xref: /illumos-gate/usr/src/lib/libsmbfs/smb/ntlm.c (revision 22028508fd28d36ff74dc02c5774a8ba1f0db045)
1 /*
2  * Copyright (c) 2000-2001, Boris Popov
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *    This product includes software developed by Boris Popov.
16  * 4. Neither the name of the author nor the names of any co-contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  * $Id: smb_crypt.c,v 1.13 2005/01/26 23:50:50 lindak Exp $
33  */
34 
35 /*
36  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
37  * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
38  */
39 
40 /*
41  * NTLM support functions
42  *
43  * Some code from the driver: smb_smb.c, smb_crypt.c
44  */
45 
46 #include <sys/errno.h>
47 #include <sys/types.h>
48 #include <sys/md4.h>
49 #include <sys/md5.h>
50 
51 #include <ctype.h>
52 #include <stdlib.h>
53 #include <strings.h>
54 
55 #include <netsmb/smb_lib.h>
56 
57 #include "private.h"
58 #include "charsets.h"
59 #include "smb_crypt.h"
60 #include "ntlm.h"
61 
62 
63 /*
64  * ntlm_compute_lm_hash
65  *
66  * Given a password, compute the LM hash.
67  * a.k.a. ResponseKeyLM in [MS-NLMP]
68  *
69  * Output:
70  *	hash: 16-byte "LanMan" (LM) hash (normally ctx->ct_lmhash)
71  * Inputs:
72  *	ucpw: User's password, upper-case UTF-8 string.
73  *
74  * Source: Implementing CIFS (Chris Hertel)
75  *
76  * P14 = UCPW padded to 14-bytes, or truncated (as needed)
77  * result = Encrypt(Key=P14, Data=MagicString)
78  */
79 int
80 ntlm_compute_lm_hash(uchar_t *hash, const char *pass)
81 {
82 	static const uchar_t M8[8] = "KGS!@#$%";
83 	uchar_t P14[14 + 1];
84 	int err;
85 	char *ucpw;
86 
87 	/* First, convert the p/w to upper case. */
88 	ucpw = utf8_str_toupper(pass);
89 	if (ucpw == NULL)
90 		return (ENOMEM);
91 
92 	/* Pad or truncate the upper-case P/W as needed. */
93 	bzero(P14, sizeof (P14));
94 	(void) strncpy((char *)P14, ucpw, 14);
95 
96 	/* Compute the hash. */
97 	err = smb_encrypt_DES(hash, NTLM_HASH_SZ,
98 	    P14, 14, M8, 8);
99 
100 	free(ucpw);
101 	return (err);
102 }
103 
104 /*
105  * ntlm_compute_nt_hash
106  *
107  * Given a password, compute the NT hash.
108  * a.k.a. the ResponseKeyNT in [MS-NLMP]
109  *
110  * Output:
111  *	hash: 16-byte "NT" hash (normally ctx->ct_nthash)
112  * Inputs:
113  *	upw: User's password, mixed-case UCS-2LE.
114  *	pwlen: Size (in bytes) of upw
115  */
116 int
117 ntlm_compute_nt_hash(uchar_t *hash, const char *pass)
118 {
119 	MD4_CTX ctx;
120 	uint16_t *unipw = NULL;
121 	int pwsz;
122 
123 	/* First, convert the password to unicode. */
124 	unipw = convert_utf8_to_leunicode(pass);
125 	if (unipw == NULL)
126 		return (ENOMEM);
127 	pwsz = unicode_strlen(unipw) << 1;
128 
129 	/* Compute the hash. */
130 	MD4Init(&ctx);
131 	MD4Update(&ctx, unipw, pwsz);
132 	MD4Final(hash, &ctx);
133 
134 	free(unipw);
135 	return (0);
136 }
137 
138 /*
139  * ntlm_v1_response
140  * a.k.a. DESL() in [MS-NLMP]
141  *
142  * Create an LM response from the given LM hash and challenge,
143  * or an NTLM repsonse from a given NTLM hash and challenge.
