From dc35442fb163c6f14cf8c5730056a4a094ead85a Mon Sep 17 00:00:00 2001 From: Günther Deschner Date: Thu, 3 Mar 2011 01:05:33 +0100 Subject: s4-nterr: move auth_nt_status_squash to nt_status_squash and move to nterr.c Guenther --- source4/libcli/util/nterr.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'source4/libcli/util') diff --git a/source4/libcli/util/nterr.c b/source4/libcli/util/nterr.c index cb0c081602..ca998bbf6f 100644 --- a/source4/libcli/util/nterr.c +++ b/source4/libcli/util/nterr.c @@ -929,3 +929,30 @@ NTSTATUS nt_status_string_to_code(const char *nt_status_str) } return NT_STATUS_UNSUCCESSFUL; } + +/** + * Squash an NT_STATUS in line with security requirements. + * In an attempt to avoid giving the whole game away when users + * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and + * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations + * (session setups in particular). + * + * @param nt_status NTSTATUS input for squashing. + * @return the 'squashed' nt_status + **/ + +NTSTATUS nt_status_squash(NTSTATUS nt_status) +{ + if NT_STATUS_IS_OK(nt_status) { + return nt_status; + } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) { + /* Match WinXP and don't give the game away */ + return NT_STATUS_LOGON_FAILURE; + + } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) { + /* Match WinXP and don't give the game away */ + return NT_STATUS_LOGON_FAILURE; + } else { + return nt_status; + } +} -- cgit