summaryrefslogtreecommitdiffstats
path: root/source/libsmb/smbencrypt.c
Commit message (Collapse)AuthorAgeFilesLines
* sys_select added one more argument (read, write selectors).Luke Leighton1999-12-011-52/+50
|
* previous commit added an abstraction function that didn't even haveLuke Leighton1999-11-251-6/+3
| | | | | struct cli_state, uint16 fnum into the code: rpc_hnd_api_req(). modified cli_lsarpc.c to use this. the rest is const issues.
* implement server-side generation of NTLMv2 session key. YESSS :-)Luke Leighton1999-11-211-0/+28
|
* you know what? this sort of thing makes me laugh. hmm, what functionsLuke Leighton1999-11-211-1/+1
| | | | | | | | | | | | | | | | | | | | have we got. and what data do we have. hmm.. i wonder what the NTLMv2 user session key can be... hmmm... weell.... there's some hidden data here, generated from the user password that doesn't go over-the-wire, so that's _got_ to be involved. and... that bit of data took a lot of computation to produce, so it's probably _also_ involved... and md4 no, md5? no, how about hmac_md5 yes let's try that one (the other's didn't work) oh goodie, it worked! i love it when this sort of thing happens. took all of fifteen minutes to guess it. tried concatenating client and server challenges. tried concatenating _random_ bits of client and server challenges. tried md5 of the above. tried hmac_md5 of the above. eventually, it boils down to this: kr = MD4(NT#,username,domainname) hmacntchal=hmac_md5(kr, nt server challenge) sess_key = hmac_md5(kr, hmacntchal);
* The First Necessary UNICODE String Support.Luke Leighton1999-11-191-19/+67
| | | | | | | | | the random workstation trust account password is TOTAL garbage. i mean, complete garbage. it's nowhere CLOSE to being a UNICODE string. therefore we can't just take every second character. created nt_owf_genW() which creates NT#(password) instead of NT#(Unicode(pw)). followed through to the password setting in srv_samr.c
* samuserset <username> -p password. YESSSSS :)Luke Leighton1999-11-041-0/+11
| | | | you have to use "ntlmv1" at the moment (i.e set client ntlmv2 = no).
* adding experimental set user password command to rpcclient, it returnsLuke Leighton1999-11-041-0/+66
| | | | error wrong password against nt. ????
* adding CAP_EXTENDED_SECURITY support in a hurry last week. forgot toLuke Leighton1999-10-141-0/+29
| | | | deal with linking issues in other binaries
* removed old code/comments.Luke Leighton1999-06-291-66/+0
|
* smbclient modified to use cli_establish_connection(). smbclient thereforeLuke Leighton1999-06-291-5/+11
| | | | | | now uses improved authentication. smbclient now "broken" for "scripts" based on DEBUG() output. cli_establish_connection() requires modification to support old scripts.
* improving authentication code (tidyup).Luke Leighton1999-06-291-42/+229
|
* fixed issues with "Welcome to SAMBA Domain" for when admin user/pass isLuke Leighton1999-03-251-1/+1
| | | | | used to add workstation to domain. unix account db not modified: only SAM password db is used.
* NULL pointer handling in nt_lm_owf_genLuke Leighton1999-03-241-1/+4
|
* return type of nt_decrypt_string2 set to BOOL.Luke Leighton1999-03-191-4/+3
|
* Implemented encryption algorithm used for a number of RPC buffers.Matthew Chapman1999-03-191-0/+45
| | | | | | | (actually, decryption only currently because I need to get some sleep). Basically another Microsoft twist on DES; the "master key" is the user's NT hash MD4'd and subsets of this are chosen as the 56-bit DES keys.
* UNICODE cleanup (see lib/util_unistr.c).Matthew Chapman1999-02-121-1/+1
| | | | | | No more ugly static library buffers and all functions take a destination string length (especially unistrcpy was rather dangerous; we were only saved by the fact that datagrams are limited in size).
