Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Completely omit CBs AV pairs when no CB provided #26

Merged
merged 1 commit into from
Jun 9, 2020
Merged

Completely omit CBs AV pairs when no CB provided #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions src/gss_sec_ctx.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -942,6 +942,7 @@ uint32_t gssntlm_accept_sec_context(uint32_t *minor_status,
}

if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS) {
uint8_t zero_cb[16] = { 0 };
if (input_chan_bindings->initiator_addrtype != 0 ||
input_chan_bindings->initiator_address.length != 0 ||
input_chan_bindings->acceptor_addrtype != 0 ||
Expand All @@ -953,12 +954,23 @@ uint32_t gssntlm_accept_sec_context(uint32_t *minor_status,
unhashed_cb.length = input_chan_bindings->application_data.length;
unhashed_cb.data = input_chan_bindings->application_data.value;

/* TODO: optionally allow to ignore CBT if av_cb is null ? */
retmin = ntlm_verify_channel_bindings(&unhashed_cb, &av_cb);
if (retmin) {
if (av_cb.length && (av_cb.length != 16)) {
set_GSSERRS(retmin, GSS_S_DEFECTIVE_TOKEN);
goto done;
}
if (av_cb.length &&
(memcmp(av_cb.data, zero_cb, 16) != 0)) {
retmin = ntlm_verify_channel_bindings(&unhashed_cb, &av_cb);
if (retmin) {
set_GSSERRS(retmin, GSS_S_DEFECTIVE_TOKEN);
goto done;
/* This flag has been introduced only recently in MIT krb5 */
#ifdef GSS_C_CHANNEL_BOUND_FLAG
} else {
ctx->gss_flags |= GSS_C_CHANNEL_BOUND_FLAG;
#endif /* GSS_C_CHANNEL_BOUND_FLAG */
}
}
}

if (ctx->neg_flags & (NTLMSSP_NEGOTIATE_SIGN |
Expand Down
14 changes: 5 additions & 9 deletions src/ntlm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,12 +68,6 @@ struct wire_single_host_data {
};
#pragma pack(pop)

#pragma pack(push, 1)
struct wire_channel_binding {
uint8_t md5_hash[16];
};
#pragma pack(pop)

#pragma pack(push, 1)
struct wire_ntlm_cli_chal {
uint8_t resp_type;
Expand Down Expand Up @@ -560,7 +554,7 @@ int ntlm_encode_target_info(struct ntlm_ctx *ctx, char *nb_computer_name,
av_target_name_len = strlen(av_target_name);
max_size += 4 + av_target_name_len * 2;
}
if (av_cb) {
if (av_cb && av_cb->length > 0) {
max_size += 4 + av_cb->length;
}

Expand Down Expand Up @@ -632,7 +626,7 @@ int ntlm_encode_target_info(struct ntlm_ctx *ctx, char *nb_computer_name,
av_target_name_len);
if (ret) goto done;
}
if (av_cb) {
if (av_cb && av_cb->length > 0) {
ret = ntlm_encode_av_pair_value(&buffer, &data_offs,
MSV_AV_CHANNEL_BINDINGS, av_cb);
if (ret) goto done;
Expand Down Expand Up @@ -791,7 +785,7 @@ int ntlm_process_target_info(struct ntlm_ctx *ctx, bool protect,
uint32_t av_flags = 0;
uint64_t srv_time = 0;
uint8_t cb[16] = { 0 };
struct ntlm_buffer av_cb = { cb, 16 };
struct ntlm_buffer av_cb = { NULL, 0 };
int ret = 0;

/* TODO: check that returned netbios/dns names match ? */
Expand Down Expand Up @@ -824,6 +818,8 @@ int ntlm_process_target_info(struct ntlm_ctx *ctx, bool protect,
}

if (unhashed_cb->length > 0) {
av_cb.data = cb;
av_cb.length = 16;
ret = ntlm_hash_channel_bindings(unhashed_cb, &av_cb);
if (ret) goto done;
}
Expand Down