Changeset 988 for vendor/current/libcli/auth

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/libcli/auth

Files:

• credentials.c (modified) (22 diffs)
• credentials.h (modified) (1 diff)
• msrpc_parse.c (modified) (6 diffs)
• netlogon_creds_cli.c (added)
• netlogon_creds_cli.h (added)
• ntlm_check.c (modified) (5 diffs)
• ntlmssp.c (deleted)
• ntlmssp.h (deleted)
• ntlmssp_ndr.c (deleted)
• ntlmssp_ndr.h (deleted)
• ntlmssp_private.h (deleted)
• ntlmssp_server.c (deleted)
• ntlmssp_sign.c (deleted)
• proto.h (modified) (6 diffs)
• schannel.h (modified) (1 diff)
• schannel_proto.h (modified) (1 diff)
• schannel_sign.c (deleted)
• schannel_state.h (modified) (1 diff)
• schannel_state_tdb.c (modified) (19 diffs)
• smbencrypt.c (modified) (15 diffs)
• spnego.h (modified) (2 diffs)
• spnego_parse.c (modified) (14 diffs)
• spnego_proto.h (modified) (1 diff)
• wscript_build (modified) (4 diffs)

vendor/current/libcli/auth/credentials.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -6 +6 @@
    Copyright (C) Andrew Tridgell 1997-2003
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -31 +31 @@
                                       struct netr_Credential *out)
 {
-        des_crypt112(out->data, in->data, creds->session_key, 1);
+        if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+                AES_KEY key;
+                uint8_t iv[AES_BLOCK_SIZE];
+
+                AES_set_encrypt_key(creds->session_key, 128, &key);
+                ZERO_STRUCT(iv);
+
+                aes_cfb8_encrypt(in->data, out->data, 8, &key, iv, AES_ENCRYPT);
+        } else {
+                des_crypt112(out->data, in->data, creds->session_key, 1);
+        }
 }
 
@@ -76 +86 @@
         memset(zero, 0, sizeof(zero));
 
-        hmac_md5_init_rfc2104(machine_password->hash, sizeof(machine_password->hash), &ctx);    
+        hmac_md5_init_rfc2104(machine_password->hash, sizeof(machine_password->hash), &ctx);
         MD5Init(&md5);
         MD5Update(&md5, zero, sizeof(zero));
@@ -86 +96 @@
 }
 
+/*
+  initialise the credentials state for AES/HMAC-SHA256-style 128 bit session keys
+
+  this call is made after the netr_ServerReqChallenge call
+*/
+static void netlogon_creds_init_hmac_sha256(struct netlogon_creds_CredentialState *creds,
+                                            const struct netr_Credential *client_challenge,
+                                            const struct netr_Credential *server_challenge,
+                                            const struct samr_Password *machine_password)
+{
+        struct HMACSHA256Context ctx;
+        uint8_t digest[SHA256_DIGEST_LENGTH];
+
+        ZERO_STRUCT(creds->session_key);
+
+        hmac_sha256_init(machine_password->hash,
+                         sizeof(machine_password->hash),
+                         &ctx);
+        hmac_sha256_update(client_challenge->data, 8, &ctx);
+        hmac_sha256_update(server_challenge->data, 8, &ctx);
+        hmac_sha256_final(digest, &ctx);
+
+        memcpy(creds->session_key, digest, sizeof(creds->session_key));
+
+        ZERO_STRUCT(digest);
+        ZERO_STRUCT(ctx);
+}
+
 static void netlogon_creds_first_step(struct netlogon_creds_CredentialState *creds,
                                       const struct netr_Credential *client_challenge,
@@ -105 +143 @@
         struct netr_Credential time_cred;
 
-        DEBUG(5,("\tseed        %08x:%08x\n", 
+        DEBUG(5,("\tseed        %08x:%08x\n",
                  IVAL(creds->seed.data, 0), IVAL(creds->seed.data, 4)));
 
@@ -115 +153 @@
         netlogon_creds_step_crypt(creds, &time_cred, &creds->client);
 
-        DEBUG(5,("\tCLIENT      %08x:%08x\n", 
+        DEBUG(5,("\tCLIENT      %08x:%08x\n",
                  IVAL(creds->client.data, 0), IVAL(creds->client.data, 4)));
 
@@ -121 +159 @@
         SIVAL(time_cred.data, 4, IVAL(creds->seed.data, 4));
 
-        DEBUG(5,("\tseed+time+1 %08x:%08x\n", 
+        DEBUG(5,("\tseed+time+1 %08x:%08x\n",
                  IVAL(time_cred.data, 0), IVAL(time_cred.data, 4)));
 
         netlogon_creds_step_crypt(creds, &time_cred, &creds->server);
 
-        DEBUG(5,("\tSERVER      %08x:%08x\n", 
+        DEBUG(5,("\tSERVER      %08x:%08x\n",
                  IVAL(creds->server.data, 0), IVAL(creds->server.data, 4)));
 
@@ -183 +221 @@
 
         data_blob_free(&session_key);
+}
+
+/*
+  AES encrypt a password buffer using the session key
+*/
+void netlogon_creds_aes_encrypt(struct netlogon_creds_CredentialState *creds, uint8_t *data, size_t len)
+{
+        AES_KEY key;
+        uint8_t iv[AES_BLOCK_SIZE];
+
+        AES_set_encrypt_key(creds->session_key, 128, &key);
+        ZERO_STRUCT(iv);
+
+        aes_cfb8_encrypt(data, data, len, &key, iv, AES_ENCRYPT);
+}
+
+/*
+  AES decrypt a password buffer using the session key
+*/
+void netlogon_creds_aes_decrypt(struct netlogon_creds_CredentialState *creds, uint8_t *data, size_t len)
+{
+        AES_KEY key;
+        uint8_t iv[AES_BLOCK_SIZE];
+
+        AES_set_encrypt_key(creds->session_key, 128, &key);
+        ZERO_STRUCT(iv);
+
+        aes_cfb8_encrypt(data, data, len, &key, iv, AES_DECRYPT);
 }
 
@@ -194 +260 @@
   credentials
 */
- 
-struct netlogon_creds_CredentialState *netlogon_creds_client_init(TALLOC_CTX *mem_ctx, 
+
+struct netlogon_creds_CredentialState *netlogon_creds_client_init(TALLOC_CTX *mem_ctx,
                                                                   const char *client_account,
-                                                                  const char *client_computer_name, 
+                                                                  const char *client_computer_name,
+                                                                  uint16_t secure_channel_type,
                                                                   const struct netr_Credential *client_challenge,
                                                                   const struct netr_Credential *server_challenge,
@@ -205 +272 @@
 {
         struct netlogon_creds_CredentialState *creds = talloc_zero(mem_ctx, struct netlogon_creds_CredentialState);
-        
+
         if (!creds) {
                 return NULL;
         }
-        
+
         creds->sequence = time(NULL);
         creds->negotiate_flags = negotiate_flags;
+        creds->secure_channel_type = secure_channel_type;
 
         creds->computer_name = talloc_strdup(creds, client_computer_name);
@@ -228 +296 @@
         dump_data_pw("Machine Pass", machine_password->hash, sizeof(machine_password->hash));
 
-        if (negotiate_flags & NETLOGON_NEG_128BIT) {
+        if (negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+                netlogon_creds_init_hmac_sha256(creds,
+                                                client_challenge,
+                                                server_challenge,
+                                                machine_password);
+        } else if (negotiate_flags & NETLOGON_NEG_STRONG_KEYS) {
                 netlogon_creds_init_128bit(creds, client_challenge, server_challenge, machine_password);
         } else {
@@ -247 +320 @@
  */
 
-struct netlogon_creds_CredentialState *netlogon_creds_client_init_session_key(TALLOC_CTX *mem_ctx, 
+struct netlogon_creds_CredentialState *netlogon_creds_client_init_session_key(TALLOC_CTX *mem_ctx,
                                                                               const uint8_t session_key[16])
 {
@@ -256 +329 @@
                 return NULL;
         }
-        
+
         memcpy(creds->session_key, session_key, 16);
 
@@ -266 +339 @@
   current client and server credentials and the seed
 
-  produce the next authenticator in the sequence ready to send to 
+  produce the next authenticator in the sequence ready to send to
   the server
 */
 void netlogon_creds_client_authenticator(struct netlogon_creds_CredentialState *creds,
                                 struct netr_Authenticator *next)
-{       
+{
+        uint32_t t32n = (uint32_t)time(NULL);
+
+        /*
+         * we always increment and ignore an overflow here
+         */
         creds->sequence += 2;
+
+        if (t32n > creds->sequence) {
+                /*
+                 * we may increment more
+                 */
+                creds->sequence = t32n;
+        } else {
+                uint32_t d = creds->sequence - t32n;
+
+                if (d >= INT32_MAX) {
+                        /*
+                         * got an overflow of time_t vs. uint32_t
+                         */
+                        creds->sequence = t32n;
+                }
+        }
+
         netlogon_creds_step(creds);
 
