1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #pragma ident "%Z%%M% %I% %E% SMI" 27 28 #include <strings.h> 29 #include <stdlib.h> 30 #include <smbsrv/alloc.h> 31 #include <smbsrv/codepage.h> 32 #include <smbsrv/oem.h> 33 #include <smbsrv/ctype.h> 34 #include <smbsrv/crypt.h> 35 #include <smbsrv/libsmb.h> 36 37 extern void randomize(char *data, unsigned len); 38 static uint64_t unix_micro_to_nt_time(struct timeval *unix_time); 39 40 /* 41 * smb_auth_qnd_unicode 42 * 43 * Quick and dirty unicode conversion! 44 * Returns the length of dst in bytes. 45 */ 46 int 47 smb_auth_qnd_unicode(mts_wchar_t *dst, char *src, int length) 48 { 49 int i; 50 51 unsigned int cpid = oem_get_telnet_cpid(); 52 unsigned int count; 53 mts_wchar_t new_char; 54 55 if ((count = oemstounicodes(dst, src, length, cpid)) == 0) { 56 for (i = 0; i < length; ++i) { 57 new_char = (mts_wchar_t)src[i] & 0xff; 58 dst[i] = LE_IN16(&new_char); 59 } 60 dst[i] = 0; 61 count = length; 62 } 63 64 return (count * sizeof (mts_wchar_t)); 65 } 66 67 /* 68 * smb_auth_lmupr 69 * 70 * Converts the given LM password to all uppercase. 71 * The standard strupr cannot 72 * be used here because lm_pwd doesn't have to be 73 * nul terminated. 74 */ 75 static void 76 smb_auth_lmupr(unsigned char *lm_pwd) 77 { 78 unsigned char *p = lm_pwd; 79 int i; 80 81 for (i = 0; (*p) && (i < SMBAUTH_LM_PWD_SZ); i++) { 82 if (mts_isascii(*p)) { 83 *p = codepage_toupper(*p); 84 p++; 85 } 86 } 87 } 88 89 /* 90 * smb_auth_lm_hash 91 * 92 * Source: Implementing CIFS (Chris Hertel) 93 * 94 * 1. The password, as entered by user, is either padded with nulls 95 * or trimmed to 14 bytes. 96 * . Note that the 14-byte result string is not handled as a 97 * nul-terminated string. 98 * . The given password is OEM not Unicode 99 * 100 * 2. The 14-byte password is converted to all uppercase 101 * 102 * 3. The result is used as key to encrypt the KGS magic string to 103 * make a 16-byte hash. 104 */ 105 int 106 smb_auth_lm_hash(char *password, unsigned char *lm_hash) 107 { 108 unsigned char lm_pwd[SMBAUTH_LM_PWD_SZ]; 109 110 bzero((void *)lm_pwd, SMBAUTH_LM_PWD_SZ); 111 (void) strncpy((char *)lm_pwd, password, SMBAUTH_LM_PWD_SZ); 112 smb_auth_lmupr(lm_pwd); 113 114 return (smb_auth_DES(lm_hash, SMBAUTH_HASH_SZ, lm_pwd, 115 SMBAUTH_LM_PWD_SZ, (unsigned char *)SMBAUTH_LM_MAGIC_STR, 116 sizeof (SMBAUTH_LM_MAGIC_STR))); 117 } 118 119 /* 120 * smb_auth_lm_response 121 * 122 * Create a LM response from the given LM hash and challenge. 123 * 124 * Returns SMBAUTH_FAILURE if any problems occur, SMBAUTH_SUCCESS if 125 * all goes well. 126 */ 127 static int 128 smb_auth_lm_response(unsigned char *hash, 129 unsigned char *challenge, int clen, 130 unsigned char *lm_rsp) 131 { 132 unsigned char S21[21]; 133 134 /* 135 * 14-byte LM Hash should be padded with 5 nul bytes to create 136 * a 21-byte string to be used in producing LM response 137 */ 138 bzero(&S21[SMBAUTH_HASH_SZ], 5); 139 bcopy(hash, S21, SMBAUTH_HASH_SZ); 140 141 /* padded LM Hash -> LM Response */ 142 return (smb_auth_DES(lm_rsp, SMBAUTH_LM_RESP_SZ, S21, 21, 143 challenge, clen)); 144 } 145 146 /* 147 * smb_auth_ntlm_hash 148 * 149 * Make NTLM Hash (using MD4) from the given password. 