summaryrefslogtreecommitdiff
path: root/auth/ntlmssp/ntlmssp_client.c
Commit message (Collapse)AuthorAgeFilesLines
* auth/ntlmssp: add ntlmssp_client:ldap_style_send_seal optionStefan Metzmacher2018-06-041-7/+17
| | | | | | | | | | | | | This will be used to similate a Windows client only using NTLMSSP_NEGOTIATE_SIGN without NTLMSSP_NEGOTIATE_SEAL on an LDAP connection, which is indicated internally by GENSEC_FEATURE_LDAP_STYLE. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13427 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 7f2bebf09cd8056b3f901dd9ff1fc9e9525f3e9d)
* define DBGC_AUTH classkkplein2018-01-081-0/+3
| | | | | | Signed-off-by: Mourik Jan C Heupink <heupink@merit.unu.edu> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: add ntlmssp_{client,server}:force_old_spnego option for testingStefan Metzmacher2016-04-281-0/+3
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=11849 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: don't require NTLMSSP_SIGN for smb connectionsStefan Metzmacher2016-04-281-1/+4
| | | | | | | | | | Enforcement of SMB signing is done at the SMB layer. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11850 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: don't require any flags in the ccache_resume codeStefan Metzmacher2016-04-281-6/+1
| | | | | | | | | | | ntlmssp_client_challenge() already checks for required flags before asking winbindd. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11850 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* CVE-2016-2110: auth/ntlmssp: implement new_spnego support including MIC ↵Stefan Metzmacher2016-04-121-5/+201
| | | | | | | | | | | | | | | generation (as client) We now detect a MsvAvTimestamp in target info as indication of the server to support NTLMSSP_MIC in the AUTH_MESSAGE. If the client uses NTLMv2 we provide NTLMSSP_AVFLAG_MIC_IN_AUTHENTICATE_MESSAGE and valid MIC. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* CVE-2016-2110: auth/credentials: pass server_timestamp to ↵Stefan Metzmacher2016-04-121-2/+3
| | | | | | | | | cli_credentials_get_ntlm_response() BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* CVE-2016-2110: auth/ntlmssp: call ntlmssp_sign_init if we provide ↵Stefan Metzmacher2016-04-121-1/+1
| | | | | | | | | | | | | | | | GENSEC_FEATURE_SIGN It's important to check if got the GENSEC_FEATURE_SIGN and if the caller wanted it. The caller may only asked for GENSEC_FEATURE_SESSION_KEY which implicitly negotiates NTLMSSP_NEGOTIATE_SIGN, which might indicate GENSEC_FEATURE_SIGN to the SPNEGO glue code. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* CVE-2016-2110: auth/ntlmssp: let gensec_ntlmssp_client_start require NTLM2 ↵Stefan Metzmacher2016-04-121-1/+1
| | | | | | | | | (EXTENDED_SESSIONSECURITY) when using ntlmv2 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* CVE-2016-2110: auth/ntlmssp: let gensec_ntlmssp_client_start require flags ↵Stefan Metzmacher2016-04-121-8/+10
| | | | | | | | | depending on the requested features BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* CVE-2016-2110: auth/ntlmssp: don't let ntlmssp_handle_neg_flags() change ↵Stefan Metzmacher2016-04-121-0/+4
| | | | | | | | | | | | ntlmssp_state->use_ntlmv2 ntlmssp_handle_neg_flags() can only disable flags, but not set them. All supported flags are set at start time. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* CVE-2016-2110: auth/ntlmssp: don't allow a downgrade from NTLMv2 to LM_AUTHStefan Metzmacher2016-04-121-0/+2
| | | | | | | | | | | | | | | man smb.conf says "client ntlmv2 auth = yes" the default disables, "client lanman auth = yes": ... Likewise, if the client ntlmv2 auth parameter is enabled, then only NTLMv2 logins will be attempted. ... BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* CVE-2016-2110: auth/ntlmssp: split allow_lm_response from allow_lm_keyStefan Metzmacher2016-04-121-3/+5
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* CVE-2016-2110: auth/ntlmssp: maintain conf_flags and required_flags variablesStefan Metzmacher2016-04-121-0/+6
| | | | | | | | | We now give an error when required flags are missing. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* CVE-2016-2110: auth/ntlmssp: let ntlmssp_handle_neg_flags() return NTSTATUSStefan Metzmacher2016-04-121-1/+5
