The branch, master has been updated
via 29c0c37 s4/libcli: do not use netbios name in NTLMv2 blobs w/o
spnego
via 96a49d2 libcli: allow exclusion of netbios name in NTLMV2 blob
via 36f7f98 s4/libcli: do not announce NT error code support when it is
disabled
from 165521e s3: only include smb profiling where needed.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 29c0c37691da10bf061ba90a5b31482bda2fa486
Author: Christian Ambach <christian.amb...@de.ibm.com>
Date: Thu Apr 7 14:05:04 2011 +0200
s4/libcli: do not use netbios name in NTLMv2 blobs w/o spnego
I have seen domain controllers rejecting NTLMv2 blobs presented to
NetrLogonSamLogonEx with LOGON_FAILURE when the MsvAvNbComputerName
was a FQDN or an IP address
I have not seen this field in NTLMv2 blobs send by Windows clients
when extended security was not available, so omitting the field
makes Samba similar to Windows.
This prevents errors with some smbtorture testcases that disable
spnego and when a target name is specified that is not a valid
netbios name.
Signed-off-by: Andrew Bartlett <abart...@samba.org>
Autobuild-User: Andrew Bartlett <abart...@samba.org>
Autobuild-Date: Thu Apr 14 02:19:08 CEST 2011 on sn-devel-104
commit 96a49d23a4caebefcea66cfb855fadbae12ccf7c
Author: Christian Ambach <christian.amb...@de.ibm.com>
Date: Thu Apr 7 14:01:50 2011 +0200
libcli: allow exclusion of netbios name in NTLMV2 blob
when no hostname is given, leave away the MsvAvNbComputerName part
of the ntlmv2 blob
Signed-off-by: Andrew Bartlett <abart...@samba.org>
commit 36f7f985c168468a82a6e941c6e21c6113b906ca
Author: Christian Ambach <christian.amb...@de.ibm.com>
Date: Wed Mar 9 13:48:06 2011 +0100
s4/libcli: do not announce NT error code support when it is disabled
when the support of NT error codes has been disabled in the options of a
CLI connection, support for them should not be announced during
protocol negotiation
Signed-off-by: Andrew Bartlett <abart...@samba.org>
-----------------------------------------------------------------------
Summary of changes:
libcli/auth/smbencrypt.c | 17 ++++++++++++-----
source4/libcli/raw/rawnegotiate.c | 5 ++++-
source4/libcli/smb_composite/sesssetup.c | 26 ++++++++++++++++++++++----
3 files changed, 38 insertions(+), 10 deletions(-)
Changeset truncated at 500 lines:
diff --git a/libcli/auth/smbencrypt.c b/libcli/auth/smbencrypt.c
index d090345..366f6df 100644
--- a/libcli/auth/smbencrypt.c
+++ b/libcli/auth/smbencrypt.c
@@ -385,11 +385,18 @@ DATA_BLOB NTLMv2_generate_names_blob(TALLOC_CTX *mem_ctx,
DATA_BLOB names_blob = data_blob_talloc(mem_ctx, NULL, 0);
/* Deliberately ignore return here.. */
- (void)msrpc_gen(mem_ctx, &names_blob,
- "aaa",
- MsvAvNbDomainName, domain,
- MsvAvNbComputerName, hostname,
- MsvAvEOL, "");
+ if (hostname != NULL) {
+ (void)msrpc_gen(mem_ctx, &names_blob,
+ "aaa",
+ MsvAvNbDomainName, domain,
+ MsvAvNbComputerName, hostname,
+ MsvAvEOL, "");
+ } else {
+ (void)msrpc_gen(mem_ctx, &names_blob,
+ "aa",
+ MsvAvNbDomainName, domain,
+ MsvAvEOL, "");
+ }
return names_blob;
}
diff --git a/source4/libcli/raw/rawnegotiate.c
b/source4/libcli/raw/rawnegotiate.c
index 67f3bfa..4f8c13e 100644
--- a/source4/libcli/raw/rawnegotiate.c
+++ b/source4/libcli/raw/rawnegotiate.c
@@ -62,7 +62,10 @@ struct smbcli_request *smb_raw_negotiate_send(struct
smbcli_transport *transport
return NULL;
}
- flags2 |= FLAGS2_32_BIT_ERROR_CODES;
+ if (transport->options.ntstatus_support) {
+ flags2 |= FLAGS2_32_BIT_ERROR_CODES;
+ }
+
if (unicode) {
flags2 |= FLAGS2_UNICODE_STRINGS;
}
diff --git a/source4/libcli/smb_composite/sesssetup.c
b/source4/libcli/smb_composite/sesssetup.c
index e1159a4..ebc3598 100644
--- a/source4/libcli/smb_composite/sesssetup.c
+++ b/source4/libcli/smb_composite/sesssetup.c
@@ -280,8 +280,17 @@ static NTSTATUS session_setup_nt1(struct composite_context
*c,
struct smbcli_request **req)
{
NTSTATUS nt_status = NT_STATUS_INTERNAL_ERROR;
- struct sesssetup_state *state = talloc_get_type(c->private_data, struct
sesssetup_state);
- DATA_BLOB names_blob = NTLMv2_generate_names_blob(state,
session->transport->socket->hostname,
cli_credentials_get_domain(io->in.credentials));
+ struct sesssetup_state *state = talloc_get_type(c->private_data,
+ struct sesssetup_state);
+ const char *domain = cli_credentials_get_domain(io->in.credentials);
+
+ /*
+ * domain controllers tend to reject the NTLM v2 blob
+ * if the netbiosname is not valid (e.g. IP address or FQDN)
+ * so just leave it away (as Windows client do)
+ */
+ DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, NULL, domain);
+
DATA_BLOB session_key = data_blob(NULL, 0);
int flags = CLI_CRED_NTLM_AUTH;
@@ -353,9 +362,18 @@ static NTSTATUS session_setup_old(struct composite_context
*c,
struct smbcli_request **req)
{
NTSTATUS nt_status;
- struct sesssetup_state *state = talloc_get_type(c->private_data, struct
sesssetup_state);
+ struct sesssetup_state *state = talloc_get_type(c->private_data,
+ struct sesssetup_state);
const char *password = cli_credentials_get_password(io->in.credentials);
- DATA_BLOB names_blob = NTLMv2_generate_names_blob(state,
session->transport->socket->hostname,
cli_credentials_get_domain(io->in.credentials));
+ const char *domain = cli_credentials_get_domain(io->in.credentials);
+
+ /*
+ * domain controllers tend to reject the NTLM v2 blob
+ * if the netbiosname is not valid (e.g. IP address or FQDN)
+ * so just leave it away (as Windows client do)
+ */
+ DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, NULL, domain);
+
DATA_BLOB session_key;
int flags = 0;
if (session->options.lanman_auth) {
--
Samba Shared Repository