* the UNICODE issue...Luke Leighton1999-02-111-1/+1
|
* UNICODE byte ordering issue: typecast to uint16* replaced with SSVAL()Luke Leighton1999-02-081-1/+1
|
* largely rewrote smbpasswd so that the code is understandable. ThisAndrew Tridgell1998-11-121-1/+1
| | | | | | | | | | | | | should allow us to call a function in swat rather than piping to smbpasswd. while doing this I also fixed quite a few "const char *" versus "char *" issues that cropped up while using const to track down bugs in the code. This led to changes in several generic functions. The smbpasswd changes should be correct but they have not been extensively tested. At least if I have introduced bugs then we should be able to fix them more easily than before.
* - dce/rpc codeLuke Leighton1998-10-191-1/+1
| | | | | | | | | | | | | | | | | | | - removed debug info in struni2 and unistr2 (security risk) - rpc_pipe function was getting pointer to data then calling realloc *dur* - password check function, the start of "credential checking", user, wks, domain, pass as the credentials (not just user,pass which is incorrect in a domain context) - cli_write needs to return ssize_t not size_t, because total can be -1 if the write fails. - fixed signed / unsigned warnings (how come i don't get those any more when i compile with gcc???) - nt password change added in smbd. yes, jeremy, i verified that the SMBtrans2 version still works.
* warnings spotted by ./configure.developer optionsLuke Leighton1998-10-141-0/+2
|
* dce/rpcLuke Leighton1998-10-101-4/+14
|
* dce/rpcLuke Leighton1998-10-091-0/+23
|
* dce/rpcLuke Leighton1998-10-091-0/+6
|
* dce/rpcLuke Leighton1998-10-071-0/+12
|
* - static function "create_new_hashes" was identical to "nt_lm_owf_gen".Luke Leighton1998-10-021-10/+36
| | | | | | | | | | create_new_hashes didn't zero the buffer for the md4hash: nt_lm_owf_gen did, because jeremy sorted this out a couple of days ago. call nt_lm_owf_gen instead. - call SMBOWFencrypt from SMBencrypt and SMBNTencrypt. - added #ifdef DEBUG_PASSWORD debug password calls.
* Fixed *nasty* bug in nt_lm_owf_gen() - this function wasJeremy Allison1998-10-011-1/+3
| | | | | | not ensuring a zero filled buffer before doing crypto stuff. See PR#10121. Beware of this ! Jeremy.
* Got very strict about the differences and uses ofJeremy Allison1998-09-291-1/+1
| | | | | | | uid_t, gid_t and vuid. Added sys_getgroups() to get around the int * return problem. Set correct datatypes for all uid, gid and vuid variables. Jeremy.
* uchar / char typecast issuesLuke Leighton1998-09-291-1/+1
|
* added rpcclient programLuke Leighton1998-09-251-0/+35
|
* tridge the destroyer returns!Andrew Tridgell1998-09-051-23/+0
| | | | | | | | | | | | | | | | | | | | | | prompted by the interpret_security() dead code that Jean-Francois pointed out I added a make target "finddead" that finds potentially dead (ie. unused) code. It spat out 304 function names ... I went through these are deleted many of them, making others static (finddead also reports functions that are used only in the local file). in doing this I have almost certainly deleted some useful code. I may have even prevented compilation with some compile options. I apologise. I decided it was better to get rid of this code now and add back the one or two functions that are needed than to keep all this baggage. So, if I have done a bit too much "destroying" then let me know. Keep the swearing to a minimum :) One bit I didn't do is the ubibt code. Chris, can you look at that? Heaps of unused functions there. Can they be made static?
* This is *not* a big change (although it looks like one).Jeremy Allison1998-01-221-1/+1
| | | | | | | This is merely updating the Copyright statements from 1997 to 1998. It's a once a year thing :-). NO OTHER CHANGES WERE MADE. Jeremy.
* Rolled back tree state to 11:59pm 8th November 1997 EST toJeremy Allison1997-11-101-16/+6
| | | | | remove problems. Jeremy
* attempting to mark up 32 bit error codes, needed for NT domains.Luke Leighton1997-11-091-6/+16
| | | | | | | | | | | | separated out smb server-mode password validation into a separate file. added called and calling netbios names to client gen state: referenced section in rfc1002.txt. created workstation trust account checking code in ntclient.c there might be a bug in reply_session_setup_andX. i indented and added { } around single-line if statements: the lm password checking code now doesn't look right (around the GUEST_SESSSETUP bits). *no code semantics have been changed by the indentation process*.
