summaryrefslogtreecommitdiff
path: root/libcli
AgeCommit message (Collapse)AuthorFilesLines
2022-07-28libcli:auth: Implment a common create_pw_buffer_from_blob()Andreas Schneider1-5/+38
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28libcli:auth: Use extract_pw_from_buffer() in decode_pw_buffer()Andreas Schneider1-20/+16
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28libcli:auth: Keep data of extract_pw_from_buffer() secretAndreas Schneider1-0/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28libcli:auth: Add test for encode_pwd_buffer514_from_str()Andreas Schneider2-0/+137
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28libcli:auth: Add encode_pw_buffer_from_str()Andreas Schneider2-0/+41
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28libcli:auth: Implement a generic encode_pwd_buffer_from_str()Andreas Schneider1-18/+59
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28libcli:auth: Remove trailing spaces from proto.hAndreas Schneider1-21/+21
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-25libcli: Modernize a few DEBUG statementsVolker Lendecke1-22/+23
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2022-06-14libcli/security: Fix typosJoseph Sutton2-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-06-14libcli:util: Update werror tableJoseph Sutton2-4/+17
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-06-10spelling: connnect encrytion exisit expection explicit invalide missmatch ↵Michael Tokarev1-2/+2
paramater paramter partion privilige relase reponse seperate unkown verson authencication progagated Tree-wide spellcheck for some common misspellings. source3/utils/status.c has misspelled local variable (unkown_dialect). "missmatch" is a known historical misspelling, only the incorrect misspellings are fixed. source3/locale/net/de.po has the spelling error (unkown) in two msgids - it probably should be updated with current source. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-06-09lib/util: Change function to mem_equal_const_time()Joseph Sutton6-21/+21
Since memcmp_const_time() doesn't act as an exact replacement for memcmp(), and its return value is only ever compared with zero, simplify it and emphasize the intention of checking equality by returning a bool instead. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-09lib/util: Change function to data_blob_equal_const_time()Joseph Sutton1-3/+3
Since data_blob_cmp_const_time() doesn't act as an exact replacement for data_blob_cmp(), and its return value is only ever compared with zero, simplify it and emphasize the intention of checking equality by returning a bool instead. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-09auth: Use constant-time memcmp when comparing sensitive buffersJoseph Sutton5-16/+16
This helps to avoid timing attacks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15010 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-14libcli: Covscan: unchecked return value for file_save()Pavel Filipenský1-2/+2
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-05-14libcli: Fix trailing whitespace in netlogon.cPavel Filipenský1-2/+2
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-05-02libcli/smb: allow SMB2 Negotiate responses with security_offset = 0 and ↵Stefan Metzmacher1-0/+15
security_length = 0 This fixes connections against the Azure SMB3 server. It's not possible to demonstrate the bug with a test and a knownfail entry, because it fails to even startup the test environments, but the following change to our server demonstrates the problem and shows the fix works: diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c index da567951c0bf..25fdaea2df7b 100644 --- a/source3/smbd/smb2_negprot.c +++ b/source3/smbd/smb2_negprot.c @@ -711,6 +711,8 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req) } } + security_buffer = data_blob_null; + if (out_negotiate_context_blob.length != 0) { static const uint8_t zeros[8]; size_t pad = 0; @@ -759,6 +761,8 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req) return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY); } + security_offset = 0; + SSVAL(outbody.data, 0x00, 0x40 + 1); /* struct size */ SSVAL(outbody.data, 0x02, security_mode); /* security mode */ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15050 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon May 2 20:13:10 UTC 2022 on sn-devel-184
2022-03-17sddl: Remove SDDL SID strings unsupported by WindowsJoseph Sutton1-3/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17sddl: Add new SDDL SID stringsJoseph Sutton1-0/+32
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17sddl: Fix incorrect SDDL SID stringsJoseph Sutton1-3/+5
Change the values to match those used by Windows. Verified with PowerShell commands of the form: New-Object Security.Principal.SecurityIdentifier ER Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-08s3: libcli: Rename smb_key_derivation() -> smb1_key_derivation()Jeremy Allison3-3/+3
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_is_negotiated() -> smb1_signing_is_negotiated()Jeremy Allison2-2/+2
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_set_negotiated() -> smb1_signing_set_negotiated()Jeremy Allison3-3/+3
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_is_mandatory() -> smb1_signing_is_mandatory()Jeremy Allison2-2/+2
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_is_desired() -> smb1_signing_is_desired()Jeremy Allison2-2/+2
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Remove unused smb_signing_is_allowed()Jeremy Allison2-6/+0
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_is_active() -> smb1_signing_is_active()Jeremy Allison3-3/+3
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_activate() -> smb1_signing_activate()Jeremy Allison3-7/+7
Fix the debugs that also used this name. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_check_pdu() -> smb1_signing_check_pdu()Jeremy Allison3-14/+12