150 * The result will contain a 16-byte NTLM hash. 151 */ 152 int 153 smb_auth_ntlm_hash(char *password, unsigned char *hash) 154 { 155 mts_wchar_t *unicode_password; 156 int length; 157 int rc; 158 159 if (password == NULL || hash == NULL) 160 return (SMBAUTH_FAILURE); 161 162 length = strlen(password); 163 unicode_password = (mts_wchar_t *) 164 malloc((length + 1) * sizeof (mts_wchar_t)); 165 166 if (unicode_password == NULL) 167 return (SMBAUTH_FAILURE); 168 169 length = smb_auth_qnd_unicode(unicode_password, password, length); 170 rc = smb_auth_md4(hash, (unsigned char *)unicode_password, length); 171 172 free(unicode_password); 173 return (rc); 174 } 175 176 /* 177 * smb_auth_ntlm_response 178 * 179 * Make LM/NTLM response from the given LM/NTLM Hash and given 180 * challenge. 181 */ 182 static int 183 smb_auth_ntlm_response(unsigned char *hash, 184 unsigned char *challenge, int clen, 185 unsigned char *ntlm_rsp) 186 { 187 unsigned char S21[21]; 188 189 bcopy(hash, S21, SMBAUTH_HASH_SZ); 190 bzero(&S21[SMBAUTH_HASH_SZ], 5); 191 if (smb_auth_DES((unsigned char *)ntlm_rsp, SMBAUTH_LM_RESP_SZ, 192 S21, 21, challenge, clen) == SMBAUTH_FAILURE) 193 return (0); 194 return (SMBAUTH_LM_RESP_SZ); 195 } 196 197 /* 198 * smb_auth_gen_data_blob 199 * 200 * Fill the NTLMv2 data blob structure with information as described in 201 * "Implementing CIFS, The Common Internet File System". (pg. 282) 202 */ 203 static void 204 smb_auth_gen_data_blob(smb_auth_data_blob_t *blob, char *ntdomain) 205 { 206 struct timeval now; 207 208 (void) memset(blob->ndb_signature, 1, 2); 209 (void) memset(&blob->ndb_signature[2], 0, 2); 210 (void) memset(blob->ndb_reserved, 0, sizeof (blob->ndb_reserved)); 211 212 (void) gettimeofday(&now, 0); 213 blob->ndb_timestamp = unix_micro_to_nt_time(&now); 214 randomize((char *)blob->ndb_clnt_challenge, 215 SMBAUTH_V2_CLNT_CHALLENGE_SZ); 216 (void) memset(blob->ndb_unknown, 0, sizeof (blob->ndb_unknown)); 217 blob->ndb_names[0].nne_len = smb_auth_qnd_unicode( 218 blob->ndb_names[0].nne_name, ntdomain, strlen(ntdomain)); 219 blob->ndb_names[0].nne_type = SMBAUTH_NAME_TYPE_DOMAIN_NETBIOS; 220 blob->ndb_names[1].nne_len = 0; 221 blob->ndb_names[1].nne_type = SMBAUTH_NAME_TYPE_LIST_END; 222 *blob->ndb_names[1].nne_name = 0; 223 (void) memset(blob->ndb_unknown2, 0, sizeof (blob->ndb_unknown2)); 224 } 225 226 /* 227 * smb_auth_memcpy 228 * 229 * It increments the pointer to the destination buffer for the easy of 230 * concatenation. 231 */ 232 static void 233 smb_auth_memcpy(unsigned char **dstbuf, 234 unsigned char *srcbuf, 235 int srcbuf_len) 236 { 237 (void) memcpy(*dstbuf, srcbuf, srcbuf_len); 238 *dstbuf += srcbuf_len; 239 } 240 241 /* 242 * smb_auth_blob_to_string 243 * 244 * Prepare the data blob string which will be used in NTLMv2 response 245 * generation. 246 * 247 * Assumption: Caller must allocate big enough buffer to prevent buffer 248 * overrun. 249 * 250 * Returns the len of the data blob string. 