2 Unix SMB/Netbios implementation.
4 handle NLTMSSP, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003
8 Copyright (C) Andrew Bartlett 2005 (Updated from gensec).
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_ntlmssp.h"
28 #include "../libcli/auth/ntlmssp_ndr.h"
29 #include "../lib/crypto/md5.h"
30 #include "../lib/crypto/arcfour.h"
31 #include "../lib/crypto/hmacmd5.h"
33 static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state,
34 DATA_BLOB reply, DATA_BLOB *next_request);
35 static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state,
36 const DATA_BLOB in, DATA_BLOB *out);
37 static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state,
38 const DATA_BLOB reply, DATA_BLOB *next_request);
39 static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state,
40 const DATA_BLOB request, DATA_BLOB *reply);
43 * Callbacks for NTLMSSP - for both client and server operating modes
47 static const struct ntlmssp_callbacks {
48 enum ntlmssp_role role;
49 enum ntlmssp_message_type ntlmssp_command;
50 NTSTATUS (*fn)(struct ntlmssp_state *ntlmssp_state,
51 DATA_BLOB in, DATA_BLOB *out);
52 } ntlmssp_callbacks[] = {
53 {NTLMSSP_CLIENT, NTLMSSP_INITIAL, ntlmssp_client_initial},
54 {NTLMSSP_SERVER, NTLMSSP_NEGOTIATE, ntlmssp_server_negotiate},
55 {NTLMSSP_CLIENT, NTLMSSP_CHALLENGE, ntlmssp_client_challenge},
56 {NTLMSSP_SERVER, NTLMSSP_AUTH, ntlmssp_server_auth},
57 {NTLMSSP_CLIENT, NTLMSSP_UNKNOWN, NULL},
58 {NTLMSSP_SERVER, NTLMSSP_UNKNOWN, NULL}
63 * Print out the NTLMSSP flags for debugging
64 * @param neg_flags The flags from the packet
67 void debug_ntlmssp_flags(uint32_t neg_flags)
69 DEBUG(3,("Got NTLMSSP neg_flags=0x%08x\n", neg_flags));
71 if (neg_flags & NTLMSSP_NEGOTIATE_UNICODE)
72 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_UNICODE\n"));
73 if (neg_flags & NTLMSSP_NEGOTIATE_OEM)
74 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM\n"));
75 if (neg_flags & NTLMSSP_REQUEST_TARGET)
76 DEBUGADD(4, (" NTLMSSP_REQUEST_TARGET\n"));
77 if (neg_flags & NTLMSSP_NEGOTIATE_SIGN)
78 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_SIGN\n"));
79 if (neg_flags & NTLMSSP_NEGOTIATE_SEAL)
80 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_SEAL\n"));
81 if (neg_flags & NTLMSSP_NEGOTIATE_DATAGRAM)
82 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_DATAGRAM\n"));
83 if (neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
84 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_LM_KEY\n"));
85 if (neg_flags & NTLMSSP_NEGOTIATE_NETWARE)
86 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NETWARE\n"));
87 if (neg_flags & NTLMSSP_NEGOTIATE_NTLM)
88 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NTLM\n"));
89 if (neg_flags & NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED)
90 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED\n"));
91 if (neg_flags & NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED)
92 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED\n"));
93 if (neg_flags & NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL)
94 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL\n"));
95 if (neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)
96 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_ALWAYS_SIGN\n"));
97 if (neg_flags & NTLMSSP_REQUEST_NON_NT_SESSION_KEY)
98 DEBUGADD(4, (" NTLMSSP_REQUEST_NON_NT_SESSION_KEY\n"));
99 if (neg_flags & NTLMSSP_NEGOTIATE_NTLM2)
100 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_NTLM2\n"));
101 if (neg_flags & NTLMSSP_NEGOTIATE_TARGET_INFO)
102 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_TARGET_INFO\n"));
103 if (neg_flags & NTLMSSP_NEGOTIATE_VERSION)
104 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_VERSION\n"));
105 if (neg_flags & NTLMSSP_NEGOTIATE_128)
106 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_128\n"));
107 if (neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)
108 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_KEY_EXCH\n"));
109 if (neg_flags & NTLMSSP_NEGOTIATE_56)
110 DEBUGADD(4, (" NTLMSSP_NEGOTIATE_56\n"));
114 * Default challenge generation code.
118 static NTSTATUS get_challenge(const struct ntlmssp_state *ntlmssp_state,
121 generate_random_buffer(chal, 8);
126 * Default 'we can set the challenge to anything we like' implementation
130 static bool may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
136 * Default 'we can set the challenge to anything we like' implementation
138 * Does not actually do anything, as the value is always in the structure anyway.
142 static NTSTATUS set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
144 SMB_ASSERT(challenge->length == 8);
149 * Set a username on an NTLMSSP context - ensures it is talloc()ed
153 NTSTATUS ntlmssp_set_username(struct ntlmssp_state *ntlmssp_state, const char *user)
155 ntlmssp_state->user = talloc_strdup(ntlmssp_state, user ? user : "" );
156 if (!ntlmssp_state->user) {
157 return NT_STATUS_NO_MEMORY;
163 * Store NT and LM hashes on an NTLMSSP context - ensures they are talloc()ed
166 NTSTATUS ntlmssp_set_hashes(struct ntlmssp_state *ntlmssp_state,
167 const uint8_t lm_hash[16],
168 const uint8_t nt_hash[16])
170 ntlmssp_state->lm_hash = (uint8_t *)
171 TALLOC_MEMDUP(ntlmssp_state, lm_hash, 16);
172 ntlmssp_state->nt_hash = (uint8_t *)
173 TALLOC_MEMDUP(ntlmssp_state, nt_hash, 16);
174 if (!ntlmssp_state->lm_hash || !ntlmssp_state->nt_hash) {
175 TALLOC_FREE(ntlmssp_state->lm_hash);
176 TALLOC_FREE(ntlmssp_state->nt_hash);
177 return NT_STATUS_NO_MEMORY;
183 * Converts a password to the hashes on an NTLMSSP context.
