summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStefan Metzmacher <metze@samba.org>2009-07-08 09:22:39 +0200
committerVolker Lendecke <vl@samba.org>2009-07-08 13:15:22 +0200
commit57afa1edebe38ea48be5fc074a8284c762e35e17 (patch)
tree89128b9befe4601ca9890ce09fa1d75b9e82bae6
parente3631da15893207b196201f89648a28f889ecb5e (diff)
downloadsamba-57afa1edebe38ea48be5fc074a8284c762e35e17.tar.gz
samba-57afa1edebe38ea48be5fc074a8284c762e35e17.tar.bz2
samba-57afa1edebe38ea48be5fc074a8284c762e35e17.zip
s4:auth/ntlmssp: let _unwrap fallback to seal if sign only doesn't work
s4:auth/ntlmssp: let _unwrap fallback to seal if sign only doesn't work Windows always uses SEAL with NTLMSSP on LDAP connection even if not negotiated. metze
-rw-r--r--source4/auth/ntlmssp/ntlmssp_sign.c63
1 files changed, 57 insertions, 6 deletions
diff --git a/source4/auth/ntlmssp/ntlmssp_sign.c b/source4/auth/ntlmssp/ntlmssp_sign.c
index cf9eab67cd..957d0a8fbc 100644
--- a/source4/auth/ntlmssp/ntlmssp_sign.c
+++ b/source4/auth/ntlmssp/ntlmssp_sign.c
@@ -523,18 +523,69 @@ NTSTATUS gensec_ntlmssp_unwrap(struct gensec_security *gensec_security,
&sig);
} else if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
+ struct gensec_ntlmssp_state *gensec_ntlmssp_state =
+ (struct gensec_ntlmssp_state *)gensec_security->private_data;
+ NTSTATUS status;
+ uint32_t ntlm_seqnum;
+ struct arcfour_state ntlm_state;
+ uint32_t ntlm2_seqnum_r;
+ uint8_t ntlm2_key_r[16];
+ struct arcfour_state ntlm2_state_r;
+
if (in->length < NTLMSSP_SIG_SIZE) {
return NT_STATUS_INVALID_PARAMETER;
}
sig.data = in->data;
sig.length = NTLMSSP_SIG_SIZE;
-
*out = data_blob_talloc(sig_mem_ctx, in->data + NTLMSSP_SIG_SIZE, in->length - NTLMSSP_SIG_SIZE);
-
- return gensec_ntlmssp_check_packet(gensec_security, sig_mem_ctx,
- out->data, out->length,
- out->data, out->length,
- &sig);
+
+ if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+ ntlm2_seqnum_r = gensec_ntlmssp_state->crypt.ntlm2.recv_seq_num;
+ ntlm2_state_r = *gensec_ntlmssp_state->crypt.ntlm2.recv_seal_arcfour_state;
+ memcpy(ntlm2_key_r,
+ gensec_ntlmssp_state->crypt.ntlm2.recv_sign_key.data,
+ 16);
+ } else {
+ ntlm_seqnum = gensec_ntlmssp_state->crypt.ntlm.seq_num;
+ ntlm_state = *gensec_ntlmssp_state->crypt.ntlm.arcfour_state;
+ }
+
+ status = gensec_ntlmssp_check_packet(gensec_security, sig_mem_ctx,
+ out->data, out->length,
+ out->data, out->length,
+ &sig);
+ if (!NT_STATUS_IS_OK(status)) {
+ NTSTATUS check_status = status;
+ /*
+ * The Windows LDAP libraries seems to have a bug
+ * and always use sealing even if only signing was
+ * negotiated. So we need to fallback.
+ */
+
+ if (gensec_ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+ gensec_ntlmssp_state->crypt.ntlm2.recv_seq_num = ntlm2_seqnum_r;
+ *gensec_ntlmssp_state->crypt.ntlm2.recv_seal_arcfour_state = ntlm2_state_r;
+ memcpy(gensec_ntlmssp_state->crypt.ntlm2.recv_sign_key.data,
+ ntlm2_key_r, 16);
+ } else {
+ gensec_ntlmssp_state->crypt.ntlm.seq_num = ntlm_seqnum;
+ *gensec_ntlmssp_state->crypt.ntlm.arcfour_state = ntlm_state;
+ }
+
+ status = gensec_ntlmssp_unseal_packet(gensec_security,
+ sig_mem_ctx,
+ out->data,
+ out->length,
+ out->data,
+ out->length,
+ &sig);
+ if (NT_STATUS_IS_OK(status)) {
+ gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
+ } else {
+ status = check_status;
+ }
+ }
+ return status;
} else {
*out = *in;
return NT_STATUS_OK;