Skip to content

Commit ea20b62

Browse files
simo5simo5
committed
Allow ntlm_seal even withon NEGOTIATE_SEAL
So according to Issue #77 we have an interop issue if we prevent the use of gss_wrap when sealing has not been negotiated. On the technical side, whether we negotiate sealing or not we always create a seal handle with RC4. Change behavior to allow applications to still wrap/unwrap data if they want, even though the negotiation marked sealing as not selected. The worst thing that can happen is that the peer application does no like sealed content and bails. Applications that need to avoid seeling should already just use gss_get_mic() anyway and they can check the returned GSS flags to see if sealing was negotiated (returned as GSS_CONF_FLAG), so applications still have all they need to make their choice and be compatible with whatever peer they need to speak to. Thanks to Filip Navara for finding this. Signed-off-by: Simo Sorce <simo@redhat.com>
1 parent 8149435 commit ea20b62

File tree

2 files changed

+71
-93
lines changed

2 files changed

+71
-93
lines changed

‎src/ntlm_crypto.c‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -860,9 +860,8 @@ int ntlm_seal(uint32_t flags,
860860

861861
h = &state->send;
862862

863-
if (!(flags & NTLMSSP_NEGOTIATE_SEAL) ||
864-
(h->seal_handle == NULL)) {
865-
return ENOTSUP;
863+
if (h->seal_handle == NULL) {
864+
return EINVAL;
866865
}
867866

868867
ret = RC4_UPDATE(h->seal_handle, message, output);
@@ -902,9 +901,8 @@ int ntlm_unseal(uint32_t flags,
902901
h = &state->recv;
903902
}
904903

905-
if (!(flags & NTLMSSP_NEGOTIATE_SEAL) ||
906-
(h->seal_handle == NULL)) {
907-
return ENOTSUP;
904+
if (h->seal_handle == NULL) {
905+
return EINVAL;
908906
}
909907

910908
ret = RC4_UPDATE(h->seal_handle, message, output);

‎tests/ntlmssptest.c‎

Lines changed: 67 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -1730,100 +1730,80 @@ int test_gssapi_1(bool user_env_file, bool use_cb, bool no_seal, bool use_cs)
17301730

17311731
gss_release_buffer(&retmin, &srv_token);
17321732

1733-
if (no_seal) {
1734-
retmaj = gssntlm_wrap(&retmin, cli_ctx, 1, 0, &message, NULL,
1735-
&cli_token);
1736-
if ((retmaj != GSS_S_FAILURE) && (retmin != ENOTSUP)) {
1737-
fprintf(stderr, "WARN: gssntlm_wrap(cli) did not fail!\n");
1738-
fflush(stderr);
1739-
ret = EINVAL;
1740-
goto done;
1741-
}
1742-
1743-
retmaj = gssntlm_wrap(&retmin, srv_ctx, 1, 0, &message, NULL,
1744-
&srv_token);
1745-
if ((retmaj != GSS_S_FAILURE) && (retmin != ENOTSUP)) {
1746-
fprintf(stderr, "WARN: gssntlm_wrap(srv) did not fail!\n");
1747-
fflush(stderr);
1748-
ret = EINVAL;
1749-
goto done;
1750-
}
1751-
} else {
1752-
retmaj = gssntlm_wrap(&retmin, cli_ctx, 1, 0, &message, &conf_state,
1753-
&cli_token);
1754-
if (retmaj != GSS_S_COMPLETE) {
1755-
print_gss_error("gssntlm_wrap(cli) failed!",
1756-
retmaj, retmin);
1757-
ret = EINVAL;
1758-
goto done;
1759-
}
1760-
if (conf_state == 0) {
1761-
fprintf(stderr, "WARN: gssntlm_wrap(cli) gave 0 conf_state!\n");
1762-
fflush(stderr);
1763-
ret = EINVAL;
1764-
goto done;
1765-
}
1766-
1767-
retmaj = gssntlm_unwrap(&retmin, srv_ctx,
1768-
&cli_token, &srv_token, &conf_state, NULL);
1769-
if (retmaj != GSS_S_COMPLETE) {
1770-
print_gss_error("gssntlm_unwrap(srv) failed!",
1771-
retmaj, retmin);
1772-
ret = EINVAL;
1773-
goto done;
1774-
}
1775-
if (conf_state == 0) {
1776-
fprintf(stderr, "WARN: gssntlm_wrap(srv) gave 0 conf_state!\n");
1777-
fflush(stderr);
1778-
ret = EINVAL;
1779-
goto done;
1780-
}
1733+
retmaj = gssntlm_wrap(&retmin, cli_ctx, 1, 0, &message, &conf_state,
1734+
&cli_token);
1735+
if (retmaj != GSS_S_COMPLETE) {
1736+
print_gss_error("gssntlm_wrap(cli) failed!",
1737+
retmaj, retmin);
1738+
ret = EINVAL;
1739+
goto done;
1740+
}
1741+
if (conf_state == 0) {
1742+
fprintf(stderr, "WARN: gssntlm_wrap(cli) gave 0 conf_state!\n");
1743+
fflush(stderr);
1744+
ret = EINVAL;
1745+
goto done;
1746+
}
17811747