144  * Both response types are 24 bytes (NTLM_V1_RESP_SZ)
145  */
146 static int
147 ntlm_v1_response(uchar_t *resp,
148     const uchar_t *hash,
149     const uchar_t *chal, int clen)
150 {
151 	uchar_t S21[21];
152 	int err;
153 
154 	/*
155 	 * 14-byte LM Hash should be padded with 5 nul bytes to create
156 	 * a 21-byte string to be used in producing LM response
157 	 */
158 	bzero(&S21, sizeof (S21));
159 	bcopy(hash, S21, NTLM_HASH_SZ);
160 
161 	/* padded LM Hash -> LM Response */
162 	err = smb_encrypt_DES(resp, NTLM_V1_RESP_SZ,
163 	    S21, 21, chal, clen);
164 	return (err);
165 }
166 
167 /*
168  * Calculate an NTLMv1 session key (16 bytes).
169  */
170 static void
171 ntlm_v1_session_key(uchar_t *ssn_key, const uchar_t *nt_hash)
172 {
173 	MD4_CTX md4;
174 
175 	MD4Init(&md4);
176 	MD4Update(&md4, nt_hash, NTLM_HASH_SZ);
177 	MD4Final(ssn_key, &md4);
178 }
179 
180 /*
181  * Compute both the LM(v1) response and the NTLM(v1) response,
182  * and put them in the mbdata chains passed.  This allocates
183  * mbuf chains in the output args, which the caller frees.
184  */
185 int
186 ntlm_put_v1_responses(struct smb_ctx *ctx,
187 	struct mbdata *lm_mbp, struct mbdata *nt_mbp,
188 	uchar_t *ssn_key)
189 {
190 	uchar_t *lmresp, *ntresp;
191 	int err;
192 
193 	/* Get mbuf chain for the LM response. */
194 	if ((err = mb_init_sz(lm_mbp, NTLM_V1_RESP_SZ)) != 0)
195 		return (err);
196 
197 	/* Get mbuf chain for the NT response. */
198 	if ((err = mb_init_sz(nt_mbp, NTLM_V1_RESP_SZ)) != 0)
199 		return (err);
200 
201 	/*
202 	 * Compute the NTLM response, derived from
203 	 * the challenge and the NT hash (a.k.a ResponseKeyNT)
204 	 */
205 	err = mb_fit(nt_mbp, NTLM_V1_RESP_SZ, (char **)&ntresp);
206 	if (err)
207 		return (err);
208 	bzero(ntresp, NTLM_V1_RESP_SZ);
209 	err = ntlm_v1_response(ntresp, ctx->ct_nthash,
210 	    ctx->ct_srv_chal, NTLM_CHAL_SZ);
211 
212 	/*
213 	 * Compute the LM response, derived from
214 	 * the challenge and the ASCII password.
215 	 * Per. [MS-NLMP 3.3.1] if NoLmResponse,
216 	 * send the NT response for both NT+LM.
217 	 */
218 	err = mb_fit(lm_mbp, NTLM_V1_RESP_SZ, (char **)&lmresp);
219 	if (err)
220 		return (err);
221 	memcpy(lmresp, ntresp, NTLM_V1_RESP_SZ);
222 	if (ctx->ct_authflags & SMB_AT_LM1) {
223 		/* They asked to send the LM hash too. */
224 		err = ntlm_v1_response(lmresp, ctx->ct_lmhash,
225 		    ctx->ct_srv_chal, NTLM_CHAL_SZ);
226 		if (err)
227 			return (err);
228 	}
229 
230 	/*
231 	 * Compute the session key
232 	 */
233 	ntlm_v1_session_key(ssn_key, ctx->ct_nthash);
234 
235 	return (err);
236 }
237 
238 /*
239  * Compute both the LM(v1x) response and the NTLM(v1x) response,
240  * and put them in the mbdata chains passed.  "v1x" here refers to
241  * NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY used with NTLMSSP,
242  * also known by its shorter alias NTLMSSP_NEGOTIATE_NTLM2.
243  * [MS-NLMP 3.3.1]
244  *
245  * This allocates mbuf chains in the output args (caller frees).
