From 5b0ab386cb0fb74d78e6c68abe1b047ab515b7b3 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Tue, 25 May 2004 14:06:28 +0000 Subject: r874: This patch is a pile of work on NTLMSSP: Samba's NTLMSSP code is now fully talloc based, which should go a long way to cleaning up the memory leaks in this code. This also avoids a lot of extra copies of data, as we now allocate the 'return' blobs on a caller-supplied context. I have also been doing a lot of work towards NTLM2 signing and sealing. I have this working for sealing, but not for the verifier (MD5 integrity check on the stream) which is still incorrect. (I can aim a rpcecho sinkdata from a Win2k3 box to my server, and the data arrives intact, but the signature check fails. It does however match the test values I have...). The new torture test is cludged in - when we get a unit test suite back, I'll happliy put it in the 'right' place.... Andrew Bartlett (This used to be commit 399e2e2b1149b8d1c070aa7f0d5131c0b577d2b9) --- source4/auth/auth_ntlmssp.c | 21 +++- source4/lib/crypto/hmacmd5.c | 15 +-- source4/lib/util_str.c | 56 ++++++++++ source4/libcli/auth/ntlmssp.c | 209 +++++++++++++++++++---------------- source4/libcli/auth/ntlmssp.h | 19 +++- source4/libcli/auth/ntlmssp_parse.c | 32 +++--- source4/libcli/auth/ntlmssp_sign.c | 205 +++++++++++++++++++++------------- source4/libcli/auth/schannel.c | 7 +- source4/libcli/util/smbencrypt.c | 21 ++-- source4/librpc/idl/lsa.idl | 10 +- source4/librpc/rpc/dcerpc.c | 4 + source4/librpc/rpc/dcerpc.h | 6 +- source4/librpc/rpc/dcerpc_ntlm.c | 39 +++---- source4/librpc/rpc/dcerpc_schannel.c | 20 ++-- source4/rpc_server/dcesrv_auth.c | 17 +-- source4/torture/config.mk | 5 +- source4/torture/rpc/netlogon.c | 5 +- source4/torture/torture.c | 1 + 18 files changed, 430 insertions(+), 262 deletions(-) diff --git a/source4/auth/auth_ntlmssp.c b/source4/auth/auth_ntlmssp.c index a4e0dd5588..1525d30631 100644 --- a/source4/auth/auth_ntlmssp.c +++ b/source4/auth/auth_ntlmssp.c @@ -162,7 +162,7 @@ NTSTATUS auth_ntlmssp_start(AUTH_NTLMSSP_STATE **auth_ntlmssp_state) (*auth_ntlmssp_state)->ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge; (*auth_ntlmssp_state)->ntlmssp_state->check_password = auth_ntlmssp_check_password; (*auth_ntlmssp_state)->ntlmssp_state->server_role = lp_server_role(); - + return NT_STATUS_OK; } @@ -183,8 +183,23 @@ void auth_ntlmssp_end(AUTH_NTLMSSP_STATE **auth_ntlmssp_state) *auth_ntlmssp_state = NULL; } + +/** + * Next state function for the wrapped NTLMSSP state machine + * + * @param auth_ntlmssp_state NTLMSSP State + * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on + * @param in The request, as a DATA_BLOB + * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx + * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent, + * or NT_STATUS_OK if the user is authenticated. + */ + NTSTATUS auth_ntlmssp_update(AUTH_NTLMSSP_STATE *auth_ntlmssp_state, - const DATA_BLOB request, DATA_BLOB *reply) + TALLOC_CTX *out_mem_ctx, + const DATA_BLOB in, DATA_BLOB *out) { - return ntlmssp_update(auth_ntlmssp_state->ntlmssp_state, request, reply); + return ntlmssp_update(auth_ntlmssp_state->ntlmssp_state, + out_mem_ctx, + in, out); } diff --git a/source4/lib/crypto/hmacmd5.c b/source4/lib/crypto/hmacmd5.c index 8ca7dba841..7697ac8a69 100644 --- a/source4/lib/crypto/hmacmd5.c +++ b/source4/lib/crypto/hmacmd5.c @@ -77,20 +77,7 @@ void hmac_md5_init_limK_to_64(const uchar* key, int key_len, key_len = 64; } - /* start out by storing key in pads */ - ZERO_STRUCT(ctx->k_ipad); - ZERO_STRUCT(ctx->k_opad); - memcpy( ctx->k_ipad, key, key_len); - memcpy( ctx->k_opad, key, key_len); - - /* XOR key with ipad and opad values */ - for (i=0; i<64; i++) { - ctx->k_ipad[i] ^= 0x36; - ctx->k_opad[i] ^= 0x5c; - } - - MD5Init(&ctx->ctx); - MD5Update(&ctx->ctx, ctx->k_ipad, 64); + hmac_md5_init_rfc2104(key, key_len, ctx); } /*********************************************************************** diff --git a/source4/lib/util_str.c b/source4/lib/util_str.c index 7bdec8c1e9..7d6505bab2 100644 --- a/source4/lib/util_str.c +++ b/source4/lib/util_str.c @@ -1196,6 +1196,62 @@ void ipstr_list_free(char* ipstr_list) SAFE_FREE(ipstr_list); } +/** + Routine to get hex characters and turn them into a 16 byte array. + the array can be variable length, and any non-hex-numeric + characters are skipped. "0xnn" or "0Xnn" is specially catered + for. + + valid examples: "0A5D15"; "0x15, 0x49, 0xa2"; "59\ta9\te3\n" + +**/ + +size_t strhex_to_str(char *p, size_t len, const char *strhex) +{ + size_t i; + size_t num_chars = 0; + unsigned char lonybble, hinybble; + const char *hexchars = "0123456789ABCDEF"; + char *p1 = NULL, *p2 = NULL; + + for (i = 0; i < len && strhex[i] != 0; i++) { + if (strnequal(hexchars, "0x", 2)) { + i++; /* skip two chars */ + continue; + } + + if (!(p1 = strchr_m(hexchars, toupper(strhex[i])))) + break; + + i++; /* next hex digit */ + + if (!(p2 = strchr_m(hexchars, toupper(strhex[i])))) + break; + + /* get the two nybbles */ + hinybble = PTR_DIFF(p1, hexchars); + lonybble = PTR_DIFF(p2, hexchars); + + p[num_chars] = (hinybble << 4) | lonybble; + num_chars++; + + p1 = NULL; + p2 = NULL; + } + return num_chars; +} + +DATA_BLOB strhex_to_data_blob(const char *strhex) +{ + DATA_BLOB ret_blob = data_blob(NULL, strlen(strhex)/2+1); + + ret_blob.length = strhex_to_str(ret_blob.data, + strlen(strhex), + strhex); + + return ret_blob; +} + /** Unescape a URL encoded string, in place. diff --git a/source4/libcli/auth/ntlmssp.c b/source4/libcli/auth/ntlmssp.c index 9513d5a138..3773c8e590 100644 --- a/source4/libcli/auth/ntlmssp.c +++ b/source4/libcli/auth/ntlmssp.c @@ -24,13 +24,17 @@ #include "includes.h" static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state, - DATA_BLOB reply, DATA_BLOB *next_request); + TALLOC_CTX *out_mem_ctx, + DATA_BLOB in, DATA_BLOB *out); static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, + TALLOC_CTX *out_mem_ctx, const DATA_BLOB in, DATA_BLOB *out); static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state, - const DATA_BLOB reply, DATA_BLOB *next_request); + TALLOC_CTX *out_mem_ctx, + const DATA_BLOB in, DATA_BLOB *out); static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state, - const DATA_BLOB request, DATA_BLOB *reply); + TALLOC_CTX *out_mem_ctx, + const DATA_BLOB in, DATA_BLOB *out); /** * Callbacks for NTLMSSP - for both client and server operating modes @@ -41,6 +45,7 @@ static const struct ntlmssp_callbacks { enum NTLMSSP_ROLE role; enum NTLM_MESSAGE_TYPE ntlmssp_command; NTSTATUS (*fn)(struct ntlmssp_state *ntlmssp_state, + TALLOC_CTX *out_mem_ctx, DATA_BLOB in, DATA_BLOB *out); } ntlmssp_callbacks[] = { {NTLMSSP_CLIENT, NTLMSSP_INITIAL, ntlmssp_client_initial}, @@ -205,12 +210,15 @@ NTSTATUS ntlmssp_store_response(NTLMSSP_STATE *ntlmssp_state, * Next state function for the NTLMSSP state machine * * @param ntlmssp_state NTLMSSP State - * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB - * @param out The reply, as an allocated DATA_BLOB, caller to free. - * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK. + * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on + * @param in The request, as a DATA_BLOB + * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx + * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent, + * or NT_STATUS_OK if the user is authenticated. */ NTSTATUS ntlmssp_update(NTLMSSP_STATE *ntlmssp_state, + TALLOC_CTX *out_mem_ctx, const DATA_BLOB in, DATA_BLOB *out) { DATA_BLOB input; @@ -219,6 +227,16 @@ NTSTATUS ntlmssp_update(NTLMSSP_STATE *ntlmssp_state, *out = data_blob(NULL, 0); + if (ntlmssp_state->expected_state == NTLMSSP_DONE) { + return NT_STATUS_INVALID_PARAMETER; + } + + if (!out_mem_ctx) { + /* if the caller doesn't want to manage/own the memory, + we can put it on our context */ + out_mem_ctx = ntlmssp_state->mem_ctx; + } + if (!in.length && ntlmssp_state->stored_response.length) { input = ntlmssp_state->stored_response; @@ -239,7 +257,8 @@ NTSTATUS ntlmssp_update(NTLMSSP_STATE *ntlmssp_state, break; } } else { - if (!msrpc_parse(&input, "Cd", + if (!msrpc_parse(ntlmssp_state->mem_ctx, + &input, "Cd", "NTLMSSP", &ntlmssp_command)) { DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n")); @@ -255,8 +274,9 @@ NTSTATUS ntlmssp_update(NTLMSSP_STATE *ntlmssp_state, for (i=0; ntlmssp_callbacks[i].fn; i++) { if (ntlmssp_callbacks[i].role == ntlmssp_state->role - && ntlmssp_callbacks[i].ntlmssp_command == ntlmssp_command) { - return ntlmssp_callbacks[i].fn(ntlmssp_state, input, out); + && ntlmssp_callbacks[i].ntlmssp_command == ntlmssp_command + && ntlmssp_callbacks[i].fn) { + return ntlmssp_callbacks[i].fn(ntlmssp_state, out_mem_ctx, input, out); } } @@ -279,10 +299,6 @@ void ntlmssp_end(NTLMSSP_STATE **ntlmssp_state) (*ntlmssp_state)->ref_count--; if ((*ntlmssp_state)->ref_count == 0) { - data_blob_free(&(*ntlmssp_state)->chal); - data_blob_free(&(*ntlmssp_state)->lm_resp); - data_blob_free(&(*ntlmssp_state)->nt_resp); - data_blob_free(&(*ntlmssp_state)->encrypted_session_key); talloc_destroy(mem_ctx); } @@ -391,6 +407,7 @@ static void ntlmssp_weaken_keys(struct ntlmssp_state *ntlmssp_state) { ntlmssp_state->session_key.data[6] = 0x38; ntlmssp_state->session_key.data[7] = 0xb0; } + ntlmssp_state->session_key.length = 8; } } @@ -398,13 +415,15 @@ static void ntlmssp_weaken_keys(struct ntlmssp_state *ntlmssp_state) { * Next state function for the Negotiate packet * * @param ntlmssp_state NTLMSSP State - * @param request The request, as a DATA_BLOB - * @param request The reply, as an allocated DATA_BLOB, caller to free. + * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on + * @param in The request, as a DATA_BLOB + * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx * @return Errors or MORE_PROCESSING_REQUIRED if a reply is sent. */ static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, - const DATA_BLOB request, DATA_BLOB *reply) + TALLOC_CTX *out_mem_ctx, + const DATA_BLOB in, DATA_BLOB *out) { DATA_BLOB struct_blob; fstring dnsname, dnsdomname; @@ -419,21 +438,19 @@ static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, file_save("ntlmssp_negotiate.dat", request.data, request.length); #endif - if (request.length) { - if (!msrpc_parse(&request, "CddAA", + if (in.length) { + if (!msrpc_parse(ntlmssp_state->mem_ctx, + &in, "CddAA", "NTLMSSP", &ntlmssp_command, &neg_flags, &cliname, &domname)) { DEBUG(1, ("ntlmssp_server_negotiate: failed to parse NTLMSSP:\n")); - dump_data(2, (const char *)request.data, request.length); + dump_data(2, (const char *)in.data, in.length); return NT_STATUS_INVALID_PARAMETER; } - SAFE_FREE(cliname); - SAFE_FREE(domname); - debug_ntlmssp_flags(neg_flags); } @@ -481,7 +498,8 @@ static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, target_name_dns = dnsname; } - msrpc_gen(&struct_blob, "aaaaa", + msrpc_gen(out_mem_ctx, + &struct_blob, "aaaaa", NTLMSSP_NAME_TYPE_DOMAIN, target_name, NTLMSSP_NAME_TYPE_SERVER, ntlmssp_state->get_global_myname(), NTLMSSP_NAME_TYPE_DOMAIN_DNS, dnsdomname, @@ -500,7 +518,8 @@ static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, gen_string = "CdAdbddB"; } - msrpc_gen(reply, gen_string, + msrpc_gen(out_mem_ctx, + out, gen_string, "NTLMSSP", NTLMSSP_CHALLENGE, target_name, @@ -510,8 +529,6 @@ static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, struct_blob.data, struct_blob.length); } - data_blob_free(&struct_blob); - ntlmssp_state->expected_state = NTLMSSP_AUTH; return NT_STATUS_MORE_PROCESSING_REQUIRED; @@ -522,7 +539,6 @@ static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, * * @param ntlmssp_state NTLMSSP State * @param request The request, as a DATA_BLOB - * @param request The reply, as an allocated DATA_BLOB, caller to free. * @return Errors or NT_STATUS_OK. */ @@ -549,6 +565,7 @@ static NTSTATUS ntlmssp_server_preauth(struct ntlmssp_state *ntlmssp_state, parse_string = "CdBBAAABd"; } + /* zero these out */ data_blob_free(&ntlmssp_state->lm_resp); data_blob_free(&ntlmssp_state->nt_resp); @@ -557,7 +574,8 @@ static NTSTATUS ntlmssp_server_preauth(struct ntlmssp_state *ntlmssp_state, ntlmssp_state->workstation = NULL; /* now the NTLMSSP encoded auth hashes */ - if (!msrpc_parse(&request, parse_string, + if (!msrpc_parse(ntlmssp_state->mem_ctx, + &request, parse_string, "NTLMSSP", &ntlmssp_command, &ntlmssp_state->lm_resp, @@ -569,9 +587,8 @@ static NTSTATUS ntlmssp_server_preauth(struct ntlmssp_state *ntlmssp_state, &auth_flags)) { DEBUG(10, ("ntlmssp_server_auth: failed to parse NTLMSSP (nonfatal):\n")); dump_data(10, (const char *)request.data, request.length); - SAFE_FREE(domain); - SAFE_FREE(user); - SAFE_FREE(workstation); + + /* zero this out */ data_blob_free(&ntlmssp_state->encrypted_session_key); auth_flags = 0; @@ -583,7 +600,8 @@ static NTSTATUS ntlmssp_server_preauth(struct ntlmssp_state *ntlmssp_state, } /* now the NTLMSSP encoded auth hashes */ - if (!msrpc_parse(&request, parse_string, + if (!msrpc_parse(ntlmssp_state->mem_ctx, + &request, parse_string, "NTLMSSP", &ntlmssp_command, &ntlmssp_state->lm_resp, @@ -593,9 +611,6 @@ static NTSTATUS ntlmssp_server_preauth(struct ntlmssp_state *ntlmssp_state, &workstation)) { DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP:\n")); dump_data(2, (const char *)request.data, request.length); - SAFE_FREE(domain); - SAFE_FREE(user); - SAFE_FREE(workstation); return NT_STATUS_INVALID_PARAMETER; } @@ -605,33 +620,23 @@ static NTSTATUS ntlmssp_server_preauth(struct ntlmssp_state *ntlmssp_state, ntlmssp_handle_neg_flags(ntlmssp_state, auth_flags, ntlmssp_state->allow_lm_key); if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) { - SAFE_FREE(domain); - SAFE_FREE(user); - SAFE_FREE(workstation); + /* zero this out */ data_blob_free(&ntlmssp_state->encrypted_session_key); return nt_status; } if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) { - SAFE_FREE(domain); - SAFE_FREE(user); - SAFE_FREE(workstation); + /* zero this out */ data_blob_free(&ntlmssp_state->encrypted_session_key); return nt_status; } if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_workstation(ntlmssp_state, workstation))) { - SAFE_FREE(domain); - SAFE_FREE(user); - SAFE_FREE(workstation); + /* zero this out */ data_blob_free(&ntlmssp_state->encrypted_session_key); return nt_status; } - SAFE_FREE(domain); - SAFE_FREE(user); - SAFE_FREE(workstation); - DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n", ntlmssp_state->user, ntlmssp_state->domain, ntlmssp_state->workstation, (unsigned long)ntlmssp_state->lm_resp.length, (unsigned long)ntlmssp_state->nt_resp.length)); @@ -648,7 +653,8 @@ static NTSTATUS ntlmssp_server_preauth(struct ntlmssp_state *ntlmssp_state, if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) { if (ntlmssp_state->nt_resp.length == 24 && ntlmssp_state->lm_resp.length == 24) { struct MD5Context md5_session_nonce_ctx; - SMB_ASSERT(ntlmssp_state->internal_chal.data && ntlmssp_state->internal_chal.length == 8); + SMB_ASSERT(ntlmssp_state->internal_chal.data + && ntlmssp_state->internal_chal.length == 8); ntlmssp_state->doing_ntlm2 = True; @@ -659,13 +665,17 @@ static NTSTATUS ntlmssp_server_preauth(struct ntlmssp_state *ntlmssp_state, MD5Update(&md5_session_nonce_ctx, ntlmssp_state->session_nonce, 16); MD5Final(session_nonce_hash, &md5_session_nonce_ctx); - ntlmssp_state->chal = data_blob_talloc(ntlmssp_state->mem_ctx, session_nonce_hash, 8); + ntlmssp_state->chal = data_blob_talloc(ntlmssp_state->mem_ctx, + session_nonce_hash, 8); - /* LM response is no longer useful */ + /* LM response is no longer useful, zero it out */ data_blob_free(&ntlmssp_state->lm_resp); /* We changed the effective challenge - set it */ - if (!NT_STATUS_IS_OK(nt_status = ntlmssp_state->set_challenge(ntlmssp_state, &ntlmssp_state->chal))) { + if (!NT_STATUS_IS_OK(nt_status = + ntlmssp_state->set_challenge(ntlmssp_state, + &ntlmssp_state->chal))) { + /* zero this out */ data_blob_free(&ntlmssp_state->encrypted_session_key); return nt_status; } @@ -678,25 +688,20 @@ static NTSTATUS ntlmssp_server_preauth(struct ntlmssp_state *ntlmssp_state, } /** - * Next state function for the Authenticate packet + * Next state function for the Authenticate packet + * (after authentication - figures out the session keys etc) * * @param ntlmssp_state NTLMSSP State - * @param request The request, as a DATA_BLOB - * @param reply The reply, as an allocated DATA_BLOB, caller to free. * @return Errors or NT_STATUS_OK. */ static NTSTATUS ntlmssp_server_postauth(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, - DATA_BLOB *lm_session_key, - DATA_BLOB *reply) + DATA_BLOB *lm_session_key) { NTSTATUS nt_status; DATA_BLOB session_key = data_blob(NULL, 0); - /* parse the NTLMSSP packet */ - *reply = data_blob(NULL, 0); - if (user_session_key) dump_data_pw("USER session key:\n", user_session_key->data, user_session_key->length); @@ -807,8 +812,15 @@ static NTSTATUS ntlmssp_server_postauth(struct ntlmssp_state *ntlmssp_state, data_blob_free(&ntlmssp_state->encrypted_session_key); - /* allow arbitarily many authentications */ - ntlmssp_state->expected_state = NTLMSSP_AUTH; + /* allow arbitarily many authentications, but watch that this will cause a + memory leak, until the ntlmssp_state is shutdown + */ + + if (ntlmssp_state->server_multiple_authentications) { + ntlmssp_state->expected_state = NTLMSSP_AUTH; + } else { + ntlmssp_state->expected_state = NTLMSSP_DONE; + } return nt_status; } @@ -818,22 +830,23 @@ static NTSTATUS ntlmssp_server_postauth(struct ntlmssp_state *ntlmssp_state, * Next state function for the Authenticate packet * * @param ntlmssp_state NTLMSSP State - * @param request The request, as a DATA_BLOB - * @param reply The reply, as an allocated DATA_BLOB, caller to free. - * @return Errors or NT_STATUS_OK. + * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB + * @param out The reply, as an allocated DATA_BLOB, caller to free. + * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK. */ static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state, - const DATA_BLOB request, DATA_BLOB *reply) + TALLOC_CTX *out_mem_ctx, + const DATA_BLOB in, DATA_BLOB *out) { DATA_BLOB user_session_key = data_blob(NULL, 0); DATA_BLOB lm_session_key = data_blob(NULL, 0); NTSTATUS nt_status; - /* parse the NTLMSSP packet */ - *reply = data_blob(NULL, 0); + /* zero the outbound NTLMSSP packet */ + *out = data_blob_talloc(out_mem_ctx, NULL, 0); - if (!NT_STATUS_IS_OK(nt_status = ntlmssp_server_preauth(ntlmssp_state, request))) { + if (!NT_STATUS_IS_OK(nt_status = ntlmssp_server_preauth(ntlmssp_state, in))) { return nt_status; } @@ -851,7 +864,12 @@ static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state, return nt_status; } - return ntlmssp_server_postauth(ntlmssp_state, &user_session_key, &lm_session_key, reply); + if (ntlmssp_state->server_use_session_keys) { + return ntlmssp_server_postauth(ntlmssp_state, &user_session_key, &lm_session_key); + } else { + ntlmssp_state->session_key = data_blob(NULL, 0); + return NT_STATUS_OK; + } } /** @@ -889,6 +907,9 @@ NTSTATUS ntlmssp_server_start(NTLMSSP_STATE **ntlmssp_state) (*ntlmssp_state)->allow_lm_key = (lp_lanman_auth() && lp_parm_bool(-1, "ntlmssp_server", "allow_lm_key", False)); + (*ntlmssp_state)->server_use_session_keys = True; + (*ntlmssp_state)->server_multiple_authentications = False; + (*ntlmssp_state)->ref_count = 1; (*ntlmssp_state)->neg_flags = @@ -910,13 +931,15 @@ NTSTATUS ntlmssp_server_start(NTLMSSP_STATE **ntlmssp_state) * Next state function for the Initial packet * * @param ntlmssp_state NTLMSSP State - * @param request The request, as a DATA_BLOB. reply.data must be NULL - * @param request The reply, as an allocated DATA_BLOB, caller to free. + * @param out_mem_ctx The DATA_BLOB *out will be allocated on this context + * @param in The request, as a DATA_BLOB. reply.data must be NULL + * @param out The reply, as an talloc()ed DATA_BLOB, on out_mem_ctx * @return Errors or NT_STATUS_OK. */ static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state, - DATA_BLOB reply, DATA_BLOB *next_request) + TALLOC_CTX *out_mem_ctx, + DATA_BLOB in, DATA_BLOB *out) { if (ntlmssp_state->unicode) { ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE; @@ -929,7 +952,8 @@ static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state, } /* generate the ntlmssp negotiate packet */ - msrpc_gen(next_request, "CddAA", + msrpc_gen(out_mem_ctx, + out, "CddAA", "NTLMSSP", NTLMSSP_NEGOTIATE, ntlmssp_state->neg_flags, @@ -951,7 +975,8 @@ static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state, */ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state, - const DATA_BLOB reply, DATA_BLOB *next_request) + TALLOC_CTX *out_mem_ctx, + const DATA_BLOB in, DATA_BLOB *out) { uint32 chal_flags, ntlmssp_command, unkn1, unkn2; DATA_BLOB server_domain_blob; @@ -968,13 +993,14 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB encrypted_session_key = data_blob(NULL, 0); NTSTATUS nt_status; - if (!msrpc_parse(&reply, "CdBd", + if (!msrpc_parse(ntlmssp_state->mem_ctx, + &in, "CdBd", "NTLMSSP", &ntlmssp_command, &server_domain_blob, &chal_flags)) { DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n")); - dump_data(2, (const char *)reply.data, reply.length); + dump_data(2, (const char *)in.data, in.length); return NT_STATUS_INVALID_PARAMETER; } @@ -1006,7 +1032,8 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state, DEBUG(3, ("NTLMSSP: Set final flags:\n")); debug_ntlmssp_flags(ntlmssp_state->neg_flags); - if (!msrpc_parse(&reply, chal_parse_string, + if (!msrpc_parse(ntlmssp_state->mem_ctx, + &in, chal_parse_string, "NTLMSSP", &ntlmssp_command, &server_domain, @@ -1015,16 +1042,13 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state, &unkn1, &unkn2, &struct_blob)) { DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n")); - dump_data(2, (const char *)reply.data, reply.length); + dump_data(2, (const char *)in.data, in.length); return NT_STATUS_INVALID_PARAMETER; } - ntlmssp_state->server_domain = talloc_strdup(ntlmssp_state->mem_ctx, - server_domain); + ntlmssp_state->server_domain = server_domain; - SAFE_FREE(server_domain); if (challenge_blob.length != 8) { - data_blob_free(&struct_blob); return NT_STATUS_INVALID_PARAMETER; } @@ -1137,7 +1161,6 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state, /* LM Key is incompatible... */ ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY; } - } if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) @@ -1156,8 +1179,6 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state, dump_data_pw("LM session key\n", session_key.data, session_key.length); } - data_blob_free(&struct_blob); - /* Key exchange encryptes a new client-generated session key with the password-derived key */ @@ -1167,18 +1188,19 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state, generate_random_buffer(client_session_key, sizeof(client_session_key), False); /* Encrypt the new session key with the old one */ - encrypted_session_key = data_blob(client_session_key, sizeof(client_session_key)); + encrypted_session_key = data_blob_talloc(ntlmssp_state->mem_ctx, + client_session_key, sizeof(client_session_key)); dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length); SamOEMhash(encrypted_session_key.data, session_key.data, encrypted_session_key.length); dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length); /* Mark the new session key as the 'real' session key */ - data_blob_free(&session_key); session_key = data_blob_talloc(ntlmssp_state->mem_ctx, client_session_key, sizeof(client_session_key)); } /* this generates the actual auth packet */ - if (!msrpc_gen(next_request, auth_gen_string, + if (!msrpc_gen(out_mem_ctx, + out, auth_gen_string, "NTLMSSP", NTLMSSP_AUTH, lm_response.data, lm_response.length, @@ -1192,10 +1214,6 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state, return NT_STATUS_NO_MEMORY; } - data_blob_free(&encrypted_session_key); - - data_blob_free(&ntlmssp_state->chal); - ntlmssp_state->session_key = session_key; /* The client might be using 56 or 40 bit weakened keys */ @@ -1205,10 +1223,11 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state, ntlmssp_state->lm_resp = lm_response; ntlmssp_state->nt_resp = nt_response; - ntlmssp_state->expected_state = NTLMSSP_UNKNOWN; + ntlmssp_state->expected_state = NTLMSSP_DONE; if (!NT_STATUS_IS_OK(nt_status = ntlmssp_sign_init(ntlmssp_state))) { - DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status))); + DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", + nt_errstr(nt_status))); return nt_status; } diff --git a/source4/libcli/auth/ntlmssp.h b/source4/libcli/auth/ntlmssp.h index a5e0951fa8..d3d39e8465 100644 --- a/source4/libcli/auth/ntlmssp.h +++ b/source4/libcli/auth/ntlmssp.h @@ -34,7 +34,8 @@ enum NTLM_MESSAGE_TYPE NTLMSSP_NEGOTIATE = 1, NTLMSSP_CHALLENGE = 2, NTLMSSP_AUTH = 3, - NTLMSSP_UNKNOWN = 4 + NTLMSSP_UNKNOWN = 4, + NTLMSSP_DONE = 5 /* samba final state */ }; /* NTLMSSP negotiation flags */ @@ -80,9 +81,15 @@ typedef struct ntlmssp_state BOOL unicode; BOOL use_ntlmv2; - BOOL use_nt_response; /* Set to 'NO' to debug what happens when the NT response is omited */ + BOOL use_nt_response; /* Set to 'False' to debug what happens when the NT response is omited */ BOOL allow_lm_key; /* The LM_KEY code is not functional at this point, and it's not very secure anyway */ + + BOOL server_use_session_keys; /* Set to 'False' for authentication only, + that will never return a session key */ + BOOL server_multiple_authentications; /* Set to 'True' to allow squid 2.5 + style 'challenge caching' */ + char *user; char *domain; char *workstation; @@ -159,10 +166,10 @@ typedef struct ntlmssp_state uint32 ntlmssp_seq_num; /* ntlmv2 */ - char send_sign_const[16]; - char send_seal_const[16]; - char recv_sign_const[16]; - char recv_seal_const[16]; + char send_sign_key[16]; + char send_seal_key[16]; + char recv_sign_key[16]; + char recv_seal_key[16]; unsigned char send_sign_hash[258]; unsigned char send_seal_hash[258]; diff --git a/source4/libcli/auth/ntlmssp_parse.c b/source4/libcli/auth/ntlmssp_parse.c index 4b3043aec8..6ddaeebb06 100644 --- a/source4/libcli/auth/ntlmssp_parse.c +++ b/source4/libcli/auth/ntlmssp_parse.c @@ -40,7 +40,7 @@ d = word (4 bytes) C = constant ascii string */ -BOOL msrpc_gen(DATA_BLOB *blob, +BOOL msrpc_gen(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, const char *format, ...) { int i, n; @@ -91,7 +91,7 @@ BOOL msrpc_gen(DATA_BLOB *blob, va_end(ap); /* allocate the space, then scan the format again to fill in the values */ - *blob = data_blob(NULL, head_size + data_size); + *blob = data_blob_talloc(mem_ctx, NULL, head_size + data_size); head_ofs = 0; data_ofs = head_size; @@ -182,12 +182,12 @@ if ((head_ofs + amount) > blob->length) { \ C = constant ascii string */ -BOOL msrpc_parse(const DATA_BLOB *blob, +BOOL msrpc_parse(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, const char *format, ...) { int i; va_list ap; - char **ps, *s; + const char **ps, *s; DATA_BLOB *b; size_t head_ofs = 0; uint16 len1, len2; @@ -206,7 +206,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob, ps = va_arg(ap, char **); if (len1 == 0 && len2 == 0) { - *ps = smb_xstrdup(""); + *ps = ""; } else { /* make sure its in the right format - be strict */ if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) { @@ -223,9 +223,12 @@ BOOL msrpc_parse(const DATA_BLOB *blob, pull_string(NULL, p, blob->data + ptr, sizeof(p), len1, STR_UNICODE|STR_NOALIGN); - (*ps) = smb_xstrdup(p); + (*ps) = talloc_strdup(mem_ctx, p); + if (!(*ps)) { + return False; + } } else { - (*ps) = smb_xstrdup(""); + (*ps) = ""; } } break; @@ -238,7 +241,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob, ps = va_arg(ap, char **); /* make sure its in the right format - be strict */ if (len1 == 0 && len2 == 0) { - *ps = smb_xstrdup(""); + *ps = ""; } else { if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) { return False; @@ -251,9 +254,12 @@ BOOL msrpc_parse(const DATA_BLOB *blob, pull_string(NULL, p, blob->data + ptr, sizeof(p), len1, STR_ASCII|STR_NOALIGN); - (*ps) = smb_xstrdup(p); + (*ps) = talloc_strdup(mem_ctx, p); + if (!(*ps)) { + return False; + } } else { - (*ps) = smb_xstrdup(""); + (*ps) = ""; } } break; @@ -265,7 +271,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob, b = (DATA_BLOB *)va_arg(ap, void *); if (len1 == 0 && len2 == 0) { - *b = data_blob(NULL, 0); + *b = data_blob_talloc(mem_ctx, NULL, 0); } else { /* make sure its in the right format - be strict */ if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) { @@ -275,7 +281,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob, if (blob->data + ptr < (uint8 *)ptr || blob->data + ptr < blob->data) return False; - *b = data_blob(blob->data + ptr, len1); + *b = data_blob_talloc(mem_ctx, blob->data + ptr, len1); } break; case 'b': @@ -286,7 +292,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob, if (blob->data + head_ofs < (uint8 *)head_ofs || blob->data + head_ofs < blob->data) return False; - *b = data_blob(blob->data + head_ofs, len1); + *b = data_blob_talloc(mem_ctx, blob->data + head_ofs, len1); head_ofs += len1; break; case 'd': diff --git a/source4/libcli/auth/ntlmssp_sign.c b/source4/libcli/auth/ntlmssp_sign.c index 5039a842bc..6abec7e8b6 100644 --- a/source4/libcli/auth/ntlmssp_sign.c +++ b/source4/libcli/auth/ntlmssp_sign.c @@ -53,7 +53,7 @@ static void NTLMSSPcalc_ap( unsigned char *hash, unsigned char *data, int