251 */ 252 static int 253 smb_auth_blob_to_string(smb_auth_data_blob_t *blob, unsigned char *data_blob) 254 { 255 unsigned char *bufp = data_blob; 256 257 smb_auth_memcpy(&bufp, blob->ndb_signature, 258 sizeof (blob->ndb_signature)); 259 smb_auth_memcpy(&bufp, blob->ndb_reserved, 260 sizeof (blob->ndb_reserved)); 261 smb_auth_memcpy(&bufp, (unsigned char *)&blob->ndb_timestamp, 262 sizeof (blob->ndb_timestamp)); 263 smb_auth_memcpy(&bufp, blob->ndb_clnt_challenge, 264 SMBAUTH_V2_CLNT_CHALLENGE_SZ); 265 smb_auth_memcpy(&bufp, blob->ndb_unknown, sizeof (blob->ndb_unknown)); 266 smb_auth_memcpy(&bufp, (unsigned char *)&blob->ndb_names[0].nne_type, 267 sizeof (blob->ndb_names[0].nne_type)); 268 smb_auth_memcpy(&bufp, (unsigned char *)&blob->ndb_names[0].nne_len, 269 sizeof (blob->ndb_names[0].nne_len)); 270 smb_auth_memcpy(&bufp, (unsigned char *)blob->ndb_names[0].nne_name, 271 blob->ndb_names[0].nne_len); 272 smb_auth_memcpy(&bufp, (unsigned char *)&blob->ndb_names[1].nne_type, 273 sizeof (blob->ndb_names[1].nne_type)); 274 smb_auth_memcpy(&bufp, (unsigned char *)&blob->ndb_names[1].nne_len, 275 sizeof (blob->ndb_names[1].nne_len)); 276 smb_auth_memcpy(&bufp, blob->ndb_unknown2, sizeof (blob->ndb_unknown2)); 277 278 /*LINTED E_PTRDIFF_OVERFLOW*/ 279 return (bufp - data_blob); 280 } 281 282 /* 283 * smb_auth_ntlmv2_hash 284 * 285 * The NTLM v2 hash will be created from the given NTLM hash, username, 286 * and the NETBIOS name of the domain. 287 * 288 * The NTLMv2 hash will be returned via the ntlmv2_hash parameter which 289 * will be used in the calculation of the NTLMv2 and LMv2 responses. 290 */ 291 static int 292 smb_auth_ntlmv2_hash(unsigned char *ntlm_hash, 293 char *username, 294 char *ntdomain, 295 unsigned char *ntlmv2_hash) 296 { 297 mts_wchar_t *data; 298 int data_len; 299 unsigned char *buf; 300 int rc; 301 302 if (username == NULL || ntdomain == NULL) 303 return (SMBAUTH_FAILURE); 304 305 (void) utf8_strupr(username); 306 (void) utf8_strupr(ntdomain); 307 308 data_len = strlen(username) + strlen(ntdomain); 309 buf = (unsigned char *)malloc((data_len + 1) * sizeof (char)); 310 if (buf == NULL) 311 return (SMBAUTH_FAILURE); 312 313 (void) snprintf((char *)buf, data_len + 1, "%s%s", username, ntdomain); 314 data = (mts_wchar_t *)malloc((data_len + 1) * sizeof (mts_wchar_t)); 315 if (data == NULL) { 316 free(buf); 317 return (SMBAUTH_FAILURE); 318 } 319 320 data_len = smb_auth_qnd_unicode(data, (char *)buf, data_len); 321 rc = SMBAUTH_HMACT64((unsigned char *)data, data_len, ntlm_hash, 322 SMBAUTH_HASH_SZ, ntlmv2_hash); 323 324 free(buf); 325 free(data); 326 return (rc); 327 } 328 329 /* 330 * smb_auth_v2_response 331 * 332 * Caculates either the LMv2 or NTLMv2 response. 333 * 334 * Same algorithm is used for calculating both LMv2 or NTLMv2 responses. 335 * This routine will return NTLMv2 response if the data blob information 336 * is passed in as the clnt_data. Otherwise, it will return LMv2 response 337 * with the 8-byte client challenge(a.k.a blip) as the clnt_data. 338 * 339 * (LM/NTLM)v2 response is the hmac-md5 hash of the specified data 340 * (server challenge + NTLMv2 data blob or LMv2 client challenge) 341 * using the NTLMv2 hash as the key. 342 * 343 * Returns the size of the corresponding v2 response upon success. 344 * Otherwise, returns -1 on error. 