@@ -285 +380 @@
                         const struct netr_Credential *received_credentials)
 {
-        if (!received_credentials || 
+        if (!received_credentials ||
             memcmp(received_credentials->data, creds->server.data, 8) != 0) {
                 DEBUG(2,("credentials check failed\n"));
@@ -318 +413 @@
   credentials
 */
-struct netlogon_creds_CredentialState *netlogon_creds_server_init(TALLOC_CTX *mem_ctx, 
+struct netlogon_creds_CredentialState *netlogon_creds_server_init(TALLOC_CTX *mem_ctx,
                                                                   const char *client_account,
-                                                                  const char *client_computer_name, 
+                                                                  const char *client_computer_name,
                                                                   uint16_t secure_channel_type,
                                                                   const struct netr_Credential *client_challenge,
                                                                   const struct netr_Credential *server_challenge,
                                                                   const struct samr_Password *machine_password,
-                                                                  struct netr_Credential *credentials_in,
+                                                                  const struct netr_Credential *credentials_in,
                                                                   struct netr_Credential *credentials_out,
                                                                   uint32_t negotiate_flags)
 {
-        
+
         struct netlogon_creds_CredentialState *creds = talloc_zero(mem_ctx, struct netlogon_creds_CredentialState);
-        
+
         if (!creds) {
                 return NULL;
         }
-        
+
         creds->negotiate_flags = negotiate_flags;
         creds->secure_channel_type = secure_channel_type;
+
+        dump_data_pw("Client chall", client_challenge->data, sizeof(client_challenge->data));
+        dump_data_pw("Server chall", server_challenge->data, sizeof(server_challenge->data));
+        dump_data_pw("Machine Pass", machine_password->hash, sizeof(machine_password->hash));
 
         creds->computer_name = talloc_strdup(creds, client_computer_name);
@@ -350 +449 @@
         }
 
-        if (negotiate_flags & NETLOGON_NEG_128BIT) {
-                netlogon_creds_init_128bit(creds, client_challenge, server_challenge, 
+        if (negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+                netlogon_creds_init_hmac_sha256(creds,
+                                                client_challenge,
+                                                server_challenge,
+                                                machine_password);
+        } else if (negotiate_flags & NETLOGON_NEG_STRONG_KEYS) {
+                netlogon_creds_init_128bit(creds, client_challenge, server_challenge,
                                            machine_password);
         } else {
-                netlogon_creds_init_64bit(creds, client_challenge, server_challenge, 
+                netlogon_creds_init_64bit(creds, client_challenge, server_challenge,
                                           machine_password);
         }
 
         netlogon_creds_first_step(creds, client_challenge, server_challenge);
+
+        dump_data_pw("Session key", creds->session_key, 16);
+        dump_data_pw("Client Credential ", creds->client.data, 8);
+        dump_data_pw("Server Credential ", creds->server.data, 8);
+
+        dump_data_pw("Credentials in", credentials_in->data, sizeof(credentials_in->data));
 
         /* And before we leak information about the machine account
@@ -369 +479 @@
         *credentials_out = creds->server;
 
+        dump_data_pw("Credentials out", credentials_out->data, sizeof(credentials_out->data));
+
         return creds;
 }
 
 NTSTATUS netlogon_creds_server_step_check(struct netlogon_creds_CredentialState *creds,
-                                 struct netr_Authenticator *received_authenticator,
-                                 struct netr_Authenticator *return_authenticator) 
+                                 const struct netr_Authenticator *received_authenticator,
+                                 struct netr_Authenticator *return_authenticator)
 {
         if (!received_authenticator || !return_authenticator) {
@@ -384 +496 @@
         }
 
-        /* TODO: this may allow the a replay attack on a non-signed
-           connection. Should we check that this is increasing? */
         creds->sequence = received_authenticator->timestamp;
         netlogon_creds_step(creds);
         if (netlogon_creds_server_check_internal(creds, &received_authenticator->cred)) {
                 return_authenticator->cred = creds->server;
-                return_authenticator->timestamp = creds->sequence;
+                return_authenticator->timestamp = 0;
                 return NT_STATUS_OK;
         } else {
@@ -398 +508 @@
 }
 
-void netlogon_creds_decrypt_samlogon(struct netlogon_creds_CredentialState *creds,
-                            uint16_t validation_level,
-                            union netr_Validation *validation) 
+static void netlogon_creds_crypt_samlogon_validation(struct netlogon_creds_CredentialState *creds,
+                                                     uint16_t validation_level,
+                                                     union netr_Validation *validation,
+                                                     bool do_encrypt)
 {
         static const char zeros[16];
-
         struct netr_SamBaseInfo *base = NULL;
+
+        if (validation == NULL) {
+                return;
+        }
+
         switch (validation_level) {
         case 2:
@@ -433 +548 @@
         if (validation_level == 6) {
                 /* they aren't encrypted! */
+        } else if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+                /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
+                if (memcmp(base->key.key, zeros,
+                           sizeof(base->key.key)) != 0) {
+                        if (do_encrypt) {
+                                netlogon_creds_aes_encrypt(creds,
+                                            base->key.key,
+                                            sizeof(base->key.key));
+                        } else {
+                                netlogon_creds_aes_decrypt(creds,
+                                            base->key.key,
+                                            sizeof(base->key.key));
+                        }
+                }
+
+                if (memcmp(base->LMSessKey.key, zeros,
+                           sizeof(base->LMSessKey.key)) != 0) {
+                        if (do_encrypt) {
+                                netlogon_creds_aes_encrypt(creds,
+                                            base->LMSessKey.key,
+                                            sizeof(base->LMSessKey.key));
+
+                        } else {
+                                netlogon_creds_aes_decrypt(creds,
+                                            base->LMSessKey.key,
+                                            sizeof(base->LMSessKey.key));
+                        }
+                }
         } else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
-                if (memcmp(base->key.key, zeros,  
+                /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
+                if (memcmp(base->key.key, zeros,
                            sizeof(base->key.key)) != 0) {
-                        netlogon_creds_arcfour_crypt(creds, 
-                                            base->key.key, 
+                        netlogon_creds_arcfour_crypt(creds,
+                                            base->key.key,
                                             sizeof(base->key.key));
                 }
-                        
-                if (memcmp(base->LMSessKey.key, zeros,  
+
+                if (memcmp(base->LMSessKey.key, zeros,
                            sizeof(base->LMSessKey.key)) != 0) {
-                        netlogon_creds_arcfour_crypt(creds, 
-                                            base->LMSessKey.key, 
+                        netlogon_creds_arcfour_crypt(creds,
+                                            base->LMSessKey.key,
                                             sizeof(base->LMSessKey.key));
                 }
         } else {
-                if (memcmp(base->LMSessKey.key, zeros,  
+                /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
+                if (memcmp(base->LMSessKey.key, zeros,
                            sizeof(base->LMSessKey.key)) != 0) {
-                        netlogon_creds_des_decrypt_LMKey(creds, 
+                        if (do_encrypt) {
+                                netlogon_creds_des_encrypt_LMKey(creds,
                                                 &base->LMSessKey);
-                }
-        }
-}       
+                        } else {
+                                netlogon_creds_des_decrypt_LMKey(creds,
+                                                &base->LMSessKey);
+                        }
+                }
+        }
+}
+
+void netlogon_creds_decrypt_samlogon_validation(struct netlogon_creds_CredentialState *creds,
+                                                uint16_t validation_level,
+                                                union netr_Validation *validation)
+{
+        netlogon_creds_crypt_samlogon_validation(creds, validation_level,
+                                                        validation, false);
+}
+
+void netlogon_creds_encrypt_samlogon_validation(struct netlogon_creds_CredentialState *creds,
+                                                uint16_t validation_level,
+                                                union netr_Validation *validation)
+{
+        netlogon_creds_crypt_samlogon_validation(creds, validation_level,
+                                                        validation, true);
+}
+
+static void netlogon_creds_crypt_samlogon_logon(struct netlogon_creds_CredentialState *creds,
+                                                enum netr_LogonInfoClass level,
+                                                union netr_LogonLevel *logon,
+                                                bool do_encrypt)
+{
+        static const char zeros[16];
+
+        if (logon == NULL) {
+                return;
+        }
+
+        switch (level) {
+        case NetlogonInteractiveInformation:
+        case NetlogonInteractiveTransitiveInformation:
+        case NetlogonServiceInformation:
+        case NetlogonServiceTransitiveInformation:
+                if (logon->password == NULL) {
+                        return;
+                }
+
+                if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+                        uint8_t *h;
+
+                        h = logon->password->lmpassword.hash;
+                        if (memcmp(h, zeros, 16) != 0) {
+                                if (do_encrypt) {
+                                        netlogon_creds_aes_encrypt(creds, h, 16);
+                                } else {
+                                        netlogon_creds_aes_decrypt(creds, h, 16);
+                                }
+                        }
+
+                        h = logon->password->ntpassword.hash;
+                        if (memcmp(h, zeros, 16) != 0) {
+                                if (do_encrypt) {
+                                        netlogon_creds_aes_encrypt(creds, h, 16);
+                                } else {
+                                        netlogon_creds_aes_decrypt(creds, h, 16);
+                                }
+                        }
+                } else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
+                        uint8_t *h;
+
+                        h = logon->password->lmpassword.hash;
+                        if (memcmp(h, zeros, 16) != 0) {
+                                netlogon_creds_arcfour_crypt(creds, h, 16);
+                        }
+
+                        h = logon->password->ntpassword.hash;
+                        if (memcmp(h, zeros, 16) != 0) {
+                                netlogon_creds_arcfour_crypt(creds, h, 16);
+                        }
+                } else {
+                        struct samr_Password *p;
+
+                        p = &logon->password->lmpassword;
+                        if (memcmp(p->hash, zeros, 16) != 0) {
+                                if (do_encrypt) {
+                                        netlogon_creds_des_encrypt(creds, p);
+                                } else {
+                                        netlogon_creds_des_decrypt(creds, p);
+                                }
+                        }
+                        p = &logon->password->ntpassword;
+                        if (memcmp(p->hash, zeros, 16) != 0) {
+                                if (do_encrypt) {
+                                        netlogon_creds_des_encrypt(creds, p);
+                                } else {
+                                        netlogon_creds_des_decrypt(creds, p);
+                                }
+                        }
+                }
+                break;
+
+        case NetlogonNetworkInformation:
+        case NetlogonNetworkTransitiveInformation:
+                break;
+
+        case NetlogonGenericInformation:
+                if (logon->generic == NULL) {
+                        return;
+                }
+
+                if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+                        if (do_encrypt) {
+                                netlogon_creds_aes_encrypt(creds,
+                                                logon->generic->data,
+                                                logon->generic->length);
+                        } else {
+                                netlogon_creds_aes_decrypt(creds,
+                                                logon->generic->data,
+                                                logon->generic->length);
+                        }
+                } else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
+                        netlogon_creds_arcfour_crypt(creds,
+                                                     logon->generic->data,
+                                                     logon->generic->length);
+                } else {
+                        /* Using DES to verify kerberos tickets makes no sense */
+                }
+                break;
+        }
+}
+
+void netlogon_creds_decrypt_samlogon_logon(struct netlogon_creds_CredentialState *creds,
+                                           enum netr_LogonInfoClass level,
+                                           union netr_LogonLevel *logon)
+{
+        netlogon_creds_crypt_samlogon_logon(creds, level, logon, false);
+}
+
+void netlogon_creds_encrypt_samlogon_logon(struct netlogon_creds_CredentialState *creds,
+                                           enum netr_LogonInfoClass level,
+                                           union netr_LogonLevel *logon)
+{
+        netlogon_creds_crypt_samlogon_logon(creds, level, logon, true);
+}
+
+union netr_LogonLevel *netlogon_creds_shallow_copy_logon(TALLOC_CTX *mem_ctx,
+                                        enum netr_LogonInfoClass level,
+                                        const union netr_LogonLevel *in)
+{
+        union netr_LogonLevel *out;
+
+        if (in == NULL) {
+                return NULL;
+        }
+
+        out = talloc(mem_ctx, union netr_LogonLevel);
+        if (out == NULL) {
+                return NULL;
+        }
+
+        *out = *in;
+
+        switch (level) {
+        case NetlogonInteractiveInformation:
+        case NetlogonInteractiveTransitiveInformation:
+        case NetlogonServiceInformation:
+        case NetlogonServiceTransitiveInformation:
+                if (in->password == NULL) {
+                        return out;
+                }
+
+                out->password = talloc(out, struct netr_PasswordInfo);
+                if (out->password == NULL) {
+                        talloc_free(out);
+                        return NULL;
+                }
+                *out->password = *in->password;
+
+                return out;
+
+        case NetlogonNetworkInformation:
+        case NetlogonNetworkTransitiveInformation:
+                break;
+
+        case NetlogonGenericInformation:
+                if (in->generic == NULL) {
+                        return out;
+                }
+
+                out->generic = talloc(out, struct netr_GenericInfo);
+                if (out->generic == NULL) {
+                        talloc_free(out);
+                        return NULL;
+                }
+                *out->generic = *in->generic;
+
+                if (in->generic->data == NULL) {
+                        return out;
+                }
+
+                if (in->generic->length == 0) {
+                        return out;
+                }
+
+                out->generic->data = talloc_memdup(out->generic,
+                                                   in->generic->data,
+                                                   in->generic->length);
+                if (out->generic->data == NULL) {
+                        talloc_free(out);
+                        return NULL;
+                }
+
+                return out;
+        }
+
+        return out;
+}
 
