Changeset 740 for vendor/current/libcli/auth

Timestamp:

Nov 14, 2012, 12:59:34 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to 3.6.0

Location:

vendor/current/libcli/auth

Files:

• config.mk (deleted)
• credentials.c (modified) (1 diff)
• credentials.h (modified) (1 diff)
• msrpc_parse.c (modified) (11 diffs)
• msrpc_parse.h (modified) (2 diffs)
• ntlm_check.c (modified) (20 diffs)
• ntlmssp.c (added)
• ntlmssp.h (added)
• ntlmssp_ndr.c (added)
• ntlmssp_ndr.h (added)
• ntlmssp_private.h (added)
• ntlmssp_server.c (added)
• ntlmssp_sign.c (added)
• pam_errors.c (added)
• pam_errors.h (added)
• proto.h (modified) (1 diff)
• schannel_proto.h (modified) (2 diffs)
• schannel_sign.c (modified) (1 diff)
• schannel_state.h (modified) (2 diffs)
• schannel_state_ldb.c (deleted)
• schannel_state_proto.h (deleted)
• schannel_state_tdb.c (modified) (9 diffs)
• smbdes.c (modified) (2 diffs)
• smbencrypt.c (modified) (4 diffs)
• spnego.h (modified) (2 diffs)
• spnego_parse.c (modified) (4 diffs)
• wscript_build (added)

vendor/current/libcli/auth/credentials.c

@@ -250 +250 @@
                                                                               const uint8_t session_key[16])
 {
-        struct netlogon_creds_CredentialState *creds = talloc(mem_ctx, struct netlogon_creds_CredentialState);
-        
+        struct netlogon_creds_CredentialState *creds;
+
+        creds = talloc_zero(mem_ctx, struct netlogon_creds_CredentialState);
         if (!creds) {
                 return NULL;

vendor/current/libcli/auth/credentials.h

@@ -69 +69 @@
 #define NETLOGON_NEG_AUTH2_ADS_FLAGS (0x200fbffb | NETLOGON_NEG_ARCFOUR | NETLOGON_NEG_128BIT | NETLOGON_NEG_SCHANNEL)
 
+#define NETLOGON_NEG_AUTH2_RODC_FLAGS (NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_RODC_PASSTHROUGH)
 

vendor/current/libcli/auth/msrpc_parse.c

@@ -41 +41 @@
   C = constant ascii string
  */
-bool msrpc_gen(TALLOC_CTX *mem_ctx, 
+NTSTATUS msrpc_gen(TALLOC_CTX *mem_ctx, 
                DATA_BLOB *blob,
                const char *format, ...)
@@ -58 +58 @@
 
         pointers = talloc_array(mem_ctx, DATA_BLOB, strlen(format));
+        if (!pointers) {
+                return NT_STATUS_NO_MEMORY;
+        }
         intargs = talloc_array(pointers, int, strlen(format));
+        if (!intargs) {
+                return NT_STATUS_NO_MEMORY;
+        }
 
         /* first scan the format to work out the header and body size */
@@ -73 +79 @@
                         if (!ret) {
                                 va_end(ap);
-                                return false;
+                                return map_nt_error_from_unix(errno);
                         }
                         pointers[i].length = n;
@@ -87 +93 @@
                         if (!ret) {
                                 va_end(ap);
-                                return false;
+                                return map_nt_error_from_unix(errno);
                         }
                         pointers[i].length = n;
@@ -103 +109 @@
                         if (!ret) {
                                 va_end(ap);
-                                return false;
+                                return map_nt_error_from_unix(errno);
                         }
                         pointers[i].length = n;
@@ -133 +139 @@
                         head_size += pointers[i].length;
                         break;
+                default:
+                        va_end(ap);
+                        return NT_STATUS_INVALID_PARAMETER;
                 }
         }
         va_end(ap);
+
+        if (head_size + data_size == 0) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         /* allocate the space, then scan the format again to fill in the values */
         *blob = data_blob_talloc(mem_ctx, NULL, head_size + data_size);
-
+        if (!blob->data) {
+                return NT_STATUS_NO_MEMORY;
+        }
         head_ofs = 0;
         data_ofs = head_size;
@@ -175 +190 @@
                 case 'b':
                         n = pointers[i].length;
-                        memcpy(blob->data + head_ofs, pointers[i].data, n);
+                        if (pointers[i].data && n) {
+                                /* don't follow null pointers... */
+                                memcpy(blob->data + head_ofs, pointers[i].data, n);
+                        }
                         head_ofs += n;
                         break;
@@ -183 +201 @@
                         head_ofs += n;
                         break;
+                default:
+                        va_end(ap);
+                        return NT_STATUS_INVALID_PARAMETER;
                 }
         }
@@ -189 +210 @@
         talloc_free(pointers);
 
