1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Commit Graph

1484 Commits

Author SHA1 Message Date
Andreas Schneider
702ae15853 libcli:auth: Use gnutls_error_to_ntstatus() in credentials
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-24 06:11:17 +00:00
Andreas Schneider
68d495cadb libcli:smb: Use gnutls_error_to_ntstatus() in smbXcli_base.c
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-24 06:11:17 +00:00
Andreas Schneider
e24a238ab9 libcli:smb: Use gnutls_error_to_ntstatus() in smb2_signing_check_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-24 06:11:16 +00:00
Andreas Schneider
bbdae27764 libcli:smb: Use gnutls_error_to_ntstatus() in smb2_signing_sign_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-24 06:11:16 +00:00
Andreas Schneider
d61601d44f libcli:smb: Return NSTATUS for smb2_signing_check_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-24 06:11:16 +00:00
Andreas Schneider
f54dfd97aa libcli:util: Add gnutls_error
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-24 06:11:16 +00:00
Stefan Metzmacher
b336d09b7b libcli/smb: harden smbXcli_session_shallow_copy against nonce reusage
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Jun 12 13:56:19 UTC 2019 on sn-devel-184
2019-06-12 13:56:19 +00:00
Stefan Metzmacher
317054f6eb libcli/smb: s/smbXcli_session_copy/smbXcli_session_shallow_copy
We should make clear that this is a function for testing only,
with possible strange side effects.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-06-12 12:42:26 +00:00
Andreas Schneider
1b46a10c16 libcli/smb: only fallback to the global smb2 signing key if we should sign
We should only sign if we're asked for it. The signing keys are
always generated, so we were always using global signing key
and signed with it when signing was not asked for.

By luck this was the correct signing key for the 1st channel.

But multi channel connections where broken is the server nor the client
require/desire signing. It seems the tests only ever run against
Windows domain controllers, which always require signing.

Note that the following code in smb2cli_req_create() makes
sure that we always sign session binds:

  if (cmd == SMB2_OP_SESSSETUP &&
      !smb2_signing_key_valid(session->smb2_channel.signing_key) &&
      smb2_signing_key_valid(session->smb2->signing_key))
  {
          /*
           * a session bind needs to be signed
           */
          state->smb2.should_sign = true;
  }

This removed a logic changed introduced in commit
17e22e020f. As

  if (!smb2_signing_key_valid(signing_key)) {

is not the same as:

  if (signing_key && signing_key->length == 0) {

it's the same as:

  if (signing_key == NULL || signing_key->length == 0) {

so we need:

  if (signing_key != NULL && !smb2_signing_key_valid(signing_key)) {

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2019-06-12 12:42:26 +00:00
Stefan Metzmacher
7b1eab1093 libcli/smb: make sure the session->{smb2->,smb2_channel.}signing_key is never NULL!
Before commit 17e22e020f they we not a
pointer and always be present.

We used the local pointer variable 'signing_key = NULL' and logic like
this:

    if (state->smb2.should_sign) {
        signing_key = state->session->smb2_channel.signing_key;
    }

    if (signing_key != NULL ...

In order to keep this we need to nake sure
state->session->smb2_channel.signing_key is never NULL!

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-06-12 12:42:26 +00:00
Stefan Metzmacher
2ad02acf38 Revert "libcli:smb: Fix signing with multichannel"
This reverts commit 1817db965d.

This was pushed to fast, the corrected commit follows.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-06-12 12:42:26 +00:00
Stefan Metzmacher
824db29672 Revert "libcli/smb: add missing struct smb2_signing_key allocation in smb2cli_session_set_channel_key()"
This reverts commit 0875016654.

This was pushed to fast, the corrected commit follows.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-06-12 12:42:26 +00:00
Stefan Metzmacher
0875016654 libcli/smb: add missing struct smb2_signing_key allocation in smb2cli_session_set_channel_key()
This was missing in commit 17e22e020f
and causes all multi-channel tests to segfault.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Jun 11 15:25:56 UTC 2019 on sn-devel-184
2019-06-11 15:25:56 +00:00
Andreas Schneider
1817db965d libcli:smb: Fix signing with multichannel
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-06-11 14:01:20 +00:00
Volker Lendecke
da87fa998a lib: Only compile resolvconftest if fmemopen exists
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13961
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat May 25 00:05:25 UTC 2019 on sn-devel-184
2019-05-25 00:05:25 +00:00
Andrew Bartlett
3e197d4370 libcli/security: Remove unused dup_sec_desc_buf()
This has been unused since before
762e7e1dff in 2003.

