r874: This patch is a pile of work on NTLMSSP:

Samba's NTLMSSP code is now fully talloc based, which should go a long
way to cleaning up the memory leaks in this code.  This also avoids a
lot of extra copies of data, as we now allocate the 'return' blobs on
a caller-supplied context.

I have also been doing a lot of work towards NTLM2 signing and
sealing.  I have this working for sealing, but not for the verifier
(MD5 integrity check on the stream) which is still incorrect.

(I can aim a rpcecho sinkdata from a Win2k3 box to my server, and the
data arrives intact, but the signature check fails.  It does however
match the test values I have...).

The new torture test is cludged in - when we get a unit test suite
back, I'll happliy put it in the 'right' place....

Andrew Bartlett
(This used to be commit 399e2e2b1149b8d1c070aa7f0d5131c0b577d2b9)

1 files changed, 15 insertions, 24 deletions

diff --git a/source4/librpc/rpc/dcerpc_ntlm.c b/source4/librpc/rpc/dcerpc_ntlm.c
index fa4232c94a..1a216e9885 100644
--- a/source4/librpc/rpc/dcerpc_ntlm.c
+++ b/source4/librpc/rpc/dcerpc_ntlm.c
@@ -26,34 +26,38 @@
   wrappers for the ntlmssp_*() functions
 */
 static NTSTATUS ntlm_unseal_packet(struct dcerpc_security *dcerpc_security, 
-				  uchar *data, size_t length, DATA_BLOB *sig)
+				   TALLOC_CTX *mem_ctx, 
+				   uchar *data, size_t length, DATA_BLOB *sig)
 {
 	struct ntlmssp_state *ntlmssp_state = dcerpc_security->private;
-	return ntlmssp_unseal_packet(ntlmssp_state, data, length, sig);
+	return ntlmssp_unseal_packet(ntlmssp_state, mem_ctx, data, length, sig);
 }
 
 static NTSTATUS ntlm_check_packet(struct dcerpc_security *dcerpc_security, 
+				  TALLOC_CTX *mem_ctx, 
 				  const uchar *data, size_t length, 
 				  const DATA_BLOB *sig)
 {
 	struct ntlmssp_state *ntlmssp_state = dcerpc_security->private;
-	return ntlmssp_check_packet(ntlmssp_state, data, length, sig);
+	return ntlmssp_check_packet(ntlmssp_state, mem_ctx, data, length, sig);
 }
 
 static NTSTATUS ntlm_seal_packet(struct dcerpc_security *dcerpc_security, 
+				 TALLOC_CTX *mem_ctx, 
 				 uchar *data, size_t length, 
 				 DATA_BLOB *sig)
 {
 	struct ntlmssp_state *ntlmssp_state = dcerpc_security->private;
-	return ntlmssp_seal_packet(ntlmssp_state, data, length, sig);
+	return ntlmssp_seal_packet(ntlmssp_state, mem_ctx, data, length, sig);
 }
 
 static NTSTATUS ntlm_sign_packet(struct dcerpc_security *dcerpc_security, 
+				 TALLOC_CTX *mem_ctx, 
 				 const uchar *data, size_t length, 
 				 DATA_BLOB *sig)
 {
 	struct ntlmssp_state *ntlmssp_state = dcerpc_security->private;
-	return ntlmssp_sign_packet(ntlmssp_state, data, length, sig);
+	return ntlmssp_sign_packet(ntlmssp_state, mem_ctx, data, length, sig);
 }
 
 static NTSTATUS ntlm_session_key(struct dcerpc_security *dcerpc_security, 
@@ -137,35 +141,30 @@ NTSTATUS dcerpc_bind_auth_ntlm(struct dcerpc_pipe *p,
 	p->auth_info->credentials = data_blob(NULL, 0);
 	p->security_state = NULL;
 
-	status = ntlmssp_update(state, 
+	status = ntlmssp_update(state, mem_ctx,
 				p->auth_info->credentials,
 				&credentials);
+
 	if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 		goto done;
 	}
 
-	p->auth_info->credentials = data_blob_talloc(mem_ctx, 
-						     credentials.data, 
-						     credentials.length);
-	data_blob_free(&credentials);
+	p->auth_info->credentials = credentials;
 
 	status = dcerpc_bind_byuuid(p, mem_ctx, uuid, version);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-
-	status = ntlmssp_update(state, 
+	status = ntlmssp_update(state, mem_ctx,
 				p->auth_info->credentials, 
 				&credentials);
+
 	if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 		goto done;
 	}
 
-	p->auth_info->credentials = data_blob_talloc(mem_ctx, 
-						     credentials.data, 
-						     credentials.length);
-	data_blob_free(&credentials);
+	p->auth_info->credentials = credentials;
 
 	status = dcerpc_auth3(p, mem_ctx);
 
@@ -187,14 +186,6 @@ NTSTATUS dcerpc_bind_auth_ntlm(struct dcerpc_pipe *p,
 	p->security_state->session_key = ntlm_session_key;
 	p->security_state->security_end = ntlm_security_end;
 
-	switch (p->auth_info->auth_level) {
-	case DCERPC_AUTH_LEVEL_PRIVACY:
-	case DCERPC_AUTH_LEVEL_INTEGRITY:
-		/* setup for signing */
-		status = ntlmssp_sign_init(state);
-		break;
-	}
-
 done:
 	talloc_destroy(mem_ctx);