sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code
127,036 Commits 60 Branches 1,145 Tags 452 MiB
3330eaf39c
Commit Graph

50 Commits

Author SHA1 Message Date
Stefan Metzmacher
53528c71ff CVE-2020-1472(ZeroLogon): libcli/auth: add netlogon_creds_is_random_challenge() to avoid weak values 
This is the check Windows is using, so we won't generate challenges,
which are rejected by Windows DCs (and future Samba DCs).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
 2020-09-18 12:48:38 +00:00
Stefan Metzmacher
b813cdcac3 CVE-2020-1472(ZeroLogon): libcli/auth: add netlogon_creds_random_challenge() 
It's good to have just a single isolated function that will generate
random challenges, in future we can add some logic in order to
avoid weak values, which are likely to be rejected by a server.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
 2020-09-18 12:48:38 +00:00
Isaac Boukris
fe2577a40c smbdes: remove old unused DES builtin-crypto 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:31 +00:00
Isaac Boukris
a75ca8d5d5 session: convert sess_crypt_blob to use gnutls 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:31 +00:00
Isaac Boukris
dcc33103d5 smbdes: convert des_crypt112_16 to use gnutls 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:31 +00:00
Isaac Boukris
254739137b smbdes: convert des_crypt112 to use gnutls 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:31 +00:00
Isaac Boukris
dce944e8a1 smbdes: convert E_old_pw_hash to use gnutls 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:31 +00:00
Isaac Boukris
c57f429574 smbdes: convert des_crypt128() to use gnutls 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:30 +00:00
Isaac Boukris
a5548af018 smbdes: convert E_P24() and SMBOWFencrypt to use gnutls 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:30 +00:00
Isaac Boukris
2eef12904f smbdes: remove D_P16() (not used) 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:30 +00:00
Isaac Boukris
9fb6361a8b smbdes: convert E_P16() to use gnutls 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:30 +00:00
Isaac Boukris
ecee199803 smbdes: convert sam_rid_crypt() to use gnutls 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:30 +00:00
Isaac Boukris
bbcf568f31 SMBsesskeygen_lm_sess_key: use gnutls and return NTSTATUS 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:30 +00:00
Isaac Boukris
38189f76d8 netlogon_creds_des_encrypt/decrypt_LMKey: use gnutls and return NTSTATUS 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:30 +00:00
Isaac Boukris
0f855f1ab9 smbdes: add des_crypt56_gnutls() using DES-CBC with zeroed IV 
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-12-10 00:30:30 +00:00
Andreas Schneider
e19b115dd2 libcli:auth: Remove unused E_md5hash() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-11-19 04:48:29 +00:00
Andreas Schneider
7c7dc855ba libcli:auth: Return NTSTATUS for netlogon_creds_client_authenticator() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-11-14 08:01:44 +00:00
Andreas Schneider
dc75a5f27e libcli:auth: Return NTSTATUS for SMBOWFencrypt_ntv2() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-11-14 08:01:43 +00:00
Andreas Schneider
045b9eb3f0 libcli:auth: Return NTSTATUS for SMBOWFencrypt_ntv2() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-11-14 08:01:43 +00:00
Andrew Bartlett
8ec796f1a1 libcli:auth Return NTSTATUS from netlogon_creds_aes_decrypt() 
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2019-08-21 09:57:30 +00:00
Andreas Schneider
ded5aad21b libcli:auth: Return NTSTATUS for netlogon_creds_aes_encrypt() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adapted by Andrew Bartlett to use gnutls_error_to_ntstatus()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
 2019-08-21 09:57:29 +00:00
Andreas Schneider
576bcf6155 libcli:auth: Return WERROR for encode_wkssvc_join_password_buffer() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-07-26 01:48:24 +00:00
Andreas Schneider
06d46c447e libcli:auth: Add encode_rc4_passwd_buffer() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-07-26 01:48:23 +00:00
Andreas Schneider
79ca72ec3d libcli:auth: Pass samr_CryptPasswordEx to decode_rc4_passwd_buffer() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-07-26 01:48:23 +00:00
Andreas Schneider
89f8b028e2 libcli:auth: Rename encode_or_decode_arc4_passwd_buffer() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-07-26 01:48:23 +00:00
Andreas Schneider
57dd415ba4 libcli:auth: Return NTSTATUS for encode_or_decode_arc4_passwd_buffer() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-07-26 01:48:22 +00:00
Andreas Schneider
67e6a9af2c libcli:auth: Return NTSTATUS for netlogon_creds_arcfour_crypt() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-06-27 12:54:23 +00:00
Andreas Schneider
cad3adb0b4 libcli:auth: Return NTSTATUS for netlogon_creds_decrypt_samlogon_logon() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-06-27 12:54:23 +00:00
Andreas Schneider
31f110317f libcli:auth: Return NTSTATUS for netlogon_creds_encrypt_samlogon_logon() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-06-27 12:54:23 +00:00
Andreas Schneider
2e6fe27bad libcli:auth: Return NTSTATUS for netlogon_creds_decrypt_samlogon_validation() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-06-27 12:54:23 +00:00
Andreas Schneider
00dd1a8bf8 libcli:auth: Return NTSTATUS for netlogon_creds_encrypt_samlogon_validation() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2019-06-27 12:54:23 +00:00
Andrew Bartlett
abe7b67394 libcli/auth: Remove des_crypt64() from smbdes 
This has been unused since it was introduced by
ad8b47a2ba in 2006