186 NTSTATUS ntlmssp_set_password(struct ntlmssp_state *ntlmssp_state, const char *password)
189 ntlmssp_state->lm_hash = NULL;
190 ntlmssp_state->nt_hash = NULL;
195 E_deshash(password, lm_hash);
196 E_md4hash(password, nt_hash);
197 return ntlmssp_set_hashes(ntlmssp_state, lm_hash, nt_hash);
203 * Set a domain on an NTLMSSP context - ensures it is talloc()ed
206 NTSTATUS ntlmssp_set_domain(struct ntlmssp_state *ntlmssp_state, const char *domain)
208 ntlmssp_state->domain = talloc_strdup(ntlmssp_state,
209 domain ? domain : "" );
210 if (!ntlmssp_state->domain) {
211 return NT_STATUS_NO_MEMORY;
217 * Request features for the NTLMSSP negotiation
219 * @param ntlmssp_state NTLMSSP state
220 * @param feature_list List of space seperated features requested from NTLMSSP.
222 void ntlmssp_want_feature_list(struct ntlmssp_state *ntlmssp_state, char *feature_list)
225 * We need to set this to allow a later SetPassword
226 * via the SAMR pipe to succeed. Strange.... We could
227 * also add NTLMSSP_NEGOTIATE_SEAL here. JRA.
229 if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list, True)) {
230 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
232 if (in_list("NTLMSSP_FEATURE_SIGN", feature_list, True)) {
233 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
235 if(in_list("NTLMSSP_FEATURE_SEAL", feature_list, True)) {
236 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
238 if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list, true)) {
239 ntlmssp_state->use_ccache = true;
244 * Request a feature for the NTLMSSP negotiation
246 * @param ntlmssp_state NTLMSSP state
247 * @param feature Bit flag specifying the requested feature
249 void ntlmssp_want_feature(struct ntlmssp_state *ntlmssp_state, uint32_t feature)
251 /* As per JRA's comment above */
252 if (feature & NTLMSSP_FEATURE_SESSION_KEY) {
253 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
255 if (feature & NTLMSSP_FEATURE_SIGN) {
256 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
258 if (feature & NTLMSSP_FEATURE_SEAL) {
259 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
261 if (feature & NTLMSSP_FEATURE_CCACHE) {
262 ntlmssp_state->use_ccache = true;
267 * Next state function for the NTLMSSP state machine
269 * @param ntlmssp_state NTLMSSP State
270 * @param in The packet in from the NTLMSSP partner, as a DATA_BLOB
271 * @param out The reply, as an allocated DATA_BLOB, caller to free.
272 * @return Errors, NT_STATUS_MORE_PROCESSING_REQUIRED or NT_STATUS_OK.
275 NTSTATUS ntlmssp_update(struct ntlmssp_state *ntlmssp_state,
276 const DATA_BLOB input, DATA_BLOB *out)
278 uint32_t ntlmssp_command;
281 if (ntlmssp_state->expected_state == NTLMSSP_DONE) {
282 /* Called update after negotiations finished. */
283 DEBUG(1, ("Called NTLMSSP after state machine was 'done'\n"));
284 return NT_STATUS_INVALID_PARAMETER;
287 *out = data_blob_null;
290 switch (ntlmssp_state->role) {
292 ntlmssp_command = NTLMSSP_INITIAL;
295 /* 'datagram' mode - no neg packet */
296 ntlmssp_command = NTLMSSP_NEGOTIATE;
300 if (!msrpc_parse(ntlmssp_state, &input, "Cd",
303 DEBUG(1, ("Failed to parse NTLMSSP packet, could not extract NTLMSSP command\n"));
304 dump_data(2, input.data, input.length);
305 return NT_STATUS_INVALID_PARAMETER;
309 if (ntlmssp_command != ntlmssp_state->expected_state) {
310 DEBUG(1, ("got NTLMSSP command %u, expected %u\n", ntlmssp_command, ntlmssp_state->expected_state));
311 return NT_STATUS_INVALID_PARAMETER;
314 for (i=0; ntlmssp_callbacks[i].fn; i++) {
315 if (ntlmssp_callbacks[i].role == ntlmssp_state->role
316 && ntlmssp_callbacks[i].ntlmssp_command == ntlmssp_command) {
317 return ntlmssp_callbacks[i].fn(ntlmssp_state, input, out);
321 DEBUG(1, ("failed to find NTLMSSP callback for NTLMSSP mode %u, command %u\n",
322 ntlmssp_state->role, ntlmssp_command));
324 return NT_STATUS_INVALID_PARAMETER;
328 * End an NTLMSSP state machine
330 * @param ntlmssp_state NTLMSSP State, free()ed by this function
333 void ntlmssp_end(struct ntlmssp_state **ntlmssp_state)
335 data_blob_free(&(*ntlmssp_state)->chal);
336 data_blob_free(&(*ntlmssp_state)->lm_resp);
337 data_blob_free(&(*ntlmssp_state)->nt_resp);
338 TALLOC_FREE(*ntlmssp_state);
340 *ntlmssp_state = NULL;
345 * Determine correct target name flags for reply, given server role
346 * and negotiated flags
348 * @param ntlmssp_state NTLMSSP State
349 * @param neg_flags The flags from the packet
350 * @param chal_flags The flags to be set in the reply packet
351 * @return The 'target name' string.