len) hash[257] = index_j; } -static void calc_hash(unsigned char hash[258], const char *k2, int k2l) +static void calc_hash(unsigned char hash[258], const char *key, size_t key_len) { unsigned char j = 0; int ind; @@ -67,7 +67,7 @@ static void calc_hash(unsigned char hash[258], const char *k2, int k2l) { unsigned char tc; - j += (hash[ind] + k2[ind%k2l]); + j += (hash[ind] + key[ind%key_len]); tc = hash[ind]; hash[ind] = hash[j]; @@ -78,23 +78,37 @@ static void calc_hash(unsigned char hash[258], const char *k2, int k2l) hash[257] = 0; } -static void calc_ntlmv2_hash(unsigned char hash[258], unsigned char digest[16], +/** + * Some notes on then NTLM2 code: + * + * This code works correctly for the sealing part of the problem. If + * we disable the check for valid client signatures, then we see that + * the output of a rpcecho 'sinkdata' at smbd is correct. We get the + * valid data, and it is validly decrypted. + * + * This means that the quantity of data passing though the RC4 sealing + * pad is correct. + * + * This code also correctly matches test values that I have obtained, + * claiming to be the correct output of NTLM2 signature generation. + * + */ + + + + +static void calc_ntlmv2_hash(unsigned char hash[258], unsigned char subkey[16], DATA_BLOB session_key, const char *constant) { struct MD5Context ctx3; - /* NOTE: This code is currently complate fantasy - it's - got more in common with reality than the previous code - (the LM session key is not the right thing to use) but - it still needs work */ - MD5Init(&ctx3); MD5Update(&ctx3, session_key.data, session_key.length); - MD5Update(&ctx3, (const unsigned char *)constant, strlen(constant)+1); - MD5Final(digest, &ctx3); + MD5Update(&ctx3, constant, strlen(constant)+1); + MD5Final(subkey, &ctx3); - calc_hash(hash, digest, 16); + calc_hash(hash, subkey, 16); } enum ntlmssp_direction { @@ -103,40 +117,51 @@ enum ntlmssp_direction { }; static NTSTATUS ntlmssp_make_packet_signature(NTLMSSP_STATE *ntlmssp_state, + TALLOC_CTX *sig_mem_ctx, const uchar *data, size_t length, enum ntlmssp_direction direction, DATA_BLOB *sig) { if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) { + HMACMD5Context ctx; uchar seq_num[4]; uchar digest[16]; SIVAL(seq_num, 0, ntlmssp_state->ntlmssp_seq_num); - hmac_md5_init_limK_to_64((const unsigned char *)(ntlmssp_state->send_sign_const), 16, &ctx); + switch (direction) { + case NTLMSSP_SEND: + hmac_md5_init_limK_to_64(ntlmssp_state->send_sign_key, + sizeof(ntlmssp_state->send_sign_key), &ctx); + break; + case NTLMSSP_RECEIVE: + hmac_md5_init_limK_to_64(ntlmssp_state->recv_sign_key, + sizeof(ntlmssp_state->recv_sign_key), &ctx); + break; + } hmac_md5_update(seq_num, 4, &ctx); hmac_md5_update(data, length, &ctx); hmac_md5_final(digest, &ctx); - if (!msrpc_gen(sig, "dBd", NTLMSSP_SIGN_VERSION, digest, 8 /* only copy first 8 bytes */ - , ntlmssp_state->ntlmssp_seq_num)) { - return NT_STATUS_NO_MEMORY; - } - if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) { switch (direction) { case NTLMSSP_SEND: - NTLMSSPcalc_ap(ntlmssp_state->send_sign_hash, sig->data+4, sig->length-4); + NTLMSSPcalc_ap(ntlmssp_state->send_seal_hash, digest, 8); break; case NTLMSSP_RECEIVE: - NTLMSSPcalc_ap(ntlmssp_state->recv_sign_hash, sig->data+4, sig->length-4); + NTLMSSPcalc_ap(ntlmssp_state->recv_seal_hash, digest, 8); break; } } + *sig = data_blob_talloc(sig_mem_ctx, NULL, 16); + SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION); + memcpy(sig->data + 4, digest, 8); + memcpy(sig->data + 12, seq_num, 4); + } else { uint32 crc; crc = crc32_calc_buffer((const char *)data, length); - if (!msrpc_gen(sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) { + if (!msrpc_gen(sig_mem_ctx, sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) { return NT_STATUS_NO_MEMORY; } @@ -148,16 +173,19 @@ static NTSTATUS ntlmssp_make_packet_signature(NTLMSSP_STATE *ntlmssp_state, } NTSTATUS ntlmssp_sign_packet(NTLMSSP_STATE *ntlmssp_state, - const uchar *data, size_t length, - DATA_BLOB *sig) + TALLOC_CTX *sig_mem_ctx, + const uchar *data, size_t length, + DATA_BLOB *sig) { NTSTATUS nt_status; + if (!ntlmssp_state->session_key.length) { DEBUG(3, ("NO session key, cannot check sign packet\n")); return NT_STATUS_NO_USER_SESSION_KEY; } - nt_status = ntlmssp_make_packet_signature(ntlmssp_state, data, length, NTLMSSP_SEND, sig); + nt_status = ntlmssp_make_packet_signature(ntlmssp_state, sig_mem_ctx, + data, length, NTLMSSP_SEND, sig); /* increment counter on send */ ntlmssp_state->ntlmssp_seq_num++; @@ -166,11 +194,11 @@ NTSTATUS ntlmssp_sign_packet(NTLMSSP_STATE *ntlmssp_state, /** * Check the signature of an incoming packet - * @note caller *must* check that the signature is the size it expects * */ NTSTATUS ntlmssp_check_packet(NTLMSSP_STATE *ntlmssp_state, + TALLOC_CTX *sig_mem_ctx, const uchar *data, size_t length, const DATA_BLOB *sig) { @@ -187,7 +215,7 @@ NTSTATUS ntlmssp_check_packet(NTLMSSP_STATE *ntlmssp_state, (unsigned long)sig->length)); } - nt_status = ntlmssp_make_packet_signature(ntlmssp_state, data, + nt_status = ntlmssp_make_packet_signature(ntlmssp_state, sig_mem_ctx, data, length, NTLMSSP_RECEIVE, &local_sig); if (!NT_STATUS_IS_OK(nt_status)) { @@ -195,22 +223,37 @@ NTSTATUS ntlmssp_check_packet(NTLMSSP_STATE *ntlmssp_state, return nt_status; } - if (local_sig.length != sig->length || - memcmp(local_sig.data + local_sig.length - 8, - sig->data + sig->length - 8, 8) != 0) { - DEBUG(5, ("BAD SIG: wanted signature of\n")); - dump_data(5, (const char *)local_sig.data, local_sig.length); - - DEBUG(5, ("BAD SIG: got signature of\n")); - dump_data(5, (const char *)(sig->data), sig->length); + /* increment counter on recv */ + ntlmssp_state->ntlmssp_seq_num++; - DEBUG(0, ("NTLMSSP packet check failed due to invalid signature!\n")); - return NT_STATUS_ACCESS_DENIED; + if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) { + if (local_sig.length != sig->length || + memcmp(local_sig.data, + sig->data, sig->length) != 0) { + DEBUG(5, ("BAD SIG NTLM2: wanted signature of\n")); + dump_data(5, local_sig.data, local_sig.length); + + DEBUG(5, ("BAD SIG: got signature of\n")); + dump_data(5, sig->data, sig->length); + + DEBUG(0, ("NTLMSSP NTLM2 packet check failed due to invalid signature!\n")); + return NT_STATUS_ACCESS_DENIED; + } + } else { + if (local_sig.length != sig->length || + memcmp(local_sig.data + 8, + sig->data + 8, sig->length - 8) != 0) { + DEBUG(5, ("BAD SIG NTLM1: wanted signature of\n")); + dump_data(5, (const char *)local_sig.data, local_sig.length); + + DEBUG(5, ("BAD SIG: got signature of\n")); + dump_data(5, (const char *)(sig->data), sig->length); + + DEBUG(0, ("NTLMSSP NTLM1 packet check failed due to invalid signature!