summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Add helper to compute extended security challengeSimo Sorce2014-08-072-14/+36
|
* Add support for NTLMv1 auth to the serverSimo Sorce2014-08-073-24/+77
| | | | Fixes also condition on when to test for a LM Response on the server.
* Add functions to verify NTLMv1 responsesSimo Sorce2014-08-072-0/+72
|
* Fix NTLMv1 client authSimo Sorce2014-08-071-8/+15
| | | | | | The worn nt/lm response buffers were being used after the version specific processing. Use always the same buffers for both protocols to avoid issues.
* Pass ctx and cred to external_xxx_auth functionsSimo Sorce2014-08-073-36/+24
| | | | This allows external auth mechanisms to see all the data they may need.
* Support client authentication using WinbindSimo Sorce2014-08-076-1/+151
| | | | | | | | | | | | Based on a patch by David Woodhouse <David.Woodhouse@intel.com> Original commit message: We need to screw around with the flags a little, since winbind doesn't really get it right. Thankfully, it doesn't support MIC and it does at least generally do the right thing (w.r.t. session negotiation and OEM vs. Unicode) so it's sufficient just to screw with the flags. Tested with Negotiate authentication to squid, and NTLM in datagram mode with pidgin-sipe. Also with Firefox, Chrome and a fixed libcurl.
* Add call to get names from winbindSimo Sorce2014-08-073-0/+41
| | | | Based on David Woodhouse work.
* Add call to get creds from winbindSimo Sorce2014-08-073-0/+65
| | | | Based on David Woodhouse work.
* Add external server auth support via WinbindSimo Sorce2014-08-075-2/+77
| | | | | | If wbclient support is available we can now check domain credentials against a Domain Controller. Requires a configured Winbind (or cmpatible) service on the host.
* Initial build support for detecting and using libwbclientSimo Sorce2014-08-072-1/+12
|
* Move client auth bits to gss_authSimo Sorce2014-08-073-266/+304
| | | | | This will makes it easier to plug in external auth handlers like winbind.
* Move sec_req flags in the context handlerSimo Sorce2014-08-073-30/+22
|
* Use helpers to get the local netbios namesSimo Sorce2014-08-074-54/+125
| | | | | | | | | move out fetching of the computer and domain netbios names. Names are still fetched from environment variables, or external sources (like winbind) or defaults are used. Based on work from David Woodhouse.
* Move local key and flags computations to the endDavid Woodhouse2014-08-071-17/+17
| | | | | | These can be safely done later and are in the way here. We're going to want to use these with winbind auth, *after* it has computed the auth message.
* Add support to perform external operationsSimo Sorce2014-08-077-60/+188
| | | | | | | This allows the code to know it has to use an external mechanism, such as winbind, to handle authentication. Based on work from David Woodhouse <David.Woodhouse@intel.com>
* Move all message structures to ntlm_common.hDavid Woodhouse2014-08-072-22/+23
| | | | | struct wire_auth_msg was already there, we're about to want access to struct wire_chal_msg, and we might as well keep them together.
* Let caller decide whether to (un)seal or notSimo Sorce2014-08-071-8/+0
| | | | | Windows seem to ignore the sealing flag and seal anyway at least in some case, so leave the decision to the caller.
* Fix order of signature vs payloadSimo Sorce2014-08-072-11/+7
| | | | | | | | | The code was dead wrong and putting the cart before the horses. The correct framing is to put the signature first an then the encrypted payload. we were doing the opposite ... how embarrassing. A milliong thanks to David Woodhouse for his persistence in testing and assisting in finding out the issue.
* Internalize extended security and datagram statusSimo Sorce2014-08-064-126/+164
| | | | | | | | Move handling of datagram status with ntlm_crypto routines, this way ntlm_seal_regen becomes an internal detail. Also better separate exended security and legacy sign/seal crypto state generation and general handling in sign/seal functions
* Introduce ntlm_signseal_stateSimo Sorce2014-08-067-164/+151
| | | | This structure keeps the crypto state closer to the crypto routines.
* Use a macro to define the ntlm signature sizeSimo Sorce2014-08-063-22/+31
| | | | | Avoids the look of magic numbers everywhere, and give some useful context to the code reader
* Implement gss_wrap_size_limit()Simo Sorce2014-08-063-0/+53
|
* Fix sealing key regen with shorter keysSimo Sorce2014-08-062-3/+3
| | | | | At LM_COMPAT_LEVEL 0 there is no exteded security and initial sealing keys are 8 byte long.
* Fix unsealing without extended session securitySimo Sorce2014-08-061-7/+8
| | | | ntlm_unseal should be symmetric to ntlm_seal
* Fix flag clearingSimo Sorce2014-08-061-1/+0
| | | | | | NTLMSSP_REQUEST_NON_NT_SESSION_KEY is not in itself incompatble with NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY, although it is only used is Extended Security is not Negotiated.