246  */
247 int
248 ntlm_put_v1x_responses(struct smb_ctx *ctx,
249 	struct mbdata *lm_mbp, struct mbdata *nt_mbp,
250 	uchar_t *ssn_key)
251 {
252 	MD5_CTX context;
253 	uchar_t challenges[2 * NTLM_CHAL_SZ];
254 	uchar_t digest[NTLM_HASH_SZ];
255 	uchar_t *lmresp, *ntresp;
256 	int err;
257 
258 	/* Get mbuf chain for the LM response. */
259 	if ((err = mb_init_sz(lm_mbp, NTLM_V1_RESP_SZ)) != 0)
260 		return (err);
261 
262 	/* Get mbuf chain for the NT response. */
263 	if ((err = mb_init_sz(nt_mbp, NTLM_V1_RESP_SZ)) != 0)
264 		return (err);
265 
266 	/*
267 	 * challenges = ConcatenationOf(ServerChallenge, ClientChallenge)
268 	 */
269 	memcpy(challenges, ctx->ct_srv_chal, NTLM_CHAL_SZ);
270 	memcpy(challenges + NTLM_CHAL_SZ, ctx->ct_clnonce, NTLM_CHAL_SZ);
271 
272 	/*
273 	 * digest = MD5(challenges)
274 	 */
275 	MD5Init(&context);
276 	MD5Update(&context, challenges, sizeof (challenges));
277 	MD5Final(digest, &context);
278 
279 	/*
280 	 * Compute the NTLM response, derived from the
281 	 * NT hash (a.k.a ResponseKeyNT) and the first
282 	 * 8 bytes of the MD5 digest of the challenges.
283 	 */
284 	err = mb_fit(nt_mbp, NTLM_V1_RESP_SZ, (char **)&ntresp);
285 	if (err)
286 		return (err);
287 	bzero(ntresp, NTLM_V1_RESP_SZ);
288 	err = ntlm_v1_response(ntresp, ctx->ct_nthash,
289 	    digest, NTLM_CHAL_SZ);
290 
291 	/*
292 	 * With "Extended Session Security", the LM response
293 	 * is simply the client challenge (nonce) padded out.
294 	 */
295 	err = mb_fit(lm_mbp, NTLM_V1_RESP_SZ, (char **)&lmresp);
296 	if (err)
297 		return (err);
298 	bzero(lmresp, NTLM_V1_RESP_SZ);
299 	memcpy(lmresp, ctx->ct_clnonce, NTLM_CHAL_SZ);
300 
301 	/*
302 	 * Compute the session key
303 	 */
304 	ntlm_v1_session_key(ssn_key, ctx->ct_nthash);
305 
306 	return (err);
307 }
308 
309 /*
310  * A variation on HMAC-MD5 known as HMACT64 is used by Windows systems.
311  * The HMACT64() function is the same as the HMAC-MD5() except that
312  * it truncates the input key to 64 bytes rather than hashing it down
313  * to 16 bytes using the MD5() function.
314  *
315  * Output: digest (16-bytes)
316  */
317 static void
318 HMACT64(uchar_t *digest,
319     const uchar_t *key, size_t key_len,
320     const uchar_t *data, size_t data_len)
321 {
322 	MD5_CTX context;
323 	uchar_t k_ipad[64];	/* inner padding - key XORd with ipad */
324 	uchar_t k_opad[64];	/* outer padding - key XORd with opad */
325 	int i;
326 
327 	/* if key is longer than 64 bytes use only the first 64 bytes */
328 	if (key_len > 64)
329 		key_len = 64;
330 
331 	/*
332 	 * The HMAC-MD5 (and HMACT64) transform looks like:
333 	 *
334 	 * MD5(K XOR opad, MD5(K XOR ipad, data))
335 	 *
336 	 * where K is an n byte key
337 	 * ipad is the byte 0x36 repeated 64 times
338 	 * opad is the byte 0x5c repeated 64 times
339 	 * and data is the data being protected.
