.auth_info->credentials);
+		status = dcesrv_crypto_sign(&dce_conn->auth_state, 
+					    call->mem_ctx,
+					    ndr->data + DCERPC_REQUEST_LENGTH, 
+					    ndr->offset - DCERPC_REQUEST_LENGTH,
+					    &dce_conn->auth_state.auth_info->credentials);
 		break;
 	default:
 		status = NT_STATUS_INVALID_LEVEL;
diff --git a/source4/rpc_server/dcesrv_crypto.c b/source4/rpc_server/dcesrv_crypto.c
new file mode 100644
index 0000000000..64ff4ee30b
--- /dev/null
+++ b/source4/rpc_server/dcesrv_crypto.c
@@ -0,0 +1,122 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   server side dcerpc authentication code - crypto support
+
+   Copyright (C) Andrew Tridgell 2004
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+/*
+  this provides a crypto interface to the various backends (such as
+  NTLMSSP and SCHANNEL) for the rpc server code
+*/
+
+#include "includes.h"
+
+/*
+  startup the cryptographic side of an authenticated dcerpc server
+*/
+NTSTATUS dcesrv_crypto_startup(struct dcesrv_connection *dce_conn,
+			       struct dcesrv_auth *auth)
+{
+	struct auth_ntlmssp_state *ntlmssp = NULL;
+	NTSTATUS status;
+
+	if (auth->auth_info->auth_level != DCERPC_AUTH_LEVEL_INTEGRITY &&
+	    auth->auth_info->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
+		DEBUG(2,("auth_level %d not supported in dcesrv auth\n", 
+			 auth->auth_info->auth_level));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	switch (auth->auth_info->auth_type) {
+/*
+	case DCERPC_AUTH_TYPE_SCHANNEL:
+		return auth_schannel_start();
+*/
+
+	case DCERPC_AUTH_TYPE_NTLMSSP:
+		status = auth_ntlmssp_start(&ntlmssp);
+		auth->crypto_state = ntlmssp;
+		break;
+
+	default:
+		DEBUG(2,("dcesrv auth_type %d not supported\n", auth->auth_info->auth_type));
+		status = NT_STATUS_INVALID_PARAMETER;
+	}
+
+	DEBUG(4,("dcesrv_crypto_startup: %s\n", nt_errstr(status)));
+
+	return status;
+}
+
+/*
+  update crypto state
+*/
+NTSTATUS dcesrv_crypto_update(struct dcesrv_auth *auth, 
+			      TALLOC_CTX *out_mem_ctx, 
+			      const DATA_BLOB in, DATA_BLOB *out) 
+{
+	AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+	return ntlmssp_update(ntlmssp->ntlmssp_state, out_mem_ctx, in, out);
+}
+
+
+/*
+  seal a packet
+*/
+NTSTATUS dcesrv_crypto_seal(struct dcesrv_auth *auth, 
+			    TALLOC_CTX *sig_mem_ctx, uint8_t *data, size_t length, DATA_BLOB *sig)
+{
+	AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+	return ntlmssp_seal_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
+
+/*
+  sign a packet
+*/
+NTSTATUS dcesrv_crypto_sign(struct dcesrv_auth *auth, 
+			    TALLOC_CTX *sig_mem_ctx, const uint8_t *data, size_t length, DATA_BLOB *sig) 
+{
+	AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+	return ntlmssp_sign_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
+
+/*
+  check a packet signature
+*/
+NTSTATUS dcesrv_crypto_check_sig(struct dcesrv_auth *auth, 
+				 TALLOC_CTX *sig_mem_ctx, const uint8_t *data, size_t length, const DATA_BLOB *sig)
+{
+	AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+	return ntlmssp_check_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
+
+/*
+  unseal a packet
+*/
+NTSTATUS dcesrv_crypto_unseal(struct dcesrv_auth *auth, 
+			       TALLOC_CTX *sig_mem_ctx, uint8_t *data, size_t length, DATA_BLOB *sig)
+{
+	AUTH_NTLMSSP_STATE *ntlmssp = auth->crypto_state;
+
+	return ntlmssp_unseal_packet(ntlmssp->ntlmssp_state, sig_mem_ctx, data, length, sig);
+}
diff --git a/source4/rpc_server/epmapper/rpc_epmapper.c b/source4/rpc_server/epmapper/rpc_epmapper.c
index b5113a881b..891876c2d8 100644
--- a/source4/rpc_server/epmapper/rpc_epmapper.c
+++ b/source4/rpc_server/epmapper/rpc_epmapper.c
@@ -102,6 +102,8 @@ static BOOL fill_protocol_tower(TALLOC_CTX *mem_ctx, struct epm_towers *twr,
 		twr->floors[4].lhs.protocol = EPM_PROTOCOL_IP;
 		twr->floors[4].lhs.info.lhs_data = data_blob(NULL, 0);
 		twr->floors[4].rhs.rhs_data = data_blob_talloc_zero(mem_ctx, 4);
+		/* TODO: we should fill in our IP address here as a hint to the 
+		   client */
 		break;
 	}
 