Fix the debugs that also used this name. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_sign_pdu() -> smb1_signing_sign_pdu()Jeremy Allison3-6/+6
Fix the debugs that also used this name. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_cancel_reply() -> smb1_signing_cancel_reply()Jeremy Allison3-3/+3
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_next_seqnum() -> smb1_signing_next_seqnum()Jeremy Allison3-3/+3
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_md5() -> smb1_signing_md5()Jeremy Allison1-5/+5
Fix the debug that also used this name. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_good() -> smb1_signing_good()Jeremy Allison1-5/+5
Fix the debugs that also used this name. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_init() -> smb1_signing_init()Jeremy Allison3-3/+3
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename smb_signing_init_ex() -> smb1_signing_init_ex()Jeremy Allison2-3/+3
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: libcli: Rename static smb_signing_reset_info() -> smb1_signing_reset_info()Jeremy Allison1-3/+3
Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08s3: Simple rename 'struct smb_signing_state' -> 'struct smb1_signing_state'Jeremy Allison3-37/+37
This is only used by the SMB1 signing code, except for one bool for SMB2 which we will replace next. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: David Mulder <dmulder@samba.org>
2022-02-02libcli/smb: let smb2_signing_decrypt_pdu() cope with ↵Stefan Metzmacher1-0/+15
gnutls_aead_cipher_decrypt() ptext_len bug The initial implementation of gnutls_aead_cipher_decrypt() had a bug and used: *ptext_len = ctext_len; instead of: *ptext_len = ctext_len - tag_size; This got fixed with gnutls 3.5.2. As we only require gnutls 3.4.7 we need to cope with this... BUG: https://bugzilla.samba.org/show_bug.cgi?id=14968 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Feb 2 18:29:08 UTC 2022 on sn-devel-184
2022-02-02libcli/smb: fix error checking in smb2_signing_decrypt_pdu() invalid ptext_lenStefan Metzmacher1-1/+8
When the ptext_size != m_total check fails, we call this: status = gnutls_error_to_ntstatus(rc, NT_STATUS_INTERNAL_ERROR); goto out; As rc is 0 at that point we'll exit smb2_signing_decrypt_pdu() with NT_STATUS_OK, but without copying the decrypted data back into the callers buffer. Which leads to strange errors in the caller. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14968 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01s3: smbd: Add the definition for SMB2_FIND_POSIX_INFORMATION info level.Jeremy Allison1-0/+3
Will be used by smb2_query_directory. Not yet used or available. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01libcli: Add SMB2 posix negotiate context flag.Jeremy Allison1-0/+1
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-01-20libcli/dns: Fix TCP fallbackVolker Lendecke1-25/+31
A customer has come across a DNS server that really just cuts a SRV reply if it's too long. This makes the packet invalid according to ndr_pull and according to wireshark. DNS_FLAG_TRUNCATION is however set. As this seems to be legal according to the DNS RFCs, we need to hand-parse the first two uint16's and look whether DNS_FLAG_TRUNCATION is set. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Jan 20 18:01:41 UTC 2022 on sn-devel-184
2022-01-18lib: Remove unused tstream_npa_socketpair()Volker Lendecke2-93/+0
This was used in the pre samba-dcerpcd source3 rpc server. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-01-04libcli/auth: let NTLMv2_RESPONSE_verify_netlogon_creds ignore invalid netapp ↵Stefan Metzmacher1-0/+63
requests We should avoid spamming the logs with wellknown messages like: ndr_pull_error(Buffer Size Error): Pull bytes 39016 They just confuse admins (and developers). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-01-04libcli/auth: let NTLMv2_RESPONSE_verify_netlogon_creds ignore BUFFER_TOO_SMALLStefan Metzmacher1-5/+21
Windows doesn't complain about invalid av_pair blobs, we need to do the same. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-12-10librpc: Get transport out of tstream_npa_accept_existing_recv()Volker Lendecke2-0/+7
To be used by the RPC servers in the next commit Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-12-10librpc: Add named_pipe_auth_req_info5->transportVolker Lendecke2-0/+8
This will serve as a check to make sure that in particular a SAMR client is really root. This is for example used in get_user_info_18() handing out a machine password. The unix domain sockets for NCACN_NP can only be contacted by root, the "np\" subdirectory for those sockets is root/root 0700. Connecting to such a socket is done in two situations: First, local real root processes connecting and smbd on behalf of SMB clients connecting to \\pipe\name, smbd does become_root() there. Via the named_pipe_auth_req_info4 smbd hands over the SMB session information that the RPC server blindly trusts. The session information (i.e. the NT token) is heavily influenced by external sources like the KDC. It is highly unlikely that we get a system token via SMB, but who knows, this is information not fully controlled by smbd. This is where this additional field in named_pipe_auth_req_info5 makes a difference: This field is set to NCACN_NP by smbd's code, not directly controlled by the clients. Other clients directly connecting to a socket in "np\" is root anyway (only smbd can do become_root()) and can set this field to NCALRPC. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-12-10named_pipe_auth: Bump info4 to info5Volker Lendecke2-56/+56
We'll add a field soon Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-12-02libcli:auth: Allow to connect to netlogon server offering only AESAndreas Schneider1-10/+38
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14912 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Dec 2 14:49:35 UTC 2021 on sn-devel-184
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-13 22:05:32 +0000