354 static const char *ntlmssp_target_name(struct ntlmssp_state *ntlmssp_state,
355 uint32_t neg_flags, uint32_t *chal_flags)
357 if (neg_flags & NTLMSSP_REQUEST_TARGET) {
358 *chal_flags |= NTLMSSP_NEGOTIATE_TARGET_INFO;
359 *chal_flags |= NTLMSSP_REQUEST_TARGET;
360 if (ntlmssp_state->server.is_standalone) {
361 *chal_flags |= NTLMSSP_TARGET_TYPE_SERVER;
362 return ntlmssp_state->server.netbios_name;
364 *chal_flags |= NTLMSSP_TARGET_TYPE_DOMAIN;
365 return ntlmssp_state->server.netbios_domain;
372 static void ntlmssp_handle_neg_flags(struct ntlmssp_state *ntlmssp_state,
373 uint32_t neg_flags, bool allow_lm) {
374 if (neg_flags & NTLMSSP_NEGOTIATE_UNICODE) {
375 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
376 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_OEM;
377 ntlmssp_state->unicode = True;
379 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_UNICODE;
380 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
381 ntlmssp_state->unicode = False;
384 if ((neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) && allow_lm) {
385 /* other end forcing us to use LM */
386 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_LM_KEY;
387 ntlmssp_state->use_ntlmv2 = False;
389 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
392 if (!(neg_flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
393 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
396 if (!(neg_flags & NTLMSSP_NEGOTIATE_NTLM2)) {
397 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
400 if (!(neg_flags & NTLMSSP_NEGOTIATE_128)) {
401 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_128;
404 if (!(neg_flags & NTLMSSP_NEGOTIATE_56)) {
405 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_56;
408 if (!(neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
409 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_KEY_EXCH;
412 if (!(neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
413 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SIGN;
416 if (!(neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
417 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SEAL;
420 /* Woop Woop - unknown flag for Windows compatibility...
421 What does this really do ? JRA. */
422 if (!(neg_flags & NTLMSSP_NEGOTIATE_VERSION)) {
423 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_VERSION;
426 if ((neg_flags & NTLMSSP_REQUEST_TARGET)) {
427 ntlmssp_state->neg_flags |= NTLMSSP_REQUEST_TARGET;
432 * Next state function for the Negotiate packet
434 * @param ntlmssp_state NTLMSSP State
435 * @param request The request, as a DATA_BLOB
436 * @param request The reply, as an allocated DATA_BLOB, caller to free.
437 * @return Errors or MORE_PROCESSING_REQUIRED if a reply is sent.
440 static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state,
441 const DATA_BLOB request, DATA_BLOB *reply)
443 DATA_BLOB struct_blob;
444 uint32_t neg_flags = 0;
445 uint32_t ntlmssp_command, chal_flags;
447 const char *target_name;
448 struct NEGOTIATE_MESSAGE negotiate;
449 struct CHALLENGE_MESSAGE challenge;
452 /* parse the NTLMSSP packet */
454 file_save("ntlmssp_negotiate.dat", request.data, request.length);
457 if (request.length) {
458 if ((request.length < 16) || !msrpc_parse(ntlmssp_state, &request, "Cdd",
462 DEBUG(1, ("ntlmssp_server_negotiate: failed to parse NTLMSSP Negotiate of length %u\n",
463 (unsigned int)request.length));
464 dump_data(2, request.data, request.length);
465 return NT_STATUS_INVALID_PARAMETER;
467 debug_ntlmssp_flags(neg_flags);
469 if (DEBUGLEVEL >= 10) {
470 if (NT_STATUS_IS_OK(ntlmssp_pull_NEGOTIATE_MESSAGE(&request,
474 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE, &negotiate);
479 ntlmssp_handle_neg_flags(ntlmssp_state, neg_flags, lp_lanman_auth());
481 /* Ask our caller what challenge they would like in the packet */
482 status = ntlmssp_state->get_challenge(ntlmssp_state, cryptkey);
483 if (!NT_STATUS_IS_OK(status)) {
487 /* Check if we may set the challenge */
488 if (!ntlmssp_state->may_set_challenge(ntlmssp_state)) {
489 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
492 /* The flags we send back are not just the negotiated flags,
493 * they are also 'what is in this packet'. Therfore, we
494 * operate on 'chal_flags' from here on
497 chal_flags = ntlmssp_state->neg_flags;
499 /* get the right name to fill in as 'target' */
500 target_name = ntlmssp_target_name(ntlmssp_state,
501 neg_flags, &chal_flags);
502 if (target_name == NULL)
503 return NT_STATUS_INVALID_PARAMETER;
