summaryrefslogtreecommitdiffstats
path: root/src/gss_sec_ctx.c
Commit message (Collapse)AuthorAgeFilesLines
* Verify Channel Bindings in accept_sec_contextSimo Sorce2014-05-041-1/+24
|
* Add support for setting CBT in the clientSimo Sorce2014-05-041-1/+17
|
* Get av_flags and check MIC if a client sent itSimo Sorce2014-05-041-4/+25
| | | | | | | Gets the target_info structure from the NT Response (if any is available) and extract the av_flags. If the appropriate flag is set verify the MIC previously extracted.
* Return target_info from ntlm_decode_auth_msgSimo Sorce2014-05-041-1/+1
| | | | | | | | | The target_info structure embedded in the NT Response message in NTLMv2 contains information needed to establish if the client has sent a valid MIC. So we need to extract and return it if the caller requested it. Also moves some wire structures definitions in common to be able to reuse them.
* Make MIC conditional on integrity being requestedSimo Sorce2014-05-041-1/+2
| | | | | If integrity is requested by any party then the MIC, if requested by the server will be generated, otherwise it will not be.
* Compute MIC in the client when requestedSimo Sorce2014-05-041-3/+20
|
* Use target_info parsing helperSimo Sorce2014-05-041-36/+30
| | | | | Target_info can be optional, but it conflicts with channel bindings being requesed.
* Retry auth with NULL Domain as per specSimo Sorce2014-05-041-23/+37
|
* Fail if the encryption level is not matchedSimo Sorce2014-05-041-0/+6
| | | | | If the client allows only 128bit security but the server does not offer it, then fail the authentication.
* Do not send LM Response on auth to modern serversSimo Sorce2014-05-041-7/+10
| | | | | | | | | | | If a server send a target_info field in a challenge message it means it does not need nor want a LM Response. See also MS-NLMP 3.1.5.1.2 The authenticate message must alwyas send a lm_chalresp and a nt_chalresp fields in the header but they will be simply zero length, yet the payload pointer must point to the valid payload area. (Windows server fail authentication if the LM Response buffer offset is zero).
* Always use Extedned Session Security when possibleSimo Sorce2014-05-041-0/+1
| | | | | MS-NLMP 3.1.5.1.1 recommends to set the extended session security flag if LM authentication is not going to be used.
* Return flags and time when requestedSimo Sorce2014-05-041-0/+14
| | | | | | | The calling application may want to check what flags were actually negotiated. Spnego also depends on the mechanism properly returning flags when integrity is negotiated for MIC purposes.
* Return Client name if requestedSimo Sorce2014-04-121-0/+9
|
* Fix segfault in init context.Simo Sorce2014-01-261-2/+2
| | | | | | | | | | | The init context function was improperly initializing the ctx variable (too late) when some early error conditions can happen. Therefore passing to the delete context function a random memory address it would then try to free. This wuld cause a SEGFAULT in most cases. Additionally unfortunately iconv_close() does not follow good practices and blindignly dereferences data, even if the passed in pointer is NULL. So add a check before calling.
* Implement export context functionSimo Sorce2013-12-151-1/+1
| | | | | The Export format version is set to 0.1 Long term keys are not exported.
* Fix potential leaks in delete_contextSimo Sorce2013-12-151-0/+6
| | | | | | | | Free RC4 state if any Free workstations tring if any Also make sure to safely zero the struct before freeing to avoid leaking any key material.
* Do not copy creds on the contextSimo Sorce2013-12-151-62/+51
| | | | | There is no need to copy creds around, they are always available or retrievable.
* Fix memleaks in init_sec_contextStefan Becker2013-12-131-1/+3
|
* Add way to set sequence numbres.Simo Sorce2013-10-181-0/+48
| | | | | | | | | | | In NTLMSSP connectionless mode applications are supposed to provide the sequence number, however GSSAPI's get_mic and verify_mic functions do not allow to pass an explicit sequence number. Allow to override the context sequence numbers using a custom oid and implemnting gss_set_sec_context_option() Allows the operation only if the context is in connectionless mode.
* Add support for connectionless modeSimo Sorce2013-10-181-46/+117
| | | | | This needs a new GSSAPI flag, for now grab a number and define GSS_C_DATAGRAM_FLAG ourselves.
* Fix handling of NULL domainSimo Sorce2013-10-171-0/+12
| | | | | | | | | Fix segafult in NTOWFv2. When domain is NULL it is just omitted from the NTOWFv2 computation. Fix segfault in accept_sec_context, just make dom_name be an empty string. Fix also memory leaks.
* Add implementation of gss_inquire_contextSimo Sorce2013-08-211-0/+110
| | | | Also add source and target names to the context.
* Basic implementation of accept_sec_contextSimo Sorce2013-08-181-3/+446
| | | | For now works only for satndalone server with access to a password file.
* Helper function to check lm compatibility levelSimo Sorce2013-07-281-4/+5
| | | | Also stop associating it with th creds struct.
* Fix message type checkSimo Sorce2013-07-281-1/+1
|
* Add gss_context_time() implementationSimo Sorce2013-07-281-1/+23
|
* Helper function to check security context validitySimo Sorce2013-07-281-0/+1
|
* Add expiration time checksSimo Sorce2013-07-281-0/+12
| | | | | | | | | Check Maxlife for challenge response messages. Also add a Maximum lifetime for the context itself based on the same challene/response maximum life. According to MS-NLMP MaxLifetime is 36h on modern Windows OSs, use the same for now.
* Add NTLMv1 support to context initializationSimo Sorce2013-07-181-5/+56
|
* Initial GSS Mechanism code.Simo Sorce2013-07-181-0/+514
Implements init sec context and basic mechanism initialization.
generated by cgit (git 2.34.1) at 2024-06-19 20:21:14 +0000