-        return true;
+        return NT_STATUS_OK;
 }
 
@@ -229 +250 @@
         bool ret = true;
 
+        if (!p) {
+                return false;
+        }
+
         va_start(ap, format);
         for (i=0; format[i]; i++) {
@@ -334 +359 @@
                 case 'b':
                         b = (DATA_BLOB *)va_arg(ap, void *);
-                        len1 = va_arg(ap, uint_t);
+                        len1 = va_arg(ap, unsigned int);
                         /* make sure its in the right format - be strict */
                         NEED_DATA(len1);

vendor/current/libcli/auth/msrpc_parse.h

@@ +1 @@
+/*
+   Unix SMB/CIFS implementation.
+   simple kerberos5/SPNEGO routines
+   Copyright (C) Andrew Tridgell 2001
+   Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
+   Copyright (C) Andrew Bartlett 2002-2003
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
 #ifndef _LIBCLI_AUTH_MSRPC_PARSE_H__
 #define _LIBCLI_AUTH_MSRPC_PARSE_H__
@@ -12 +33 @@
 /* The following definitions come from /home/jeremy/src/samba/git/master/source3/../source4/../libcli/auth/msrpc_parse.c  */
 
-bool msrpc_gen(TALLOC_CTX *mem_ctx, 
+NTSTATUS msrpc_gen(TALLOC_CTX *mem_ctx, 
                DATA_BLOB *blob,
                const char *format, ...);

vendor/current/libcli/auth/ntlm_check.c

@@ -5 +5 @@
    Copyright (C) Gerald Carter                             2003
    Copyright (C) Luke Kenneth Casson Leighton         1996-2000
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -37 +37 @@
         /* Finish the encryption of part_passwd. */
         uint8_t p24[24];
-        
+
         if (part_passwd == NULL) {
                 DEBUG(10,("No password set - DISALLOWING access\n"));
@@ -43 +43 @@
                 return false;
         }
-        
+
         if (sec_blob->length != 8) {
                 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%lu)\n", 
@@ -49 +49 @@
                 return false;
         }
-        
+
         if (nt_response->length != 24) {
                 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%lu)\n", 
@@ -57 +57 @@
 
         SMBOWFencrypt(part_passwd, sec_blob->data, p24);
-        
+
 #if DEBUG_PASSWORD
         DEBUG(100,("Part password (P16) was |\n"));
@@ -107 +107 @@
                 return false;
         }
-        
+
         if (ntv2_response->length < 24) {
                 /* We MUST have more than 16 bytes, or the stuff below will go
@@ -181 +181 @@
                 return false;
         }
-        
+
         if (ntv2_response->length < 24) {
                 /* We MUST have more than 16 bytes, or the stuff below will go
@@ -219 +219 @@
 
 NTSTATUS hash_password_check(TALLOC_CTX *mem_ctx,
-                                 bool lanman_auth,
+                             bool lanman_auth,
                              const struct samr_Password *client_lanman,
                              const struct samr_Password *client_nt,
@@ -282 +282 @@
 