505 ntlmssp_state->chal = data_blob_talloc(ntlmssp_state, cryptkey, 8);
506 ntlmssp_state->internal_chal = data_blob_talloc(ntlmssp_state,
509 /* This creates the 'blob' of names that appears at the end of the packet */
510 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO)
512 msrpc_gen(ntlmssp_state, &struct_blob, "aaaaa",
513 MsvAvNbDomainName, target_name,
514 MsvAvNbComputerName, ntlmssp_state->server.netbios_name,
515 MsvAvDnsDomainName, ntlmssp_state->server.dns_domain,
516 MsvAvDnsComputerName, ntlmssp_state->server.dns_name,
519 struct_blob = data_blob_null;
523 /* Marshal the packet in the right format, be it unicode or ASCII */
524 const char *gen_string;
525 /* "What Windows returns" as a version number. */
526 const char vers[] = { 0x6, 0x1, 0xb0, 0x1d, 0, 0, 0, 0xf};
528 if (chal_flags & NTLMSSP_NEGOTIATE_VERSION) {
529 DATA_BLOB version_blob = data_blob_talloc(ntlmssp_state, vers, 8);
531 if (ntlmssp_state->unicode) {
532 gen_string = "CdUdbddBb";
534 gen_string = "CdAdbddBb";
537 msrpc_gen(ntlmssp_state, reply, gen_string,
544 struct_blob.data, struct_blob.length,
545 version_blob.data, version_blob.length);
546 data_blob_free(&version_blob);
548 if (ntlmssp_state->unicode) {
549 gen_string = "CdUdbddB";
551 gen_string = "CdAdbddB";
554 msrpc_gen(ntlmssp_state, reply, gen_string,
561 struct_blob.data, struct_blob.length);
564 if (DEBUGLEVEL >= 10) {
565 if (NT_STATUS_IS_OK(ntlmssp_pull_CHALLENGE_MESSAGE(reply,
569 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE, &challenge);
574 data_blob_free(&struct_blob);
576 ntlmssp_state->expected_state = NTLMSSP_AUTH;
578 return NT_STATUS_MORE_PROCESSING_REQUIRED;
582 * Next state function for the Authenticate packet
584 * @param ntlmssp_state NTLMSSP State
585 * @param request The request, as a DATA_BLOB
586 * @param request The reply, as an allocated DATA_BLOB, caller to free.
587 * @return Errors or NT_STATUS_OK.
590 static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state,
591 const DATA_BLOB request, DATA_BLOB *reply)
593 DATA_BLOB encrypted_session_key = data_blob_null;
594 DATA_BLOB user_session_key = data_blob_null;
595 DATA_BLOB lm_session_key = data_blob_null;
596 DATA_BLOB session_key = data_blob_null;
597 uint32_t ntlmssp_command, auth_flags;
598 NTSTATUS nt_status = NT_STATUS_OK;
599 struct AUTHENTICATE_MESSAGE authenticate;
602 bool doing_ntlm2 = False;
604 uint8_t session_nonce[16];
605 uint8_t session_nonce_hash[16];
607 const char *parse_string;
609 /* parse the NTLMSSP packet */
610 *reply = data_blob_null;
613 file_save("ntlmssp_auth.dat", request.data, request.length);
616 if (ntlmssp_state->unicode) {
617 parse_string = "CdBBUUUBd";
619 parse_string = "CdBBAAABd";
622 data_blob_free(&ntlmssp_state->lm_resp);
623 data_blob_free(&ntlmssp_state->nt_resp);
625 ntlmssp_state->user = NULL;
626 ntlmssp_state->domain = NULL;
628 /* now the NTLMSSP encoded auth hashes */
629 if (!msrpc_parse(ntlmssp_state, &request, parse_string,
632 &ntlmssp_state->lm_resp,
633 &ntlmssp_state->nt_resp,
634 &ntlmssp_state->domain,
635 &ntlmssp_state->user,
636 &ntlmssp_state->client.netbios_name,
637 &encrypted_session_key,
641 /* Try again with a shorter string (Win9X truncates this packet) */
642 if (ntlmssp_state->unicode) {
643 parse_string = "CdBBUUU";
645 parse_string = "CdBBAAA";
648 /* now the NTLMSSP encoded auth hashes */
649 if (!msrpc_parse(ntlmssp_state, &request, parse_string,
652 &ntlmssp_state->lm_resp,
653 &ntlmssp_state->nt_resp,
654 &ntlmssp_state->domain,
655 &ntlmssp_state->user,
656 &ntlmssp_state->client.netbios_name)) {
657 DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP (tried both formats):\n"));
658 dump_data(2, request.data, request.length);
660 return NT_STATUS_INVALID_PARAMETER;
665 ntlmssp_handle_neg_flags(ntlmssp_state, auth_flags, lp_lanman_auth());
667 if (DEBUGLEVEL >= 10) {
668 if (NT_STATUS_IS_OK(ntlmssp_pull_AUTHENTICATE_MESSAGE(&request,
672 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE, &authenticate);
676 DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
677 ntlmssp_state->user, ntlmssp_state->domain,
678 ntlmssp_state->client.netbios_name,
679 (unsigned long)ntlmssp_state->lm_resp.length,
680 (unsigned long)ntlmssp_state->nt_resp.length));
683 file_save("nthash1.dat", &ntlmssp_state->nt_resp.data, &ntlmssp_state->nt_resp.length);
684 file_save("lmhash1.dat", &ntlmssp_state->lm_resp.data, &ntlmssp_state->lm_resp.length);
687 /* NTLM2 uses a 'challenge' that is made of up both the server challenge, and a