\n")); + return NT_STATUS_ACCESS_DENIED; + } } - /* increment counter on recieive */ - ntlmssp_state->ntlmssp_seq_num++; - return NT_STATUS_OK; } @@ -221,6 +264,7 @@ NTSTATUS ntlmssp_check_packet(NTLMSSP_STATE *ntlmssp_state, */ NTSTATUS ntlmssp_seal_packet(NTLMSSP_STATE *ntlmssp_state, + TALLOC_CTX *sig_mem_ctx, uchar *data, size_t length, DATA_BLOB *sig) { @@ -233,32 +277,34 @@ NTSTATUS ntlmssp_seal_packet(NTLMSSP_STATE *ntlmssp_state, dump_data_pw("ntlmssp clear data\n", data, length); if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) { HMACMD5Context ctx; - char seq_num[4]; + uchar seq_num[4]; uchar digest[16]; SIVAL(seq_num, 0, ntlmssp_state->ntlmssp_seq_num); - hmac_md5_init_limK_to_64((const unsigned char *)(ntlmssp_state->send_sign_const), 16, &ctx); - hmac_md5_update((const unsigned char *)seq_num, 4, &ctx); + hmac_md5_init_limK_to_64(ntlmssp_state->send_sign_key, + sizeof(ntlmssp_state->send_sign_key), &ctx); + hmac_md5_update(seq_num, 4, &ctx); hmac_md5_update(data, length, &ctx); hmac_md5_final(digest, &ctx); - if (!msrpc_gen(sig, "dBd", NTLMSSP_SIGN_VERSION, digest, 8 /* only copy first 8 bytes */ - , ntlmssp_state->ntlmssp_seq_num)) { - return NT_STATUS_NO_MEMORY; + /* The order of these two operations matters - we must first seal the packet, + then seal the sequence number - this is becouse the send_seal_hash is not + constant, but is is rather updated with each iteration */ + + NTLMSSPcalc_ap(ntlmssp_state->send_seal_hash, data, length); + + if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) { + NTLMSSPcalc_ap(ntlmssp_state->send_seal_hash, digest, 8); } - dump_data_pw("ntlmssp client sealing hash:\n", - ntlmssp_state->send_seal_hash, - sizeof(ntlmssp_state->send_seal_hash)); - NTLMSSPcalc_ap(ntlmssp_state->send_seal_hash, data, length); - dump_data_pw("ntlmssp client signing hash:\n", - ntlmssp_state->send_sign_hash, - sizeof(ntlmssp_state->send_sign_hash)); - NTLMSSPcalc_ap(ntlmssp_state->send_sign_hash, sig->data+4, sig->length-4); + *sig = data_blob_talloc(sig_mem_ctx, NULL, 16); + SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION); + memcpy(sig->data + 4, digest, 8); + memcpy(sig->data + 12, seq_num, 4); } else { uint32 crc; crc = crc32_calc_buffer((const char *)data, length); - if (!msrpc_gen(sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) { + if (!msrpc_gen(sig_mem_ctx, sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) { return NT_STATUS_NO_MEMORY; } @@ -288,8 +334,9 @@ NTSTATUS ntlmssp_seal_packet(NTLMSSP_STATE *ntlmssp_state, */ NTSTATUS ntlmssp_unseal_packet(NTLMSSP_STATE *ntlmssp_state, - uchar *data, size_t length, - DATA_BLOB *sig) + TALLOC_CTX *sig_mem_ctx, + uchar *data, size_t length, + DATA_BLOB *sig) { if (!ntlmssp_state->session_key.length) { DEBUG(3, ("NO session key, cannot unseal packet\n")); @@ -307,7 +354,10 @@ NTSTATUS ntlmssp_unseal_packet(NTLMSSP_STATE *ntlmssp_state, } dump_data_pw("ntlmssp clear data\n", data, length); - return ntlmssp_check_packet(ntlmssp_state, data, length, sig); + return ntlmssp_check_packet(ntlmssp_state, sig_mem_ctx, data, length, sig); + + /* increment counter on recv */ + ntlmssp_state->ntlmssp_seq_num++; } /** @@ -348,57 +398,60 @@ NTSTATUS ntlmssp_sign_init(NTLMSSP_STATE *ntlmssp_state) break; } + /* SEND */ calc_ntlmv2_hash(ntlmssp_state->send_sign_hash, - ntlmssp_state->send_sign_const, + ntlmssp_state->send_sign_key, ntlmssp_state->session_key, send_sign_const); + dump_data_pw("NTLMSSP send sign key:\n", + ntlmssp_state->send_sign_key, + sizeof(ntlmssp_state->send_sign_key)); + dump_data_pw("NTLMSSP send sign hash:\n", ntlmssp_state->send_sign_hash, sizeof(ntlmssp_state->send_sign_hash)); calc_ntlmv2_hash(ntlmssp_state->send_seal_hash, - ntlmssp_state->send_seal_const, + ntlmssp_state->send_seal_key, ntlmssp_state->session_key, send_seal_const); + dump_data_pw("NTLMSSP send seal key:\n", + ntlmssp_state->send_seal_key, + sizeof(ntlmssp_state->send_seal_key)); + dump_data_pw("NTLMSSP send sesl hash:\n", ntlmssp_state->send_seal_hash, sizeof(ntlmssp_state->send_seal_hash)); + /* RECV */ calc_ntlmv2_hash(ntlmssp_state->recv_sign_hash, - ntlmssp_state->recv_sign_const, + ntlmssp_state->recv_sign_key, ntlmssp_state->session_key, recv_sign_const); + dump_data_pw("NTLMSSP recv sign key:\n", + ntlmssp_state->recv_sign_key, + sizeof(ntlmssp_state->recv_sign_key)); dump_data_pw("NTLMSSP receive sign hash:\n", ntlmssp_state->recv_sign_hash, sizeof(ntlmssp_state->recv_sign_hash)); calc_ntlmv2_hash(ntlmssp_state->recv_seal_hash, - ntlmssp_state->recv_seal_const, + ntlmssp_state->recv_seal_key, ntlmssp_state->session_key, recv_seal_const); + dump_data_pw("NTLMSSP recv seal key:\n", + ntlmssp_state->recv_sign_key, + sizeof(ntlmssp_state->recv_seal_key)); dump_data_pw("NTLMSSP receive seal hash:\n", ntlmssp_state->recv_sign_hash, sizeof(ntlmssp_state->recv_sign_hash)); - } - else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) { - if (!ntlmssp_state->session_key.data || ntlmssp_state->session_key.length < 8) { - /* can't sign or check signatures yet */ - DEBUG(5, ("NTLMSSP Sign/Seal - cannot use LM KEY yet\n")); - return NT_STATUS_UNSUCCESSFUL; - } - - DEBUG(5, ("NTLMSSP Sign/Seal - using LM KEY\n")); - - calc_hash(ntlmssp_state->ntlmssp_hash, (const char *)(ntlmssp_state->session_key.data), 8); - dump_data_pw("NTLMSSP hash:\n", ntlmssp_state->ntlmssp_hash, - sizeof(ntlmssp_state->ntlmssp_hash)); } else { - if (!ntlmssp_state->session_key.data || ntlmssp_state->session_key.length < 16) { + if (!ntlmssp_state->session_key.data) { /* can't sign or check signatures yet */ - DEBUG(5, ("NTLMSSP Sign/Seal - cannot use NT KEY yet\n")); + DEBUG(5, ("NTLMSSP Sign/Seal - cannot use NT KEY\n")); return NT_STATUS_UNSUCCESSFUL; } DEBUG(5, ("NTLMSSP Sign/Seal - using NT KEY\n")); - calc_hash(ntlmssp_state->ntlmssp_hash, (const char *)(ntlmssp_state->session_key.data), 16); + calc_hash(ntlmssp_state->ntlmssp_hash, (const char *)(ntlmssp_state->session_key.data), ntlmssp_state->session_key.length); dump_data_pw("NTLMSSP hash:\n", ntlmssp_state->ntlmssp_hash, sizeof(ntlmssp_state->ntlmssp_hash)); } diff --git a/source4/libcli/auth/schannel.c b/source4/libcli/auth/schannel.c index e5a786ff24..59d0c4aa7d 100644 --- a/source4/libcli/auth/schannel.c +++ b/source4/libcli/auth/schannel.c @@ -93,6 +93,7 @@ static void schannel_digest(const uchar sess_key[16], unseal a packet */ NTSTATUS schannel_unseal_packet(struct schannel_state *state, + TALLOC_CTX *mem_ctx, uchar *data, size_t length, DATA_BLOB *sig) { @@ -183,6 +184,7 @@ NTSTATUS schannel_check_packet(struct schannel_state *state, seal a packet */ NTSTATUS schannel_seal_packet(struct schannel_state *state, + TALLOC_CTX *mem_ctx, uchar *data, size_t length, DATA_BLOB *sig) { @@ -208,7 +210,7 @@ NTSTATUS schannel_seal_packet(struct schannel_state *state, netsec_deal_with_seq_num(state, digest_final, seq_num); if (!state->signature.data) { - state->signature = data_blob_talloc(state->mem_ctx, NULL, 32); + state->signature = data_blob_talloc(mem_ctx, NULL, 32); if (!state->signature.data) { return NT_STATUS_NO_MEMORY; } @@ -233,6 +235,7 @@ NTSTATUS schannel_seal_packet(struct schannel_state *state, sign a packet */ NTSTATUS schannel_sign_packet(struct schannel_state *state, + TALLOC_CTX *mem_ctx, const uchar *data, size_t length, DATA_BLOB *sig) { @@ -250,7 +253,7 @@ NTSTATUS schannel_sign_packet(struct schannel_state *state, netsec_deal_with_seq_num(state, digest_final, seq_num); if (!state->signature.data) { - state->signature = data_blob_talloc(state->mem_ctx, NULL, 32); + state->signature = data_blob_talloc(mem_ctx, NULL, 32); if (!state->signature.data) { return NT_STATUS_NO_MEMORY; } diff --git a/source4/libcli/util/smbencrypt.c b/source4/libcli/util/smbencrypt.c index 013f00d5fa..edf1526d2e 100644 --- a/source4/libcli/util/smbencrypt.c +++ b/source4/libcli/util/smbencrypt.c @@ -291,19 +291,20 @@ void SMBsesskeygen_lm_sess_key(const uchar lm_hash[16], #endif } -DATA_BLOB NTLMv2_generate_names_blob(const char *hostname, +DATA_BLOB