summaryrefslogtreecommitdiff
path: root/libcli/auth/ntlm_check.c
AgeCommit message (Collapse)AuthorFilesLines
2023-08-21libcli/auth: Remove unnecessary castsJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16auth: Return status code if configuration prohibits NTLMJoseph Sutton1-0/+8
Currently, we rely on ‘stored_nt’ being NULL to give an NT_STATUS_WRONG_PASSWORD error. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-09lib/util: Change function to mem_equal_const_time()Joseph Sutton1-4/+4
Since memcmp_const_time() doesn't act as an exact replacement for memcmp(), and its return value is only ever compared with zero, simplify it and emphasize the intention of checking equality by returning a bool instead. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-09auth: Use constant-time memcmp when comparing sensitive buffersJoseph Sutton1-4/+4
This helps to avoid timing attacks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15010 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-01-06auth: Avoid casts in ntlm_check.cVolker Lendecke1-16/+15
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Mon Jan 6 03:12:20 UTC 2020 on sn-devel-184
2020-01-06auth: Check for talloc failure in smb_sess_key_ntlmv2()Volker Lendecke1-0/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-06auth: Slightly simplify smb_pwd_check_ntlmv1()Volker Lendecke1-11/+13
Do an early return for the failure case Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-06auth: Check for talloc failure in smb_pwd_check_ntlmv1()Volker Lendecke1-0/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-06auth: Slightly simplify smb_pwd_check_ntlmv2()Volker Lendecke1-15/+17
Do an early return for the failure case Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-06auth: Check for talloc failure in smb_pwd_check_ntlmv2()Volker Lendecke1-0/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-12-10smbdes: convert E_P24() and SMBOWFencrypt to use gnutlsIsaac Boukris1-1/+5
Signed-off-by: Isaac Boukris <iboukris@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-14libcli:auth: Check return code of SMBOWFencrypt_ntv2()Andreas Schneider1-3/+15
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-14libcli:auth: Check return codes of SMBsesskeygen_ntv2()Andreas Schneider1-2/+15
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-27libcli:auth: Only use the required md4 headerAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2018-08-14CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled ↵Günther Deschner1-1/+1
via "ntlm auth". This fixes a regression that came in via 00db3aba6cf9ebaafdf39ee2f9c7ba5ec2281ea0. Found by Vivek Das <vdas@redhat.com> (Red Hat QE). In order to demonstrate simply run: smbclient //server/share -U user%password -mNT1 -c quit \ --option="client ntlmv2 auth"=no \ --option="client use spnego"=no against a server that uses "ntlm auth = ntlmv2-only" (our default setting). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360 CVE-2018-1139: Weak authentication protocol allowed. Guenther Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-08-14CVE-2018-1139 libcli/auth: fix debug messages in hash_password_check()Günther Deschner1-4/+4
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360 CVE-2018-1139: Weak authentication protocol allowed. Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2017-07-04param: Add new "disabled" value to "ntlm auth" to disable NTLM totallyAndrew Bartlett1-0/+6
Signed-off-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923 Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-07-04auth: Allow NTLMv1 if MSV1_0_ALLOW_MSVCHAPV2 is given and re-factor 'ntlm ↵Andrew Bartlett1-2/+3
auth =' The ntlm auth parameter is expanded to more clearly describe the role of each option, and to allow the new mode that permits MSCHAPv2 (as declared by the client over the NETLOGON protocol) while still banning NTLMv1. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12252 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Based on a patch by Mantas Mikulėnas <mantas@utenos-kolegija.lt>: Commit 0b500d413c5b ("Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth") added the --allow-mschapv2 option, but didn't implement checking for it server-side. This implements such checking. Additionally, Samba now disables NTLMv1 authentication by default for security reasons. To avoid having to re-enable it globally, 'ntlm auth' becomes an enum and a new setting is added to allow only MSCHAPv2. Signed-off-by: Mantas Mikulėnas <mantas@utenos-kolegija.lt> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-01-03libcli: Use "all_zero" where appropriateVolker Lendecke1-3/+2
... Saves a few bytes of footprint Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2014-04-14Typo: s/preceeded/preceded/Jelmer Vernooij1-3/+3
Caught by lintian, the Debian package linter :) Change-Id: Ia7162ea8c2b1845155345526b66d71ae64f15227 Reviewed-on: https://gerrit.samba.org/216 Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Jelmer Vernooij <jelmer@samba.org> Autobuild-Date(master): Mon Apr 14 03:51:15 CEST 2014 on sn-devel-104
2012-08-24Remove useless bool "upper_case_domain" parameter from ntv2_owf_gen().Jeremy Allison1-2/+2
The code in SMBNTLMv2encrypt_hash() should not be requesting case changes on the domain name. Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Aug 24 21:39:42 CEST 2012 on sn-devel-104
2012-08-24Remove useless bool "upper_case_domain" parameter.Jeremy Allison1-13/+2
2012-08-24Move uppercasing the domain out of smb_pwd_check_ntlmv2()Jeremy Allison1-9/+21
Allows us to remove a silly bool parameter. Based on work done by "Blohm, Guntram (I/FP-37, extern)" <extern.guntram.blohm@audi.de>.
2011-03-29Ensure convert_string_XXX is always called with a valid converted_size pointer.Jeremy Allison1-1/+2
Preparation for cleaning up this API. Autobuild-User: Jeremy Allison <jra@samba.org> Autobuild-Date: Tue Mar 29 21:01:49 CEST 2011 on sn-devel-104
2011-03-24charcnv: removed the allow_badcharcnv and allow_bad_conv options to ↵Andrew Tridgell1-1/+1
convert_string*() we shouldn't accept bad multi-byte strings, it just hides problems Autobuild-User: Andrew Tridgell <tridge@samba.org> Autobuild-Date: Thu Mar 24 01:47:26 CET 2011 on sn-devel-104
2010-09-13ntlm_check: Fix some nonempty blank linesVolker Lendecke1-21/+21
2010-08-26libcli/auth/ntlm_check.c - fix parameter indentationMatthias Dieter Wallnöfer1-3/+3
2010-03-03Fix typo in comments.Karolin Seeger1-1/+1
2009-04-23Fix a couple of warningsVolker Lendecke1-1/+1
2009-04-20libcli/auth: Don't pass back lm_sess_key as the same pointer as user_sess_keyAndrew Bartlett1-13/+7
This ensures that a talloc_free() of both pointers won't double-free (sharing pointers like this is evil anyway). Andrew Bartlett
2009-04-14Rework Samba3 to use new libcli/auth code (partial)Andrew Bartlett1-1/+0
This commit is mostly to cope with the removal of SamOemHash (replaced by arcfour_crypt()) and other collisions (such as changed function arguments compared to Samba3). We still provide creds_hash3 until Samba3 uses the credentials code in netlogon server Andrew Bartlett
2009-04-14Move libcli/auth to the top levelAndrew Bartlett1-0/+603
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-10 17:02:17 +0000