690 However, the NTLM2 flag may still be set for the real NTLMv2 logins, be careful.
692 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
693 if (ntlmssp_state->nt_resp.length == 24 && ntlmssp_state->lm_resp.length == 24) {
694 struct MD5Context md5_session_nonce_ctx;
695 SMB_ASSERT(ntlmssp_state->internal_chal.data && ntlmssp_state->internal_chal.length == 8);
699 memcpy(session_nonce, ntlmssp_state->internal_chal.data, 8);
700 memcpy(&session_nonce[8], ntlmssp_state->lm_resp.data, 8);
702 MD5Init(&md5_session_nonce_ctx);
703 MD5Update(&md5_session_nonce_ctx, session_nonce, 16);
704 MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
706 ntlmssp_state->chal = data_blob_talloc(
707 ntlmssp_state, session_nonce_hash, 8);
709 /* LM response is no longer useful */
710 data_blob_free(&ntlmssp_state->lm_resp);
712 /* We changed the effective challenge - set it */
713 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_state->set_challenge(ntlmssp_state, &ntlmssp_state->chal))) {
714 data_blob_free(&encrypted_session_key);
718 /* LM Key is incompatible. */
719 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
724 * Note we don't check here for NTLMv2 auth settings. If NTLMv2 auth
725 * is required (by "ntlm auth = no" and "lm auth = no" being set in the
726 * smb.conf file) and no NTLMv2 response was sent then the password check
727 * will fail here. JRA.
730 /* Finally, actually ask if the password is OK */
732 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_state->check_password(ntlmssp_state,
733 &user_session_key, &lm_session_key))) {
734 data_blob_free(&encrypted_session_key);
738 dump_data_pw("NT session key:\n", user_session_key.data, user_session_key.length);
739 dump_data_pw("LM first-8:\n", lm_session_key.data, lm_session_key.length);
741 /* Handle the different session key derivation for NTLM2 */
743 if (user_session_key.data && user_session_key.length == 16) {
744 session_key = data_blob_talloc(ntlmssp_state,
746 hmac_md5(user_session_key.data, session_nonce,
747 sizeof(session_nonce), session_key.data);
748 DEBUG(10,("ntlmssp_server_auth: Created NTLM2 session key.\n"));
749 dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
752 DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM2 session key.\n"));
753 session_key = data_blob_null;
755 } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
756 if (lm_session_key.data && lm_session_key.length >= 8) {
757 if (ntlmssp_state->lm_resp.data && ntlmssp_state->lm_resp.length == 24) {
758 session_key = data_blob_talloc(ntlmssp_state,
760 if (session_key.data == NULL) {
761 return NT_STATUS_NO_MEMORY;
763 SMBsesskeygen_lm_sess_key(lm_session_key.data, ntlmssp_state->lm_resp.data,
765 DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
767 static const uint8_t zeros[24] = {0, };
768 session_key = data_blob_talloc(
769 ntlmssp_state, NULL, 16);
770 if (session_key.data == NULL) {
771 return NT_STATUS_NO_MEMORY;
773 SMBsesskeygen_lm_sess_key(
774 lm_session_key.data, zeros,
777 dump_data_pw("LM session key:\n", session_key.data,
780 DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM session key.\n"));
781 session_key = data_blob_null;
783 } else if (user_session_key.data) {
784 session_key = user_session_key;
785 DEBUG(10,("ntlmssp_server_auth: Using unmodified nt session key.\n"));
786 dump_data_pw("unmodified session key:\n", session_key.data, session_key.length);
787 } else if (lm_session_key.data) {
788 session_key = lm_session_key;
789 DEBUG(10,("ntlmssp_server_auth: Using unmodified lm session key.\n"));
790 dump_data_pw("unmodified session key:\n", session_key.data, session_key.length);
792 DEBUG(10,("ntlmssp_server_auth: Failed to create unmodified session key.\n"));
793 session_key = data_blob_null;
796 /* With KEY_EXCH, the client supplies the proposed session key,
797 but encrypts it with the long-term key */
798 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
799 if (!encrypted_session_key.data || encrypted_session_key.length != 16) {
800 data_blob_free(&encrypted_session_key);
801 DEBUG(1, ("Client-supplied KEY_EXCH session key was of invalid length (%u)!\n",
802 (unsigned int)encrypted_session_key.length));
803 return NT_STATUS_INVALID_PARAMETER;
804 } else if (!session_key.data || session_key.length != 16) {
805 DEBUG(5, ("server session key is invalid (len == %u), cannot do KEY_EXCH!\n",
