|
 |
b6b438 |
From 042dc64f099a2aa2dd44ba9a00c29e05eed0848b Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Date: Wed, 13 Nov 2019 12:45:04 +0100
|
|
|
b6b438 |
Subject: [PATCH 140/187] libcli:auth: Check return codes of
|
|
|
b6b438 |
SMBsesskeygen_ntv2()
|
|
|
b6b438 |
|
|
|
b6b438 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
b6b438 |
(cherry picked from commit 0914824684b3a69a9926402d447e1d5781f2ec02)
|
|
|
b6b438 |
---
|
|
|
b6b438 |
libcli/auth/ntlm_check.c | 17 +++++++++++++++--
|
|
|
b6b438 |
libcli/auth/smbencrypt.c | 15 +++++++++++++--
|
|
|
b6b438 |
2 files changed, 28 insertions(+), 4 deletions(-)
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/libcli/auth/ntlm_check.c b/libcli/auth/ntlm_check.c
|
|
|
b6b438 |
index 3844abde528..ba0051d7aea 100644
|
|
|
b6b438 |
--- a/libcli/auth/ntlm_check.c
|
|
|
b6b438 |
+++ b/libcli/auth/ntlm_check.c
|
|
|
b6b438 |
@@ -142,8 +142,15 @@ static bool smb_pwd_check_ntlmv2(TALLOC_CTX *mem_ctx,
|
|
|
b6b438 |
data_blob_clear_free(&client_key_data);
|
|
|
b6b438 |
if (memcmp(value_from_encryption, ntv2_response->data, 16) == 0) {
|
|
|
b6b438 |
if (user_sess_key != NULL) {
|
|
|
b6b438 |
+ NTSTATUS status;
|
|
|
b6b438 |
*user_sess_key = data_blob_talloc(mem_ctx, NULL, 16);
|
|
|
b6b438 |
- SMBsesskeygen_ntv2(kr, value_from_encryption, user_sess_key->data);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ status = SMBsesskeygen_ntv2(kr,
|
|
|
b6b438 |
+ value_from_encryption,
|
|
|
b6b438 |
+ user_sess_key->data);
|
|
|
b6b438 |
+ if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ return false;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
}
|
|
|
b6b438 |
return true;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
@@ -166,6 +173,7 @@ static bool smb_sess_key_ntlmv2(TALLOC_CTX *mem_ctx,
|
|
|
b6b438 |
uint8_t kr[16];
|
|
|
b6b438 |
uint8_t value_from_encryption[16];
|
|
|
b6b438 |
DATA_BLOB client_key_data;
|
|
|
b6b438 |
+ NTSTATUS status;
|
|
|
b6b438 |
|
|
|
b6b438 |
if (part_passwd == NULL) {
|
|
|
b6b438 |
DEBUG(10,("No password set - DISALLOWING access\n"));
|
|
|
b6b438 |
@@ -196,7 +204,12 @@ static bool smb_sess_key_ntlmv2(TALLOC_CTX *mem_ctx,
|
|
|
b6b438 |
|
|
|
b6b438 |
SMBOWFencrypt_ntv2(kr, sec_blob, &client_key_data, value_from_encryption);
|
|
|
b6b438 |
*user_sess_key = data_blob_talloc(mem_ctx, NULL, 16);
|
|
|
b6b438 |
- SMBsesskeygen_ntv2(kr, value_from_encryption, user_sess_key->data);
|
|
|
b6b438 |
+ status = SMBsesskeygen_ntv2(kr,
|
|
|
b6b438 |
+ value_from_encryption,
|
|
|
b6b438 |
+ user_sess_key->data);
|
|
|
b6b438 |
+ if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ return false;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
return true;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/libcli/auth/smbencrypt.c b/libcli/auth/smbencrypt.c
|
|
|
b6b438 |
index 904d2c38219..1412274dd21 100644
|
|
|
b6b438 |
--- a/libcli/auth/smbencrypt.c
|
|
|
b6b438 |
+++ b/libcli/auth/smbencrypt.c
|
|
|
b6b438 |
@@ -551,6 +551,7 @@ bool SMBNTLMv2encrypt_hash(TALLOC_CTX *mem_ctx,
|
|
|
b6b438 |
DATA_BLOB *lm_session_key, DATA_BLOB *user_session_key)
|
|
|
b6b438 |
{
|
|
|
b6b438 |
uint8_t ntlm_v2_hash[16];
|
|
|
b6b438 |
+ NTSTATUS status;
|
|
|
b6b438 |
|
|
|
b6b438 |
/* We don't use the NT# directly. Instead we use it mashed up with
|
|
|
b6b438 |
the username and domain.
|
|
|
b6b438 |
@@ -580,7 +581,12 @@ bool SMBNTLMv2encrypt_hash(TALLOC_CTX *mem_ctx,
|
|
|
b6b438 |
|
|
|
b6b438 |
/* The NTLMv2 calculations also provide a session key, for signing etc later */
|
|
|
b6b438 |
/* use only the first 16 bytes of nt_response for session key */
|
|
|
b6b438 |
- SMBsesskeygen_ntv2(ntlm_v2_hash, nt_response->data, user_session_key->data);
|
|
|
b6b438 |
+ status = SMBsesskeygen_ntv2(ntlm_v2_hash,
|
|
|
b6b438 |
+ nt_response->data,
|
|
|
b6b438 |
+ user_session_key->data);
|
|
|
b6b438 |
+ if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ return false;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
}
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
@@ -599,7 +605,12 @@ bool SMBNTLMv2encrypt_hash(TALLOC_CTX *mem_ctx,
|
|
|
b6b438 |
|
|
|
b6b438 |
/* The NTLMv2 calculations also provide a session key, for signing etc later */
|
|
|
b6b438 |
/* use only the first 16 bytes of lm_response for session key */
|
|
|
b6b438 |
- SMBsesskeygen_ntv2(ntlm_v2_hash, lm_response->data, lm_session_key->data);
|
|
|
b6b438 |
+ status = SMBsesskeygen_ntv2(ntlm_v2_hash,
|
|
|
b6b438 |
+ lm_response->data,
|
|
|
b6b438 |
+ lm_session_key->data);
|
|
|
b6b438 |
+ if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ return false;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
}
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|