* Generate LM hash when getting pwd from cred_storeSimo Sorce2014-08-061-0/+8
| | | | | This is needed when NTLMSSP_NEGOTIATE_LM_KEY is used at lower, LM_COMPTE_LEVEL (eg, level 0) by a client and NTLMv1 auth.
* Fix rpmbuildSimo Sorce2014-08-011-0/+1
| | | | create dir containg config file or rpm generaion may fail
* Bump up to pre-release statusSimo Sorce2014-07-311-2/+2
|
* Install mechanism configuration in mech.dSimo Sorce2014-07-312-8/+8
| | | | This will automatically enable the mechanism upon install.
* Silence const errorsSimo Sorce2014-07-122-3/+5
|
* Cast to (char *) not (void *) to do pointer mathSimo Sorce2014-07-122-10/+10
|
* Add gss_localname supportSimo Sorce2014-07-123-0/+79
| | | | | | Uses the fully qualified name and falls back to simple user name and calls getpwnam_r() to resolve a local name. If the user is not known to the nsswitch subsystme it returns a failure.
* Handle missing name calling acquire creds.Simo Sorce2014-07-111-13/+41
| | | | | | | In the GSS_C_ACCEPT (acceptor/server) case we would end up segfalting if no name was provided. Instead allow a null desired_name and load the default server name if none is passed in, just like gss_accept_sec_context() does i this case.
* Release 0.4.0v0.4.0Simo Sorce2014-06-211-1/+1
|
* Fix const warningsSimo Sorce2014-06-212-40/+73
| | | | | Just discard the const and silence the warnings, where safe; rework assignments were possible.
* Fix Makefile cflags useSimo Sorce2014-05-171-2/+2
|
* Fix memory leak in NTLMv2 acceptor codeSimo Sorce2014-05-171-0/+3
|
* Release Candidate 2 for 0.4.0Simo Sorce2014-05-051-1/+1
|
* Add way to talk about MIC with SPNEGOSimo Sorce2014-05-056-12/+106
| | | | | | | | | | | | | | | As agreed with MIT people, add an inquire mechanism that serves 2 roles. On the one hand, if the spnego mechanism makes this call at all it means it is recent enough to support forcing the mechlistMIC on if we create an Authenticate message MIC. So remove the environment variable and instead depend on the SPNEGO layer to call this function before the Authenticate token is generated (usually right after the Negotiate token has been produced). On the other hand if this function has been called assume SPNEGO will call again right after the authenticate message has been genrated to know whether the mechlistMIC needs to be added.
* Release Candidate 1 for 0.4.0Simo Sorce2014-05-041-2/+2
|
* Disable MIC by default.Simo Sorce2014-05-041-1/+11
| | | | | | | | | | | | The environment variable NTLMSSP_ENABLE_MIC will enable setting the MIC if requested by the server when it is set to '1'. It is disabled by default because it works only with a patched SPNEGO library that will always set the mechlistMIC on the authenticate packet if we report that integrity is enabled. If the libray is unpatched it has also been observed that Firefox will go in an infinite authentication loop while it keeps trying to make requests that are always denied.
* Provide the correct target name in the challengeSimo Sorce2014-05-041-2/+13
| | | | | | | | MS-NLMP prescribes in 3.2.5.1.1 that the server should send the NetbIOS Domain name if joined to a domain or the NetBIOS computer name if standalone. Never the DNS computer name. Also do not add a target_name entry in the target_info field, it is not required and Windows does not do that.
* Check netbios computer and domain name when neededSimo Sorce2014-05-043-4/+15
| | | | | | MS-NLMP 3.1.5.1.2 says a client must fail to communicate if NTLMv2 is used, Integrity or Confidentiality are required and NetBIOS Computer or Domain Name are not present in the Challenge message from the server.
* Always provide netbios computer and domain nameSimo Sorce2014-05-041-9/+79
| | | | | | | | | | These are necessary by spec (MS-NLMP 3.1.5.1.2) if the server sends a target_info field in the challenge message, which we do. Uses environment variables NETBIOS_COMPUTER_NAME and NETBIOS_DOMAIN_NAME to set NetBIOS data. If they are not available the server name truncated to the first '.' (if any) will be used and the domain is set to the generic "WORKGROUP" name.
* Test Challenge V2 message with CBT test vectorsSimo Sorce2014-05-041-7/+465
|
* Verify Channel Bindings in accept_sec_contextSimo Sorce2014-05-041-1/+24
|
* Add support for setting CBT in the clientSimo Sorce2014-05-043-2/+28
|
* Add function to verify Channel Binding TokenSimo Sorce2014-05-042-0/+27
|
* Add function to calculate channel bindings hashSimo Sorce2014-05-042-0/+39
|
* Get av_flags and check MIC if a client sent itSimo Sorce2014-05-041-4/+25
| | | | | | | Gets the target_info structure from the NT Response (if any is available) and extract the av_flags. If the appropriate flag is set verify the MIC previously extracted.
generated by cgit (git 2.34.1) at 2024-05-03 05:08:47 +0000