summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Add placeholder inquire_nameHEADmasterSimo Sorce2015-06-063-0/+25
| | | | | | | | | Otherwise in some cases MIT's GSSAPI can crash after trying to inquire a name. For example see: https://github.com/modauthgssapi/mod_auth_gssapi/issues/34 Signed-off-by: Simo Sorce <simo@redhat.com>
* Return actual mech on accept context tooSimo Sorce2015-04-191-0/+1
| | | | Related #5
* Fix gss_inquire_cred with no credsSimo Sorce2015-04-191-5/+16
| | | | | | | | | | | | For GSS_Inquire_cred RFC 2743 specifies: Input: o cred_handle CREDENTIAL HANDLE -- if GSS_C_NO_CREDENTIAL -- is specified, default initiator credentials are queried Thanks to Isaac Boukris for the inital patch on which this one is based. Fixes: https://fedorahosted.org/gss-ntlmssp/ticket/6
* Return the actual_mech_type when requestedSimo Sorce2015-04-041-0/+1
| | | | Fixes #5
* Fix length check of nt_responsefix32bitSimo Sorce2015-03-191-3/+1
| | | | | | | | | An array passed as a function argument is just a cosmetic ay to pass just a pointer. Therefore sizeof(array) will only return the pointer length, not the array length, and on 32 bit pointers are 4 bytes long. Fix payload calculation by passing in the known correct length instead of using fancy sizeofs ...
* Support openssl optimized 32bit RC4 key packingSimo Sorce2015-03-192-18/+15
| | | | | | | | | Openssl detects at runtime the CPU type and on some 32 bit CPUs will automatically switch to a compressed schedule for the RC4_KEY. Don't try to be too smart nd just copy all the data even if it takes 4 times the space. The code still assumes sizeof(RC4_INT) == sizeof(uint32_t)
* Fix incorrect import of exported_session_keySimo Sorce2015-03-191-1/+1
|
* Names with a . in the domain are enteprise namesSimo Sorce2015-01-061-3/+10
| | | | | | | | | | | | This allows people to put in an email address as the source name and have i treated automatically as an enterprise name as well. Although technically NetBIOS names can have dots it is unlikely and the user@domain form is generally undestood to be used with UPNs and email like addresses which use the DNS Domain Name. The fallback case for NetBIOS domain names with a dot is to configure the client to use the DOMAIN\user name form instead.
* Put comments before translatable stringsDavid Woodhouse2014-08-111-30/+30
| | | | | | xgettext will helpfully include and comment which precedes the string in the pot file to aid in translation. So put the comments with the error numbers *before* the corresponding strings.
* Fix typos in error stringsDavid Woodhouse2014-08-111-2/+2
|
* Use NLS for translating error messages in gssntlm_display_status()David Woodhouse2014-08-111-34/+39
|
* Include config.h in gss_err.c, fix GNU strerror_r() code pathDavid Woodhouse2014-08-111-1/+3
| | | | We really ought to be including config.h consistently...
* Always send NetBIOS Domain NameSimo Sorce2014-08-104-2/+25
| | | | | | | | | Apparently Windows (2012 at least) refuses to authenticate if the target_info field in the challenge message lacks the NetBIOS Domain name. So Always set the fake the nb_domain_name if not available, but do not mark the server as a domain member in that case.
* Add --with-wbclient configure flagSimo Sorce2014-08-101-2/+0
|
* Add more custom error messageSimo Sorce2014-08-1010-118/+168
| | | | This should make error reporting a little bit better.
* Add support for printing internal NTLM error codesSimo Sorce2014-08-102-1/+21
|
* Add macros to handle returning errorsSimo Sorce2014-08-108-523/+575
| | | | | | These macros prevent the chance of not setting minor_status approproiately. They also hook into the tracing system, so any time an error is set, then it can be traced to exactly what finction (and in which line) it was set.
* Add debug helpers to be used to trace gss-ntlmsspSimo Sorce2014-08-103-0/+71
| | | | | | If the GSSNTLMSSP_DEBUG environment variable is set to a file that can be opened for writing, then trace information will be written to that file whenever DEBUG macros are called in the code.
* Add support for both strerror_r variantsSimo Sorce2014-08-101-0/+17
|
* We can handle only mech status codesSimo Sorce2014-08-101-0/+6
| | | | | | | Return an error if status_type is bogus. We can't call gss_display_status() for GSS_C_GSS_CODE because we'd loop back to ourselves as unfortunately the GSSAPI mechanisms SPI uses the same symbol names as the public API ...
* Add gssntlm_display_status()David Woodhouse2014-08-103-0/+85
|
* Offer OEM charset support in the negotiate packetSimo Sorce2014-08-102-1/+26
| | | | | | | But make sure to clear out flags once we receive the challenge packet or we end up with both (OEM and UNICODE) flags set when we generate the AUTH package. Special care needs to be taken for DATAGRAM packets, as they are special.
* Do not send domain/workstation name in nego_msgSimo Sorce2014-08-101-10/+1
| | | | | Modern Windows OSs also completely ignore sending any of this stuff, so just stop sending it ourselves, it's generally ignored anyway.
* Ignore domain and workstation in negotiate messageSimo Sorce2014-08-082-9/+7
| | | | | We never use these fields, so do not even attempt to decode them just ignore completely.
* Very old NTLM servers may omit target_infoSimo Sorce2014-08-082-1/+21
| | | | | | | | | | Seem like some very old NTLM server may omit the target_info field entirely in the Challenge message, although MS-NLMP says modern clients SHOULD send and empty target info header even when no target info is being sent. Allow to interoperate with these old servers but always set the target_info field when we generate Challenge packets.
