2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett 2001-2002
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 extern struct auth_context *negprot_global_auth_context;
23 extern bool global_encrypted_passwords_negotiated;
26 #define DBGC_CLASS DBGC_AUTH
28 /****************************************************************************
29 COMPATIBILITY INTERFACES:
30 ***************************************************************************/
32 /****************************************************************************
33 check if a username/password is OK assuming the password is in plaintext
34 return True if the password is correct, False otherwise
35 ****************************************************************************/
37 NTSTATUS check_plaintext_password(const char *smb_name,
38 DATA_BLOB plaintext_blob,
39 struct auth_serversupplied_info **server_info)
41 struct auth_context *plaintext_auth_context = NULL;
42 struct auth_usersupplied_info *user_info = NULL;
45 if (!NT_STATUS_IS_OK(nt_status = make_auth_context_subsystem(&plaintext_auth_context))) {
49 plaintext_auth_context->get_ntlm_challenge(plaintext_auth_context,
52 if (!make_user_info_for_reply(&user_info,
53 smb_name, lp_workgroup(), chal,
55 return NT_STATUS_NO_MEMORY;
58 nt_status = plaintext_auth_context->check_ntlm_password(plaintext_auth_context,
59 user_info, server_info);
61 TALLOC_FREE(plaintext_auth_context);
62 free_user_info(&user_info);
66 static NTSTATUS pass_check_smb(struct auth_context *actx,
74 struct auth_serversupplied_info *server_info = NULL;
75 struct auth_usersupplied_info *user_info = NULL;
77 return NT_STATUS_INTERNAL_ERROR;
79 make_user_info_for_reply_enc(&user_info, smb_name,
83 nt_status = actx->check_ntlm_password(actx, user_info, &server_info);
84 free_user_info(&user_info);
85 TALLOC_FREE(server_info);
89 /****************************************************************************
90 check if a username/password pair is ok via the auth subsystem.
91 return True if the password is correct, False otherwise
92 ****************************************************************************/
94 bool password_ok(struct auth_context *actx, bool global_encrypted,
95 const char *session_workgroup,
96 const char *smb_name, DATA_BLOB password_blob)
99 DATA_BLOB null_password = data_blob_null;
100 bool encrypted = (global_encrypted && (password_blob.length == 24 || password_blob.length > 46));
104 * The password could be either NTLM or plain LM. Try NTLM first,
105 * but fall-through as required.
106 * Vista sends NTLMv2 here - we need to try the client given workgroup.
108 if (session_workgroup) {
109 if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, session_workgroup, null_password, password_blob))) {
112 if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, session_workgroup, password_blob, null_password))) {
117 if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, lp_workgroup(), null_password, password_blob))) {
121 if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, lp_workgroup(), password_blob, null_password))) {
125 struct auth_serversupplied_info *server_info = NULL;
126 NTSTATUS nt_status = check_plaintext_password(smb_name, password_blob, &server_info);
127 if (NT_STATUS_IS_OK(nt_status)) {
128 TALLOC_FREE(server_info);