340 	 */
341 
342 	/* start out by storing key in pads */
343 	bzero(k_ipad, sizeof (k_ipad));
344 	bzero(k_opad, sizeof (k_opad));
345 	bcopy(key, k_ipad, key_len);
346 	bcopy(key, k_opad, key_len);
347 
348 	/* XOR key with ipad and opad values */
349 	for (i = 0; i < 64; i++) {
350 		k_ipad[i] ^= 0x36;
351 		k_opad[i] ^= 0x5c;
352 	}
353 
354 	/*
355 	 * perform inner MD5
356 	 */
357 	MD5Init(&context);			/* init context for 1st pass */
358 	MD5Update(&context, k_ipad, 64);	/* start with inner pad */
359 	MD5Update(&context, data, data_len);	/* then data of datagram */
360 	MD5Final(digest, &context);		/* finish up 1st pass */
361 
362 	/*
363 	 * perform outer MD5
364 	 */
365 	MD5Init(&context);			/* init context for 2nd pass */
366 	MD5Update(&context, k_opad, 64);	/* start with outer pad */
367 	MD5Update(&context, digest, 16);	/* then results of 1st hash */
368 	MD5Final(digest, &context);		/* finish up 2nd pass */
369 }
370 
371 
372 /*
373  * Compute an NTLMv2 hash given the NTLMv1 hash, the user name,
374  * and the destination (machine or domain name).
375  *
376  * Output:
377  *	v2hash: 16-byte NTLMv2 hash.
378  * Inputs:
379  *	v1hash: 16-byte NTLMv1 hash.
380  *	user: User name, UPPER-case UTF-8 string.
381  *	destination: Domain or server, MIXED-case UTF-8 string.
382  */
383 static int
384 ntlm_v2_hash(uchar_t *v2hash, const uchar_t *v1hash,
385     const char *user, const char *destination)
386 {
387 	int ulen, dlen;
388 	size_t ucs2len;
389 	uint16_t *ucs2data = NULL;
390 	char *utf8data = NULL;
391 	int err = ENOMEM;
392 
393 	/*
394 	 * v2hash = HMACT64(v1hash, 16, concat(upcase(user), dest))
395 	 * where "dest" is the domain or server name ("target name")
396 	 * Note: user name is converted to upper-case by the caller.
397 	 */
398 
399 	/* utf8data = concat(user, dest) */
400 	ulen = strlen(user);
401 	dlen = strlen(destination);
402 	utf8data = malloc(ulen + dlen + 1);
403 	if (utf8data == NULL)
404 		goto out;
405 	bcopy(user, utf8data, ulen);
406 	bcopy(destination, utf8data + ulen, dlen + 1);
407 
408 	/* Convert to UCS-2LE */
409 	ucs2data = convert_utf8_to_leunicode(utf8data);
410 	if (ucs2data == NULL)
411 		goto out;
412 	ucs2len = 2 * unicode_strlen(ucs2data);
413 
414 	HMACT64(v2hash, v1hash, NTLM_HASH_SZ,
415 	    (uchar_t *)ucs2data, ucs2len);
416 	err = 0;
417 out:
418 	if (ucs2data)
419 		free(ucs2data);
420 	if (utf8data)
421 		free(utf8data);
422 	return (err);
423 }
424 
425 /*
426  * Compute a partial LMv2 or NTLMv2 response (first 16-bytes).
427  * The full response is composed by the caller by
428  * appending the client_data to the returned hash.
429  *
430  * Output:
431  *	rhash: _partial_ LMv2/NTLMv2 response (first 16-bytes)
432  * Inputs:
433  *	v2hash: 16-byte NTLMv2 hash.
434  *	C8: Challenge from server (8 bytes)
435  *	client_data: client nonce (for LMv2) or the
436  *	  "blob" from ntlm_build_target_info (NTLMv2)
437  */
438 static int
439 ntlm_v2_resp_hash(uchar_t *rhash,
440     const uchar_t *v2hash, const uchar_t *C8,
441     const uchar_t *client_data, size_t cdlen)
442 {
443 	size_t dlen;
444 	uchar_t *data = NULL;
445 
446 	/* data = concat(C8, client_data) */
447 	dlen = 8 + cdlen;
448 	data = malloc(dlen);
449 	if (data == NULL)
450 		return (ENOMEM);
451 	bcopy(C8, data, 8);
452 	bcopy(client_data, data + 8, cdlen);
453 
454 	HMACT64(rhash, v2hash, NTLM_HASH_SZ, data, dlen);
455 
456 	free(data);
457 	return (0);
458 }
459 
460 /*
461  * Calculate an NTLMv2 session key (16 bytes).