* fix some casting errors in smbencrypt and some multiply-defined errorsAndrew Tridgell1997-10-261-5/+5
| | | | | | in clientutil.c (Luke, you can't just copy a global variable declaration from one file to another, you need to declare one of them extern)
* Makefile :Luke Leighton1997-10-251-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | adding bits for new nt domain code byteorder.h : trying to get macros right, and not to crash on SUNOS5... client.c : added #ifdef NTDOMAIN, and created do_nt_login() function. don't want to have to recompile client.c unless absolutely necessary. credentials.c : moved deal_with_creds() [possibly inappropriately] into credentials.c ipc.c reply.c server.c uid.c : attempting to make (un)become_root() functions calleable from smbclient. this is a little tricky: smbclient might have to be another setuid root program, immediately setuid'ing to non-root, so that we can reset-uid to root to get at the smbpasswd file. or, have a secure pipe mechanism to smbd to grab smbpasswd entries. or the like. smbdes.c smbencrypt.c : created a function to generate lm and nt owf hashes. lsaparse.c ntclient.c smbparse.c : added nt client LSA_AUTH2 code. it works, too! pipenetlog.c pipentlsa.c pipesrvsvc.c : simplification. code-shuffling. getting that damn offset right for the opcode in RPC_HDR. smb.h : changed dcinfo xxx_creds to DOM_CRED structures instead of DOM_CHAL. we might need to store the server times as well. proto.h : the usual.
* - change generate_challenge() to use md4 instead of desAndrew Tridgell1997-09-161-23/+0
| | | | | | | | | | | | | | | | | | | | | | | - move routines about a bit between smbencrypt.c and smbdes.c. Ensure that there is no entry point for normal DES operation - add the following comment: This code is NOT a complete DES implementation. It implements only the minimum necessary for SMB authentication, as used by all SMB products (including every copy of Microsoft Windows95 ever sold) In particular, it can only do a unchained forward DES pass. This means it is not possible to use this code for encryption/decryption of data, instead it is only useful as a "hash" algorithm. There is no entry point into this code that allows normal DES operation. I believe this means that this code does not come under ITAR regulations but this is NOT a legal opinion. If you are concerned about the applicability of ITAR regulations to this code then you should confirm it for yourself (and maybe let me know if you come up with a different answer to the one above)
* rewrote md4.c from scratch. This implementation should be portable andAndrew Tridgell1997-09-151-14/+5
| | | | doesn't have any worries about RSA copyright.
* This commit does 3 main things:Andrew Tridgell1997-09-141-63/+10
| | | | | | | | | | | | | | | | | | | | | | | 1) put the encryption code in by default, with no #ifdef. It is still disabled by default so you need to add "encrypt passwords = yes" in smb.conf but at least all binaries will have it. 2) cleanup the kanji code so it compiles with no warnings 3) get rid of lots of uses of ugly non-portable C code. The main offender being things like "register" but also remove uses of the "const" keyword as there are compilers out there that don't support it and even those that do often complain about its usage. Users don't like warnings :-( There is still some work to do. We need to replace the md4 code with our own implementation. The current code (from rfc1186) is PD but is not very portable. The new RFC (rfc1320) is more portable but adds copyright restrictions. I'll do a from-scratch MD4 soon. We also need to test that what I've implemented is portable. It should be, but I'm too tired right now to test it on anything other than intel linux.
