Module ntlm 

Minimal NTLMSSP ([MS-NLMP]) message construction/parsing plus the SPNEGO DER wrapping used during extended-security session setup.

Both SMB1 (SESSION_SETUP_ANDX with CAP_EXTENDED_SECURITY) and SMB2 session setup speak this exact dialect of tokens, so the module is shared between protocol implementations.

Structs

Type3

Parsed AUTHENTICATE (type 3) message.

Constants

MSG_TYPE1

NEGOTIATE message identifier.

MSG_TYPE2

CHALLENGE message identifier.

MSG_TYPE3

AUTHENTICATE message identifier.

NEGOTIATE_128

128-bit crypto strength requested.

NEGOTIATE_ALWAYS_SIGN

Always sign messages.

NEGOTIATE_ANONYMOUS

Client requests anonymous authentication.

NEGOTIATE_DOMAIN_SUPPLIED

Domain name supplied by the client.

NEGOTIATE_EXTENDED_SESSIONSECURITY

Extended session security (NTLM2).

NEGOTIATE_KEY_EXCH

Key exchange negotiated ([MS-NLMP] §2.2.2.5): the AUTHENTICATE message carries an RC4-encrypted RandomSessionKey.

NEGOTIATE_NTLM

NTLM authentication (as opposed to LM-only).

NEGOTIATE_SEAL

Sealing (encryption) is supported.

NEGOTIATE_SIGN

Message signing is supported.

NEGOTIATE_TARGET_INFO

Target info AV pairs are present.

NEGOTIATE_UNICODE

Request/response Unicode strings.

NEGOTIATE_VERSION

Version structure present.

NTLMSSP_SIG

Wire signature every NTLMSSP message begins with.

REQUEST_TARGET

Server must include a target name in the CHALLENGE.

TARGET_TYPE_DOMAIN

Target type is a domain.

Functions

build_type2

Build an NTLMSSP CHALLENGE (type 2) message carrying our challenge, target domain/hostname and a complete TargetInfo AV list.

is_spnego

True when the blob looks like DER/SPNEGO (starts with ASN.1 tags) rather than a raw NTLMSSP message.

msg_type

Identify an NTLMSSP message type (1/2/3), if the buffer is one.

parse_type3

Parse an NTLMSSP AUTHENTICATE (type 3) message per [MS-NLMP] §2.2.1.3. Parse an NTLMSSP AUTHENTICATE (Type 3) message ([MS-NLMP] §2.2.1.3 fixed layout).

parse_type3_session_key

Session key field ([MS-NLMP] §2.2.1.3): len @52, max @54, offset @56.

unwrap_blob

Extract the inner NTLMSSP message from a possibly-SPNEGO-wrapped blob: returns the slice starting at the "NTLMSSP\0" marker, when present.

wrap_accept_complete

SPNEGO NegTokenTarg carrying only negResult = accept-completed.

wrap_accept_complete_with_mic

SPNEGO NegTokenResp with accept-completed plus a mechListMIC ([RFC 4178] §4.2.2): the client validates it against the exported session key whenever it sent a MIC in its AUTHENTICATE message.

wrap_negtoken_targ

Wrap an NTLMSSP token in a SPNEGO NegTokenTarg declaring negResult = accept-incomplete and supportedMech = NTLMSSP.