auth/ntlmssp: implement GENSEC_FEATURE_LDAP_STYLE

We need to handle NTLMSSP_NEGOTIATE_SIGN as
NTLMSSP_NEGOTIATE_SEAL if GENSEC_FEATURE_LDAP_STYLE
is requested.

This works arround a bug in Windows, which allow signed only
messages using NTLMSSP and LDAP.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

diff --git a/auth/ntlmssp/gensec_ntlmssp_server.c b/auth/ntlmssp/gensec_ntlmssp_server.c
index 03d539b9bb1879d2fb3e43992a8c021b032b082c..5a57413a4d2ebdfc32758a59edeab00f059fbb3a 100644 (file)
--- a/auth/ntlmssp/gensec_ntlmssp_server.c
+++ b/auth/ntlmssp/gensec_ntlmssp_server.c
@@ -153,6 +153,15 @@ NTSTATUS gensec_ntlmssp_server_start(struct gensec_security *gensec_security)
        }
        if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+
+               if (gensec_security->want_features & GENSEC_FEATURE_LDAP_STYLE) {
+                       /*
+                        * We need to handle NTLMSSP_NEGOTIATE_SIGN as
+                        * NTLMSSP_NEGOTIATE_SEAL if GENSEC_FEATURE_LDAP_STYLE
+                        * is requested.
+                        */
+                       ntlmssp_state->force_wrap_seal = true;
+               }
        }
        if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;

diff --git a/auth/ntlmssp/ntlmssp.h b/auth/ntlmssp/ntlmssp.h
index f1af2243855a74a45d69c8db382494b4bff68520..c63c23d029cd652b813d3f4e5105d4aabd061bbe 100644 (file)
--- a/auth/ntlmssp/ntlmssp.h
+++ b/auth/ntlmssp/ntlmssp.h
@@ -94,6 +94,8 @@ struct ntlmssp_state
 
        uint32_t neg_flags; /* the current state of negotiation with the NTLMSSP partner */
 
+       bool force_wrap_seal;
+
        union ntlmssp_crypt_state *crypt;
 };
 

diff --git a/auth/ntlmssp/ntlmssp_client.c b/auth/ntlmssp/ntlmssp_client.c
index 523a8423b68b3edf21f371aad517c8d4a5e96cd8..652c8f1fb5b7907474f1bbd613ad43b774b4e189 100644 (file)
--- a/auth/ntlmssp/ntlmssp_client.c
+++ b/auth/ntlmssp/ntlmssp_client.c
@@ -639,6 +639,15 @@ NTSTATUS gensec_ntlmssp_client_start(struct gensec_security *gensec_security)
        }
        if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+
+               if (gensec_security->want_features & GENSEC_FEATURE_LDAP_STYLE) {
+                       /*
+                        * We need to handle NTLMSSP_NEGOTIATE_SIGN as
+                        * NTLMSSP_NEGOTIATE_SEAL if GENSEC_FEATURE_LDAP_STYLE
+                        * is requested.
+                        */
+                       ntlmssp_state->force_wrap_seal = true;
+               }
        }
        if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;

diff --git a/auth/ntlmssp/ntlmssp_sign.c b/auth/ntlmssp/ntlmssp_sign.c
index c0be91465b32a43e7c8021a2a88b8ca01876459c..743ba2bdc04cadffe6cee2156fdd81c6abb9d2df 100644 (file)
--- a/auth/ntlmssp/ntlmssp_sign.c
+++ b/auth/ntlmssp/ntlmssp_sign.c
@@ -558,6 +558,22 @@ NTSTATUS ntlmssp_sign_init(struct ntlmssp_state *ntlmssp_state)
                return NT_STATUS_NO_MEMORY;
        }
 
+       if (ntlmssp_state->force_wrap_seal &&
+           (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN))
+       {
+               /*
+                * We need to handle NTLMSSP_NEGOTIATE_SIGN as
+                * NTLMSSP_NEGOTIATE_SEAL if GENSEC_FEATURE_LDAP_STYLE
+                * is requested.
+                *
+                * The negotiation of flags (and authentication)
+                * is completed when ntlmssp_sign_init() is called
+                * so we can safely pretent NTLMSSP_NEGOTIATE_SEAL
+                * was negotiated.
+                */
+               ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
+       }
+
        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
                DATA_BLOB weak_session_key = ntlmssp_state->session_key;
                const char *send_sign_const;