s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that...

Packet traces showing such servers are found in the bug this fixes:

https://bugzilla.samba.org/show_bug.cgi?id=10016

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Thu Mar 19 12:05:56 CET 2015 on sn-devel-104

diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c
index 617b34b497722dc570d28c875686c3091cfe74d1..e661aebba12d6ec88583aab07c506bb985519ff5 100644 (file)
--- a/source3/libsmb/ntlmssp.c
+++ b/source3/libsmb/ntlmssp.c
@@ -359,12 +359,13 @@ static NTSTATUS ntlmssp3_client_challenge(struct ntlmssp_state *ntlmssp_state,
                                         TALLOC_CTX *out_mem_ctx, /* Unused at this time */
                                         const DATA_BLOB reply, DATA_BLOB *next_request)
 {
-       uint32_t chal_flags, ntlmssp_command, unkn1, unkn2;
+       uint32_t chal_flags, ntlmssp_command, unkn1 = 0, unkn2 = 0;
        DATA_BLOB server_domain_blob;
        DATA_BLOB challenge_blob;
        DATA_BLOB struct_blob = data_blob_null;
        char *server_domain;
        const char *chal_parse_string;
+       const char *chal_parse_string_short = NULL;
        const char *auth_gen_string;
        DATA_BLOB lm_response = data_blob_null;
        DATA_BLOB nt_response = data_blob_null;
@@ -474,6 +475,7 @@ noccache:
                        chal_parse_string = "CdUdbddB";
                } else {
                        chal_parse_string = "CdUdbdd";
+                       chal_parse_string_short = "CdUdb";
                }
                auth_gen_string = "CdBBUUUBd";
        } else {
@@ -481,6 +483,7 @@ noccache:
                        chal_parse_string = "CdAdbddB";
                } else {
                        chal_parse_string = "CdAdbdd";
+                       chal_parse_string_short = "CdAdb";
                }
 
                auth_gen_string = "CdBBAAABd";
@@ -497,9 +500,38 @@ noccache:
                         &challenge_blob, 8,
                         &unkn1, &unkn2,
                         &struct_blob)) {
+
+               bool ok = false;
+
                DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
-               dump_data(2, reply.data, reply.length);
-               return NT_STATUS_INVALID_PARAMETER;
+
+               if (chal_parse_string_short != NULL) {
+                       /*
+                        * In the case where NTLMSSP_NEGOTIATE_TARGET_INFO
+                        * is not used, some NTLMSSP servers don't return
+                        * the unused unkn1 and unkn2 fields.
+                        * See bug:
+                        * https://bugzilla.samba.org/show_bug.cgi?id=10016
+                        * for packet traces.
+                        * Try and parse again without them.
+                        */
+                       ok = msrpc_parse(ntlmssp_state, &reply,
+                               chal_parse_string_short,
+                               "NTLMSSP",
+                               &ntlmssp_command,
+                               &server_domain,
+                               &chal_flags,
+                               &challenge_blob, 8);
+                       if (!ok) {
+                               DEBUG(1, ("Failed to short parse "
+                                       "the NTLMSSP Challenge: (#2)\n"));
+                       }
+               }
+
+               if (!ok) {
+                       dump_data(2, reply.data, reply.length);
+                       return NT_STATUS_INVALID_PARAMETER;
+               }
        }
 
        if (chal_flags & NTLMSSP_TARGET_TYPE_SERVER) {