1782-
gss_release_buffer(&retmin, &cli_token);
1783-
gss_release_buffer(&retmin, &srv_token);
1748+
retmaj = gssntlm_unwrap(&retmin, srv_ctx,
1749+
&cli_token, &srv_token, &conf_state, NULL);
1750+
if (retmaj != GSS_S_COMPLETE) {
1751+
print_gss_error("gssntlm_unwrap(srv) failed!",
1752+
retmaj, retmin);
1753+
ret = EINVAL;
1754+
goto done;
1755+
}
1756+
if (!no_seal && conf_state == 0) {
1757+
fprintf(stderr, "WARN: gssntlm_wrap(srv) gave 0 conf_state!\n");
1758+
fflush(stderr);
1759+
ret = EINVAL;
1760+
goto done;
1761+
}
17841762

1785-
retmaj = gssntlm_wrap(&retmin, srv_ctx, 1, 0, &message, &conf_state,
1786-
&srv_token);
1787-
if (retmaj != GSS_S_COMPLETE) {
1788-
print_gss_error("gssntlm_wrap(srv) failed!",
1789-
retmaj, retmin);
1790-
ret = EINVAL;
1791-
goto done;
1792-
}
1793-
if (conf_state == 0) {
1794-
fprintf(stderr, "WARN: gssntlm_wrap(srv) gave 0 conf_state!\n");
1795-
fflush(stderr);
1796-
ret = EINVAL;
1797-
goto done;
1798-
}
1763+
gss_release_buffer(&retmin, &cli_token);
1764+
gss_release_buffer(&retmin, &srv_token);
17991765

1800-
retmaj = gssntlm_unwrap(&retmin, cli_ctx,
1801-
&srv_token, &cli_token, &conf_state, NULL);
1802-
if (retmaj != GSS_S_COMPLETE) {
1803-
print_gss_error("gssntlm_unwrap(cli) failed!",
1804-
retmaj, retmin);
1805-
ret = EINVAL;
1806-
goto done;
1807-
}
1808-
if (conf_state == 0) {
1809-
fprintf(stderr, "WARN: gssntlm_wrap(cli) gave 0 conf_state!\n");
1810-
fflush(stderr);
1811-
ret = EINVAL;
1812-
goto done;
1813-
}
1766+
retmaj = gssntlm_wrap(&retmin, srv_ctx, 1, 0, &message, &conf_state,
1767+
&srv_token);
1768+
if (retmaj != GSS_S_COMPLETE) {
1769+
print_gss_error("gssntlm_wrap(srv) failed!",
1770+
retmaj, retmin);
1771+
ret = EINVAL;
1772+
goto done;
1773+
}
1774+
if (conf_state == 0) {
1775+
fprintf(stderr, "WARN: gssntlm_wrap(srv) gave 0 conf_state!\n");
1776+
fflush(stderr);
1777+
ret = EINVAL;
1778+
goto done;
1779+
}
18141780

1815-
if (memcmp(message.value, cli_token.value, cli_token.length) != 0) {
1816-
print_gss_error("sealing and unsealing failed to return the "
1817-
"same result",
1818-
retmaj, retmin);
1819-
ret = EINVAL;
1820-
goto done;
1821-
}
1781+
retmaj = gssntlm_unwrap(&retmin, cli_ctx,
1782+
&srv_token, &cli_token, &conf_state, NULL);
1783+
if (retmaj != GSS_S_COMPLETE) {
1784+
print_gss_error("gssntlm_unwrap(cli) failed!",
1785+
retmaj, retmin);
1786+
ret = EINVAL;
1787+
goto done;
1788+
}
1789+
if (!no_seal && conf_state == 0) {
1790+
fprintf(stderr, "WARN: gssntlm_wrap(cli) gave 0 conf_state!\n");
1791+
fflush(stderr);
1792+
ret = EINVAL;
1793+
goto done;
1794+
}
18221795

1823-
gss_release_buffer(&retmin, &cli_token);
1824-
gss_release_buffer(&retmin, &srv_token);
1796+
if (memcmp(message.value, cli_token.value, cli_token.length) != 0) {
1797+
print_gss_error("sealing and unsealing failed to return the "
1798+
"same result",
1799+
retmaj, retmin);
1800+
ret = EINVAL;
1801+
goto done;
18251802
}
18261803

1804+
gss_release_buffer(&retmin, &cli_token);
1805+
gss_release_buffer(&retmin, &srv_token);
1806+
18271807
gssntlm_release_name(&retmin, &gss_username);
18281808
gssntlm_release_name(&retmin, &gss_srvname);
18291809

0 commit comments

Comments
 (0)