 /*

vendor/current/libcli/auth/credentials.h

@@ -69 +69 @@
 #define NETLOGON_NEG_AUTH2_ADS_FLAGS (0x200fbffb | NETLOGON_NEG_ARCFOUR | NETLOGON_NEG_128BIT | NETLOGON_NEG_SCHANNEL)
 
-#define NETLOGON_NEG_AUTH2_RODC_FLAGS (NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_RODC_PASSTHROUGH)
-

vendor/current/libcli/auth/msrpc_parse.c

@@ -79 +79 @@
                         if (!ret) {
                                 va_end(ap);
-                                return map_nt_error_from_unix(errno);
+                                return map_nt_error_from_unix_common(errno);
                         }
                         pointers[i].length = n;
@@ -93 +93 @@
                         if (!ret) {
                                 va_end(ap);
-                                return map_nt_error_from_unix(errno);
+                                return map_nt_error_from_unix_common(errno);
                         }
                         pointers[i].length = n;
@@ -109 +109 @@
                         if (!ret) {
                                 va_end(ap);
-                                return map_nt_error_from_unix(errno);
+                                return map_nt_error_from_unix_common(errno);
                         }
                         pointers[i].length = n;
@@ -178 +178 @@
                         n = pointers[i].length;
                         SSVAL(blob->data, data_ofs, n); data_ofs += 2;
-                        if (n >= 0) {
-                                memcpy(blob->data+data_ofs, pointers[i].data, n);
-                        }
+                        memcpy(blob->data+data_ofs, pointers[i].data, n);
                         data_ofs += n;
                         break;
@@ -287 +285 @@
                                         if (!convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX, 
                                                                    blob->data + ptr, len1, 
-                                                                   ps, &pull_len, false)) {
+                                                                   ps, &pull_len)) {
                                                 ret = false;
                                                 goto cleanup;
@@ -323 +321 @@
                                         if (!convert_string_talloc(mem_ctx, CH_DOS, CH_UNIX, 
                                                                    blob->data + ptr, len1, 
-                                                                   ps, &pull_len, false)) {
+                                                                   ps, &pull_len)) {
                                                 ret = false;
                                                 goto cleanup;

vendor/current/libcli/auth/ntlm_check.c

@@ -321 +321 @@
                 char *unix_pw = NULL;
                 bool lm_ok;
+                size_t converted_size = 0;
 
                 DEBUG(4,("ntlm_password_check: checking plaintext passwords for user %s\n",
@@ -329 +330 @@
                     (convert_string_talloc(mem_ctx, CH_DOS, CH_UNIX, 
                                           lm_response->data, lm_response->length, 
-                                           (void *)&unix_pw, NULL, false))) {
+                                           (void *)&unix_pw, &converted_size))) {
                         if (E_deshash(unix_pw, client_lm.hash)) {
                                 lm_ok = true;
@@ -485 +486 @@
                                  &tmp_sess_key)) {
                 if (nt_response->length > 24) {
-                        /* If NTLMv2 authentication has preceeded us
+                        /* If NTLMv2 authentication has preceded us
                          * (even if it failed), then use the session
                          * key from that.  See the RPC-SAMLOGON
@@ -514 +515 @@
                                  &tmp_sess_key)) {
                 if (nt_response->length > 24) {
-                        /* If NTLMv2 authentication has preceeded us
+                        /* If NTLMv2 authentication has preceded us
                          * (even if it failed), then use the session
                          * key from that.  See the RPC-SAMLOGON
@@ -542 +543 @@
                                  &tmp_sess_key)) {
                 if (nt_response->length > 24) {
-                        /* If NTLMv2 authentication has preceeded us
+                        /* If NTLMv2 authentication has preceded us
                          * (even if it failed), then use the session
                          * key from that.  See the RPC-SAMLOGON

vendor/current/libcli/auth/proto.h

@@ -17 +17 @@
 void netlogon_creds_des_decrypt(struct netlogon_creds_CredentialState *creds, struct samr_Password *pass);
 void netlogon_creds_arcfour_crypt(struct netlogon_creds_CredentialState *creds, uint8_t *data, size_t len);
+void netlogon_creds_aes_encrypt(struct netlogon_creds_CredentialState *creds, uint8_t *data, size_t len);
+void netlogon_creds_aes_decrypt(struct netlogon_creds_CredentialState *creds, uint8_t *data, size_t len);
 
 /*****************************************************************
@@ -25 +27 @@
                                                                   const char *client_account,
                                                                   const char *client_computer_name, 
+                                                                  uint16_t secure_channel_type,
                                                                   const struct netr_Credential *client_challenge,
                                                                   const struct netr_Credential *server_challenge,
@@ -50 +53 @@
                                                                   const struct netr_Credential *server_challenge,
                                                                   const struct samr_Password *machine_password,
-                                                                  struct netr_Credential *credentials_in,
+                                                                  const struct netr_Credential *credentials_in,
                                                                   struct netr_Credential *credentials_out,
                                                                   uint32_t negotiate_flags);
 NTSTATUS netlogon_creds_server_step_check(struct netlogon_creds_CredentialState *creds,
-                                 struct netr_Authenticator *received_authenticator,
+                                 const struct netr_Authenticator *received_authenticator,
                                  struct netr_Authenticator *return_authenticator) ;
-void netlogon_creds_decrypt_samlogon(struct netlogon_creds_CredentialState *creds,
-                            uint16_t validation_level,
-                            union netr_Validation *validation) ;
+void netlogon_creds_decrypt_samlogon_validation(struct netlogon_creds_CredentialState *creds,
+                                                uint16_t validation_level,
+                                                union netr_Validation *validation);
+void netlogon_creds_encrypt_samlogon_validation(struct netlogon_creds_CredentialState *creds,
+                                                uint16_t validation_level,
+                                                union netr_Validation *validation);
+void netlogon_creds_decrypt_samlogon_logon(struct netlogon_creds_CredentialState *creds,
+                                           enum netr_LogonInfoClass level,
+                                           union netr_LogonLevel *logon);
+void netlogon_creds_encrypt_samlogon_logon(struct netlogon_creds_CredentialState *creds,
+                                           enum netr_LogonInfoClass level,
+                                           union netr_LogonLevel *logon);
+union netr_LogonLevel *netlogon_creds_shallow_copy_logon(TALLOC_CTX *mem_ctx,
+                                        enum netr_LogonInfoClass level,
+                                        const union netr_LogonLevel *in);
 