@@ -247,7 +249,7 @@ static NTSTATUS epm_Map(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 
 	count = build_ep_list(mem_ctx, dce_call->conn->dce_ctx->endpoint_list, &eps);
 
-	ZERO_STRUCTP(r->out.entry_handle);
+	ZERO_STRUCT(*r->out.entry_handle);
 	r->out.num_towers = 1;
 	r->out.status = 0;
 	r->out.towers = talloc_p(mem_ctx, struct epm_twr_p_t);
diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 81d37d0984..5f4717a5c6 100644
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -148,7 +148,7 @@ static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TAL
 
 	ZERO_STRUCTP(r->out.credentials);
 	*r->out.rid = 0;
-	*r->out.negotiate_flags = *r->in.negotiate_flags & NETLOGON_NEG_AUTH2_FLAGS;
+	*r->out.negotiate_flags = *r->in.negotiate_flags;
 
 	if (!pipe_state) {
 		DEBUG(1, ("No challange requested by client, cannot authenticate\n"));
@@ -228,8 +228,9 @@ static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TAL
 
 	creds_server_init(pipe_state->creds, &pipe_state->client_challenge, 
 			  &pipe_state->server_challenge, mach_pwd,
-			  r->out.credentials);
-
+			  r->out.credentials,
+			  *r->in.negotiate_flags);
+	
 	if (!creds_server_check(pipe_state->creds, r->in.credentials)) {
 		return NT_STATUS_ACCESS_DENIED;
 	}
@@ -249,8 +250,6 @@ static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TAL
 	}
 
 	pipe_state->computer_name = talloc_strdup(pipe_state->mem_ctx, r->in.computer_name);
-	
-	*r->out.negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
 
 	return NT_STATUS_OK;
 }
diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
index 89deaa2f09..228b8b53c0 100644
--- a/source4/rpc_server/samr/samr_password.c
+++ b/source4/rpc_server/samr/samr_password.c
@@ -169,7 +169,7 @@ NTSTATUS samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, TALLOC_
 	}
 
 	/* decrypt the password we have been given */
-	SamOEMhash(pwbuf->data, lm_pwd, 516);
+	arcfour_crypt(pwbuf->data, lm_pwd, 516);
 
 	if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
 			      &new_pass_len, STR_ASCII)) {
@@ -284,7 +284,7 @@ NTSTATUS samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
 	}
 
 	/* decrypt the password we have been given */
-	SamOEMhash(r->in.nt_password->data, nt_pwd, 516);
+	arcfour_crypt(r->in.nt_password->data, nt_pwd, 516);
 
 	if (!decode_pw_buffer(r->in.nt_password->data, new_pass, sizeof(new_pass),
 			      &new_pass_len, STR_UNICODE)) {
@@ -684,7 +684,7 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call,
 	uint32_t new_pass_len;
 	DATA_BLOB session_key = dce_call->conn->session_key;
 
-	SamOEMhashBlob(pwbuf->data, 516, &session_key);
+	arcfour_crypt_blob(pwbuf->data, 516, &session_key);
 
 	if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
 			      &new_pass_len, STR_UNICODE)) {
@@ -731,7 +731,7 @@ NTSTATUS samr_set_password_ex(struct dcesrv_call_state *dce_call,
 	MD5Update(&ctx, session_key.data, session_key.length);
 	MD5Final(co_session_key.data, &ctx);
 	
-	SamOEMhashBlob(pwbuf->data, 516, &co_session_key);
+	arcfour_crypt_blob(pwbuf->data, 516, &co_session_key);
 
 	if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
 			      &new_pass_len, STR_UNICODE)) {