806 (unsigned int)session_key.length));
807 ntlmssp_state->session_key = session_key;
809 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
810 arcfour_crypt_blob(encrypted_session_key.data,
811 encrypted_session_key.length,
813 ntlmssp_state->session_key = data_blob_talloc(
814 ntlmssp_state, encrypted_session_key.data,
815 encrypted_session_key.length);
816 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data,
817 encrypted_session_key.length);
820 ntlmssp_state->session_key = session_key;
823 if (!NT_STATUS_IS_OK(nt_status)) {
824 ntlmssp_state->session_key = data_blob_null;
825 } else if (ntlmssp_state->session_key.length) {
826 nt_status = ntlmssp_sign_init(ntlmssp_state);
829 data_blob_free(&encrypted_session_key);
831 /* Only one authentication allowed per server state. */
832 ntlmssp_state->expected_state = NTLMSSP_DONE;
838 * Create an NTLMSSP state machine
840 * @param ntlmssp_state NTLMSSP State, allocated by this function
843 NTSTATUS ntlmssp_server_start(TALLOC_CTX *mem_ctx,
845 const char *netbios_name,
846 const char *netbios_domain,
847 const char *dns_name,
848 const char *dns_domain,
849 struct ntlmssp_state **_ntlmssp_state)
851 struct ntlmssp_state *ntlmssp_state;
857 if (!netbios_domain) {
869 ntlmssp_state = talloc_zero(mem_ctx, struct ntlmssp_state);
870 if (!ntlmssp_state) {
871 return NT_STATUS_NO_MEMORY;
874 ntlmssp_state->role = NTLMSSP_SERVER;
876 ntlmssp_state->get_challenge = get_challenge;
877 ntlmssp_state->set_challenge = set_challenge;
878 ntlmssp_state->may_set_challenge = may_set_challenge;
880 ntlmssp_state->server.is_standalone = is_standalone;
882 ntlmssp_state->expected_state = NTLMSSP_NEGOTIATE;
884 ntlmssp_state->neg_flags =
885 NTLMSSP_NEGOTIATE_128 |
886 NTLMSSP_NEGOTIATE_56 |
887 NTLMSSP_NEGOTIATE_VERSION |
888 NTLMSSP_NEGOTIATE_ALWAYS_SIGN |
889 NTLMSSP_NEGOTIATE_NTLM |
890 NTLMSSP_NEGOTIATE_NTLM2 |
891 NTLMSSP_NEGOTIATE_KEY_EXCH |
892 NTLMSSP_NEGOTIATE_SIGN |
893 NTLMSSP_NEGOTIATE_SEAL;
895 ntlmssp_state->server.netbios_name = talloc_strdup(ntlmssp_state, netbios_name);
896 if (!ntlmssp_state->server.netbios_name) {
897 talloc_free(ntlmssp_state);
898 return NT_STATUS_NO_MEMORY;
900 ntlmssp_state->server.netbios_domain = talloc_strdup(ntlmssp_state, netbios_domain);
901 if (!ntlmssp_state->server.netbios_domain) {
902 talloc_free(ntlmssp_state);
903 return NT_STATUS_NO_MEMORY;
905 ntlmssp_state->server.dns_name = talloc_strdup(ntlmssp_state, dns_name);
906 if (!ntlmssp_state->server.dns_name) {
907 talloc_free(ntlmssp_state);
908 return NT_STATUS_NO_MEMORY;
910 ntlmssp_state->server.dns_domain = talloc_strdup(ntlmssp_state, dns_domain);
911 if (!ntlmssp_state->server.dns_domain) {
912 talloc_free(ntlmssp_state);
913 return NT_STATUS_NO_MEMORY;
916 *_ntlmssp_state = ntlmssp_state;
920 /*********************************************************************
922 *********************************************************************/
925 * Next state function for the Initial packet
927 * @param ntlmssp_state NTLMSSP State
928 * @param request The request, as a DATA_BLOB. reply.data must be NULL
929 * @param request The reply, as an allocated DATA_BLOB, caller to free.
930 * @return Errors or NT_STATUS_OK.
933 static NTSTATUS ntlmssp_client_initial(struct ntlmssp_state *ntlmssp_state,
934 DATA_BLOB reply, DATA_BLOB *next_request)
936 struct NEGOTIATE_MESSAGE negotiate;
938 if (ntlmssp_state->unicode) {
939 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
941 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
944 if (ntlmssp_state->use_ntlmv2) {
945 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
948 /* generate the ntlmssp negotiate packet */
949 msrpc_gen(ntlmssp_state, next_request, "CddAA",
952 ntlmssp_state->neg_flags,
953 ntlmssp_state->client.netbios_domain,
954 ntlmssp_state->client.netbios_name);
956 if (DEBUGLEVEL >= 10) {
957 if (NT_STATUS_IS_OK(ntlmssp_pull_NEGOTIATE_MESSAGE(next_request,
961 NDR_PRINT_DEBUG(NEGOTIATE_MESSAGE, &negotiate);
965 ntlmssp_state->expected_state = NTLMSSP_CHALLENGE;
967 return NT_STATUS_MORE_PROCESSING_REQUIRED;
971 * Next state function for the Challenge Packet. Generate an auth packet.
973 * @param ntlmssp_state NTLMSSP State
974 * @param request The request, as a DATA_BLOB. reply.data must be NULL
975 * @param request The reply, as an allocated DATA_BLOB, caller to free.
976 * @return Errors or NT_STATUS_OK.