 /* The following definitions come from /home/jeremy/src/samba/git/master/source3/../source4/../libcli/auth/session.c  */
@@ -112 +127 @@
                   uint8_t kr_buf[16]);
 void SMBOWFencrypt(const uint8_t passwd[16], const uint8_t *c8, uint8_t p24[24]);
-void SMBNTencrypt_hash(const uint8_t nt_hash[16], uint8_t *c8, uint8_t *p24);
-void SMBNTencrypt(const char *passwd, uint8_t *c8, uint8_t *p24);
+void SMBNTencrypt_hash(const uint8_t nt_hash[16], const uint8_t *c8, uint8_t *p24);
+void SMBNTencrypt(const char *passwd, const uint8_t *c8, uint8_t *p24);
 void SMBOWFencrypt_ntv2(const uint8_t kr[16],
                         const DATA_BLOB *srv_chal,
@@ -130 +145 @@
                            const char *user, const char *domain, const uint8_t nt_hash[16],
                            const DATA_BLOB *server_chal, 
+                           const NTTIME *server_timestamp,
                            const DATA_BLOB *names_blob,
                            DATA_BLOB *lm_response, DATA_BLOB *nt_response, 
@@ -180 +196 @@
 bool extract_pw_from_buffer(TALLOC_CTX *mem_ctx, 
                             uint8_t in_buffer[516], DATA_BLOB *new_pass);
+struct wkssvc_PasswordBuffer;
 void encode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,
                                         const char *pwd,

vendor/current/libcli/auth/schannel.h

@@ -23 +23 @@
 #include "libcli/auth/libcli_auth.h"
 #include "libcli/auth/schannel_state.h"
-
-enum schannel_position {
-        SCHANNEL_STATE_START = 0,
-        SCHANNEL_STATE_UPDATE_1
-};
-
-struct schannel_state {
-        enum schannel_position state;
-        uint32_t seq_num;
-        bool initiator;
-        struct netlogon_creds_CredentialState *creds;
-};
-
 #include "libcli/auth/schannel_proto.h"

vendor/current/libcli/auth/schannel_proto.h

@@ -26 +26 @@
 struct schannel_state;
 
-struct tdb_wrap *open_schannel_session_store(TALLOC_CTX *mem_ctx,
-                                             const char *private_dir);
-
-NTSTATUS netsec_incoming_packet(struct schannel_state *state,
-                                TALLOC_CTX *mem_ctx,
-                                bool do_unseal,
-                                uint8_t *data, size_t length,
-                                const DATA_BLOB *sig);
-uint32_t netsec_outgoing_sig_size(struct schannel_state *state);
-NTSTATUS netsec_outgoing_packet(struct schannel_state *state,
-                                TALLOC_CTX *mem_ctx,
-                                bool do_seal,
-                                uint8_t *data, size_t length,
-                                DATA_BLOB *sig);
+struct db_context *open_schannel_session_store(TALLOC_CTX *mem_ctx,
+                                               struct loadparm_context *lp_ctx);
 
 #endif

vendor/current/libcli/auth/schannel_state.h

@@ -25 +25 @@
 
 NTSTATUS schannel_get_creds_state(TALLOC_CTX *mem_ctx,
-                                  const char *db_priv_dir,
+                                  struct loadparm_context *lp_ctx,
                                   const char *computer_name,
                                   struct netlogon_creds_CredentialState **creds);
 
 NTSTATUS schannel_save_creds_state(TALLOC_CTX *mem_ctx,
-                                   const char *db_priv_dir,
+                                   struct loadparm_context *lp_ctx,
                                    struct netlogon_creds_CredentialState *creds);
 
 NTSTATUS schannel_check_creds_state(TALLOC_CTX *mem_ctx,
-                                    const char *db_priv_dir,
+                                    struct loadparm_context *lp_ctx,
                                     const char *computer_name,
                                     struct netr_Authenticator *received_authenticator,

vendor/current/libcli/auth/schannel_state_tdb.c

@@ -24 +24 @@
 #include "includes.h"
 #include "system/filesys.h"
-#include <tdb.h>
+#include "../lib/tdb/include/tdb.h"
 #include "../lib/util/util_tdb.h"
+#include "../lib/param/param.h"
 #include "../libcli/auth/schannel.h"
 #include "../librpc/gen_ndr/ndr_schannel.h"
-#include "lib/util/tdb_wrap.h"
+#include "lib/dbwrap/dbwrap.h"
 
 #define SECRETS_SCHANNEL_STATE "SECRETS/SCHANNEL"
@@ -37 +38 @@
 *******************************************************************************/
 
-struct tdb_wrap *open_schannel_session_store(TALLOC_CTX *mem_ctx,
-                                             const char *private_dir)
-{
-        struct tdb_wrap *tdb_sc = NULL;
-        char *fname = talloc_asprintf(mem_ctx, "%s/schannel_store.tdb", private_dir);
+struct db_context *open_schannel_session_store(TALLOC_CTX *mem_ctx,
+                                               struct loadparm_context *lp_ctx)
+{
+        struct db_context *db_sc = NULL;
+        char *fname = lpcfg_private_db_path(mem_ctx, lp_ctx, "schannel_store");
 
         if (!fname) {
@@ -47 +48 @@
         }
 
-        tdb_sc = tdb_wrap_open(mem_ctx, fname, 0, TDB_CLEAR_IF_FIRST|TDB_NOSYNC, O_RDWR|O_CREAT, 0600);
-
-        if (!tdb_sc) {
+        db_sc = dbwrap_local_open(mem_ctx, lp_ctx, fname, 0,
+                                  TDB_CLEAR_IF_FIRST|TDB_NOSYNC, O_RDWR|O_CREAT,
+                                  0600, DBWRAP_LOCK_ORDER_NONE,
+                                  DBWRAP_FLAG_NONE);
+
+        if (!db_sc) {
                 DEBUG(0,("open_schannel_session_store: Failed to open %s - %s\n",
                          fname, strerror(errno)));
@@ -58 +62 @@
         TALLOC_FREE(fname);
 
-        return tdb_sc;
+        return db_sc;
 }
 
@@ -65 +69 @@
 
 static
-NTSTATUS schannel_store_session_key_tdb(struct tdb_wrap *tdb_sc,
+NTSTATUS schannel_store_session_key_tdb(struct db_context *db_sc,
                                         TALLOC_CTX *mem_ctx,
                                         struct netlogon_creds_CredentialState *creds)
@@ -72 +76 @@
         DATA_BLOB blob;
         TDB_DATA value;
-        int ret;
         char *keystr;
         char *name_upper;
+        NTSTATUS status;
+
+        if (strlen(creds->computer_name) > 15) {
+                /*
+                 * We may want to check for a completely
+                 * valid netbios name.
+                 */
+                return STATUS_BUFFER_OVERFLOW;
+        }
 
         name_upper = strupper_talloc(mem_ctx, creds->computer_name);
@@ -98 +110 @@
         value.dsize = blob.length;
 
-        ret = tdb_store_bystring(tdb_sc->tdb, keystr, value, TDB_REPLACE);
-        if (ret != TDB_SUCCESS) {
+        status = dbwrap_store_bystring(db_sc, keystr, value, TDB_REPLACE);
+        if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0,("Unable to add %s to session key db - %s\n",
-                         keystr, tdb_errorstr(tdb_sc->tdb)));
+                         keystr, nt_errstr(status)));
                 talloc_free(keystr);
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                return status;
         }
 
@@ -122 +134 @@
 
 static
-NTSTATUS schannel_fetch_session_key_tdb(struct tdb_wrap *tdb_sc,
+NTSTATUS schannel_fetch_session_key_tdb(struct db_context *db_sc,
                                         TALLOC_CTX *mem_ctx,
                                         const char *computer_name,
@@ -149 +161 @@
         }
 
-        value = tdb_fetch_bystring(tdb_sc->tdb, keystr);
-        if (!value.dptr) {
+        status = dbwrap_fetch_bystring(db_sc, keystr, keystr, &value);
+        if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(10,("schannel_fetch_session_key_tdb: Failed to find entry with key %s\n",
                         keystr ));
-                status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
                 goto done;
         }
@@ -184 +195 @@
 
         talloc_free(keystr);
-        SAFE_FREE(value.dptr);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -202 +212 @@
 