345 */ 346 static int 347 smb_auth_v2_response( 348 unsigned char *hash, 349 unsigned char *srv_challenge, int slen, 350 unsigned char *clnt_data, int clen, 351 unsigned char *v2_rsp) 352 { 353 unsigned char *hmac_data; 354 355 hmac_data = (unsigned char *)malloc((slen + clen) * sizeof (char)); 356 if (!hmac_data) { 357 return (-1); 358 } 359 360 (void) memcpy(hmac_data, srv_challenge, slen); 361 (void) memcpy(&hmac_data[slen], clnt_data, clen); 362 if (SMBAUTH_HMACT64(hmac_data, slen + clen, (unsigned char *)hash, 363 SMBAUTH_HASH_SZ, (unsigned char *)v2_rsp) != SMBAUTH_SUCCESS) 364 return (-1); 365 (void) memcpy(&v2_rsp[SMBAUTH_HASH_SZ], clnt_data, clen); 366 367 free(hmac_data); 368 return (SMBAUTH_HASH_SZ + clen); 369 } 370 371 /* 372 * smb_auth_set_info 373 * 374 * Fill the smb_auth_info instance with either NTLM or NTLMv2 related 375 * authentication information based on the LMCompatibilityLevel. 376 * 377 * If the LMCompatibilityLevel equals 2, the SMB Redirector will perform 378 * NTLM challenge/response authentication which requires the NTLM hash and 379 * NTLM response. 380 * 381 * If the LMCompatibilityLevel is 3 or above, the SMB Redirector will 382 * perfrom NTLMv2 challenge/response authenticatoin which requires the 383 * NTLM hash, NTLMv2 hash, NTLMv2 response and LMv2 response. 384 * 385 * Returns -1 on error. Otherwise, returns 0 upon success. 386 */ 387 int 388 smb_auth_set_info(char *username, 389 char *password, 390 unsigned char *ntlm_hash, 391 char *domain, 392 unsigned char *srv_challenge_key, 393 int srv_challenge_len, 394 int lmcomp_lvl, 395 smb_auth_info_t *auth) 396 { 397 unsigned short blob_len; 398 unsigned char blob_buf[SMBAUTH_BLOB_MAXLEN]; 399 int rc; 400 401 auth->lmcompatibility_lvl = lmcomp_lvl; 402 if (lmcomp_lvl == 2) { 403 auth->ci_len = 0; 404 *auth->ci = 0; 405 if (!ntlm_hash) { 406 if (smb_auth_ntlm_hash(password, auth->hash) != 407 SMBAUTH_SUCCESS) 408 return (-1); 409 } else { 410 (void) memcpy(auth->hash, ntlm_hash, SMBAUTH_HASH_SZ); 411 } 412 413 auth->cs_len = smb_auth_ntlm_response(auth->hash, 414 srv_challenge_key, srv_challenge_len, auth->cs); 415 } else { 416 if (!ntlm_hash) { 417 if (smb_auth_ntlm_hash(password, auth->hash) != 418 SMBAUTH_SUCCESS) 419 return (-1); 420 } else { 421 (void) memcpy(auth->hash, ntlm_hash, SMBAUTH_HASH_SZ); 422 } 423 424 if (smb_auth_ntlmv2_hash(auth->hash, username, 425 domain, auth->hash_v2) != SMBAUTH_SUCCESS) 426 return (-1); 427 428 /* generate data blob */ 429 smb_auth_gen_data_blob(&auth->data_blob, domain); 430 blob_len = smb_auth_blob_to_string(&auth->data_blob, blob_buf); 431 432 /* generate NTLMv2 response */ 433 rc = smb_auth_v2_response(auth->hash_v2, srv_challenge_key, 434 srv_challenge_len, blob_buf, blob_len, auth->cs); 435 436 if (rc < 0) 437 return (-1); 438 439 auth->cs_len = rc; 440 441 /* generate LMv2 response */ 442 rc = smb_auth_v2_response(auth->hash_v2, srv_challenge_key, 443 srv_challenge_len, auth->data_blob.ndb_clnt_challenge, 444 SMBAUTH_V2_CLNT_CHALLENGE_SZ, auth->ci); 445 446 if (rc < 0) 447 return (-1); 448 449 auth->ci_len = rc; 450 } 451 452 return (0); 453 } 454 455 /* 456 * smb_auth_gen_session_key 457 * 458 * Generate the NTLM user session key if LMCompatibilityLevel is 2 or 459 * NTLMv2 user session key if LMCompatibilityLevel is 3 or above. 460 * 461 * NTLM_Session_Key = MD4(NTLM_Hash); 462 * 463 * NTLMv2_Session_Key = HMAC_MD5(NTLMv2Hash, 16, NTLMv2_HMAC, 16) 464 * 465 * Prior to calling this function, the auth instance should be set 466 * via smb_auth_set_info(). 