* Improve role managementwinbindSimo Sorce2014-08-083-17/+49
| | | | | A server can be standalone or domain member, improve role management so we can autodetct which role we should assume as a server.
* Fetch server names much earier in the processSimo Sorce2014-08-081-40/+40
| | | | | This is needed to find out if we are "domain joined" by way of checking nb_domain_name, in following patches.
* Fix target info checkSimo Sorce2014-08-081-3/+1
| | | | | Domain name is really just optional, only computer name is mandatory. Domain name can be empty if the server is not a domain member.
* Set the domain name only when available.Simo Sorce2014-08-084-28/+14
| | | | | If we cannot source the domain name do not try to fake it up, just leave it empty and omit it from the negotiation.
* Add helper to check for allowed ntlm versionsSimo Sorce2014-08-084-10/+46
| | | | | Also lower the default lm compat level to 3 for broader compatibility. This allows NTLMv1 with no LM auth.
* Formal adjustment of ntlmv1_signSimo Sorce2014-08-071-2/+2
| | | | | random_pad is always set to 0, so this change makes no difference, however with this change we conform to MS-NLMP 3.4.4.1
* Fix winbindd NTLMv1 Extended Security authSimo Sorce2014-08-071-1/+20
| | | | | | | | In the ntlmv1 extended security case, winbindd wants a pre-digested challenge, this is arguably a bug as Winbind has all the data it needs to compute it by itself ... oh well, just cope. Thanks to David Woodhouse for finding this out.
* Add helper to compute extended security challengeSimo Sorce2014-08-072-14/+36
|
* Add support for NTLMv1 auth to the serverSimo Sorce2014-08-073-24/+77
| | | | Fixes also condition on when to test for a LM Response on the server.
* Add functions to verify NTLMv1 responsesSimo Sorce2014-08-072-0/+72
|
* Fix NTLMv1 client authSimo Sorce2014-08-071-8/+15
| | | | | | The worn nt/lm response buffers were being used after the version specific processing. Use always the same buffers for both protocols to avoid issues.
* Pass ctx and cred to external_xxx_auth functionsSimo Sorce2014-08-073-36/+24
| | | | This allows external auth mechanisms to see all the data they may need.
* Support client authentication using WinbindSimo Sorce2014-08-076-1/+151
| | | | | | | | | | | | Based on a patch by David Woodhouse <David.Woodhouse@intel.com> Original commit message: We need to screw around with the flags a little, since winbind doesn't really get it right. Thankfully, it doesn't support MIC and it does at least generally do the right thing (w.r.t. session negotiation and OEM vs. Unicode) so it's sufficient just to screw with the flags. Tested with Negotiate authentication to squid, and NTLM in datagram mode with pidgin-sipe. Also with Firefox, Chrome and a fixed libcurl.
* Add call to get names from winbindSimo Sorce2014-08-073-0/+41
| | | | Based on David Woodhouse work.
* Add call to get creds from winbindSimo Sorce2014-08-073-0/+65
| | | | Based on David Woodhouse work.
* Add external server auth support via WinbindSimo Sorce2014-08-074-1/+74
| | | | | | If wbclient support is available we can now check domain credentials against a Domain Controller. Requires a configured Winbind (or cmpatible) service on the host.
* Move client auth bits to gss_authSimo Sorce2014-08-073-266/+304
| | | | | This will makes it easier to plug in external auth handlers like winbind.
* Move sec_req flags in the context handlerSimo Sorce2014-08-073-30/+22
|
* Use helpers to get the local netbios namesSimo Sorce2014-08-074-54/+125
| | | | | | | | | move out fetching of the computer and domain netbios names. Names are still fetched from environment variables, or external sources (like winbind) or defaults are used. Based on work from David Woodhouse.
* Move local key and flags computations to the endDavid Woodhouse2014-08-071-17/+17
| | | | | | These can be safely done later and are in the way here. We're going to want to use these with winbind auth, *after* it has computed the auth message.
* Add support to perform external operationsSimo Sorce2014-08-076-60/+186
| | | | | | | This allows the code to know it has to use an external mechanism, such as winbind, to handle authentication. Based on work from David Woodhouse <David.Woodhouse@intel.com>
* Move all message structures to ntlm_common.hDavid Woodhouse2014-08-072-22/+23
| | | | | struct wire_auth_msg was already there, we're about to want access to struct wire_chal_msg, and we might as well keep them together.
* Let caller decide whether to (un)seal or notSimo Sorce2014-08-071-8/+0
| | | | | Windows seem to ignore the sealing flag and seal anyway at least in some case, so leave the decision to the caller.
* Fix order of signature vs payloadSimo Sorce2014-08-072-11/+7
| | | | | | | | | The code was dead wrong and putting the cart before the horses. The correct framing is to put the signature first an then the encrypted payload. we were doing the opposite ... how embarrassing. A milliong thanks to David Woodhouse for his persistence in testing and assisting in finding out the issue.
* Internalize extended security and datagram statusSimo Sorce2014-08-064-126/+164
| | | | | | | | Move handling of datagram status with ntlm_crypto routines, this way ntlm_seal_regen becomes an internal detail. Also better separate exended security and legacy sign/seal crypto state generation and general handling in sign/seal functions
generated by cgit (git 2.34.1) at 2024-05-04 15:40:01 +0000