462  */
463 static void
464 ntlm_v2_session_key(uchar_t *ssn_key,
465 	const uchar_t *v2hash,
466 	const uchar_t *ntresp)
467 {
468 
469 	/* session key uses only 1st 16 bytes of ntresp */
470 	HMACT64(ssn_key, v2hash, NTLM_HASH_SZ, ntresp, NTLM_HASH_SZ);
471 }
472 
473 
474 /*
475  * Compute both the LMv2 response and the NTLMv2 response,
476  * and put them in the mbdata chains passed.  This allocates
477  * mbuf chains in the output args, which the caller frees.
478  * Also computes the session key.
479  */
480 int
481 ntlm_put_v2_responses(struct smb_ctx *ctx, struct mbdata *ti_mbp,
482 	struct mbdata *lm_mbp, struct mbdata *nt_mbp,
483 	uchar_t *ssn_key)
484 {
485 	uchar_t *lmresp, *ntresp;
486 	int err;
487 	char *ucuser = NULL;	/* upper-case user name */
488 	uchar_t v2hash[NTLM_HASH_SZ];
489 	struct mbuf *tim = ti_mbp->mb_top;
490 
491 	/*
492 	 * Convert the user name to upper-case, as
493 	 * that's what's used when computing LMv2
494 	 * and NTLMv2 responses.  Note that the
495 	 * domain name is NOT upper-cased!
496 	 */
497 	if (ctx->ct_user[0] == '\0')
498 		return (EINVAL);
499 	ucuser = utf8_str_toupper(ctx->ct_user);
500 	if (ucuser == NULL)
501 		return (ENOMEM);
502 
503 	if ((err = mb_init(lm_mbp)) != 0)
504 		goto out;
505 	if ((err = mb_init(nt_mbp)) != 0)
506 		goto out;
507 
508 	/*
509 	 * Compute the NTLMv2 hash
510 	 */
511 	err = ntlm_v2_hash(v2hash, ctx->ct_nthash,
512 	    ucuser, ctx->ct_domain);
513 	if (err)
514 		goto out;
515 
516 	/*
517 	 * Compute the LMv2 response, derived from
518 	 * the v2hash, the server challenge, and
519 	 * the client nonce (random bits).
520 	 *
521 	 * We compose it from two parts:
522 	 *	1: 16-byte response hash
523 	 *	2: Client nonce
524 	 */
525 	lmresp = mb_reserve(lm_mbp, NTLM_HASH_SZ);
526 	err = ntlm_v2_resp_hash(lmresp,
527 	    v2hash, ctx->ct_srv_chal,
528 	    ctx->ct_clnonce, NTLM_CHAL_SZ);
529 	if (err)
530 		goto out;
531 	mb_put_mem(lm_mbp, ctx->ct_clnonce, NTLM_CHAL_SZ, MB_MSYSTEM);
532 
533 	/*
534 	 * Compute the NTLMv2 response, derived
535 	 * from the server challenge and the
536 	 * "target info." blob passed in.
537 	 *
538 	 * Again composed from two parts:
539 	 *	1: 16-byte response hash
540 	 *	2: "target info." blob
541 	 */
542 	ntresp = mb_reserve(nt_mbp, NTLM_HASH_SZ);
543 	err = ntlm_v2_resp_hash(ntresp,
544 	    v2hash, ctx->ct_srv_chal,
545 	    (uchar_t *)tim->m_data, tim->m_len);
546 	if (err)
547 		goto out;
548 	mb_put_mem(nt_mbp, tim->m_data, tim->m_len, MB_MSYSTEM);
549 
550 	/*
551 	 * Compute the session key
552 	 */
553 	ntlm_v2_session_key(ssn_key, v2hash, ntresp);
554 
555 out:
556 	if (err) {
557 		mb_done(lm_mbp);
558 		mb_done(nt_mbp);
559 	}
560 	free(ucuser);
561 
562 	return (err);
563 }
564 
565 /*
566  * Helper for ntlm_build_target_info below.
567  * Put a name in the NTLMv2 "target info." blob.