979 static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state,
980 const DATA_BLOB reply, DATA_BLOB *next_request)
982 uint32_t chal_flags, ntlmssp_command, unkn1, unkn2;
983 DATA_BLOB server_domain_blob;
984 DATA_BLOB challenge_blob;
985 DATA_BLOB struct_blob = data_blob_null;
987 const char *chal_parse_string;
988 const char *auth_gen_string;
989 DATA_BLOB lm_response = data_blob_null;
990 DATA_BLOB nt_response = data_blob_null;
991 DATA_BLOB session_key = data_blob_null;
992 DATA_BLOB encrypted_session_key = data_blob_null;
993 NTSTATUS nt_status = NT_STATUS_OK;
994 struct CHALLENGE_MESSAGE challenge;
995 struct AUTHENTICATE_MESSAGE authenticate;
997 if (ntlmssp_state->use_ccache) {
998 struct wbcCredentialCacheParams params;
999 struct wbcCredentialCacheInfo *info = NULL;
1000 struct wbcAuthErrorInfo *error = NULL;
1001 struct wbcNamedBlob auth_blob;
1002 struct wbcBlob *wbc_next = NULL;
1003 struct wbcBlob *wbc_session_key = NULL;
1007 params.account_name = ntlmssp_state->user;
1008 params.domain_name = ntlmssp_state->domain;
1009 params.level = WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP;
1011 auth_blob.name = "challenge_blob";
1012 auth_blob.flags = 0;
1013 auth_blob.blob.data = reply.data;
1014 auth_blob.blob.length = reply.length;
1015 params.num_blobs = 1;
1016 params.blobs = &auth_blob;
1018 wbc_status = wbcCredentialCache(¶ms, &info, &error);
1019 if (error != NULL) {
1020 wbcFreeMemory(error);
1022 if (!WBC_ERROR_IS_OK(wbc_status)) {
1026 for (i=0; i<info->num_blobs; i++) {
1027 if (strequal(info->blobs[i].name, "auth_blob")) {
1028 wbc_next = &info->blobs[i].blob;
1030 if (strequal(info->blobs[i].name, "session_key")) {
1031 wbc_session_key = &info->blobs[i].blob;
1034 if ((wbc_next == NULL) || (wbc_session_key == NULL)) {
1035 wbcFreeMemory(info);
1039 *next_request = data_blob(wbc_next->data, wbc_next->length);
1040 ntlmssp_state->session_key = data_blob(
1041 wbc_session_key->data, wbc_session_key->length);
1043 wbcFreeMemory(info);
1049 if (!msrpc_parse(ntlmssp_state, &reply, "CdBd",
1052 &server_domain_blob,
1054 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
1055 dump_data(2, reply.data, reply.length);
1057 return NT_STATUS_INVALID_PARAMETER;
1060 if (DEBUGLEVEL >= 10) {
1061 if (NT_STATUS_IS_OK(ntlmssp_pull_CHALLENGE_MESSAGE(&reply,
1065 NDR_PRINT_DEBUG(CHALLENGE_MESSAGE, &challenge);
1069 data_blob_free(&server_domain_blob);
1071 DEBUG(3, ("Got challenge flags:\n"));
1072 debug_ntlmssp_flags(chal_flags);
1074 ntlmssp_handle_neg_flags(ntlmssp_state, chal_flags, lp_client_lanman_auth());
1076 if (ntlmssp_state->unicode) {
1077 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
1078 chal_parse_string = "CdUdbddB";
1080 chal_parse_string = "CdUdbdd";
1082 auth_gen_string = "CdBBUUUBd";
1084 if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
1085 chal_parse_string = "CdAdbddB";
1087 chal_parse_string = "CdAdbdd";
1090 auth_gen_string = "CdBBAAABd";
1093 DEBUG(3, ("NTLMSSP: Set final flags:\n"));
1094 debug_ntlmssp_flags(ntlmssp_state->neg_flags);
1096 if (!msrpc_parse(ntlmssp_state, &reply, chal_parse_string,
1104 DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
1105 dump_data(2, reply.data, reply.length);
1106 return NT_STATUS_INVALID_PARAMETER;
1109 if (chal_flags & NTLMSSP_TARGET_TYPE_SERVER) {
1110 ntlmssp_state->server.is_standalone = true;
1112 ntlmssp_state->server.is_standalone = false;
1114 /* TODO: parse struct_blob and fill in the rest */
1115 ntlmssp_state->server.netbios_name = "";
1116 ntlmssp_state->server.netbios_domain = server_domain;
1117 ntlmssp_state->server.dns_name = "";
1118 ntlmssp_state->server.dns_domain = "";
1120 if (challenge_blob.length != 8) {
1121 data_blob_free(&struct_blob);
1122 return NT_STATUS_INVALID_PARAMETER;
1125 if (!ntlmssp_state->nt_hash || !ntlmssp_state->lm_hash) {
1126 static const uint8_t zeros[16] = {0, };
1127 /* do nothing - blobs are zero length */
1129 /* session key is all zeros */
1130 session_key = data_blob_talloc(ntlmssp_state, zeros, 16);
1132 /* not doing NLTM2 without a password */
1133 ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
1134 } else if (ntlmssp_state->use_ntlmv2) {
1135 if (!struct_blob.length) {
1136 /* be lazy, match win2k - we can't do NTLMv2 without it */
1137 DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
1138 return NT_STATUS_INVALID_PARAMETER;
1141 /* TODO: if the remote server is standalone, then we should replace 'domain'
1142 with the server name as supplied above */
1144 if (!SMBNTLMv2encrypt_hash(ntlmssp_state,
1145 ntlmssp_state->user,
1146 ntlmssp_state->domain,
1147 ntlmssp_state->nt_hash, &challenge_blob,
1149 &lm_response, &nt_response, NULL,
1151 data_blob_free(&challenge_blob);
1152 data_blob_free(&struct_blob);
1153 return NT_STATUS_NO_MEMORY;
1155 } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
1156 struct MD5Context md5_session_nonce_ctx;
1157 uint8_t session_nonce[16];
1158 uint8_t session_nonce_hash[16];
1159 uint8_t user_session_key[16];
