From fe348fdb28624428269bffeb1ff796ec3857ff66 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Mon, 24 Jul 2006 05:02:38 +0000 Subject: r17216: From Kai Blin : A patch to make ntlm_auth recognize three new commands in ntlmssp-client-1 and squid-2.5-ntlmssp: The commands are the following: Command: SF Reply: OK Description: Takes feature request flags similar to samba4's gensec_want_feature() call. So far, only NTLMSSP_FEATURE_SESSION_KEY, NTLMSSP_FEATURE_SIGN and NTLMSSP_FEATURE_SEAL are implemented, using the same values as the corresponding GENSEC_FEATURE_* flags in samba4. Command: GF Reply: GF Description: Returns the negotiated flags. Command: GK Reply: GK Description: Returns the negotiated session key. (These commands assist a wine project to use ntlm_auth for signing and sealing of bulk data). Andrew Bartlett (This used to be commit bd3e06a0e4435f1c48fa3b7862333efe273119ee) --- source3/libsmb/ntlmssp.c | 50 ++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 44 insertions(+), 6 deletions(-) (limited to 'source3/libsmb/ntlmssp.c') diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c index 986fa8cce9..a6fb3b426b 100644 --- a/source3/libsmb/ntlmssp.c +++ b/source3/libsmb/ntlmssp.c @@ -210,6 +210,50 @@ NTSTATUS ntlmssp_store_response(NTLMSSP_STATE *ntlmssp_state, return NT_STATUS_OK; } +/** + * Request features for the NTLMSSP negotiation + * + * @param ntlmssp_state NTLMSSP state + * @param feature_list List of space seperated features requested from NTLMSSP. + */ +void ntlmssp_want_feature_list(NTLMSSP_STATE *ntlmssp_state, char *feature_list) +{ + /* + * We need to set this to allow a later SetPassword + * via the SAMR pipe to succeed. Strange.... We could + * also add NTLMSSP_NEGOTIATE_SEAL here. JRA. + */ + if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list, True)) { + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN; + } + if (in_list("NTLMSSP_FEATURE_SIGN", feature_list, True)) { + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN; + } + if(in_list("NTLMSSP_FEATURE_SEAL", feature_list, True)) { + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL; + } +} + +/** + * Request a feature for the NTLMSSP negotiation + * + * @param ntlmssp_state NTLMSSP state + * @param feature Bit flag specifying the requested feature + */ +void ntlmssp_want_feature(NTLMSSP_STATE *ntlmssp_state, uint32 feature) +{ + /* As per JRA's comment above */ + if (feature & NTLMSSP_FEATURE_SESSION_KEY) { + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN; + } + if (feature & NTLMSSP_FEATURE_SIGN) { + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN; + } + if (feature & NTLMSSP_FEATURE_SEAL) { + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL; + } +} + /** * Next state function for the NTLMSSP state machine * @@ -1163,12 +1207,6 @@ NTSTATUS ntlmssp_client_start(NTLMSSP_STATE **ntlmssp_state) NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_NTLM2 | NTLMSSP_NEGOTIATE_KEY_EXCH | - /* - * We need to set this to allow a later SetPassword - * via the SAMR pipe to succeed. Strange.... We could - * also add NTLMSSP_NEGOTIATE_SEAL here. JRA. - * */ - NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_REQUEST_TARGET; return NT_STATUS_OK; -- cgit