467 * 468 * Returns the appropriate session key. 469 */ 470 int 471 smb_auth_gen_session_key(smb_auth_info_t *auth, unsigned char *session_key) 472 { 473 int rc; 474 475 if (auth->lmcompatibility_lvl == 2) 476 rc = smb_auth_md4(session_key, auth->hash, SMBAUTH_HASH_SZ); 477 else 478 rc = SMBAUTH_HMACT64((unsigned char *)auth->cs, 479 SMBAUTH_HASH_SZ, (unsigned char *)auth->hash_v2, 480 SMBAUTH_SESSION_KEY_SZ, session_key); 481 482 return (rc); 483 } 484 485 /* 100's of ns between 1/1/1970 and 1/1/1601 */ 486 #define NT_TIME_BIAS (134774LL * 24LL * 60LL * 60LL * 10000000LL) 487 488 static uint64_t 489 unix_micro_to_nt_time(struct timeval *unix_time) 490 { 491 uint64_t nt_time; 492 493 nt_time = unix_time->tv_sec; 494 nt_time *= 10000000; /* seconds to 100ns */ 495 nt_time += unix_time->tv_usec * 10; 496 return (nt_time + NT_TIME_BIAS); 497 } 498 499 static boolean_t 500 smb_lm_password_ok( 501 unsigned char *challenge, 502 uint32_t clen, 503 unsigned char *lm_hash, 504 unsigned char *passwd) 505 { 506 unsigned char lm_resp[SMBAUTH_LM_RESP_SZ]; 507 int rc; 508 509 rc = smb_auth_lm_response(lm_hash, challenge, clen, lm_resp); 510 if (rc != SMBAUTH_SUCCESS) 511 return (B_FALSE); 512 513 return (bcmp(lm_resp, passwd, SMBAUTH_LM_RESP_SZ) == 0); 514 } 515 516 static boolean_t 517 smb_ntlm_password_ok( 518 unsigned char *challenge, 519 uint32_t clen, 520 unsigned char *ntlm_hash, 521 unsigned char *passwd) 522 { 523 unsigned char ntlm_resp[SMBAUTH_LM_RESP_SZ]; 524 int rc; 525 526 rc = smb_auth_ntlm_response(ntlm_hash, challenge, clen, ntlm_resp); 527 528 if (rc != SMBAUTH_LM_RESP_SZ) 529 return (B_FALSE); 530 531 return (bcmp(ntlm_resp, passwd, SMBAUTH_LM_RESP_SZ) == 0); 532 } 533 534 static boolean_t 535 smb_ntlmv2_password_ok( 536 unsigned char *challenge, 537 uint32_t clen, 538 unsigned char *ntlm_hash, 539 unsigned char *passwd, 540 int pwdlen, 541 char *username) 542 { 543 unsigned char *clnt_blob; 544 int clnt_blob_len; 545 unsigned char ntlmv2_hash[SMBAUTH_HASH_SZ]; 546 unsigned char *ntlmv2_resp; 547 boolean_t ok; 548 549 clnt_blob_len = pwdlen - SMBAUTH_HASH_SZ; 550 clnt_blob = &passwd[SMBAUTH_HASH_SZ]; 551 552 /* 553 * 15.5.2 The NTLMv2 Password Hash, pg. 279, of the "Implementing CIFS" 554 * 555 * * The NTLMv2 Hash is created from: 556 * - NTLM hash 557 * - user's username, and 558 * - the name of the logon destination(i.e. the NetBIOS name of either 559 * the SMB server or NT Domain against which the suer is trying to 560 * authenticate. 561 * 562 * (N.L.) With my experience, this is not exactly true. It's really 563 * tricky how the NTLMv2 hash is generated by the Windows client when 564 * logging into a standalone server using NTLMv2 challenge / response. 565 * The NTLMv2 hash is actually created with the destination info="" 566 * as opposed to the SMB server name mentioned in the book. 567 */ 568 if (smb_auth_ntlmv2_hash(ntlm_hash, username, "", ntlmv2_hash) != 569 SMBAUTH_SUCCESS) { 570 return (B_FALSE); 571 } 572 573 ntlmv2_resp = (unsigned char *)malloc(SMBAUTH_HASH_SZ + clnt_blob_len); 574 if (ntlmv2_resp == NULL) 575 return (B_FALSE); 576 577 if (smb_auth_v2_response(ntlmv2_hash, challenge, 578 clen, clnt_blob, clnt_blob_len, ntlmv2_resp) < 0) { 579 free(ntlmv2_resp); 580 return (B_FALSE); 581 } 582 583 ok = (bcmp(passwd, ntlmv2_resp, pwdlen) == 0); 584 