| | | | | | | | | | In future we can do a more fine granted negotiation and assert specific security features. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: add more compat for GENSEC_FEATURE_LDAP_STYLEStefan Metzmacher2016-03-101-0/+8
| | | | | | | | | | We want also work against old Samba servers which didn't had GENSEC_FEATURE_LDAP_STYLE we negotiate SEAL too. We may remove this in a few years. As all servers should support GENSEC_FEATURE_LDAP_STYLE by then. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: implement GENSEC_FEATURE_LDAP_STYLEStefan Metzmacher2016-03-101-0/+9
| | | | | | | | | | | | | We need to handle NTLMSSP_NEGOTIATE_SIGN as NTLMSSP_NEGOTIATE_SEAL if GENSEC_FEATURE_LDAP_STYLE is requested. This works arround a bug in Windows, which allow signed only messages using NTLMSSP and LDAP. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: let the client always include NTLMSSP_NEGOTIATE_VERSIONStefan Metzmacher2016-03-101-6/+11
| | | | | | | | This matches a modern Windows client. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: don't send domain and workstation in the NEGOTIATE_MESSAGEStefan Metzmacher2016-03-101-14/+2
| | | | | | | | | | We don't set NTLMSSP_NEGOTIATE_OEM_{DOMAIN,WORKSTATION}_SUPPLIED anyway. This matches modern Windows clients. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: set NTLMSSP_ANONYMOUS for anonymous authenticationStefan Metzmacher2016-03-101-0/+1
| | | | | | | | This matches a modern Windows client. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: define all client neg_flags in gensec_ntlmssp_client_start()Stefan Metzmacher2016-03-101-10/+10
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: implement GENSEC_FEATURE_NTLM_CCACHEStefan Metzmacher2016-03-101-3/+91
| | | | | | | | | | This can used in order to use the WINBINDD_CCACHE_NTLMAUTH code of winbindd to do NTLMSSP authentication with a cached password. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: provide a "ntlmssp_resume_ccache" backendStefan Metzmacher2016-03-101-0/+111
| | | | | | | | | | | | These can be used to implement the winbindd side of the WINBINDD_CCACHE_NTLMAUTH call. It can properly get the initial NEGOTIATE messages injected if available. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* auth/ntlmssp: keep ntlmssp_state->server.netbios_domain on the correct ↵Stefan Metzmacher2016-03-101-1/+1
| | | | | | | | talloc context Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Prevent a crash in Python modules that try to authenticate by ensuring we ↵Richard Sharpe2015-08-251-2/+19
| | | | | | | | | | reject cases where credendials fields are not intialized. Signed-off-by: Richard Sharpe <rsharpe@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Aug 25 21:45:18 CEST 2015 on sn-devel-104
* s4: lib: auth: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers ↵Jeremy Allison2015-03-191-4/+36
| | | | | | | | | | | that don't send the 2 unused fields. Packet traces showing such servers are found in the bug this fixes: https://bugzilla.samba.org/show_bug.cgi?id=10016 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
* auth/gensec: introduce gensec_internal.hStefan Metzmacher2013-08-101-0/+1
| | | | | | | | | | We should treat most gensec related structures private. It's a long way, but this is a start. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: avoid talloc_tos() in ntlmssp_client_initial()Stefan Metzmacher2012-08-041-1/+1
| | | | | | | This avoids a smb_panic at log level = 10. If we don't have a talloc stackframe yet. metze
* auth: Remove plugable password-check functions from gensec_ntlmsspAndrew Bartlett2012-02-241-8/+0
| | | | | | The auth4_context layer now provides the plugability here. Andrew Bartlett
* auth: Move the rest of the source4 gensec_ntlmssp code to the top levelAndrew Bartlett2012-02-171-0/+436
The ntlmssp_server code will be in common shortly, and aside from a symbol name or two, moving the client code causes no harm and makes less mess. We will also get the client code in common very soon. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
View Lorry Controller Status