Changeset 745 for trunk/server/libcli/auth/ntlm_check.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• libcli/auth/ntlm_check.c (modified) (20 diffs)

trunk/server/libcli/auth/ntlm_check.c

@@ -5 +5 @@
    Copyright (C) Gerald Carter                             2003
    Copyright (C) Luke Kenneth Casson Leighton         1996-2000
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -37 +37 @@
         /* Finish the encryption of part_passwd. */
         uint8_t p24[24];
-        
+
         if (part_passwd == NULL) {
                 DEBUG(10,("No password set - DISALLOWING access\n"));
@@ -43 +43 @@
                 return false;
         }
-        
+
         if (sec_blob->length != 8) {
                 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%lu)\n", 
@@ -49 +49 @@
                 return false;
         }
-        
+
         if (nt_response->length != 24) {
                 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%lu)\n", 
@@ -57 +57 @@
 
         SMBOWFencrypt(part_passwd, sec_blob->data, p24);
-        
+
 #if DEBUG_PASSWORD
         DEBUG(100,("Part password (P16) was |\n"));
@@ -107 +107 @@
                 return false;
         }
-        
+
         if (ntv2_response->length < 24) {
                 /* We MUST have more than 16 bytes, or the stuff below will go
@@ -181 +181 @@
                 return false;
         }
-        
+
         if (ntv2_response->length < 24) {
                 /* We MUST have more than 16 bytes, or the stuff below will go
@@ -219 +219 @@
 
 NTSTATUS hash_password_check(TALLOC_CTX *mem_ctx,
-                                 bool lanman_auth,
+                             bool lanman_auth,
                              const struct samr_Password *client_lanman,
                              const struct samr_Password *client_nt,
@@ -282 +282 @@
 
 NTSTATUS ntlm_password_check(TALLOC_CTX *mem_ctx,
-                                 bool lanman_auth,
-                                 bool ntlm_auth,
+                             bool lanman_auth,
+                             bool ntlm_auth,
                              uint32_t logon_parameters,
                              const DATA_BLOB *challenge,
@@ -319 +319 @@
                          username));
                 mdfour(client_nt.hash, nt_response->data, nt_response->length);
-                
+
                 if (lm_response->length && 
                     (convert_string_talloc(mem_ctx, CH_DOS, CH_UNIX, 
@@ -344 +344 @@
                          (unsigned long)nt_response->length, username));                
         }
-        
+
         if (nt_response->length > 24 && stored_nt) {
                 /* We have the NT MD4 hash challenge available - see if we can
@@ -362 +362 @@
                         return NT_STATUS_OK;
                 }
-                
+
                 DEBUG(4,("ntlm_password_check: Checking NTLMv2 password with uppercased version of domain [%s]\n", client_domain));
                 if (smb_pwd_check_ntlmv2(mem_ctx,
@@ -376 +376 @@
                         return NT_STATUS_OK;
                 }
-                
+
                 DEBUG(4,("ntlm_password_check: Checking NTLMv2 password without a domain\n"));
                 if (smb_pwd_check_ntlmv2(mem_ctx,
@@ -404 +404 @@
                                 /* The LM session key for this response is not very secure, 
                                    so use it only if we otherwise allow LM authentication */
-                                
+
                                 if (lanman_auth && stored_lanman) {
                                         *lm_sess_key = data_blob_talloc(mem_ctx, stored_lanman->hash, MIN(8, user_sess_key->length));
@@ -417 +417 @@
                         DEBUG(2,("ntlm_password_check: NTLMv1 passwords NOT PERMITTED for user %s\n",
                                  username));                    
-                        /* no return, becouse we might pick up LMv2 in the LM field */
-                }
-        }
-        
+                        /* no return, because we might pick up LMv2 in the LM field */
+                }
+        }
+
         if (lm_response->length == 0) {
                 DEBUG(3,("ntlm_password_check: NEITHER LanMan nor NT password supplied for user %s\n",
@@ -426 +426 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-        
+
         if (lm_response->length < 24) {
                 DEBUG(2,("ntlm_password_check: invalid LanMan password length (%lu) for user %s\n", 
@@ -432 +432 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-                
+
         if (!lanman_auth) {
                 DEBUG(3,("ntlm_password_check: Lanman passwords NOT PERMITTED for user %s\n",
@@ -462 +462 @@
                 }
         }
-        
+
         if (!stored_nt) {
                 DEBUG(4,("ntlm_password_check: LM password check failed for user, no NT password %s\n",username));
                 return NT_STATUS_WRONG_PASSWORD;
         }
-        
+
         /* This is for 'LMv2' authentication.  almost NTLMv2 but limited to 24 bytes.
            - related to Win9X, legacy NAS pass-though authentication
@@ -500 +500 @@
                 return NT_STATUS_OK;
         }
-        
+
         DEBUG(4,("ntlm_password_check: Checking LMv2 password with upper-cased version of domain %s\n", client_domain));
         if (smb_pwd_check_ntlmv2(mem_ctx,
@@ -530 +530 @@
                 return NT_STATUS_OK;
         }
-        
+
         DEBUG(4,("ntlm_password_check: Checking LMv2 password without a domain\n"));
         if (smb_pwd_check_ntlmv2(mem_ctx,