568  */
569 static void
570 smb_put_blob_name(struct mbdata *mbp, char *name, int type)
571 {
572 	uint16_t *ucs = NULL;
573 	int nlen;
574 
575 	if (name)
576 		ucs = convert_utf8_to_leunicode(name);
577 	if (ucs)
578 		nlen = unicode_strlen(ucs);
579 	else
580 		nlen = 0;
581 
582 	nlen <<= 1;	/* length in bytes, without null. */
583 
584 	mb_put_uint16le(mbp, type);
585 	mb_put_uint16le(mbp, nlen);
586 	mb_put_mem(mbp, (char *)ucs, nlen, MB_MSYSTEM);
587 
588 	if (ucs)
589 		free(ucs);
590 }
591 
592 /*
593  * Build an NTLMv2 "target info." blob.  When called from NTLMSSP,
594  * the list of names comes from the Type 2 message.  Otherwise,
595  * we create the name list here.
596  */
597 int
598 ntlm_build_target_info(struct smb_ctx *ctx, struct mbuf *names,
599 	struct mbdata *mbp)
600 {
601 	struct timeval now;
602 	uint64_t nt_time;
603 
604 	char *ucdom = NULL;	/* user's domain */
605 	int err;
606 
607 	/* Get mbuf chain for the "target info". */
608 	if ((err = mb_init(mbp)) != 0)
609 		return (err);
610 
611 	/*
612 	 * Get the "NT time" for the target info header.
613 	 */
614 	(void) gettimeofday(&now, 0);
615 	smb_time_local2NT(&now, 0, &nt_time);
616 
617 	/*
618 	 * Build the "target info." block.
619 	 *
620 	 * Based on information at:
621 	 * http://davenport.sourceforge.net/ntlm.html#theNtlmv2Response
622 	 *
623 	 * First the fixed-size part.
624 	 */
625 	mb_put_uint32le(mbp, 0x101);	/* Blob signature */
626 	mb_put_uint32le(mbp, 0);		/* reserved */
627 	mb_put_uint64le(mbp, nt_time);	/* NT time stamp */
628 	mb_put_mem(mbp, ctx->ct_clnonce, NTLM_CHAL_SZ, MB_MSYSTEM);
629 	mb_put_uint32le(mbp, 0);		/* unknown */
630 
631 	/*
632 	 * Now put the list of names, either from the
633 	 * NTLMSSP Type 2 message or composed here.
634 	 */
635 	if (names) {
636 		err = mb_put_mem(mbp, names->m_data, names->m_len, MB_MSYSTEM);
637 	} else {
638 		/* Get upper-case names. */
639 		ucdom  = utf8_str_toupper(ctx->ct_domain);
640 		if (ucdom == NULL) {
641 			err = ENOMEM;
642 			goto out;
643 		}
644 		smb_put_blob_name(mbp, ucdom, NAMETYPE_DOMAIN_NB);
645 		smb_put_blob_name(mbp, NULL, NAMETYPE_EOL);
646 		/* OK, that's the whole "target info." blob! */
647 	}
648 	err = 0;
649 
650 out:
651 	free(ucdom);
652 	return (err);
653 }
654 
655 /*
656  * Helper for ntlmssp_put_type3 - Build the "key exchange key"
657  * used when we have both NTLM(v1) and NTLMSSP_NEGOTIATE_NTLM2.
658  * HMAC_MD5(SessionBaseKey, concat(ServerChallenge, LmResponse[0..7]))
659  */
660 void
661 ntlm2_kxkey(struct smb_ctx *ctx, struct mbdata *lm_mbp,
662 	uchar_t *ssn_key, uchar_t *kxkey)
663 {
664 	uchar_t data[NTLM_HASH_SZ];
665 	uchar_t *p = mtod(lm_mbp->mb_top, uchar_t *);
666 
667 	/* concat(ServerChallenge, LmResponse[0..7]) */
668 	memcpy(data, ctx->ct_srv_chal, NTLM_CHAL_SZ);
669 	memcpy(data + NTLM_CHAL_SZ, p, NTLM_CHAL_SZ);
670 
671 	/* HMAC_MD5(SessionBaseKey, concat(...)) */
672 	HMACT64(kxkey, ssn_key, NTLM_HASH_SZ,
673 	    data, NTLM_HASH_SZ);
674 }
675