[29421] in CVS-changelog-for-Kerberos-V5
krb5 commit: Add SPNEGO special case for NTLMSSP+MechListMIC
daemon@ATHENA.MIT.EDU (Greg Hudson)
Sat May 28 21:54:36 2016
Date: Sat, 28 May 2016 21:54:31 -0400
From: Greg Hudson <ghudson@mit.edu>
Message-Id: <201605290154.u4T1sVuF022275@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/cb96ca52a3354e5a0ea52e12495ff375de54f9b7
commit cb96ca52a3354e5a0ea52e12495ff375de54f9b7
Author: Simo Sorce <simo@redhat.com>
Date: Wed Mar 30 13:00:19 2016 -0400
Add SPNEGO special case for NTLMSSP+MechListMIC
MS-SPNG section 3.3.5.1 documents an odd behavior the SPNEGO layer
needs to implement specifically for the NTLMSSP mechanism. This is
required for compatibility with Windows services.
ticket: 8423 (new)
src/lib/gssapi/spnego/spnego_mech.c | 48 +++++++++++++++++++++++++++++++---
1 files changed, 43 insertions(+), 5 deletions(-)
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index bcebba8..7862d98 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -507,6 +507,45 @@ mech_requires_mechlistMIC(spnego_gss_ctx_id_t sc)
return result;
}
+/* iso(1) org(3) dod(6) internet(1) private(4) enterprises(1) Microsoft(311)
+ * security(2) mechanisms(2) NTLM(10) */
+static const gss_OID_desc gss_mech_ntlmssp_oid =
+ { 10, "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a" };
+
+/* iso(1) org(3) dod(6) internet(1) private(4) enterprises(1) samba(7165)
+ * gssntlmssp(655) controls(1) ntlmssp_reset_crypto(3) */
+static const gss_OID_desc ntlmssp_reset_crypto_oid =
+ { 11, "\x2B\x06\x01\x04\x01\xB7\x7D\x85\x0F\x01\x03" };
+
+/*
+ * MS-SPNG section 3.3.5.1 warns that the NTLM mechanism requires special
+ * handling of the crypto state to interop with Windows. If the mechanism for
+ * sc is SPNEGO, invoke a mechanism-specific operation on the context to reset
+ * the RC4 state after producing or verifying a MIC. Ignore a result of
+ * GSS_S_UNAVAILABLE for compatibility with older versions of the mechanism
+ * that do not support this functionality.
+ */
+static OM_uint32
+ntlmssp_reset_crypto_state(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc,
+ OM_uint32 verify)
+{
+ OM_uint32 major, minor;
+ gss_buffer_desc value;
+
+ if (!g_OID_equal(sc->internal_mech, &gss_mech_ntlmssp_oid))
+ return GSS_S_COMPLETE;
+
+ value.length = sizeof(verify);
+ value.value = &verify;
+ major = gss_set_sec_context_option(&minor, &sc->ctx_handle,
+ (gss_OID)&ntlmssp_reset_crypto_oid,
+ &value);
+ if (major == GSS_S_UNAVAILABLE)
+ return GSS_S_COMPLETE;
+ *minor_status = minor;
+ return major;
+}
+
/*
* Both initiator and acceptor call here to verify and/or create mechListMIC,
* and to consistency-check the MIC state. handle_mic is invoked only if the
@@ -588,6 +627,8 @@ process_mic(OM_uint32 *minor_status, gss_buffer_t mic_in,
ret = gss_verify_mic(minor_status, sc->ctx_handle,
&sc->DER_mechTypes,
mic_in, &qop_state);
+ if (ret == GSS_S_COMPLETE)
+ ret = ntlmssp_reset_crypto_state(minor_status, sc, 1);
if (ret != GSS_S_COMPLETE) {
*negState = REJECT;
*tokflag = ERROR_TOKEN_SEND;
@@ -602,6 +643,8 @@ process_mic(OM_uint32 *minor_status, gss_buffer_t mic_in,
GSS_C_QOP_DEFAULT,
&sc->DER_mechTypes,
&tmpmic);
+ if (ret == GSS_S_COMPLETE)
+ ret = ntlmssp_reset_crypto_state(minor_status, sc, 0);
if (ret != GSS_S_COMPLETE) {
gss_release_buffer(&tmpmin, &tmpmic);
*tokflag = NO_TOKEN_SEND;
@@ -804,11 +847,6 @@ init_ctx_nego(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc,
return ret;
}
-/* iso(1) org(3) dod(6) internet(1) private(4) enterprise(1) Microsoft(311)
- * security(2) mechanisms(2) NTLM(10) */
-static const gss_OID_desc gss_mech_ntlmssp_oid =
- { 10, "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a" };
-
/*
* Handle acceptor's counter-proposal of an alternative mechanism.
*/
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