 NTSTATUS schannel_get_creds_state(TALLOC_CTX *mem_ctx,
-                                  const char *db_priv_dir,
+                                  struct loadparm_context *lp_ctx,
                                   const char *computer_name,
                                   struct netlogon_creds_CredentialState **_creds)
 {
         TALLOC_CTX *tmpctx;
-        struct tdb_wrap *tdb_sc;
+        struct db_context *db_sc;
         struct netlogon_creds_CredentialState *creds;
         NTSTATUS status;
@@ -216 +226 @@
         }
 
-        tdb_sc = open_schannel_session_store(tmpctx, db_priv_dir);
-        if (!tdb_sc) {
+        db_sc = open_schannel_session_store(tmpctx, lp_ctx);
+        if (!db_sc) {
                 return NT_STATUS_ACCESS_DENIED;
         }
 
-        status = schannel_fetch_session_key_tdb(tdb_sc, tmpctx, 
+        status = schannel_fetch_session_key_tdb(db_sc, tmpctx,
                                                 computer_name, &creds);
         if (NT_STATUS_IS_OK(status)) {
@@ -240 +250 @@
 
 NTSTATUS schannel_save_creds_state(TALLOC_CTX *mem_ctx,
-                                   const char *db_priv_dir,
+                                   struct loadparm_context *lp_ctx,
                                    struct netlogon_creds_CredentialState *creds)
 {
         TALLOC_CTX *tmpctx;
-        struct tdb_wrap *tdb_sc;
+        struct db_context *db_sc;
         NTSTATUS status;
 
@@ -252 +262 @@
         }
 
-        tdb_sc = open_schannel_session_store(tmpctx, db_priv_dir);
-        if (!tdb_sc) {
+        db_sc = open_schannel_session_store(tmpctx, lp_ctx);
+        if (!db_sc) {
                 return NT_STATUS_ACCESS_DENIED;
         }
 
-        status = schannel_store_session_key_tdb(tdb_sc, tmpctx, creds);
+        status = schannel_store_session_key_tdb(db_sc, tmpctx, creds);
 
         talloc_free(tmpctx);
@@ -274 +284 @@
 
 NTSTATUS schannel_check_creds_state(TALLOC_CTX *mem_ctx,
-                                    const char *db_priv_dir,
+                                    struct loadparm_context *lp_ctx,
                                     const char *computer_name,
                                     struct netr_Authenticator *received_authenticator,
@@ -281 +291 @@
 {
         TALLOC_CTX *tmpctx;
-        struct tdb_wrap *tdb_sc;
+        struct db_context *db_sc;
         struct netlogon_creds_CredentialState *creds;
         NTSTATUS status;
-        int ret;
+        char *name_upper = NULL;
+        char *keystr = NULL;
+        struct db_record *record;
+        TDB_DATA key;
 
         if (creds_out != NULL) {
@@ -295 +308 @@
         }
 
-        tdb_sc = open_schannel_session_store(tmpctx, db_priv_dir);
-        if (!tdb_sc) {
+        name_upper = strupper_talloc(tmpctx, computer_name);
+        if (!name_upper) {
+                status = NT_STATUS_NO_MEMORY;
+                goto done;
+        }
+
+        keystr = talloc_asprintf(tmpctx, "%s/%s",
+                                 SECRETS_SCHANNEL_STATE, name_upper);
+        if (!keystr) {
+                status = NT_STATUS_NO_MEMORY;
+                goto done;
+        }
+
+        key = string_term_tdb_data(keystr);
+
+        db_sc = open_schannel_session_store(tmpctx, lp_ctx);
+        if (!db_sc) {
                 status = NT_STATUS_ACCESS_DENIED;
                 goto done;
         }
 
-        ret = tdb_transaction_start(tdb_sc->tdb);
-        if (ret != 0) {
+        record = dbwrap_fetch_locked(db_sc, tmpctx, key);
+        if (!record) {
                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
                 goto done;
@@ -311 +339 @@
          * update the structure */
 
-        status = schannel_fetch_session_key_tdb(tdb_sc, tmpctx, 
+        status = schannel_fetch_session_key_tdb(db_sc, tmpctx,
                                                 computer_name, &creds);
         if (!NT_STATUS_IS_OK(status)) {
-                tdb_transaction_cancel(tdb_sc->tdb);
                 goto done;
         }
@@ -322 +349 @@
                                                   return_authenticator);
         if (!NT_STATUS_IS_OK(status)) {
-                tdb_transaction_cancel(tdb_sc->tdb);
-                goto done;
-        }
-
-        status = schannel_store_session_key_tdb(tdb_sc, tmpctx, creds);
-        if (!NT_STATUS_IS_OK(status)) {
-                tdb_transaction_cancel(tdb_sc->tdb);
-                goto done;
-        }
-
-        tdb_transaction_commit(tdb_sc->tdb);
+                goto done;
+        }
+
+        status = schannel_store_session_key_tdb(db_sc, tmpctx, creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
 
         if (creds_out) {

vendor/current/libcli/auth/smbencrypt.c

@@ -117 +117 @@
 bool E_deshash(const char *passwd, uint8_t p16[16])
 {
-        bool ret = true;
-        char dospwd[256];
+        bool ret;
+        uint8_t dospwd[14];
+        TALLOC_CTX *frame = talloc_stackframe();
+
+        size_t converted_size;
+
+        char *tmpbuf;
+
         ZERO_STRUCT(dospwd);
 
-        /* Password must be converted to DOS charset - null terminated, uppercase. */
-        push_string(dospwd, passwd, sizeof(dospwd), STR_ASCII|STR_UPPER|STR_TERMINATE);
-
-        /* Only the first 14 chars are considered, password need not be null terminated. */
+        tmpbuf = strupper_talloc(frame, passwd);
+        if (tmpbuf == NULL) {
+                /* Too many callers don't check this result, we need to fill in the buffer with something */
+                strlcpy((char *)dospwd, passwd ? passwd : "", sizeof(dospwd));
+                E_P16(dospwd, p16);
+                talloc_free(frame);
+                return false;
+        }
+
+        ZERO_STRUCT(dospwd);
+
+        ret = convert_string_error(CH_UNIX, CH_DOS, tmpbuf, strlen(tmpbuf), dospwd, sizeof(dospwd), &converted_size);
+        talloc_free(frame);
+
+        /* Only the first 14 chars are considered, password need not
+         * be null terminated.  We do this in the error and success
+         * case to avoid returning a fixed 'password' buffer, but
+         * callers should not use it when E_deshash returns false */
+
         E_P16((const uint8_t *)dospwd, p16);
-
-        if (strlen(dospwd) > 14) {
-                ret = false;
-        }
 
         ZERO_STRUCT(dospwd);
@@ -249 +266 @@
 /* Does the des encryption. */
 
-void SMBNTencrypt_hash(const uint8_t nt_hash[16], uint8_t *c8, uint8_t *p24)
+void SMBNTencrypt_hash(const uint8_t nt_hash[16], const uint8_t *c8, uint8_t *p24)
 {
         uint8_t p21[21];
@@ -267 +284 @@
 /* Does the NT MD4 hash then des encryption. Plaintext version of the above. */
 
-void SMBNTencrypt(const char *passwd, uint8_t *c8, uint8_t *p24)
+void SMBNTencrypt(const char *passwd, const uint8_t *c8, uint8_t *p24)
 {
         uint8_t nt_hash[16];
@@ -371 +388 @@
 }
 
-static DATA_BLOB NTLMv2_generate_client_data(TALLOC_CTX *mem_ctx, const DATA_BLOB *names_blob)
+static DATA_BLOB NTLMv2_generate_client_data(TALLOC_CTX *mem_ctx,
+                                             NTTIME nttime,
+                                             const DATA_BLOB *names_blob)
 {
         uint8_t client_chal[8];
         DATA_BLOB response = data_blob(NULL, 0);
         uint8_t long_date[8];
-        NTTIME nttime;
-
-        unix_to_nt_time(&nttime, time(NULL));
 
         generate_random_buffer(client_chal, sizeof(client_chal));
@@ -401 +417 @@
                                           const uint8_t ntlm_v2_hash[16],
                                           const DATA_BLOB *server_chal,
+                                          NTTIME nttime,
                                           const DATA_BLOB *names_blob)
 {
@@ -417 +434 @@
         /* generate some data to pass into the response function - including
            the hostname and domain name of the server */
-        ntlmv2_client_data = NTLMv2_generate_client_data(mem_ctx, names_blob);
+        ntlmv2_client_data = NTLMv2_generate_client_data(mem_ctx, nttime, names_blob);
 
         /* Given that data, and the challenge from the server, generate a response */
@@ -463 +480 @@
                            const char *user, const char *domain, const uint8_t nt_hash[16],
                            const DATA_BLOB *server_chal,
+                           const NTTIME *server_timestamp,
                            const DATA_BLOB *names_blob,
                            DATA_BLOB *lm_response, DATA_BLOB *nt_response,
@@ -478 +496 @@
 
         if (nt_response) {
+                const NTTIME *nttime = server_timestamp;
+                NTTIME _now = 0;
+
+                if (nttime == NULL) {
+                        struct timeval tv_now = timeval_current();
+                        _now = timeval_to_nttime(&tv_now);
+                        nttime = &_now;
+                }
+
                 *nt_response = NTLMv2_generate_response(mem_ctx,
-                                                        ntlm_v2_hash, server_chal,
+                                                        ntlm_v2_hash,
+                                                        server_chal,
+                                                        *nttime,
                                                         names_blob);
                 if (user_session_key) {
@@ -493 +522 @@
 
         if (lm_response) {
-                *lm_response = LMv2_generate_response(mem_ctx,
-                                                      ntlm_v2_hash, server_chal);
+                if (server_timestamp != NULL) {
+                        *lm_response = data_blob_talloc_zero(mem_ctx, 24);
+                } else {
+                        *lm_response = LMv2_generate_response(mem_ctx,
+                                                              ntlm_v2_hash,
+                                                              server_chal);
+                }
                 if (lm_session_key) {
                         *lm_session_key = data_blob_talloc(mem_ctx, NULL, 16);
@@ -519 +553 @@
 
         return SMBNTLMv2encrypt_hash(mem_ctx,
-                                     user, domain, nt_hash, server_chal, names_blob,
+                                     user, domain, nt_hash,
+                                     server_chal, NULL, names_blob,
                                      lm_response, nt_response, lm_session_key, user_session_key);
 }
@@ -611 +646 @@
                 }
 
