[PATCH 0/2] ksmbd: NTLM pass-through to a domain controller

[Jan Koester]

Hi,

a ksmbd server joined to an Active Directory domain can authenticate
domain users with Kerberos, but not with NTLM: it has no password hash
for them, so the NTLMv2 response can't be checked locally. Clients that
fall back to NTLM (access by IP address, machines outside the domain,
mount.cifs with user name and password) are refused.

Samba solves this by forwarding the response to a domain controller
over NETLOGON (NetrLogonSamLogonEx on a schannel connection). These two
patches give ksmbd the kernel half of that, and leave the NETLOGON client
to user space, like the rest of ksmbd's user handling:

1/2 adds a KSMBD_USER_FLAG_PASSTHROUGH login flag. For such a user,
    ksmbd_decode_ntlmssp_auth_blob() doesn't compute the response from a
    local hash. It sends the server challenge, the user, domain and
    workstation names and the NT/LM responses to user space in a new
    KSMBD_EVENT_NTLM_AUTHEN_REQUEST event, then takes the session base
    key from KSMBD_EVENT_NTLM_AUTHEN_RESPONSE and goes on with the
    existing key exchange. Both events have a strict netlink policy and
    are checked in ipc_validate_msg().

2/2 puts the workgroup, not the netbios name, into MsvAvNbDomainName and
    MsvAvDnsDomainName of the challenge's target info. A domain
    controller checks these when it verifies the NTLMv2 response (Samba
    in NTLMv2_RESPONSE_verify_workstation()), so without this patch
    every pass-through login fails with NT_STATUS_LOGON_FAILURE. The
    patch also checks that the challenge blob fits the response buffer,
    since the workgroup can be longer than the netbios name.

Logins of users without the new flag are checked as before. The only
change they see is the domain names in the challenge's target info
(patch 2/2). ksmbd-tools doesn't set the flag yet. The user space side
we tested with is sharedd/adconnect from FenrirOS: it marks domain users
without a local hash as pass-through, and it answers the event through
a NETLOGON schannel client, tested against a Samba 4.22 AD DC.

I can send the matching ksmbd-tools change if the interface looks
acceptable.

The series is based on v7.3-rc7.

Jan Koester (2):
  ksmbd: pass through NTLM authentication to a domain controller
  ksmbd: put the workgroup into the NTLMSSP target info's domain names

 fs/smb/server/auth.c          | 109 +++++++++++++++++++++++++++++++---
 fs/smb/server/ksmbd_netlink.h |  41 +++++++++++++
 fs/smb/server/smb2pdu.c       |  21 ++++++-
 fs/smb/server/transport_ipc.c |  73 ++++++++++++++++++++++-
 fs/smb/server/transport_ipc.h |   3 +
 5 files changed, 236 insertions(+), 11 deletions(-)


base-commit: 32c52ec87d6245ee2d12ed5dd509e40062939b50
-- 
2.56.0