1161 lm_response = data_blob_talloc(ntlmssp_state, NULL, 24);
1162 generate_random_buffer(lm_response.data, 8);
1163 memset(lm_response.data+8, 0, 16);
1165 memcpy(session_nonce, challenge_blob.data, 8);
1166 memcpy(&session_nonce[8], lm_response.data, 8);
1168 MD5Init(&md5_session_nonce_ctx);
1169 MD5Update(&md5_session_nonce_ctx, challenge_blob.data, 8);
1170 MD5Update(&md5_session_nonce_ctx, lm_response.data, 8);
1171 MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
1173 DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
1174 DEBUG(5, ("challenge is: \n"));
1175 dump_data(5, session_nonce_hash, 8);
1177 nt_response = data_blob_talloc(ntlmssp_state, NULL, 24);
1178 SMBNTencrypt_hash(ntlmssp_state->nt_hash,
1182 session_key = data_blob_talloc(ntlmssp_state, NULL, 16);
1184 SMBsesskeygen_ntv1(ntlmssp_state->nt_hash, user_session_key);
1185 hmac_md5(user_session_key, session_nonce, sizeof(session_nonce), session_key.data);
1186 dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
1188 /* lanman auth is insecure, it may be disabled */
1189 if (lp_client_lanman_auth()) {
1190 lm_response = data_blob_talloc(ntlmssp_state,
1192 SMBencrypt_hash(ntlmssp_state->lm_hash,challenge_blob.data,
1196 nt_response = data_blob_talloc(ntlmssp_state, NULL, 24);
1197 SMBNTencrypt_hash(ntlmssp_state->nt_hash,challenge_blob.data,
1200 session_key = data_blob_talloc(ntlmssp_state, NULL, 16);
1201 if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
1202 && lp_client_lanman_auth()) {
1203 SMBsesskeygen_lm_sess_key(ntlmssp_state->lm_hash, lm_response.data,
1205 dump_data_pw("LM session key\n", session_key.data, session_key.length);
1207 SMBsesskeygen_ntv1(ntlmssp_state->nt_hash, session_key.data);
1208 dump_data_pw("NT session key:\n", session_key.data, session_key.length);
1211 data_blob_free(&struct_blob);
1213 /* Key exchange encryptes a new client-generated session key with
1214 the password-derived key */
1215 if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
1216 /* Make up a new session key */
1217 uint8_t client_session_key[16];
1218 generate_random_buffer(client_session_key, sizeof(client_session_key));
1220 /* Encrypt the new session key with the old one */
1221 encrypted_session_key = data_blob(client_session_key, sizeof(client_session_key));
1222 dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length);
1223 arcfour_crypt_blob(encrypted_session_key.data, encrypted_session_key.length, &session_key);
1224 dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
1226 /* Mark the new session key as the 'real' session key */
1227 data_blob_free(&session_key);
1228 session_key = data_blob_talloc(ntlmssp_state,
1230 sizeof(client_session_key));
1233 /* this generates the actual auth packet */
1234 if (!msrpc_gen(ntlmssp_state, next_request, auth_gen_string,
1237 lm_response.data, lm_response.length,
1238 nt_response.data, nt_response.length,
1239 ntlmssp_state->domain,
1240 ntlmssp_state->user,
1241 ntlmssp_state->client.netbios_name,
1242 encrypted_session_key.data, encrypted_session_key.length,
1243 ntlmssp_state->neg_flags)) {
1245 return NT_STATUS_NO_MEMORY;
1248 if (DEBUGLEVEL >= 10) {
1249 if (NT_STATUS_IS_OK(ntlmssp_pull_AUTHENTICATE_MESSAGE(next_request,
1253 NDR_PRINT_DEBUG(AUTHENTICATE_MESSAGE, &authenticate);
1257 data_blob_free(&encrypted_session_key);
1259 data_blob_free(&ntlmssp_state->chal);
1261 ntlmssp_state->session_key = session_key;
1263 ntlmssp_state->chal = challenge_blob;
1264 ntlmssp_state->lm_resp = lm_response;
1265 ntlmssp_state->nt_resp = nt_response;
1269 ntlmssp_state->expected_state = NTLMSSP_DONE;
1271 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_sign_init(ntlmssp_state))) {
1272 DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status)));
1278 NTSTATUS ntlmssp_client_start(TALLOC_CTX *mem_ctx,
1279 const char *netbios_name,
1280 const char *netbios_domain,
1282 struct ntlmssp_state **_ntlmssp_state)
1284 struct ntlmssp_state *ntlmssp_state;
1286 if (!netbios_name) {
1290 if (!netbios_domain) {
1291 netbios_domain = "";
1294 ntlmssp_state = talloc_zero(mem_ctx, struct ntlmssp_state);
1295 if (!ntlmssp_state) {
1296 return NT_STATUS_NO_MEMORY;
1299 ntlmssp_state->role = NTLMSSP_CLIENT;
1301 ntlmssp_state->unicode = True;
1303 ntlmssp_state->use_ntlmv2 = use_ntlmv2;
1305 ntlmssp_state->expected_state = NTLMSSP_INITIAL;
1307 ntlmssp_state->neg_flags =
1308 NTLMSSP_NEGOTIATE_128 |
1309 NTLMSSP_NEGOTIATE_ALWAYS_SIGN |
1310 NTLMSSP_NEGOTIATE_NTLM |
1311 NTLMSSP_NEGOTIATE_NTLM2 |
1312 NTLMSSP_NEGOTIATE_KEY_EXCH |
1313 NTLMSSP_REQUEST_TARGET;
1315 ntlmssp_state->client.netbios_name = talloc_strdup(ntlmssp_state, netbios_name);
1316 if (!ntlmssp_state->client.netbios_name) {
1317 talloc_free(ntlmssp_state);
1318 return NT_STATUS_NO_MEMORY;
1320 ntlmssp_state->client.netbios_domain = talloc_strdup(ntlmssp_state, netbios_domain);
1321 if (!ntlmssp_state->client.netbios_domain) {
1322 talloc_free(ntlmssp_state);
1323 return NT_STATUS_NO_MEMORY;
1326 *_ntlmssp_state = ntlmssp_state;
1327 return NT_STATUS_OK;