-#ifdef SAMBA4_INTERNAL_HEIMDAL /* smbtorture4 for make test */
                 cmp = strcasecmp_m(a, v);
-#else /* smbd */
-                cmp = StrCaseCmp(a, v);
-#endif
                 if (cmp != 0) {
                         DEBUG(2,("%s: NTLMv2_RESPONSE with "
@@ -637 +668 @@
                 v = av_nb_dn->Value.AvNbDomainName;
 
-#ifdef SAMBA4_INTERNAL_HEIMDAL /* smbtorture4 for make test */
                 cmp = strcasecmp_m(workgroup, v);
-#else /* smbd */
-                cmp = StrCaseCmp(workgroup, v);
-#endif
                 if (cmp != 0) {
                         DEBUG(2,("%s: NTLMv2_RESPONSE with "
@@ -740 +767 @@
                                    byte_len,
                                    (void *)pp_new_pwrd,
-                                   new_pw_len,
-                                   false)) {
+                                   new_pw_len)) {
                 DEBUG(0, ("decode_pw_buffer: failed to convert incoming password\n"));
                 return false;
@@ -891 +917 @@
 
         if (!pwd_buf) {
-                return WERR_BAD_PASSWORD;
+                return WERR_INVALID_PASSWORD;
         }
 
         if (session_key->length != 16) {
                 DEBUG(10,("invalid session key\n"));
-                return WERR_BAD_PASSWORD;
+                return WERR_INVALID_PASSWORD;
         }
 
@@ -913 +939 @@
         if (!decode_pw_buffer(mem_ctx, buffer, pwd, &pwd_len, CH_UTF16)) {
                 data_blob_free(&confounded_session_key);
-                return WERR_BAD_PASSWORD;
+                return WERR_INVALID_PASSWORD;
         }
 

vendor/current/libcli/auth/spnego.h

@@ -46 +46 @@
         SPNEGO_ACCEPT_INCOMPLETE = 1,
         SPNEGO_REJECT = 2,
-        SPNEGO_NONE_RESULT = 3
+        SPNEGO_REQUEST_MIC = 3,
+        /*
+         * The max value is 0xff (255) on the wire
+         */
+        SPNEGO_NONE_RESULT = 256
 };
 
 struct spnego_negTokenInit {
-        const char **mechTypes;
+        const char * const *mechTypes;
         DATA_BLOB reqFlags;
         uint8_t reqFlagsPadding;
@@ -59 +63 @@
 
 struct spnego_negTokenTarg {
-        uint8_t negResult;
+        enum spnego_negResult negResult;
         const char *supportedMech;
         DATA_BLOB responseToken;

vendor/current/libcli/auth/spnego_parse.c

@@ -30 +30 @@
         ZERO_STRUCTP(token);
 
-        asn1_start_tag(asn1, ASN1_CONTEXT(0));
-        asn1_start_tag(asn1, ASN1_SEQUENCE(0));
-
-        while (!asn1->has_error && 0 < asn1_tag_remaining(asn1)) {
+        if (!asn1_start_tag(asn1, ASN1_CONTEXT(0))) return false;
+        if (!asn1_start_tag(asn1, ASN1_SEQUENCE(0))) return false;
+
+        while (!asn1_has_error(asn1) && 0 < asn1_tag_remaining(asn1)) {
                 int i;
                 uint8_t context;
+
                 if (!asn1_peek_uint8(asn1, &context)) {
-                        asn1->has_error = true;
+                        asn1_set_error(asn1);
                         break;
                 }
@@ -43 +44 @@
                 switch (context) {
                 /* Read mechTypes */
-                case ASN1_CONTEXT(0):
-                        asn1_start_tag(asn1, ASN1_CONTEXT(0));
-                        asn1_start_tag(asn1, ASN1_SEQUENCE(0));
-
-                        token->mechTypes = talloc(NULL, const char *);
-                        for (i = 0; !asn1->has_error &&
+                case ASN1_CONTEXT(0): {
+                        const char **mechTypes;
+
+                        if (!asn1_start_tag(asn1, ASN1_CONTEXT(0))) return false;
+                        if (!asn1_start_tag(asn1, ASN1_SEQUENCE(0))) return false;
+
+                        mechTypes = talloc(mem_ctx, const char *);
+                        if (mechTypes == NULL) {
+                                asn1_set_error(asn1);
+                                return false;
+                        }
+                        for (i = 0; !asn1_has_error(asn1) &&
                                      0 < asn1_tag_remaining(asn1); i++) {
                                 char *oid;
-                                token->mechTypes = talloc_realloc(NULL,
-                                                                  token->mechTypes,
-                                                                  const char *, i+2);
-                                asn1_read_OID(asn1, token->mechTypes, &oid);
-                                token->mechTypes[i] = oid;
-                        }
-                        token->mechTypes[i] = NULL;
+                                const char **p;
+                                p = talloc_realloc(mem_ctx,
+                                                   mechTypes,
+                                                   const char *, i+2);
+                                if (p == NULL) {
+                                        talloc_free(mechTypes);
+                                        asn1_set_error(asn1);
+                                        return false;
+                                }
+                                mechTypes = p;
+
+                                if (!asn1_read_OID(asn1, mechTypes, &oid)) return false;
+                                mechTypes[i] = oid;
+                        }
+                        mechTypes[i] = NULL;
+                        token->mechTypes = mechTypes;
 
                         asn1_end_tag(asn1);
                         asn1_end_tag(asn1);
                         break;
+                }
                 /* Read reqFlags */
                 case ASN1_CONTEXT(1):
-                        asn1_start_tag(asn1, ASN1_CONTEXT(1));
-                        asn1_read_BitString(asn1, mem_ctx, &token->reqFlags,
-                                            &token->reqFlagsPadding);
-                        asn1_end_tag(asn1);
+                        if (!asn1_start_tag(asn1, ASN1_CONTEXT(1))) return false;
+                        if (!asn1_read_BitString(asn1, mem_ctx, &token->reqFlags,
+                                            &token->reqFlagsPadding)) return false;
+                        if (!asn1_end_tag(asn1)) return false;
                         break;
                 /* Read mechToken */
                 case ASN1_CONTEXT(2):
-                        asn1_start_tag(asn1, ASN1_CONTEXT(2));
-                        asn1_read_OctetString(asn1, mem_ctx, &token->mechToken);
-                        asn1_end_tag(asn1);
+                        if (!asn1_start_tag(asn1, ASN1_CONTEXT(2))) return false;
+                        if (!asn1_read_OctetString(asn1, mem_ctx, &token->mechToken)) return false;
+                        if (!asn1_end_tag(asn1)) return false;
                         break;
                 /* Read mecListMIC */
@@ -79 +96 @@
                 {
                         uint8_t type_peek;
-                        asn1_start_tag(asn1, ASN1_CONTEXT(3));
+                        if (!asn1_start_tag(asn1, ASN1_CONTEXT(3))) return false;
                         if (!asn1_peek_uint8(asn1, &type_peek)) {
-                                asn1->has_error = true;
+                                asn1_set_error(asn1);
                                 break;
                         }
                         if (type_peek == ASN1_OCTET_STRING) {
-                                asn1_read_OctetString(asn1, mem_ctx,
-                                                      &token->mechListMIC);
+                                if (!asn1_read_OctetString(asn1, mem_ctx,
+                                                      &token->mechListMIC)) return false;
                         } else {
                                 /* RFC 2478 says we have an Octet String here,
                                    but W2k sends something different... */
                                 char *mechListMIC;
-                                asn1_start_tag(asn1, ASN1_SEQUENCE(0));
-                                asn1_start_tag(asn1, ASN1_CONTEXT(0));
-                                asn1_read_GeneralString(asn1, mem_ctx, &mechListMIC);
-                                asn1_end_tag(asn1);
-                                asn1_end_tag(asn1);
+                                if (!asn1_start_tag(asn1, ASN1_SEQUENCE(0))) return false;
+                                if (!asn1_start_tag(asn1, ASN1_CONTEXT(0))) return false;
+                                if (!asn1_read_GeneralString(asn1, mem_ctx, &mechListMIC)) return false;
+                                if (!asn1_end_tag(asn1)) return false;
+                                if (!asn1_end_tag(asn1)) return false;
 
