diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-12-06 12:08:50 +0100 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2014-01-07 16:53:31 +0100 |
| commit | 7d2abf520df1ff46d79dfd8ff579c230f2bc3c2a (patch) | |
| tree | 45db20cc0e1468d98509cf23e05f30331124ec0c | |
| parent | 2e36fbc77dc43f31ec78cdbef23b94bd00d6f565 (diff) | |
| download | samba-7d2abf520df1ff46d79dfd8ff579c230f2bc3c2a.tar.gz samba-7d2abf520df1ff46d79dfd8ff579c230f2bc3c2a.tar.xz samba-7d2abf520df1ff46d79dfd8ff579c230f2bc3c2a.zip | |
s4:netlogon: implement "allow nt4 crypto" and "reject md5 clients" features.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan 7 16:53:31 CET 2014 on sn-devel-104
| -rw-r--r-- | source4/rpc_server/netlogon/dcerpc_netlogon.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c index eb15c7fed8..0dd215df6c 100644 --- a/source4/rpc_server/netlogon/dcerpc_netlogon.c +++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c @@ -93,6 +93,9 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3(struct dcesrv_call_state *dce_ca const char *account_name; uint32_t server_flags = 0; uint32_t negotiate_flags = 0; + bool allow_nt4_crypto = lpcfg_allow_nt4_crypto(dce_call->conn->dce_ctx->lp_ctx); + bool reject_des_client = !allow_nt4_crypto; + bool reject_md5_client = lpcfg_reject_md5_clients(dce_call->conn->dce_ctx->lp_ctx); ZERO_STRUCTP(r->out.return_credentials); *r->out.rid = 0; @@ -125,6 +128,23 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3(struct dcesrv_call_state *dce_ca negotiate_flags = *r->in.negotiate_flags & server_flags; + if (negotiate_flags & NETLOGON_NEG_STRONG_KEYS) { + reject_des_client = false; + } + + if (negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) { + reject_des_client = false; + reject_md5_client = false; + } + + if (reject_des_client || reject_md5_client) { + /* + * Here we match Windows 2012 and return no flags. + */ + *r->out.negotiate_flags = 0; + return NT_STATUS_DOWNGRADE_DETECTED; + } + /* * According to Microsoft (see bugid #6099) * Windows 7 looks at the negotiate_flags |