Found by callcatcher

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
 2019-05-22 05:59:13 +00:00
Volker Lendecke
602ec8884b libcli: Apply some const 
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2017-09-16 08:36:18 +02:00
Stefan Metzmacher
1b48c8515e libcli/auth: add const to set_pw_in_buffer() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2017-06-27 16:57:46 +02:00
Stefan Metzmacher
423e95b430 CVE-2016-2111: libcli/auth: add NTLMv2_RESPONSE_verify_netlogon_creds() helper function 
This is the function that prevents spoofing like
Microsoft's CVE-2015-0005.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11749

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
 2016-04-12 19:25:24 +02:00
Stefan Metzmacher
4c4829634f CVE-2016-2110: libcli/auth: pass server_timestamp to SMBNTLMv2encrypt_hash() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
 2016-04-12 19:25:23 +02:00
Stefan Metzmacher
a46a00673d libcli/auth: add forward declaration for struct wkssvc_PasswordBuffer 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2015-03-20 20:43:11 +01:00
Stefan Metzmacher
409cf45147 libcli/auth: add some const to netlogon_creds_server_{init,step_check}() 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2015-03-20 20:43:11 +01:00
Stefan Metzmacher
2ea749a1a4 libcli/auth: add netlogon_creds_shallow_copy_logon() 
This can be used before netlogon_creds_encrypt_samlogon_logon()
in order to keep the provided buffers unchanged.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2013-08-05 10:30:01 +02:00
Stefan Metzmacher
c7319fce60 libcli/auth: add netlogon_creds_[de|en]crypt_samlogon_logon() 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2013-08-05 10:30:01 +02:00
Günther Deschner
a9d5b2fdf0 libcli/auth: also set secure channel type in netlogon_creds_client_init(). 
Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2013-08-05 10:30:00 +02:00
Günther Deschner
301f69b0ca libcli/auth: add netlogon_creds_encrypt_samlogon_validation(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2012-12-15 21:50:36 +01:00
Günther Deschner
563cc67ac6 libcli/auth: rename netlogon_creds_decrypt_samlogon() to netlogon_creds_decrypt_samlogon_validation(). 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2012-12-15 21:50:36 +01:00
Günther Deschner
429600c5f3 libcli/auth: add netlogon_creds_aes_{en|de}crypt routines. 
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2012-12-09 19:39:07 +01:00
Jeremy Allison
aca444cbfc Remove useless bool "upper_case_domain" parameter from ntv2_owf_gen(). 
The code in SMBNTLMv2encrypt_hash() should not be requesting case
changes on the domain name.

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Aug 24 21:39:42 CEST 2012 on sn-devel-104
 2012-08-24 21:39:41 +02:00
Stefan Metzmacher
d727fcc867 libcli/auth: add some const to SMBNTencrypt_hash() and SMBNTencrypt() 
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Sep 14 19:49:24 CEST 2011 on sn-devel-104
 2011-09-14 19:49:24 +02:00
Günther Deschner
898c612335 s3-dcerpc: avoid talloc_move on schannel creds in cli_rpc_pipe_open_schannel_with_key(). 
Initially, the schannel creds were talloc memduped, then, during the netlogon
creds client merge (baf7274fed) they were first
talloc_referenced and then later (53765c81f7)
talloc_moved.

The issue with using talloc_move here is that users of that function in winbind
will only be able to have two schanneled connections, as the cached schannel
credentials pointer from the netlogon pipe will be set to NULL. Do a deep copy
of the struct instead.

Guenther
 2010-08-24 02:04:27 +02:00
Stefan Metzmacher
6eedba102b libcli/auth: add a const to des_crypt112_16() 
metze
 2010-03-05 14:06:18 +01:00
Matt Kraai
aa6a507e76 Change uint_t to unsigned int in libcli 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
 2010-02-02 07:18:17 +01:00
Jeremy Allison
fe77eac5f3 Add previously generated header files now needed in merged build. 
Jeremy.
 2009-04-20 08:48:07 -07:00