                                 token->targetPrincipal = mechListMIC;
                         }
-                        asn1_end_tag(asn1);
+                        if (!asn1_end_tag(asn1)) return false;
                         break;
                 }
                 default:
-                        asn1->has_error = true;
-                        break;
-                }
-        }
-
-        asn1_end_tag(asn1);
-        asn1_end_tag(asn1);
-
-        return !asn1->has_error;
+                        asn1_set_error(asn1);
+                        break;
+                }
+        }
+
+        if (!asn1_end_tag(asn1)) return false;
+        if (!asn1_end_tag(asn1)) return false;
+
+        return !asn1_has_error(asn1);
 }
 
 static bool write_negTokenInit(struct asn1_data *asn1, struct spnego_negTokenInit *token)
 {
-        asn1_push_tag(asn1, ASN1_CONTEXT(0));
-        asn1_push_tag(asn1, ASN1_SEQUENCE(0));
+        if (!asn1_push_tag(asn1, ASN1_CONTEXT(0))) return false;
+        if (!asn1_push_tag(asn1, ASN1_SEQUENCE(0))) return false;
 
         /* Write mechTypes */
@@ -123 +140 @@
                 int i;
 
-                asn1_push_tag(asn1, ASN1_CONTEXT(0));
-                asn1_push_tag(asn1, ASN1_SEQUENCE(0));
+                if (!asn1_push_tag(asn1, ASN1_CONTEXT(0))) return false;
+                if (!asn1_push_tag(asn1, ASN1_SEQUENCE(0))) return false;
                 for (i = 0; token->mechTypes[i]; i++) {
-                        asn1_write_OID(asn1, token->mechTypes[i]);
-                }
-                asn1_pop_tag(asn1);
-                asn1_pop_tag(asn1);
+                        if (!asn1_write_OID(asn1, token->mechTypes[i])) return false;
+                }
+                if (!asn1_pop_tag(asn1)) return false;
+                if (!asn1_pop_tag(asn1)) return false;
         }
 
         /* write reqFlags */
         if (token->reqFlags.length > 0) {
-                asn1_push_tag(asn1, ASN1_CONTEXT(1));
-                asn1_write_BitString(asn1, token->reqFlags.data,
+                if (!asn1_push_tag(asn1, ASN1_CONTEXT(1))) return false;
+                if (!asn1_write_BitString(asn1, token->reqFlags.data,
                                      token->reqFlags.length,
-                                     token->reqFlagsPadding);
-                asn1_pop_tag(asn1);
+                                     token->reqFlagsPadding)) return false;
+                if (!asn1_pop_tag(asn1)) return false;
         }
 
         /* write mechToken */
         if (token->mechToken.data) {
-                asn1_push_tag(asn1, ASN1_CONTEXT(2));
-                asn1_write_OctetString(asn1, token->mechToken.data,
-                                       token->mechToken.length);
-                asn1_pop_tag(asn1);
+                if (!asn1_push_tag(asn1, ASN1_CONTEXT(2))) return false;
+                if (!asn1_write_OctetString(asn1, token->mechToken.data,
+                                       token->mechToken.length)) return false;
+                if (!asn1_pop_tag(asn1)) return false;
         }
 
         /* write mechListMIC */
         if (token->mechListMIC.data) {
-                asn1_push_tag(asn1, ASN1_CONTEXT(3));
+                if (!asn1_push_tag(asn1, ASN1_CONTEXT(3))) return false;
 #if 0
                 /* This is what RFC 2478 says ... */
@@ -159 +176 @@
                 /* ... but unfortunately this is what Windows
                    sends/expects */
-                asn1_push_tag(asn1, ASN1_SEQUENCE(0));
-                asn1_push_tag(asn1, ASN1_CONTEXT(0));
-                asn1_push_tag(asn1, ASN1_GENERAL_STRING);
-                asn1_write(asn1, token->mechListMIC.data,
-                           token->mechListMIC.length);
-                asn1_pop_tag(asn1);
-                asn1_pop_tag(asn1);
-                asn1_pop_tag(asn1);
+                if (!asn1_push_tag(asn1, ASN1_SEQUENCE(0))) return false;
+                if (!asn1_push_tag(asn1, ASN1_CONTEXT(0))) return false;
+                if (!asn1_push_tag(asn1, ASN1_GENERAL_STRING)) return false;
+                if (!asn1_write(asn1, token->mechListMIC.data,
+                           token->mechListMIC.length)) return false;
+                if (!asn1_pop_tag(asn1)) return false;
+                if (!asn1_pop_tag(asn1)) return false;
+                if (!asn1_pop_tag(asn1)) return false;
 #endif
-                asn1_pop_tag(asn1);
-        }
-
-        asn1_pop_tag(asn1);
-        asn1_pop_tag(asn1);
-
-        return !asn1->has_error;
+                if (!asn1_pop_tag(asn1)) return false;
+        }
+
+        if (!asn1_pop_tag(asn1)) return false;
+        if (!asn1_pop_tag(asn1)) return false;
+
+        return !asn1_has_error(asn1);
 }
 
@@ -182 +199 @@
         ZERO_STRUCTP(token);
 
-        asn1_start_tag(asn1, ASN1_CONTEXT(1));
-        asn1_start_tag(asn1, ASN1_SEQUENCE(0));
-
-        while (!asn1->has_error && 0 < asn1_tag_remaining(asn1)) {
+        if (!asn1_start_tag(asn1, ASN1_CONTEXT(1))) return false;
+        if (!asn1_start_tag(asn1, ASN1_SEQUENCE(0))) return false;
+
+        while (!asn1_has_error(asn1) && 0 < asn1_tag_remaining(asn1)) {
                 uint8_t context;
+                uint8_t neg_result;
                 char *oid;
+
                 if (!asn1_peek_uint8(asn1, &context)) {
-                        asn1->has_error = true;
+                        asn1_set_error(asn1);
                         break;
                 }
@@ -195 +214 @@
                 switch (context) {
                 case ASN1_CONTEXT(0):
-                        asn1_start_tag(asn1, ASN1_CONTEXT(0));
-                        asn1_start_tag(asn1, ASN1_ENUMERATED);
-                        asn1_read_uint8(asn1, &token->negResult);
-                        asn1_end_tag(asn1);
-                        asn1_end_tag(asn1);
+                        if (!asn1_start_tag(asn1, ASN1_CONTEXT(0))) return false;
+                        if (!asn1_start_tag(asn1, ASN1_ENUMERATED)) return false;
+                        if (!asn1_read_uint8(asn1, &neg_result)) return false;
+                        token->negResult = neg_result;
+                        if (!asn1_end_tag(asn1)) return false;
+                        if (!asn1_end_tag(asn1)) return false;
                         break;
                 case ASN1_CONTEXT(1):
-                        asn1_start_tag(asn1, ASN1_CONTEXT(1));
-                        asn1_read_OID(asn1, mem_ctx, &oid);
+                        if (!asn1_start_tag(asn1, ASN1_CONTEXT(1))) return false;
+                        if (!asn1_read_OID(asn1, mem_ctx, &oid)) return false;
                         token->supportedMech = oid;
-                        asn1_end_tag(asn1);
+                        if (!asn1_end_tag(asn1)) return false;
                         break;
                 case ASN1_CONTEXT(2):
-                        asn1_start_tag(asn1, ASN1_CONTEXT(2));
-                        asn1_read_OctetString(asn1, mem_ctx, &token->responseToken);
-                        asn1_end_tag(asn1);
+                        if (!asn1_start_tag(asn1, ASN1_CONTEXT(2))) return false;
+                        if (!asn1_read_OctetString(asn1, mem_ctx, &token->responseToken)) return false;
+                        if (!asn1_end_tag(asn1)) return false;
                         break;
                 case ASN1_CONTEXT(3):
-                        asn1_start_tag(asn1, ASN1_CONTEXT(3));
-                        asn1_read_OctetString(asn1, mem_ctx, &token->mechListMIC);
-                        asn1_end_tag(asn1);
+                        if (!asn1_start_tag(asn1, ASN1_CONTEXT(3))) return false;
+                        if (!asn1_read_OctetString(asn1, mem_ctx, &token->mechListMIC)) return false;
+                        if (!asn1_end_tag(asn1)) return false;
                         break;
                 default:
-                        asn1->has_error = true;
-                        break;
-                }
-        }
-
-        asn1_end_tag(asn1);
-        asn1_end_tag(asn1);
-
-        return !asn1->has_error;
+                        asn1_set_error(asn1);
+                        break;
+                }
+        }
+
+        if (!asn1_end_tag(asn1)) return false;
+        if (!asn1_end_tag(asn1)) return false;
+
+        return !asn1_has_error(asn1);
 }
 
 static bool write_negTokenTarg(struct asn1_data *asn1, struct spnego_negTokenTarg *token)
 {
-        asn1_push_tag(asn1, ASN1_CONTEXT(1));
-        asn1_push_tag(asn1, ASN1_SEQUENCE(0));
+        if (!asn1_push_tag(asn1, ASN1_CONTEXT(1))) return false;
+        if (!asn1_push_tag(asn1, ASN1_SEQUENCE(0))) return false;
 
         if (token->negResult != SPNEGO_NONE_RESULT) {
-                asn1_push_tag(asn1, ASN1_CONTEXT(0));
-                asn1_write_enumerated(asn1, token->negResult);
-                asn1_pop_tag(asn1);
+                if (!asn1_push_tag(asn1, ASN1_CONTEXT(0))) return false;
+                if (!asn1_write_enumerated(asn1, token->negResult)) return false;
+                if (!asn1_pop_tag(asn1)) return false;
         }
 
