samba.git/libcli/auth/credentials.c, branch talloc-2.4.2

libcli/auth: Call correct function to get HMAC output length

2023-11-30T00:02:33+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

libcli/auth: Use correct enumeration constant

2023-11-30T00:02:33+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

libcli/auth: Fix code spelling

2023-08-08T04:39:36+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

Remove rudundent check and fallback for AES CFB8 as we now require GnuTLS 3.6.13

2023-06-30T14:00:38+00:00

This allows us to remove a lot of conditionally compiled code and so
know with more certaintly that our tests are covering our codepaths.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Andreas Schneider

lib/util: Change function to mem_equal_const_time()

2022-06-09T22:49:29+00:00

Since memcmp_const_time() doesn't act as an exact replacement for
memcmp(), and its return value is only ever compared with zero, simplify
it and emphasize the intention of checking equality by returning a bool
instead.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

auth: Use constant-time memcmp when comparing sensitive buffers

2022-06-09T22:49:29+00:00

This helps to avoid timing attacks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15010

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

CVE-2020-1472(ZeroLogon): libcli/auth: reject weak client challenges in netlogon_creds_server_init()

2020-09-18T12:48:38+00:00

This implements the note from MS-NRPC 3.1.4.1 Session-Key Negotiation:

 7. If none of the first 5 bytes of the client challenge is unique, the
    server MUST fail session-key negotiation without further processing of
    the following steps.

It lets ./zerologon_tester.py from
https://github.com/SecuraBV/CVE-2020-1472.git
report: "Attack failed. Target is probably patched."

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Gary Lockyer

CVE-2020-1472(ZeroLogon): libcli/auth: add netlogon_creds_is_random_challenge() to avoid weak values

2020-09-18T12:48:38+00:00

This is the check Windows is using, so we won't generate challenges,
which are rejected by Windows DCs (and future Samba DCs).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Gary Lockyer

CVE-2020-1472(ZeroLogon): libcli/auth: add netlogon_creds_random_challenge()

2020-09-18T12:48:38+00:00

It's good to have just a single isolated function that will generate
random challenges, in future we can add some logic in order to
avoid weak values, which are likely to be rejected by a server.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Gary Lockyer

smbdes: convert des_crypt112_16 to use gnutls

2019-12-10T00:30:31+00:00

Signed-off-by: Isaac Boukris 
Reviewed-by: Andrew Bartlett