diff options
| author | Jeremy Allison <jra@samba.org> | 2015-03-09 14:27:43 -0700 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2015-03-24 02:40:28 +0100 |
| commit | 9e395c9c445f101014a01b7d3589bdf524f17883 (patch) | |
| tree | 20095ec65b8038d7a94928848cafcaf331fef2a1 /source3/libsmb | |
| parent | 2355e2dc577d87f251097200aef519131ef9cfe2 (diff) | |
| download | samba-9e395c9c445f101014a01b7d3589bdf524f17883.tar.gz | |
s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields.
Packet traces showing such servers are found in the bug this fixes:
https://bugzilla.samba.org/show_bug.cgi?id=10016
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Thu Mar 19 12:05:56 CET 2015 on sn-devel-104
(cherry picked from commit ffe33940faa6fb762fd2483f0245448b0434be00)
Diffstat (limited to 'source3/libsmb')
| -rw-r--r-- | source3/libsmb/ntlmssp.c | 38 |
1 files changed, 35 insertions, 3 deletions
diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c index 617b34b4977..e661aebba12 100644 --- a/source3/libsmb/ntlmssp.c +++ b/source3/libsmb/ntlmssp.c @@ -359,12 +359,13 @@ static NTSTATUS ntlmssp3_client_challenge(struct ntlmssp_state *ntlmssp_state, TALLOC_CTX *out_mem_ctx, /* Unused at this time */ const DATA_BLOB reply, DATA_BLOB *next_request) { - uint32_t chal_flags, ntlmssp_command, unkn1, unkn2; + uint32_t chal_flags, ntlmssp_command, unkn1 = 0, unkn2 = 0; DATA_BLOB server_domain_blob; DATA_BLOB challenge_blob; DATA_BLOB struct_blob = data_blob_null; char *server_domain; const char *chal_parse_string; + const char *chal_parse_string_short = NULL; const char *auth_gen_string; DATA_BLOB lm_response = data_blob_null; DATA_BLOB nt_response = data_blob_null; @@ -474,6 +475,7 @@ noccache: chal_parse_string = "CdUdbddB"; } else { chal_parse_string = "CdUdbdd"; + chal_parse_string_short = "CdUdb"; } auth_gen_string = "CdBBUUUBd"; } else { @@ -481,6 +483,7 @@ noccache: chal_parse_string = "CdAdbddB"; } else { chal_parse_string = "CdAdbdd"; + chal_parse_string_short = "CdAdb"; } auth_gen_string = "CdBBAAABd"; @@ -497,9 +500,38 @@ noccache: &challenge_blob, 8, &unkn1, &unkn2, &struct_blob)) { + + bool ok = false; + DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n")); - dump_data(2, reply.data, reply.length); - return NT_STATUS_INVALID_PARAMETER; + + if (chal_parse_string_short != NULL) { + /* + * In the case where NTLMSSP_NEGOTIATE_TARGET_INFO + * is not used, some NTLMSSP servers don't return + * the unused unkn1 and unkn2 fields. + * See bug: + * https://bugzilla.samba.org/show_bug.cgi?id=10016 + * for packet traces. + * Try and parse again without them. + */ + ok = msrpc_parse(ntlmssp_state, &reply, + chal_parse_string_short, + "NTLMSSP", + &ntlmssp_command, + &server_domain, + &chal_flags, + &challenge_blob, 8); + if (!ok) { + DEBUG(1, ("Failed to short parse " + "the NTLMSSP Challenge: (#2)\n")); + } + } + + if (!ok) { + dump_data(2, reply.data, reply.length); + return NT_STATUS_INVALID_PARAMETER; + } } if (chal_flags & NTLMSSP_TARGET_TYPE_SERVER) { |