 NTSTATUS ntlm_password_check(TALLOC_CTX *mem_ctx,
-                                 bool lanman_auth,
-                                 bool ntlm_auth,
+                             bool lanman_auth,
+                             bool ntlm_auth,
                              uint32_t logon_parameters,
                              const DATA_BLOB *challenge,
@@ -319 +319 @@
                          username));
                 mdfour(client_nt.hash, nt_response->data, nt_response->length);
-                
+
                 if (lm_response->length && 
                     (convert_string_talloc(mem_ctx, CH_DOS, CH_UNIX, 
@@ -344 +344 @@
                          (unsigned long)nt_response->length, username));                
         }
-        
+
         if (nt_response->length > 24 && stored_nt) {
                 /* We have the NT MD4 hash challenge available - see if we can
@@ -362 +362 @@
                         return NT_STATUS_OK;
                 }
-                
+
                 DEBUG(4,("ntlm_password_check: Checking NTLMv2 password with uppercased version of domain [%s]\n", client_domain));
                 if (smb_pwd_check_ntlmv2(mem_ctx,
@@ -376 +376 @@
                         return NT_STATUS_OK;
                 }
-                
+
                 DEBUG(4,("ntlm_password_check: Checking NTLMv2 password without a domain\n"));
                 if (smb_pwd_check_ntlmv2(mem_ctx,
@@ -404 +404 @@
                                 /* The LM session key for this response is not very secure, 
                                    so use it only if we otherwise allow LM authentication */
-                                
+
                                 if (lanman_auth && stored_lanman) {
                                         *lm_sess_key = data_blob_talloc(mem_ctx, stored_lanman->hash, MIN(8, user_sess_key->length));
@@ -417 +417 @@
                         DEBUG(2,("ntlm_password_check: NTLMv1 passwords NOT PERMITTED for user %s\n",
                                  username));                    
-                        /* no return, becouse we might pick up LMv2 in the LM field */
-                }
-        }
-        
+                        /* no return, because we might pick up LMv2 in the LM field */
+                }
+        }
+
         if (lm_response->length == 0) {
                 DEBUG(3,("ntlm_password_check: NEITHER LanMan nor NT password supplied for user %s\n",
@@ -426 +426 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-        
+
         if (lm_response->length < 24) {
                 DEBUG(2,("ntlm_password_check: invalid LanMan password length (%lu) for user %s\n", 
@@ -432 +432 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-                
+
         if (!lanman_auth) {
                 DEBUG(3,("ntlm_password_check: Lanman passwords NOT PERMITTED for user %s\n",
@@ -462 +462 @@
                 }
         }
-        
+
         if (!stored_nt) {
                 DEBUG(4,("ntlm_password_check: LM password check failed for user, no NT password %s\n",username));
                 return NT_STATUS_WRONG_PASSWORD;
         }
-        
+
         /* This is for 'LMv2' authentication.  almost NTLMv2 but limited to 24 bytes.
            - related to Win9X, legacy NAS pass-though authentication
@@ -500 +500 @@
                 return NT_STATUS_OK;
         }
-        
+
         DEBUG(4,("ntlm_password_check: Checking LMv2 password with upper-cased version of domain %s\n", client_domain));
         if (smb_pwd_check_ntlmv2(mem_ctx,
@@ -530 +530 @@
                 return NT_STATUS_OK;
         }
-        
+
         DEBUG(4,("ntlm_password_check: Checking LMv2 password without a domain\n"));
         if (smb_pwd_check_ntlmv2(mem_ctx,

vendor/current/libcli/auth/proto.h

@@ -195 +195 @@
 void des_crypt64(uint8_t out[8], const uint8_t in[8], const uint8_t key[8], int forw);
 void des_crypt112(uint8_t out[8], const uint8_t in[8], const uint8_t key[14], int forw);
-void des_crypt112_16(uint8_t out[16], uint8_t in[16], const uint8_t key[14], int forw);
-void sam_rid_crypt(uint_t rid, const uint8_t *in, uint8_t *out, int forw);
+void des_crypt112_16(uint8_t out[16], const uint8_t in[16], const uint8_t key[14], int forw);
+void sam_rid_crypt(unsigned int rid, const uint8_t *in, uint8_t *out, int forw);
 #undef _PRINTF_ATTRIBUTE
 #define _PRINTF_ATTRIBUTE(a1, a2)