         if (token->supportedMech) {
-                asn1_push_tag(asn1, ASN1_CONTEXT(1));
-                asn1_write_OID(asn1, token->supportedMech);
-                asn1_pop_tag(asn1);
+                if (!asn1_push_tag(asn1, ASN1_CONTEXT(1))) return false;
+                if (!asn1_write_OID(asn1, token->supportedMech)) return false;
+                if (!asn1_pop_tag(asn1)) return false;
         }
 
         if (token->responseToken.data) {
-                asn1_push_tag(asn1, ASN1_CONTEXT(2));
-                asn1_write_OctetString(asn1, token->responseToken.data,
-                                       token->responseToken.length);
-                asn1_pop_tag(asn1);
+                if (!asn1_push_tag(asn1, ASN1_CONTEXT(2))) return false;
+                if (!asn1_write_OctetString(asn1, token->responseToken.data,
+                                       token->responseToken.length)) return false;
+                if (!asn1_pop_tag(asn1)) return false;
         }
 
         if (token->mechListMIC.data) {
-                asn1_push_tag(asn1, ASN1_CONTEXT(3));
-                asn1_write_OctetString(asn1, token->mechListMIC.data,
-                                      token->mechListMIC.length);
-                asn1_pop_tag(asn1);
-        }
-
-        asn1_pop_tag(asn1);
-        asn1_pop_tag(asn1);
-
-        return !asn1->has_error;
+                if (!asn1_push_tag(asn1, ASN1_CONTEXT(3))) return false;
+                if (!asn1_write_OctetString(asn1, token->mechListMIC.data,
+                                      token->mechListMIC.length)) return false;
+                if (!asn1_pop_tag(asn1)) return false;
+        }
+
+        if (!asn1_pop_tag(asn1)) return false;
+        if (!asn1_pop_tag(asn1)) return false;
+
+        return !asn1_has_error(asn1);
 }
 
@@ -283 +303 @@
         }
 
-        asn1_load(asn1, data);
+        if (!asn1_load(asn1, data)) goto err;
 
         if (!asn1_peek_uint8(asn1, &context)) {
-                asn1->has_error = true;
+                asn1_set_error(asn1);
         } else {
                 switch (context) {
                 case ASN1_APPLICATION(0):
-                        asn1_start_tag(asn1, ASN1_APPLICATION(0));
-                        asn1_check_OID(asn1, OID_SPNEGO);
+                        if (!asn1_start_tag(asn1, ASN1_APPLICATION(0))) goto err;
+                        if (!asn1_check_OID(asn1, OID_SPNEGO)) goto err;
                         if (read_negTokenInit(asn1, mem_ctx, &token->negTokenInit)) {
                                 token->type = SPNEGO_NEG_TOKEN_INIT;
                         }
-                        asn1_end_tag(asn1);
+                        if (!asn1_end_tag(asn1)) goto err;
                         break;
                 case ASN1_CONTEXT(1):
@@ -303 +323 @@
                         break;
                 default:
-                        asn1->has_error = true;
-                        break;
-                }
-        }
-
-        if (!asn1->has_error) ret = asn1->ofs;
+                        asn1_set_error(asn1);
+                        break;
+                }
+        }
+
+        if (!asn1_has_error(asn1)) {
+                ret = asn1_current_ofs(asn1);
+        }
+
+  err:
+
         asn1_free(asn1);
 
@@ -325 +350 @@
         switch (spnego->type) {
         case SPNEGO_NEG_TOKEN_INIT:
-                asn1_push_tag(asn1, ASN1_APPLICATION(0));
-                asn1_write_OID(asn1, OID_SPNEGO);
-                write_negTokenInit(asn1, &spnego->negTokenInit);
-                asn1_pop_tag(asn1);
+                if (!asn1_push_tag(asn1, ASN1_APPLICATION(0))) goto err;
+                if (!asn1_write_OID(asn1, OID_SPNEGO)) goto err;
+                if (!write_negTokenInit(asn1, &spnego->negTokenInit)) goto err;
+                if (!asn1_pop_tag(asn1)) goto err;
                 break;
         case SPNEGO_NEG_TOKEN_TARG:
@@ -334 +359 @@
                 break;
         default:
-                asn1->has_error = true;
-                break;
-        }
-
-        if (!asn1->has_error) {
-                *blob = data_blob_talloc(mem_ctx, asn1->data, asn1->length);
-                ret = asn1->ofs;
-        }
+                asn1_set_error(asn1);
+                break;
+        }
+
+        if (!asn1_extract_blob(asn1, mem_ctx, blob)) {
+                goto err;
+        }
+
+        ret = asn1_current_ofs(asn1);
+
+  err:
+
         asn1_free(asn1);
 
@@ -356 +385 @@
         case SPNEGO_NEG_TOKEN_INIT:
                 if (spnego->negTokenInit.mechTypes) {
-                        talloc_free(spnego->negTokenInit.mechTypes);
+                        talloc_free(discard_const(spnego->negTokenInit.mechTypes));
                 }
                 data_blob_free(&spnego->negTokenInit.reqFlags);
@@ -380 +409 @@
 
 bool spnego_write_mech_types(TALLOC_CTX *mem_ctx,
-                             const char **mech_types,
+                             const char * const *mech_types,
                              DATA_BLOB *blob)
 {
+        bool ret = false;
         struct asn1_data *asn1 = asn1_init(mem_ctx);
 
@@ -393 +423 @@
                 int i;
 
-                asn1_push_tag(asn1, ASN1_SEQUENCE(0));
+                if (!asn1_push_tag(asn1, ASN1_SEQUENCE(0))) goto err;
                 for (i = 0; mech_types[i]; i++) {
-                        asn1_write_OID(asn1, mech_types[i]);
-                }
-                asn1_pop_tag(asn1);
-        }
-
-        if (asn1->has_error) {
-                asn1_free(asn1);
-                return false;
-        }
-
-        *blob = data_blob_talloc(mem_ctx, asn1->data, asn1->length);
-        if (blob->length != asn1->length) {
-                asn1_free(asn1);
-                return false;
-        }
+                        if (!asn1_write_OID(asn1, mech_types[i])) goto err;
+                }
+                if (!asn1_pop_tag(asn1)) goto err;
+        }
+
+        if (asn1_has_error(asn1)) {
+                goto err;
+        }
+
+        if (!asn1_extract_blob(asn1, mem_ctx, blob)) {
+                goto err;
+        }
+
+        ret = true;
+
+  err:
 
         asn1_free(asn1);
 
-        return true;
-}
+        return ret;
+}

vendor/current/libcli/auth/spnego_proto.h

@@ -25 +25 @@
 bool spnego_free_data(struct spnego_data *spnego);
 bool spnego_write_mech_types(TALLOC_CTX *mem_ctx,
-                             const char **mech_types,
+                             const char * const *mech_types,
                              DATA_BLOB *blob);

vendor/current/libcli/auth/wscript_build

@@ -3 +3 @@
 bld.SAMBA_LIBRARY('cliauth',
                   source='',
-                  deps='NTLMSSP_COMMON MSRPC_PARSE LIBCLI_AUTH COMMON_SCHANNEL PAM_ERRORS SPNEGO_PARSE',
+                  deps='MSRPC_PARSE LIBCLI_AUTH COMMON_SCHANNEL PAM_ERRORS SPNEGO_PARSE krb5samba samba-errors NTLM_CHECK UTIL_LSARPC',
                   private_library=True,
                   grouping_library=True)
-
-bld.SAMBA_SUBSYSTEM('NTLMSSP_COMMON',
-                    source='ntlmssp.c ntlmssp_ndr.c ntlmssp_server.c ntlmssp_sign.c ntlm_check.c',
-                    deps='samba-util NDR_NTLMSSP MSRPC_PARSE')
-
 
 bld.SAMBA_SUBSYSTEM('MSRPC_PARSE',
@@ -17 +12 @@
         )
 
+bld.SAMBA_SUBSYSTEM('NTLM_CHECK',
+                    source='ntlm_check.c',
+                    deps = 'talloc'
+                    )
 
 bld.SAMBA_SUBSYSTEM('LIBCLI_AUTH',
         source='credentials.c session.c smbencrypt.c smbdes.c',
-        public_deps='MSRPC_PARSE NDR_NTLMSSP',
+        public_deps='MSRPC_PARSE',
         public_headers='credentials.h:domain_credentials.h'
         )
@@ -26 +25 @@
 
 bld.SAMBA_SUBSYSTEM('COMMON_SCHANNEL',
-        source='schannel_state_tdb.c schannel_sign.c',
-        deps='tdb-wrap UTIL_TDB'
+        source='schannel_state_tdb.c',
+        deps='dbwrap util_tdb samba-hostconfig NDR_NETLOGON'
         )
 
+bld.SAMBA_SUBSYSTEM('NETLOGON_CREDS_CLI',
+        source='netlogon_creds_cli.c',
+        deps='dbwrap util_tdb tevent-util samba-hostconfig RPC_NDR_NETLOGON NDR_NETLOGON'
+        )
 
 bld.SAMBA_SUBSYSTEM('PAM_ERRORS',
@@ -38 +41 @@
 bld.SAMBA_SUBSYSTEM('SPNEGO_PARSE',
                     source='spnego_parse.c',
-                    deps='ASN1_UTIL')
+                    deps='asn1util')