NTLMv2_generate_names_blob(TALLOC_CTX *mem_ctx, + const char *hostname, const char *domain) { - DATA_BLOB names_blob = data_blob(NULL, 0); + DATA_BLOB names_blob = data_blob_talloc(mem_ctx, NULL, 0); - msrpc_gen(&names_blob, "aaa", + msrpc_gen(mem_ctx, &names_blob, "aaa", NTLMSSP_NAME_TYPE_DOMAIN, domain, NTLMSSP_NAME_TYPE_SERVER, hostname, 0, ""); return names_blob; } -static DATA_BLOB NTLMv2_generate_client_data(const DATA_BLOB *names_blob) +static DATA_BLOB NTLMv2_generate_client_data(TALLOC_CTX *mem_ctx, const DATA_BLOB *names_blob) { uchar client_chal[8]; DATA_BLOB response = data_blob(NULL, 0); @@ -318,7 +319,7 @@ static DATA_BLOB NTLMv2_generate_client_data(const DATA_BLOB *names_blob) /* See http://www.ubiqx.org/cifs/SMB.html#SMB.8.5 */ - msrpc_gen(&response, "ddbbdb", + msrpc_gen(mem_ctx, &response, "ddbbdb", 0x00000101, /* Header */ 0, /* 'Reserved' */ long_date, 8, /* Timestamp */ @@ -337,10 +338,16 @@ static DATA_BLOB NTLMv2_generate_response(const uchar ntlm_v2_hash[16], DATA_BLOB ntlmv2_client_data; DATA_BLOB final_response; + TALLOC_CTX *mem_ctx = talloc_init("NTLMv2_generate_response internal context"); + + if (!mem_ctx) { + return data_blob(NULL, 0); + } + /* NTLMv2 */ /* generate some data to pass into the response function - including the hostname and domain name of the server */ - ntlmv2_client_data = NTLMv2_generate_client_data(names_blob); + ntlmv2_client_data = NTLMv2_generate_client_data(mem_ctx, names_blob); /* Given that data, and the challenge from the server, generate a response */ SMBOWFencrypt_ntv2(ntlm_v2_hash, server_chal, &ntlmv2_client_data, ntlmv2_response); @@ -352,7 +359,7 @@ static DATA_BLOB NTLMv2_generate_response(const uchar ntlm_v2_hash[16], memcpy(final_response.data+sizeof(ntlmv2_response), ntlmv2_client_data.data, ntlmv2_client_data.length); - data_blob_free(&ntlmv2_client_data); + talloc_destroy(mem_ctx); return final_response; } diff --git a/source4/librpc/idl/lsa.idl b/source4/librpc/idl/lsa.idl index 2e3049ac78..6d81a4cb6f 100644 --- a/source4/librpc/idl/lsa.idl +++ b/source4/librpc/idl/lsa.idl @@ -499,7 +499,15 @@ /* Function: 0x2d */ - NTSTATUS UNK_GET_CONNUSER (); + NTSTATUS UNK_GET_CONNUSER ( + [in] unistr *system_name, + [in] uint32 unknown1, + [in] uint32 unknown2, + [in] uint32 unknown3, + [out] unistr *username, + [out] unistr *domain_name + ); + /* Function: 0x2e */ NTSTATUS QUERYINFO2 (); } diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c index 21340e4f63..e4c5174af3 100644 --- a/source4/librpc/rpc/dcerpc.c +++ b/source4/librpc/rpc/dcerpc.c @@ -183,6 +183,7 @@ static NTSTATUS dcerpc_pull_request_sign(struct dcerpc_pipe *p, switch (p->auth_info->auth_level) { case DCERPC_AUTH_LEVEL_PRIVACY: status = p->security_state->unseal_packet(p->security_state, + mem_ctx, pkt->u.response.stub_and_verifier.data, pkt->u.response.stub_and_verifier.length, &auth.credentials); @@ -190,6 +191,7 @@ static NTSTATUS dcerpc_pull_request_sign(struct dcerpc_pipe *p, case DCERPC_AUTH_LEVEL_INTEGRITY: status = p->security_state->check_packet(p->security_state, + mem_ctx, pkt->u.response.stub_and_verifier.data, pkt->u.response.stub_and_verifier.length, &auth.credentials); @@ -250,6 +252,7 @@ static NTSTATUS dcerpc_push_request_sign(struct dcerpc_pipe *p, switch (p->auth_info->auth_level) { case DCERPC_AUTH_LEVEL_PRIVACY: status = p->security_state->seal_packet(p->security_state, + mem_ctx, ndr->data + DCERPC_REQUEST_LENGTH, ndr->offset - DCERPC_REQUEST_LENGTH, &p->auth_info->credentials); @@ -257,6 +260,7 @@ static NTSTATUS dcerpc_push_request_sign(struct dcerpc_pipe *p, case DCERPC_AUTH_LEVEL_INTEGRITY: status = p->security_state->sign_packet(p->security_state, + mem_ctx, ndr->data + DCERPC_REQUEST_LENGTH, ndr->offset - DCERPC_REQUEST_LENGTH, &p->auth_info->credentials); diff --git a/source4/librpc/rpc/dcerpc.h b/source4/librpc/rpc/dcerpc.h index 5c7f01c658..25c2029f34 100644 --- a/source4/librpc/rpc/dcerpc.h +++ b/source4/librpc/rpc/dcerpc.h @@ -28,12 +28,16 @@ enum dcerpc_transport_t {NCACN_NP, NCACN_IP_TCP}; struct dcerpc_security { void *private; NTSTATUS (*unseal_packet)(struct dcerpc_security *, + TALLOC_CTX *mem_ctx, uchar *data, size_t length, DATA_BLOB *sig); NTSTATUS (*check_packet)(struct dcerpc_security *, + TALLOC_CTX *mem_ctx, const uchar *data, size_t length, const DATA_BLOB *sig); NTSTATUS (*seal_packet)(struct dcerpc_security *, - uchar *data, size_t length, DATA_BLOB *sig); + TALLOC_CTX *mem_ctx, + uchar *data, size_t length, DATA_BLOB *sig); NTSTATUS (*sign_packet)(struct dcerpc_security *, + TALLOC_CTX *mem_ctx, const uchar *data, size_t length, DATA_BLOB *sig); NTSTATUS (*session_key)(struct dcerpc_security *, DATA_BLOB *session_key); void (*security_end)(struct dcerpc_security *); diff --git a/source4/librpc/rpc/dcerpc_ntlm.c b/source4/librpc/rpc/dcerpc_ntlm.c index fa4232c94a..1a216e9885 100644 --- a/source4/librpc/rpc/dcerpc_ntlm.c +++ b/source4/librpc/rpc/dcerpc_ntlm.c @@ -26,34 +26,38 @@ wrappers for the ntlmssp_*() functions */ static NTSTATUS ntlm_unseal_packet(struct dcerpc_security *dcerpc_security, - uchar *data, size_t length, DATA_BLOB *sig) + TALLOC_CTX *mem_ctx, + uchar *data, size_t length, DATA_BLOB *sig) { struct ntlmssp_state *ntlmssp_state = dcerpc_security->private; - return ntlmssp_unseal_packet(ntlmssp_state, data, length, sig); + return ntlmssp_unseal_packet(ntlmssp_state, mem_ctx, data, length, sig); } static NTSTATUS ntlm_check_packet(struct dcerpc_security *dcerpc_security, + TALLOC_CTX *mem_ctx, const uchar *data, size_t length, const DATA_BLOB *sig) { struct ntlmssp_state *ntlmssp_state = dcerpc_security->private; - return ntlmssp_check_packet(ntlmssp_state, data, length, sig); + return ntlmssp_check_packet(ntlmssp_state, mem_ctx, data, length, sig); } static NTSTATUS ntlm_seal_packet(struct dcerpc_security *dcerpc_security, + TALLOC_CTX *mem_ctx, uchar *data, size_t length, DATA_BLOB *sig) { struct ntlmssp_state *ntlmssp_state = dcerpc_security->private; - return ntlmssp_seal_packet(ntlmssp_state, data, length, sig); + return ntlmssp_seal_packet(ntlmssp_state, mem_ctx, data, length, sig); } static NTSTATUS ntlm_sign_packet(struct dcerpc_security *dcerpc_security, + TALLOC_CTX *mem_ctx, const uchar *data, size_t length, DATA_BLOB *sig) { struct ntlmssp_state *ntlmssp_state = dcerpc_security->private; - return ntlmssp_sign_packet(ntlmssp_state, data, length, sig); + return ntlmssp_sign_packet(ntlmssp_state, mem_ctx, data, length, sig); } static NTSTATUS ntlm_session_key(struct dcerpc_security *dcerpc_security, @@ -137,35 +141,30 @@ NTSTATUS dcerpc_bind_auth_ntlm(struct dcerpc_pipe *p, p->auth_info->credentials = data_blob(NULL, 0); p->security_state = NULL; - status = ntlmssp_update(state, + status = ntlmssp_update(state, mem_ctx, p->auth_info->credentials, &credentials); + if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { goto done; } - p->auth_info->credentials = data_blob_talloc(mem_ctx, - credentials.data, - credentials.length); - data_blob_free(&credentials); + p->auth_info->credentials = credentials; status = dcerpc_bind_byuuid(p, mem_ctx, uuid, version); if (!NT_STATUS_IS_OK(status)) { goto done; } - - status = ntlmssp_update(state, + status = ntlmssp_update(state, mem_ctx, p->auth_info->credentials, &credentials); + if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { goto done; } - p->auth_info->credentials = data_blob_talloc(mem_ctx, - credentials.data, - credentials.length); - data_blob_free(&credentials); + p->auth_info->credentials = credentials; status = dcerpc_auth3(p, mem_ctx); @@ -187,14 +186,6 @@ NTSTATUS dcerpc_bind_auth_ntlm(struct dcerpc_pipe *p, p->security_state->session_key = ntlm_session_key; p->security_state->security_end = ntlm_security_end; - switch (p->auth_info->auth_level) { - case DCERPC_AUTH_LEVEL_PRIVACY: - case DCERPC_AUTH_LEVEL_INTEGRITY: - /* setup for signing */ - status = ntlmssp_sign_init(state); - break; - } - done: talloc_destroy(mem_ctx); diff --git a/source4/librpc/rpc/dcerpc_schannel.c b/source4/librpc/rpc/dcerpc_schannel.c index a88d3c1b3e..f368ce30b3 100644 --- a/source4/librpc/rpc/dcerpc_schannel.c +++ b/source4/librpc/rpc/dcerpc_schannel.c @@ -26,34 +26,38 @@ wrappers for the schannel_*() functions */ static NTSTATUS schan_unseal_packet(struct dcerpc_security *dcerpc_security, - uchar *data, size_t length, DATA_BLOB *sig) + TALLOC_CTX *mem_ctx, + uchar *data, size_t length, DATA_BLOB *sig) { struct schannel_state *schannel_state = dcerpc_security->private; - return schannel_unseal_packet(schannel_state, data, length, sig); + return schannel_unseal_packet(schannel_state, mem_ctx, data, length, sig); } static NTSTATUS schan_check_packet(struct dcerpc_security *dcerpc_security, - const uchar *data, size_t length, - const DATA_BLOB *sig) + TALLOC_CTX *mem_ctx, + const uchar *data, size_t length, + const DATA_BLOB *sig) { struct schannel_state *schannel_state = dcerpc_security->private; return schannel_check_packet(schannel_state, data, length, sig); } static NTSTATUS schan_seal_packet(struct dcerpc_security *dcerpc_security, - uchar *data, size_t length, - DATA_BLOB *sig) + TALLOC_CTX *mem_ctx, + uchar *data, size_t length, + DATA_BLOB *sig) { struct schannel_state *schannel_state = dcerpc_security->private; - return schannel_seal_packet(schannel_state, data, length, sig); + return schannel_seal_packet(schannel_state, mem_ctx, data, length, sig); } static NTSTATUS schan_sign_packet(struct dcerpc_security *dcerpc_security, + TALLOC_CTX *mem_ctx, const uchar *data, size_t length, DATA_BLOB *sig) { struct schannel_state *schannel_state = dcerpc_security->private; - return schannel_sign_packet(schannel_state, data, length, sig); + return schannel_sign_packet(schannel_state, mem_ctx, data, length, sig); } static NTSTATUS schan_session_key(struct dcerpc_security *dcerpc_security, diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c index a117f08445..48792180c6 100644 --- a/source4/rpc_server/dcesrv_auth.c +++ b/source4/rpc_server/dcesrv_auth.c @@ -66,6 +66,7 @@ BOOL dcesrv_auth_bind(struct dcesrv_call_state *call) status = auth_ntlmssp_start(&dce_conn->auth_state.ntlmssp_state); if (!NT_STATUS_IS_OK(status)) { + DEBUG(2, ("Failed to start NTLMSSP subsystem!\n")); return False; } @@ -85,10 +86,12 @@ BOOL dcesrv_auth_bind_ack(struct dcesrv_call_state *call, struct dcerpc_packet * } status = auth_ntlmssp_update(dce_conn->auth_state.ntlmssp_state, + call->mem_ctx, dce_conn->auth_state.auth_info->credentials, &dce_conn->auth_state.auth_info->credentials); if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + DEBUG(2, ("Failed to start NTLMSSP process NTLMSSP negotiate: %s\n", nt_errstr(status))); return False; } @@ -131,20 +134,14 @@ BOOL dcesrv_auth_auth3(struct dcesrv_call_state *call) } status = auth_ntlmssp_update(dce_conn->auth_state.ntlmssp_state, + call->mem_ctx, dce_conn->auth_state.auth_info->credentials, &dce_conn->auth_state.auth_info->credentials); if (!NT_STATUS_IS_OK(status)) { + DEBUG(4, ("User failed to authenticated with NTLMSSP: %s\n", nt_errstr(status))); return False; } - switch (dce_conn->auth_state.auth_info->auth_level) { - case DCERPC_AUTH_LEVEL_PRIVACY: - case DCERPC_AUTH_LEVEL_INTEGRITY: - /* setup for signing */ - status = ntlmssp_sign_init(dce_conn->auth_state.ntlmssp_state->ntlmssp_state); - break; - } - return True; } @@ -197,6 +194,7 @@ BOOL dcesrv_auth_request(struct dcesrv_call_state *call) switch (dce_conn->auth_state.auth_info->auth_level) { case DCERPC_AUTH_LEVEL_PRIVACY: status = ntlmssp_unseal_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state, + call->mem_ctx, pkt->u.request.stub_and_verifier.data, pkt->u.request.stub_and_verifier.length, &auth.credentials); @@ -204,6 +202,7 @@ BOOL dcesrv_auth_request(struct dcesrv_call_state *call) case DCERPC_AUTH_LEVEL_INTEGRITY: status = ntlmssp_check_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state, + call->mem_ctx, pkt->u.request.stub_and_verifier.data, pkt->u.request.stub_and_verifier.length, &auth.credentials); @@ -262,6 +261,7 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call, switch (dce_conn->auth_state.auth_info->auth_level) { case DCERPC_AUTH_LEVEL_PRIVACY: status = ntlmssp_seal_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state, + call->mem_ctx, ndr->data + DCERPC_REQUEST_LENGTH, ndr->offset - DCERPC_REQUEST_LENGTH, &dce_conn->auth_state.auth_info->credentials); @@ -269,6 +269,7 @@ BOOL dcesrv_auth_response(struct dcesrv_call_state *call, case DCERPC_AUTH_LEVEL_INTEGRITY: status = ntlmssp_sign_packet(dce_conn->auth_state.ntlmssp_state->ntlmssp_state, + call->mem_ctx, ndr->data + DCERPC_REQUEST_LENGTH, ndr->offset - DCERPC_REQUEST_LENGTH, &dce_conn->auth_state.auth_info->credentials); diff --git a/source4/torture/config.mk b/source4/torture/config.mk index 05f4df2105..6231941715 100644 --- a/source4/torture/config.mk +++ b/source4/torture/config.mk @@ -9,7 +9,7 @@ ADD_OBJ_FILES = \ torture/basic/charset.o \ torture/basic/mangle_test.o \ torture/basic/denytest.o \ - torture/basic/aliases.o + torture/basic/aliases.o REQUIRED_SUBSYSTEMS = \ LIBSMB # End SUBSYSTEM TORTURE_BASIC @@ -81,7 +81,8 @@ ADD_OBJ_FILES = \ [BINARY::smbtorture] OBJ_FILES = \ torture/torture.o \ - torture/torture_util.o + torture/torture_util.o \ + torture/ntlmssp.o REQUIRED_SUBSYSTEMS = \ TORTURE_BASIC \ TORTURE_RAW \ diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c index 25c0496a00..bd7a450f58 100644 --- a/source4/torture/rpc/netlogon.c +++ b/source4/torture/rpc/netlogon.c @@ -741,14 +741,15 @@ static BOOL test_lmv2_ntlmv2_broken(struct samlogon_state *samlogon_state, enum DATA_BLOB ntlmv2_response = data_blob(NULL, 0); DATA_BLOB lmv2_response = data_blob(NULL, 0); DATA_BLOB ntlmv2_session_key = data_blob(NULL, 0); - DATA_BLOB names_blob = NTLMv2_generate_names_blob(lp_netbios_name(), lp_workgroup()); + DATA_BLOB names_blob = NTLMv2_generate_names_blob(samlogon_state->mem_ctx, lp_netbios_name(), lp_workgroup()); uchar user_session_key[16]; ZERO_STRUCT(user_session_key); /* TODO - test with various domain cases, and without domain */ - if (!SMBNTLMv2encrypt(samlogon_state->username, lp_workgroup(), samlogon_state->password, &samlogon_state->chall, + if (!SMBNTLMv2encrypt(samlogon_state->username, lp_workgroup(), + samlogon_state->password, &samlogon_state->chall, &names_blob, &lmv2_response, &ntlmv2_response, &ntlmv2_session_key)) { diff --git a/source4/torture/torture.c b/source4/torture/torture.c index 9ba90a103d..ef6a0c2ed8 100644 --- a/source4/torture/torture.c +++ b/source4/torture/torture.c @@ -4140,6 +4140,7 @@ static struct { {"RPC-MGMT", torture_rpc_mgmt, 0}, {"RPC-SCANNER", torture_rpc_scanner, 0}, {"RPC-AUTOIDL", torture_rpc_autoidl, 0}, + {"NTLMSSP-SELFCHECK", torture_ntlmssp_self_check, 0}, {NULL, NULL, 0}}; -- cgit