vendor/current/libcli/auth/schannel_proto.h

@@ -24 +24 @@
 #define _LIBCLI_AUTH_SCHANNEL_PROTO_H__
 
+struct schannel_state;
+
+struct tdb_wrap *open_schannel_session_store(TALLOC_CTX *mem_ctx,
+                                             const char *private_dir);
+
 NTSTATUS netsec_incoming_packet(struct schannel_state *state,
                                 TALLOC_CTX *mem_ctx,
@@ -29 +34 @@
                                 uint8_t *data, size_t length,
                                 const DATA_BLOB *sig);
+uint32_t netsec_outgoing_sig_size(struct schannel_state *state);
 NTSTATUS netsec_outgoing_packet(struct schannel_state *state,
                                 TALLOC_CTX *mem_ctx,

vendor/current/libcli/auth/schannel_sign.c

@@ -205 +205 @@
 }
 
+uint32_t netsec_outgoing_sig_size(struct schannel_state *state)
+{
+        uint32_t sig_size = 0;
+
+        netsec_offset_and_sizes(state,
+                                true,
+                                NULL,
+                                &sig_size,
+                                NULL,
+                                NULL);
+
+        return sig_size;
+}
+
 NTSTATUS netsec_outgoing_packet(struct schannel_state *state,
                                 TALLOC_CTX *mem_ctx,

vendor/current/libcli/auth/schannel_state.h

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -11 +11 @@
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-struct ldb_context;
-struct tdb_context;
-#include "libcli/auth/schannel_state_proto.h"
+#ifndef _LIBCLI_AUTH_SCHANNEL_STATE_H__
+#define _LIBCLI_AUTH_SCHANNEL_STATE_H__
+
+NTSTATUS schannel_get_creds_state(TALLOC_CTX *mem_ctx,
+                                  const char *db_priv_dir,
+                                  const char *computer_name,
+                                  struct netlogon_creds_CredentialState **creds);
+
+NTSTATUS schannel_save_creds_state(TALLOC_CTX *mem_ctx,
+                                   const char *db_priv_dir,
+                                   struct netlogon_creds_CredentialState *creds);
+
+NTSTATUS schannel_check_creds_state(TALLOC_CTX *mem_ctx,
+                                    const char *db_priv_dir,
+                                    const char *computer_name,
+                                    struct netr_Authenticator *received_authenticator,
+                                    struct netr_Authenticator *return_authenticator,
+                                    struct netlogon_creds_CredentialState **creds_out);
+
+#endif

vendor/current/libcli/auth/schannel_state_tdb.c

@@ -23 +23 @@
 
 #include "includes.h"
-#include "../libcli/auth/libcli_auth.h"
-#include "../libcli/auth/schannel_state.h"
+#include "system/filesys.h"
+#include <tdb.h>
+#include "../lib/util/util_tdb.h"
+#include "../libcli/auth/schannel.h"
 #include "../librpc/gen_ndr/ndr_schannel.h"
+#include "lib/util/tdb_wrap.h"
+
+#define SECRETS_SCHANNEL_STATE "SECRETS/SCHANNEL"
+
+/******************************************************************************
+ Open or create the schannel session store tdb.  Non-static so it can
+ be called from parent processes to corectly handle TDB_CLEAR_IF_FIRST
+*******************************************************************************/
+
+struct tdb_wrap *open_schannel_session_store(TALLOC_CTX *mem_ctx,
+                                             const char *private_dir)
+{
+        struct tdb_wrap *tdb_sc = NULL;
+        char *fname = talloc_asprintf(mem_ctx, "%s/schannel_store.tdb", private_dir);
+
+        if (!fname) {
+                return NULL;
+        }
+
+        tdb_sc = tdb_wrap_open(mem_ctx, fname, 0, TDB_CLEAR_IF_FIRST|TDB_NOSYNC, O_RDWR|O_CREAT, 0600);
+
+        if (!tdb_sc) {
+                DEBUG(0,("open_schannel_session_store: Failed to open %s - %s\n",
+                         fname, strerror(errno)));
+                TALLOC_FREE(fname);
+                return NULL;
+        }
+
+        TALLOC_FREE(fname);
+
+        return tdb_sc;
+}
 