585 free(ntlmv2_resp); 586 return (ok); 587 } 588 589 static int 590 smb_lmv2_password_ok( 591 unsigned char *challenge, 592 uint32_t clen, 593 unsigned char *ntlm_hash, 594 unsigned char *passwd, 595 char *username) 596 { 597 unsigned char *clnt_challenge; 598 unsigned char ntlmv2_hash[SMBAUTH_HASH_SZ]; 599 unsigned char lmv2_resp[SMBAUTH_LM_RESP_SZ]; 600 601 clnt_challenge = &passwd[SMBAUTH_HASH_SZ]; 602 603 /* 604 * 15.5.2 The NTLMv2 Password Hash, pg. 279, of the "Implementing CIFS" 605 * 606 * The NTLMv2 Hash is created from: 607 * - NTLM hash 608 * - user's username, and 609 * - the name of the logon destination(i.e. the NetBIOS name of either 610 * the SMB server or NT Domain against which the suer is trying to 611 * authenticate. 612 * 613 * (N.L.) With my experience, this is not exactly true. It's really 614 * tricky how the NTLMv2 hash is generated by the Windows client when 615 * logging into a standalone server using LMv2 challenge/response. 616 * The NTLMv2 hash is actually created with the destination info = "" 617 * as opposed to the SMB server name mentioned in the book. 618 */ 619 if (smb_auth_ntlmv2_hash(ntlm_hash, username, "", ntlmv2_hash) != 620 SMBAUTH_SUCCESS) { 621 return (B_FALSE); 622 } 623 if (smb_auth_v2_response(ntlmv2_hash, challenge, 624 clen, clnt_challenge, SMBAUTH_V2_CLNT_CHALLENGE_SZ, 625 lmv2_resp) < 0) { 626 return (B_FALSE); 627 } 628 629 return (bcmp(passwd, lmv2_resp, SMBAUTH_LM_RESP_SZ) == 0); 630 } 631 632 /* 633 * smb_auth_validate_lm 634 * 635 * Validates given LM/LMv2 client response, passed in passwd arg, against 636 * stored user's password, passed in smbpw 637 * 638 * If LM level <=3 server accepts LM responses, otherwise LMv2 639 */ 640 boolean_t 641 smb_auth_validate_lm( 642 unsigned char *challenge, 643 uint32_t clen, 644 smb_passwd_t *smbpw, 645 unsigned char *passwd, 646 int pwdlen, 647 char *username) 648 { 649 int lmlevel; 650 boolean_t ok = B_FALSE; 651 652 if (pwdlen != SMBAUTH_LM_RESP_SZ) 653 return (B_FALSE); 654 655 smb_config_rdlock(); 656 lmlevel = smb_config_getnum(SMB_CI_LM_LEVEL); 657 smb_config_unlock(); 658 659 if (lmlevel <= 3) { 660 ok = smb_lm_password_ok(challenge, clen, smbpw->pw_lmhash, 661 passwd); 662 } 663 664 if (!ok) 665 ok = smb_lmv2_password_ok(challenge, clen, smbpw->pw_nthash, 666 passwd, username); 667 668 return (ok); 669 } 670 671 /* 672 * smb_auth_validate_nt 673 * 674 * Validates given NTLM/NTLMv2 client response, passed in passwd arg, against 675 * stored user's password, passed in smbpw 676 * 677 * If LM level <=4 server accepts NTLM/NTLMv2 responses, otherwise only NTLMv2 678 */ 679 boolean_t 680 smb_auth_validate_nt( 681 unsigned char *challenge, 682 uint32_t clen, 683 smb_passwd_t *smbpw, 684 unsigned char *passwd, 685 int pwdlen, 686 char *username) 687 { 688 int lmlevel; 689 boolean_t ok; 690 691 smb_config_rdlock(); 692 lmlevel = smb_config_getnum(SMB_CI_LM_LEVEL); 693 smb_config_unlock(); 694 695 if ((lmlevel == 5) && (pwdlen <= SMBAUTH_LM_RESP_SZ)) 696 return (B_FALSE); 697 698 if (pwdlen > SMBAUTH_LM_RESP_SZ) 699 ok = smb_ntlmv2_password_ok(challenge, clen, 700 smbpw->pw_nthash, passwd, pwdlen, username); 701 else 702 ok = smb_ntlm_password_ok(challenge, clen, 703 smbpw->pw_nthash, passwd); 704 705 return (ok); 706 } 707