Found by callcatcher

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-22 05:59:14 +00:00
Andrew Bartlett
abe7b67394 libcli/auth: Remove des_crypt64() from smbdes
This has been unused since it was introduced by
ad8b47a2ba in 2006

Found by callcatcher

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-22 05:59:13 +00:00
Andreas Schneider
5a0516bee9 libcli:smb: Return NTSTATUS for smb_key_derivation()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:21 +00:00
Andreas Schneider
39a665464f libcli:smb: Check return code of smb_signing_md5()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:21 +00:00
Andreas Schneider
754e155183 libcli:smb: Return NTSTATUS for smb_signing_sign_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:21 +00:00
Andreas Schneider
7368a20043 libcli:smb: Return NTSTATUS for smb_signing_md5()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:21 +00:00
Andreas Schneider
940e0c106c libcli:smb: Use GnuTLS HMAC MD5 in smb_key_derivation()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:21 +00:00
Andreas Schneider
f7d952398b libcli:smb: Use GnuTLS MD5 and HMAC MD5 in smb_signing_md5()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:21 +00:00
Andreas Schneider
a6eeb49b39 libcli:drsuapi: Use GnuTLS MD5 in drsuapi_encrypt_attribute_value()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
54440f1b30 libcli:drsuapi: Use GnuTLS MD5 in drsuapi_decrypt_attribute_value()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
75ee0c83c1 libcli:auth: Add return codes for netlogon_creds_init_128bit()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
1810daaf9c libcli:auth: Use GnuTLS MD5 and HMAC MD5 in netlogon_creds_init_128bit
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
d22aa6fcc2 libcli:auth: Use 'bool ok' in ntv2_owf_gen()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
6f4c027094 libcli:auth: Use GnuTLS MD5 HMAC in SMBsesskeygen_ntv2()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
e1c04866a8 libcli:auth: Use GnuTLS MD5 HMAC in SMBOWFencrypt_ntv2()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
a2f88720d2 libcli:auth: Use GnuTLS MD5 HMAC in ntv2_owf_gen()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
023e6b4f04 libcli:auth: Use GnuTLS MD5 in decode_wkssvc_join_password_buffer()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
10a1caa46d libcli:auth: Use GnuTLS MD5 in encode_or_decode_arc4_passwd_buffer()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
2463d1111f libcli:auth: Use GnuTLS MD5 in encode_wkssvc_join_password_buffer()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
152cd8b426 libcli:auth: Use GnuTLS MD5 in encode_or_decode_arc4_passwd_buffer()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
45a4a9078c libcli:auth: Use GnuTLS MD5 for E_md5hash() in smbcrypt
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:20 +00:00
Andreas Schneider
ad04e5f5f9 lib:util: Move VWV macro to smb_constants.h
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-17 19:33:25 +00:00
Noel Power
cbdd3d0c26 squash 'cast between incompatible function types' warning
To avoid warning above produced by using
-Wcast-function-type we;

  + ensure PyCFunctions of type METH_NOARGS defined dummy arg
  + ensure PyCFunctions of type METH_KEYWORDS use PY_DISCARD_FUNC_SIG
    macro

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-05-16 17:55:17 +00:00
Andreas Schneider
d2a4088cc3 libcli:smb: Use GnuTLS SHA512 in smbXcli_base
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-07 03:04:28 +00:00
Andreas Schneider
015e4d2dc2 libcli:smb: Use smb2_signing_key for smb2_signing_check_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:28 +00:00
Andreas Schneider
dcf37228e1 libcli:smb: Use smb2_signing_key for smb2_signing_sign_pdu()
This caches the gnutls hmac handle in the struct so we only allocate it
once.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:28 +00:00
Andreas Schneider
3f252816ad libcli:smb: Add smb2_signing_key_destructor()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:28 +00:00
Andreas Schneider
17e22e020f libcli:smb: Use 'struct smb2_signing_key' in smbXcli_base.c
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:28 +00:00
Andreas Schneider
11e3552c9f libcli:smb: Introduce a structure for the smb2_singing_key
This also adds a new function to validate the structure.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:28 +00:00
Andreas Schneider
604c0b2620 libcli:smb: Use GnuTLS SHA256 HMAC in smb2_signing_check_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:27 +00:00
Andreas Schneider
eca425ef5b libcli:smb: Use GnuTLS SHA256 HMAC in smb2_signing_sign_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:27 +00:00
Andreas Schneider
cda938cd9c libcli:smb: Use GnuTLS SHA256 HMAC in smb2_key_derivation()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:27 +00:00
Andreas Schneider
5d87610976 libcli:auth: Add return code for netlogon_creds_init_hmac_sha256()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:27 +00:00
Andreas Schneider
8bed91c999 libcli:auth: Use GnuTLS SHA256 HMAC for credentials
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:27 +00:00
Swen Schillig
beb3012e3f libcli: Update error check for new string conversion wrapper
The new string conversion wrappers detect and flag errors
which occured during the string to integer conversion.
Those modifications required an update of the callees
error checks.

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
2019-04-11 22:29:27 +00:00