 /********************************************************************
  ********************************************************************/
 
-NTSTATUS schannel_store_session_key_tdb(struct tdb_context *tdb,
+static
+NTSTATUS schannel_store_session_key_tdb(struct tdb_wrap *tdb_sc,
                                         TALLOC_CTX *mem_ctx,
                                         struct netlogon_creds_CredentialState *creds)
@@ -39 +74 @@
         int ret;
         char *keystr;
-
-        keystr = talloc_asprintf_strupper_m(mem_ctx, "%s/%s",
-                                            SECRETS_SCHANNEL_STATE,
-                                            creds->computer_name);
+        char *name_upper;
+
+        name_upper = strupper_talloc(mem_ctx, creds->computer_name);
+        if (!name_upper) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        keystr = talloc_asprintf(mem_ctx, "%s/%s",
+                                 SECRETS_SCHANNEL_STATE, name_upper);
+        TALLOC_FREE(name_upper);
         if (!keystr) {
                 return NT_STATUS_NO_MEMORY;
         }
 
-        ndr_err = ndr_push_struct_blob(&blob, mem_ctx, NULL, creds,
+        ndr_err = ndr_push_struct_blob(&blob, mem_ctx, creds,
                         (ndr_push_flags_fn_t)ndr_push_netlogon_creds_CredentialState);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -57 +98 @@
         value.dsize = blob.length;
 
-        ret = tdb_store_bystring(tdb, keystr, value, TDB_REPLACE);
+        ret = tdb_store_bystring(tdb_sc->tdb, keystr, value, TDB_REPLACE);
         if (ret != TDB_SUCCESS) {
                 DEBUG(0,("Unable to add %s to session key db - %s\n",
-                         keystr, tdb_errorstr(tdb)));
+                         keystr, tdb_errorstr(tdb_sc->tdb)));
                 talloc_free(keystr);
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -80 +121 @@
  ********************************************************************/
 
-NTSTATUS schannel_fetch_session_key_tdb(struct tdb_context *tdb,
+static
+NTSTATUS schannel_fetch_session_key_tdb(struct tdb_wrap *tdb_sc,
                                         TALLOC_CTX *mem_ctx,
                                         const char *computer_name,
@@ -91 +133 @@
         struct netlogon_creds_CredentialState *creds = NULL;
         char *keystr = NULL;
+        char *name_upper;
 
         *pcreds = NULL;
 
-        keystr = talloc_asprintf_strupper_m(mem_ctx, "%s/%s",
-                                            SECRETS_SCHANNEL_STATE,
-                                            computer_name);
+        name_upper = strupper_talloc(mem_ctx, computer_name);
+        if (!name_upper) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        keystr = talloc_asprintf(mem_ctx, "%s/%s",
+                                 SECRETS_SCHANNEL_STATE, name_upper);
+        TALLOC_FREE(name_upper);
         if (!keystr) {
-                status = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        value = tdb_fetch_bystring(tdb, keystr);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        value = tdb_fetch_bystring(tdb_sc->tdb, keystr);
         if (!value.dptr) {
-                DEBUG(0,("schannel_fetch_session_key_tdb: Failed to find entry with key %s\n",
+                DEBUG(10,("schannel_fetch_session_key_tdb: Failed to find entry with key %s\n",
                         keystr ));
                 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -118 +165 @@
         blob = data_blob_const(value.dptr, value.dsize);
 
