From: Jeremy Allison <jra@samba.org>
Date: Mon, 9 Mar 2015 21:27:43 +0000 (-0700)
Subject: s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that... 
X-Git-Tag: samba-4.1.18~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9e395c9c445f101014a01b7d3589bdf524f17883;p=thirdparty%2Fsamba.git

s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields.

Packet traces showing such servers are found in the bug this fixes:

https://bugzilla.samba.org/show_bug.cgi?id=10016

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Thu Mar 19 12:05:56 CET 2015 on sn-devel-104

(cherry picked from commit ffe33940faa6fb762fd2483f0245448b0434be00)
---

diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c
index 617b34b4977..e661aebba12 100644
--- a/source3/libsmb/ntlmssp.c
+++ b/source3/libsmb/ntlmssp.c
@@ -359,12 +359,13 @@ static NTSTATUS ntlmssp3_client_challenge(struct ntlmssp_state *ntlmssp_state,
 				         TALLOC_CTX *out_mem_ctx, /* Unused at this time */
 					 const DATA_BLOB reply, DATA_BLOB *next_request)
 {
-	uint32_t chal_flags, ntlmssp_command, unkn1, unkn2;
+	uint32_t chal_flags, ntlmssp_command, unkn1 = 0, unkn2 = 0;
 	DATA_BLOB server_domain_blob;
 	DATA_BLOB challenge_blob;
 	DATA_BLOB struct_blob = data_blob_null;
 	char *server_domain;
 	const char *chal_parse_string;
+	const char *chal_parse_string_short = NULL;
 	const char *auth_gen_string;
 	DATA_BLOB lm_response = data_blob_null;
 	DATA_BLOB nt_response = data_blob_null;
@@ -474,6 +475,7 @@ noccache:
 			chal_parse_string = "CdUdbddB";
 		} else {
 			chal_parse_string = "CdUdbdd";
+			chal_parse_string_short = "CdUdb";
 		}
 		auth_gen_string = "CdBBUUUBd";
 	} else {
@@ -481,6 +483,7 @@ noccache:
 			chal_parse_string = "CdAdbddB";
 		} else {
 			chal_parse_string = "CdAdbdd";
+			chal_parse_string_short = "CdAdb";
 		}
 
 		auth_gen_string = "CdBBAAABd";
@@ -497,9 +500,38 @@ noccache:
 			 &challenge_blob, 8,
 			 &unkn1, &unkn2,
 			 &struct_blob)) {
+
+		bool ok = false;
+
 		DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
-		dump_data(2, reply.data, reply.length);
-		return NT_STATUS_INVALID_PARAMETER;
+
+		if (chal_parse_string_short != NULL) {
+			/*
+			 * In the case where NTLMSSP_NEGOTIATE_TARGET_INFO
+			 * is not used, some NTLMSSP servers don't return
+			 * the unused unkn1 and unkn2 fields.
+			 * See bug:
+			 * https://bugzilla.samba.org/show_bug.cgi?id=10016
+			 * for packet traces.
+			 * Try and parse again without them.
+			 */
+			ok = msrpc_parse(ntlmssp_state, &reply,
+				chal_parse_string_short,
+				"NTLMSSP",
+				&ntlmssp_command,
+				&server_domain,
+				&chal_flags,
+				&challenge_blob, 8);
+			if (!ok) {
+				DEBUG(1, ("Failed to short parse "
+					"the NTLMSSP Challenge: (#2)\n"));
+			}
+		}
+
+		if (!ok) {
+			dump_data(2, reply.data, reply.length);
+			return NT_STATUS_INVALID_PARAMETER;
+		}
 	}
 
 	if (chal_flags & NTLMSSP_TARGET_TYPE_SERVER) {