* 'The mother of all checkins' :-). Jeremy Allison (jallison@whistle.com)Samba Release Account1997-05-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Wed May 7 1997: Update for 1.9.17alpha1 release - 'browsefix release' designed to make browsing across subnets work. byteorder.h: Updated copyright to 1997. charcnv.c: Updated copyright to 1997. charset.c Updated copyright to 1997. charset.h Updated copyright to 1997. client.c Updated copyright to 1997. clientutil.c Updated copyright to 1997. dir.c Updated copyright to 1997. fault.c Updated copyright to 1997. includes.h Updated copyright to 1997. interface.c Updated copyright to 1997. ipc.c Updated copyright to 1997. kanji.c Updated copyright to 1997. kanji.h Updated copyright to 1997. loadparm.c Updated copyright to 1997. locking.c Updated copyright to 1997. mangle.c Updated copyright to 1997. message.c Updated copyright to 1997. nameannounce.c Made use of WINS subnet explicit. Added reset_announce_timer() so announcement can be made immediately when we become a master. Expanded code to do sync with dmb. namebrowse.c Removed redundent checks for AM_MASTER in sync code. Made use of WINS subnet explicit. namedbname.c Made use of WINS subnet explicit. namedbresp.c Made use of WINS subnet explicit. namedbserver.c Made use of WINS subnet explicit. namedbsubnet.c Explicitly add workgroup to WINS subnet when we become a dmb. Made use of WINS subnet explicit. namedbwork.c Made use of WINS subnet explicit. Removed redundent check_work_servertype() function. nameelect.c Explicitly add workgroup to WINS subnet when we become a master browser. Made use of WINS subnet explicit. namelogon.c Updated copyright to 1997. namepacket.c Updated copyright to 1997. namequery.c Updated copyright to 1997. nameresp.c Made use of WINS subnet explicit. Made nmbd fail if configured as master browser and one exists already. nameserv.c Made use of WINS subnet explicit. Remove redundent logon server and domain master code. nameserv.h Add emumerate subnet macros. nameservreply.c Made use of WINS subnet explicit. nameservresp.c Updated copyright to 1997. namework.c Made use of WINS subnet explicit. Updated code to add sync browser entries to add subnet parameter. nmbd.c Added sanity check for misconfigured nmbd. nmblib.c Updated copyright to 1997. nmblookup.c Updated copyright to 1997. nmbsync.c Removed redundent AM_ANY_MASTER check. params.c Updated copyright to 1997. password.c Updated copyright to 1997. pipes.c Updated copyright to 1997. predict.c Updated copyright to 1997. printing.c Updated copyright to 1997. proto.h Changed protos for new nmbd code. quotas.c Updated copyright to 1997. replace.c Updated copyright to 1997. reply.c Updated copyright to 1997. server.c Updated copyright to 1997. shmem.c Updated copyright to 1997. smb.h Updated copyright to 1997. smbencrypt.c Updated copyright to 1997. smbpasswd.c Updated copyright to 1997. smbrun.c Updated copyright to 1997. status.c Updated copyright to 1997. system.c Updated copyright to 1997. testparm.c Updated copyright to 1997. testprns.c Updated copyright to 1997. time.c Updated copyright to 1997. trans2.c Updated copyright to 1997. trans2.h Updated copyright to 1997. uid.c Updated copyright to 1997. username.c Updated copyright to 1997. util.c Updated copyright to 1997. version.h Changed to 1.9.17alpha1.
* Fixed for FreeBsd.Samba Release Account1996-12-101-0/+8
| | | | jra@cygnus.com
* - added support for TMPDIR env variableAndrew Tridgell1996-10-241-4/+4
| | | | | | - fixed fault.c for linux 2.1 - put back in the FIND_SELF failing code - cleaned up casts in encryption
* got rid of a lot of redundent header files as we now globally generateAndrew Tridgell1996-06-101-1/+0
| | | | | prototypes automatically using "make proto". This is much less prone to error than the old method of manually adding prototypes
* a huge pile of changes :-)Andrew Tridgell1996-06-041-14/+1
| | | | | | | | The biggest thing is the integration of Lukes new nmbd. Its still largely untested, so we will really need some feedback I've also added auto prototype generation and cleaned up a lot of minor things as a result
* cleanups to make thinsg compile cleanlyAndrew Tridgell1996-05-291-1/+1
|
* Initial version imported to CVS Samba Release Account1996-05-041-0/+202
generated by cgit (git 2.34.1) at 2025-09-25 16:36:18 +0000