-        ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, NULL, creds,
+        ndr_err = ndr_pull_struct_blob(&blob, creds, creds,
                         (ndr_pull_flags_fn_t)ndr_pull_netlogon_creds_CredentialState);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -137 +184 @@
 
         talloc_free(keystr);
+        SAFE_FREE(value.dptr);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -148 +196 @@
 }
 
+/******************************************************************************
+ Wrapper around schannel_fetch_session_key_tdb()
+ Note we must be root here.
+*******************************************************************************/
+
+NTSTATUS schannel_get_creds_state(TALLOC_CTX *mem_ctx,
+                                  const char *db_priv_dir,
+                                  const char *computer_name,
+                                  struct netlogon_creds_CredentialState **_creds)
+{
+        TALLOC_CTX *tmpctx;
+        struct tdb_wrap *tdb_sc;
+        struct netlogon_creds_CredentialState *creds;
+        NTSTATUS status;
+
+        tmpctx = talloc_named(mem_ctx, 0, "schannel_get_creds_state");
+        if (!tmpctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        tdb_sc = open_schannel_session_store(tmpctx, db_priv_dir);
+        if (!tdb_sc) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        status = schannel_fetch_session_key_tdb(tdb_sc, tmpctx, 
+                                                computer_name, &creds);
+        if (NT_STATUS_IS_OK(status)) {
+                *_creds = talloc_steal(mem_ctx, creds);
+                if (!*_creds) {
+                        status = NT_STATUS_NO_MEMORY;
+                }
+        }
+
+        talloc_free(tmpctx);
+        return status;
+}
+
+/******************************************************************************
+ Wrapper around schannel_store_session_key_tdb()
+ Note we must be root here.
+*******************************************************************************/
+
+NTSTATUS schannel_save_creds_state(TALLOC_CTX *mem_ctx,
+                                   const char *db_priv_dir,
+                                   struct netlogon_creds_CredentialState *creds)
+{
+        TALLOC_CTX *tmpctx;
+        struct tdb_wrap *tdb_sc;
+        NTSTATUS status;
+
+        tmpctx = talloc_named(mem_ctx, 0, "schannel_save_creds_state");
+        if (!tmpctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        tdb_sc = open_schannel_session_store(tmpctx, db_priv_dir);
+        if (!tdb_sc) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        status = schannel_store_session_key_tdb(tdb_sc, tmpctx, creds);
+
+        talloc_free(tmpctx);
+        return status;
+}
+
 /********************************************************************
-
-  Validate an incoming authenticator against the credentials for the remote
-  machine.
-
-  The credentials are (re)read and from the schannel database, and
-  written back after the caclulations are performed.
-
-  The creds_out parameter (if not NULL) returns the credentials, if
-  the caller needs some of that information.
-
+ Validate an incoming authenticator against the credentials for the
+ remote machine stored in the schannel database.
+
+ The credentials are (re)read and from the schannel database, and
+ written back after the caclulations are performed.
+
+ If the creds_out parameter is not NULL returns the credentials.
  ********************************************************************/
 
-NTSTATUS schannel_creds_server_step_check_tdb(struct tdb_context *tdb,
-                                              TALLOC_CTX *mem_ctx,
-                                              const char *computer_name,
-                                              bool schannel_required_for_call,
-                                              bool schannel_in_use,
-                                              struct netr_Authenticator *received_authenticator,
-                                              struct netr_Authenticator *return_authenticator,
-                                              struct netlogon_creds_CredentialState **creds_out)
-{
+NTSTATUS schannel_check_creds_state(TALLOC_CTX *mem_ctx,
+                                    const char *db_priv_dir,
+                                    const char *computer_name,
+                                    struct netr_Authenticator *received_authenticator,
+                                    struct netr_Authenticator *return_authenticator,
+                                    struct netlogon_creds_CredentialState **creds_out)
+{
+        TALLOC_CTX *tmpctx;
+        struct tdb_wrap *tdb_sc;
         struct netlogon_creds_CredentialState *creds;
         NTSTATUS status;
         int ret;
 
-        ret = tdb_transaction_start(tdb);
+        tmpctx = talloc_named(mem_ctx, 0, "schannel_check_creds_state");
+        if (!tmpctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        tdb_sc = open_schannel_session_store(tmpctx, db_priv_dir);
+        if (!tdb_sc) {
+                status = NT_STATUS_ACCESS_DENIED;
+                goto done;
+        }
+
+        ret = tdb_transaction_start(tdb_sc->tdb);
         if (ret != 0) {
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+                goto done;
         }
 
@@ -183 +307 @@
          * update the structure */
 
-        status = schannel_fetch_session_key_tdb(tdb, mem_ctx, computer_name,
-                                                &creds);
-
-        /* If we are flaged that schannel is required for a call, and
-         * it is not in use, then make this an error */
-
-        /* It would be good to make this mandatory once schannel is
-         * negotiated, but this is not what windows does */
-        if (schannel_required_for_call && !schannel_in_use) {
-                DEBUG(0,("schannel_creds_server_step_check_tdb: "
-                        "client %s not using schannel for netlogon, despite negotiating it\n",
-                        creds->computer_name ));
-                tdb_transaction_cancel(tdb);
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        if (NT_STATUS_IS_OK(status)) {
-                status = netlogon_creds_server_step_check(creds,
-                                                          received_authenticator,
-                                                          return_authenticator);
-        }
-
-        if (NT_STATUS_IS_OK(status)) {
-                status = schannel_store_session_key_tdb(tdb, mem_ctx, creds);
-        }
-
-        if (NT_STATUS_IS_OK(status)) {
-                tdb_transaction_commit(tdb);
-                if (creds_out) {
-                        *creds_out = creds;
-                        talloc_steal(mem_ctx, creds);
+        status = schannel_fetch_session_key_tdb(tdb_sc, tmpctx, 
+                                                computer_name, &creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                tdb_transaction_cancel(tdb_sc->tdb);
+                goto done;
+        }
+
+        status = netlogon_creds_server_step_check(creds,
+                                                  received_authenticator,
+                                                  return_authenticator);
+        if (!NT_STATUS_IS_OK(status)) {
+                tdb_transaction_cancel(tdb_sc->tdb);
+                goto done;
+        }
+
+        status = schannel_store_session_key_tdb(tdb_sc, tmpctx, creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                tdb_transaction_cancel(tdb_sc->tdb);
+                goto done;
+        }
+
+        tdb_transaction_commit(tdb_sc->tdb);
+
+        if (creds_out) {
+                *creds_out = talloc_steal(mem_ctx, creds);
+                if (!*creds_out) {
+                        status = NT_STATUS_NO_MEMORY;
+                        goto done;
                 }
-        } else {
-                tdb_transaction_cancel(tdb);
-        }
-
+        }
+
+        status = NT_STATUS_OK;
+
+done:
+        talloc_free(tmpctx);
         return status;
 }
+

vendor/current/libcli/auth/smbdes.c

@@ -359 +359 @@
 
 /* des encryption of a 16 byte lump of data with a 112 bit key */
-void des_crypt112_16(uint8_t out[16], uint8_t in[16], const uint8_t key[14], int forw)
+void des_crypt112_16(uint8_t out[16], const uint8_t in[16], const uint8_t key[14], int forw)
 {
         des_crypt56(out, in, key, forw);
@@ -368 +368 @@
    same method used to store passwords in the NT registry.  The DES key
    used is based on the RID of the user. */
-void sam_rid_crypt(uint_t rid, const uint8_t *in, uint8_t *out, int forw)
+void sam_rid_crypt(unsigned int rid, const uint8_t *in, uint8_t *out, int forw)
 {
         uint8_t s[14];

vendor/current/libcli/auth/smbencrypt.c

@@ -364 +364 @@
         DATA_BLOB names_blob = data_blob_talloc(mem_ctx, NULL, 0);
 
-        msrpc_gen(mem_ctx, &names_blob,
+        /* Deliberately ignore return here.. */
+        (void)msrpc_gen(mem_ctx, &names_blob,
                   "aaa",
                   MsvAvNbDomainName, domain,
@@ -387 +388 @@
         /* See http://www.ubiqx.org/cifs/SMB.html#SMB.8.5 */
 
-        msrpc_gen(mem_ctx, &response, "ddbbdb",
+        /* Deliberately ignore return here.. */
+        (void)msrpc_gen(mem_ctx, &response, "ddbbdb",
                   0x00000101,     /* Header  */
                   0,              /* 'Reserved'  */
@@ -530 +532 @@
 {
         uint8_t new_pw[512];
-        size_t new_pw_len;
+        ssize_t new_pw_len;
 
         /* the incoming buffer can be any alignment. */
@@ -538 +540 @@
                                  password,
                                  sizeof(new_pw), string_flags);
+        if (new_pw_len == -1) {
+                return false;
+        }
 
         memcpy(&buffer[512 - new_pw_len], new_pw, new_pw_len);

vendor/current/libcli/auth/spnego.h

@@ -26 +26 @@
 #define OID_KERBEROS5 "1.2.840.113554.1.2.2"
 
+#define ADS_IGNORE_PRINCIPAL "not_defined_in_RFC4178@please_ignore"
+
 #define SPNEGO_DELEG_FLAG    0x01
 #define SPNEGO_MUTUAL_FLAG   0x02
@@ -33 +35 @@
 #define SPNEGO_CONF_FLAG     0x20
 #define SPNEGO_INTEG_FLAG    0x40
+
+#define TOK_ID_KRB_AP_REQ       ((const uint8_t *)"\x01\x00")
+#define TOK_ID_KRB_AP_REP       ((const uint8_t *)"\x02\x00")
+#define TOK_ID_KRB_ERROR        ((const uint8_t *)"\x03\x00")
+#define TOK_ID_GSS_GETMIC       ((const uint8_t *)"\x01\x01")
+#define TOK_ID_GSS_WRAP         ((const uint8_t *)"\x02\x01")
 
 enum spnego_negResult {

vendor/current/libcli/auth/spnego_parse.c

@@ -50 +50 @@
                         for (i = 0; !asn1->has_error &&
                                      0 < asn1_tag_remaining(asn1); i++) {
+                                char *oid;
                                 token->mechTypes = talloc_realloc(NULL,
                                                                   token->mechTypes,
                                                                   const char *, i+2);
-                                asn1_read_OID(asn1, token->mechTypes, token->mechTypes + i);
+                                asn1_read_OID(asn1, token->mechTypes, &oid);
+                                token->mechTypes[i] = oid;
                         }
                         token->mechTypes[i] = NULL;
@@ -185 +187 @@
         while (!asn1->has_error && 0 < asn1_tag_remaining(asn1)) {
                 uint8_t context;
+                char *oid;
                 if (!asn1_peek_uint8(asn1, &context)) {
                         asn1->has_error = true;
@@ -200 +203 @@
                 case ASN1_CONTEXT(1):
                         asn1_start_tag(asn1, ASN1_CONTEXT(1));
-                        asn1_read_OID(asn1, mem_ctx, &token->supportedMech);
+                        asn1_read_OID(asn1, mem_ctx, &oid);
+                        token->supportedMech = oid;
                         asn1_end_tag(asn1);
                         break;
@@ -381 +385 @@
         struct asn1_data *asn1 = asn1_init(mem_ctx);
 
+        if (asn1 == NULL) {
+                return false;
+        }
+
         /* Write mechTypes */
         if (mech_types && *mech_types) {